Initial project scaffold: macOS package security audit tool
This commit establishes the foundation for a comprehensive security audit tool for macOS developer machines. It audits all installed software, detects vulnerabilities via OSV.dev, and provides Claude-powered mitigation recommendations. ## Architecture - System inventory collection (Homebrew, pip, npm, Go, Rust, apps) - CVE scanning via OSV.dev API (no auth, unlimited rate limits) - Claude integration (CLI or SDK) for mitigation analysis - JSON + HTML report generation - Full test suite (34+ tests, 7 benchmarks) - Production-grade linting (11 linters via golangci-lint) - Vulnerability scanning (govulncheck) - GitHub Actions CI/CD pipeline ## Key Components - cmd/audit/: CLI entry point - internal/inventory/: System inventory parsing - internal/security/: OSV.dev querying, Claude integration, audit logic - internal/report/: JSON and HTML report generation - scripts/collect-inventory.sh: Bash script for system enumeration ## MVP Features - Homebrew package scanning - Python/Node/Go/Rust ecosystem scanning - CVSS-based severity filtering - Claude-powered recommendations (update/replace/protect/monitor) - Makefile automation (test, lint, vulnerability checks) - Pre-commit hooks configuration ## Testing & Quality - 34+ unit tests with table-driven patterns - 7 benchmark tests for performance - 11 configured linters (staticcheck, gosec, revive, etc.) - Code coverage reporting - GitHub Actions CI (tests on Go 1.22 & 1.23) - Pre-commit hook framework ## Documentation - README.md: Full feature and usage documentation - QUICKSTART.md: 3-minute setup guide - TESTING.md: Testing and code quality guide - QA_SETUP.md: Analysis tooling reference - DATA_SOURCES_SPEC.md: Vulnerability data source documentation ## Data Sources - OSV.dev: Primary CVE database (1.8 day latency, no auth needed) - GitHub Advisories: Supplement for maintainer-created advisories - OpenSSF Scorecard: Trust signals (repo health/practices) - Homebrew Formulae API: Package metadata - CISA KEV: Active exploitation tracking ## Next Steps Phase 1 (MVP): Complete and tested ✓ Phase 2 (planned): Third-party app scanning, VirusTotal integration Phase 3 (planned): Historical monitoring, scheduled audits, webhooks Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
This commit is contained in:
Claude
@@ -0,0 +1,198 @@
|
||||
package report
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"os"
|
||||
"os/exec"
|
||||
"strings"
|
||||
|
||||
"github.com/user/package-review/internal/security"
|
||||
)
|
||||
|
||||
// WriteJSON writes the audit results as JSON
|
||||
func WriteJSON(audit *security.Audit, outputPath string) error {
|
||||
data := map[string]interface{}{
|
||||
"timestamp": audit.Inventory.Timestamp,
|
||||
"system": audit.Inventory.System,
|
||||
"summary": map[string]interface{}{
|
||||
"total_packages": audit.Inventory.CountPackages(),
|
||||
"by_source": audit.Inventory.CountBySource(),
|
||||
"total_findings": len(audit.Findings),
|
||||
"vulnerable_count": audit.CountVulnerable(),
|
||||
"high_severity": len(audit.FilterByMinSeverity(7.0)),
|
||||
"critical_findings": len(audit.FilterByMinSeverity(9.0)),
|
||||
},
|
||||
"findings": audit.Findings,
|
||||
"mitigations": audit.Mitigations,
|
||||
}
|
||||
|
||||
jsonBytes, err := json.MarshalIndent(data, "", " ")
|
||||
if err != nil {
|
||||
return fmt.Errorf("marshal JSON: %w", err)
|
||||
}
|
||||
|
||||
if err := os.WriteFile(outputPath, jsonBytes, 0o644); err != nil {
|
||||
return fmt.Errorf("write JSON file: %w", err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// GenerateAstroSite generates an Astro static site from the audit results
|
||||
func GenerateAstroSite(audit *security.Audit, outputHTMLPath string) error {
|
||||
// Create intermediate JSON for Astro to consume
|
||||
astroDataFile := "audit_data.json"
|
||||
|
||||
// Write audit data to JSON file that Astro will use
|
||||
data := map[string]interface{}{
|
||||
"timestamp": audit.Inventory.Timestamp,
|
||||
"system": audit.Inventory.System,
|
||||
"findings": audit.Findings,
|
||||
"mitigations": audit.Mitigations,
|
||||
"summary": map[string]interface{}{
|
||||
"total_packages": audit.Inventory.CountPackages(),
|
||||
"vulnerable_count": audit.CountVulnerable(),
|
||||
"high_severity": len(audit.FilterByMinSeverity(7.0)),
|
||||
"critical_findings": len(audit.FilterByMinSeverity(9.0)),
|
||||
},
|
||||
}
|
||||
|
||||
jsonBytes, err := json.MarshalIndent(data, "", " ")
|
||||
if err != nil {
|
||||
return fmt.Errorf("marshal Astro data: %w", err)
|
||||
}
|
||||
|
||||
if err := os.WriteFile(astroDataFile, jsonBytes, 0o644); err != nil {
|
||||
return fmt.Errorf("write Astro data file: %w", err)
|
||||
}
|
||||
|
||||
// Check if Astro is available
|
||||
_, err = exec.LookPath("astro")
|
||||
if err != nil {
|
||||
// Fallback: generate a simple HTML report without Astro
|
||||
fmt.Println(" ⚠️ Astro not found, generating basic HTML report...")
|
||||
return generateBasicHTML(audit, outputHTMLPath)
|
||||
}
|
||||
|
||||
// Build Astro site
|
||||
cmd := exec.Command("astro", "build", "--outDir", "dist")
|
||||
if err := cmd.Run(); err != nil {
|
||||
fmt.Println(" ⚠️ Astro build failed, generating basic HTML report...")
