secupdater 0.2.0alpha4 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 72d1d0d9d634e7b741faf88079cd487319fdd9b9d623b6f21871c57144492849
-  data.tar.gz: c08e421af618d820ac2c361844bab4d8d6a96bff6c676f418bce2d979479a09f
+  metadata.gz: f3e2a3d2fd687a912cd17a2dab8216d5c7187693c5239ccfdeac56ce87a825ac
+  data.tar.gz: 6db3dd9e3f87b76f96e75b3849c9d447ac24a1f0ea31972d24a37cdc20437ee6
 SHA512:
-  metadata.gz: b63b7f2d374a1262822179eff166c111f902303defaf335b6d49047f2427d39544c2a02b506b77dc534f990b95971e9391e48cde0bd04a464dab0a7e7a535a7d
-  data.tar.gz: ad07d210bd3c346f361440f33bdea10c1b2b925df568550ba46c0946dc1ee80b0827ef7b1850139cec37ef36035275397763903cd2ec6c1c808b38bbeafd3d57
+  metadata.gz: 66aabee38119a94edf9f609ba05d6d8c59581a7994f3f8c3a089f836c8460af124a5a34b08f44418dd9588439b590204864970fad3faf492e05a885f605ae329
+  data.tar.gz: 3f8607eca5779819b70d6346365dfa70ec158af70bc9f5c8a3d6c2c3ea9bef3a53839708c9eee388ff942369cc5303c03af958db07013dfb9d85ec04d162155a

data/lib/secupdater/ecosystem/rubygems.rb

@@ -35,7 +35,7 @@ module Secupdater
       end
 
       def run_update(names, level)
-        output, status = Open3.capture2e(bundle_env, "bundle", "lock", "--update", *Array(names), "--conservative", "--#{level}", "--strict")
+        output, status = Open3.capture2e(bundle_env, "bundle", *bundler_version_arg, "lock", "--update", *Array(names), "--conservative", "--#{level}", "--strict")
 
         if status.exitstatus == FROZEN_EXIT_CODE
           raise Secupdater::Error, "bundle lock can't change Gemfile.lock (is BUNDLE_DEPLOYMENT set?)\n#{output}"
@@ -79,6 +79,24 @@ module Secupdater
 
       private
 
+      def bundler_version_arg
+        version = Bundler::LockfileParser.new(Bundler.read_file("Gemfile.lock")).bundler_version
+        return [] unless version
+
+        install_bundler(version)
+        ["_#{version}_"]
+      end
+
+      def install_bundler(version)
+        @installed_bundlers ||= Set.new
+        return if @installed_bundlers.include?(version)
+
+        output, status = Open3.capture2e(bundle_env, "gem", "install", "bundler", "--version", version.to_s, "--conservative", "--no-document")
+        raise Secupdater::Error, "Couldn't install Bundler #{version}, which Gemfile.lock was bundled with\n#{output}" unless status.success?
+
+        @installed_bundlers << version
+      end
+
       # When secupdater itself runs under `bundle exec` (e.g. an image whose
       # entrypoint is `bundle exec`), undo what that set up so bundle lock works on
       # the Gemfile and Gemfile.lock here. PATH is left alone, as callers may have

data/lib/secupdater/publisher/gitlab.rb

@@ -11,6 +11,7 @@ module Secupdater
         @project_id = project_id
         @target_branch = target_branch
         @start_sha = start_sha
+        @current_merge_requests = {}
       end
 
       # Added to every MR secupdater opens. Closing one declines that version of
@@ -36,13 +37,39 @@ module Secupdater
             commit(http)
           end
 
-          return [:up_to_date, nil] if open_merge_request && up_to_date
+          if open_merge_request
+            remember(open_merge_request)
+            return [:up_to_date, nil] if up_to_date
+          else
+            remember(JSON.parse(create_merge_request(http).body))
+          end
 
-          create_merge_request(http) unless open_merge_request
           [:published, nil]
         end
       end
 
