still_active 3.0.0.rc4 → 3.0.0.rc5

data/lib/helpers/ruby_helper.rb

@@ -38,8 +38,8 @@ module StillActive
         latest_release_date: latest_release_date,
         libyear: LibyearHelper.gem_libyear(
           version_used_release_date: current_release_date,
-          latest_version_release_date: latest_release_date,
-        ),
+          latest_version_release_date: latest_release_date
+        )
       }
     end
 
@@ -54,7 +54,7 @@ module StillActive
     private
 
     def current_ruby_version
-      lockfile_ruby_version || (RUBY_ENGINE == "ruby" ? RUBY_VERSION : nil)
+      lockfile_ruby_version || ((RUBY_ENGINE == "ruby") ? RUBY_VERSION : nil)
     end
 
     def lockfile_ruby_version

data/lib/helpers/runtime_ceiling_helper.rb

@@ -82,7 +82,7 @@ module StillActive
         ceiling_version: ceiling[:version].to_s,
         ceiling_eol_date: ceiling[:eol_date],
         oldest_supported: support_window[:oldest_supported].to_s,
-        latest_stable: support_window[:latest_stable].to_s,
+        latest_stable: support_window[:latest_stable].to_s
       }
       finding.merge(severity: ConstraintHelper.constraint_severity(finding))
     end
@@ -92,7 +92,7 @@ module StillActive
         requirement: requirement,
         eol_forced: false,
         oldest_supported: support_window[:oldest_supported].to_s,
-        latest_stable: support_window[:latest_stable].to_s,
+        latest_stable: support_window[:latest_stable].to_s
       }
       finding.merge(severity: ConstraintHelper.constraint_severity(finding))
     end

data/lib/helpers/sarif_helper.rb

@@ -40,7 +40,7 @@ module StillActive
         ruby_info: ruby_info,
         line_index: line_index,
         ruby_line: ruby_line,
-        lockfile_uri: lockfile_uri,
+        lockfile_uri: lockfile_uri
       )
 
       JSON.pretty_generate(document(results: results, tool_version: tool_version, flavour: :ruby))
@@ -64,7 +64,7 @@ module StillActive
         ruby_info: nil,
         line_index: {},
         ruby_line: nil,
-        lockfile_uri: source_uri,
+        lockfile_uri: source_uri
       )
 
       JSON.pretty_generate(document(results: results, tool_version: tool_version, flavour: :neutral))
@@ -95,13 +95,13 @@ module StillActive
               "version" => tool_version,
               "semanticVersion" => VersionHelper.to_semver(tool_version),
               "informationUri" => TOOL_URI,
-              "rules" => catalog.map { |r| sarif_rule(r) },
-            },
+              "rules" => catalog.map { |r| sarif_rule(r) }
+            }
           },
-          "originalUriBaseIds" => { "%SRCROOT%" => { "uri" => "file:///" } },
+          "originalUriBaseIds" => {"%SRCROOT%" => {"uri" => "file:///"}},
           "results" => results.map { |res| stamp_rule_index(res, index_by_id) },
-          "columnKind" => "utf16CodeUnits",
-        }],
+          "columnKind" => "utf16CodeUnits"
+        }]
       }
     end
 
@@ -113,17 +113,17 @@ module StillActive
     end
 
     def sarif_rule(r)
-      properties = { "tags" => r[:tags], "precision" => "high" }
+      properties = {"tags" => r[:tags], "precision" => "high"}
       properties["security-severity"] = r[:security_severity] if r[:security_severity]
       {
         "id" => r[:id],
         "name" => r[:name],
-        "shortDescription" => { "text" => r[:short] },
-        "fullDescription" => { "text" => r[:full] },
-        "help" => { "text" => r[:help_text], "markdown" => r[:help_markdown] },
+        "shortDescription" => {"text" => r[:short]},
+        "fullDescription" => {"text" => r[:full]},
+        "help" => {"text" => r[:help_text], "markdown" => r[:help_markdown]},
         "helpUri" => Sarif::Rules.help_uri(r[:id]),
-        "defaultConfiguration" => { "level" => r[:level] },
-        "properties" => properties,
+        "defaultConfiguration" => {"level" => r[:level]},
+        "properties" => properties
       }
     end
 
