still_active 1.6.0 → 3.0.0.rc1

data/lib/still_active/sbom_reader.rb

@@ -0,0 +1,191 @@
+# frozen_string_literal: true
+
+require "json"
+require "uri"
+require "package_url"
+
+module StillActive
+  # Reads a CycloneDX SBOM (e.g. produced by Syft) into a clean, normalized
+  # dependency set -- the breadth input for non-Ruby ecosystems, where the
+  # maintenance lens runs over deps.dev/ecosyste.ms.
+  #
+  # `parse` returns both the assessable dependencies AND the components it could
+  # NOT assess (a real dependency in an unsupported ecosystem, or a library with
+  # no PURL -- typically a git/path/local source). Surfacing those is the point:
+  # silently dropping them would let an audit report "all clear" while ignoring
+  # the deps that are often the riskiest. Genuine non-package noise (GitHub
+  # Actions `pkg:github`, opaque binaries `pkg:generic`, and file/application
+  # components) is excluded, not surfaced.
+  #
+  # `read` keeps the simple "just the dependencies" shape. Never raises -- a
+  # missing/malformed SBOM or a bad PURL degrades to empty/skip.
+  module SbomReader
+    extend self
+
+    Result = Data.define(:dependencies, :unassessable)
+
+    # PURL type -> still_active ecosystem (also the deps.dev `system`, lowercased).
+    ECOSYSTEMS = {
+      "gem" => :rubygems,
+      "npm" => :npm,
+      "pypi" => :pypi,
+      "cargo" => :cargo,
+      "maven" => :maven,
+      "golang" => :go,
+      "nuget" => :nuget,
+    }.freeze
+
+    # PURL types that are not package dependencies: CI actions and opaque
+    # binaries. Excluded from both lists (not "unassessed deps").
+    NOISE_TYPES = ["github", "generic"].freeze
+
+    def read(path) = parse(path).dependencies
+    def read_string(body) = parse_string(body).dependencies
+
+    def parse(path)
+      parse_string(File.read(path))
+    rescue SystemCallError, IOError
+      Result.new(dependencies: [], unassessable: [])
+    end
+
+    def parse_string(body)
+      doc = JSON.parse(body)
+      components = doc.is_a?(Hash) ? doc["components"] : nil
+      return Result.new(dependencies: [], unassessable: []) unless components.is_a?(Array)
+
+      # Only trust the prod/dev split when the generator actually marks it
+      # somewhere (scope, or a dev property). syft-style SBOMs mark nothing, so an
+      # unmarked component is genuinely unknown -- never assume it's production.
+      # Scoped to library components: scope/properties are legal on any component
+      # type (application/file/...), and a dev signal on one of those is unrelated
+      # to whether the dependency library components are marked.
+      marks_dev = components.any? { |c| c.is_a?(Hash) && c["type"] == "library" && dev_signal?(c) }
+
+      deps = []
+      unassessable = []
+      components.each do |component|
+        kind, entry = classify(component)
+        entry[:production] = !dev_signal?(component) if kind == :dependency && marks_dev
+        deps << entry if kind == :dependency
+        unassessable << entry if kind == :unassessable
+      end
+      # uniq collapses a package that a generator lists more than once (e.g. Syft's
+      # per-location entries); `production` is derived from each component's own
+      # signal, so duplicates of the same name+version dedup cleanly unless a
+      # generator marks the copies inconsistently (malformed; not observed).
+      Result.new(dependencies: deps.uniq, unassessable: unassessable.uniq)
+    rescue JSON::ParserError
+      Result.new(dependencies: [], unassessable: [])
+    end
+
+    private
+
+    # Whether a component is marked dev/test-only. CycloneDX `scope` (excluded =
+    # not part of the product, optional = not needed at runtime) is the standard;
+    # tools that don't set scope may instead emit a property (cyclonedx-npm's
+    # `cdx:npm:package:development=true`). Absent both, this is false -- the caller
+    # only trusts a false when the document marks dev somewhere.
+    def dev_signal?(component)
+      scope = component["scope"]
+      return true if scope == "excluded" || scope == "optional"
+
+      Array(component["properties"]).any? do |p|
+        p.is_a?(Hash) && p["value"] == "true" && p["name"].to_s.match?(/(\A|:)dev(elopment)?\z/)
+      end
+    end