+      # Closes open secupdater MRs for a dependency that this run opened or kept a
+      # different MR for, or that no longer has any advisories. MRs for
+      # dependencies this run couldn't update are left alone.
+      def finish(vulnerable_names)
+        Net::HTTP.start("gitlab.com", 443, use_ssl: true) do |http|
+          find_open_secupdater_merge_requests(http).filter_map do |merge_request|
+            name = merge_request["source_branch"][REFERENCE_PATTERN, :name]
+            current = @current_merge_requests[name]
+
+            reason = if current && current != merge_request["iid"]
+              "Superseded by !#{current}."
+            elsif name && !vulnerable_names.include?(name)
+              "#{name} no longer has any security advisories on #{target_branch}, so this is no longer needed."
+            end
+            next unless reason
+
+            close_merge_request(http, merge_request["iid"], reason)
+            "closed !#{merge_request["iid"]} (#{merge_request["source_branch"]}): #{reason}"
+          end
+        end
+      end
+
       private
 
       def commit(http, force: false)
@@ -57,6 +84,20 @@ module Secupdater
         request(http, Net::HTTP::Post, "repository/commits", data)
       end
 
+      def remember(merge_request)
+        @current_merge_requests[bump.dependency.name] = merge_request["iid"]
+      end
+
+      def find_open_secupdater_merge_requests(http)
+        query = URI.encode_www_form(state: "opened", labels: LABEL, target_branch: target_branch, per_page: 100)
+        JSON.parse(request(http, Net::HTTP::Get, "merge_requests?#{query}").body)
+      end
+
+      def close_merge_request(http, iid, reason)
+        request(http, Net::HTTP::Post, "merge_requests/#{iid}/notes", { body: reason })
+        request(http, Net::HTTP::Put, "merge_requests/#{iid}", { state_event: "close" })
+      end
+
       def create_merge_request(http)
         data = {
           source_branch: reference,

data/lib/secupdater/publisher.rb

@@ -17,6 +17,13 @@ module Secupdater
       run
     end
 
+    # Called once every dependency has been through #call, with the names of all
+    # the dependencies that have advisories. Returns messages about anything it
+    # tidied up.
+    def finish(vulnerable_names) = []
+
+    REFERENCE_PATTERN = %r{\Asecurity/(?<name>.+)-(?<version>[^-]+)\z}
+
     def reference = "security/#{bump.dependency.name}-#{bump.to}"
 
     def title = "Upgrade #{ecosystem.ecosystem_name} dependency #{bump.dependency.name} to version #{bump.to}"

data/lib/secupdater/update.rb

@@ -16,9 +16,13 @@ module Secupdater
       missing = deps_needing_checking.keys - original.keys
       raise Secupdater::Error, "Advisories for dependencies not in the lockfile: #{missing.join(', ')}" if missing.any?
 
-      deps_needing_checking.to_h do |name, dep_advisories|
+      results = deps_needing_checking.to_h do |name, dep_advisories|
         [name, update_dependency(original[name], dep_advisories)]
       end
+
+      publisher&.finish(deps_needing_checking.keys)&.each { logger.info it }
+
+      results
     end
 
     def update_dependency(dep, advisories)

data/lib/secupdater/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Secupdater
-  VERSION = "0.2.0alpha4"
+  VERSION = "0.3.0"
 end

data/spec/e2e/secupdater_spec.rb

@@ -54,6 +54,8 @@ RSpec.describe "secupdater end to end" do
         FileUtils.mkdir("bin")
         File.write("bin/bundle", "#!/bin/sh\ncp Gemfile.lock.after Gemfile.lock\n")
         File.chmod(0o755, "bin/bundle")
+        File.write("bin/gem", "#!/bin/sh\n")
+        File.chmod(0o755, "bin/gem")
 
         system("git init -q && git add Gemfile.lock && git -c user.name=test -c user.email=test@example.com commit -qm init", exception: true)
 