@@ -157,16 +157,16 @@ module StillActive
         if ActivityHelper.activity_level(data) == :critical
           activity = ActivityHelper.last_activity(data)
           years = ((Time.now - activity[:date]) / SECONDS_PER_YEAR).round(1)
-          noun = activity[:kind] == :release ? "no release" : "no commits"
+          noun = (activity[:kind] == :release) ? "no release" : "no commits"
           out << mark_suppressed(
             result(
               "SA002",
               name,
               "#{display} #{version}: #{noun} in #{years} years (last #{activity[:date].utc.strftime("%Y-%m-%d")})#{alternatives_suffix(data)}#{transitive_suffix(data)}.",
-              location,
+              location
             ),
             display,
-            :activity,
+            :activity
           )
         end
       end
@@ -220,7 +220,7 @@ module StillActive
     end
 
     def language_ceiling_level(data)
-      { critical: "error", warning: "warning", note: "note" }.fetch(data[:language_ceiling][:severity], "note")
+      {critical: "error", warning: "warning", note: "note"}.fetch(data[:language_ceiling][:severity], "note")
     end
 
     def language_ceiling_message(display, version, data)
@@ -234,7 +234,7 @@ module StillActive
         else
           "no #{runtime} #{ceiling[:latest_stable]} support yet"
         end
-      fix = ceiling[:fixed_by_upgrade] && data[:latest_version] ? "; upgrade to #{data[:latest_version]} to lift it" : ""
+      fix = (ceiling[:fixed_by_upgrade] && data[:latest_version]) ? "; upgrade to #{data[:latest_version]} to lift it" : ""
       "#{display} #{version}: requires #{runtime} #{ceiling[:requirement]}, #{body}#{fix}#{transitive_suffix(data)}."
     end
 
@@ -250,7 +250,7 @@ module StillActive
       # security finding, not the maintenance-tier signal poison usually is.
       return "error" if data[:poison_security_relevant]
 
-      { critical: "error", warning: "warning", note: "note" }.fetch(data[:poison_severity], "warning")
+      {critical: "error", warning: "warning", note: "note"}.fetch(data[:poison_severity], "warning")
     end
 
     def poison_message(display, version, data)
@@ -290,14 +290,14 @@ module StillActive
     def mark_suppressed(result_hash, gem_name, signal, advisory: nil, aliases: [])
       config = StillActive.config
       if config.ignored_gems.include?(gem_name)
-        result_hash["suppressions"] = [{ "kind" => "external", "justification" => "ignored via --ignore" }]
+        result_hash["suppressions"] = [{"kind" => "external", "justification" => "ignored via --ignore"}]
         return result_hash
       end
 
       entry = config.suppressions.match(gem: gem_name, signal: signal, advisory: advisory, aliases: aliases)
       return result_hash unless entry
 
-      suppression = { "kind" => "external" }
+      suppression = {"kind" => "external"}
       suppression["justification"] = entry.reason if entry.reason
       result_hash["suppressions"] = [suppression]
       result_hash
@@ -331,9 +331,9 @@ module StillActive
         "#{display} #{version}: #{advisory_id}#{title}#{alias_suffix}#{no_fix}#{transitive_suffix(data)}.",
         location,
         level: level,
-        fp_extra: advisory_id,
+        fp_extra: advisory_id
       )
-      base["properties"] = { "security-severity" => severity } if severity
+      base["properties"] = {"security-severity" => severity} if severity
       mark_suppressed(base, display, :vulnerability, advisory: vuln[:id], aliases: Array(vuln[:aliases]))
     end
 
