mrjoy-bundler-audit 0.3.3 → 0.3.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 61f5df0b26d555b3c6090841a2e650dc5727dfc8
-  data.tar.gz: 2b8d065557c8713ced0d20ece4733656def2c4e1
+  metadata.gz: d6b9ab49f8c28f5409240c762d440a51472ed981
+  data.tar.gz: e9befa665dd527051744e7edd7706cbece60d636
 SHA512:
-  metadata.gz: 43deec103a419b873f440cffcab2e681a3dc2f7810588d57d78efb180ab46c902e9b31888aab6dd8793620a97a4bf5e3775b5f404a80d6cb535d74622538ec94
-  data.tar.gz: dd7976caed4e730d05d6d45dc5db2c5b7c65b97930112c401a2e5eecf561549ae2ab677bf741cdae2a9f1b3dba694a87d0edd48967f3b416975220ee60ecc380
+  metadata.gz: d64dfbf30d2801b6c89be762b840cd9b676a26355883dc3eab09ed6b4d2721e0184457c8372407f50b4962b4f488690fe49d7a558fd6a8acb24e1ea8f5b7dd2f
+  data.tar.gz: c090e2cc9dc19c62564aa3d56a3aa2a7cac6a6606dca9440bfcef2b1f12a0d2507a5051b911382e31022ffc19ccaa2e69def3bf9223222717fdc3e2cebfee0c8

data/.gitignore

@@ -1,9 +1,8 @@
-Gemfile.lock
+/Gemfile.lock
 doc/
 coverage/
 .yardoc/
 pkg/
-spec/bundle/*/Gemfile.lock
 spec/bundle/*/.bundle/
 vendor/bundle/
 tmp/

data/.travis.yml

@@ -5,3 +5,5 @@ rvm:
   - 2.0.0
   - 2.1.0
   - 2.1.1
+  - rbx-2.2.6
+  - jruby-1.7.11

data/ChangeLog.md

@@ -1,3 +1,13 @@
+### mrjoy-0.3.4 / 2014-04-16
+
+* Integrate upstream changes from `gut_vendored_db`.  This eliminates the
+  internal copy of the database entirely and automatically downloads one if
+  needed.
+* Fix several bugs in upstream branch, and make test cases more robust.
+* Include integration test results in coverage analysis.
+* Improve code coverage.
+* Improve Travis integration.
+
 ### mrjoy-0.3.3 / 2014-04-15
 
 * Fix development-mode code loading issue.

data/Gemfile

@@ -11,5 +11,5 @@ group :development do
   gem 'rubygems-tasks', '~> 0.2', :require => false
   gem 'rspec',          '~> 2.4', :require => false
   gem 'yard',           '~> 0.8', :require => false
-  gem 'simplecov',      '~> 0.7', :require => false
+  gem 'simplecov',      '~> 0.7', :require => false, :platform => [:ruby_19, :ruby_20, :ruby_21]
 end

data/Rakefile

@@ -3,21 +3,13 @@
 require 'rubygems'
 
 begin
-  require 'bundler'
+  require 'bundler/setup'
 rescue LoadError => e
   warn e.message
   warn "Run `gem install bundler` to install Bundler."
   exit -1
 end
 
-begin
-  Bundler.setup(:default, :development)
-rescue Bundler::BundlerError => e
-  warn e.message
-  warn "Run `bundle install` to install missing gems."
-  exit e.status_code
-end
-
 require 'rake'
 require 'time'
 
@@ -50,8 +42,18 @@ namespace :spec do
   task :bundle do
     root = 'spec/bundle'
 
