syncable_cli/analyzer/hadolint/rules/
dl3033.rs

1//! DL3033: Pin versions in yum install
2//!
3//! Yum packages should be pinned to specific versions.
4
5use crate::analyzer::hadolint::parser::instruction::Instruction;
6use crate::analyzer::hadolint::rules::{simple_rule, SimpleRule};
7use crate::analyzer::hadolint::shell::ParsedShell;
8use crate::analyzer::hadolint::types::Severity;
9
10pub fn rule() -> SimpleRule<impl Fn(&Instruction, Option<&ParsedShell>) -> bool + Send + Sync> {
11    simple_rule(
12        "DL3033",
13        Severity::Warning,
14        "Specify version with `yum install -y <package>-<version>`.",
15        |instr, shell| {
16            match instr {
17                Instruction::Run(_) => {
18                    if let Some(shell) = shell {
19                        !shell.any_command(|cmd| {
20                            if cmd.name == "yum" && cmd.has_any_arg(&["install"]) {
21                                // Get packages (args after install, excluding flags)
22                                let packages = get_yum_packages(cmd);
23                                // Check if any package is unpinned
24                                packages.iter().any(|pkg| !is_pinned_yum_package(pkg))
25                            } else {
26                                false
27                            }
28                        })
29                    } else {
30                        true
31                    }
32                }
33                _ => true,
34            }
35        },
36    )
37}
38
39/// Extract package names from yum install command
40fn get_yum_packages(cmd: &crate::analyzer::hadolint::shell::Command) -> Vec<&str> {
41    let mut packages = Vec::new();
42    let mut found_install = false;
43
44    for arg in &cmd.arguments {
45        if arg == "install" {
46            found_install = true;
47            continue;
48        }
49        if found_install && !arg.starts_with('-') {
50            packages.push(arg.as_str());
51        }
52    }
53
54    packages
55}
56
57/// Check if yum package is pinned
58fn is_pinned_yum_package(pkg: &str) -> bool {
59    // Skip flags
60    if pkg.starts_with('-') {
61        return true;
62    }
63
64    // Skip local RPM files
65    if pkg.ends_with(".rpm") {
66        return true;
67    }
68
69    // Yum version formats: package-version or package-version-release
70    // Simple heuristic: contains a hyphen followed by a digit
71    let parts: Vec<&str> = pkg.rsplitn(2, '-').collect();
72    if parts.len() >= 2 {
73        let potential_version = parts[0];
74        // Version typically starts with a digit
75        potential_version.chars().next().map(|c| c.is_ascii_digit()).unwrap_or(false)
76    } else {
77        false
78    }
79}
80
81#[cfg(test)]
82mod tests {
83    use super::*;
84    use crate::analyzer::hadolint::lint::{lint, LintResult};
85    use crate::analyzer::hadolint::config::HadolintConfig;
86
87    fn lint_dockerfile(content: &str) -> LintResult {
88        lint(content, &HadolintConfig::default())
89    }
90
91    #[test]
92    fn test_yum_install_unpinned() {
93        let result = lint_dockerfile("FROM centos:7\nRUN yum install -y nginx");
94        assert!(result.failures.iter().any(|f| f.code.as_str() == "DL3033"));
95    }
96
97    #[test]
98    fn test_yum_install_pinned() {
99        let result = lint_dockerfile("FROM centos:7\nRUN yum install -y nginx-1.20.1");
100        assert!(!result.failures.iter().any(|f| f.code.as_str() == "DL3033"));
101    }
102
103    #[test]
104    fn test_yum_install_local_rpm() {
105        let result = lint_dockerfile("FROM centos:7\nRUN yum install -y /tmp/package.rpm");
106        assert!(!result.failures.iter().any(|f| f.code.as_str() == "DL3033"));
107    }
108
109    #[test]
110    fn test_yum_update() {
111        let result = lint_dockerfile("FROM centos:7\nRUN yum update -y");
112        assert!(!result.failures.iter().any(|f| f.code.as_str() == "DL3033"));
113    }
114}
syncable_cli/analyzer/hadolint/rules/dl3033.rs

syncable_cli/analyzer/hadolint/rules/
dl3033.rs
