diff mbox series

[bug#47193,1/2] lint: Sort possible vulnerabilities.

Message ID 20210316160653.9891-1-me@tobias.gr
State New
Headers show
Series [bug#47193,1/2] lint: Sort possible vulnerabilities. | expand

Checks

Context Check Description
cbaines/submitting builds success
cbaines/comparison success View comparision
cbaines/git branch success View Git branch
cbaines/applying patch success View Laminar job
cbaines/issue success View issue

Commit Message

Tobias Geerinckx-Rice March 16, 2021, 4:06 p.m. UTC 
* guix/lint.scm (check-vulnerabilities): Sort unpatched vulnerabilities
by ID.
---
 guix/lint.scm | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

Comments

Ludovic Courtès March 31, 2021, 12:53 p.m. UTC | #1 
Hi!

Tobias Geerinckx-Rice <me@tobias.gr> skribis:

> * guix/lint.scm (check-vulnerabilities): Sort unpatched vulnerabilities
> by ID.

[...]

>                (make-warning
>                 package
>                 (G_ "probably vulnerable to ~a")
> -               (list (string-join (map vulnerability-id unpatched)
> +               (list (string-join (map vulnerability-id
> +                                       (sort unpatched vulnerability<))
>                                    ", "))))))))))

Nitpick: it might be a bit clearer done the other way around:

  (sort (map vulnerability-id unpatched) cve-id<?)

… where ‘cve-id<?’ is like ‘vulnerability<’ but takes a CVE ID (a
string).

Otherwise LGTM!

Ludo’.
diff mbox series

Patch

diff --git a/guix/lint.scm b/guix/lint.scm
index 5144fa139d..ed57e19fe2 100644
--- a/guix/lint.scm
+++ b/guix/lint.scm
@@ -1164,6 +1164,23 @@  the NIST server non-fatal."
                                             package-vulnerabilities))
   "Check for known vulnerabilities for PACKAGE.  Obtain the list of
 vulnerability records for PACKAGE by calling PACKAGE-VULNERABILITIES."
+
+  (define (vulnerability< v1 v2)
+    (define (string-list< list1 list2)
+      (match list1
+        ((head1 tail1 ...)
+         (match list2
+           ((head2 tail2 ...)
+            (if (string=? head1 head2)
+                (string-list< tail1 tail2)
+                (string<? head1 head2)))
+           (_ #f)))
+        (_ #f)))
+
+    (let ((separators (char-set-complement char-set:letter+digit)))
+      (string-list< (string-split (vulnerability-id v1) separators)
+                    (string-split (vulnerability-id v2) separators))))
+
   (let ((package (or (package-replacement package) package)))
     (match (package-vulnerabilities package)
       (()
@@ -1184,7 +1201,8 @@  vulnerability records for PACKAGE by calling PACKAGE-VULNERABILITIES."
               (make-warning
                package
                (G_ "probably vulnerable to ~a")
-               (list (string-join (map vulnerability-id unpatched)
+               (list (string-join (map vulnerability-id
+                                       (sort unpatched vulnerability<))
                                   ", "))))))))))
 
 (define (check-for-updates package)