all messages for Guix-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
* [bug#31442] [PATCH 0/5] 'guix health': a tool to report vulnerable packages
@ 2018-05-13 20:25 Ludovic Courtès
  2018-05-14  8:25 ` [bug#31442] [PATCH 1/5] profiles: Add '%current-profile', 'user-friendly-profile', & co Ludovic Courtès
  2018-06-09 10:18 ` [bug#31442] [PATCH 0/5] 'guix health': a tool to report vulnerable packages Ludovic Courtès
  0 siblings, 2 replies; 7+ messages in thread
From: Ludovic Courtès @ 2018-05-13 20:25 UTC (permalink / raw)
  To: 31442

Hello Guix!

On IRC davidl shared a shell script that checks the output of ‘guix lint
-c cve’ and uses that to determine vulnerable packages in a profile.
That reminds me of the plan for ‘guix health’ (a tool to do just that),
so I went ahead and tried to make it a reality at last.

This ‘guix health’ reports information about “leaf” packages in a
profile, but not about their dependencies:

--8<---------------cut here---------------start------------->8---
$ ./pre-inst-env guix health -p /run/current-system/profile/
guix health: warning: util-linux@2.31.1 may be vulnerable to CVE-2018-7738
guix health: warning: util-linux@2.31.1 is available but does not fix any of these
hint: Run `guix pull' and then re-run `guix health' to see if fixes are available.  If
none are available, please consider submitting a patch for the package definition of
'util-linux'.


guix health: warning: shadow@4.5 may be vulnerable to CVE-2018-7169
guix health: warning: shadow@4.6 is available and fixes CVE-2018-7169, consider ugprading
guix health: warning: tar@1.29 may be vulnerable to CVE-2016-6321
guix health: warning: tar@1.29 is available but does not fix any of these
hint: Run `guix pull' and then re-run `guix health' to see if fixes are available.  If
none are available, please consider submitting a patch for the package definition of
'tar'.
--8<---------------cut here---------------end--------------->8---

The difficulty here is that we need to know a package’s CPE name before
we can check the CVE database, and we also need to know whether the
package already includes fixes for known CVEs.  This patch set attaches
this information to manifest entries, so that ‘guix health’ can then
rely on it.

Fundamentally, that means we cannot reliably tell much about
dependencies: in cases where the CPE name differs from the Guix name, we
won’t have any match, and more generally, we cannot know what CVE are
patched in the package; we could infer part of this by looking at the
same-named package in the current Guix, but that’s hacky.

I think that longer-term we probably need to attach this kind of
meta-data to packages themselves, by adding a bunch of files in each
package, say under PREFIX/guix.  We could do that for search paths as
well.

Should we satisfy ourselves with the current approach in the meantime?
Thoughts?

Besides, support for properties in manifest entries seems useful to me,
so we may want to keep it regardless of whether we take ‘guix health’
as-is.

Ludo’.

Ludovic Courtès (5):
  profiles: Add '%current-profile', 'user-friendly-profile', & co.
  packages: Add 'package-patched-vulnerabilities'.
  profiles: Add 'properties' field to manifest entries.
  profiles: Record fixed vulnerabilities as properties of entries.
  DRAFT Add 'guix health'.

 Makefile.am              |   1 +
 guix/packages.scm        |  28 +++++++
 guix/profiles.scm        |  91 ++++++++++++++++++++--
 guix/scripts/health.scm  | 158 +++++++++++++++++++++++++++++++++++++++
 guix/scripts/lint.scm    |  23 +-----
 guix/scripts/package.scm |  40 ----------
 po/guix/POTFILES.in      |   1 +
 tests/packages.scm       |  15 ++++
 tests/profiles.scm       |  22 ++++++
 9 files changed, 312 insertions(+), 67 deletions(-)
 create mode 100644 guix/scripts/health.scm

-- 
2.17.0

^ permalink raw reply	[flat|nested] 7+ messages in thread

end of thread, other threads:[~2018-06-09 10:19 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-05-13 20:25 [bug#31442] [PATCH 0/5] 'guix health': a tool to report vulnerable packages Ludovic Courtès
2018-05-14  8:25 ` [bug#31442] [PATCH 1/5] profiles: Add '%current-profile', 'user-friendly-profile', & co Ludovic Courtès
2018-05-14  8:25   ` [bug#31442] [PATCH 2/5] packages: Add 'package-patched-vulnerabilities' Ludovic Courtès
2018-05-14  8:25   ` [bug#31442] [PATCH 3/5] profiles: Add 'properties' field to manifest entries Ludovic Courtès
2018-05-14  8:25   ` [bug#31442] [PATCH 4/5] profiles: Record fixed vulnerabilities as properties of entries Ludovic Courtès
2018-05-14  8:25   ` [bug#31442] [PATCH 5/5] DRAFT Add 'guix health' Ludovic Courtès
2018-06-09 10:18 ` [bug#31442] [PATCH 0/5] 'guix health': a tool to report vulnerable packages Ludovic Courtès

Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/guix.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.