bootprint 0.2.0

data/lib/bootprint/collectors/operating_system.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+require "etc"
+require "rbconfig"
+
+module Bootprint
+  module Collectors
+    module OperatingSystem
+      TOOLS = %w[git make gcc clang cmake pkg-config docker podman].freeze
+
+      module_function
+
+      def key = "operating_system"
+
+      def capture
+        {
+          "name" => RbConfig::CONFIG["host_os"],
+          "cpu" => RbConfig::CONFIG["host_cpu"],
+          "processors" => Etc.nprocessors,
+          "capabilities" => TOOLS.to_h { |tool| [tool, executable?(tool)] },
+          "ruby_headers" => header_state,
+          "ci" => ci_provider
+        }
+      end
+
+      def executable?(name)
+        extensions = Gem.win_platform? ? ENV.fetch("PATHEXT", ".EXE;.BAT;.CMD").split(";") : [""]
+        ENV.fetch("PATH", "").split(File::PATH_SEPARATOR).any? do |directory|
+          extensions.any? do |extension|
+            File.executable?(File.join(directory, "#{name}#{extension}"))
+          end
+        end
+      end
+
+      def header_state
+        path = RbConfig::CONFIG["rubyhdrdir"]
+        { "present" => path && File.directory?(path), "path" => path && Sanitizer.path(path) }
+      end
+
+      def ci_provider
+        return "github" if ENV["GITHUB_ACTIONS"] == "true"
+        return "gitlab" if ENV["GITLAB_CI"] == "true"
+        return "circleci" if ENV["CIRCLECI"] == "true"
+        return "generic" if ENV.key?("CI")
+
+        nil
+      end
+    end
+  end
+end

data/lib/bootprint/collectors/rails.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+
+module Bootprint
+  module Collectors
+    module Rails
+      module_function
+
+      def key = "rails"
+
+      def capture
+        return {} unless defined?(::Rails) && ::Rails.respond_to?(:application) && ::Rails.application
+
+        application = ::Rails.application
+        config = application.config
+        {
+          "version" => ::Rails.version,
+          "environment" => ::Rails.env.to_s,
+          "framework_defaults" => value(config, :loaded_config_version)&.to_s,
+          "eager_load" => value(config, :eager_load),
+          "cache_classes" => value(config, :cache_classes),
+          "autoload_paths" => paths(value(config, :autoload_paths)),
+          "eager_load_paths" => paths(value(config, :eager_load_paths)),
+          "adapters" => adapters(config),
+          "active_storage_service" => nested_value(config, :active_storage, :service)&.to_s,
+          "action_cable_adapter" => action_cable_adapter,
+          "mail_delivery_method" => nested_value(config, :action_mailer, :delivery_method)&.to_s,
+          "time_zone" => value(config, :time_zone)&.to_s,
+          "logging" => logging(config),
+          "public_file_server_enabled" => nested_value(config, :public_file_server, :enabled),
+          "assets_compile" => nested_value(config, :assets, :compile),
+          "secret_key_base" => secret_metadata(application),
+          "initializers" => sanitized_initializers
+        }
+      end
+
+      def adapters(config)
+        {
+          "active_job" => nested_value(config, :active_job, :queue_adapter)&.to_s,
+          "cache" => Array(value(config, :cache_store)).first&.to_s,
+          "session" => value(config, :session_store)&.to_s,
+          "database" => database_adapter
+        }.compact
+      end
+
+      def database_adapter
+        return unless defined?(ActiveRecord::Base)
+
+        ActiveRecord::Base.connection_db_config.adapter
+      rescue StandardError
+        nil
+      end
+
+      def action_cable_adapter
+        return unless defined?(ActionCable) && ActionCable.respond_to?(:server)
+
+        ActionCable.server.config.cable.fetch("adapter", nil)
+      rescue StandardError
+        nil
+      end
+
+      def logging(config)
+        logger = defined?(::Rails.logger) ? ::Rails.logger : nil
+        { "level" => logger&.level, "class" => logger&.class&.name, "log_tags" => Array(value(config, :log_tags)).map(&:to_s) }
+      end
+
+      def secret_metadata(application)
+        present = !application.secret_key_base.to_s.empty?
+        source = ENV.key?("SECRET_KEY_BASE") ? "environment" : "credentials_or_configuration"
+        { "present" => present, "source" => source, "redacted" => true }
+      rescue StandardError
+        { "present" => false, "source" => "unavailable", "redacted" => true }
+      end
+
+      def sanitized_initializers
+        return [] unless defined?(Bootprint::RailsState)
+
+        Array(Bootprint::RailsState.initializers).map do |initializer|
+          initializer.merge("name" => Sanitizer.path(initializer["name"]))
+        end
+      end
+
+      def paths(value)
+        Array(value).map { |path| Sanitizer.path(path) }.sort
+      end
+
+      def value(object, method)
+        object.public_send(method) if object.respond_to?(method)
+      rescue StandardError
+        nil
+      end
+
+      def nested_value(object, *methods)
+        methods.reduce(object) { |current, method| current && value(current, method) }
+      end
+    end
+  end
+end

