tree 6dabb95c879b11c5dc722d5679d7edbf3441adfa
parent 8889080d6d39a6d93804592f3f7228b12f009a51
author Damien Neil <dneil@google.com> 1652222481 -0700
committer Damien Neil <dneil@google.com> 1655317497 +0000

cmd/vulnreport: automatically fetch modules in symbol checks

The "vulnreport fix" command loads affected modules to add exported
symbols. (Eventually, this command should also validate the listed
symbols exist in the module, but it doesn't do that right now.)

Running fix requires some manual effort on the user's part.
From the triage documentation:

  mkdir /tmp/mymod
  cd /tmp/mymod
  go mod init
  go get github.com/my/mod@<version-before-fixed>
  go run <path to /cmd/vulnreport> fix

Automate this.

Detemining the "version-before-fixed" is programmatically is difficult.
Rather than trying to do so, add a "vulnerable_at" field to reports
which specifies a known-vulnerable version to use. Placing this in
the report also makes whatever work fix does more reproducable, since
we have an audit trail of what version was used.

Change-Id: Ie76d582a1f5192597f411b60eb407c2c014a9d35
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/412395
Reviewed-by: Julie Qiu <julieqiu@google.com>
Run-TryBot: Damien Neil <dneil@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>