secupdater 0.1.0

data/spec/secupdater/update_spec.rb

@@ -0,0 +1,262 @@
+require "secupdater"
+require "secupdater/publisher"
+require "json"
+require "stringio"
+require "tmpdir"
+
+module UpdateSpec
+  # outcomes: gem name => version try_update moves it to, :unchanged or :fail, or a hash of those by level
+  class FakeEcosystem
+    LOCKFILE = "Gemfile.lock"
+
+    attr_reader :outcomes, :lockfiles_seen, :attempts
+
+    def initialize(outcomes)
+      @outcomes = outcomes
+      @lockfiles_seen = {}
+      @attempts = []
+    end
+
+    def update_levels = [:patch, :minor, :major]
+
+    def ecosystem_name = "Fake"
+
+    def snapshot
+      JSON.parse(File.read(LOCKFILE)).to_h do |name, version|
+        [name, Secupdater::DependencySpec.new(name, "ruby", Gem::Version.new(version))]
+      end
+    end
+
+    def diff_snapshot(a, b) = Secupdater::Ecosystem::Rubygems.new.diff_snapshot(a, b)
+
+    def try_update(name, level:)
+      before = File.read(LOCKFILE)
+      lockfiles_seen[[name, level]] = JSON.parse(before)
+      attempts << [name, level]
+
+      outcome = outcomes.fetch(name)
+      outcome = outcome.fetch(level) if outcome.is_a?(Hash)
+
+      case outcome
+      when :fail
+        raise Secupdater::UpdateCommandFailed.new("bundle update failed", 1, "could not resolve #{name}")
+      when :unchanged
+        []
+      else
+        after = JSON.generate(JSON.parse(before).merge(name => outcome))
+        File.write(LOCKFILE, after)
+        [Secupdater::FileChange.new(LOCKFILE, "update", after, before)]
+      end
+    end
+
+    def satisfies_requirement?(version, requirement)
+      Gem::Requirement.create(requirement).satisfied_by?(Gem::Version.create(version))
+    end
+  end
+end
+
+RSpec.describe Secupdater::Update do
+  subject(:update) { described_class.new(logger, ecosystem, publisher: publisher) }
+
+  let(:log) { StringIO.new }
+  let(:logger) { Dry.Logger(:test, stream: log, template: "%<severity>s %<message>s", level: :debug) }
+  let(:ecosystem) { UpdateSpec::FakeEcosystem.new(outcomes) }
+  let(:publisher) { instance_double(Secupdater::Publisher) }
+  let(:published) { [] }
+
+  let(:lockfile) { { "rack" => "1.0", "nokogiri" => "1.0" } }
+
+  def advisory(gem, id, patched = ">= 2.0") = Secupdater::SecurityAdvisory.new(gem, id, [patched])
+
+  def lockfile_on_disk = JSON.parse(File.read("Gemfile.lock"))
+
+  around do |example|
+    Dir.mktmpdir do |dir|
+      Dir.chdir(dir) do
+        File.write("Gemfile.lock", JSON.generate(lockfile))
+        example.run
+      end
+    end
+  end
+
+  before do
+    allow(publisher).to receive(:call) { |*args| published << args } if publisher
+  end
+
+  describe "#call(advisories)" do
+    context "one gem with 2 advisories updates to a patched version" do
+      let(:outcomes) { { "rack" => "2.1" } }
+      let(:advisories) { [advisory("rack", "cve/1"), advisory("rack", "cve/2")] }
+
+      it "calls the publisher ONCE for the gem, with both advisories and the changes" do
+        update.call(advisories)
+
+        expect(published.length).to eq(1)
+
+        eco, bump, advs, changes = published.first
+        expect(eco).to be(ecosystem)
+        expect(bump).to have_attributes(from: Gem::Version.new("1.0"), to: Gem::Version.new("2.1"))
+        expect(bump.dependency.name).to eq("rack")
+        expect(advs.map(&:report_id)).to contain_exactly("cve/1", "cve/2")
+        expect(changes.map(&:filename)).to eq(["Gemfile.lock"])
+        expect(JSON.parse(changes.first.content)).to include("rack" => "2.1")
+      end
+
+      it "logs which upgrade resolves each advisory" do
+        update.call(advisories)
+
+        expect(log.string).to match(%r{^INFO .*rack.*1\.0.*2\.1.*cve/1})
+        expect(log.string).to match(%r{^INFO .*rack.*1\.0.*2\.1.*cve/2})
+      end
+    end
+
+    context "update lands below the patched version" do
+      let(:outcomes) { { "rack" => "1.5" } }
+
