From f4007b25476dfd97885f358d2dabbd463f6f6017 Mon Sep 17 00:00:00 2001
From: Efraim Flashner <efraim@flashner.co.il>
Date: Thu, 30 Nov 2017 23:41:29 +0200
Subject: lint: 'check-vulnerabilities' also checks package properties.

* guix/scripts/lint.scm (check-vulnerabilities): Also check for CVEs
listed as mitigated in the package properties.
* tests/lint.scm ("cve: known safe from vulnerability"): New test.
---
 tests/lint.scm | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

(limited to 'tests')

diff --git a/tests/lint.scm b/tests/lint.scm
index 064f3d177e..ab0e8b9a8c 100644
--- a/tests/lint.scm
+++ b/tests/lint.scm
@@ -5,6 +5,7 @@
 ;;; Copyright © 2015, 2016 Mathieu Lirzin <mthl@gnu.org>
 ;;; Copyright © 2016 Hartmut Goebel <h.goebel@crazy-compilers.com>
 ;;; Copyright © 2017 Alex Kost <alezost@gmail.com>
+;;; Copyright © 2017 Efraim Flashner <efraim@flashner.co.il>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -702,6 +703,20 @@
                              (patches
                               (list "/a/b/pi-CVE-2015-1234.patch"))))))))))
 
+(test-assert "cve: known safe from vulnerability"
+  (mock ((guix scripts lint) package-vulnerabilities
+         (lambda (package)
+           (list (make-struct (@@ (guix cve) <vulnerability>) 0
+                              "CVE-2015-1234"
+                              (list (cons (package-name package)
+                                          (package-version package)))))))
+        (string-null?
+         (with-warnings
+           (check-vulnerabilities
+            (dummy-package "pi"
+                           (version "3.14")
+                           (properties `((lint-hidden-cve . ("CVE-2015-1234"))))))))))
+
 (test-assert "cve: vulnerability fixed in replacement version"
   (mock ((guix scripts lint) package-vulnerabilities
          (lambda (package)
-- 
cgit v1.2.3


From 3caab236c49012643ab46afd7e82a287ec413ee8 Mon Sep 17 00:00:00 2001
From: Ludovic Courtès <ludo@gnu.org>
Date: Mon, 18 Dec 2017 22:33:51 +0100
Subject: guix gc: '--verify=foo' is reported as an error.

Fixes <https://bugs.gnu.org/29761>.
Reported by Martin Castillo <castilma@uni-bremen.de>.

* guix/scripts/gc.scm (argument->verify-options): New procedure.
(%options) ["verify"]: Adjust to use it.
* tests/guix-gc.sh: Add test.
---
 guix/scripts/gc.scm | 31 +++++++++++++++++++++----------
 tests/guix-gc.sh    |  3 +++
 2 files changed, 24 insertions(+), 10 deletions(-)

(limited to 'tests')

diff --git a/guix/scripts/gc.scm b/guix/scripts/gc.scm
index 378a47d113..a31d2236b0 100644
--- a/guix/scripts/gc.scm
+++ b/guix/scripts/gc.scm
@@ -78,6 +78,21 @@ Invoke the garbage collector.\n"))
   (newline)
   (show-bug-report-information))
 
+(define argument->verify-options
+  (let ((not-comma (char-set-complement (char-set #\,)))
+        (validate  (lambda (option)
+                     (unless (memq option '(repair contents))
+                       (leave (G_ "~a: invalid '--verify' option~%")
+                              option)))))
+    (lambda (arg)
+      "Turn ARG into a list of symbols denoting '--verify' options."
+      (if arg
+          (let ((lst (map string->symbol
+                          (string-tokenize arg not-comma))))
+            (for-each validate lst)
+            lst)
+          '()))))
+
 (define %options
   ;; Specification of the command-line options.
   (list (option '(#\h "help") #f #f
@@ -112,16 +127,12 @@ Invoke the garbage collector.\n"))
                   (alist-cons 'action 'optimize
                               (alist-delete 'action result))))
         (option '("verify") #f #t
-                (let ((not-comma (char-set-complement (char-set #\,))))
-                  (lambda (opt name arg result)
-                    (let ((options (if arg
-                                       (map string->symbol
-                                            (string-tokenize arg not-comma))
-                                       '())))
-                      (alist-cons 'action 'verify
-                                  (alist-cons 'verify-options options
-                                              (alist-delete 'action
-                                                            result)))))))
+                (lambda (opt name arg result)
+                  (let ((options (argument->verify-options arg)))
+                    (alist-cons 'action 'verify
+                                (alist-cons 'verify-options options
+                                            (alist-delete 'action
+                                                          result))))))
         (option '("list-dead") #f #f
                 (lambda (opt name arg result)
                   (alist-cons 'action 'list-dead
diff --git a/tests/guix-gc.sh b/tests/guix-gc.sh
index 57c5e7dd61..efbc7e759c 100644
--- a/tests/guix-gc.sh
+++ b/tests/guix-gc.sh
@@ -39,6 +39,9 @@ do
     if guix gc $option whatever; then false; else true; fi
 done
 
+# This should fail.
+if guix gc --verify=foo; then false; else true; fi
+
 # Check the references of a .drv.
 drv="`guix build guile-bootstrap -d`"
 out="`guix build guile-bootstrap`"
-- 
cgit v1.2.3