admin/brew
1
0
Fork 0
Code Issues Packages Projects Releases 6 Wiki Activity

audit: simplify ssl/tls audit failure messages

Browse Source 
This cuts the amount of custom code fairly drastically, applying the
same generic syntax across the different SSL/TLS enforced areas.

It also makes the failure message fit onto one terminal line, which
looks cleaner than the multi-line message we currently print
for standard-size Terminals.

Changes something like:

`ftp.gnu.org urls should be https://, not http:// (url is http://ftp.gnu.org/gnu/gawk/gawk-4.1.1.tar.xz)`

Into:

`Please use https:// for http://ftp.gnu.org/gnu/gawk/gawk-4.1.1.tar.xz`

References: Homebrew/homebrew#39421 Homebrew/homebrew#39306

Closes Homebrew/homebrew#40054.

Signed-off-by: Dominyk Tiller <dominyktiller@gmail.com>
This commit is contained in:
Dominyk Tiller 2015-05-24 16:14:44 +01:00
parent c178d50f29
commit 6db8e1c5a9
1 changed files with 44 additions and 70 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

114
Library/Homebrew/cmd/audit.rb
View File

@ -1,7 +1,7 @@
require 'formula' require "formula"
require 'utils' require "utils"
require 'extend/ENV' require "extend/ENV"
require 'formula_cellar_checks' require "formula_cellar_checks"
module Homebrew module Homebrew
def audit def audit
@ -211,9 +211,9 @@ class FormulaAuditor
problem "Use `depends_on :hg` instead of `depends_on 'mercurial'`" problem "Use `depends_on :hg` instead of `depends_on 'mercurial'`"
when "ruby" when "ruby"
problem "Don't use ruby as a dependency. We allow non-Homebrew ruby installations." problem "Don't use ruby as a dependency. We allow non-Homebrew ruby installations."
when 'gfortran' when "gfortran"
problem "Use `depends_on :fortran` instead of `depends_on 'gfortran'`" problem "Use `depends_on :fortran` instead of `depends_on 'gfortran'`"
when 'open-mpi', 'mpich2' when "open-mpi", "mpich2"
problem <<-EOS.undent problem <<-EOS.undent
There are multiple conflicting ways to install MPI. Use an MPIDependency: There are multiple conflicting ways to install MPI. Use an MPIDependency:
depends_on :mpi => [<lang list>] depends_on :mpi => [<lang list>]
@ -285,36 +285,13 @@ class FormulaAuditor
# Check for http:// GitHub homepage urls, https:// is preferred. # Check for http:// GitHub homepage urls, https:// is preferred.
# Note: only check homepages that are repo pages, not *.github.com hosts # Note: only check homepages that are repo pages, not *.github.com hosts
if homepage =~ %r[^http://github\.com/] if homepage =~ %r[^http://github\.com/]
problem "Use https:// URLs for homepages on GitHub (URL is #{homepage})." problem "Please use https:// for #{homepage}"
end
# Google Code homepages should end in a slash
if homepage =~ %r[^https?://code\.google\.com/p/[^/]+[^/]$]
problem "Google Code homepage should end with a slash (URL is #{homepage})."
end
# Automatic redirect exists, but this is another hugely common error.
if homepage =~ %r[^http://code\.google\.com/]
problem "Google Code homepages should be https:// URLs (URL is #{homepage})."
end
# GNU has full SSL/TLS support but no auto-redirect.
if homepage =~ %r[^http://www\.gnu\.org/]
problem "GNU homepages should be https:// URLs (URL is #{homepage})."
end end
# Savannah has full SSL/TLS support but no auto-redirect. # Savannah has full SSL/TLS support but no auto-redirect.
# Doesn't apply to the download URLs, only the homepage. # Doesn't apply to the download URLs, only the homepage.
if homepage =~ %r[^http://savannah\.nongnu\.org/] if homepage =~ %r[^http://savannah\.nongnu\.org/]
problem "Savannah homepages should be https:// URLs (URL is #{homepage})." problem "Please use https:// for #{homepage}"
end
if homepage =~ %r[^http://((?:trac|tools|www)\.)?ietf\.org]
problem "ietf homepages should be https:// URLs (URL is #{homepage})."
end
if homepage =~ %r[^http://((?:www)\.)?gnupg.org/]
problem "GnuPG homepages should be https:// URLs (URL is #{homepage})."
end end
