cratery 1.11.1

Cratery -- a private cargo registry
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146

/*******************************************************************************
 * Copyright (c) 2024 Cénotélie Opérations SAS (cenotelie.fr)
 ******************************************************************************/

//! Service to fetch data about advisories against Rust crates on crates.io

use std::collections::HashMap;
use std::path::PathBuf;
use std::sync::Arc;
use std::time::{Duration, Instant};

use futures::lock::Mutex;
use futures::StreamExt;
use log::error;
use semver::Version;
use tokio_stream::wrappers::ReadDirStream;

use crate::model::config::Configuration;
use crate::model::osv::{Advisory, SimpleAdvisory};
use crate::utils::apierror::ApiError;
use crate::utils::concurrent::n_at_a_time_stream;
use crate::utils::{stale_instant, FaillibleFuture};

/// Service to use the [RustSec](https://github.com/rustsec) data about crates
pub trait RustSecChecker {
    /// Gets the advisories against a crate
    fn check_crate<'a>(&'a self, package: &'a str, version: &'a Version) -> FaillibleFuture<'a, Vec<SimpleAdvisory>>;
}

/// Gets the rustsec service
#[must_use]
pub fn get_service(config: &Configuration) -> Arc<dyn RustSecChecker + Send + Sync> {
    Arc::new(RustSecCheckerImpl {
        data: Mutex::new(RustSecData::new(config.data_dir.clone(), config.deps_stale_registry)),
    })
}

struct RustSecCheckerImpl {
    /// The data for the service
    data: Mutex<RustSecData>,
}

impl RustSecChecker for RustSecCheckerImpl {
    /// Gets the advisories against a crate
    fn check_crate<'a>(&'a self, package: &'a str, version: &'a Version) -> FaillibleFuture<'a, Vec<SimpleAdvisory>> {
        Box::pin(async move {
            let mut data = self.data.lock().await;
            data.update_data().await?;
            let db = data.db.lock().unwrap();
            Ok(db
                .get(package)
                .map(|advisories| {
                    advisories
                        .iter()
                        .filter(|advisory| advisory.affects(version))
                        .cloned()
                        .collect::<Vec<_>>()
                })
                .unwrap_or_default())
        })
    }
}

/// Service to use the [RustSec](https://github.com/rustsec) data about crates
#[derive(Debug, Clone)]
struct RustSecData {
    /// The data directory
    data_dir: String,
    /// Number of milliseconds after which the local data about an external registry are deemed stale and must be pulled again
    stale_registry: u64,
    /// The last time the data was updated
    last_touch: Instant,
    /// The known advisories
    db: Arc<std::sync::Mutex<HashMap<String, Vec<SimpleAdvisory>>>>,
}

/// The URI of the git repo with the `RustSec` database
const RUSTSEC_DB_GIT_URI: &str = "https://github.com/rustsec/advisory-db";
/// The branch inside the repo with the actual data
const RUSTSEC_DB_GIT_BRANCH: &str = "osv";
/// Name of the sub-directory to use within the data directory
const DATA_SUB_DIR: &str = "rustsec";

impl RustSecData {
    fn new(data_dir: String, stale_registry: u64) -> Self {
        Self {
            data_dir,
            stale_registry,
            last_touch: stale_instant(),
            db: Arc::new(std::sync::Mutex::new(HashMap::new())),
        }
    }

    /// Updates the data
    async fn update_data(&mut self) -> Result<(), ApiError> {
        let now = Instant::now();
        let is_stale = now.duration_since(self.last_touch) > Duration::from_millis(self.stale_registry);
        let mut reg_location = PathBuf::from(&self.data_dir);
        reg_location.push(DATA_SUB_DIR);
        if is_stale {
            if tokio::fs::try_exists(&reg_location).await? {
                crate::utils::execute_git(&reg_location, &["fetch", "origin", RUSTSEC_DB_GIT_BRANCH]).await?;
                crate::utils::execute_git(
                    &reg_location,
                    &["reset", "--hard", &format!("origin/{RUSTSEC_DB_GIT_BRANCH}")],
                )
                .await?;
            } else {
                tokio::fs::create_dir_all(&reg_location).await?;
                crate::utils::execute_git(
                    &reg_location,
                    &["clone", "--branch", RUSTSEC_DB_GIT_BRANCH, RUSTSEC_DB_GIT_URI, "."],
                )
                .await?;
            }
            self.last_touch = Instant::now();
            reg_location.push("crates");
            self.db.lock().unwrap().clear();
            let _results = n_at_a_time_stream(
                ReadDirStream::new(tokio::fs::read_dir(&reg_location).await?).map(|entry| {
                    let db = self.db.clone();
                    Box::pin(async move {
                        let content = tokio::fs::read(&entry?.path()).await?;
                        let advisory = serde_json::from_slice::<Advisory>(&content)?;
                        if let Ok(simple) = SimpleAdvisory::try_from(advisory) {
                            db.lock().unwrap().entry(simple.package.clone()).or_default().push(simple);
                        }
                        Ok::<_, ApiError>(())
                    })
                }),
                10,
                |r| {
                    if let Err(e) = r {
                        error!("{e}");
                        if let Some(backtrace) = &e.backtrace {
                            error!("{backtrace}");
                        }
                    }
                    false
                },
            )
            .await;
        }
        Ok(())
    }
}