macos-package-review/scripts/collect-inventory.sh

#!/usr/bin/env bash
# Collect system inventory for security audit
# Outputs JSON with all installed packages and applications

set -e

OUTPUT_FILE="${1:-inventory.json}"

# Initialize JSON object
json_data="{"
json_data+="\"timestamp\":\"$(date -u +'%Y-%m-%dT%H:%M:%SZ')\","
json_data+="\"system\":{"

# System info
json_data+="\"os\":\"$(uname -s)\","
json_data+="\"kernel_release\":\"$(uname -r)\","
json_data+="\"macos_version\":\"$(sw_vers -productVersion)\","
json_data+="\"hostname\":\"$(hostname)\","
json_data+="\"username\":\"$(whoami)\""
json_data+="},"

# Homebrew packages
echo "Collecting Homebrew packages..." >&2
json_data+="\"homebrew\":["
if command -v brew &> /dev/null; then
  first=true
  while IFS= read -r line; do
    if [ -z "$line" ]; then
      continue
    fi
    name=$(echo "$line" | awk '{print $1}')
    version=$(echo "$line" | awk '{print $2}')

    if [ "$first" = true ]; then
      first=false
    else
      json_data+=","
    fi

    json_data+="{\"name\":\"$(echo "$name" | sed 's/"/\\"/g')\",\"version\":\"$(echo "$version" | sed 's/"/\\"/g')\",\"source\":\"homebrew\"}"
  done < <(brew list --versions 2>/dev/null || true)
fi
json_data+="],"

# Python packages (from system/brew Python)
echo "Collecting Python packages..." >&2
json_data+="\"python\":["
if command -v python3 &> /dev/null; then
  first=true
  while IFS= read -r line; do
    if [ -z "$line" ] || [[ "$line" == "Package"* ]] || [[ "$line" == "---"* ]]; then
      continue
    fi
    name=$(echo "$line" | awk '{print $1}')
    version=$(echo "$line" | awk '{print $2}')

    if [ -z "$name" ] || [ -z "$version" ]; then
      continue
    fi

    if [ "$first" = true ]; then
      first=false
    else
      json_data+=","
    fi

    json_data+="{\"name\":\"$(echo "$name" | sed 's/"/\\"/g')\",\"version\":\"$(echo "$version" | sed 's/"/\\"/g')\",\"source\":\"pip\"}"
  done < <(python3 -m pip list 2>/dev/null || true)
fi
json_data+="],"

# Node.js global packages
echo "Collecting Node.js global packages..." >&2
json_data+="\"node\":["
if command -v npm &> /dev/null; then
  first=true
  while IFS= read -r line; do
    if [ -z "$line" ] || [[ "$line" == *"node_modules"* ]] || [[ "$line" == "├"* ]] || [[ "$line" == "└"* ]] || [[ "$line" == "│"* ]]; then
      continue
    fi

    # Parse package@version format
    if [[ "$line" =~ ^([a-zA-Z0-9\-\./@]+)@([0-9\.]+) ]]; then
      name="${BASH_REMATCH[1]}"
      version="${BASH_REMATCH[2]}"

      if [ "$first" = true ]; then
        first=false
      else
        json_data+=","
      fi

      json_data+="{\"name\":\"$(echo "$name" | sed 's/"/\\"/g')\",\"version\":\"$(echo "$version" | sed 's/"/\\"/g')\",\"source\":\"npm\"}"
    fi
  done < <(npm list -g --depth=0 2>/dev/null || true)
fi
json_data+="],"

# Go packages (if go.mod exists in common locations)
echo "Collecting Go packages..." >&2
json_data+="\"go\":["
first=true
for go_mod in ~/go/src/*/go.mod ~/.config/*/go.mod /tmp/*/go.mod; do
  if [ -f "$go_mod" ]; then
    dir=$(dirname "$go_mod")
    if command -v go &> /dev/null; then
      while IFS= read -r line; do
        if [[ "$line" =~ ^require\ ]]; then
          continue
        fi
        if [ -z "$line" ] || [[ "$line" == ")" ]] || [[ "$line" =~ ^\/\/ ]]; then
          continue
        fi

        name=$(echo "$line" | awk '{print $1}')
        version=$(echo "$line" | awk '{print $2}')

        if [ -z "$name" ] || [ -z "$version" ]; then
          continue
        fi

        if [ "$first" = true ]; then
          first=false
        else
          json_data+=","
        fi

        json_data+="{\"name\":\"$(echo "$name" | sed 's/"/\\"/g')\",\"version\":\"$(echo "$version" | sed 's/"/\\"/g')\",\"source\":\"go\"}"
      done < <(go mod graph 2>/dev/null | cut -d' ' -f2 | sort -u || true)
    fi
  fi
done
json_data+="],"

# Installed applications
echo "Collecting installed applications..." >&2
json_data+="\"applications\":["
first=true
for app_path in /Applications/* /System/Applications/* /usr/local/opt/*/Applications/*; do
  if [ -d "$app_path" ]; then
    app_name=$(basename "$app_path" .app)

    # Try to extract version from Info.plist
    info_plist="$app_path/Contents/Info.plist"
    version="unknown"
    bundle_id=""

    if [ -f "$info_plist" ]; then
      # Extract CFBundleShortVersionString
      if command -v plutil &> /dev/null; then
        version=$(plutil -extract CFBundleShortVersionString raw "$info_plist" 2>/dev/null || echo "unknown")
        bundle_id=$(plutil -extract CFBundleIdentifier raw "$info_plist" 2>/dev/null || echo "")
      elif command -v defaults &> /dev/null; then
        version=$(/usr/libexec/PlistBuddy -c "Print CFBundleShortVersionString" "$info_plist" 2>/dev/null || echo "unknown")
        bundle_id=$(/usr/libexec/PlistBuddy -c "Print CFBundleIdentifier" "$info_plist" 2>/dev/null || echo "")
      fi
    fi

    if [ "$first" = true ]; then
      first=false
    else
      json_data+=","
    fi

    json_data+="{\"name\":\"$(echo "$app_name" | sed 's/"/\\"/g')\",\"path\":\"$(echo "$app_path" | sed 's/"/\\"/g')\",\"version\":\"$(echo "$version" | sed 's/"/\\"/g')\",\"bundle_id\":\"$(echo "$bundle_id" | sed 's/"/\\"/g')\",\"source\":\"application\"}"
  fi
done
json_data+="]"

json_data+="}"

# Write to file
echo "$json_data" > "$OUTPUT_FILE"
echo "✓ Inventory saved to $OUTPUT_FILE" >&2
echo "  Total applications: $(echo "$json_data" | grep -o '\"name\"' | wc -l)" >&2