-    %w[secure unpatched_gems insecure_sources].each do |bundle|
+# Skip this test on any Ruby below 1.9.3.
+version = RUBY_VERSION.split(/\./).map(&:to_i)
+if((version[0] == 1 && version[1] >= 9 && version[2] >= 3) || (version[0] >= 2))
+    chdir(File.join(root,"secure")) do
+      FileUtils.rm("Gemfile.lock") if(File.exist?("Gemfile.lock"))
+      sh 'BUNDLE_BIN_PATH="" BUNDLE_GEMFILE="" RUBYOPT="" bundle install --path ../../../vendor/bundle'
+    end
+end
+
+    %w[unpatched_gems insecure_sources].each do |bundle|
       chdir(File.join(root,bundle)) do
+        FileUtils.rm("Gemfile.lock") if(File.exist?("Gemfile.lock"))
         sh 'BUNDLE_BIN_PATH="" BUNDLE_GEMFILE="" RUBYOPT="" bundle install --path ../../../vendor/bundle'
       end
     end

data/lib/bundler/audit/cli.rb

@@ -39,6 +39,9 @@ module Bundler
         scanner    = Scanner.new
         vulnerable = false
 
+        # attempt update the database before doing a scan
+        scanner.database.update!
+
         scanner.scan(:ignore => options.ignore) do |result|
           vulnerable = true
 

data/lib/bundler/audit/database.rb

@@ -33,14 +33,8 @@ module Bundler
       # Git URL of the ruby-advisory-db
       URL = 'https://github.com/rubysec/ruby-advisory-db.git'
 
-      # Default path to the ruby-advisory-db
-      VENDORED_PATH =  File.expand_path(File.join(File.dirname(__FILE__),'..','..','..','data','ruby-advisory-db'))
-
-      # Timestamp for when the database was last updated
-      VENDORED_TIMESTAMP = Time.parse(File.read("#{VENDORED_PATH}.ts")).utc
-
       # Path to the user's copy of the ruby-advisory-db
-      USER_PATH = File.expand_path(File.join(ENV['HOME'],'.local','share','ruby-advisory-db'))
+      PATH = File.expand_path(File.join(ENV['HOME'],'.local','share','ruby-advisory-db'))
 
       # The path to the advisory database
       attr_reader :path
@@ -66,23 +60,54 @@ module Bundler
       # The default path for the database.
       #
       # @return [String]
-      #   The path to the database directory.
+      #   The path to the database directory. Defaults to {PATH}.
       #
       def self.path
-        if File.directory?(USER_PATH)
-          t1 = Dir.chdir(USER_PATH) { Time.parse(`git log --pretty="%cd" -1`) }
-          t2 = VENDORED_TIMESTAMP
+        @@path ||= PATH
+      end
 
-          if t1 >= t2 then USER_PATH
-          else             VENDORED_PATH
-          end
+      #
+      # Sets the default path for the database.
+      #
+      # @return [String]
+      #   The new default path for the database.
+      #
+      def self.path=(new_path)
+        @@path = new_path
+      end
+
+      #
+      # Downloads the database.
+      #
+      # @return [Boolean]
+      #   Specifies whether the download was successful.
+      #
+      # @since 0.4.0
+      #
+      def self.install!
+        system 'git', 'clone', URL, path
+      end
+
+      #
+      # Updates the user's ruby-advisory-db.
+      #
+      # @return [Boolean]
+      #   Specifies whether the update was successful.
+      #
+      # @see #update!
+      #
+      # @since 0.3.0
+      #
+      def self.update!
+        if File.directory?(File.join(path, '.git'))
+          new(path).update!
         else
-          VENDORED_PATH
+          install!
         end
       end
 
       #
-      # Updates the ruby-advisory-db.
+      # Updates the database.
       #
       # @return [Boolean]
       #   Specifies whether the update was successful.
@@ -90,18 +115,26 @@ module Bundler
       # @note
       #   Requires network access.
       #
-      # @since 0.3.0
+      # @see 0.4.0
       #
-      def self.update!
-        if File.directory?(USER_PATH)
-          Dir.chdir(USER_PATH) do
-            system 'git', 'pull', 'origin', 'master'
-          end
-        else
-          system 'git', 'clone', URL, USER_PATH
+      def update!
+        Dir.chdir(@path) do
+          system 'git', 'pull', 'origin', 'master'
         end
       end
 
