#31442 [PATCH 0/5] 'guix health': a tool to report vulnerable packages

Message #14 received at 31442@debbugs.gnu.org (full text, mbox, reply):

Received: (at 31442) by debbugs.gnu.org; 14 May 2018 08:26:13 +0000
From debbugs-submit-bounces@debbugs.gnu.org Mon May 14 04:26:13 2018
Received: from localhost ([127.0.0.1]:33176 helo=debbugs.gnu.org)
	by debbugs.gnu.org with esmtp (Exim 4.84_2)
	(envelope-from <debbugs-submit-bounces@debbugs.gnu.org>)
	id 1fI8o8-0007ZY-Nw
	for submit@debbugs.gnu.org; Mon, 14 May 2018 04:26:12 -0400
Received: from eggs.gnu.org ([208.118.235.92]:46690)
 by debbugs.gnu.org with esmtp (Exim 4.84_2)
 (envelope-from <ludo@gnu.org>) id 1fI8o6-0007Yv-Ps
 for 31442@debbugs.gnu.org; Mon, 14 May 2018 04:26:11 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
 (envelope-from <ludo@gnu.org>) id 1fI8o0-0002um-R6
 for 31442@debbugs.gnu.org; Mon, 14 May 2018 04:26:05 -0400
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org
X-Spam-Level: 
X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_50 autolearn=disabled
 version=3.3.2
Received: from fencepost.gnu.org ([2001:4830:134:3::e]:60791)
 by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from <ludo@gnu.org>)
 id 1fI8ny-0002pB-EU; Mon, 14 May 2018 04:26:02 -0400
Received: from [193.50.110.240] (port=53312 helo=gnu.org)
 by fencepost.gnu.org with esmtpsa (TLS1.2:DHE_RSA_AES_256_CBC_SHA1:256)
 (Exim 4.82) (envelope-from <ludo@gnu.org>)
 id 1fI8nx-0007HI-Ld; Mon, 14 May 2018 04:26:02 -0400
From: Ludovic Courtès <ludo@gnu.org>
To: 31442@debbugs.gnu.org
Subject: [PATCH 4/5] profiles: Record fixed vulnerabilities as properties of
 entries.
Date: Mon, 14 May 2018 10:25:49 +0200
Message-Id: <20180514082550.1131-4-ludo@gnu.org>
X-Mailer: git-send-email 2.17.0
In-Reply-To: <20180514082550.1131-1-ludo@gnu.org>
References: <20180514082550.1131-1-ludo@gnu.org>
X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic]
X-Received-From: 2001:4830:134:3::e
X-Spam-Score: -5.0 (-----)
X-Debbugs-Envelope-To: 31442
Cc: Ludovic Courtès <ludo@gnu.org>
X-BeenThere: debbugs-submit@debbugs.gnu.org
X-Mailman-Version: 2.1.18
Precedence: list
List-Id: <debbugs-submit.debbugs.gnu.org>
List-Unsubscribe: <https://debbugs.gnu.org/cgi-bin/mailman/options/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=unsubscribe>
List-Archive: <https://debbugs.gnu.org/cgi-bin/mailman/private/debbugs-submit/>
List-Post: <mailto:debbugs-submit@debbugs.gnu.org>
List-Help: <mailto:debbugs-submit-request@debbugs.gnu.org?subject=help>
List-Subscribe: <https://debbugs.gnu.org/cgi-bin/mailman/listinfo/debbugs-submit>, 
 <mailto:debbugs-submit-request@debbugs.gnu.org?subject=subscribe>
Errors-To: debbugs-submit-bounces@debbugs.gnu.org
Sender: "Debbugs-submit" <debbugs-submit-bounces@debbugs.gnu.org>
X-Spam-Score: -6.0 (------)

* guix/profiles.scm (package->manifest-entry)[fixed, cpe-name]
[cpe-version]: New variables.
Populate the 'properties' field based on these.
* tests/profiles.scm ("manifest-entry-properties"): New test.
---
 guix/profiles.scm  | 23 ++++++++++++++++++++++-
 tests/profiles.scm | 22 ++++++++++++++++++++++
 2 files changed, 44 insertions(+), 1 deletion(-)

diff --git a/guix/profiles.scm b/guix/profiles.scm
index 02828e465..6656cf356 100644
--- a/guix/profiles.scm
+++ b/guix/profiles.scm
@@ -286,6 +286,17 @@ file name."
 (define* (package->manifest-entry package #:optional (output "out")
                                   #:key (parent (delay #f)))
   "Return a manifest entry for the OUTPUT of package PACKAGE."
+  (define fixed
+    (append (package-patched-vulnerabilities package)
+            (or (assq-ref (package-properties package) 'lint-hidden-cve)
+                '())))
+
+  (define cpe-name
+    (assoc-ref (package-properties package) 'cpe-name))
+
+  (define cpe-version
+    (assoc-ref (package-properties package) 'cpe-version))
+
   ;; For each dependency, keep a promise pointing to its "parent" entry.
   (letrec* ((deps  (map (match-lambda
                           ((label package)
@@ -303,7 +314,17 @@ file name."
                      (dependencies (delete-duplicates deps))
                      (search-paths
                       (package-transitive-native-search-paths package))
-                     (parent parent))))
+                     (parent parent)
+                     (properties `(,@(if cpe-name
+                                         `((cpe-name . ,cpe-name))
+                                         '())
+                                   ,@(if cpe-version
+                                         `((cpe-version . ,cpe-version))
+                                         '())
+                                   ,@(if (null? fixed)
+                                         '()
+                                         `((fixed-vulnerabilities
+                                            . ,fixed))))))))
     entry))
 
 (define (packages->manifest packages)
diff --git a/tests/profiles.scm b/tests/profiles.scm
index c668c2b83..8152e4b68 100644
--- a/tests/profiles.scm
+++ b/tests/profiles.scm
@@ -439,6 +439,28 @@
                                                     #:locales? #f)))
         (return #f)))))
 
+(test-equal "manifest-entry-properties"
+  '(((fixed-vulnerabilities "CVE-2015-1234"))
+    ((fixed-vulnerabilities "CVE-2016-1234" "CVE-2018-4567"))
+    ((cpe-name . "Pi")
+     (fixed-vulnerabilities "CVE-2002-0001"))
+    ())
+  (let ((p1 (dummy-package "pi"
+              (source (dummy-origin
+                       (patches (list "/a/b/pi-CVE-2015-1234.patch"))))))
+        (p2 (dummy-package "pi"
+              (source (dummy-origin
+                       (patches
+                        (list
+                         "/a/b/pi-CVE-2016-1234-CVE-2018-4567.patch"))))))
+        (p3 (dummy-package "pi" (source (dummy-origin))
+                           (properties
+                            '((cpe-name . "Pi")
+                              (lint-hidden-cve "CVE-2002-0001")))))
+        (p4 (dummy-package "pi" (source (dummy-origin)))))
+    (map (compose manifest-entry-properties package->manifest-entry)
+         (list p1 p2 p3 p4))))
+
 (test-assertm "no collision"
   ;; Here we have an entry that is "lowered" (its 'item' field is a store file
   ;; name) and another entry (its 'item' field is a package) that is
-- 
2.17.0

Send a report that this bug log contains spam.