hexpm: support advisories

Author: ankddev

compiler-cli/src/dependencies.rs

@@ -827,12 +827,14 @@ impl ProvidedPackage {
             requirements,
             retirement_status: None,
             outer_checksum: vec![],
+            security_advisories: vec![],
             meta: (),
         };
         hexpm::Package {
             name: name.as_str().into(),
             repository: "local".into(),
             releases: vec![release],
+            advisories: vec![],
         }
     }
 

compiler-cli/src/dependencies/tests.rs

@@ -641,10 +641,12 @@ fn provided_local_to_hex() {
     let hex_package = hexpm::Package {
         name: "package".into(),
         repository: "local".into(),
+        advisories: vec![],
         releases: vec![hexpm::Release {
             version: Version::new(1, 0, 0),
             retirement_status: None,
             outer_checksum: vec![],
+            security_advisories: vec![],
             meta: (),
             requirements: [
                 (
@@ -700,11 +702,13 @@ fn provided_git_to_hex() {
     let hex_package = hexpm::Package {
         name: "package".into(),
         repository: "local".into(),
+        advisories: vec![],
         releases: vec![hexpm::Release {
             version: Version::new(1, 0, 0),
             retirement_status: None,
             outer_checksum: vec![],
             meta: (),
+            security_advisories: vec![],
             requirements: [
                 (
                     "req_1".into(),

compiler-core/src/dependency.rs

@@ -44,11 +44,13 @@ where
     let root = hexpm::Package {
         name: root_name.as_str().into(),
         repository: "local".into(),
+        advisories: vec![],
         releases: vec![Release {
             version: root_version.clone(),
             outer_checksum: vec![],
             retirement_status: None,
             requirements,
+            security_advisories: vec![],
             meta: (),
         }],
     };
@@ -1170,6 +1172,7 @@ but it is locked to 0.2.0, which is incompatible."
             requirements: all_requirements,
             retirement_status: None,
             outer_checksum: vec![1, 2, 3],
+            security_advisories: vec![],
             meta: (),
         }
     }
@@ -1182,6 +1185,7 @@ but it is locked to 0.2.0, which is incompatible."
                 Rc::new(hexpm::Package {
                     name: package.into(),
                     repository: "hexpm".into(),
+                    advisories: vec![],
                     releases,
                 }),
             );

hexpm/src/lib.rs

@@ -393,15 +393,25 @@ pub fn repository_v2_package_parse_body(
         verify_payload(signed, public_key).map_err(|_| ApiError::IncorrectPayloadSignature)?;
 
     let package = proto::package::Package::decode(payload.as_slice())?;
-    let releases = package
-        .releases
-        .clone()
+    let proto::package::Package {
+        name,
+        repository,
+        advisories: proto_advisories,
+        releases: proto_releases,
+    } = package;
+
+    let advisories = proto_advisories
+        .into_iter()
+        .map(proto_to_security_advisory)
+        .collect::<Result<Vec<_>, _>>()?;
+    let releases = proto_releases
         .into_iter()
-        .map(proto_to_release)
+        .map(|release| proto_to_release(release, &advisories))
         .collect::<Result<Vec<_>, _>>()?;
     let package = Package {
-        name: package.name,
-        repository: package.repository,
+        name,
+        repository,
+        advisories,
         releases,
     };
 
@@ -866,7 +876,10 @@ fn proto_to_dep(dep: proto::package::Dependency) -> Result<(String, Dependency),
     ))
 }
 
-fn proto_to_release(release: proto::package::Release) -> Result<Release<()>, ApiError> {
+fn proto_to_release(
+    release: proto::package::Release,
+    package_advisories: &[SecurityAdvisory],
+) -> Result<Release<()>, ApiError> {
     let dependencies = release
         .dependencies
         .clone()
@@ -875,23 +888,79 @@ fn proto_to_release(release: proto::package::Release) -> Result<Release<()>, Api
         .collect::<Result<HashMap<_, _>, _>>()?;
     let version = Version::try_from(release.version.as_str())
         .expect("Failed to parse version format from Hex");
+    let security_advisories = package_advisories
+        .iter()
+        .enumerate()
+        .filter_map(|(index, advisory)| {
+            if release.advisory_indexes.contains(&(index as u32)) {
+                Some(advisory.clone())
+            } else {
+                None
+            }
+        })
+        .collect();
     Ok(Release {
         version,
         outer_checksum: release.outer_checksum.unwrap_or_default(),
         retirement_status: proto_to_retirement_status(release.retired),
         requirements: dependencies,
+        security_advisories,
         meta: (),
     })
 }
 