@@ -354,13 +354,13 @@ module StillActive
       base = {
         "ruleId" => "SA006",
         "level" => "error",
-        "message" => { "text" => "Ruby #{version} has reached end-of-life#{eol_part}.#{latest_part}" },
+        "message" => {"text" => "Ruby #{version} has reached end-of-life#{eol_part}.#{latest_part}"},
         "locations" => [{
           "physicalLocation" => {
-            "artifactLocation" => { "uri" => lockfile_uri, "uriBaseId" => "%SRCROOT%" },
-            "region" => { "startLine" => ruby_line },
-          },
-        }],
+            "artifactLocation" => {"uri" => lockfile_uri, "uriBaseId" => "%SRCROOT%"},
+            "region" => {"startLine" => ruby_line}
+          }
+        }]
       }
       apply_fingerprint(base, fingerprint("SA006", "ruby"))
     end
@@ -370,8 +370,8 @@ module StillActive
       base = {
         "ruleId" => rule_id,
         "level" => level,
-        "message" => { "text" => message },
-        "locations" => [location],
+        "message" => {"text" => message},
+        "locations" => [location]
       }
       apply_fingerprint(base, fingerprint(rule_id, gem_name, fp_extra))
     end
@@ -379,7 +379,7 @@ module StillActive
     def apply_fingerprint(result, fp)
       result["partialFingerprints"] = {
         "primaryLocationLineHash" => fp,
-        "stillActiveFinding/v1" => fp,
+        "stillActiveFinding/v1" => fp
       }
       result
     end
@@ -387,9 +387,9 @@ module StillActive
     def location_for(gem_name, line_index, lockfile_uri)
       {
         "physicalLocation" => {
-          "artifactLocation" => { "uri" => lockfile_uri, "uriBaseId" => "%SRCROOT%" },
-          "region" => { "startLine" => line_index[gem_name] || 1 },
-        },
+          "artifactLocation" => {"uri" => lockfile_uri, "uriBaseId" => "%SRCROOT%"},
+          "region" => {"startLine" => line_index[gem_name] || 1}
+        }
       }
     end
 

data/lib/helpers/status_helper.rb

@@ -45,7 +45,7 @@ module StillActive
         # archived != EOL: a repo archived while the gem still publishes recent
         # releases (development moved to a monorepo) isn't dead -- let the
         # releases speak, but keep :stale so the archived repo stays a yellow flag.
-        ActivityHelper.release_recency_level(gem_data) == :ok ? :stale : :archived
+        (ActivityHelper.release_recency_level(gem_data) == :ok) ? :stale : :archived
       when :critical then :legacy # long-dormant but clean: feature-complete, not a fire
       else level # :stale / :ok / :unknown
       end

data/lib/helpers/summary_helper.rb

@@ -43,7 +43,7 @@ module StillActive
         vulnerabilities: vulnerabilities,
         # The single worst per-gem verdict (plus EOL Ruby), so a consumer reads
         # one project-level posture without scanning every gem's status.
-        status: StatusHelper.project_status(result, ruby_info: ruby_info),
+        status: StatusHelper.project_status(result, ruby_info: ruby_info)
       }
       summary[:ruby_eol] = ruby_info[:eol] == true if ruby_info
       summary

data/lib/helpers/terminal_helper.rb

@@ -39,7 +39,7 @@ module StillActive
     # "gems" for a native Ruby audit -- calling npm/cargo/go packages "gems" is a
     # Ruby-ism that reads wrong cross-ecosystem.
     def dependency_noun(result)
-      result.each_value.any? { |data| data[:ecosystem] } ? "dependencies" : "gems"
+      (result.each_value.any? { |data| data[:ecosystem] }) ? "dependencies" : "gems"
     end
 
     def build_row(name, data)
@@ -49,7 +49,7 @@ module StillActive
         format_activity(data),
         format_scorecard(data[:scorecard_score]),
         format_vulns(data),
-        format_license(data[:license]),
+        format_license(data[:license])
       ]
     end
 
@@ -153,9 +153,9 @@ module StillActive
     # gems point at the parent (#60), direct ones offer alternatives.
     def sub_lines(data)
       lines = if data[:poison]
-        [poison_line(data), (data[:direct] == false ? nil : alternatives_line(data))]
+        [poison_line(data), ((data[:direct] == false) ? nil : alternatives_line(data))]
       else
-        [data[:direct] == false ? dependency_path_line(data) : alternatives_line(data)]
+        [(data[:direct] == false) ? dependency_path_line(data) : alternatives_line(data)]
       end
       # A language-runtime ceiling is orthogonal to poison/alternatives (a gem can
       # be maintained yet still cap your Ruby), so it always gets its own line.
@@ -206,7 +206,7 @@ module StillActive
       return if constraints.nil? || constraints.empty?
 