data/lib/bootprint/collectors/runtime.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require "rbconfig"
+
+module Bootprint
+  module Collectors
+    module Runtime
+      module_function
+
+      def key = "runtime"
+
+      def capture
+        {
+          "engine" => defined?(RUBY_ENGINE) ? RUBY_ENGINE : "ruby",
+          "engine_version" => defined?(RUBY_ENGINE_VERSION) ? RUBY_ENGINE_VERSION : RUBY_VERSION,
+          "ruby_version" => RUBY_VERSION,
+          "patchlevel" => RUBY_PATCHLEVEL,
+          "platform" => RUBY_PLATFORM,
+          "architecture" => RbConfig::CONFIG["arch"],
+          "host_os" => RbConfig::CONFIG["host_os"],
+          "host_cpu" => RbConfig::CONFIG["host_cpu"],
+          "description" => RUBY_DESCRIPTION,
+          "debug_build" => debug_build?,
+          "supported" => Gem::Version.new(RUBY_VERSION) >= Gem::Version.new("3.1.0")
+        }
+      end
+
+      def debug_build?
+        args = RbConfig::CONFIG["configure_args"].to_s
+        args.include?("--enable-debug") || args.include?("--with-assertions")
+      end
+    end
+  end
+end

data/lib/bootprint/collectors/toolchain.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+require "rubygems"
+
+module Bootprint
+  module Collectors
+    module Toolchain
+      module_function
+
+      def key = "toolchain"
+
+      def capture
+        bundler_version = if defined?(Bundler::VERSION)
+                            Bundler::VERSION
+                          else
+                            Gem.loaded_specs["bundler"]&.version&.to_s ||
+                              Gem::Specification.find_all_by_name("bundler").map(&:version).max&.to_s
+                          end
+        { "rubygems_version" => Gem::VERSION, "bundler_version" => bundler_version }
+      end
+    end
+  end
+end

data/lib/bootprint/configuration.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module Bootprint
+  class Configuration
+    DEFAULT_ENV_PATTERNS = [
+      /\A(?:DATABASE|REDIS|RAILS|RACK|BUNDLE|SECRET_KEY_BASE|RAILS_MASTER_KEY)(?:_|\z)/,
+      /_URL\z/,
+      /_HOST\z/,
+      /_PORT\z/
+    ].freeze
+
+    attr_accessor :environment_patterns, :environment_names, :ignored_environment_names,
+                  :required_environment_names, :optional_environment_names, :privacy,
+                  :slow_initializer_threshold_ms, :profile_boot, :plugin_strict,
+                  :redaction_patterns, :redaction_safe_list, :expected_platforms
+
+    def initialize
+      @environment_patterns = DEFAULT_ENV_PATTERNS.dup
+      @environment_names = []
+      @ignored_environment_names = []
+      @required_environment_names = []
+      @optional_environment_names = []
+      @privacy = :standard
+      @slow_initializer_threshold_ms = 500.0
+      @profile_boot = ENV["BOOTPRINT_PROFILE_BOOT"] == "1"
+      @plugin_strict = false
+      @redaction_patterns = %w[TOKEN SECRET PASSWORD PRIVATE_KEY AUTHORIZATION COOKIE]
+      @redaction_safe_list = %w[checksum sha256 digest]
+      @expected_platforms = []
+    end
+
+    def capture_environment?(name)
+      return false if ignored_environment_names.include?(name)
+
+      environment_names.include?(name) || environment_patterns.any? { |pattern| pattern.match?(name) }
+    end
+  end
+end