-#[derive(Debug, PartialEq, Eq, Clone)]
+fn proto_to_security_advisory(
+    advisory: proto::package::SecurityAdvisory,
+) -> Result<SecurityAdvisory, ApiError> {
+    let proto::package::SecurityAdvisory {
+        id,
+        summary,
+        aliases,
+        api_url,
+        cvss_score,
+        html_url,
+        severity,
+    } = advisory;
+    // We use this instead of just `SecurityAdvisory::severity()` to save `None`
+    // state, since otherwise it will be lost.
+    let severity = severity
+        .and_then(|severity| severity.try_into().ok())
+        .map(proto_to_advisory_severity);
+    Ok(SecurityAdvisory {
+        id,
+        summary,
+        html_url,
+        severity,
+        cvss_score,
+        api_url,
+        aliases,
+    })
+}
+
+fn proto_to_advisory_severity(severity: proto::package::AdvisorySeverity) -> AdvisorySeverity {
+    use proto::package::AdvisorySeverity::*;
+    match severity {
+        SeverityNone => AdvisorySeverity::None,
+        SeverityLow => AdvisorySeverity::Low,
+        SeverityMedium => AdvisorySeverity::Medium,
+        SeverityHigh => AdvisorySeverity::High,
+        SeverityCritical => AdvisorySeverity::Critical,
+    }
+}
+
+#[derive(Debug, PartialEq, Clone)]
 pub struct Package {
+    /// Name of package
     pub name: String,
+    /// Name of repository
     pub repository: String,
+    /// All releases of the package
     pub releases: Vec<Release<()>>,
+    /// All security advisories affecting any release of the package
+    pub advisories: Vec<SecurityAdvisory>,
 }
 
-#[derive(Debug, PartialEq, Eq, Clone, serde::Deserialize)]
+#[derive(Debug, PartialEq, Clone, serde::Deserialize)]
 pub struct Release<Meta> {
     /// Release version
     pub version: Version,
@@ -904,6 +973,8 @@ pub struct Release<Meta> {
     /// required when encoding but optional when decoding
     #[serde(alias = "checksum", deserialize_with = "deserialize_checksum")]
     pub outer_checksum: Vec<u8>,
+    /// Security advisories affecting this release of the package
+    pub security_advisories: Vec<SecurityAdvisory>,
     /// This is not present in all API endpoints so may be absent sometimes.
     pub meta: Meta,
 }
@@ -972,6 +1043,63 @@ impl RetirementReason {
     }
 }
 
+#[derive(Debug, PartialEq, Clone, serde::Deserialize)]
+pub struct SecurityAdvisory {
+    /// Advisory identifier (e.g. GHSA-xxxx-xxxx-xxxx or CVE-xxxx-xxxxx)
+    pub id: String,
+    /// Short description of the advisory
+    pub summary: String,
+    /// OSV web URL for the advisory
+    pub html_url: String,
+    /// Severity of the advisory
+    pub severity: Option<AdvisorySeverity>,
+    /// CVSS score (0.0–10.0)
+    pub cvss_score: Option<f32>,
+    /// OSV API URL for the advisory
+    pub api_url: String,
+    /// Other identifiers for the same vulnerability (e.g. a CVE id when the
+    /// primary id is a GHSA id, or vice versa).
+    pub aliases: Vec<String>,
+}
+
+#[derive(Debug, PartialEq, Eq, Clone)]
+pub enum AdvisorySeverity {
+    None,
+    Low,
+    Medium,
+    High,
+    Critical,
+}
+
+impl<'de> serde::Deserialize<'de> for AdvisorySeverity {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        let s: &str = serde::de::Deserialize::deserialize(deserializer)?;
+        match s {
+            "none" => Ok(AdvisorySeverity::None),
+            "low" => Ok(AdvisorySeverity::Low),
+            "medium" => Ok(AdvisorySeverity::Medium),
+            "high" => Ok(AdvisorySeverity::High),
+            "critical" => Ok(AdvisorySeverity::Critical),
+            _ => Err(serde::de::Error::custom("unknown advisory severity type")),
+        }
+    }
+}
+
+impl AdvisorySeverity {
+    pub fn to_str(&self) -> &'static str {
+        match self {
+            AdvisorySeverity::None => "none",
+            AdvisorySeverity::Low => "low",
+            AdvisorySeverity::Medium => "medium",
+            AdvisorySeverity::High => "high",
+            AdvisorySeverity::Critical => "critical",
+        }
+    }
+}
+
 #[derive(Debug, PartialEq, Eq, Clone, serde::Deserialize)]
 pub struct Dependency {
     /// Version requirement of dependency

