ClaudeandClaude Haiku 4.5
f8adf0669c
This commit establishes the foundation for a comprehensive security audit tool for macOS developer machines. It audits all installed software, detects vulnerabilities via OSV.dev, and provides Claude-powered mitigation recommendations. ## Architecture - System inventory collection (Homebrew, pip, npm, Go, Rust, apps) - CVE scanning via OSV.dev API (no auth, unlimited rate limits) - Claude integration (CLI or SDK) for mitigation analysis - JSON + HTML report generation - Full test suite (34+ tests, 7 benchmarks) - Production-grade linting (11 linters via golangci-lint) - Vulnerability scanning (govulncheck) - GitHub Actions CI/CD pipeline ## Key Components - cmd/audit/: CLI entry point - internal/inventory/: System inventory parsing - internal/security/: OSV.dev querying, Claude integration, audit logic - internal/report/: JSON and HTML report generation - scripts/collect-inventory.sh: Bash script for system enumeration ## MVP Features - Homebrew package scanning - Python/Node/Go/Rust ecosystem scanning - CVSS-based severity filtering - Claude-powered recommendations (update/replace/protect/monitor) - Makefile automation (test, lint, vulnerability checks) - Pre-commit hooks configuration ## Testing & Quality - 34+ unit tests with table-driven patterns - 7 benchmark tests for performance - 11 configured linters (staticcheck, gosec, revive, etc.) - Code coverage reporting - GitHub Actions CI (tests on Go 1.22 & 1.23) - Pre-commit hook framework ## Documentation - README.md: Full feature and usage documentation - QUICKSTART.md: 3-minute setup guide - TESTING.md: Testing and code quality guide - QA_SETUP.md: Analysis tooling reference - DATA_SOURCES_SPEC.md: Vulnerability data source documentation ## Data Sources - OSV.dev: Primary CVE database (1.8 day latency, no auth needed) - GitHub Advisories: Supplement for maintainer-created advisories - OpenSSF Scorecard: Trust signals (repo health/practices) - Homebrew Formulae API: Package metadata - CISA KEV: Active exploitation tracking ## Next Steps Phase 1 (MVP): Complete and tested ✓ Phase 2 (planned): Third-party app scanning, VirusTotal integration Phase 3 (planned): Historical monitoring, scheduled audits, webhooks Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
102 lines
2.9 KiB
Makefile
102 lines
2.9 KiB
Makefile
.PHONY: help build run clean test lint fmt audit-full install-deps install-tools coverage vulnerability ci
|
|
|
|
help:
|
|
@echo "Package Security Audit Tool"
|
|
@echo ""
|
|
@echo "Build & Run:"
|
|
@echo " make build - Build the audit binary"
|
|
@echo " make run - Run audit (requires inventory.json)"
|
|
@echo " make inventory - Collect system inventory"
|
|
@echo " make audit-full - Collect inventory + run audit"
|
|
@echo ""
|
|
@echo "Testing & Quality:"
|
|
@echo " make test - Run unit tests"
|
|
@echo " make coverage - Run tests with coverage report"
|
|
@echo " make lint - Run all linters"
|
|
@echo " make fmt - Format code"
|
|
@echo " make vulnerability - Check for known vulnerabilities"
|
|
@echo " make ci - Run all CI checks"
|
|
@echo ""
|
|
@echo "Maintenance:"
|
|
@echo " make install-deps - Install Go dependencies"
|
|
@echo " make install-tools - Install linting & analysis tools"
|
|
@echo " make clean - Clean build artifacts"
|
|
@echo ""
|
|
@echo "Quick start:"
|
|
@echo " make install-tools && make test && make audit-full"
|
|
|
|
install-tools:
|
|
@echo "Installing analysis tools..."
|
|
go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
|
|
go install golang.org/x/vuln/cmd/govulncheck@latest
|
|
@echo "✓ Tools installed"
|
|
|
|
install-deps:
|
|
@echo "Installing Go dependencies..."
|
|
go mod download
|
|
go mod tidy
|
|
|
|
build:
|
|
@echo "Building audit tool..."
|
|
mkdir -p bin
|
|
go build -o bin/audit ./cmd/audit
|
|
@echo "✓ Binary: ./bin/audit"
|
|
|
|
run: build
|
|
@echo "Running audit..."
|
|
@if [ ! -f inventory.json ]; then \
|
|
echo "❌ inventory.json not found. Run: make inventory"; \
|
|
exit 1; \
|
|
fi
|
|
./bin/audit
|
|
|
|
inventory:
|
|
@echo "Collecting system inventory..."
|
|
./scripts/collect-inventory.sh inventory.json
|
|
@echo "✓ Inventory saved to inventory.json"
|
|
|
|
audit-full: inventory run
|
|
@echo "✅ Audit complete!"
|
|
@echo " JSON: audit_report.json"
|
|
@echo " HTML: audit_report.html"
|
|
|
|
test:
|
|
@echo "Running tests..."
|
|
go test -v -race ./...
|
|
|
|
coverage:
|
|
@echo "Running tests with coverage..."
|
|
go test -v -race -coverprofile=coverage.out ./...
|
|
go tool cover -html=coverage.out -o coverage.html
|
|
@echo "✓ Coverage report: coverage.html"
|
|
@go tool cover -func=coverage.out | tail -1
|
|
|
|
lint:
|
|
@echo "Running linters..."
|
|
@which golangci-lint > /dev/null || (echo "Install with: make install-tools" && exit 1)
|
|
golangci-lint run --timeout=5m ./...
|
|
@echo "✓ Linting passed"
|
|
|
|
fmt:
|
|
@echo "Formatting code..."
|
|
go fmt ./...
|
|
go vet ./...
|
|
@echo "✓ Code formatted"
|
|
|
|
vulnerability:
|
|
@echo "Checking for known vulnerabilities..."
|
|
@which govulncheck > /dev/null || (echo "Install with: make install-tools" && exit 1)
|
|
govulncheck ./...
|
|
@echo "✓ No known vulnerabilities"
|
|
|
|
ci: fmt lint test vulnerability
|
|
@echo "✅ All CI checks passed"
|
|
|
|
clean:
|
|
@echo "Cleaning..."
|
|
rm -rf bin dist coverage.out coverage.html
|
|
rm -f inventory.json audit_report.json audit_report.html audit_data.json
|
|
go clean
|
|
|
|
.DEFAULT_GOAL := help
|