Skip to content

Commit 1541db0

Browse files
Avgor46Avgor46
committed
test: Add test for homebrew scanning
1 parent f01cd51 commit 1541db0

7 files changed

Lines changed: 353 additions & 0 deletions

File tree

‎cmd/osv-scanner/scan/source/__snapshots__/command_test.snap‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3410,6 +3410,64 @@ Total 1 package affected by 40 known vulnerabilities (5 Critical, 15 High, 20 Me
34103410

34113411
---
34123412

3413+
[TestCommand_HomebrewWithAnnotators/homebrew_extractor_explicitly_enabled_with_annotator - 1]
3414+
Scanning dir ./testdata/homebrew/Cellar/
3415+
Scanned <rootdir>/testdata/homebrew/Cellar/libssh2/1.11.1/INSTALL_RECEIPT.json file and found 1 package
3416+
3417+
Scanning Result (package view):
3418+
Total 1 package affected by 5 known vulnerabilities (0 Critical, 0 High, 0 Medium, 0 Low, 5 Unknown) from 1 ecosystem.
3419+
0 vulnerabilities can be fixed.
3420+
3421+
3422+
GIT
3423+
+----------------------------------------------------------------------------------------------+
3424+
| Source:os:<rootdir>/testdata/homebrew/Cell |
3425+
| ar/libssh2/1.11.1/INSTALL_RECEIPT.json |
3426+
+----------------+-------------------+------------------+------------+-------------------------+
3427+
| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) |
3428+
+----------------+-------------------+------------------+------------+-------------------------+
3429+
| libssh2 | 1.11.1 | No fix available | 5 | |
3430+
+----------------+-------------------+------------------+------------+-------------------------+
3431+
3432+
For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve <image_name>`.
3433+
You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical <image_name>`.
3434+
3435+
---
3436+
3437+
[TestCommand_HomebrewWithAnnotators/homebrew_extractor_explicitly_enabled_with_annotator - 2]
3438+
3439+
---
3440+
3441+
[TestCommand_HomebrewWithAnnotators/homebrew_extractor_via_artifact_plugin - 1]
3442+
Scanning dir ./testdata/homebrew/Cellar/
3443+
Scanned <rootdir>/testdata/homebrew/Cellar/libssh2/1.11.1/.brew/libssh2.rb file and found 0 packages
3444+
Scanned <rootdir>/testdata/homebrew/Cellar/libssh2/1.11.1/.brew/libssh2.rb file and found 0 packages
3445+
Scanned <rootdir>/testdata/homebrew/Cellar/libssh2/1.11.1/INSTALL_RECEIPT.json file and found 1 package
3446+
3447+
Scanning Result (package view):
3448+
Total 1 package affected by 5 known vulnerabilities (0 Critical, 0 High, 0 Medium, 0 Low, 5 Unknown) from 1 ecosystem.
3449+
0 vulnerabilities can be fixed.
3450+
3451+
3452+
GIT
3453+
+----------------------------------------------------------------------------------------------+
3454+
| Source:os:<rootdir>/testdata/homebrew/Cell |
3455+
| ar/libssh2/1.11.1/INSTALL_RECEIPT.json |
3456+
+----------------+-------------------+------------------+------------+-------------------------+
3457+
| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) |
3458+
+----------------+-------------------+------------------+------------+-------------------------+
3459+
| libssh2 | 1.11.1 | No fix available | 5 | |
3460+
+----------------+-------------------+------------------+------------+-------------------------+
3461+
3462+
For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve <image_name>`.
3463+
You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical <image_name>`.
3464+
3465+
---
3466+
3467+
[TestCommand_HomebrewWithAnnotators/homebrew_extractor_via_artifact_plugin - 2]
3468+
3469+
---
3470+
34133471
[TestCommand_HtmlFile - 1]
34143472

34153473
---

‎cmd/osv-scanner/scan/source/command_test.go‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -450,6 +450,38 @@ func TestCommand_JavareachArchive(t *testing.T) {
450450
}
451451
}
452452

