Skip to content

Commit fc80ca4

Browse files
Avgor46Avgor46
committed
test: Add test for homebrew scanning
1 parent 9c91d64 commit fc80ca4

7 files changed

Lines changed: 353 additions & 0 deletions

File tree

‎cmd/osv-scanner/scan/source/__snapshots__/command_test.snap‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3256,6 +3256,64 @@ Total 1 package affected by 45 known vulnerabilities (5 Critical, 17 High, 23 Me
32563256

32573257
---
32583258

3259+
[TestCommand_HomebrewWithAnnotators/homebrew_extractor_explicitly_enabled_with_annotator - 1]
3260+
Scanning dir ./testdata/homebrew/Cellar/
3261+
Scanned <rootdir>/testdata/homebrew/Cellar/libssh2/1.11.1/INSTALL_RECEIPT.json file and found 1 package
3262+
3263+
Scanning Result (package view):
3264+
Total 1 package affected by 5 known vulnerabilities (0 Critical, 0 High, 0 Medium, 0 Low, 5 Unknown) from 1 ecosystem.
3265+
0 vulnerabilities can be fixed.
3266+
3267+
3268+
GIT
3269+
+----------------------------------------------------------------------------------------------+
3270+
| Source:os:<rootdir>/testdata/homebrew/Cell |
3271+
| ar/libssh2/1.11.1/INSTALL_RECEIPT.json |
3272+
+----------------+-------------------+------------------+------------+-------------------------+
3273+
| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) |
3274+
+----------------+-------------------+------------------+------------+-------------------------+
3275+
| libssh2 | 1.11.1 | No fix available | 5 | |
3276+
+----------------+-------------------+------------------+------------+-------------------------+
3277+
3278+
For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve <image_name>`.
3279+
You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical <image_name>`.
3280+
3281+
---
3282+
3283+
[TestCommand_HomebrewWithAnnotators/homebrew_extractor_explicitly_enabled_with_annotator - 2]
3284+
3285+
---
3286+
3287+
[TestCommand_HomebrewWithAnnotators/homebrew_extractor_via_artifact_plugin - 1]
3288+
Scanning dir ./testdata/homebrew/Cellar/
3289+
Scanned <rootdir>/testdata/homebrew/Cellar/libssh2/1.11.1/.brew/libssh2.rb file and found 0 packages
3290+
Scanned <rootdir>/testdata/homebrew/Cellar/libssh2/1.11.1/.brew/libssh2.rb file and found 0 packages
3291+
Scanned <rootdir>/testdata/homebrew/Cellar/libssh2/1.11.1/INSTALL_RECEIPT.json file and found 1 package
3292+
3293+
Scanning Result (package view):
3294+
Total 1 package affected by 5 known vulnerabilities (0 Critical, 0 High, 0 Medium, 0 Low, 5 Unknown) from 1 ecosystem.
3295+
0 vulnerabilities can be fixed.
3296+
3297+
3298+
GIT
3299+
+----------------------------------------------------------------------------------------------+
3300+
| Source:os:<rootdir>/testdata/homebrew/Cell |
3301+
| ar/libssh2/1.11.1/INSTALL_RECEIPT.json |
3302+
+----------------+-------------------+------------------+------------+-------------------------+
3303+
| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) |
3304+
+----------------+-------------------+------------------+------------+-------------------------+
3305+
| libssh2 | 1.11.1 | No fix available | 5 | |
3306+
+----------------+-------------------+------------------+------------+-------------------------+
3307+
3308+
For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve <image_name>`.
3309+
You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical <image_name>`.
3310+
3311+
---
3312+
3313+
[TestCommand_HomebrewWithAnnotators/homebrew_extractor_via_artifact_plugin - 2]
3314+
3315+
---
3316+
32593317
[TestCommand_HtmlFile - 1]
32603318
Scanning dir ./testdata/locks-many/composer.lock
32613319
Scanned <rootdir>/testdata/locks-many/composer.lock file and found 1 package

‎cmd/osv-scanner/scan/source/command_test.go‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -445,6 +445,38 @@ func TestCommand_JavareachArchive(t *testing.T) {
445445
}
446446
}
447447