|
||||
return generateBasicHTML(audit, outputHTMLPath)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// generateBasicHTML creates a simple HTML report as fallback
|
||||
func generateBasicHTML(audit *security.Audit, outputPath string) error {
|
||||
html := `<!DOCTYPE html>
|
||||
<html lang="en">
|
||||
<head>
|
||||
<meta charset="UTF-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
||||
<title>Security Audit Report</title>
|
||||
<style>
|
||||
body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; margin: 0; padding: 20px; background: #f5f5f5; }
|
||||
.container { max-width: 1200px; margin: 0 auto; background: white; border-radius: 8px; padding: 30px; box-shadow: 0 2px 8px rgba(0,0,0,0.1); }
|
||||
h1 { color: #333; }
|
||||
.summary { display: grid; grid-template-columns: repeat(4, 1fr); gap: 20px; margin: 20px 0; }
|
||||
.metric { background: #f9f9f9; padding: 15px; border-radius: 6px; }
|
||||
.metric-value { font-size: 32px; font-weight: bold; color: #2c3e50; }
|
||||
.metric-label { font-size: 12px; color: #7f8c8d; text-transform: uppercase; margin-top: 5px; }
|
||||
.critical { color: #e74c3c; }
|
||||
.high { color: #f39c12; }
|
||||
.medium { color: #3498db; }
|
||||
.finding { border: 1px solid #e0e0e0; border-radius: 6px; padding: 15px; margin: 10px 0; }
|
||||
.finding-header { display: flex; justify-content: space-between; align-items: center; }
|
||||
.finding-cve { font-family: monospace; font-weight: bold; }
|
||||
.cvss { display: inline-block; padding: 4px 8px; border-radius: 4px; color: white; font-weight: bold; }
|
||||
.cvss-critical { background: #e74c3c; }
|
||||
.cvss-high { background: #f39c12; }
|
||||
.cvss-medium { background: #3498db; }
|
||||
.cvss-low { background: #27ae60; }
|
||||
.mitigation { background: #ecf0f1; padding: 15px; border-left: 4px solid #3498db; margin-top: 10px; border-radius: 4px; }
|
||||
table { width: 100%; border-collapse: collapse; margin: 20px 0; }
|
||||
th, td { padding: 12px; text-align: left; border-bottom: 1px solid #e0e0e0; }
|
||||
th { background: #f9f9f9; font-weight: 600; }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<div class="container">
|
||||
<h1>🔒 Security Audit Report</h1>
|
||||
<p>Generated: ` + audit.Inventory.Timestamp.String() + `</p>
|
||||
|
||||
<h2>Summary</h2>
|
||||
<div class="summary">
|
||||
<div class="metric">
|
||||
<div class="metric-value">` + fmt.Sprintf("%d", audit.Inventory.CountPackages()) + `</div>
|
||||
<div class="metric-label">Total Packages</div>
|
||||
</div>
|
||||
<div class="metric">
|
||||
<div class="metric-value">` + fmt.Sprintf("%d", audit.CountVulnerable()) + `</div>
|
||||
<div class="metric-label">With CVEs</div>
|
||||
</div>
|
||||
<div class="metric">
|
||||
<div class="metric-value critical">` + fmt.Sprintf("%d", len(audit.FilterByMinSeverity(9.0))) + `</div>
|
||||
<div class="metric-label">CRITICAL</div>
|
||||
</div>
|
||||
<div class="metric">
|
||||
<div class="metric-value high">` + fmt.Sprintf("%d", len(audit.FilterByMinSeverity(7.0))-len(audit.FilterByMinSeverity(9.0))) + `</div>
|
||||
<div class="metric-label">HIGH</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<h2>Findings</h2>`
|
||||
|
||||
for _, finding := range audit.Findings {
|
||||
cssClass := "cvss-low"
|
||||
switch {
|
||||
case finding.CVSS >= 9.0:
|
||||
cssClass = "cvss-critical"
|
||||
case finding.CVSS >= 7.0:
|
||||
cssClass = "cvss-high"
|
||||
case finding.CVSS >= 4.0:
|
||||
cssClass = "cvss-medium"
|
||||
}
|
||||
|
||||
html += `
|
||||
<div class="finding">
|
||||
<div class="finding-header">
|
||||
<div>
|
||||
<strong>` + finding.PackageName + `</strong> (` + finding.PackageVersion + `)
|
||||
<br>
|
||||
<span class="finding-cve">` + finding.CVE + `</span>
|
||||
</div>
|
||||
<span class="cvss ` + cssClass + `">` + fmt.Sprintf("%.1f", finding.CVSS) + `</span>
|
||||
</div>
|
||||
<p>` + finding.Summary + `</p>`
|
||||
|
||||
// Find mitigation for this finding
|
||||
for _, mit := range audit.Mitigations {
|
||||
if mit.Finding.CVE == finding.CVE && mit.Finding.PackageName == finding.PackageName {
|
||||
html += `
|
||||
<div class="mitigation">
|
||||
<strong>Recommendation:</strong> ` + strings.ToUpper(mit.Recommendation) + `<br>
|
||||
<strong>Rationale:</strong> ` + mit.Rationale + `<br>
|
||||
<strong>Next Steps:</strong> ` + mit.NextSteps + `
|
||||
</div>`
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
html += `
|
||||
</div>`
|
||||
}
|
||||
|
||||
html += `
|
||||
</div>
|
||||
</body>
|
||||
</html>`
|
||||
|
||||
if err := os.WriteFile(outputPath, []byte(html), 0o644); err != nil {
|
||||
return fmt.Errorf("write HTML file: %w", err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
Reference in New Issue
Block a user