       path = data[:dependency_path]
-      via = data[:direct] == false && path && path.length >= 2 ? " (via #{path.first})" : ""
+      via = (data[:direct] == false && path && path.length >= 2) ? " (via #{path.first})" : ""
       # Colour carries the tier: red = act-now (3+ majors behind), yellow = plan,
       # dim = a minor/FYI cap (1 behind). A security-relevant cap (it pins a
       # vulnerable dependency below the fix) is always red -- that's the finding to
@@ -234,7 +234,7 @@ module StillActive
     end
 
     def poison_colour(severity)
-      { critical: :red, warning: :yellow, note: :dim }.fetch(severity, :yellow)
+      {critical: :red, warning: :yellow, note: :dim}.fetch(severity, :yellow)
     end
 
     # A worst-first "N label (X critical, Y note)" summary fragment, coloured by
@@ -339,11 +339,11 @@ module StillActive
       parts << activity
       parts << "#{summary[:vulnerabilities]} vulnerabilities"
       poison_tiers = result.each_value.select { |data| data[:poison] }.map { |data| data[:poison_severity] }
-      poison_part = tier_summary_part(poison_tiers, "#{poison_tiers.size} poison-#{poison_tiers.size == 1 ? "pill" : "pills"}")
+      poison_part = tier_summary_part(poison_tiers, "#{poison_tiers.size} poison-#{(poison_tiers.size == 1) ? "pill" : "pills"}")
       parts << poison_part if poison_part
       ceilings = result.each_value.filter_map { |data| data[:language_ceiling] }
       runtimes = ceilings.map { |ceiling| ceiling[:runtime] }.uniq
-      runtime_label = runtimes.size == 1 ? runtimes.first : "language"
+      runtime_label = (runtimes.size == 1) ? runtimes.first : "language"
       ceiling_part = tier_summary_part(ceilings.map { |ceiling| ceiling[:severity] }, "#{ceilings.size} #{runtime_label} ceiling#{"s" unless ceilings.size == 1}")
       parts << ceiling_part if ceiling_part
       total_libyear = LibyearHelper.total_libyear(result)

data/lib/helpers/vulnerability_helper.rb

@@ -10,7 +10,7 @@ module StillActive
     # a CVSS-4-only advisory returns cvss3Score 0 (unscored); OSV's
     # `database_specific.severity` reads correctly for it and rescues a real HIGH from
     # fail-closed noise. GitHub uses MODERATE where we use medium.
-    OSV_LABELS = { "critical" => "critical", "high" => "high", "moderate" => "medium", "medium" => "medium", "low" => "low" }.freeze
+    OSV_LABELS = {"critical" => "critical", "high" => "high", "moderate" => "medium", "medium" => "medium", "low" => "low"}.freeze
 
     def highest_severity(vulnerabilities)
       return if vulnerabilities.nil? || vulnerabilities.empty?

data/lib/still_active/artifactory_client.rb

@@ -5,6 +5,8 @@ require "cgi"
 require "json"
 require "uri"
 require_relative "../helpers/http_helper"
+require_relative "compact_index_client"
+require_relative "source_credentials"
 
 module StillActive
   module ArtifactoryClient
@@ -18,8 +20,18 @@ module StillActive
       false
     end
 
+    # Version sources in precedence order:
+    #   1. the compact index, the only endpoint that lists what the repo can
+    #      actually resolve (#142)
+    #   2. the versions API, for hosts that serve no compact index
+    #   3. AQL, a cache inventory, when neither answers
+    # The compact index carries no timestamps, so a compact-index list is dated
+    # from the versions API.
     def versions(gem_name:, source_uri:)
       headers = auth_headers(gem_name: gem_name, source_uri: source_uri)
+      compact = CompactIndexClient.versions(gem_name: gem_name, source_uri: source_uri, headers: headers)
+      return dated(compact, gem_name: gem_name, source_uri: source_uri, headers: headers) unless compact.empty?
+
       vs = RubygemsClient.versions(gem_name: gem_name, source_uri: source_uri, headers: headers)
       return vs unless vs.empty?
 