data/lib/bootprint/diagnosis.rb

@@ -0,0 +1,95 @@
+# frozen_string_literal: true
+
+module Bootprint
+  class Diagnosis
+    REPORT_SCHEMA_VERSION = 1
+    attr_reader :source, :target, :policy, :only, :minimum_severity
+
+    def initialize(source, target, policy: Policy.new, only: nil, minimum_severity: nil)
+      @source = source
+      @target = target
+      @policy = policy
+      @only = only
+      @minimum_severity = minimum_severity
+    end
+
+    def run
+      started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      findings = Rules.evaluate(source, target, policy:, only:, minimum_severity:)
+      findings.concat(plugin_failure_findings(target))
+      duration = (Process.clock_gettime(Process::CLOCK_MONOTONIC) - started) * 1_000
+      Report.new(source:, target:, findings:, policy:, duration_ms: duration.round(3))
+    end
+
+    private
+
+    def plugin_failure_findings(snapshot)
+      warnings = snapshot.data.dig("capture", "warnings") || []
+      warnings.filter_map do |warning|
+        next unless warning["plugin"]
+
+        severity = policy.plugin_strict? ? :error : :warning
+        Rules::Finding.new(
+          rule_id: "plugin-capture-failure",
+          title: "Bootprint plugin failed",
+          category: :plugins,
+          severity:,
+          summary: "Plugin #{warning['plugin']} could not capture its data.",
+          cause: warning["message"],
+          impact: "Plugin-specific diagnostics are incomplete; the core snapshot remains valid.",
+          evidence: warning,
+          remediation: { "summary" => "Update, reconfigure, or disable the failing plugin.", "commands" => [], "files" => [] },
+          references: [], metadata: { "built_in" => true }, suppressed: false
+        )
+      end
+    end
+  end
+
+  class Report
+    attr_reader :source, :target, :findings, :policy, :duration_ms
+
+    def initialize(source:, target:, findings:, policy:, duration_ms:)
+      @source = source
+      @target = target
+      @findings = findings.sort_by { |finding| [-Rules::SEVERITY_ORDER.fetch(finding.severity), finding.rule_id] }
+      @policy = policy
+      @duration_ms = duration_ms
+    end
+
+    def blocking? = findings.any? { |finding| finding.blocking?(policy) }
+
+    def counts
+      Rules::Rule::SEVERITIES.to_h do |severity|
+        count = findings.count { |finding| finding.severity == severity && !finding.suppressed }
+        [severity.to_s, count]
+      end
+    end
+
+    def to_h
+      {
+        "schema_version" => Diagnosis::REPORT_SCHEMA_VERSION,
+        "source" => snapshot_metadata(source),
+        "target" => snapshot_metadata(target),
+        "findings" => findings.map(&:to_h),
+        "summary" => counts.merge("blocking" => blocking?),
+        "execution" => {
+          "bootprint_version" => VERSION,
+          "duration_ms" => duration_ms,
+          "network_requests" => 0,
+          "policy" => policy.path
+        }
+      }
+    end
+
+    private
+
+    def snapshot_metadata(snapshot)
+      {
+        "name" => snapshot.name,
+        "schema_version" => snapshot.data["schema_version"],
+        "generated_at" => snapshot.data["generated_at"],
+        "bootprint_version" => snapshot.data["bootprint_version"]
+      }
+    end
+  end
+end

