lockfile_audit 0.1.1 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5b293cff106a2d7cdf8214e512965e2d0155ac740d7d26eec9840c8d9634a795
-  data.tar.gz: f02bf84ccdd70a87cf2d7bada32ffcba4b343ff553cbc016a7c152df5e7b9f81
+  metadata.gz: f54f64dd70f25a217ccd3c29bd0ea985f420f3d947074a57b033f711950d08df
+  data.tar.gz: bd3edfc6cb9c823955aa7e81d895f36f1207a95475c4dd4b5cd4c05ec29ff496
 SHA512:
-  metadata.gz: 69158c852ae5786a6181f4df7f871accf34a3d42868a153a818186398bd188aad0f3d5ba7ebdfb1049d1c10692f0e57861f294f3ae6d335d0c5df4c9f88d7772
-  data.tar.gz: 3491f0634af4b8caea832f88e7eadfc5b71cf4e4db0dca98ae57a60e27a8c011125b7c42f66e9b2f1f98a8afa782279f4e249d561920e3f0697931f6a9bd6e3b
+  metadata.gz: 46de93997759fd386a2f11bf5aa6520c640299b4faaf8d0f4a7e82cfebfc52617f5577b25bffa9ffece99bd589108905d3dcea5ed10112a9134a193fbf344e30
+  data.tar.gz: 0342efc962e99aab09b78aa848028eab33bafbba188f148227607ac90ab015b370ab5b1029711e2de01cd256286e311100aeeb2bffbe9f7ae1d61ecc5b785339

data/CHANGELOG.md

@@ -7,6 +7,27 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.0] - 2026-10-04
+
+### Changed
+- `VulnerabilityCollector` now scans the lockfile in-process with `Bundler::Audit::Scanner` instead of spawning the `bundle-audit` executable in a child Ruby process. The subprocess approach failed with `Bundler::GemfileError ... is already registered` on machines that have more than one Bundler version installed, because two copies of Bundler were loaded into the child process.
+
+- `bundler-audit` must now be in the host application's bundle (add `gem "bundler-audit"` to your Gemfile). Having it installed globally or on `PATH` is no longer enough. Passing audit_json: still works without bundler-audit.
+
+- A failing scan now raises `Errors::BundlerAuditFailed` with the underlying error and a hint to run `bundle-audit update`. `Errors::BundlerAuditNotInstalled` is raised only when `bundler-audit` cannot be loaded.
+
+### Removed
+- The subprocess code path and its environment scrubbing (`BUNDLER_ENV_KEYS`, `Open3`, `RbConfig.ruby` / `Gem.bin_path` lookup).
+
+### Notes
+- Insecure-source findings from `bundler-audit` (for example an `http://` gem source) are not included in `audit.vulnerabilities`; only advisories for unpatched gems are reported.
+
+## [0.1.2] - 2026-10-03
+
+### Changed
+
+- Source moved to the `betterwebsites/ror_gems` monorepo. Gemspec metadata
+  links updated. No code changes.
 ## [0.1.1] - 2026-09-26
 
 ### Fixed

data/README.md

@@ -10,6 +10,8 @@ feed into a dashboard, or archive for compliance.
 
 ## Installation
 
+`gem "bundler-audit"` must be in the app's Gemfile
+
 Add it to your Gemfile:
 
     gem "lockfile_audit"
@@ -116,16 +118,12 @@ All errors inherit from `LockfileAudit::Errors::Error`.
 
 ## Development
 
+    cd lockfile_audit
     bundle install
-    bundle exec rspec
-    bundle exec standardrb
-
-To release a new version:
+    bundle exec rake
 
-1. Bump `lib/lockfile_audit/version.rb`.
-2. Update `CHANGELOG.md`.
-3. `gem build lockfile_audit.gemspec`
-4. `gem push lockfile_audit-<version>.gem`
+To release, see the "Releasing a gem" section of the
+[repo README](../README.md).
 