448+
func TestCommand_HomebrewWithAnnotators(t *testing.T) {
449+
t.Parallel()
450+
451+
if runtime.GOOS != "darwin" {
452+
testutility.Skip(t, "The detector in this test only works on Darwin")
453+
}
454+
455+
client := testcmd.InsertCassette(t)
456+
457+
tests := []testcmd.Case{
458+
{
459+
Name: "homebrew_extractor_via_artifact_plugin",
460+
Args: []string{"", "source", "-r", "--no-ignore", "--experimental-plugins=artifact", "./testdata/homebrew/Cellar/"},
461+
Exit: 1,
462+
},
463+
{
464+
Name: "homebrew_extractor_explicitly_enabled_with_annotator",
465+
Args: []string{"", "source", "-r", "--no-ignore", "--experimental-plugins=os/homebrew", "--experimental-plugins=misc/brew-source", "./testdata/homebrew/Cellar/"},
466+
Exit: 1,
467+
},
468+
}
469+
for _, tt := range tests {
470+
t.Run(tt.Name, func(t *testing.T) {
471+
t.Parallel()
472+
473+
tt.HTTPClient = testcmd.WithTestNameHeader(t, *client)
474+
475+
testcmd.RunAndMatchSnapshots(t, tt)
476+
})
477+
}
478+
}
479+
448480
func TestCommand_ExplicitExtractors_WithDefaults(t *testing.T) {
449481
t.Parallel()
450482

‎cmd/osv-scanner/scan/source/testdata/cassettes/TestCommand_HomebrewWithAnnotators.yaml‎

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
---
2+
version: 2
3+
interactions:
4+
- id: 0
5+
request:
6+
proto: HTTP/1.1
7+
proto_major: 1
8+
proto_minor: 1
9+
content_length: 170
10+
host: api.osv.dev
11+
body: |
12+
{
13+
"queries": [
14+
{
15+
"package": {
16+
"ecosystem": "GIT",
17+
"name": "https://github.com/libssh2/libssh2"
18+
},
19+
"version": "1.11.1"
20+
}
21+
]
22+
}
23+
headers:
24+
Content-Type:
25+
- application/json
26+
X-Test-Name:
27+
- TestCommand_HomebrewWithAnnotators/homebrew_extractor_explicitly_enabled_with_annotator
28+
url: https://api.osv.dev/v1/querybatch
29+
method: POST
30+
response:
31+
proto: HTTP/2.0
32+
proto_major: 2
33+
proto_minor: 0
34+
content_length: 337
35+
body: |
36+
{
37+
"results": [
38+
{
39+
"vulns": [
40+
{
41+
"id": "OSV-2022-24",
42+
"modified": "2025-02-01T14:16:58.476563Z"
43+
},
44+
{
45+
"id": "OSV-2024-847",
46+
"modified": "2025-02-01T14:27:03.602163Z"
47+
},
48+
{
49+
"id": "OSV-2025-433",
50+
"modified": "2025-06-05T00:02:57.200566Z"
51+
},
52+
{
53+
"id": "OSV-2025-90",
54+
"modified": "2025-12-20T14:15:39.033263Z"
55+
},
56+
{
57+
"id": "OSV-2025-92",
58+
"modified": "2025-12-20T14:25:09.128654Z"
59+
}
60+
]
61+
}
62+
]
63+
}
64+
headers:
65+
Content-Length:
66+
- "337"
67+
Content-Type:
68+
- application/json
69+
status: 200 OK
70+
code: 200
71+
duration: 0s
72+
- id: 1
73+
request:
74+
proto: HTTP/1.1
75+
proto_major: 1
76+
proto_minor: 1
77+
content_length: 170
78+
host: api.osv.dev
79+
body: |
80+
{
81+
"queries": [
82+
{
83+
"package": {
84+
"ecosystem": "GIT",
85+
"name": "https://github.com/libssh2/libssh2"
86+
},
87+
"version": "1.11.1"
88+
}
89+
]
90+
}
91+
headers:
92+
Content-Type:
93+
- application/json
94+
X-Test-Name:
95+
- TestCommand_HomebrewWithAnnotators/homebrew_extractor_via_artifact_plugin
96+
url: https://api.osv.dev/v1/querybatch
97+
method: POST
98+
response:
99+
proto: HTTP/2.0
100+
proto_major: 2
101+
proto_minor: 0
102+
content_length: 337
103+
body: |
104+
{
105+
"results": [
106+
{
107+
"vulns": [
108+
{
109+
"id": "OSV-2022-24",
110+
"modified": "2025-02-01T14:16:58.476563Z"
111+
},
112+
{
113+
"id": "OSV-2024-847",
114+
"modified": "2025-02-01T14:27:03.602163Z"
115+
},
116+
{
117+
"id": "OSV-2025-433",
118+
"modified": "2025-06-05T00:02:57.200566Z"
119+
},
120+
{
121+
"id": "OSV-2025-90",
122+
"modified": "2025-12-20T14:15:39.033263Z"
123+
},
124+
{
125+
"id": "OSV-2025-92",
126+
"modified": "2025-12-20T14:25:09.128654Z"
127+
}
128+
]
129+
}
130+
]
131+
}
132+
headers:
133+
Content-Length:
134+
- "337"
135+
Content-Type:
136+
- application/json
137+
status: 200 OK
138+
code: 200
139+
duration: 0s