data/lib/bootprint/diff.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module Bootprint
+  class Diff
+    Change = Struct.new(:path, :local, :target, keyword_init: true) do
+      def to_h
+        { "path" => path, "local" => local, "target" => target }
+      end
+    end
+
+    IGNORED_PATHS = %w[generated_at bootprint_version environment.name].freeze
+
+    attr_reader :local, :target, :allowed_paths
+
+    def initialize(local, target, allowed_paths: [])
+      @local = local.is_a?(Snapshot) ? local.data : local
+      @target = target.is_a?(Snapshot) ? target.data : target
+      @allowed_paths = allowed_paths
+    end
+
+    def changes
+      @changes ||= compare(local, target).reject { |change| ignored?(change.path) }
+    end
+
+    def allowed?(path)
+      allowed_paths.any? { |pattern| File.fnmatch?(pattern, path, File::FNM_PATHNAME | File::FNM_EXTGLOB) }
+    end
+
+    private
+
+    def compare(left, right, path = nil)
+      if left.is_a?(Hash) && right.is_a?(Hash)
+        (left.keys | right.keys).sort.flat_map do |key|
+          compare(left[key], right[key], [path, key].compact.join("."))
+        end
+      elsif left != right
+        [Change.new(path:, local: left, target: right)]
+      else
+        []
+      end
+    end
+
+    def ignored?(path)
+      IGNORED_PATHS.include?(path) || path == "capture" || path.start_with?("capture.") || allowed?(path)
+    end
+  end
+end