# Freedesktop is complicated to handle - It has SSL/TLS, but only on certain subdomains. # Freedesktop is complicated to handle - It has SSL/TLS, but only on certain subdomains.
@ -323,36 +300,40 @@ class FormulaAuditor
# "Software" is redirected to https://wiki.freedesktop.org/www/Software/project_name # "Software" is redirected to https://wiki.freedesktop.org/www/Software/project_name
if homepage =~ %r[^http://((?:www|nice|libopenraw|liboil|telepathy|xorg)\.)?freedesktop\.org/(?:wiki/)?] if homepage =~ %r[^http://((?:www|nice|libopenraw|liboil|telepathy|xorg)\.)?freedesktop\.org/(?:wiki/)?]
if homepage =~ /Software/ if homepage =~ /Software/
problem "The url should be styled `https://wiki.freedesktop.org/www/Software/project_name`, not #{homepage}." problem "#{homepage} should be styled `https://wiki.freedesktop.org/www/Software/project_name`"
else else
problem "The url should be styled `https://wiki.freedesktop.org/project_name`, not #{homepage}." problem "#{homepage} should be styled `https://wiki.freedesktop.org/project_name`"
end end
end end
if homepage =~ %r[^http://wiki\.freedesktop\.org/] # Google Code homepages should end in a slash
problem "Freedesktop's Wiki subdomain should be https:// (URL is #{homepage})." if homepage =~ %r[^https?://code\.google\.com/p/[^/]+[^/]$]
end problem "#{homepage} should end with a slash"
# There's an auto-redirect here, but this mistake is incredibly common too.
if homepage =~ %r[^http://packages\.debian\.org]
problem "Debian homepage should be https:// URLs (URL is #{homepage})."
end end
# People will run into mixed content sometimes, but we should enforce and then add # People will run into mixed content sometimes, but we should enforce and then add
# exemptions as they are discovered. Treat mixed content on homepages as a bug. # exemptions as they are discovered. Treat mixed content on homepages as a bug.
# Justify each exemptions with a code comment so we can keep track here. # Justify each exemptions with a code comment so we can keep track here.
if homepage =~ %r[^http://[^/]*github\.io/] if homepage =~ %r[^http://[^/]*github\.io/]
problem "Github Pages URLs should be https:// (URL is #{homepage})." problem "Please use https:// for #{homepage}"
end
if homepage =~ %r[^http://[^/]*\.apache\.org]
problem "Apache homepages should be https:// URLs (URL is #{homepage})."
end end
# There's an auto-redirect here, but this mistake is incredibly common too. # There's an auto-redirect here, but this mistake is incredibly common too.
# Only applies to the homepage and subdomains for now, not the FTP URLs. # Only applies to the homepage and subdomains for now, not the FTP URLs.
if homepage =~ %r[^http://((?:build|cloud|developer|download|extensions|git|glade|help|library|live|nagios|news|people|projects|rt|static|wiki|www)\.)?gnome\.org] if homepage =~ %r[^http://((?:build|cloud|developer|download|extensions|git|glade|help|library|live|nagios|news|people|projects|rt|static|wiki|www)\.)?gnome\.org]
problem "Gnome homepages should be https:// URLs (URL is #{homepage})." problem "Please use https:// for #{homepage}"
end
# Compact the above into this list as we're able to remove detailed notations, etc over time.
case homepage
when %r[^http://[^/]*\.apache\.org],
%r[^http://packages\.debian\.org],
%r[^http://wiki\.freedesktop\.org/],
%r[^http://((?:www)\.)?gnupg.org/],
%r[^http://((?:trac|tools|www)\.)?ietf\.org],
%r[^http://www\.gnu\.org/],
%r[^http://code\.google\.com/]
problem "Please use https:// for #{homepage}"
end end
end end
@ -885,7 +866,7 @@ class ResourceAuditor
def audit_urls def audit_urls
# Check GNU urls; doesn't apply to mirrors # Check GNU urls; doesn't apply to mirrors
if url =~ %r[^(?:https?|ftp)://(?!alpha).+/gnu/] if url =~ %r[^(?:https?|ftp)://(?!alpha).+/gnu/]
problem "\"http://ftpmirror.gnu.org\" is preferred for GNU software (url is #{url})." problem "Please use \"http://ftpmirror.gnu.org\" instead of #{url}."
end end
if mirrors.include?(url) if mirrors.include?(url)
@ -901,22 +882,16 @@ class ResourceAuditor
