Initial commit

.depsource.toml

@@ -0,0 +1,7 @@
+version = 1
+
+[[analyzers]]
+name = "go"
+
+  [analyzers.meta]
+  import_root = "github.com/crashdump/libguardian"

.github/workflows/release.yml

@@ -0,0 +1,34 @@
+name: goreleaser
+
+on:
+  push:
+    # run only against tags
+    tags:
+      - '*'
+
+permissions:
+  contents: write
+  packages: write
+
+jobs:
+  goreleaser:
+    runs-on: ubuntu-latest
+    steps:
+
+      - uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - run: git fetch --force --tags
+
+      - uses: actions/setup-go@v4
+        with:
+          go-version: stable
+
+      - uses: goreleaser/goreleaser-action@v4
+        with:
+          distribution: goreleaser
+          version: latest
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/test.yml

@@ -0,0 +1,28 @@
+# This workflow will build a golang project
+# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-go
+
+name: Go
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Set up Go
+        uses: actions/setup-go@v4
+        with:
+          go-version: '1.20'
+
+      - name: Build
+        run: go build -v -o dist/libguardian cmd/libguardian/*.go
+
+      - name: Test
+        run: go test -v ./...

.gitignore

@@ -0,0 +1,2 @@
+node_modules/
+.idea

.goreleaser.yaml

@@ -0,0 +1,48 @@
+# This is an example .goreleaser.yml file with some sensible defaults.
+# Make sure to check the documentation at https://goreleaser.com
+before:
+  hooks:
+    # You may remove this if you don't use go modules.
+    - go mod tidy
+    # you may remove this if you don't need go generate
+    - go generate ./...
+builds:
+  - id: "libguardian"
+    binary: "libguardian"
+    main: ./cmd/libguardian
+    env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+      - windows
+      - darwin
+
+archives:
+  - format: tar.gz
+    # this name template makes the OS and Arch compatible with the results of uname.
+    name_template: >-
+      {{ .ProjectName }}_
+      {{- title .Os }}_
+      {{- if eq .Arch "amd64" }}x86_64
+      {{- else if eq .Arch "386" }}i386
+      {{- else }}{{ .Arch }}{{ end }}
+      {{- if .Arm }}v{{ .Arm }}{{ end }}
+    # use zip for windows archives
+    format_overrides:
+      - goos: windows
+        format: zip
+checksum:
+  name_template: 'checksums.txt'
+snapshot:
+  name_template: "{{ incpatch .Version }}-next"
+changelog:
+  sort: asc
+  filters:
+    exclude:
+      - '^docs:'
+      - '^test:'
+
+# The lines beneath this are called `modelines`. See `:help modeline`
+# Feel free to remove those if you don't want/use them.
+# yaml-language-server: $schema=https://goreleaser.com/static/schema.json
+# vim: set ts=2 sw=2 tw=0 fo=cnqoj

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Adrien P.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

Makefile

@@ -0,0 +1,19 @@
+.PHONY: build clean test
+.DEFAULT_GOAL=test
+
+build: test
+	go build -v -o dist/libguardian cmd/libguardian/*.go
+
+clean:
+	rm -f dist/libguardian
+
+test:
+	go mod tidy
+	staticcheck ./...
+	go test -v ./...
+
+integration-test:
+	go test -v ./... -tags=integration
+
+release: test integration-test build
+	go test all -v

README.md

@@ -0,0 +1,43 @@
+# Lib Guardian
+
+[![License](http://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/crashdump/libguardian/master/LICENSE)
+[![GoDoc](https://godoc.org/github.com/crashdump/libguardian?status.svg)](https://godoc.org/github.com/crashdump/libguardian)
+
+
+## Install
+
+```bash
+go install github.com/crashdump/libguardian/cmd/libguardian@latest
+```
+
+## Use
+
+```bash
+libguardian ./sources/
+```
+
+    ┌──────────────┐
+    │ Lib Guardian │
+    └──────────────┘
+
+    > Searching for supported manifests...
+      Found foo/bar/package.json.
+
+    > Examining files...
+      Found foreign library: foo.bar
+      Found foreign library: bar.baz
+
+    Failed!
+
+
+### Build
+
+```bash
+go build ./... -o dist/libguardian
+```
+
+### Test
+
+```bash
+go test ./...
+```

