diff --git a/AGENTS.md b/AGENTS.md index 2ff538b..f57c577 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -180,6 +180,12 @@ The project uses `just` as a command runner to encapsulate common workflows. * `just fix` * Runs `cargo fix` and `cargo machete` / `cargo machete --fix` to clean up unused dependencies and minor issues. +* `just update` + * Updates flake inputs, Cargo deps and pre-commit hooks, and runs `just update-cli-scanner`. + +* `just update-cli-scanner` + * Bumps the pinned Sysdig CLI scanner version in `src/infra/scanner_binary_manager.rs` to the latest release. It rewrites the lines tagged with `newest-version-marker`; do not remove those markers. + Additional helpful commands: * `cargo test -- --nocapture` – run tests with full output when debugging. diff --git a/Cargo.lock b/Cargo.lock index f2353f9..8fc394e 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -1994,7 +1994,7 @@ dependencies = [ [[package]] name = "sysdig-lsp" -version = "0.9.0" +version = "0.9.1" dependencies = [ "async-trait", "bollard", diff --git a/Cargo.toml b/Cargo.toml index 0ec4f5d..c52ae00 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "sysdig-lsp" -version = "0.9.0" +version = "0.9.1" edition = "2024" authors = [ "Sysdig Inc." ] readme = "README.md" diff --git a/Justfile b/Justfile index c160380..0c7b835 100644 --- a/Justfile +++ b/Justfile @@ -20,3 +20,15 @@ update: nix flake update nix develop --command cargo update nix develop --command pre-commit autoupdate + nix develop --command just update-cli-scanner + +# Bump the pinned sysdig-cli-scanner to the latest version (lines tagged with newest-version-marker) +update-cli-scanner: + #!/usr/bin/env bash + set -euo pipefail + latest=$(curl --silent --show-error --fail --location https://download.sysdig.com/scanning/sysdig-cli-scanner/latest_version.txt | tr -d '[:space:]') + IFS=. read -r major minor patch <<< "$latest" + file=src/infra/scanner_binary_manager.rs + sd 'Version::new\(\d+, \d+, \d+\)(.*newest-version-marker)' "Version::new($major, $minor, $patch)\${1}" "$file" + sd '"\d+\.\d+\.\d+"(.*newest-version-marker)' "\"$latest\"\${1}" "$file" + echo "sysdig-cli-scanner -> $latest" diff --git a/flake.nix b/flake.nix index e49561f..5d78d1f 100644 --- a/flake.nix +++ b/flake.nix @@ -45,12 +45,14 @@ cargo-nextest cargo-tarpaulin clippy + curl just lldb pre-commit rust-analyzer rustc rustfmt + sd ]; inputsFrom = [ sysdig-lsp ]; diff --git a/src/domain/scanresult/package_type.rs b/src/domain/scanresult/package_type.rs index 13cceec..ca65ba2 100644 --- a/src/domain/scanresult/package_type.rs +++ b/src/domain/scanresult/package_type.rs @@ -12,6 +12,8 @@ pub enum PackageType { Ruby, Php, CSharp, + Oci, + SoftwareRuntime, } impl Display for PackageType { @@ -30,6 +32,8 @@ impl Display for PackageType { PackageType::Ruby => "ruby", PackageType::Php => "php", PackageType::CSharp => "csharp", + PackageType::Oci => "oci", + PackageType::SoftwareRuntime => "software runtime", } ) } diff --git a/src/infra/scanner_binary_manager.rs b/src/infra/scanner_binary_manager.rs index b0017f9..2f6c3dc 100644 --- a/src/infra/scanner_binary_manager.rs +++ b/src/infra/scanner_binary_manager.rs @@ -44,7 +44,7 @@ pub(super) struct ScannerBinaryManager {} impl ScannerBinaryManager { const fn version(&self) -> Version { - Version::new(1, 23, 0) + Version::new(1, 30, 1) // newest-version-marker — DO NOT REMOVE; auto-updated by `just update-cli-scanner` } pub async fn install_expected_version_if_not_present( @@ -197,7 +197,7 @@ mod tests { async fn it_gets_the_wanted_version() { let mgr = ScannerBinaryManager::default(); - assert_eq!(mgr.version().to_string(), "1.23.0"); + assert_eq!(mgr.version().to_string(), "1.30.1"); // newest-version-marker — DO NOT REMOVE; auto-updated by `just update-cli-scanner` } #[tokio::test] @@ -237,7 +237,7 @@ mod tests { .await .unwrap() .to_string(), - "1.23.0" + mgr.version().to_string() ); } @@ -260,7 +260,7 @@ mod tests { .await .unwrap() .to_string(), - "1.23.0" + mgr.version().to_string() ); } } diff --git a/src/infra/sysdig_image_scanner_json_scan_result_v1.rs b/src/infra/sysdig_image_scanner_json_scan_result_v1.rs index bd96f9f..f47509c 100644 --- a/src/infra/sysdig_image_scanner_json_scan_result_v1.rs +++ b/src/infra/sysdig_image_scanner_json_scan_result_v1.rs @@ -372,6 +372,10 @@ pub(super) enum JsonPackageType { Ruby, #[serde(rename = "rust")] Rust, + #[serde(rename = "oci")] + Oci, + #[serde(rename = "Software Runtime")] + SoftwareRuntime, #[default] Unknown, } @@ -388,6 +392,8 @@ impl From for PackageType { JsonPackageType::Python => Self::Python, JsonPackageType::Ruby => Self::Ruby, JsonPackageType::Rust => Self::Rust, + JsonPackageType::Oci => Self::Oci, + JsonPackageType::SoftwareRuntime => Self::SoftwareRuntime, JsonPackageType::Unknown => Self::Unknown, } } @@ -571,8 +577,10 @@ pub(super) struct JsonVulnerability { #[cfg(test)] mod tests { use crate::{ - domain::scanresult::{scan_result::ScanResult, severity::Severity}, - infra::sysdig_image_scanner_json_scan_result_v1::JsonScanResultV1, + domain::scanresult::{ + package_type::PackageType, scan_result::ScanResult, severity::Severity, + }, + infra::sysdig_image_scanner_json_scan_result_v1::{JsonPackageType, JsonScanResultV1}, }; #[test] @@ -672,4 +680,15 @@ mod tests { assert!(found_layer.is_some(), "Should find layer by valid digest"); assert_eq!(found_layer.unwrap().digest(), Some(digest)); } + + #[rstest::rstest] + #[case(r#""oci""#, PackageType::Oci)] + #[case(r#""Software Runtime""#, PackageType::SoftwareRuntime)] + fn it_deserializes_package_types_added_in_newer_scanners( + #[case] json: &str, + #[case] expected: PackageType, + ) { + let package_type: JsonPackageType = serde_json::from_str(json).unwrap(); + assert_eq!(PackageType::from(package_type), expected); + } }