+      it "warns with the from/to versions and doesn't publish" do
+        update.call([advisory("rack", "cve/1")])
+
+        expect(published).to be_empty
+        expect(log.string).to match(/^WARN .*rack.*1\.0.*1\.5/)
+      end
+    end
+
+    context "nothing changes for the first gem" do
+      let(:outcomes) { { "rack" => :unchanged, "nokogiri" => "2.0" } }
+
+      it "warns that it's stuck at the current version and continues to the next gem" do
+        update.call([advisory("rack", "cve/1"), advisory("nokogiri", "cve/2")])
+
+        expect(log.string).to match(/^WARN .*rack.*1\.0/)
+        expect(published.map { it[1].dependency.name }).to eq(["nokogiri"])
+      end
+    end
+
+    context "bundle update fails for the first gem" do
+      let(:outcomes) { { "rack" => :fail, "nokogiri" => "2.0" } }
+
+      it "records the failure and continues to the next gem" do
+        update.call([advisory("rack", "cve/1"), advisory("nokogiri", "cve/2")])
+
+        expect(log.string).to match(/^ERROR .*rack.*could not resolve rack/m)
+        expect(published.map { it[1].dependency.name }).to eq(["nokogiri"])
+      end
+    end
+
+    context "two vulnerable gems" do
+      let(:outcomes) { { "rack" => "2.1", "nokogiri" => "2.0" } }
+      let(:advisories) { [advisory("rack", "cve/1"), advisory("nokogiri", "cve/2")] }
+
+      it "restores the lockfile between gems so each MR only has its own changes" do
+        update.call(advisories)
+
+        expect(ecosystem.lockfiles_seen[["nokogiri", :patch]]).to eq(lockfile)
+
+        nokogiri_changes = published.find { it[1].dependency.name == "nokogiri" }[3]
+        expect(JSON.parse(nokogiri_changes.first.content)).to eq("rack" => "1.0", "nokogiri" => "2.0")
+      end
+
+      it "leaves the lockfile as it found it" do
+        update.call(advisories)
+
+        expect(lockfile_on_disk).to eq(lockfile)
+      end
+    end
+
+    context "an advisory for a gem that isn't in the lockfile" do
+      let(:outcomes) { { "rack" => "2.1" } }
+
+      it "raises Secupdater::Error naming the gem, before attempting any updates" do
+        expect { update.call([advisory("rack", "cve/1"), advisory("left-pad", "cve/2")]) }
+          .to raise_error(Secupdater::Error, /left-pad/)
+
+        expect(ecosystem.lockfiles_seen).to be_empty
+      end
+    end
+
+    context "no publisher configured (dry run)" do
+      let(:publisher) { nil }
+      let(:outcomes) { { "rack" => "2.1" } }
+
+      it "updates and logs without publishing" do
+        update.call([advisory("rack", "cve/1")])
+
+        expect(log.string).to match(%r{^INFO .*rack.*2\.1.*cve/1})
+        expect(lockfile_on_disk).to eq(lockfile)
+      end
+
+      it "returns :resolved for the gem" do
+        expect(update.call([advisory("rack", "cve/1")])).to eq("rack" => :resolved)
+      end
+    end
+
+    context "the patch update resolves the advisory" do
+      let(:outcomes) { { "rack" => { patch: "2.0.1" } } }
+
+      it "doesn't try the minor or major updates" do
+        update.call([advisory("rack", "cve/1")])
+
+        expect(ecosystem.attempts).to eq([["rack", :patch]])
+        expect(published.length).to eq(1)
+      end
+    end
+
+    context "the patch update is unresolved but the minor update resolves it" do
+      let(:outcomes) { { "rack" => { patch: "1.0.1", minor: "2.1" } } }
+
+      it "restores the lockfile before trying the minor update" do
+        update.call([advisory("rack", "cve/1")])
+
+        expect(ecosystem.lockfiles_seen[["rack", :minor]]).to eq(lockfile)
+      end
+
+      it "publishes the minor update's changes" do
+        expect(update.call([advisory("rack", "cve/1")])).to eq("rack" => :published)
+
+        _, bump, _, changes = published.first
+        expect(bump.to).to eq(Gem::Version.new("2.1"))
+        expect(JSON.parse(changes.first.content)).to include("rack" => "2.1")
+      end
+