453+
func TestCommand_HomebrewWithAnnotators(t *testing.T) {
454+
t.Parallel()
455+
456+
if runtime.GOOS != "darwin" {
457+
testutility.Skip(t, "The detector in this test only works on Darwin")
458+
}
459+
460+
client := testcmd.InsertCassette(t)
461+
462+
tests := []testcmd.Case{
463+
{
464+
Name: "homebrew_extractor_via_artifact_plugin",
465+
Args: []string{"", "source", "-r", "--no-ignore", "--experimental-plugins=artifact", "./testdata/homebrew/Cellar/"},
466+
Exit: 1,
467+
},
468+
{
469+
Name: "homebrew_extractor_explicitly_enabled_with_annotator",
470+
Args: []string{"", "source", "-r", "--no-ignore", "--experimental-plugins=os/homebrew", "--experimental-plugins=misc/brew-source", "./testdata/homebrew/Cellar/"},
471+
Exit: 1,
472+
},
473+
}
474+
for _, tt := range tests {
475+
t.Run(tt.Name, func(t *testing.T) {
476+
t.Parallel()
477+
478+
tt.HTTPClient = testcmd.WithTestNameHeader(t, *client)
479+
480+
testcmd.RunAndMatchSnapshots(t, tt)
481+
})
482+
}
483+
}
484+
453485
func TestCommand_ExplicitExtractors_WithDefaults(t *testing.T) {
454486
t.Parallel()
455487

‎cmd/osv-scanner/scan/source/testdata/cassettes/TestCommand_HomebrewWithAnnotators.yaml‎

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
---
2+
version: 2
3+
interactions:
4+
- id: 0
5+
request:
6+
proto: HTTP/1.1
7+
proto_major: 1
8+
proto_minor: 1
9+
content_length: 170
10+
host: api.osv.dev
11+
body: |
12+
{
13+
"queries": [
14+
{
15+
"package": {
16+
"ecosystem": "GIT",
17+
"name": "https://github.com/libssh2/libssh2"
18+
},
19+
"version": "1.11.1"
20+
}
21+
]
22+
}
23+
headers:
24+
Content-Type:
25+
- application/json
26+
X-Test-Name:
27+
- TestCommand_HomebrewWithAnnotators/homebrew_extractor_explicitly_enabled_with_annotator
28+
url: https://api.osv.dev/v1/querybatch
29+
method: POST
30+
response:
31+
proto: HTTP/2.0
32+
proto_major: 2
33+
proto_minor: 0
34+
content_length: 337
35+
body: |
36+
{
37+
"results": [
38+
{
39+
"vulns": [
40+
{
41+
"id": "OSV-2022-24",
42+
"modified": "2025-02-01T14:16:58.476563Z"
43+
},
44+
{
45+
"id": "OSV-2024-847",
46+
"modified": "2025-02-01T14:27:03.602163Z"
47+
},
48+
{
49+
"id": "OSV-2025-433",
50+
"modified": "2025-06-05T00:02:57.200566Z"
51+
},
52+
{
53+
"id": "OSV-2025-90",
54+
"modified": "2025-12-20T14:15:39.033263Z"
55+
},
56+
{
57+
"id": "OSV-2025-92",
58+
"modified": "2025-12-20T14:25:09.128654Z"
59+
}
60+
]
61+
}
62+
]
63+
}
64+
headers:
65+
Content-Length:
66+
- "337"
67+
Content-Type:
68+
- application/json
69+
status: 200 OK
70+
code: 200
71+
duration: 0s
72+
- id: 1
73+
request:
74+
proto: HTTP/1.1
75+
proto_major: 1
76+
proto_minor: 1
77+
content_length: 170
78+
host: api.osv.dev
79+
body: |
80+
{
81+
"queries": [
82+
{
83+
"package": {
84+
"ecosystem": "GIT",
85+
"name": "https://github.com/libssh2/libssh2"
86+
},
87+
"version": "1.11.1"
88+
}
89+
]
90+
}
91+
headers:
92+
Content-Type:
93+
- application/json
94+
X-Test-Name:
95+
- TestCommand_HomebrewWithAnnotators/homebrew_extractor_via_artifact_plugin
96+
url: https://api.osv.dev/v1/querybatch
97+
method: POST
98+
response:
99+
proto: HTTP/2.0
100+
proto_major: 2
101+
proto_minor: 0
102+
content_length: 337
103+
body: |
104+
{
105+
"results": [
106+
{
107+
"vulns": [
108+
{
109+
"id": "OSV-2022-24",
110+
"modified": "2025-02-01T14:16:58.476563Z"
111+
},
112+
{
113+
"id": "OSV-2024-847",
114+
"modified": "2025-02-01T14:27:03.602163Z"
115+
},
116+
{
117+
"id": "OSV-2025-433",
118+
"modified": "2025-06-05T00:02:57.200566Z"
119+
},
120+
{
121+
"id": "OSV-2025-90",
122+
"modified": "2025-12-20T14:15:39.033263Z"
123+
},
124+
{
125+
"id": "OSV-2025-92",
126+
"modified": "2025-12-20T14:25:09.128654Z"
127+
}
128+
]
129+
}
130+
]
131+
}
132+
headers:
133+
Content-Length:
134+
- "337"
135+
Content-Type:
136+
- application/json
137+
status: 200 OK
138+
code: 200
139+
duration: 0s

