package-audit 0.4.1 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 637173ee31a102187a23134942d6df2245d6b7785708747c85029d5fdf2045c0
-  data.tar.gz: d30d4aad7dd1ff9a39348db8125fe991e9877a537eec6962883885f788e79438
+  metadata.gz: 4c2f009e294663828a3055ac8b8facb3106251875a240f9abf74754747102cef
+  data.tar.gz: 0a11812a839205caa7793c5b34baf31006438b020e9f535ffe1fd5b3ee0333ab
 SHA512:
-  metadata.gz: 187e2559f65548b13eded61cbcc0679e4ddbf99e46484f7ce3a8ae1ddf71d8c095c224dab43aaf3366cc918105a8df4310a2991b69b1a64a23735bd20308f727
-  data.tar.gz: 1b452b5db99d6434d475b04adfa91ac4c49dd934211d160a4a9a4d49dafade42e59b7ac2a2162ba344169bc70f74632ffcd466dcfdef5dc99a7379dace932940
+  metadata.gz: 7e7a294008ddcb510e8335193ac013447c38b27a71f440325ae2221f5bd0dea29bf714a88e6089b451d50c64f24964da04215c5e54c74c0729fa37a3f277d44b
+  data.tar.gz: 29bb2f4dbef1bb9a6c38eb7d4b17c9aa299f943916765d05a02b14b8f48a0e8ce212bc834e4657285b99d9ba0eb33c80df479e907b673f13fa6834c098e8649e

data/lib/package/audit/cli.rb

@@ -15,6 +15,9 @@ module Package
       class_option Enum::Option::CONFIG,
                    aliases: '-c', banner: 'FILE',
                    desc: "Path to a custom configuration file, default: #{Const::File::CONFIG})"
+      class_option Enum::Option::ENVIRONMENT,
+                   aliases: '-e', repeatable: true,
+                   desc: 'Environment to be audited (repeat this flag for each environment)'
       class_option Enum::Option::TECHNOLOGY,
                    aliases: '-t', repeatable: true,
                    desc: 'Technology to be audited (repeat this flag for each technology)'

data/lib/package/audit/const/fields.rb

@@ -14,15 +14,13 @@ module Package
           risk_explanation
         ]
 
-        ALL = %i[name version latest_version latest_version_date groups vulnerabilities risk_type risk_explanation]
-        DEPRECATED = %i[name version latest_version latest_version_date groups]
-        OUTDATED = %i[name version latest_version latest_version_date groups]
-        VULNERABLE = %i[name version latest_version groups vulnerabilities]
+        DEFAULT = %i[name version latest_version latest_version_date groups vulnerabilities risk_type risk_explanation]
 
         # the names of these fields must match the instance variables in the Dependency class
         HEADERS = {
           name: 'Package',
           version: 'Version',
+          version_date: 'Version Date',
           latest_version: 'Latest',
           latest_version_date: 'Latest Date',
           groups: 'Groups',

data/lib/package/audit/enum/environment.rb

@@ -2,11 +2,15 @@ module Package
   module Audit
     module Enum
       module Environment
-        DEV = :development
-        TEST = :test
-        STAGING = :staging
-        PRODUCTION = :production
-        DEFAULT = :default
+        DEV = 'development'
+        TEST = 'test'
+        STAGING = 'staging'
+        PRODUCTION = 'production'
+        DEFAULT = 'default'
+
+        def self.all
+          constants.map { |key| Enum::Environment.const_get(key) }.sort
+        end
       end
     end
   end

data/lib/package/audit/enum/option.rb

@@ -5,6 +5,7 @@ module Package
         CONFIG = 'config'
         CSV = 'csv'
         CSV_EXCLUDE_HEADERS = 'exclude-headers'
+        ENVIRONMENT = 'environment'
         INCLUDE_IGNORED = 'include-ignored'
         TECHNOLOGY = 'technology'
       end