+      it "logs which level resolved it" do
+        update.call([advisory("rack", "cve/1")])
+
+        expect(log.string).to match(%r{^INFO .*rack.*2\.1 \(minor\).*cve/1})
+      end
+    end
+
+    context "the patch and minor updates fail but the major update resolves it" do
+      let(:outcomes) { { "rack" => { patch: :fail, minor: :fail, major: "2.1" } } }
+
+      it "returns :published without logging an error" do
+        expect(update.call([advisory("rack", "cve/1")])).to eq("rack" => :published)
+        expect(log.string).not_to match(/^ERROR/)
+      end
+    end
+
+    context "every level fails" do
+      let(:outcomes) { { "rack" => :fail } }
+
+      it "tries each level, then returns :failed" do
+        expect(update.call([advisory("rack", "cve/1")])).to eq("rack" => :failed)
+        expect(ecosystem.attempts.map(&:last)).to eq([:patch, :minor, :major])
+      end
+    end
+
+    context "a mix of outcomes" do
+      let(:lockfile) { { "rack" => "1.0", "nokogiri" => "1.0", "puma" => "1.0", "rails" => "1.0" } }
+      let(:outcomes) { { "rack" => "2.1", "nokogiri" => "1.5", "puma" => :unchanged, "rails" => :fail } }
+
+      it "returns a result per gem" do
+        results = update.call(%w[rack nokogiri puma rails].map { advisory(it, "cve/#{it}") })
+
+        expect(results).to eq(
+          "rack" => :published,
+          "nokogiri" => :unresolved,
+          "puma" => :unchanged,
+          "rails" => :failed
+        )
+      end
+    end
+  end
+end

data/spec/spec_helper.rb

@@ -0,0 +1,98 @@
+require "webmock/rspec"
+
+# This file was generated by the `rspec --init` command. Conventionally, all
+# specs live under a `spec` directory, which RSpec adds to the `$LOAD_PATH`.
+# The generated `.rspec` file contains `--require spec_helper` which will cause
+# this file to always be loaded, without a need to explicitly require it in any
+# files.
+#
+# Given that it is always loaded, you are encouraged to keep this file as
+# light-weight as possible. Requiring heavyweight dependencies from this file
+# will add to the boot time of your test suite on EVERY test run, even for an
+# individual file that may not need all of that loaded. Instead, consider making
+# a separate helper file that requires the additional dependencies and performs
+# the additional setup, and require it from the spec files that actually need
+# it.
+#
+# See https://rubydoc.info/gems/rspec-core/RSpec/Core/Configuration
+RSpec.configure do |config|
+  # rspec-expectations config goes here. You can use an alternate
+  # assertion/expectation library such as wrong or the stdlib/minitest
+  # assertions if you prefer.
+  config.expect_with :rspec do |expectations|
+    # This option will default to `true` in RSpec 4. It makes the `description`
+    # and `failure_message` of custom matchers include text for helper methods
+    # defined using `chain`, e.g.:
+    #     be_bigger_than(2).and_smaller_than(4).description
+    #     # => "be bigger than 2 and smaller than 4"
+    # ...rather than:
+    #     # => "be bigger than 2"
+    expectations.include_chain_clauses_in_custom_matcher_descriptions = true
+  end
+
+  # rspec-mocks config goes here. You can use an alternate test double
+  # library (such as bogus or mocha) by changing the `mock_with` option here.
+  config.mock_with :rspec do |mocks|
+    # Prevents you from mocking or stubbing a method that does not exist on
+    # a real object. This is generally recommended, and will default to
+    # `true` in RSpec 4.
+    mocks.verify_partial_doubles = true
+  end
+
+  # This option will default to `:apply_to_host_groups` in RSpec 4 (and will
+  # have no way to turn it off -- the option exists only for backwards
+  # compatibility in RSpec 3). It causes shared context metadata to be
+  # inherited by the metadata hash of host groups and examples, rather than
+  # triggering implicit auto-inclusion in groups with matching metadata.