data/lib/bootprint/docker.rb

@@ -0,0 +1,149 @@
+# frozen_string_literal: true
+
+require "json"
+require "open3"
+require "securerandom"
+
+module Bootprint
+  module Docker
+    class Client
+      CAPTURE_SCRIPT = <<~'RUBY'
+        require "json"
+        require "rbconfig"
+        require "rubygems"
+        require "openssl"
+        require "psych"
+        packages = []
+        if File.file?("/var/lib/dpkg/status")
+          packages = File.read("/var/lib/dpkg/status").scan(/^Package:\s*(\S+)/).flatten
+        elsif File.file?("/lib/apk/db/installed")
+          packages = File.read("/lib/apk/db/installed").scan(/^P:(\S+)/).flatten
+        end
+        gems = Gem::Specification.map do |spec|
+          [spec.name, {
+            "version" => spec.version.to_s,
+            "platform" => spec.platform.to_s,
+            "native_extensions" => !spec.extensions.empty?,
+            "missing_extensions" => spec.respond_to?(:missing_extensions?) && spec.missing_extensions?,
+            "prerelease" => spec.version.prerelease?
+          }]
+        end.sort.to_h
+        output = {
+          "runtime" => {
+            "engine" => defined?(RUBY_ENGINE) ? RUBY_ENGINE : "ruby",
+            "engine_version" => defined?(RUBY_ENGINE_VERSION) ? RUBY_ENGINE_VERSION : RUBY_VERSION,
+            "ruby_version" => RUBY_VERSION,
+            "patchlevel" => RUBY_PATCHLEVEL,
+            "platform" => RUBY_PLATFORM,
+            "architecture" => RbConfig::CONFIG["arch"],
+            "host_os" => RbConfig::CONFIG["host_os"],
+            "host_cpu" => RbConfig::CONFIG["host_cpu"],
+            "description" => RUBY_DESCRIPTION,
+            "debug_build" => RbConfig::CONFIG["configure_args"].to_s.include?("--enable-debug"),
+            "supported" => Gem::Version.new(RUBY_VERSION) >= Gem::Version.new("3.1.0")
+          },
+          "dependencies" => {
+            "toolchain" => {
+              "rubygems_version" => Gem::VERSION,
+              "bundler_version" => Gem.loaded_specs["bundler"]&.version&.to_s
+            },
+            "gems" => gems,
+            "lockfile" => { "platforms" => [] }
+          },
+          "native_libraries" => {
+            "openssl" => {
+              "compiled" => OpenSSL::OPENSSL_VERSION,
+              "runtime" => OpenSSL.const_defined?(:OPENSSL_LIBRARY_VERSION) ? OpenSSL::OPENSSL_LIBRARY_VERSION : OpenSSL::OPENSSL_VERSION
+            },
+            "libyaml" => Psych.libyaml_version.join("."),
+            "psych" => Psych::VERSION
+          },
+          "configuration" => {
+            "environment_variables" => ENV.keys.sort.to_h { |name| [name, true] },
+            "required_environment_variables" => [],
+            "optional_environment_variables" => [],
+            "rails" => {}
+          },
+          "filesystem" => {
+            "path_separator" => File::SEPARATOR,
+            "case_sensitive" => true,
+            "symlinks_supported" => File.respond_to?(:symlink),
+            "temporary_directory" => { "present" => File.directory?("/tmp"), "writable" => File.writable?("/tmp"), "path" => "/tmp" },
+            "required_directories" => { "current" => { "present" => File.directory?(Dir.pwd), "writable" => File.writable?(Dir.pwd), "path" => Dir.pwd } }
+          },
+          "operating_system" => {
+            "name" => RbConfig::CONFIG["host_os"],
+            "cpu" => RbConfig::CONFIG["host_cpu"],
+            "capabilities" => {
+              "make" => ENV.fetch("PATH", "").split(File::PATH_SEPARATOR).any? { |dir| File.executable?(File.join(dir, "make")) },
+              "gcc" => ENV.fetch("PATH", "").split(File::PATH_SEPARATOR).any? { |dir| File.executable?(File.join(dir, "gcc")) }
+            },
+            "ruby_headers" => { "present" => File.directory?(RbConfig::CONFIG["rubyhdrdir"].to_s) },
+            "system_packages" => packages.sort
+          }
+        }
+        STDOUT.write(JSON.generate(output))
+      RUBY
+
+      def available?
+        _out, _error, status = Open3.capture3("docker", "version", "--format", "{{.Client.Version}}")
+        status.success?
+      rescue Errno::ENOENT
+        false
+      end
+
+      def capture(image, label: nil, privacy: :standard)
+        raise DockerError, "Docker is unavailable; install Docker and ensure its daemon is running" unless available?
+
+        metadata = image_metadata(image)
+        container_name = "bootprint-#{SecureRandom.hex(8)}"
+        stdout, stderr, status = Open3.capture3(
+          "docker", "run", "--name", container_name, "--rm", "--network", "none", "--read-only", "--entrypoint", "ruby",
+          image.to_s, "-e", CAPTURE_SCRIPT
+        )
+        raise DockerError, "Could not inspect image #{image}: #{Sanitizer.text(stderr.strip)}" unless status.success?
+
+        environment = JSON.parse(stdout)
+        environment["name"] = label || image.to_s
+        environment["container"] = metadata
+        Snapshot.new(
+          "schema_version" => Schema::CURRENT_VERSION,
+          "generated_at" => Time.now.utc.iso8601,
+          "bootprint_version" => VERSION,
+          "environment" => Sanitizer.recursive(environment, privacy:),
+          "capture" => { "privacy" => privacy.to_s, "source" => "docker", "network" => "disabled" }
+        )
+      rescue JSON::ParserError => error
+        raise DockerError, "Image #{image} returned invalid inspection data: #{error.message}"
+      ensure
+        cleanup_container(container_name) if container_name
+      end
+
+      private
+
+      def image_metadata(image)
+        stdout, stderr, status = Open3.capture3("docker", "image", "inspect", image.to_s)
+        raise DockerError, "Docker image #{image} is not available locally: #{Sanitizer.text(stderr.strip)}" unless status.success?
+
+        details = JSON.parse(stdout).first || {}
+        config = details["Config"] || {}
+        {
+          "image" => image.to_s,
+          "image_id" => details["Id"],
+          "architecture" => details["Architecture"],
+          "os" => details["Os"],
+          "working_directory" => config["WorkingDir"],
+          "entrypoint" => Array(config["Entrypoint"]),
+          "command" => Array(config["Cmd"]),
+          "declared_environment_variables" => Array(config["Env"]).map { |entry| entry.split("=", 2).first }.sort
+        }
+      end
+
+      def cleanup_container(name)
+        Open3.capture3("docker", "rm", "--force", name.to_s)
+      rescue Errno::ENOENT
+        nil
+      end
+    end
+  end
+end