+      #
+      # Determines when the database was last updated.
+      #
+      # @return [Time]
+      #   The time of the last update.
+      #
+      # @since 0.4.0
+      #
+      def last_updated
+        Dir.chdir(@path) { Time.parse(`git log -1 --format=%ad`) }
+      end
+
       #
       # Enumerates over every advisory in the database.
       #

data/lib/bundler/audit/version.rb

@@ -20,6 +20,6 @@
 module Bundler
   module Audit
     # bundler-audit version
-    VERSION = '0.3.3'
+    VERSION = '0.3.4'
   end
 end

data/mrjoy-bundler-audit.gemspec

@@ -26,13 +26,6 @@ Gem::Specification.new do |gem|
   gem.files = `git ls-files`.split($/)
   gem.files = glob[gemspec['files']] if gemspec['files']
 
-  # add paths from data/ruby-advisory-db/
-  gem.files += Dir.chdir('data/ruby-advisory-db') do
-    `git ls-files`.split($/).map do |sub_path|
-      File.join('data','ruby-advisory-db',sub_path)
-    end
-  end
-
   gem.executables = gemspec.fetch('executables') do
     glob['bin/*'].map { |path| File.basename(path) }
   end

data/spec/advisory_spec.rb

@@ -2,11 +2,16 @@ require 'spec_helper'
 require 'bundler/audit/database'
 require 'bundler/audit/advisory'
 
-describe Bundler::Audit::Advisory do
-  let(:root) { Bundler::Audit::Database::VENDORED_PATH }
+describe Advisory do
+  before(:suite) do
+    Database.update!
+  end
+
+  let(:root) { "spec/fixtures" }
   let(:gem)  { 'actionpack' }
   let(:id)   { 'OSVDB-84243' }
-  let(:path) { File.join(root,'gems',gem,"#{id}.yml") }
+  let(:path) { File.join(root,"#{id}.yml") }
+
   let(:an_unaffected_version) do
     Bundler::Audit::Advisory.load(path).unaffected_versions.map { |version_rule|
       # For all the rules, get the individual constraints out and see if we

data/spec/bundle/insecure_sources/Gemfile.lock

@@ -0,0 +1,98 @@
+GIT
+  remote: git://github.com/rails/jquery-rails.git
+  revision: c7c8365987f65953f62e2d207083021bf616a6fc
+  tag: v2.2.1
+  specs:
+    jquery-rails (2.2.1)
+      railties (>= 3.0, < 5.0)
+      thor (>= 0.14, < 2.0)
+
+GEM
+  remote: http://rubygems.org/
+  specs:
+    actionmailer (3.2.12)
+      actionpack (= 3.2.12)
+      mail (~> 2.4.4)
+    actionpack (3.2.12)
+      activemodel (= 3.2.12)
+      activesupport (= 3.2.12)
+      builder (~> 3.0.0)
+      erubis (~> 2.7.0)
+      journey (~> 1.0.4)
+      rack (~> 1.4.5)
+      rack-cache (~> 1.2)
+      rack-test (~> 0.6.1)
+      sprockets (~> 2.2.1)
+    activemodel (3.2.12)
+      activesupport (= 3.2.12)
+      builder (~> 3.0.0)
+    activerecord (3.2.12)
+      activemodel (= 3.2.12)
+      activesupport (= 3.2.12)
+      arel (~> 3.0.2)
+      tzinfo (~> 0.3.29)
+    activeresource (3.2.12)
+      activemodel (= 3.2.12)
+      activesupport (= 3.2.12)
+    activesupport (3.2.12)
+      i18n (~> 0.6)
+      multi_json (~> 1.0)
+    arel (3.0.3)
+    builder (3.0.4)
+    erubis (2.7.0)
+    hike (1.2.3)
+    i18n (0.6.9)
+    journey (1.0.4)
+    json (1.8.1)
+    mail (2.4.4)
+      i18n (>= 0.4.0)
+      mime-types (~> 1.16)
+      treetop (~> 1.4.8)
+    mime-types (1.25.1)
+    multi_json (1.9.2)
+    polyglot (0.3.4)
+    rack (1.4.5)
+    rack-cache (1.2)
+      rack (>= 0.4)
+    rack-ssl (1.3.4)
+      rack
+    rack-test (0.6.2)
+      rack (>= 1.0)
+    rails (3.2.12)
+      actionmailer (= 3.2.12)
+      actionpack (= 3.2.12)
+      activerecord (= 3.2.12)
+      activeresource (= 3.2.12)
+      activesupport (= 3.2.12)
+      bundler (~> 1.0)
+      railties (= 3.2.12)
+    railties (3.2.12)
+      actionpack (= 3.2.12)
+      activesupport (= 3.2.12)
+      rack-ssl (~> 1.3.2)
+      rake (>= 0.8.7)
+      rdoc (~> 3.4)
+      thor (>= 0.14.6, < 2.0)
+    rake (10.3.0)
+    rdoc (3.12.2)
+      json (~> 1.4)
+    sprockets (2.2.2)
+      hike (~> 1.2)
+      multi_json (~> 1.0)
+      rack (~> 1.0)
+      tilt (~> 1.1, != 1.3.0)
+    sqlite3 (1.3.9)
+    thor (0.19.1)
+    tilt (1.4.1)
+    treetop (1.4.15)
+      polyglot
+      polyglot (>= 0.3.1)
+    tzinfo (0.3.39)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  jquery-rails!
+  rails (= 3.2.12)
+  sqlite3