‎cmd/osv-scanner/scan/source/testdata/homebrew/Cellar/libssh2/1.11.1/.brew/libssh2.rb‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
class Libssh2 < Formula
2+
desc "C library implementing the SSH2 protocol"
3+
homepage "https://libssh2.org/"
4+
url "https://libssh2.org/download/libssh2-1.11.1.tar.gz"
5+
mirror "https://github.com/libssh2/libssh2/releases/download/libssh2-1.11.1/libssh2-1.11.1.tar.gz"
6+
mirror "http://download.openpkg.org/components/cache/libssh2/libssh2-1.11.1.tar.gz"
7+
sha256 "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7"
8+
license "BSD-3-Clause"
9+
10+
livecheck do
11+
url "https://libssh2.org/download/"
12+
regex(/href=.*?libssh2[._-]v?(\d+(?:\.\d+)+)\./i)
13+
end
14+
15+
head do
16+
url "https://github.com/libssh2/libssh2.git", branch: "master"
17+
18+
depends_on "autoconf" => :build
19+
depends_on "automake" => :build
20+
depends_on "libtool" => :build
21+
end
22+
23+
depends_on "openssl@3"
24+
25+
uses_from_macos "zlib"
26+
27+
def install
28+
args = %W[
29+
--disable-silent-rules
30+
--disable-examples-build
31+
--with-openssl
32+
--with-libz
33+
--with-libssl-prefix=#{Formula["openssl@3"].opt_prefix}
34+
]
35+
36+
system "./buildconf" if build.head?
37+
system "./configure", *std_configure_args, *args
38+
system "make", "install"
39+
end
40+
41+
test do
42+
(testpath/"test.c").write <<~EOS
43+
#include <libssh2.h>
44+
45+
int main(void)
46+
{
47+
libssh2_exit();
48+
return 0;
49+
}
50+
EOS
51+
52+
system ENV.cc, "test.c", "-L#{lib}", "-lssh2", "-o", "test"
53+
system "./test"
54+
end
55+
end

‎cmd/osv-scanner/scan/source/testdata/homebrew/Cellar/libssh2/1.11.1/INSTALL_RECEIPT.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"homebrew_version": "4.4.1-34-gaf958b2",
3+
"used_options": [],
4+
"unused_options": [],
5+
"built_as_bottle": true,
6+
"poured_from_bottle": true,
7+
"loaded_from_api": true,
8+
"installed_as_dependency": true,
9+
"installed_on_request": false,
10+
"changed_files": [
11+
"NEWS",
12+
"lib/pkgconfig/libssh2.pc"
13+
],
14+
"time": 1765466145,
15+
"source_modified_time": 1729065801,
16+
"compiler": "clang",
17+
"aliases": [],
18+
"runtime_dependencies": [
19+
{
20+
"full_name": "ca-certificates",
21+
"version": "2025-12-02",
22+
"revision": 0,
23+
"bottle_rebuild": 0,
24+
"pkg_version": "2025-12-02",
25+
"declared_directly": false
26+
},
27+
{
28+
"full_name": "openssl@3",
29+
"version": "3.6.0",
30+
"revision": 0,
31+
"bottle_rebuild": 0,
32+
"pkg_version": "3.6.0",
33+
"declared_directly": true
34+
}
35+
],
36+
"source": {
37+
"spec": "stable",
38+
"versions": {
39+
"stable": "1.11.1",
40+
"head": null,
41+
"version_scheme": 0,
42+
"compatibility_version": null
43+
},
44+
"path": "/Users/user/Library/Caches/Homebrew/api/formula.jws.json",
45+
"tap_git_head": null,
46+
"tap": "homebrew/core"
47+
},
48+
"arch": "arm64",
49+
"built_on": {
50+
"os": "Macintosh",
51+
"os_version": "macOS 15",
52+
"cpu_family": "dunno",
53+
"xcode": "16.0",
54+
"clt": "16.0.0.0.1.1724870825",
55+
"preferred_perl": "5.34"
56+
}
57+
}

‎internal/scalibrplugin/__snapshots__/resolve_test.snap‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -128,8 +128,10 @@ baseimage
128128
go/binary
129129
java/archive
130130
javascript/nodemodules
131+
misc/brew-source
131132
os/apk
132133
os/dpkg
134+
os/homebrew
133135
python/wheelegg
134136
rust/cargoauditable
135137
vex/os-duplicate/apk

0 commit comments

Comments
 (0)