data/lib/package/audit/npm/npm_meta_data.rb

@@ -11,17 +11,23 @@ module Package
           @packages = packages
         end
 
-        def fetch
+        def fetch # rubocop:disable Metrics/AbcSize, Metrics/MethodLength
           threads = @packages.map do |package|
             Thread.new do
               response = Net::HTTP.get_response(URI.parse("#{REGISTRY_URL}/#{package.name}"))
-              raise response.error unless response.is_a?(Net::HTTPSuccess)
+              raise "Unable to fetch meta data for #{package.name} from #{REGISTRY_URL} (#{response.class})" unless
+                response.is_a?(Net::HTTPSuccess)
 
               json_package = JSON.parse(response.body, symbolize_names: true)
               update_meta_data(package, json_package)
+            rescue StandardError => e
+              Thread.current[:exception] = e
             end
           end
-          threads.each(&:join)
+          threads.each do |thread|
+            thread.join
+            raise thread[:exception] if thread[:exception]
+          end
           @packages
         end
 

data/lib/package/audit/npm/vulnerability_finder.rb

@@ -36,7 +36,7 @@ module Package
 
           @vuln_hash[full_name] = Package.new(name, version, 'node') unless @vuln_hash.key? full_name
           @vuln_hash[full_name].update vulnerabilities: @vuln_hash[full_name].vulnerabilities + [vulnerability]
-          @vuln_hash[full_name].update groups: @pkg_hash[parent_name].groups
+          @vuln_hash[full_name].update groups: @pkg_hash[parent_name].groups.map(&:to_s)
         end
       end
     end

data/lib/package/audit/npm/yarn_lock_parser.rb

@@ -1,3 +1,5 @@
+require_relative '../enum/environment'
+
 module Package
   module Audit
     module Npm
@@ -7,13 +9,17 @@ module Package
           @yarn_lock_path = yarn_lock_path
         end
 
-        def fetch(default_deps, dev_deps)
+        def fetch(default_deps, dev_deps) # rubocop:disable Metrics/MethodLength
           pkgs = []
           default_deps.merge(dev_deps).each do |dep_name, expected_version|
             pkg_block = fetch_package_block(dep_name, expected_version)
             version = fetch_package_version(dep_name, pkg_block)
             pks = Package.new(dep_name.to_s, version, 'node')
-            pks.update groups: dev_deps.key?(dep_name) ? %i[development] : %i[default development]
+            pks.update groups: if dev_deps.key?(dep_name)
+                                 [Enum::Environment::DEV]
+                               else
+                                 [Enum::Environment::DEFAULT, Enum::Environment::DEV]
+                               end
             pkgs << pks
           end
           pkgs

data/lib/package/audit/ruby/gem_collection.rb

@@ -31,27 +31,27 @@ module Package
           specs = BundlerSpecs.gemfile(@dir)
           pkgs = specs.map { |spec| Package.new(spec.name, spec.version, Enum::Technology::RUBY) }
           vulnerable_pkgs = VulnerabilityFinder.new(@dir).run
-          pkgs = GemMetaData.new(pkgs + vulnerable_pkgs).fetch.filter(&:risk?)
+          pkgs = GemMetaData.new(@dir, pkgs + vulnerable_pkgs).fetch.filter(&:risk?)
           DuplicatePackageMerger.new(pkgs).run
         end
 
         def deprecated
           specs = BundlerSpecs.gemfile(@dir)
           pkgs = specs.map { |spec| Package.new(spec.name, spec.version, Enum::Technology::RUBY) }
-          pkgs = GemMetaData.new(pkgs).fetch.filter(&:deprecated?)
+          pkgs = GemMetaData.new(@dir, pkgs).fetch.filter(&:deprecated?)
           DuplicatePackageMerger.new(pkgs).run
         end
 
         def outdated(include_implicit: false)
           specs = include_implicit ? BundlerSpecs.all(@dir) : BundlerSpecs.gemfile(@dir)
           pkgs = specs.map { |spec| Package.new(spec.name, spec.version, Enum::Technology::RUBY) }
-          pkgs = GemMetaData.new(pkgs).fetch.filter(&:outdated?)
+          pkgs = GemMetaData.new(@dir, pkgs).fetch.filter(&:outdated?)
           DuplicatePackageMerger.new(pkgs).run
         end
 