@@ -30,14 +42,36 @@ module StillActive
 
     private
 
+    # Matched on the exact version number, so the versions API can only annotate a
+    # version the compact index already listed. That keeps a name collision from
+    # contributing anything: the placeholder gem's versions simply don't match, and
+    # the real ones stay undated rather than borrowing a stranger's release date.
+    def dated(versions, gem_name:, source_uri:, headers:)
+      return versions if versions.all? { |version| version["created_at"] }
+
+      published = RubygemsClient.versions(gem_name: gem_name, source_uri: source_uri, headers: headers)
+      return versions unless published.is_a?(Array)
+
+      by_number = published.grep(Hash).to_h { |version| [version["number"], version] }
+      # compact first: an absent compact-index field must not blank out the value
+      # the versions API supplied for the same version.
+      versions.map { |version| (by_number[version["number"]] || {}).merge(version.compact) }
+    end
+
+    # Bundler's own per-host credential (bundle config / BUNDLE_<HOST>) wins, exactly
+    # as `bundle install` would use it. Only when the host has none do we consider
+    # still_active's ambient --artifactory-token, and only for the one host the user
+    # explicitly allowlisted: the token is not host-keyed, so sending it to a
+    # lockfile-derived host would leak it. See SourceCredentials for the host-keyed
+    # store this shares with the generic private-source path.
     def credentials(gem_name:, source_uri:)
-      host = URI(source_uri).host
-      bundler = Bundler.settings[source_uri] || Bundler.settings[host]
+      bundler = Bundler.settings.credentials_for(URI(source_uri))
       return bundler if bundler && !bundler.empty?
 
       global = StillActive.config.artifactory_token
       return unless global
 
+      host = URI(source_uri).host
       configured_host = StillActive.config.artifactory_host
       unless configured_host && host&.casecmp?(configured_host)
         warn_unauthorized_host(gem_name: gem_name, host: host)
@@ -48,23 +82,15 @@ module StillActive
     end
 
     def warn_unauthorized_host(gem_name:, host:)
-      $stderr.puts(
+      warn(
         "warning: an Artifactory token is set but #{host} (source for #{gem_name}) is not an authorized host, " \
           "so the token will not be sent. " \
-          "To allow it, set --artifactory-host=#{host} or STILL_ACTIVE_ARTIFACTORY_HOST=#{host}",
+          "To allow it, set --artifactory-host=#{host} or STILL_ACTIVE_ARTIFACTORY_HOST=#{host}"
       )
     end
 
     def auth_headers(gem_name:, source_uri:)
-      creds = credentials(gem_name: gem_name, source_uri: source_uri)
-      return {} unless creds
-
-      if creds.include?(":")
-        user, pass = creds.split(":", 2).map { |part| CGI.unescape(part) }
-        { "Authorization" => "Basic #{["#{user}:#{pass}"].pack("m0")}" }
-      else
-        { "Authorization" => "Bearer #{creds}" }
-      end
+      SourceCredentials.auth_header(credentials(gem_name: gem_name, source_uri: source_uri))
     end
 
     # Artifactory's Rubygems-compatible API
@@ -99,8 +125,8 @@ module StillActive
         base = URI(artifactory_base)
         path = "#{base.path}#{AQL_PATH}"
         query = {
-          "name" => { "$match" => "#{gem_name}-*.gem" },
-          "repo" => repo_key,
+          "name" => {"$match" => "#{gem_name}-*.gem"},
+          "repo" => repo_key
         }
         body = %(items.find(#{JSON.generate(query)}).include("repo", "path", "name", "created"))
         response = HttpHelper.post_json(base, path, body: body, headers: headers.merge("Content-Type" => "text/plain"))
@@ -115,7 +141,7 @@ module StillActive
       def parse_source_url(source_uri)
         match = source_uri.match(SOURCE_URL_PATTERN)
         unless match
-          $stderr.puts("warning: unrecognized Artifactory source URL for AQL fallback: #{source_uri}")
+          warn("warning: unrecognized Artifactory source URL for AQL fallback: #{source_uri}")
           return [nil, nil]
         end
 
@@ -128,10 +154,13 @@ module StillActive
             version = extract_version(item["name"], gem_name)
             next if version.nil?
 
+            # No "created_at": the AQL `created` field is when this Artifactory
+            # cached the artifact, not when the version was published. The two
+            # agree to within a day for a gem someone pulled promptly and diverge
+            # by years for one pulled late, so it cannot back a staleness signal.
             {
               "number" => version,
-              "created_at" => item["created"],
-              "prerelease" => Gem::Version.new(version).prerelease?,
+              "prerelease" => Gem::Version.new(version).prerelease?
             }
           end
           .uniq { |h| h["number"] }