 ## License
 

data/lib/lockfile_audit/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module LockfileAudit
-  VERSION = "0.1.1"
+  VERSION = "0.2.0"
 end

data/lib/lockfile_audit/vulnerability_collector.rb

@@ -1,53 +1,29 @@
 # frozen_string_literal: true
 
 require "json"
-require "open3"
 
 module LockfileAudit
   # Collects vulnerability findings from bundler-audit.
   #
-  # Either accepts pre-computed JSON (via +audit_json:+) or shells out to
-  # `bundle-audit check --format json` when no JSON is supplied.
+  # Either accepts pre-computed JSON (via +audit_json:+) or, when no JSON is
+  # supplied, scans the lockfile in-process using Bundler::Audit::Scanner.
   #
-  # The normalizer tolerates both known shapes of bundler-audit output:
+  # Scanning in-process (instead of spawning the `bundle-audit` executable)
+  # avoids loading a second copy of Bundler in a child Ruby process, which
+  # fails on machines that have more than one Bundler version installed.
+  #
+  # Requirements for the in-process scan:
+  #   - the `bundler-audit` gem must be in the host application's bundle
+  #   - the advisory database must exist (run `bundle-audit update`)
+  #
+  # For +audit_json:+ the normalizer tolerates both known shapes of
+  # bundler-audit JSON output:
   #   - a bare Array of findings (newer versions)
   #   - a Hash with a "results" key holding the Array (older versions)
-  #
-  # When invoking the CLI, the collector runs with a scrubbed environment so
-  # the parent process's Bundler state (BUNDLE_*, RUBYOPT, etc.) does not leak
-  # into the subprocess. It also invokes bundler-audit using the *current*
-  # Ruby (RbConfig.ruby) and the exact installed binary path (Gem.bin_path),
-  # so the subprocess uses the same Ruby as the host application.
   class VulnerabilityCollector
-    # Environment variables that must not leak into the bundler-audit
-    # subprocess. These are set by Bundler when the parent process is a
-    # bundled Ruby app, and their presence forces Bundler to re-initialize
-    # inside the subprocess.
-    BUNDLER_ENV_KEYS = %w[
-      BUNDLE_GEMFILE
-      BUNDLE_BIN_PATH
-      BUNDLE_PATH
-      BUNDLE_APP_CONFIG
-      BUNDLE_FROZEN
-      BUNDLE_WITHOUT
-      BUNDLE_WITH
-      BUNDLE_JOBS
-      BUNDLE_RETRY
-      BUNDLER_VERSION
-      BUNDLER_ORIG_BUNDLE_BIN_PATH
-      BUNDLER_ORIG_BUNDLE_GEMFILE
-      BUNDLER_ORIG_BUNDLE_PATH
-      BUNDLER_ORIG_MANPATH
-      BUNDLER_ORIG_RUBYLIB
-      BUNDLER_ORIG_RUBYOPT
-      RUBYOPT
-      RUBYLIB
-    ].freeze
-
     # @param audit_json [String, nil] raw JSON from bundler-audit; if nil,
-    #   bundler-audit is invoked directly
-    # @param lockfile_path [String, Pathname] path to Gemfile.lock; used to
-    #   derive the working directory for the CLI invocation
+    #   the lockfile is scanned in-process
+    # @param lockfile_path [String, Pathname] path to Gemfile.lock
     def initialize(audit_json: nil, lockfile_path: "Gemfile.lock")
       @audit_json = audit_json
       @lockfile_path = lockfile_path
@@ -55,13 +31,14 @@ module LockfileAudit
 
     # @return [Array<Hash>] normalized findings, each with keys
     #   `:gem`, `:version`, `:criticality`, `:description`
-    # @raise [Errors::InvalidAuditJson] if the JSON cannot be parsed
-    # @raise [Errors::BundlerAuditNotInstalled] if bundler-audit is missing
+    # @raise [Errors::InvalidAuditJson] if the supplied JSON cannot be parsed
+    # @raise [Errors::BundlerAuditNotInstalled] if bundler-audit cannot be loaded
+    # @raise [Errors::BundlerAuditFailed] if the in-process scan raises
     def call
-      raw = @audit_json || run_bundler_audit
-      return [] if raw.nil? || raw.strip.empty?
+      return scan_in_process if @audit_json.nil?
+      return [] if @audit_json.strip.empty?
 