+
+    # [:dependency, {...}] | [:unassessable, {...}] | nil (non-package noise).
+    def classify(component)
+      return unless component.is_a?(Hash) && component["type"] == "library"
+
+      name = component["name"]
+      purl = component["purl"]
+      return [:unassessable, { ecosystem: nil, name: name, reason: :no_purl }] unless purl.is_a?(String) && !purl.empty?
+
+      classify_purl(purl, name)
+    end
+
+    # Public registry hosts per ecosystem. A purl `repository_url` qualifier means
+    # a non-default (private/alternative) registry per the purl spec, EXCEPT when a
+    # generator redundantly names the public one -- so we still assess those.
+    PUBLIC_REGISTRY_HOSTS = [
+      "rubygems.org",
+      "registry.npmjs.org",
+      "npmjs.org",
+      "registry.yarnpkg.com",
+      "pypi.org",
+      "files.pythonhosted.org",
+      "crates.io",
+      "static.crates.io",
+      "index.crates.io",
+      "repo1.maven.org",
+      "repo.maven.apache.org",
+      "api.nuget.org",
+      "proxy.golang.org",
+    ].freeze
+
+    def classify_purl(purl, name)
+      parsed = PackageURL.parse(purl)
+      type = parsed.type&.downcase
+      ecosystem = ECOSYSTEMS[type]
+
+      if ecosystem
+        return [:unassessable, { ecosystem: type, name: name, reason: :no_version }] if parsed.version.to_s.empty?
+
+        full_name = build_name(ecosystem, parsed.namespace, parsed.name)
+        repository_url = parsed.qualifiers&.dig("repository_url")
+        # A private/alternative registry: never look the name up on the public
+        # registry (a same-named public package's data is not this one's -- the #43
+        # dependency-confusion guard, cross-ecosystem). We never dial the URL; its
+        # presence alone is the signal. Limit: this can only fire when the SBOM
+        # carries repository_url; a generator that omits it (Syft often can't
+        # determine the source registry) leaves a private package indistinguishable
+        # from a public one, so it is still assessed by name. Best-effort, not a
+        # guarantee that every private package is caught.
+        if repository_url && !public_registry?(repository_url)
+          return [:unassessable, { ecosystem: ecosystem, name: full_name, version: parsed.version, reason: :private_registry, repository_url: repository_url }]
+        end
+
+        [:dependency, { ecosystem: ecosystem, name: full_name, version: parsed.version }]
+      elsif NOISE_TYPES.include?(type)
+        nil # CI actions / opaque binaries: not a package dependency
+      else
+        [:unassessable, { ecosystem: type, name: name, reason: :unsupported_ecosystem }]
+      end
+    rescue ArgumentError
+      # InvalidPackageURL is a subclass of ArgumentError, but PackageURL.parse also
+      # raises a BARE ArgumentError on an empty name-after-namespace (`pkg:npm/@1.0.0`)
+      # or bad percent-encoding, both common in real Syft/Trivy output. Catch both so
+      # one malformed component degrades to unassessable, never a backtrace that drops
+      # every other dependency's verdict (SbomReader's documented "never raises").
+      [:unassessable, { ecosystem: nil, name: name, reason: :malformed_purl }]
+    end
+
+    # Whether a repository_url points at a known public registry. We only read the
+    # host; we never connect to it (a lockfile/SBOM-derived URL is untrusted). An
+    # unparseable or non-public host reads as private, failing safe.
+    def public_registry?(repository_url)
+      host = registry_host(repository_url)
+      !host.nil? && PUBLIC_REGISTRY_HOSTS.include?(host)
+    end
+
+    def registry_host(url)
+      URI.parse(url.include?("//") ? url : "//#{url}").host&.downcase
+    rescue URI::InvalidURIError
+      nil
+    end
+
+    # Reconstruct the lookup name from the PURL's namespace + name: npm
+    # `@scope/name`, maven `group:artifact`, Go module path `github.com/owner/name`;
+    # pypi/cargo/gem/nuget have no namespace and use the bare name.
+    def build_name(ecosystem, namespace, name)
+      return name if namespace.to_s.empty?
+
+      case ecosystem
+      when :npm, :go then "#{namespace}/#{name}"
+      when :maven then "#{namespace}:#{name}"
+      else name
+      end
+    end
+  end
+end

