diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml new file mode 100644 index 0000000..e05d595 --- /dev/null +++ b/.github/workflows/release.yml @@ -0,0 +1,32 @@ +name: Release + +on: + push: + tags: + - 'v*' + +permissions: + contents: write + +jobs: + release: + runs-on: ubuntu-latest + steps: + - name: Checkout + uses: actions/checkout@v4 + with: + fetch-depth: 0 + + - name: Set up Go + uses: actions/setup-go@v5 + with: + go-version-file: go.mod + cache: true + + - name: Run GoReleaser + uses: goreleaser/goreleaser-action@v6 + with: + version: '~> v2' + args: release --clean + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/.gitignore b/.gitignore index 57abfe3..002c724 100644 --- a/.gitignore +++ b/.gitignore @@ -6,11 +6,13 @@ !.gitattributes !.github/** !.vscode/* +!.goreleaser.yaml !cmd/** !docs/* !examples/** !wraith/** !pkg/** +!scripts/** !*.go !go.sum @@ -18,6 +20,7 @@ !README.md !LICENSE +!NOTICE !Makefile # ...even if they are in subdirectories diff --git a/.goreleaser.yaml b/.goreleaser.yaml new file mode 100644 index 0000000..12a6abd --- /dev/null +++ b/.goreleaser.yaml @@ -0,0 +1,67 @@ +version: 2 + +project_name: wraith + +env: + - OSV_VERSION=v2.3.2 + +before: + hooks: + - go mod tidy + - bash scripts/download-osv-scanner.sh + +builds: + - id: wraith + main: ./cmd/wraith + binary: wraith + env: + - CGO_ENABLED=0 + goos: + - linux + - darwin + - windows + goarch: + - amd64 + - arm64 + ignore: + - goos: windows + goarch: arm64 + ldflags: + - -s -w + - -X main.version={{.Version}} + +archives: + - id: default + formats: ['tar.gz'] + format_overrides: + - goos: windows + formats: ['zip'] + name_template: >- + {{ .ProjectName }}_ + {{- .Os }}_ + {{- .Arch }} + files: + - README.md + - LICENSE + - NOTICE + - src: build/osv-scanner/{{ .Os }}_{{ .Arch }}/* + strip_parent: true + +checksum: + name_template: 'checksums.txt' + +changelog: + sort: asc + filters: + exclude: + - '^docs:' + - '^test:' + - '^chore:' + +release: + github: + owner: ghostsecurity + name: wraith + draft: false + prerelease: auto + name_template: "v{{.Version}}" diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..06a9488 --- /dev/null +++ b/LICENSE @@ -0,0 +1,190 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to the Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + Copyright 2026 Ghost Security + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/NOTICE b/NOTICE new file mode 100644 index 0000000..4546659 --- /dev/null +++ b/NOTICE @@ -0,0 +1,6 @@ +Wraith +Copyright 2026 Ghost Security + +This product includes software developed by Google: +- osv-scanner (https://github.com/google/osv-scanner) + Licensed under the Apache License, Version 2.0 diff --git a/README.md b/README.md index 5ac283d..f094a92 100644 --- a/README.md +++ b/README.md @@ -4,16 +4,67 @@ A vulnerability scanner for package dependencies. -### Features +## Features -Just a wrapper around [osv-scanner](https://github.com/google/osv-scanner) with some convenience functions. +A wrapper around [osv-scanner](https://github.com/google/osv-scanner) with a user-friendly CLI and Go library. The CLI release bundles osv-scanner, so you only need to do one install. -### Installation +## CLI Installation + +Download the latest release for your platform from the [releases