         def vulnerable
           pkgs = VulnerabilityFinder.new(@dir).run
-          pkgs = GemMetaData.new(pkgs).fetch.filter(&:vulnerable?)
+          pkgs = GemMetaData.new(@dir, pkgs).fetch.filter(&:vulnerable?)
           DuplicatePackageMerger.new(pkgs).run
         end
       end

data/lib/package/audit/ruby/gem_meta_data.rb

@@ -4,7 +4,8 @@ module Package
   module Audit
     module Ruby
       class GemMetaData
-        def initialize(pkgs)
+        def initialize(dir, pkgs)
+          @dir = dir
           @pkgs = pkgs
           @gem_hash = {}
         end
@@ -45,12 +46,16 @@ module Package
         end
 
         def assign_groups # rubocop:disable Metrics/AbcSize
-          definition = Bundler.definition
+          definition = Bundler::Definition.build Pathname("#{@dir}/Gemfile"), Pathname("#{@dir}/Gemfile.lock"), nil
+          Bundler.ui.level = 'error'
+          definition.resolve_remotely!
           groups = definition.groups.uniq.sort
           groups.each do |group|
             specs = definition.specs_for([group])
             specs.each do |spec|
-              @gem_hash[spec.name].update(groups: @gem_hash[spec.name].groups | [group]) if @gem_hash.key? spec.name
+              if @gem_hash.key? spec.name
+                @gem_hash[spec.name].update(groups: (@gem_hash[spec.name].groups | [group]).map(&:to_s))
+              end
             end
           end
         end

data/lib/package/audit/services/command_parser.rb

@@ -4,6 +4,7 @@ require_relative '../enum/option'
 require_relative '../enum/report'
 require_relative '../technology/detector'
 require_relative '../technology/validator'
+require_relative '../util/spinner'
 require_relative '../util/summary_printer'
 require_relative 'package_finder'
 require_relative 'package_printer'
@@ -18,26 +19,46 @@ module Package
         @options = options
         @report = report
         @config = parse_config_file
+        @environments = parse_environments
         @technologies = parse_technologies
+        @spinner = Util::Spinner.new('Evaluating packages and their dependencies...')
       end
 
-      def run
+      def run # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
+        mutex = Mutex.new
         cumulative_pkgs = []
+        thread_index = 0
 
-        @technologies.each do |technology|
-          all_pkgs, ignored_pkgs = PackageFinder.new(@config, @dir, @report).run(technology)
-          ignored_pkgs = [] if @options[Enum::Option::INCLUDE_IGNORED]
-          cumulative_pkgs << all_pkgs
-          print_results(technology, (all_pkgs || []) - (ignored_pkgs || []), ignored_pkgs || [])
+        @spinner.start
+        threads = @technologies.map.with_index do |technology, technology_index|
+          Thread.new do
+            all_pkgs, ignored_pkgs = PackageFinder.new(@config, @dir, @report, @environments).run(technology)
+            ignored_pkgs = [] if @options[Enum::Option::INCLUDE_IGNORED]
+            cumulative_pkgs += all_pkgs || []
+            sleep 0.1 while technology_index != thread_index # print each technology in order
+            mutex.synchronize do
+              @spinner.stop
+              print_results(technology, (all_pkgs || []) - (ignored_pkgs || []), ignored_pkgs || [])
+              thread_index += 1
+              @spinner.start
+            end
+          rescue StandardError => e
+            Thread.current[:exception] = e
+          end
         end
-
-        cumulative_pkgs.any?
+        threads.each do |thread|
+          thread.join
+          raise thread[:exception] if thread[:exception]
+        end
+        cumulative_pkgs.any? ? 1 : 0
+      ensure
+        @spinner.stop
       end
 
       private
 
       def print_results(technology, pkgs, ignored_pkgs)
-        PackagePrinter.new(@options, pkgs).print(report_fields)
+        PackagePrinter.new(@options, pkgs).print(Const::Fields::DEFAULT)
         print_summary(technology, pkgs, ignored_pkgs) unless @options[Enum::Option::CSV]
         print_disclaimer(technology) unless @options[Enum::Option::CSV] || pkgs.empty?
       end
@@ -70,19 +91,6 @@ module Package
         end
       end
 