-      parsed = JSON.parse(raw)
+      parsed = JSON.parse(@audit_json)
       results = parsed.is_a?(Hash) ? parsed.fetch("results", []) : parsed
 
       Array(results).map { |finding| normalize(finding) }
@@ -71,62 +48,42 @@ module LockfileAudit
 
     private
 
-    def run_bundler_audit
-      stdout, stderr, status = invoke
-      return stdout if usable?(stdout, status)
+    # Runs Bundler::Audit::Scanner against the lockfile and maps unpatched
+    # gem results onto the public schema. Insecure-source results (e.g. an
+    # http:// gem source) have no gem or advisory and are skipped.
+    def scan_in_process
+      require "bundler/audit/scanner"
 
-      raise_not_installed(stderr)
-    rescue Gem::Exception
-      raise Errors::BundlerAuditNotInstalled,
-        "bundler-audit is not installed for #{RbConfig.ruby} (#{RUBY_VERSION}). " \
-        "Install it for this Ruby: gem install bundler-audit"
-    rescue Errno::ENOENT
-      raise_not_installed(nil)
-    end
+      path = File.expand_path(@lockfile_path)
+      scanner = Bundler::Audit::Scanner.new(File.dirname(path), File.basename(path))
 
-    def invoke
-      Open3.capture3(
-        clean_env,
-        RbConfig.ruby, bundle_audit_path, "check", "--format", "json",
-        chdir: File.dirname(File.expand_path(@lockfile_path))
-      )
-    end
+      results = []
+      scanner.scan { |result| results << result }
 
-    def bundle_audit_path
-      Gem.bin_path("bundler-audit", "bundle-audit")
-    end
+      results.filter_map do |result|
+        next unless result.is_a?(Bundler::Audit::Results::UnpatchedGem)
 
-    # Builds an environment hash that removes the inherited Bundler state.
-    # Passing nil as the value to Open3 unsets the variable in the child.
-    def clean_env
-      BUNDLER_ENV_KEYS.each_with_object({}) do |key, acc|
-        acc[key] = nil
+        advisory = result.advisory
+        {
+          gem: result.gem.name,
+          version: result.gem.version.to_s,
+          criticality: advisory.criticality&.to_s&.capitalize,
+          description: advisory.title
+        }
       end
+    rescue LoadError
+      raise Errors::BundlerAuditNotInstalled,
+        "bundler-audit is not available. " \
+        "Add `gem \"bundler-audit\"` to your Gemfile and run `bundle install`."
+    rescue Errors::Error
+      raise
+    rescue => e
+      raise Errors::BundlerAuditFailed,
+        "bundler-audit scan failed: #{e.class}: #{e.message}. " \
+        "Run `bundle-audit update` to fetch the advisory database."
     end
 
-    # bundler-audit exits 1 when it finds vulnerabilities (that's success for
-    # us), and 0 when the lockfile is clean. Any other exit code, or empty
-    # stdout, means the invocation didn't produce usable output.
-    def usable?(stdout, status)
-      return false if stdout.nil? || stdout.strip.empty?
-      return true if [0, 1].include?(status.exitstatus)
-
-      false
-    end
-
-    # Raises BundlerAuditNotInstalled with an actionable message that
-    # includes stderr when available.
-    def raise_not_installed(stderr)
-      detail = stderr.to_s.strip
-      message = "bundler-audit could not be invoked. " \
-                "Ensure the `bundler-audit` gem is installed for this Ruby " \
-                "(#{RUBY_VERSION}) and run `bundle-audit update` to fetch the " \
-                "advisory database."
-      message += " stderr: #{detail}" unless detail.empty?
-      raise Errors::BundlerAuditNotInstalled, message
-    end
-
-    # Maps a single bundler-audit finding onto the public schema.
+    # Maps a single bundler-audit JSON finding onto the public schema.
     #
     # bundler-audit has used slightly different key names across versions, so
     # we fall back to nested "advisory" keys when the top-level ones are absent.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: lockfile_audit
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.2.0
 platform: ruby
 authors:
 - behnam1369
@@ -27,12 +27,13 @@ files:
 - lib/lockfile_audit/report.rb
 - lib/lockfile_audit/version.rb
 - lib/lockfile_audit/vulnerability_collector.rb
-homepage: https://github.com/Behnam1369/lockfile_audit
+homepage: https://github.com/betterwebsites/ror_gems/tree/main/lockfile_audit
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://github.com/Behnam1369/lockfile_audit
-  changelog_uri: https://github.com/Behnam1369/lockfile_audit/blob/main/CHANGELOG.md
+  homepage_uri: https://github.com/betterwebsites/ror_gems/tree/main/lockfile_audit
+  source_code_uri: https://github.com/betterwebsites/ror_gems/tree/main/lockfile_audit
+  changelog_uri: https://github.com/betterwebsites/ror_gems/blob/main/lockfile_audit/CHANGELOG.md
 rdoc_options: []
 require_paths:
 - lib