page](https://github.com/ghostsecurity/wraith/releases). + +```bash +# macOS (Apple Silicon) +curl -L https://github.com/ghostsecurity/wraith/releases/latest/download/wraith_darwin_arm64.tar.gz | tar xz +sudo mv wraith osv-scanner /usr/local/bin/ + +# macOS (Intel) +curl -L https://github.com/ghostsecurity/wraith/releases/latest/download/wraith_darwin_amd64.tar.gz | tar xz +sudo mv wraith osv-scanner /usr/local/bin/ + +# Linux (x86_64) +curl -L https://github.com/ghostsecurity/wraith/releases/latest/download/wraith_linux_amd64.tar.gz | tar xz +sudo mv wraith osv-scanner /usr/local/bin/ + +# Linux (ARM64) +curl -L https://github.com/ghostsecurity/wraith/releases/latest/download/wraith_linux_arm64.tar.gz | tar xz +sudo mv wraith osv-scanner /usr/local/bin/ +``` + +For Windows, download the `.zip` file from the releases page and extract both `wraith.exe` and `osv-scanner.exe` to a directory in your PATH. + +## CLI Usage + +```bash +# Scan a lockfile (text output) +wraith scan go.mod + +# Output as JSON +wraith scan --format json go.mod + +# Output as Markdown +wraith scan --format md go.mod + +# Write Markdown report to file +wraith scan --output report.md go.mod +``` + +> **Note:** Flags must come before the lockfile path. + +### Exit Codes + +- `0`: No vulnerabilities found +- `1`: Vulnerabilities found or error occurred + +## Library Installation ```bash go get github.com/ghostsecurity/wraith ``` +> **Note:** When using wraith as a library, you need [osv-scanner](https://github.com/google/osv-scanner) installed and available in your PATH. + +## Library Usage + ### Basic Usage ```go diff --git a/cmd/wraith/main.go b/cmd/wraith/main.go new file mode 100644 index 0000000..c49c6ec --- /dev/null +++ b/cmd/wraith/main.go @@ -0,0 +1,330 @@ +package main + +import ( + "encoding/json" + "flag" + "fmt" + "os" + "strings" + "time" + + wraith "github.com/ghostsecurity/wraith/pkg" +) + +var ( + version = "dev" +) + +const ( + colorRed = "\033[31m" + colorGreen = "\033[32m" + colorYellow = "\033[33m" + colorCyan = "\033[36m" + colorReset = "\033[0m" + colorBold = "\033[1m" +) + +func main() { + if len(os.Args) < 2 { + printUsage() + os.Exit(1) + } + + switch os.Args[1] { + case "scan": + os.Exit(runScan(os.Args[2:])) + case "version", "--version", "-v": + fmt.Printf("wraith %s\n", version) + os.Exit(0) + case "help", "--help", "-h": + printUsage() + os.Exit(0) + default: + fmt.Fprintf(os.Stderr, "Unknown command: %s\n\n", os.Args[1]) + printUsage() + os.Exit(1) + } +} + +func runScan(args []string) int { + fs := flag.NewFlagSet("scan", flag.ExitOnError) + format := fs.String("format", "text", "Output format: text, json, md") + outputFile := fs.String("output", "", "Write output to file (implies --format md if .md extension)") + noColor := fs.Bool("no-color", false, "Disable colored output (text format only)") + + fs.Usage = func() { + fmt.Fprintf(os.Stderr, "Usage: wraith scan [options] \n\n") + fmt.Fprintf(os.Stderr, "Scan a lockfile for known vulnerabilities.