-      def report_fields
-        case @report
-        when Enum::Report::DEPRECATED
-          Const::Fields::DEPRECATED
-        when Enum::Report::OUTDATED
-          Const::Fields::OUTDATED
-        when Enum::Report::VULNERABLE
-          Const::Fields::VULNERABLE
-        else
-          Const::Fields::ALL
-        end
-      end
-
       def parse_config_file
         if @options[Enum::Option::CONFIG].nil?
           YAML.load_file("#{@dir}/#{Const::File::CONFIG}") if File.exist? "#{@dir}/#{Const::File::CONFIG}"
@@ -93,6 +101,17 @@ module Package
         end
       end
 
+      def parse_environments
+        unsupported_technologies = (@options[Enum::Option::ENVIRONMENT] || []) - Enum::Environment.all
+
+        if unsupported_technologies.any?
+          raise ArgumentError, "#{unsupported_technologies} is not valid list of environments, " \
+                               "use one of #{Enum::Environment.all}"
+        end
+
+        (@options[Enum::Option::ENVIRONMENT] || Enum::Environment.all) | [Enum::Environment::DEFAULT]
+      end
+
       def parse_technologies
         technology_validator = Technology::Validator.new(@dir)
         @options[Enum::Option::TECHNOLOGY]&.each { |technology| technology_validator.validate! technology }

data/lib/package/audit/services/package_finder.rb

@@ -11,16 +11,19 @@ require 'yaml'
 module Package
   module Audit
     class PackageFinder
-      def initialize(config, dir, report)
+      def initialize(config, dir, report, environments)
         @config = config
         @dir = dir
         @report = report
+        @environments = environments
       end
 
       def run(technology)
         all_pkgs = find_by_technology(technology)
-        ignored_pkgs = filter_pkgs_based_on_config(all_pkgs)
-        [all_pkgs, ignored_pkgs]
+        ignored_by_environment_pkgs = filter_pkgs_based_on_environment(all_pkgs)
+        active_pkgs = all_pkgs - ignored_by_environment_pkgs
+        ignored_by_config_pkgs = filter_pkgs_based_on_config(active_pkgs)
+        [active_pkgs, ignored_by_config_pkgs]
       end
 
       private
@@ -53,6 +56,15 @@ module Package
         end
         ignored_pkgs
       end
+
+      def filter_pkgs_based_on_environment(pkgs)
+        ignored_pkgs = []
+
+        pkgs.each do |pkg|
+          ignored_pkgs << pkg unless (pkg.groups & @environments).any?
+        end
+        ignored_pkgs
+      end
     end
   end
 end

data/lib/package/audit/services/package_printer.rb

@@ -32,14 +32,14 @@ module Package
       private
 
       def check_fields(fields)
-        return unless (fields - Const::Fields::ALL).any?
+        return unless (fields - Const::Fields::DEFAULT).any?
 
         raise ArgumentError,
-              "#{fields - Const::Fields::ALL} are not valid field names. " \
-              "Available fields names are: #{Const::Fields::ALL}."
+              "#{fields - Const::Fields::DEFAULT} are not valid field names. " \
+              "Available fields names are: #{Const::Fields::DEFAULT}."
       end
 