‎cmd/osv-scanner/scan/source/testdata/homebrew/Cellar/libssh2/1.11.1/.brew/libssh2.rb‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
class Libssh2 < Formula
2+
desc "C library implementing the SSH2 protocol"
3+
homepage "https://libssh2.org/"
4+
url "https://libssh2.org/download/libssh2-1.11.1.tar.gz"
5+
mirror "https://github.com/libssh2/libssh2/releases/download/libssh2-1.11.1/libssh2-1.11.1.tar.gz"
6+
mirror "http://download.openpkg.org/components/cache/libssh2/libssh2-1.11.1.tar.gz"
7+
sha256 "d9ec76cbe34db98eec3539fe2c899d26b0c837cb3eb466a56b0f109cabf658f7"
8+
license "BSD-3-Clause"
9+
10+
livecheck do
11+
url "https://libssh2.org/download/"
12+
regex(/href=.*?libssh2[._-]v?(\d+(?:\.\d+)+)\./i)
13+
end
14+
15+
head do
16+
url "https://github.com/libssh2/libssh2.git", branch: "master"
17+
18+
depends_on "autoconf" => :build
19+
depends_on "automake" => :build
20+
depends_on "libtool" => :build
21+
end
22+
23+
depends_on "openssl@3"
24+
25+
uses_from_macos "zlib"
26+
27+
def install
28+
args = %W[
29+
--disable-silent-rules
30+
--disable-examples-build
31+
--with-openssl
32+
--with-libz
33+
--with-libssl-prefix=#{Formula["openssl@3"].opt_prefix}
34+
]
35+
36+
system "./buildconf" if build.head?
37+
system "./configure", *std_configure_args, *args
38+
system "make", "install"
39+
end
40+
41+
test do
42+
(testpath/"test.c").write <<~EOS
43+
#include <libssh2.h>
44+
45+
int main(void)
46+
{
47+
libssh2_exit();
48+
return 0;
49+
}
50+
EOS
51+
52+
system ENV.cc, "test.c", "-L#{lib}", "-lssh2", "-o", "test"
53+
system "./test"
54+
end
55+
end

‎cmd/osv-scanner/scan/source/testdata/homebrew/Cellar/libssh2/1.11.1/INSTALL_RECEIPT.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"homebrew_version": "4.4.1-34-gaf958b2",
3+
"used_options": [],
4+
"unused_options": [],
5+
"built_as_bottle": true,
6+
"poured_from_bottle": true,
7+
"loaded_from_api": true,
8+
"installed_as_dependency": true,
9+
"installed_on_request": false,
10+
"changed_files": [
11+
"NEWS",
12+
"lib/pkgconfig/libssh2.pc"
13+
],
14+
"time": 1765466145,
15+
"source_modified_time": 1729065801,
16+
"compiler": "clang",
17+
"aliases": [],
18+
"runtime_dependencies": [
19+
{
20+
"full_name": "ca-certificates",
21+
"version": "2025-12-02",
22+
"revision": 0,
23+
"bottle_rebuild": 0,
24+
"pkg_version": "2025-12-02",
25+
"declared_directly": false
26+
},
27+
{
28+
"full_name": "openssl@3",
29+
"version": "3.6.0",
30+
"revision": 0,
31+
"bottle_rebuild": 0,
32+
"pkg_version": "3.6.0",
33+
"declared_directly": true
34+
}
35+
],
36+
"source": {
37+
"spec": "stable",
38+
"versions": {
39+
"stable": "1.11.1",
40+
"head": null,
41+
"version_scheme": 0,
42+
"compatibility_version": null
43+
},
44+
"path": "/Users/user/Library/Caches/Homebrew/api/formula.jws.json",
45+
"tap_git_head": null,
46+
"tap": "homebrew/core"
47+
},
48+
"arch": "arm64",
49+
"built_on": {
50+
"os": "Macintosh",
51+
"os_version": "macOS 15",
52+
"cpu_family": "dunno",
53+
"xcode": "16.0",
54+
"clt": "16.0.0.0.1.1724870825",
55+
"preferred_perl": "5.34"
56+
}
57+
}

‎internal/scalibrplugin/__snapshots__/resolve_test.snap‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,10 @@ baseimage
2828
go/binary
2929
java/archive
3030
javascript/nodemodules
31+
misc/brew-source
3132
os/apk
3233
os/dpkg
34+
os/homebrew
3335
python/wheelegg
3436
rust/cargoauditable
3537
vex/os-duplicate/apk

0 commit comments

Comments
 (0)