@@ -70,7 +72,14 @@ RSpec.describe "secupdater end to end" do
     let(:env) { { "SECUPDATER_GITLAB_TOKEN" => "token", "CI_PROJECT_ID" => "123", "CI_DEFAULT_BRANCH" => "main" } }
 
     let!(:find_mr_stub) do
-      stub_request(:get, %r{\Ahttps://gitlab.com/api/v4/projects/123/merge_requests\?})
+      stub_request(:get, "https://gitlab.com/api/v4/projects/123/merge_requests")
+        .with(query: hash_including(source_branch: "security/css_parser-1.1.0"))
+        .to_return(status: 200, body: "[]")
+    end
+
+    let!(:find_open_secupdater_mrs_stub) do
+      stub_request(:get, "https://gitlab.com/api/v4/projects/123/merge_requests")
+        .with(query: hash_including(state: "opened", labels: "secupdater"))
         .to_return(status: 200, body: "[]")
     end
 
@@ -99,6 +108,7 @@ RSpec.describe "secupdater end to end" do
       expect { run_cli }.not_to raise_error
 
       expect(find_mr_stub).to have_been_requested.once
+      expect(find_open_secupdater_mrs_stub).to have_been_requested.once
       expect(create_commit_stub).to have_been_requested.once
       expect(create_mr_stub).to have_been_requested.once
       expect(File.read("Gemfile.lock")).to eq(lockfile("1.0.0"))

data/spec/secupdater/ecosystem/rubygems_spec.rb

@@ -145,11 +145,65 @@ RSpec.describe Secupdater::Ecosystem::Rubygems do
       }
     end
 
-    before { allow(Bundler).to receive(:original_env).and_return(original_env) }
+    let(:install_status) { instance_double(Process::Status, success?: true, exitstatus: 0) }
+
+    before do
+      allow(Bundler).to receive(:original_env).and_return(original_env)
+      allow(Open3).to receive(:capture2e).with(anything, "gem", any_args).and_return(["", install_status])
+    end
+
+    context "lockfile bundled with a Bundler other than the one running" do
+      before { allow(Open3).to receive(:capture2e).with(anything, "bundle", any_args).and_return(["", status]) }
+
+      it "installs that Bundler if it's missing, then runs bundle lock with it" do
+        rubygems.try_update("css_parser", level: :patch)
+
+        expect(Open3).to have_received(:capture2e).with(bundle_env, "gem", "install", "bundler", "--version", "2.5.0", "--conservative", "--no-document").ordered
+        expect(Open3).to have_received(:capture2e).with(bundle_env, "bundle", "_2.5.0_", "lock", any_args).ordered
+      end
+
+      it "only installs it once per run" do
+        rubygems.try_update("css_parser", level: :patch)
+        rubygems.try_update("css_parser", level: :minor)
+
+        expect(Open3).to have_received(:capture2e).with(anything, "gem", any_args).once
+      end
+    end
+
+    context "lockfile without BUNDLED WITH" do
+      before do
+        File.write("Gemfile.lock", lockfile("1.0.0").sub(/\nBUNDLED WITH\n.*\n\z/, ""))
+        allow(Open3).to receive(:capture2e).with(anything, "bundle", any_args).and_return(["", status])
+      end
+
+      it "runs bundle lock with whichever Bundler RubyGems picks, without installing one" do
+        rubygems.try_update("css_parser", level: :patch)
+
+        expect(Open3).not_to have_received(:capture2e).with(anything, "gem", any_args)
+        expect(Open3).to have_received(:capture2e).with(bundle_env, "bundle", "lock", "--update", "css_parser", "--conservative", "--patch", "--strict")
+      end
+    end
+
+    context "locked Bundler can't be installed" do
+      let(:install_status) { instance_double(Process::Status, success?: false, exitstatus: 2) }
+
+      before do
+        allow(Open3).to receive(:capture2e).with(anything, "gem", any_args).and_return(["Could not find a valid gem 'bundler' (= 2.5.0)", install_status])
+        allow(Open3).to receive(:capture2e).with(anything, "bundle", any_args)
+      end
+
+      it "raises Secupdater::Error rather than UpdateCommandFailed, so the run stops, and doesn't run bundle lock" do
+        expect { rubygems.try_update("css_parser", level: :patch) }.to raise_error(Secupdater::Error) do
+          expect(it).not_to be_a(Secupdater::UpdateCommandFailed)
+          expect(it.message).to include("Bundler 2.5.0", "Could not find a valid gem")
+        end
+        expect(Open3).not_to have_received(:capture2e).with(anything, "bundle", any_args)
+      end
+    end
 