-      def pretty(fields = Const::Fields::ALL) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
+      def pretty(fields = Const::Fields::DEFAULT) # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
         # find the maximum length of each field across all the packages so we know how many
         # characters of horizontal space to allocate for each field when printing
         fields.each do |key|

data/lib/package/audit/services/risk_calculator.rb

@@ -16,7 +16,7 @@ module Package
         unless production_dependency?
           risks.each_with_index do |risk, index|
             risks[index] =
-              [risk, Risk.new(Enum::RiskType::MEDIUM, risk.explanation)].min || Risk.new(Enum::RiskType::NONE)
+              [risk, Risk.new(Enum::RiskType::LOW, risk.explanation)].min || Risk.new(Enum::RiskType::NONE)
           end
         end
         risks

data/lib/package/audit/util/spinner.rb

@@ -0,0 +1,48 @@
+module Package
+  module Audit
+    module Util
+      class Spinner
+        ANIMATION_SPEED = 0.1
+        STATES = %w[| / - \\]
+
+        def initialize(message = 'Loading...')
+          @message = message
+          @running = false
+          @thread = nil
+        end
+
+        def start # rubocop:disable Metrics/MethodLength
+          return if ENV['RACK_ENV'] == 'test'
+          raise 'Loading indicator already started.' if @running
+
+          @running = true
+          @thread = Thread.new do
+            step = 0
+            while @running
+              if @running && (ENV['RUBY_ENV'] != 'test' && ENV['RACK_ENV'] != 'test')
+                print "\r#{@message} #{STATES[step % STATES.length]}"
+              end
+              sleep ANIMATION_SPEED
+              step += 1
+            end
+          end
+        end
+
+        def stop
+          return if ENV['RACK_ENV'] == 'test'
+          return unless @running
+
+          @running = false
+          @thread&.join
+          clear_console_line
+        end
+
+        private
+
+        def clear_console_line
+          print "\r#{' ' * (@message.length + 2)}\r"
+        end
+      end
+    end
+  end
+end

data/lib/package/audit/util/summary_printer.rb

@@ -85,7 +85,7 @@ module Package
 
           puts Util::BashColor.blue('5. Check whether the package is used in production or not.')
           puts '   If a package is limited to a non-production environment:'
-          puts "      - cap risk severity to\t -> #{Util::BashColor.orange('medium')} risk"
+          puts "      - cap risk severity to\t -> #{Util::BashColor.yellow('low')} risk"
         end
       end
     end

data/lib/package/audit/version.rb

@@ -1,5 +1,5 @@
 module Package
   module Audit
-    VERSION = '0.4.1'
+    VERSION = '0.5.0'
   end
 end

data/sig/package/audit/const/fields.rbs

@@ -2,12 +2,9 @@ module Package
   module Audit
     module Const
       module Fields
-        ALL: Array[Symbol]
         AVAILABLE: Array[Symbol]
-        DEPRECATED: Array[Symbol]
+        DEFAULT: Array[Symbol]
         HEADERS: Hash[Symbol, String]
-        OUTDATED: Array[Symbol]
-        VULNERABLE: Array[Symbol]
       end
     end
   end

data/sig/package/audit/enum/environment.rbs

@@ -2,11 +2,13 @@ module Package
   module Audit
     module Enum
       module Environment
-        DEFAULT: Symbol
-        DEV: Symbol
-        PRODUCTION: Symbol
-        STAGING: Symbol
-        TEST: Symbol
+        DEFAULT: String
+        DEV: String
+        PRODUCTION: String
+        STAGING: String
+        TEST: String
+
+        def self.all: -> Array[String]
       end
     end
   end

data/sig/package/audit/enum/option.rbs

@@ -5,6 +5,7 @@ module Package
         CONFIG: String
         CSV: String
         CSV_EXCLUDE_HEADERS: String
+        ENVIRONMENT: String
         INCLUDE_IGNORED: String
         TECHNOLOGY: String
       end

data/sig/package/audit/models/package.rbs

@@ -1,12 +1,12 @@
 module Package
   module Audit
     class Package
-      @groups: Array[Symbol]
+      @groups: Array[String]
       @risks: Array[Risk]
       @technology: String
       @vulnerabilities: Array[String]
 
