projects/guix·blob python-team · refs

103 lines · 3.7 KiB

1;;; GNU Guix --- Functional package management for GNU
2;;; Copyright © 2015, 2016, 2019 Ludovic Courtès <[email protected]>
3;;;
4;;; This file is part of GNU Guix.
5;;;
6;;; GNU Guix is free software; you can redistribute it and/or modify it
7;;; under the terms of the GNU General Public License as published by
8;;; the Free Software Foundation; either version 3 of the License, or (at
9;;; your option) any later version.
10;;;
11;;; GNU Guix is distributed in the hope that it will be useful, but
12;;; WITHOUT ANY WARRANTY; without even the implied warranty of
13;;; MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14;;; GNU General Public License for more details.
15;;;
16;;; You should have received a copy of the GNU General Public License
17;;; along with GNU Guix. If not, see <http://www.gnu.org/licenses/>.
18
19(define-module (test-cve)
20 #:use-module (guix cve)
21 #:use-module (srfi srfi-1)
22 #:use-module (srfi srfi-19)
23 #:use-module (srfi srfi-64))
24
25;; Generated from the 2019 database :
26;; jq -M '.vulnerabilities |= map(select(.cve.id | IN("CVE-2019-14811", "CVE-2019-17365", "CVE-2019-1010180", "CVE-2019-1010204", "CVE-2019-18192", "CVE-2019-0001"))) | .totalResults = (.vulnerabilities | length) | .resultsPerPage = (.vulnerabilities | length)'
27(define %sample
28 (search-path %load-path "tests/cve-sample.json"))
29
30(define (vulnerability id packages)
31 (make-struct/no-tail (@@ (guix cve) <vulnerability>) id packages))
32
33(define %expected-vulnerabilities
34 ;; What we should get when reading %SAMPLE.
35 (list
36 (vulnerability "CVE-2019-1010204"
37 '(("gnu" "binutils" (and (>= "2.21") (<= "2.31.1")))
38 ("gnu" "binutils_gold" (and (>= "1.11") (<= "1.16")))))
39 (vulnerability "CVE-2019-1010180"
40 '(("gnu" "gdb" (< "9.1"))))
41 (vulnerability "CVE-2019-14811"
42 '(("artifex" "ghostscript" (< "9.50"))))
43 (vulnerability "CVE-2019-17365"
44 '(("nixos" "nix" (<= "2.3"))))
45 (vulnerability "CVE-2019-18192"
46 '(("gnu" "guix" "1.0.1")))
47 ;; Only the "a" CPE configurations are kept; the "o" configurations are discarded.
48 ;; This is why CVE-2019-0001 doesn't appear here.
49 ))
50
51
52(test-begin "cve")
53
54(test-equal "json->cve-items"
55 '("CVE-2019-0001"
56 "CVE-2019-1010204"
57 "CVE-2019-1010180"
58 "CVE-2019-14811"
59 "CVE-2019-17365"
60 "CVE-2019-18192")
61 (map cve-item-id
62 (call-with-input-file %sample json->cve-items)))
63
64(test-equal "cve-item-published-date"
65 '(2019)
66 (delete-duplicates
67 (map (compose date-year cve-item-published-date)
68 (call-with-input-file %sample json->cve-items))))
69
70(test-equal "json->vulnerabilities"
71 %expected-vulnerabilities
72 (call-with-input-file %sample json->vulnerabilities))
73
74(test-equal "vulnerabilities->lookup-proc"
75 (list (list (first %expected-vulnerabilities)) ;binutils
76 '()
77 (list (first %expected-vulnerabilities))
78 '()
79
80 (list (second %expected-vulnerabilities)) ;gdb
81 (list (second %expected-vulnerabilities))
82
83 (list (third %expected-vulnerabilities)) ;ghostscript
84 (list (third %expected-vulnerabilities))
85 '()
86
87 (list (fourth %expected-vulnerabilities)) ;nix
88 '())
89 (let* ((vulns (call-with-input-file %sample json->vulnerabilities))
90 (lookup (vulnerabilities->lookup-proc vulns)))
91 (list (lookup "binutils" "2.31.1")
92 (lookup "binutils" "2.10")
93 (lookup "binutils_gold" "1.11")
94 (lookup "binutils" "2.32")
95 (lookup "gdb")
96 (lookup "gdb" "9.0")
97 (lookup "ghostscript")
98 (lookup "ghostscript" "9.27")
99 (lookup "ghostscript" "9.51")
100 (lookup "nix")
101 (lookup "nix" "2.4"))))
102
103(test-end "cve")