     context "command succeeds" do
       before do
-        allow(Open3).to receive(:capture2e) do
+        allow(Open3).to receive(:capture2e).with(anything, "bundle", any_args) do
           File.write("Gemfile.lock", lockfile("1.1.0"))
           ["Bundle updated!", status]
         end
@@ -158,7 +212,7 @@ RSpec.describe Secupdater::Ecosystem::Rubygems do
       it "runs a strict, conservative, unfrozen bundle lock --update at the given level" do
         rubygems.try_update("css_parser", level: :minor)
 
-        expect(Open3).to have_received(:capture2e).with(bundle_env, "bundle", "lock", "--update", "css_parser", "--conservative", "--minor", "--strict")
+        expect(Open3).to have_received(:capture2e).with(bundle_env, "bundle", "_2.5.0_", "lock", "--update", "css_parser", "--conservative", "--minor", "--strict")
       end
 
       it "returns the lockfile change with its new and original content" do
@@ -169,7 +223,7 @@ RSpec.describe Secupdater::Ecosystem::Rubygems do
     end
 
     context "command succeeds without changing anything" do
-      before { allow(Open3).to receive(:capture2e).and_return(["Bundle updated!", status]) }
+      before { allow(Open3).to receive(:capture2e).with(anything, "bundle", any_args).and_return(["Bundle updated!", status]) }
 
       it "returns no file changes" do
         expect(rubygems.try_update("css_parser", level: :patch)).to eq([])
@@ -177,12 +231,12 @@ RSpec.describe Secupdater::Ecosystem::Rubygems do
     end
 
     context "gem name containing shell metacharacters" do
-      before { allow(Open3).to receive(:capture2e).and_return(["", status]) }
+      before { allow(Open3).to receive(:capture2e).with(anything, "bundle", any_args).and_return(["", status]) }
 
       it "passes it as a single argument without going through a shell" do
         rubygems.try_update("css_parser; touch pwned", level: :patch)
 
-        expect(Open3).to have_received(:capture2e).with(bundle_env, "bundle", "lock", "--update", "css_parser; touch pwned", "--conservative", "--patch", "--strict")
+        expect(Open3).to have_received(:capture2e).with(bundle_env, "bundle", "_2.5.0_", "lock", "--update", "css_parser; touch pwned", "--conservative", "--patch", "--strict")
       end
     end
 
@@ -196,14 +250,14 @@ RSpec.describe Secupdater::Ecosystem::Rubygems do
         }
       end
 
-      before { allow(Open3).to receive(:capture2e).and_return(["", status]) }
+      before { allow(Open3).to receive(:capture2e).with(anything, "bundle", any_args).and_return(["", status]) }
 
       it "runs bundle lock with Bundler's settings from before bundle exec, on the Gemfile in the working directory" do
         rubygems.try_update("css_parser", level: :patch)
 
         expect(Open3).to have_received(:capture2e).with(
           bundle_env.merge("GEM_HOME" => "/usr/local/bundle", "RUBYOPT" => "-W0"),
-          "bundle", "lock", "--update", "css_parser", "--conservative", "--patch", "--strict"
+          "bundle", "_2.5.0_", "lock", "--update", "css_parser", "--conservative", "--patch", "--strict"
         )
       end
     end
@@ -211,7 +265,7 @@ RSpec.describe Secupdater::Ecosystem::Rubygems do
     context "command exits 1" do
       let(:status) { instance_double(Process::Status, success?: false, exitstatus: 1) }
 