-      attr_accessor groups: Array[Symbol]
+      attr_accessor groups: Array[String]
       attr_accessor latest_version: String
       attr_accessor latest_version_date: String
       attr_reader name: String

data/sig/package/audit/ruby/gem_meta_data.rbs

@@ -2,10 +2,11 @@ module Package
   module Audit
     module Ruby
       class GemMetaData
+        @dir: String
         @gem_hash: Hash[String, Package]
         @pkgs: Array[Package]
 
-        def initialize: (Array[Package]) -> void
+        def initialize: (String, Array[Package]) -> void
 
         def fetch: -> Array[Package]
 

data/sig/package/audit/services/command_parser.rbs

@@ -3,13 +3,15 @@ module Package
     class CommandParser
       @config: Hash[String, untyped]?
       @dir: String
+      @environments: Array[String]
+      @spinner: Util::Spinner
       @options: Hash[String, untyped]
       @report: Symbol
       @technologies: Array[String]
 
       def initialize: (String, Hash[String, untyped], Symbol) -> void
 
-      def run: -> bool
+      def run: -> int
 
       private
 
@@ -17,6 +19,8 @@ module Package
 
       def parse_config_file: -> Hash[String, untyped]?
 
+      def parse_environments: -> Array[String]
+
       def parse_technologies: -> Array[String]
 
       def print_disclaimer: (String) -> void
@@ -24,8 +28,6 @@ module Package
       def print_results: (String, Array[Package], Array[Package]) -> void
 
       def print_summary: (String, Array[Package], Array[Package]) -> void
-
-      def report_fields: -> Array[Symbol]
     end
   end
 end

data/sig/package/audit/services/package_finder.rbs

@@ -4,8 +4,9 @@ module Package
       @config: Hash[String, untyped]?
       @dir: String
       @report: Symbol
+      @environments: Array[String]
 
-      def initialize: (Hash[String, untyped]?, String, Symbol) -> void
+      def initialize: (Hash[String, untyped]?, String, Symbol, Array[String]) -> void
 
       def run: (String) -> Array[Array[Package]]
 
@@ -13,6 +14,8 @@ module Package
 
       def filter_pkgs_based_on_config: (Array[Package]) -> Array[Package]
 
+      def filter_pkgs_based_on_environment: (Array[Package]) -> Array[Package]
+
       def find_by_technology: (String) -> Array[Package]
 
       def find_node: -> Array[Package]

data/sig/package/audit/util/spinner.rbs

@@ -0,0 +1,24 @@
+module Package
+  module Audit
+    module Util
+      class Spinner
+        ANIMATION_SPEED: Float
+        STATES: Array[String]
+
+        @message: String
+        @running: bool
+        @thread: Thread?
+
+        def initialize: (?String) -> void
+
+        def start: -> void
+
+        def stop: -> void
+
+        private
+
+        def clear_console_line: -> void
+      end
+    end
+  end
+end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: package-audit
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.5.0
 platform: ruby
 authors:
-- Vadim Kononov
+- Tactica Communications Inc.
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-10-04 00:00:00.000000000 Z
+date: 2023-11-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: bundler-audit
@@ -85,6 +85,7 @@ files:
 - lib/package/audit/technology/detector.rb
 - lib/package/audit/technology/validator.rb
 - lib/package/audit/util/bash_color.rb
+- lib/package/audit/util/spinner.rb
 - lib/package/audit/util/summary_printer.rb
 - lib/package/audit/version.rb
 - sig/package/audit/cli.rbs
@@ -124,6 +125,7 @@ files:
 - sig/package/audit/technology/detector.rbs
 - sig/package/audit/technology/validator.rbs
 - sig/package/audit/util/bash_color.rbs
+- sig/package/audit/util/spinner.rbs
 - sig/package/audit/util/summary_printer.rbs
 - sig/package/audit/version.rbs
 homepage: https://github.com/tactica/package-audit
@@ -148,7 +150,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.4.17
+rubygems_version: 3.4.22
 signing_key:
 specification_version: 4
 summary: A helper tool to find outdated, deprecated and vulnerable dependencies.