dependagrab 0.1.1 → 0.1.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 11c4874c224ffa840474e0afefdd5f01450901397ed59a4ff49520cc20120825
-  data.tar.gz: df168d0f83220a9e44a0994a16555d871677477e5ffff07a9f7e29af111f8ee4
+  metadata.gz: cd35ef0ade298a293c34027c89bfdb351610bf2ccbaf2101492153b9e605b20a
+  data.tar.gz: 5645015e5ba4cb5ec457001cc9125e10f50c5fe9458b53b79b117b23f3549065
 SHA512:
-  metadata.gz: f79942b317b628f1635284afe4c6059dc0efd9b3d10527078f63a54fc741be37b53f20667dd385a17053eaaa0b49b76892a9a48d897baa81253640cb27ba105f
-  data.tar.gz: 18644e8f2c54b2a6c3e942fe4259a97543674889b54a8b5983f4c411ccdb565f65257a4035c6906c5b662827bce0fab403ad317f9ee1ed163432f6d3e915b8fc
+  metadata.gz: d73f942dd1c05ef4b923e874917d5d3d7752e2a7e85755f431161d41d02a5d9e82d98dd60af6ad92cada4203dfd7433b474af5c7244ce0e386b899156c3a249b
+  data.tar.gz: a4a915c49803c23ab5a782d905833243f720070fc440a4e285f43386da9560a6db9358c112396e3c8e0895b782f18eaece6e3c68472ad81107677c2677489cae

data/CHANGE_LOG.md

@@ -1,3 +1,16 @@
+# V0.1.5
+Fix when there is no CWE present
+
+# V0.1.4 (broken)
+Fix when there is no CWE present
+Improve error logging
+
+# V0.1.3
+Fix add support for repos names with dots in them.
+
+# V0.1.2
+Fix require paths
+
 # V0.1.1
 Fix executable config
 

data/Dockerfile

@@ -0,0 +1,8 @@
+FROM ruby:3.0.3-slim-bullseye
+
+COPY pkg/*.gem .
+
+RUN gem install *.gem
+
+ENTRYPOINT ["dependagrab"]
+CMD ["--help"]

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    dependagrab (0.1.1)
+    dependagrab (0.1.5)
       graphql-client (= 0.17.0)
 
 GEM
@@ -46,14 +46,14 @@ GEM
     zeitwerk (2.5.1)
 
 PLATFORMS
-  ruby
+  x86_64-linux
 
 DEPENDENCIES
-  bundler (~> 1.17)
+  bundler (~> 2.2)
   dependagrab!
   pry (~> 0.14)
   rake (~> 10.0)
   rspec (~> 3.0)
 
 BUNDLED WITH
-   1.17.2
+   2.2.32

data/dependagrab.gemspec

@@ -39,7 +39,7 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib", "static"]
 
   spec.add_dependency "graphql-client", "0.17.0"
-  spec.add_development_dependency "bundler", "~> 1.17"
+  spec.add_development_dependency "bundler", "~> 2.2"
   spec.add_development_dependency "rake", "~> 10.0"
   spec.add_development_dependency "rspec", "~> 3.0"
   spec.add_development_dependency "pry", "~> 0.14"

data/lib/dependagrab/cli.rb

@@ -2,9 +2,6 @@ require 'getoptlong'
 require 'dependagrab'
 
 module Dependagrab
-  require 'dependagrab/console_writer'
-  require 'dependagrab/file_writer'
-
   class CLI
     def self.start
       opts = GetoptLong.new(
@@ -13,7 +10,6 @@ module Dependagrab
         [ '--output', '-o', GetoptLong::REQUIRED_ARGUMENT ],
       )
 
-
       options = {}
 
       begin
@@ -40,8 +36,8 @@ module Dependagrab
       end
 
       repo = ARGV.shift
-      _, options[:owner], options[:repo] = repo.split /([\w-]+)\/([\w-]+)$/
-      if  options[:owner].nil? || options[:repo].nil?
+      _, options[:owner], options[:repo] = repo.split /([\w_-]+)\/([\w._-]+)$/
+      if options[:owner].nil? || options[:repo].nil?
         STDERR.puts "Invalid REPO format"
         exit 1
       end
@@ -60,7 +56,8 @@ module Dependagrab
           puts "#{result[:alerts].count} dependency warnings written to '#{options.fetch(:output)}'"
         rescue => e
           STDERR.puts "Failed to write file '#{options.fetch(:output)}'"
-          STDERR.puts e.message
+          STDERR.puts "#{e.message} (set DEBUG=true for detailed backtrace)"
+          STDERR.puts e.backtrace if ENV['DEBUG']
           exit 1
         end
       else

data/lib/dependagrab/file_writer.rb

@@ -59,13 +59,18 @@ module Dependagrab
           version: alert[:vulnerable_version_range],
           issueType: "VULNERABILITY",
         },
-        mappings: [
-          {
-            mappingType: "CWE",
-            value: alert[:cwe][4..],
-          }
-        ]
-      }
+      }.tap do |finding|
+        # Only add CWE when present
+        if alert[:cwe]
+          finding[:mappings] = [
+            {
+              mappingType: "CWE",
+              value: alert[:cwe][4..],
+            }
+          ]
+        end
+
+      end
     end
   end
 end

data/lib/dependagrab/gh_api.rb

@@ -4,7 +4,7 @@ require "graphql/client/http"
 module Dependagrab
   module GHAPI
     GRAPHQL_API = "https://api.github.com/graphql"
-    SCHEMA_PATH = "static/gh_schema.json"
+    SCHEMA_PATH = File.join(File.expand_path('../../', File.dirname(__FILE__)), "static/gh_schema.json")
 
     # Configure GraphQL endpoint using the basic HTTP network adapter.
     HTTP = GraphQL::Client::HTTP.new(GRAPHQL_API) do

data/lib/dependagrab/github_client.rb

@@ -1,5 +1,3 @@
-require './lib/dependagrab/gh_api'
-
 module Dependagrab
   class GithubClient
 

data/lib/dependagrab/version.rb

@@ -1,3 +1,3 @@
 module Dependagrab
-  VERSION = "0.1.1"
+  VERSION = "0.1.5"
 end

data/lib/dependagrab.rb

@@ -1,6 +1,9 @@
 module Dependagrab
   require "dependagrab/version"
+  require 'dependagrab/gh_api'
   require "dependagrab/github_client"
+  require "dependagrab/console_writer"
+  require "dependagrab/file_writer"
 
   class Error < StandardError; end
   class MissingConfigError < Dependagrab::Error; end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: dependagrab
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.1.5
 platform: ruby
 authors:
 - Dave Elliott
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2021-12-01 00:00:00.000000000 Z
+date: 2021-12-06 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: graphql-client
@@ -30,14 +30,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.17'
+        version: '2.2'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.17'
+        version: '2.2'
 - !ruby/object:Gem::Dependency
   name: rake
   requirement: !ruby/object:Gem::Requirement
@@ -92,6 +92,7 @@ files:
 - ".rspec"
 - ".travis.yml"
 - CHANGE_LOG.md
+- Dockerfile
 - Gemfile
 - Gemfile.lock
 - LICENSE
@@ -132,7 +133,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.2.32
 signing_key: 
 specification_version: 4
 summary: Utility for extracting dependency warnings from GitHub