-      before { allow(Open3).to receive(:capture2e).and_return(["Could not find gem 'css_parser'", status]) }
+      before { allow(Open3).to receive(:capture2e).with(anything, "bundle", any_args).and_return(["Could not find gem 'css_parser'", status]) }
 
       it "raises a retryable UpdateCommandFailed with the integer exit code and combined output" do
         expect { rubygems.try_update("css_parser", level: :patch) }.to raise_error(Secupdater::UpdateCommandFailed) do
@@ -233,7 +287,7 @@ RSpec.describe Secupdater::Ecosystem::Rubygems do
       context "command exits #{exit_code} (#{reason})" do
         let(:status) { instance_double(Process::Status, success?: false, exitstatus: exit_code) }
 
-        before { allow(Open3).to receive(:capture2e).and_return([reason, status]) }
+        before { allow(Open3).to receive(:capture2e).with(anything, "bundle", any_args).and_return([reason, status]) }
 
         it "raises UnretryableUpdateFailed with the exit code and output" do
           expect { rubygems.try_update("css_parser", level: :patch) }.to raise_error(Secupdater::UnretryableUpdateFailed) do
@@ -247,7 +301,7 @@ RSpec.describe Secupdater::Ecosystem::Rubygems do
     context "command exits 16 (frozen lockfile)" do
       let(:status) { instance_double(Process::Status, success?: false, exitstatus: 16) }
 
-      before { allow(Open3).to receive(:capture2e).and_return(["frozen mode is set", status]) }
+      before { allow(Open3).to receive(:capture2e).with(anything, "bundle", any_args).and_return(["frozen mode is set", status]) }
 
       it "raises Secupdater::Error rather than UpdateCommandFailed, so the run stops" do
         expect { rubygems.try_update("css_parser", level: :patch) }.to raise_error(Secupdater::Error) do

data/spec/secupdater/publisher/gitlab_spec.rb

@@ -86,7 +86,7 @@ RSpec.describe Secupdater::Publisher::Gitlab do
         title: "Upgrade RubyGems dependency css_parser to version 1.1.0",
         description: "Upgrade RubyGems dependency css_parser to version 1.1.0 to address the following security advisories:\n\n* cve/2024-0001\n",
       }, headers: headers)
-      .to_return(status: 201, body: "{}")
+      .to_return(status: 201, body: { iid: 9 }.to_json)
   end
 