\n\n") + fmt.Fprintf(os.Stderr, "Options:\n") + fs.PrintDefaults() + fmt.Fprintf(os.Stderr, "\nExamples:\n") + fmt.Fprintf(os.Stderr, " wraith scan go.mod # Text output to terminal\n") + fmt.Fprintf(os.Stderr, " wraith scan --format json go.mod # JSON output to stdout\n") + fmt.Fprintf(os.Stderr, " wraith scan --format md go.mod # Markdown output to stdout\n") + fmt.Fprintf(os.Stderr, " wraith scan --output report.md go.mod # Write markdown to file\n") + } + + if err := fs.Parse(args); err != nil { + return 1 + } + + if fs.NArg() < 1 { + fmt.Fprintf(os.Stderr, "Error: lockfile path is required\n\n") + fs.Usage() + return 1 + } + + lockfile := fs.Arg(0) + outputFormat := *format + + // If output file has .md extension, default to markdown format + if *outputFile != "" && strings.HasSuffix(*outputFile, ".md") && *format == "text" { + outputFormat = "md" + } + + useColor := !*noColor && isTerminal() && *outputFile == "" + + result, err := wraith.QuickScan(lockfile) + if err != nil { + fmt.Fprintf(os.Stderr, "Error: %v\n", err) + return 1 + } + + var output string + var exitCode int + + switch outputFormat { + case "json": + output, exitCode = formatJSON(result) + case "md", "markdown": + output, exitCode = formatMarkdown(result, lockfile) + case "text": + output, exitCode = formatText(result, useColor) + default: + fmt.Fprintf(os.Stderr, "Error: unknown format %q (use text, json, or md)\n", outputFormat) + return 1 + } + + // Write to file or stdout + if *outputFile != "" { + if err := os.WriteFile(*outputFile, []byte(output), 0644); err != nil { + fmt.Fprintf(os.Stderr, "Error writing to file: %v\n", err) + return 1 + } + fmt.Fprintf(os.Stderr, "Report written to %s\n", *outputFile) + } else { + fmt.Print(output) + } + + return exitCode +} + +func formatJSON(result *wraith.OSVScanResult) (string, int) { + output := struct { + PackageCount int `json:"package_count"` + VulnerabilityCount int `json:"vulnerability_count"` + Results []wraith.ScanResult `json:"results"` + }{ + PackageCount: result.GetPackageCount(), + VulnerabilityCount: result.GetVulnerabilityCount(), + Results: result.ToSimplifiedResults(), + } + + data, err := json.MarshalIndent(output, "", " ") + if err != nil { + return fmt.Sprintf("Error encoding JSON: %v\n", err), 1 + } + + exitCode := 0 + if result.GetVulnerabilityCount() > 0 { + exitCode = 1 + } + return string(data) + "\n", exitCode +} + +func formatMarkdown(result *wraith.OSVScanResult, lockfile string) (string, int) { + var sb strings.Builder + pkgCount := result.GetPackageCount() + vulnCount := result.GetVulnerabilityCount() + vulnPackages := result.GetPackagesWithVulnerabilities() + + sb.WriteString("# Vulnerability Scan Report\n\n") + sb.WriteString(fmt.Sprintf("**Scanned:** `%s` \n", lockfile)) + sb.WriteString(fmt.Sprintf("**Date:** %s \n\n", time.Now().Format("2006-01-02 15:04:05"))) + + sb.WriteString("## Summary\n\n") + sb.WriteString("| Metric | Count |\n") + sb.WriteString("|--------|-------|\n") + sb.WriteString(fmt.Sprintf("| Packages scanned | %d |\n", pkgCount)) + sb.WriteString(fmt.Sprintf("| Vulnerabilities found | %d |\n", vulnCount)) + sb.WriteString(fmt.Sprintf("| Affected packages | %d |\n\n", len(vulnPackages))) + + if vulnCount == 0 { + sb.WriteString("✅ **No vulnerabilities found!