forked from Plemya-x/ALR
Maxim Slipenko
afe35f407e
Vulnerabilities detected by Trivy scan: - github.com/go-git/go-git/v5 (CVE-2025-21613) - github.com/go-git/go-git/v5 (CVE-2025-21614) - golang.org/x/crypto (CVE-2025-22869) - golang.org/x/net (CVE-2025-22870) - golang.org/x/net (CVE-2025-22872)
58 lines
1.8 KiB
Bash
58 lines
1.8 KiB
Bash
#!/bin/bash
|
|
# ALR - Any Linux Repository
|
|
# Copyright (C) 2025 Евгений Храмов
|
|
#
|
|
# This program is free software: you can redistribute it and/or modify
|
|
# it under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation, either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# This program is distributed in the hope that it will be useful,
|
|
# but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
|
|
|
VULNS_FILE="vulns.json"
|
|
COMMIT_MSG_FILE="commit_msg.txt"
|
|
|
|
echo "Scanning for vulnerabilities with Trivy..."
|
|
trivy fs --scanners vuln --format json . > "$VULNS_FILE"
|
|
|
|
echo "security: update vulnerable packages" > "$COMMIT_MSG_FILE"
|
|
echo "" >> "$COMMIT_MSG_FILE"
|
|
echo "Vulnerabilities detected by Trivy scan:" >> "$COMMIT_MSG_FILE"
|
|
|
|
echo "Processing vulnerabilities..."
|
|
jq -r '
|
|
.Results[].Vulnerabilities[] |
|
|
select(.PkgName and .FixedVersion) |
|
|
"\(.PkgName)|\(.FixedVersion)|\(.VulnerabilityID)"
|
|
' "$VULNS_FILE" | sort | uniq | while IFS="|" read -r pkg version cve; do
|
|
echo "- ${pkg} (${cve})" >> "$COMMIT_MSG_FILE"
|
|
echo "Updating ${pkg} to v${version} (${cve})..."
|
|
go get "${pkg}@v${version}" || echo "Failed to update ${pkg}"
|
|
done
|
|
|
|
echo "Running go mod tidy..."
|
|
go mod tidy
|
|
|
|
echo "Verifying fixes..."
|
|
trivy fs --scanners vuln .
|
|
|
|
echo ""
|
|
echo "Suggested commit message:"
|
|
echo "------------------------"
|
|
cat "$COMMIT_MSG_FILE"
|
|
echo "------------------------"
|
|
|
|
rm "$VULNS_FILE"
|
|
|
|
git add go.mod go.sum
|
|
|
|
echo ""
|
|
echo "To commit these changes, run:"
|
|
echo "git commit -a -F $(pwd)/$COMMIT_MSG_FILE" |