depsguard 0.1.38

Harden package manager configs against supply chain attacks. Built by Arnica.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

// poetry scanner: checks `solver.min-release-age` in poetry's config.toml.

use std::path::Path;

use super::config::read_toml_value;
use super::detect::get_delay_days;
use super::types::{gate_min_version, missing_status_for_path, CheckStatus, Recommendation};
use super::version::extract_version_str;

/// Minimum poetry version that supports `solver.min-release-age` (added in 2.4.0).
const POETRY_MIN_MAJOR: u64 = 2;
const POETRY_MIN_MINOR: u64 = 4;

/// poetry stores the cooldown under `[solver]` as `min-release-age` (integer days).
pub(crate) const POETRY_KEY: &str = "solver.min-release-age";

pub fn scan(path: &Path, version: &str) -> Vec<Recommendation> {
    let days = get_delay_days();
    let ver = extract_version_str(version);
    let expected = days.to_string();
    let description = format!("Delay new versions by {days} days");

    let val = read_toml_value(path, POETRY_KEY);
    let status = match &val {
        Some(v) => match v.parse::<u64>() {
            Ok(n) if n == days => CheckStatus::Ok(v.clone()),
            _ => CheckStatus::WrongValue(v.clone()),
        },
        None => missing_status_for_path(path),
    };

    let rec = Recommendation {
        key: POETRY_KEY.into(),
        description,
        expected,
        status,
    };

    let rec = gate_min_version(rec, "poetry", POETRY_MIN_MAJOR, POETRY_MIN_MINOR, ver);

    vec![rec]
}