depsguard 0.1.35

Harden package manager configs against supply chain attacks. Built by Arnica.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

// Yarn Berry scanner: checks npmMinimalAgeGate in .yarnrc.yml.

use std::path::Path;

use super::config::read_yaml_value;
use super::date::parse_duration_minutes;
use super::detect::get_delay_days;
use super::types::{
    missing_status_for_path, unsupported_if_configured, CheckStatus, Recommendation,
};
use super::version::version_at_least;

pub fn scan(path: &Path, version: &str) -> Vec<Recommendation> {
    let days = get_delay_days();
    let val = read_yaml_value(path, "npmMinimalAgeGate");
    let required_minutes = days.saturating_mul(24).saturating_mul(60);
    let status = match &val {
        Some(v) => {
            if let Some(configured_minutes) = parse_duration_minutes(v) {
                if configured_minutes == required_minutes {
                    CheckStatus::Ok(v.clone())
                } else {
                    CheckStatus::WrongValue(v.clone())
                }
            } else if let Ok(raw_minutes) = v.parse::<u64>() {
                if raw_minutes == required_minutes {
                    CheckStatus::Ok(v.clone())
                } else {
                    CheckStatus::WrongValue(v.clone())
                }
            } else {
                CheckStatus::WrongValue(v.clone())
            }
        }
        None => missing_status_for_path(path),
    };
    let rec = Recommendation {
        key: "npmMinimalAgeGate".into(),
        description: format!("Delay new versions by {days} days"),
        expected: format!("{days}d"),
        status,
    };

    let rec = if version_at_least(version, 4, 10) {
        rec
    } else {
        unsupported_if_configured(rec, "yarn", 4, 10, version)
    };

    vec![rec]
}