   def publish = gitlab.call(ecosystem, bump, advisories, changes)
@@ -243,4 +243,76 @@ RSpec.describe Secupdater::Publisher::Gitlab do
       end
     end
   end
+
+  describe "#finish(vulnerable_names)" do
+    let(:open_secupdater_merge_requests) { [] }
+
+    let!(:find_open_stub) do
+      stub_request(:get, "#{project_api}/merge_requests")
+        .with(query: { state: "opened", labels: "secupdater", target_branch: "main", per_page: "100" }, headers: headers)
+        .to_return(status: 200, body: open_secupdater_merge_requests.to_json)
+    end
+
+    let!(:note_stub) { stub_request(:post, %r{\A#{project_api}/merge_requests/\d+/notes\z}).to_return(status: 201, body: "{}") }
+    let!(:close_stub) do
+      stub_request(:put, %r{\A#{project_api}/merge_requests/\d+\z})
+        .with(body: { state_event: "close" })
+        .to_return(status: 200, body: "{}")
+    end
+
+    context "an older MR for a dependency this run opened a new MR for" do
+      let(:open_secupdater_merge_requests) do
+        [
+          { iid: 5, source_branch: "security/css_parser-1.0.5" },
+          { iid: 9, source_branch: "security/css_parser-1.1.0" }
+        ]
+      end
+
+      before { publish }
+
+      it "closes it, saying which MR superseded it" do
+        expect(gitlab.finish(["css_parser"])).to eq(["closed !5 (security/css_parser-1.0.5): Superseded by !9."])
+
+        expect(a_request(:post, "#{project_api}/merge_requests/5/notes").with(body: { body: "Superseded by !9." })).to have_been_made
+        expect(a_request(:put, "#{project_api}/merge_requests/5")).to have_been_made
+        expect(a_request(:put, //)).to have_been_made.once
+      end
+    end
+
+    context "an MR for a dependency that no longer has advisories" do
+      let(:open_secupdater_merge_requests) { [{ iid: 4, source_branch: "security/net-ssh-7.3.8" }] }
+
+      it "closes it, saying it's no longer needed" do
+        expect(gitlab.finish(["css_parser"])).to eq(
+          ["closed !4 (security/net-ssh-7.3.8): net-ssh no longer has any security advisories on main, so this is no longer needed."]
+        )
+
+        expect(a_request(:put, "#{project_api}/merge_requests/4")).to have_been_made
+        expect(a_request(:put, //)).to have_been_made.once
+      end
+    end
+
+    context "an MR for a dependency that still has advisories, but that this run didn't publish" do
+      let(:open_secupdater_merge_requests) { [{ iid: 4, source_branch: "security/net-ssh-7.3.8" }] }
+
+      it "leaves it alone" do
+        expect(gitlab.finish(["net-ssh"])).to eq([])
+
+        expect(a_request(:put, //)).not_to have_been_made
+        expect(a_request(:post, //)).not_to have_been_made
+      end
+    end
+
+    context "the MR this run opened or kept" do
+      let(:open_secupdater_merge_requests) { [{ iid: 9, source_branch: "security/css_parser-1.1.0" }] }
+
+      before { publish }
+
+      it "leaves it alone" do
+        expect(gitlab.finish(["css_parser"])).to eq([])
+
+        expect(a_request(:put, //)).not_to have_been_made
+      end
+    end
+  end
 end

data/spec/secupdater/update_spec.rb

@@ -85,6 +85,7 @@ RSpec.describe Secupdater::Update do
 
   before do
     allow(publisher).to receive(:call) { |*args| published << args; [:published, nil] } if publisher
+    allow(publisher).to receive(:finish).and_return([]) if publisher
   end
 
   describe "#call(advisories)" do
@@ -274,6 +275,30 @@ RSpec.describe Secupdater::Update do
       end
     end
 
+    context "once every gem has been through the publisher" do
+      let(:outcomes) { { "rack" => "2.1", "nokogiri" => :unchanged } }
+
+      before { allow(publisher).to receive(:finish).and_return(["closed !5 (security/rack-2.0): Superseded by !9."]) }
+
+      it "lets the publisher tidy up, with the names of every gem that has advisories" do
+        update.call([advisory("rack", "cve/1"), advisory("nokogiri", "cve/2")])
+
+        expect(publisher).to have_received(:finish).with(["rack", "nokogiri"])
+      end
+
+      it "logs what it tidied up" do
+        update.call([advisory("rack", "cve/1")])
+
+        expect(log.string).to match(%r{^INFO closed !5 \(security/rack-2\.0\): Superseded by !9\.})
+      end
+
+      it "does so even when there are no advisories, so MRs whose fixes have landed get closed" do
+        expect(update.call([])).to eq({})
+
+        expect(publisher).to have_received(:finish).with([])
+      end
+    end
+
     context "publishing fails for the first gem" do
       let(:outcomes) { { "rack" => "2.1", "nokogiri" => "2.0" } }
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: secupdater
 version: !ruby/object:Gem::Version
-  version: 0.2.0alpha4
+  version: 0.3.0
 platform: ruby
 authors:
 - Ben Anderson