capistrano-bundle_audit 0.0.5 → 0.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: ca42a3f923f09faf37b1e4cb274d53524176a3ca
-  data.tar.gz: 3d3132fb283a947522ec726cdc90b8df7bb76ed0
+  metadata.gz: 6ea145f68dcfb596d6495508735045ecfe748e4e
+  data.tar.gz: c1654a55b6549127642a85d61a3fa727e414bdf0
 SHA512:
-  metadata.gz: cf4b39f01a537d92fbd525db06ba6ae989566c6787d71a7d7777ff7d197a9d015dd77b90860ae665e008bc25f16d1c5fb1d3d6aa1353ba040b3701f691368e72
-  data.tar.gz: 2a070fc5abcd49788407d180c5d2b05f761ee28b1fb1810b668d914b832d839a1be75ed3394b241cc61aa36cff71851c178af1f1083961ac5d474f1532424ff3
+  metadata.gz: 1eab1bf796254f443ed10da984355c6947a3ce1fd4807f0c87a353c9b3cd0bd5be4f20b8629427cb8f4f346d6d40de1f794efc6b05d8d61dd5cb37baf68173dc
+  data.tar.gz: ab18c1f831df47f7a3fc33ef27e7436bbc74ee3866940d450ed408e8f4644bd95b9290b4469da32e690bdd8f9531157d823f8a0fd5e15ca6e8596f95f0ad9309

data/README.md

@@ -24,6 +24,15 @@ require 'capistrano/bundle_audit'
 
 After `deploy:updating` (and before the deployed code is released as the current version), `bundle-audit` will be run against the pushed code. If any vulnerabilities are discovered, the release will be aborted.
 
+### Skipping auditing
+
+In some cases, it is impossible to update to secure versions of dependencies. In these cases, you can relax the audit by either:
+
+- setting the `SKIP_BUNDLE_AUDIT` environment variable before deploying (e.g. `SKIP_BUNDLE_AUDIT=true bundle exec cap production deploy`)
+- ignore specific vulnerabilities by setting the Capistrano variable `bundle_audit_ignore` in `config/deploy.rb` or similar (e.g. `set :bundle_audit_ignore, %w(CVE-123456)` to ignore the vulnerability reported in CVE-123456)
+
+
+
 ## Contributing
 
 1. Fork it ( https://github.com/[my-github-username]/capistrano-bundle_audit/fork )

data/capistrano-bundle_audit.gemspec

@@ -18,7 +18,7 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib"]
 
   spec.add_dependency "capistrano", "~> 3.0"
-  spec.add_dependency "bundler-audit"
+  spec.add_dependency "bundler-audit", "~> 0.5"
 
   spec.add_development_dependency "bundler", "~> 1.6"
   spec.add_development_dependency "rake", "~> 10.0"

data/lib/capistrano/bundle_audit/version.rb

@@ -1,5 +1,5 @@
 module Capistrano
   module BundleAudit
-    VERSION = "0.0.5"
+    VERSION = "0.1.0"
   end
 end

data/lib/capistrano/tasks/bundle_audit.rake

@@ -3,7 +3,7 @@ require 'tmpdir'
 
 namespace :deploy do
   namespace :check do
-    desc "Audit the Gemfile/Gemfile.lock for known vulnerabilities"
+    desc "Audit the Gemfile.lock for known vulnerabilities"
     task :bundle_audit do
       on roles(:app), in: :sequence do |host|
 
@@ -11,14 +11,13 @@ namespace :deploy do
         Dir.mktmpdir do |dir|
           Dir.chdir dir do
             download! "#{release_path}/Gemfile.lock", "Gemfile.lock"
-            download! "#{release_path}/Gemfile", "Gemfile"
 
             run_locally do
+              capture %(echo 'gem "bundler-audit"' > Gemfile)
 
-              # Get the latest vulnerability information
-              execute "bundle-audit update &> /dev/null"
-
-              bundle_audit_output = capture "bundle-audit #{"--ignore #{Shellwords.join(fetch(:bundle_audit_ignore))}" unless fetch(:bundle_audit_ignore).empty? }"
+              bundle_audit_output = Bundler.with_clean_env do
+                capture "bundle-audit check --update #{"--ignore #{Shellwords.join(fetch(:bundle_audit_ignore))}" unless fetch(:bundle_audit_ignore).empty? }"
+              end
 
               # bundle-audit includes failures for both gem vulnerabilities
               # and insecure gem sources, and offers no way to distinguish those cases.
@@ -27,7 +26,11 @@ namespace :deploy do
               # a solution available to upgrade. If no solution is available deploy
               # will still be allowed.
               if bundle_audit_output =~ /Solution: upgrade to/
+                warn bundle_audit_output
                 fail "Bundle audit failed; update your vulnerable dependencies before deploying"
+              else
+                debug bundle_audit_output
+                info bundle_audit_output.split("\n").last
               end
             end
           end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: capistrano-bundle_audit
 version: !ruby/object:Gem::Version
-  version: 0.0.5
+  version: 0.1.0
 platform: ruby
 authors:
 - Chris Beer
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2015-04-01 00:00:00.000000000 Z
+date: 2016-06-23 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: capistrano
@@ -28,16 +28,16 @@ dependencies:
   name: bundler-audit
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '0.5'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - ">="
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '0.5'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -102,7 +102,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.4.5
+rubygems_version: 2.6.4
 signing_key: 
 specification_version: 4
 summary: Audit a project's gem dependencies before deployment