data/lib/still_active/sbom_workflow.rb

@@ -0,0 +1,96 @@
+# frozen_string_literal: true
+
+require_relative "ecosystem_lens"
+require_relative "ceiling_reconciler"
+require_relative "poison_security_correlator"
+require_relative "../helpers/python_helper"
+require "async"
+require "async/barrier"
+require "async/semaphore"
+
+module StillActive
+  # The SBOM audit's fan-out, parallel to Workflow but for a cross-ecosystem
+  # SBOM rather than a Bundler lockfile: it runs EcosystemLens over each
+  # dependency concurrently and returns a result hash the same output path can
+  # render. Keyed by "ecosystem/name@version" (not bare name) so nothing collides
+  # and overwrites: not an npm `foo` against a pypi `foo`, and -- the case a merged
+  # monorepo SBOM actually produces -- not two versions of the same package pinned
+  # by different subprojects (a lockfile resolves one version per name, an SBOM
+  # doesn't). Each is a distinct assessable unit with its own version-specific
+  # advisory set, so collapsing them would silently drop one dep's verdict.
+  module SbomWorkflow
+    extend self
+
+    # `assessed` is the "ecosystem/name@version" => gem_data hash; `failures` is
+    # the deps whose lens call raised (a rate-limited/flaky deps.dev, or a bug
+    # hitting every dep). The two are returned separately so run_sbom can surface
+    # the failures instead of dropping them: a raised dep that just vanished would
+    # be absent from the JSON, uncounted, and past the exit gate, letting a
+    # rate-limited run read "all clear" while silently skipping deps.
+    Outcome = Data.define(:assessed, :failures)
+
+    def call(sbom_result, &on_progress)
+      dependencies = sbom_result.dependencies
+      Async do
+        # The Python runtime support window, fetched once for the whole SBOM (the
+        # language-ceiling input for pypi deps). Guarded like the native Ruby path:
+        # a feed failure degrades to "no ceiling checks", never aborts the audit.
+        python_range =
+          begin
+            PythonHelper.supported_python_range
+          rescue StandardError => e
+            $stderr.puts("warning: Python support window lookup failed: #{e.class} (#{e.message}); skipping language-ceiling checks")
+            nil
+          end
+        barrier = Async::Barrier.new
+        semaphore = Async::Semaphore.new(StillActive.config.parallelism, parent: barrier)
+        result = {}
+        failures = []
+        # Memoizes each capped dep's RESOLVED latest version across the whole SBOM
+        # (keyed by ecosystem+name inside the lens), so a dep pinned by several
+        # dormant packages is fetched once. Unresolved lookups aren't cached (a
+        # transient nil must not suppress a later package's pill), so concurrent
+        # first-misses on the same dep may briefly double-fetch; harmless.
+        constraint_cache = {}
+        total = dependencies.size
+        completed = 0
+        dependencies.each do |dep|
+          semaphore.async do
+            # Carry the SBOM's prod-vs-dev/test verdict onto the assessment so the
+            # output can separate prod risk from test debt. `slice` copies it only
+            # when the SBOM actually marked it (SbomReader leaves the key absent
+            # otherwise): absent stays "unknown", never a false that reads as test-only.
+            result["#{dep[:ecosystem]}/#{dep[:name]}@#{dep[:version]}"] =
+              EcosystemLens.assess(ecosystem: dep[:ecosystem], name: dep[:name], version: dep[:version], constraint_cache: constraint_cache, python_range: python_range)
+                .merge(dep.slice(:production))
+          rescue StandardError => e
+            # One dependency's failure must not abort the audit, but it must not
+            # disappear either: record it as an unassessable entry (same shape as
+            # the reader's, with a distinct reason) so it's counted and reported.
+            # production rides along (when known, via slice) so a failed prod dep
+            # stays distinguishable from a failed dev one.
+            failures << { ecosystem: dep[:ecosystem], name: dep[:name], version: dep[:version], reason: :assessment_error, error: "#{e.class}: #{e.message}" }
+              .merge(dep.slice(:production))
+            $stderr.puts("error assessing #{dep[:ecosystem]}/#{dep[:name]}@#{dep[:version]}: #{e.class}\n\t#{e.message}")
+          ensure
+            completed += 1
+            on_progress&.call(completed, total)
+          end
+        end
+        barrier.wait
+        # Whole-tree correlation once every package's signals are in: a Python
+        # ceiling's "upgrade to lift it" must not contradict a poison finding that
+        # caps the same package below that upgrade (same guarantee as the native path).
+        CeilingReconciler.reconcile_ceiling_with_poison(result)
+        # Flag poison caps that pin a vulnerable dependency (the moat's strongest
+        # case: an archived package holding you on a known-vulnerable dep).
+        PoisonSecurityCorrelator.correlate(result)
+        # Stable, diffable order regardless of async completion order.
+        Outcome.new(
+          assessed: result.sort_by { |key, _| key }.to_h,
+          failures: failures.sort_by { |failure| "#{failure[:ecosystem]}/#{failure[:name]}@#{failure[:version]}" },
+        )
+      end.wait
+    end
+  end
+end