data/lib/bootprint/doctor.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Bootprint
+  class Doctor
+    def initialize(policy: Policy.new)
+      @policy = policy
+    end
+
+    def run(snapshot = Snapshot.capture(label: "current"))
+      Diagnosis.new(snapshot, snapshot, policy: @policy).run
+    end
+  end
+end

data/lib/bootprint/errors.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Bootprint
+  class Error < StandardError; end
+  class InvalidSnapshotError < Error; end
+  class ConfigurationError < Error; end
+  class DockerError < Error; end
+  class PluginError < Error; end
+end

data/lib/bootprint/formatters/human.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+module Bootprint
+  module Formatters
+    class Human
+      COLORS = { critical: 31, error: 31, warning: 33, info: 36 }.freeze
+
+      def initialize(report, color: false)
+        @report = report
+        @color = color && !ENV.key?("NO_COLOR")
+      end
+
+      def render
+        output = "Bootprint Diagnosis\nSource: #{@report.source.name}\nTarget: #{@report.target.name}\n"
+        active = @report.findings
+        if active.empty?
+          output << "\nNo findings at the selected severity.\n"
+        else
+          active.each { |finding| output << render_finding(finding) }
+        end
+        output << "\nSummary:\n"
+        @report.counts.each { |severity, count| output << format("  %-8s %d\n", severity, count) if count.positive? }
+        output << "  blocking #{@report.blocking? ? 'yes' : 'no'}\n"
+        output
+      end
+
+      private
+
+      def render_finding(finding)
+        label = finding.suppressed ? "SUPPRESSED" : finding.severity.to_s.upcase
+        heading = format("%-10s %s", colorize(label, finding.severity), finding.title)
+        body = "\n\n#{heading}\n          #{finding.summary}\n"
+        body << "\n          Why: #{finding.cause}\n" if finding.cause
+        body << "          Impact: #{finding.impact}\n" if finding.impact
+        evidence = finding.evidence || {}
+        body << "          Evidence: #{compact(evidence)}\n" unless evidence.empty?
+        remediation = finding.remediation || {}
+        if remediation["summary"]
+          body << "\n          Recommended fix:\n          #{remediation['summary']}\n"
+          Array(remediation["commands"]).each { |command| body << "          $ #{command}\n" }
+        end
+        body << "          Suppression: #{finding.suppression_reason}\n" if finding.suppressed
+        body
+      end
+
+      def compact(value)
+        value.inspect.gsub(/\s+/, " ")
+      end
+
+      def colorize(text, severity)
+        @color ? "\e[#{COLORS.fetch(severity)}m#{text}\e[0m" : text
+      end
+    end
+  end
+end

data/lib/bootprint/formatters/json.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Bootprint
+  module Formatters
+    class JSON
+      def initialize(report) = @report = report
+      def render = "#{::JSON.pretty_generate(@report.to_h)}\n"
+    end
+  end
+end

data/lib/bootprint/formatters/markdown.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Bootprint
+  module Formatters
+    class Markdown
+      def initialize(report) = @report = report
+
+      def render
+        output = +"# Bootprint Diagnosis\n\n"
+        output << "| Source | Target | Blocking |\n|---|---|---|\n"
+        output << "| #{@report.source.name} | #{@report.target.name} | #{@report.blocking? ? 'Yes' : 'No'} |\n\n"
+        @report.findings.each do |finding|
+          output << "## #{finding.severity.to_s.upcase}: #{finding.title}\n\n"
+          output << "#{finding.summary}\n\n"
+          output << "**Impact:** #{finding.impact}\n\n" if finding.impact
+          if finding.remediation&.fetch("summary", nil)
+            output << "**Recommended fix:** #{finding.remediation['summary']}\n\n"
+            Array(finding.remediation["commands"]).each { |command| output << "```console\n#{command}\n```\n\n" }
+          end
+        end
+        output << "## Summary\n\n"
+        output << @report.counts.map { |severity, count| "- #{severity}: #{count}" }.join("\n") << "\n"
+        output
+      end
+    end
+  end
+end