ClaudeandClaude Haiku 4.5
f8adf0669c
This commit establishes the foundation for a comprehensive security audit tool for macOS developer machines. It audits all installed software, detects vulnerabilities via OSV.dev, and provides Claude-powered mitigation recommendations. ## Architecture - System inventory collection (Homebrew, pip, npm, Go, Rust, apps) - CVE scanning via OSV.dev API (no auth, unlimited rate limits) - Claude integration (CLI or SDK) for mitigation analysis - JSON + HTML report generation - Full test suite (34+ tests, 7 benchmarks) - Production-grade linting (11 linters via golangci-lint) - Vulnerability scanning (govulncheck) - GitHub Actions CI/CD pipeline ## Key Components - cmd/audit/: CLI entry point - internal/inventory/: System inventory parsing - internal/security/: OSV.dev querying, Claude integration, audit logic - internal/report/: JSON and HTML report generation - scripts/collect-inventory.sh: Bash script for system enumeration ## MVP Features - Homebrew package scanning - Python/Node/Go/Rust ecosystem scanning - CVSS-based severity filtering - Claude-powered recommendations (update/replace/protect/monitor) - Makefile automation (test, lint, vulnerability checks) - Pre-commit hooks configuration ## Testing & Quality - 34+ unit tests with table-driven patterns - 7 benchmark tests for performance - 11 configured linters (staticcheck, gosec, revive, etc.) - Code coverage reporting - GitHub Actions CI (tests on Go 1.22 & 1.23) - Pre-commit hook framework ## Documentation - README.md: Full feature and usage documentation - QUICKSTART.md: 3-minute setup guide - TESTING.md: Testing and code quality guide - QA_SETUP.md: Analysis tooling reference - DATA_SOURCES_SPEC.md: Vulnerability data source documentation ## Data Sources - OSV.dev: Primary CVE database (1.8 day latency, no auth needed) - GitHub Advisories: Supplement for maintainer-created advisories - OpenSSF Scorecard: Trust signals (repo health/practices) - Homebrew Formulae API: Package metadata - CISA KEV: Active exploitation tracking ## Next Steps Phase 1 (MVP): Complete and tested ✓ Phase 2 (planned): Third-party app scanning, VirusTotal integration Phase 3 (planned): Historical monitoring, scheduled audits, webhooks Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
99 lines
2.8 KiB
Go
99 lines
2.8 KiB
Go
package main
|
|
|
|
import (
|
|
"encoding/json"
|
|
"flag"
|
|
"fmt"
|
|
"log"
|
|
"os"
|
|
"path/filepath"
|
|
|
|
"github.com/user/package-review/internal/inventory"
|
|
"github.com/user/package-review/internal/report"
|
|
"github.com/user/package-review/internal/security"
|
|
)
|
|
|
|
func main() {
|
|
var (
|
|
inventoryFile = flag.String("inventory", "inventory.json", "Path to inventory JSON file")
|
|
outputJSON = flag.String("json", "audit_report.json", "Output audit report as JSON")
|
|
outputHTML = flag.String("html", "audit_report.html", "Output audit report as HTML")
|
|
claudeMode = flag.String("claude", "claude", "Claude integration mode: 'claude' (CLI) or 'sdk' (Anthropic SDK)")
|
|
)
|
|
|
|
flag.Usage = func() {
|
|
fmt.Fprintf(os.Stderr, `Usage: audit [options]
|
|
|
|
Options:
|
|
`)
|
|
flag.PrintDefaults()
|
|
fmt.Fprintf(os.Stderr, `
|
|
Examples:
|
|
# Collect inventory and run audit
|
|
./scripts/collect-inventory.sh && go run ./cmd/audit
|
|
|
|
# Use existing inventory
|
|
go run ./cmd/audit -inventory=/path/to/inventory.json
|
|
|
|
# Specify output files
|
|
go run ./cmd/audit -json=report.json -html=report.html
|
|
|
|
# Use Anthropic SDK for Claude (requires ANTHROPIC_API_KEY)
|
|
go run ./cmd/audit -claude=sdk
|
|
`)
|
|
}
|
|
|
|
flag.Parse()
|
|
|
|
// Verify inventory file exists
|
|
if _, err := os.Stat(*inventoryFile); os.IsNotExist(err) {
|
|
log.Fatalf("❌ Inventory file not found: %s\nRun: ./scripts/collect-inventory.sh", *inventoryFile)
|
|
}
|
|
|
|
fmt.Println("🔍 Loading inventory...")
|
|
inv, err := inventory.LoadInventory(*inventoryFile)
|
|
if err != nil {
|
|
log.Fatalf("Error loading inventory: %v", err)
|
|
}
|
|
|
|
fmt.Printf("✓ Loaded %d packages from inventory\n\n", inv.CountPackages())
|
|
|
|
// Scan for vulnerabilities
|
|
fmt.Println("🔎 Scanning for vulnerabilities...")
|
|
audit := security.NewAudit(inv)
|
|
if err := audit.ScanOSV(); err != nil {
|
|
log.Fatalf("Error scanning OSV.dev: %v", err)
|
|
}
|
|
|
|
// Get high-severity findings
|
|
highSev := audit.FilterByMinSeverity(7.0)
|
|
fmt.Printf("⚠️ Found %d high-severity vulnerabilities\n\n", len(highSev))
|
|
|
|
// Run Claude analysis on high-severity items
|
|
if len(highSev) > 0 {
|
|
fmt.Println("🤖 Analyzing with Claude...")
|
|
if err := audit.AnalyzeWithClaude(*claudeMode); err != nil {
|
|
log.Fatalf("Error running Claude analysis: %v", err)
|
|
}
|
|
}
|
|
|
|
// Generate reports
|
|
fmt.Println("\n📊 Generating reports...")
|
|
|
|
// JSON report
|
|
if err := report.WriteJSON(audit, *outputJSON); err != nil {
|
|
log.Fatalf("Error writing JSON report: %v", err)
|
|
}
|
|
fmt.Printf("✓ JSON report: %s\n", *outputJSON)
|
|
|
|
// HTML report (via Astro)
|
|
if err := report.GenerateAstroSite(audit, *outputHTML); err != nil {
|
|
log.Fatalf("Error generating HTML report: %v", err)
|
|
}
|
|
fmt.Printf("✓ HTML report: %s\n", *outputHTML)
|
|
|
|
fmt.Println("\n✅ Audit complete!")
|
|
fmt.Printf("📈 Summary: %d packages scanned, %d with CVEs, %d high-severity\n",
|
|
inv.CountPackages(), audit.CountVulnerable(), len(highSev))
|
|
}
|