hexpm/src/tests.rs

@@ -450,6 +450,7 @@ fn expected_package_exfmt() -> Package {
     Package {
         name: "exfmt".to_string(),
         repository: "hexpm".to_string(),
+        advisories: vec![],
         releases: vec![
             Release {
                 version: Version::try_from("0.0.0").unwrap(),
@@ -459,6 +460,7 @@ fn expected_package_exfmt() -> Package {
                     82, 48, 191, 145, 92, 172, 0, 108, 238, 71, 57, 23, 101, 177, 161, 83, 91, 182,
                     18, 232, 249, 225, 29, 12, 246, 5, 215, 165, 32, 57, 179, 110,
                 ],
+                security_advisories: vec![],
                 meta: (),
             },
             Release {
@@ -469,6 +471,7 @@ fn expected_package_exfmt() -> Package {
                     111, 246, 240, 176, 118, 229, 12, 15, 164, 61, 186, 3, 89, 106, 153, 225, 247,
                     52, 245, 8, 216, 139, 21, 232, 200, 16, 214, 59, 241, 188, 9, 6,
                 ],
+                security_advisories: vec![],
                 meta: (),
             },
             Release {
@@ -479,6 +482,7 @@ fn expected_package_exfmt() -> Package {
                     149, 9, 192, 229, 84, 162, 110, 207, 161, 43, 31, 0, 126, 168, 14, 243, 31, 43,
                     195, 238, 100, 91, 78, 100, 213, 181, 101, 154, 106, 168, 170, 107,
                 ],
+                security_advisories: vec![],
                 meta: (),
             },
             Release {
@@ -489,6 +493,7 @@ fn expected_package_exfmt() -> Package {
                     157, 229, 28, 212, 92, 249, 14, 240, 235, 104, 31, 12, 160, 199, 83, 195, 154,
                     105, 222, 37, 221, 80, 181, 183, 113, 240, 234, 107, 144, 85, 255, 65,
                 ],
+                security_advisories: vec![],
                 meta: (),
             },
             Release {
@@ -499,6 +504,7 @@ fn expected_package_exfmt() -> Package {
                     112, 250, 133, 189, 183, 192, 54, 218, 115, 55, 216, 97, 204, 201, 191, 168,
                     250, 133, 138, 252, 202, 240, 74, 197, 228, 235, 81, 18, 241, 7, 155, 38,
                 ],
+                security_advisories: vec![],
                 meta: (),
             },
             Release {
@@ -509,6 +515,7 @@ fn expected_package_exfmt() -> Package {
                     131, 20, 29, 160, 171, 124, 7, 125, 210, 88, 17, 189, 199, 49, 191, 190, 14,
                     162, 38, 247, 52, 176, 189, 17, 7, 188, 151, 152, 24, 64, 170, 29,
                 ],
+                security_advisories: vec![],
                 meta: (),
             },
             Release {
@@ -519,6 +526,7 @@ fn expected_package_exfmt() -> Package {
                     109, 162, 185, 169, 26, 4, 62, 60, 167, 54, 182, 161, 140, 197, 75, 113, 183,
                     117, 247, 201, 218, 228, 14, 160, 115, 157, 196, 51, 108, 16, 96, 217,
                 ],
+                security_advisories: vec![],
                 meta: (),
             },
             Release {
@@ -529,6 +537,7 @@ fn expected_package_exfmt() -> Package {
                     97, 50, 95, 212, 242, 59, 245, 177, 140, 78, 79, 180, 108, 174, 119, 176, 24,
                     80, 218, 152, 178, 227, 152, 242, 32, 126, 72, 67, 222, 0, 173, 170,
                 ],
+                security_advisories: vec![],
                 meta: (),
             },
             Release {
@@ -539,6 +548,7 @@ fn expected_package_exfmt() -> Package {
                     246, 178, 237, 214, 217, 158, 143, 52, 130, 186, 64, 50, 94, 175, 161, 81, 68,
                     186, 4, 73, 53, 226, 235, 144, 209, 84, 231, 136, 165, 119, 122, 126,
                 ],
+                security_advisories: vec![],
                 meta: (),
             },
             Release {
@@ -549,6 +559,7 @@ fn expected_package_exfmt() -> Package {
                     151, 86, 157, 218, 218, 131, 240, 119, 198, 216, 202, 240, 65, 17, 57, 228, 84,
                     252, 59, 207, 246, 49, 22, 21, 52, 47, 51, 139, 190, 9, 95, 109,
                 ],
+                security_advisories: vec![],
                 meta: (),
             },
         ],
@@ -891,6 +902,7 @@ fn get_package_release_response_ok() {
                 "app": "cowboy"
             }
         },
+        "security_advisories": [],
         "meta": {
             "app": "clint",
             "build_tools": ["mix"]
@@ -903,6 +915,7 @@ fn get_package_release_response_ok() {
         resp,
         Release {
             version: Version::new(0, 0, 1),
+            security_advisories: vec![],
             requirements: [
                 (
                     "plug".into(),