data/spec/bundle/secure/Gemfile.lock

@@ -0,0 +1,90 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    actionmailer (4.1.0)
+      actionpack (= 4.1.0)
+      actionview (= 4.1.0)
+      mail (~> 2.5.4)
+    actionpack (4.1.0)
+      actionview (= 4.1.0)
+      activesupport (= 4.1.0)
+      rack (~> 1.5.2)
+      rack-test (~> 0.6.2)
+    actionview (4.1.0)
+      activesupport (= 4.1.0)
+      builder (~> 3.1)
+      erubis (~> 2.7.0)
+    activemodel (4.1.0)
+      activesupport (= 4.1.0)
+      builder (~> 3.1)
+    activerecord (4.1.0)
+      activemodel (= 4.1.0)
+      activesupport (= 4.1.0)
+      arel (~> 5.0.0)
+    activesupport (4.1.0)
+      i18n (~> 0.6, >= 0.6.9)
+      json (~> 1.7, >= 1.7.7)
+      minitest (~> 5.1)
+      thread_safe (~> 0.1)
+      tzinfo (~> 1.1)
+    arel (5.0.1.20140414130214)
+    builder (3.2.2)
+    erubis (2.7.0)
+    hike (1.2.3)
+    i18n (0.6.9)
+    jquery-rails (3.1.0)
+      railties (>= 3.0, < 5.0)
+      thor (>= 0.14, < 2.0)
+    json (1.8.1)
+    mail (2.5.4)
+      mime-types (~> 1.16)
+      treetop (~> 1.4.8)
+    mime-types (1.25.1)
+    minitest (5.3.3)
+    multi_json (1.9.2)
+    polyglot (0.3.4)
+    rack (1.5.2)
+    rack-test (0.6.2)
+      rack (>= 1.0)
+    rails (4.1.0)
+      actionmailer (= 4.1.0)
+      actionpack (= 4.1.0)
+      actionview (= 4.1.0)
+      activemodel (= 4.1.0)
+      activerecord (= 4.1.0)
+      activesupport (= 4.1.0)
+      bundler (>= 1.3.0, < 2.0)
+      railties (= 4.1.0)
+      sprockets-rails (~> 2.0)
+    railties (4.1.0)
+      actionpack (= 4.1.0)
+      activesupport (= 4.1.0)
+      rake (>= 0.8.7)
+      thor (>= 0.18.1, < 2.0)
+    rake (10.3.0)
+    sprockets (2.12.1)
+      hike (~> 1.2)
+      multi_json (~> 1.0)
+      rack (~> 1.0)
+      tilt (~> 1.1, != 1.3.0)
+    sprockets-rails (2.1.3)
+      actionpack (>= 3.0)
+      activesupport (>= 3.0)
+      sprockets (~> 2.8)
+    sqlite3 (1.3.9)
+    thor (0.19.1)
+    thread_safe (0.3.3)
+    tilt (1.4.1)
+    treetop (1.4.15)
+      polyglot
+      polyglot (>= 0.3.1)
+    tzinfo (1.1.0)
+      thread_safe (~> 0.1)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  jquery-rails
+  rails (~> 4.1.0)
+  sqlite3