carthage_audit 0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 681d8acf114b7d9ff780a03291932f411e4328d51130f99ebb4c74261e527987
+  data.tar.gz: d510f649677fa2b37b7db350561b8b64e8305ed62f6d9401adb70a064fcb1e80
+SHA512:
+  metadata.gz: d6b0b48438128a4a1d0a7873f1819b30783ac3aa22df35562b01dc3250c5235af5ec177a0be9a92abcbe41215fed8d012ebc97d261486c8f86222bbec06f9b27
+  data.tar.gz: 361e46359e5000100ccef806bda5ff3e49ba999ac128dbc2ae04622fd1c6c05e4b98fd4bed45595832f6eacefc99502776e33bbb33910273c7ef93b79a9d05e2

data/Gemfile

@@ -0,0 +1,6 @@
+source "https://rubygems.org"
+
+gem "gem-release", group: :development
+gem "oga"
+gem "rspec", group: :test
+gem "solargraph", group: :development

data/bin/carthage_audit

@@ -0,0 +1,6 @@
+#!/usr/bin/env ruby
+
+require 'carthage_audit'
+
+audit = Auditor.new
+audit.run # TODO: delete this because it's useless?

data/lib/carthage_audit.rb

@@ -0,0 +1,76 @@
+require "net/http"
+require "oga"
+
+class Auditor
+  Dependency = Struct.new(:name, :current_version, :new_version, :update_info_list) do
+    # Returns first update note that includes security keyword
+    def vulnerability_info
+      # word_pattern = /(vulnerability|vulnerabilities|security|attack|advisory|unsecure|critical|alert|emergency)/
+      word_pattern = /(fix|bug)/ # TODO: for testing purposes
+      update_info_list.detect { |i| i.downcase.match?(word_pattern) }
+    end
+  end
+
+  def get_repo(name)
+    File.open("Cartfile", "r") do |f|
+      f.each_line do |line|
+        next unless matches = line.match(/^github "(.*#{Regexp.quote(name)})"/)
+
+        repo = matches[1]
+        return repo
+      end
+    end
+
+    "#{name}/#{name}" # repo assumed to `github.com/repo_name/repo_name`
+  end
+
+  def make_request(url)
+    uri = URI(url)
+
+    _ = Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https") do |http|
+      req = Net::HTTP::Get.new(uri.request_uri)
+      http.request(req)
+    end
+  end
+
+  def get_list_items_from_html(html)
+    update_info = []
+
+    d = Oga.parse_html(html)
+    _ = d.css(".markdown-body").each do |n|
+      n.css("ul li").each do |l|
+        update_info << l.text
+      end
+    end
+
+    update_info
+  end
+
+  def run
+    # TODO: replace w/ actual call to carthage outdated
+    IO.popen("cat carthage_output.txt", "r") do |output|
+      output.readlines.each do |line|
+        next unless matches = line.match(/^(.*?) "(.*?)".*Latest: "(.*?)"/)
+
+        name = matches[1]
+        current_version = matches[2]
+        new_version = matches[3]
+
+        dep = Dependency.new(name, current_version, new_version, nil)
+
+        next if current_version == new_version
+
+        repo = get_repo(name)
+        url = "https://github.com/#{repo}/releases/tag/#{new_version}"
+        resp = make_request(url)
+
+        next unless resp.code == "200"
+
+        update_info_list = get_list_items_from_html(resp.body)
+        dep.update_info_list = update_info_list
+
+        yield dep
+      end
+    end
+  end
+end

data/spec/audit_spec.rb

@@ -0,0 +1,9 @@
+require "carthage_audit"
+
+RSpec.describe Auditor do
+  describe "some_func" do
+    it "does stuff" do
+      expect(true).to be(true)
+    end
+  end
+end

metadata

@@ -0,0 +1,65 @@
+--- !ruby/object:Gem::Specification
+name: carthage_audit
+version: !ruby/object:Gem::Version
+  version: '0.1'
+platform: ruby
+authors:
+- Joshua Kaplan
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2019-06-20 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.8'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.8'
+description: This tool is just a simple checker to see if newer versions of Carthage
+  dependencies use keywords that relate to security
+email:
+- yhkaplan@gmail.com
+executables:
+- carthage_audit
+extensions: []
+extra_rdoc_files: []
+files:
+- Gemfile
+- bin/carthage_audit
+- lib/carthage_audit.rb
+- spec/audit_spec.rb
+homepage: http://github.com/yhkaplan/carthage_audit
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 3.0.1
+signing_key: 
+specification_version: 4
+summary: A tool to check if newer versions of Carthage dependencies contain security
+  updates
+test_files:
+- spec/audit_spec.rb