next if p =~ %r[/ftpmirror\.gnu\.org] next if p =~ %r[/ftpmirror\.gnu\.org]
case p case p
when %r[^http://ftp\.gnu\.org/] when %r[^http://ftp\.gnu\.org/],
problem "ftp.gnu.org mirrors should be https://, not http:// (mirror is #{p})." %r[^http://[^/]*\.apache\.org/],
when %r[^http://[^/]*\.apache\.org/] %r[^http://code\.google\.com/],
problem "Apache urls should be https://, not http (url is #{p})." %r[^http://fossies\.org/],
when %r[^http://code\.google\.com/] %r[^http://mirrors\.kernel\.org/],
problem "code.google.com urls should be https://, not http (url is #{p})." %r[^http://([^/]*\.|)bintray\.com/],
when %r[^http://fossies\.org/] %r[^http://tools\.ietf\.org/]
problem "Fossies urls should be https://, not http (url is #{p})." problem "Please use https:// for #{p}"
when %r[^http://mirrors\.kernel\.org/]
problem "mirrors.kernel urls should be https://, not http (url is #{p})."
when %r[^http://([^/]*\.|)bintray\.com/]
problem "Bintray urls should be https://, not http (url is #{p})."
when %r[^http://tools\.ietf\.org/]
problem "ietf urls should be https://, not http (url is #{p})."
when %r[^http://search\.mcpan\.org/CPAN/(.*)]i when %r[^http://search\.mcpan\.org/CPAN/(.*)]i
problem "MetaCPAN url should be `https://cpan.metacpan.org/#{$1}` (url is #{p})." problem "#{p} should be `https://cpan.metacpan.org/#{$1}`"
end end
end end
@ -938,7 +913,7 @@ class ResourceAuditor
end end
if p =~ %r[^https?://sourceforge\.] if p =~ %r[^https?://sourceforge\.]
problem "Use http://downloads.sourceforge.net to get geolocation (url is #{p})." problem "Use https://downloads.sourceforge.net to get geolocation (url is #{p})."
end end
if p =~ %r[^https?://prdownloads\.] if p =~ %r[^https?://prdownloads\.]
@ -951,7 +926,7 @@ class ResourceAuditor
end end
if p.start_with? "http://downloads" if p.start_with? "http://downloads"
problem "Use https:// URLs for downloads from SourceForge (url is #{p})." problem "Please use https:// for #{p}"
end end
end end
@ -959,27 +934,27 @@ class ResourceAuditor
# Intentionally not extending this to SVN repositories due to certificate # Intentionally not extending this to SVN repositories due to certificate
# issues. # issues.
urls.grep(%r[^http://.*\.googlecode\.com/files.*]) do |u| urls.grep(%r[^http://.*\.googlecode\.com/files.*]) do |u|
problem "Use https:// URLs for downloads from Google Code (url is #{u})." problem "Please use https:// for #{u}"
end end
# Check for new-url Google Code download urls, https:// is preferred # Check for new-url Google Code download urls, https:// is preferred
urls.grep(%r[^http://code\.google\.com/]) do |u| urls.grep(%r[^http://code\.google\.com/]) do |u|
problem "Use https:// URLs for downloads from code.google (url is #{u})." problem "Please use https:// for #{u}"
end end
# Check for git:// GitHub repo urls, https:// is preferred. # Check for git:// GitHub repo urls, https:// is preferred.
urls.grep(%r[^git://[^/]*github\.com/]) do |u| urls.grep(%r[^git://[^/]*github\.com/]) do |u|
problem "Use https:// URLs for accessing GitHub repositories (url is #{u})." problem "Please use https:// for #{u}"
end end
# Check for git:// Gitorious repo urls, https:// is preferred. # Check for git:// Gitorious repo urls, https:// is preferred.
urls.grep(%r[^git://[^/]*gitorious\.org/]) do |u| urls.grep(%r[^git://[^/]*gitorious\.org/]) do |u|
problem "Use https:// URLs for accessing Gitorious repositories (url is #{u})." problem "Please use https:// for #{u}"
end end
# Check for http:// GitHub repo urls, https:// is preferred. # Check for http:// GitHub repo urls, https:// is preferred.
urls.grep(%r[^http://github\.com/.*\.git$]) do |u| urls.grep(%r[^http://github\.com/.*\.git$]) do |u|
problem "Use https:// URLs for accessing GitHub repositories (url is #{u})." problem "Please use https:// for #{u}"
end end
# Use new-style archive downloads # Use new-style archive downloads
@ -993,7 +968,6 @@ class ResourceAuditor
end end
end end
def problem text def problem text
@problems << text @problems << text
end end