macos-package-review

Files

T

FloandClaude Opus 4.8 5a610ff5c4 feat(security): scan Homebrew pkgs via brew-vulns

Add Audit.ScanHomebrew, which shells out to "brew vulns --json" (the
homebrew/brew-vulns tap) to cover the Homebrew formulae that ScanOSV
skips. It resolves each formula's source repo and version tag and
queries OSV via the GIT ecosystem.

brew-vulns exits 1 when vulnerabilities are found, so success is
detected by parseable JSON on stdout rather than the exit code; if the
tool is not installed the scan is skipped with a notice instead of
failing the audit. Qualitative severities are mapped through the
existing severityLabelToScore/cvssToSeverity helpers for consistency.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GVbEgdgcC1w6qwSq3zC4kg

2026-06-23 23:58:42 +02:00

audit_test.go

Initial project scaffold: macOS package security audit tool

2026-06-23 04:56:57 -07:00

audit.go

Initial project scaffold: macOS package security audit tool

2026-06-23 04:56:57 -07:00

brewvulns_test.go

feat(security): scan Homebrew pkgs via brew-vulns

2026-06-23 23:58:42 +02:00

brewvulns.go

feat(security): scan Homebrew pkgs via brew-vulns