+  config.shared_context_metadata_behavior = :apply_to_host_groups
+
+  # The settings below are suggested to provide a good initial experience
+  # with RSpec, but feel free to customize to your heart's content.
+  
+  # This allows you to limit a spec run to individual examples or groups
+  # you care about by tagging them with `:focus` metadata. When nothing
+  # is tagged with `:focus`, all examples get run. RSpec also provides
+  # aliases for `it`, `describe`, and `context` that include `:focus`
+  # metadata: `fit`, `fdescribe` and `fcontext`, respectively.
+  config.filter_run_when_matching :focus
+
+  # Allows RSpec to persist some state between runs in order to support
+  # the `--only-failures` and `--next-failure` CLI options. We recommend
+  # you configure your source control system to ignore this file.
+  config.example_status_persistence_file_path = "spec/examples.txt"
+
+  # Limits the available syntax to the non-monkey patched syntax that is
+  # recommended. For more details, see:
+  # https://rspec.info/features/3-12/rspec-core/configuration/zero-monkey-patching-mode/
+  config.disable_monkey_patching!
+
+  # This setting enables warnings. It's recommended, but in some cases may
+  # be too noisy due to issues in dependencies.
+  config.warnings = true
+
+  # Many RSpec users commonly either run the entire suite or an individual
+  # file, and it's useful to allow more verbose output when running an
+  # individual spec file.
+  if config.files_to_run.one?
+    # Use the documentation formatter for detailed output,
+    # unless a formatter has already been configured
+    # (e.g. via a command-line flag).
+    config.default_formatter = "doc"
+  end
+
+  # Print the 10 slowest examples and example groups at the
+  # end of the spec run, to help surface which specs are running
+  # particularly slow.
+  config.profile_examples = 10
+  # Run specs in random order to surface order dependencies. If you find an
+  # order dependency and want to debug it, you can fix the order by providing
+  # the seed, which is printed after each run.
+  #     --seed 1234
+  config.order = :random
+
+  # Seed global randomization in this process using the `--seed` CLI option.
+  # Setting this allows you to use `--seed` to deterministically reproduce
+  # test failures related to randomization by passing the same `--seed` value
+  # as the one that triggered the failure.
+  Kernel.srand config.seed
+end

metadata

@@ -0,0 +1,124 @@
+--- !ruby/object:Gem::Specification
+name: secupdater
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Ben Anderson
+bindir: bin
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: dry-logger
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.2.2
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.2.2
+- !ruby/object:Gem::Dependency
+  name: dry-cli
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.4.1
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 1.4.1
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.13.2
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.13.2
+- !ruby/object:Gem::Dependency
+  name: webmock
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.34.0
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: 3.34.0
+email:
+- me@benanderson.nz
+executables:
+- secupdater
+extensions: []
+extra_rdoc_files: []
+files:
+- ".rspec"
+- ".tool-versions"
+- CHANGELOG.md
+- LICENSE.txt
+- README.md
+- Rakefile
+- bin/secupdater
+- lib/secupdater.rb
+- lib/secupdater/cli.rb
+- lib/secupdater/ecosystem.rb
+- lib/secupdater/ecosystem/rubygems.rb
+- lib/secupdater/publisher.rb
+- lib/secupdater/publisher/gitlab.rb
+- lib/secupdater/runner.rb
+- lib/secupdater/update.rb
+- lib/secupdater/version.rb
+- sig/secupdater.rbs
+- spec/e2e/secupdater_spec.rb
+- spec/secupdater/cli_spec.rb
+- spec/secupdater/ecosystem/rubygems_spec.rb
+- spec/secupdater/ecosystem_spec.rb
+- spec/secupdater/publisher/gitlab_spec.rb
+- spec/secupdater/publisher_spec.rb
+- spec/secupdater/runner_spec.rb
+- spec/secupdater/update_spec.rb
+- spec/spec_helper.rb
+homepage: https://github.com/bagedevimo/secupdater
+licenses:
+- MIT
+metadata:
+  source_code_uri: https://github.com/bagedevimo/secupdater
+  changelog_uri: https://github.com/bagedevimo/secupdater/blob/main/CHANGELOG.md
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.2.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.19
+specification_version: 4
+summary: A CLI tool to replace dependabot, powered by ecosystem audit reports
+test_files: []