From unknown Fri Jun 13 11:36:41 2025 X-Loop: help-debbugs@gnu.org Subject: [bug#31443] [PATCH 0/5] 'guix health': a tool to report vulnerable packages Resent-From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Original-Sender: "Debbugs-submit" Resent-CC: guix-patches@gnu.org Resent-Date: Sun, 13 May 2018 22:40:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: report 31443 X-GNU-PR-Package: guix-patches X-GNU-PR-Keywords: patch To: 31443@debbugs.gnu.org Cc: Ludovic =?UTF-8?Q?Court=C3=A8s?= X-Debbugs-Original-To: guix-patches@gnu.org Received: via spool by submit@debbugs.gnu.org id=B.152625116032260 (code B ref -1); Sun, 13 May 2018 22:40:02 +0000 Received: (at submit) by debbugs.gnu.org; 13 May 2018 22:39:20 +0000 Received: from localhost ([127.0.0.1]:32859 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fHzeB-0008OG-Py for submit@debbugs.gnu.org; Sun, 13 May 2018 18:39:20 -0400 Received: from eggs.gnu.org ([208.118.235.92]:34043) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fHze9-0008O2-2n for submit@debbugs.gnu.org; Sun, 13 May 2018 18:39:17 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fHze2-0003CX-R5 for submit@debbugs.gnu.org; Sun, 13 May 2018 18:39:11 -0400 X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on eggs.gnu.org X-Spam-Level: X-Spam-Status: No, score=0.8 required=5.0 tests=BAYES_50 autolearn=disabled version=3.3.2 Received: from lists.gnu.org ([2001:4830:134:3::11]:60242) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1fHze2-0003CR-OP for submit@debbugs.gnu.org; Sun, 13 May 2018 18:39:10 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:53231) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fHze1-0008GF-Dl for guix-patches@gnu.org; Sun, 13 May 2018 18:39:10 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1fHyLY-0003B0-Ja for guix-patches@gnu.org; Sun, 13 May 2018 17:16:01 -0400 Received: from fencepost.gnu.org ([2001:4830:134:3::e]:51814) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1fHyLU-00039x-QH; Sun, 13 May 2018 17:15:56 -0400 Received: from [2a01:e0a:1d:7270:af76:b9b:ca24:c465] (port=46738 helo=gnu.org) by fencepost.gnu.org with esmtpsa (TLS1.2:DHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.82) (envelope-from ) id 1fHyLU-0004TK-D4; Sun, 13 May 2018 17:15:56 -0400 From: Ludovic =?UTF-8?Q?Court=C3=A8s?= Date: Sun, 13 May 2018 23:15:46 +0200 Message-Id: <20180513211546.10858-1-ludo@gnu.org> X-Mailer: git-send-email 2.17.0 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.6.x X-Received-From: 2001:4830:134:3::11 X-Spam-Score: -5.0 (-----) X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -6.0 (------) Hello Guix! On IRC davidl shared a shell script that checks the output of ‘guix lint -c cve’ and uses that to determine vulnerable packages in a profile. That reminds me of the plan for ‘guix health’ (a tool to do just that), so I went ahead and tried to make it a reality at last. This ‘guix health’ reports information about “leaf” packages in a profile, but not about their dependencies: --8<---------------cut here---------------start------------->8--- $ ./pre-inst-env guix health -p /run/current-system/profile/ guix health: warning: util-linux@2.31.1 may be vulnerable to CVE-2018-7738 guix health: warning: util-linux@2.31.1 is available but does not fix any of these hint: Run `guix pull' and then re-run `guix health' to see if fixes are available. If none are available, please consider submitting a patch for the package definition of 'util-linux'. guix health: warning: shadow@4.5 may be vulnerable to CVE-2018-7169 guix health: warning: shadow@4.6 is available and fixes CVE-2018-7169, consider ugprading guix health: warning: tar@1.29 may be vulnerable to CVE-2016-6321 guix health: warning: tar@1.29 is available but does not fix any of these hint: Run `guix pull' and then re-run `guix health' to see if fixes are available. If none are available, please consider submitting a patch for the package definition of 'tar'. --8<---------------cut here---------------end--------------->8--- The difficulty here is that we need to know a package’s CPE name before we