cmd/libguardian/cmd.go

@@ -0,0 +1,172 @@
+package main
+
+import (
+	"errors"
+	"os"
+	"time"
+
+	"github.com/urfave/cli/v2"
+
+	"github.com/crashdump/libguardian/pkg"
+	"github.com/crashdump/libguardian/pkg/gomod"
+)
+
+var logger *logging
+
+const STDOUT = "stdout"
+
+func init() {
+	cli.HelpFlag = &cli.BoolFlag{Name: "help"}
+	cli.VersionFlag = &cli.BoolFlag{Name: "version", Aliases: []string{"v"}}
+}
+
+var errorPathMissing = "You need to specify the path to the source code folder"
+
+func main() {
+	logger = newLogger()
+	var flagOutput string
+
+	logger.print("┌──────────────┐")
+	logger.print("│ Lib Guardian │")
+	logger.print("└──────────────┘")
+	logger.print("")
+
+	app := &cli.App{
+		Name:     "libguardian",
+		Usage:    "Walk files in a directory and identifies gaps between project and inventory.",
+		Compiled: time.Now(),
+		Authors: []*cli.Author{{
+			Name:  "Adrien Pujol",
+			Email: "ap@cdfr.net",
+		}},
+		Commands: []*cli.Command{
+			{
+				Name:    "enumerate",
+				Aliases: []string{"e"},
+				Usage:   "enumerate all the libraries from source code.",
+				Before: func(cCtx *cli.Context) error {
+					if cCtx.Args().Len() < 1 {
+						logger.print(errorPathMissing)
+						os.Exit(1)
+					}
+					return nil
+				},
+				Action: func(cCtx *cli.Context) error {
+					path := cCtx.Args().First()
+
+					logger.printHeader("Enumerating libraries from source code...")
+
+					lg := pkg.NewLibGuardian[gomod.Library](path, gomod.GoMod[gomod.Library]{})
+					results, err := lg.Enumerate()
+					if err != nil {
+						logger.printFatal(err.Error())
+					}
+					logger.printfResult("Found %d files.", len(results))
+					logger.print("")
+					for _, result := range results {
+						logger.printResult(result.Module)
+					}
+
+					return nil
+				},
+			},
+			{
+				Name:    "generate",
+				Aliases: []string{"g"},
+				Usage:   "generate a config.json from source code.",
+				Flags: []cli.Flag{
+					&cli.StringFlag{
+						Name:        "output",
+						Aliases:     []string{"o"},
+						Destination: &flagOutput,
+						Action: func(ctx *cli.Context, v string) error {
+							if v == "" {
+								return errors.New("missing output filename")
+							}
+							return nil
+						},
+					},
+				},
+				Before: func(cCtx *cli.Context) error {
+					if cCtx.Args().Len() < 1 {
+						logger.print(errorPathMissing)
+						os.Exit(1)
+					}
+					return nil
+				},
+				Action: func(cCtx *cli.Context) error {
+					//path := cCtx.Args().First()
+
+					logger.printHeader("Generating sbom.jsom from source code...")
+					panic("not implemented")
+					//results, err := libguardian.Enumerate(path)
+					//if err != nil {
+					//	logger.printFatal(err.Error())
+					//}
+					//logger.printfResult("Found %d files.", len(results))
+					//logger.print("")
+
+					return nil
+				},
+			},
+			{
+				Name:    "enforce",
+				Aliases: []string{"v"},
+				Usage:   "enforce inventory libraries.",
+				Flags: []cli.Flag{
+					&cli.StringFlag{
+						Name:        "config",
+						Aliases:     []string{"c"},
+						Destination: &flagOutput,
+						Action: func(ctx *cli.Context, v string) error {
+							if v == "" {
+								return errors.New("missing config filename")
+							}
+							return nil
+						},
+					},
+				},
+				Before: func(cCtx *cli.Context) error {
+					if cCtx.Args().Len() < 1 {
+						logger.print(errorPathMissing)
+						os.Exit(1)
+					}
+					return nil
+				},
+				Action: func(cCtx *cli.Context) error {
+					path := cCtx.Args().First()
+
+					logger.printHeader("Searching for foreign libraries in source code...")
+
+					lg := pkg.NewLibGuardian[gomod.Library](path, gomod.GoMod[gomod.Library]{})
+					err := lg.Config.Load(cCtx.String("config"))
+					if err != nil {
+						return err
+					}
+
+					results, err := lg.Enforce()
+					if err != nil {
+						return err
+					}
+
+					if len(results) > 0 {
+						logger.printfResult("Found %d foreign libraries.", len(results))
+						logger.print("")
+						for _, result := range results {
+							logger.printResult(result.Module)
+						}
+
+						logger.printFatal("Failed!")
+					}
+					logger.print("No mismatch, success!")
+
+					return nil
+				},
+			},
+		},
+	}
+
+	if err := app.Run(os.Args); err != nil {
+		logger.printFatal(err.Error())
+	}
+}