data/lib/still_active/suppressions.rb

@@ -0,0 +1,143 @@
+# frozen_string_literal: true
+
+require "date"
+
+module StillActive
+  # Granular, auditable suppression of individual findings, loaded from the
+  # `ignore:` block of a committed .still_active.yml. Each entry silences one
+  # signal (activity / vulnerability / libyear / poison) or one advisory for one
+  # gem, optionally until an expiry date, replacing the all-or-nothing whole-gem
+  # --ignore. A bare gem
+  # name (or a gem-only mapping) keeps the old whole-gem behaviour so --ignore
+  # can union into the same list.
+  #
+  # Two guardrails keep suppression from hiding live risk: a lapsed entry stops
+  # applying so the finding re-surfaces, and a vulnerability suppression must
+  # name an explicit advisory id, so a newly disclosed CVE on the same gem is
+  # never pre-silenced.
+  class Suppressions
+    GATEABLE_SIGNALS = [:activity, :vulnerability, :libyear, :poison, :language_ceiling].freeze
+
+    Entry = Struct.new(:gem, :advisory, :signal, :reason, :expires, keyword_init: true) do
+      def whole_gem?
+        signal.nil? && advisory.nil?
+      end
+
+      def expired?(today)
+        !expires.nil? && expires < today
+      end
+
+      def covers?(signal:, advisory:, aliases:)
+        return true if whole_gem?
+
+        if self.signal == :vulnerability
+          [advisory, *aliases].compact.include?(self.advisory)
+        else
+          self.signal == signal
+        end
+      end
+    end
+
+    class << self
+      def from(raw, today: Date.today)
+        warnings = []
+        entries = Array(raw).filter_map { |item| parse_entry(item, warnings) }
+        new(entries, warnings, today)
+      end
+
+      private
+
+      def parse_entry(item, warnings)
+        return Entry.new(gem: item, advisory: nil, signal: nil, reason: nil, expires: nil) if item.is_a?(String)
+
+        unless item.is_a?(Hash)
+          warnings << "ignoring suppression entry #{item.inspect}: expected a gem name or a mapping"
+          return
+        end
+
+        gem = item["gem"]
+        advisory = item["advisory"]
+        signal = item["signal"]&.to_sym
+        signal ||= :vulnerability if advisory
+        expires = parse_expires(item["expires"], item, warnings)
+        return if expires == :invalid
+
+        label = gem || advisory || "entry"
+        return unless valid?(gem:, advisory:, signal:, label:, warnings:)
+
+        Entry.new(gem:, advisory:, signal:, reason: item["reason"], expires:)
+      end
+
+      # Returns true when the entry is well-formed, otherwise records a warning
+      # and returns false so the caller skips (does not apply) the entry.
+      def valid?(gem:, advisory:, signal:, label:, warnings:)
+        if gem.nil? && signal.nil? && advisory.nil?
+          warnings << "ignoring suppression entry: needs a gem, signal, or advisory"
+          return false
+        end
+        if signal && !GATEABLE_SIGNALS.include?(signal)
+          warnings << "ignoring suppression for #{label}: unknown signal #{signal.inspect} (expected activity, vulnerability, libyear, or poison)"
+          return false
+        end
+        if signal == :vulnerability && advisory.nil?
+          warnings << "ignoring vulnerability suppression for #{label}: must name an advisory id so newly disclosed advisories still surface"
+          return false
+        end
+        if [:activity, :libyear, :poison].include?(signal) && gem.nil?
+          warnings << "ignoring #{signal} suppression: must name a gem"
+          return false
+        end
+
+        true
+      end
+
+      def parse_expires(value, item, warnings)
+        return if value.nil?
+        return value if value.is_a?(Date)
+
+        Date.parse(value.to_s)
+      rescue ArgumentError, TypeError
+        warnings << "ignoring suppression #{item.inspect}: unparseable expires #{value.inspect}"
+        :invalid
+      end
+    end
+
+    attr_reader :warnings
+
+    def initialize(entries, warnings, today)
+      @entries = entries
+      @warnings = warnings
+      @today = today
+    end
+
+    def suppressed?(gem:, signal:, advisory: nil, aliases: [])
+      !match(gem:, signal:, advisory:, aliases:).nil?
+    end
+
+    # Warnings for live entries that name a gem absent from the audited set: they
+    # can never match, so they are dead config (a typo, or a gem removed since
+    # the suppression was written). This is the presence axis of suppression rot;
+    # `expired?` already covers the time axis, so an expired entry isn't
+    # re-reported here, and a gem-agnostic advisory entry (gem nil) is skipped
+    # since it applies across the whole graph.
+    def stale_gem_warnings(present_gems)
+      @entries.filter_map do |entry|
+        next if entry.expired?(@today)
+        next unless entry.gem && !present_gems.include?(entry.gem)
+
+        "suppression for #{entry.gem} never applies: it is not in the audited dependencies (typo, or removed since it was suppressed?)"
+      end
+    end
+
+    # The first live entry covering this finding, or nil. Used by SARIF to carry
+    # the suppression's reason as the native suppressions[] justification.
+    def match(gem:, signal:, advisory: nil, aliases: [])
+      @entries.find do |entry|
+        next false if entry.expired?(@today)
+        next false unless entry.gem.nil? || entry.gem == gem
+
+        entry.covers?(signal:, advisory:, aliases:)
+      end
+    end
+  end
+end

data/lib/still_active/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module StillActive
-  VERSION = "1.6.0"
+  VERSION = "3.0.0.rc1"
 end