can check the CVE database, and we also need to know whether the package already includes fixes for known CVEs. This patch set attaches this information to manifest entries, so that ‘guix health’ can then rely on it. Fundamentally, that means we cannot reliably tell much about dependencies: in cases where the CPE name differs from the Guix name, we won’t have any match, and more generally, we cannot know what CVE are patched in the package; we could infer part of this by looking at the same-named package in the current Guix, but that’s hacky. I think that longer-term we probably need to attach this kind of meta-data to packages themselves, by adding a bunch of files in each package, say under PREFIX/guix. We could do that for search paths as well. Should we satisfy ourselves with the current approach in the meantime? Thoughts? Besides, support for properties in manifest entries seems useful to me, so we may want to keep it regardless of whether we take ‘guix health’ as-is. Ludo’. Ludovic Courtès (5): profiles: Add '%current-profile', 'user-friendly-profile', & co. packages: Add 'package-patched-vulnerabilities'. profiles: Add 'properties' field to manifest entries. profiles: Record fixed vulnerabilities as properties of entries. DRAFT Add 'guix health'. Makefile.am | 1 + guix/packages.scm | 28 +++++++ guix/profiles.scm | 91 ++++++++++++++++++++-- guix/scripts/health.scm | 158 +++++++++++++++++++++++++++++++++++++++ guix/scripts/lint.scm | 23 +----- guix/scripts/package.scm | 40 ---------- po/guix/POTFILES.in | 1 + tests/packages.scm | 15 ++++ tests/profiles.scm | 22 ++++++ 9 files changed, 312 insertions(+), 67 deletions(-) create mode 100644 guix/scripts/health.scm -- 2.17.0 From debbugs-submit-bounces@debbugs.gnu.org Mon May 14 04:26:28 2018 Received: (at control) by debbugs.gnu.org; 14 May 2018 08:26:28 +0000 Received: from localhost ([127.0.0.1]:33185 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fI8oN-0007aT-T2 for submit@debbugs.gnu.org; Mon, 14 May 2018 04:26:28 -0400 Received: from mail3-relais-sop.national.inria.fr ([192.134.164.104]:58865) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fI8oM-0007aE-2a for control@debbugs.gnu.org; Mon, 14 May 2018 04:26:26 -0400 X-IronPort-AV: E=Sophos;i="5.49,399,1520895600"; d="scan'208";a="265096414" Received: from unknown (HELO ribbon) ([193.50.110.240]) by mail3-relais-sop.national.inria.fr with ESMTP/TLS/AES256-GCM-SHA384; 14 May 2018 10:26:19 +0200 Date: Mon, 14 May 2018 10:26:19 +0200 Message-Id: <87wow6bq38.fsf@gnu.org> To: control@debbugs.gnu.org From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: control message for bug #31442 MIME-version: 1.0 Content-type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -4.0 (----) X-Debbugs-Envelope-To: control X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -5.0 (-----) merge 31442 31443 From debbugs-submit-bounces@debbugs.gnu.org Mon May 14 04:26:31 2018 Received: (at control) by debbugs.gnu.org; 14 May 2018 08:26:32 +0000 Received: from localhost ([127.0.0.1]:33189 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fI8oR-0007ai-Ot for submit@debbugs.gnu.org; Mon, 14 May 2018 04:26:31 -0400 Received: from mail3-relais-sop.national.inria.fr ([192.134.164.104]:58865) by debbugs.gnu.org with esmtp (Exim 4.84_2) (envelope-from ) id 1fI8oP-0007aE-0k for control@debbugs.gnu.org; Mon, 14 May 2018 04:26:29 -0400 X-IronPort-AV: E=Sophos;i="5.49,399,1520895600"; d="scan'208";a="265096442" Received: from unknown (HELO ribbon) ([193.50.110.240]) by mail3-relais-sop.national.inria.fr with ESMTP/TLS/AES256-GCM-SHA384; 14 May 2018 10:26:28 +0200 Date: Mon, 14 May 2018 10:26:28 +0200 Message-Id: <87vabqbq2z.fsf@gnu.org> To: control@debbugs.gnu.org From: ludo@gnu.org (Ludovic =?utf-8?Q?Court=C3=A8s?=) Subject: control message for bug #31442 MIME-version: 1.0 Content-type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Spam-Score: -4.0 (----) X-Debbugs-Envelope-To: control X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: debbugs-submit-bounces@debbugs.gnu.org Sender: "Debbugs-submit" X-Spam-Score: -5.0 (-----) merge 31442 31444