**\n") + return sb.String(), 0 + } + + sb.WriteString("## Vulnerabilities\n\n") + + for _, pkg := range vulnPackages { + sb.WriteString(fmt.Sprintf("### %s@%s\n\n", pkg.Package.Name, pkg.Package.Version)) + sb.WriteString(fmt.Sprintf("**Ecosystem:** %s\n\n", pkg.Package.Ecosystem)) + + for _, vuln := range pkg.Vulnerabilities { + sb.WriteString(fmt.Sprintf("#### %s\n\n", vuln.ID)) + + if vuln.Summary != "" { + sb.WriteString(fmt.Sprintf("%s\n\n", vuln.Summary)) + } + + // CVEs + cves := extractCVEs(vuln.Aliases) + if len(cves) > 0 { + sb.WriteString(fmt.Sprintf("**CVEs:** %s\n\n", strings.Join(cves, ", "))) + } + + // Severity + if len(vuln.Severity) > 0 { + sb.WriteString(fmt.Sprintf("**Severity:** `%s`\n\n", vuln.Severity[0].Score)) + } + + // References + if len(vuln.References) > 0 { + sb.WriteString("**References:**\n") + for _, ref := range vuln.References { + sb.WriteString(fmt.Sprintf("- [%s](%s)\n", ref.URL, ref.URL)) + } + sb.WriteString("\n") + } + + sb.WriteString("---\n\n") + } + } + + return sb.String(), 1 +} + +func formatText(result *wraith.OSVScanResult, useColor bool) (string, int) { + var sb strings.Builder + pkgCount := result.GetPackageCount() + vulnCount := result.GetVulnerabilityCount() + vulnPackages := result.GetPackagesWithVulnerabilities() + + sb.WriteString(fmt.Sprintf("\n%s\n", divider(50))) + sb.WriteString(fmt.Sprintf("%s SCAN SUMMARY %s\n", bold("", useColor), "")) + sb.WriteString(fmt.Sprintf("%s\n\n", divider(50))) + + sb.WriteString(fmt.Sprintf("Packages scanned: %s\n", bold(fmt.Sprintf("%d", pkgCount), useColor))) + + if vulnCount == 0 { + sb.WriteString(fmt.Sprintf("Vulnerabilities: %s\n\n", green("0", useColor))) + sb.WriteString(fmt.Sprintf("%s No vulnerabilities found!\n\n", green("✓", useColor))) + return sb.String(), 0 + } + + sb.WriteString(fmt.Sprintf("Vulnerabilities: %s\n", red(fmt.Sprintf("%d", vulnCount), useColor))) + sb.WriteString(fmt.Sprintf("Affected packages: %s\n\n", red(fmt.Sprintf("%d", len(vulnPackages)), useColor))) + + for _, pkg := range vulnPackages { + sb.WriteString(fmt.Sprintf("%s %s %s (%s)\n", + red("●", useColor), + bold(pkg.Package.Name, useColor), + cyan(pkg.Package.Version, useColor), + pkg.Package.Ecosystem)) + + for _, vuln := range pkg.Vulnerabilities { + sb.WriteString(fmt.Sprintf(" %s %s\n", yellow("└─", useColor), vuln.ID)) + if vuln.Summary != "" { + summary := vuln.Summary + if len(summary) > 80 { + summary = summary[:77] + "..." + } + sb.WriteString(fmt.Sprintf(" %s\n", summary)) + } + + cves := extractCVEs(vuln.Aliases) + if len(cves) > 0 { + sb.WriteString(fmt.Sprintf(" CVEs: %s\n", strings.Join(cves, ", "))) + } + } + sb.WriteString("\n") + } + + sb.WriteString(fmt.Sprintf("%s Review and address the vulnerabilities above.\n\n", yellow("!", useColor))) + return sb.String(), 1 +} + +func extractCVEs(aliases []string) []string { + var cves []string + for _, alias := range aliases { + if strings.HasPrefix(alias, "CVE-") { + cves = append(cves, alias) + } + } + return cves +} + +func printUsage() { + fmt.Fprintf(os.Stderr, `wraith - Vulnerability scanner for package dependencies + +USAGE: + wraith [options] + +COMMANDS: + scan Scan a lockfile for vulnerabilities + version Print version information + help Show this help message + +EXAMPLES: + wraith scan go.mod + wraith scan --format json poetry.lock + wraith scan --format md go.mod + wraith scan --output report.md go.mod + +Run 'wraith scan --help' for more information on the scan command. +`) +} + +func isTerminal() bool { + fileInfo, _ := os.Stdout.Stat() + return (fileInfo.Mode() & os.ModeCharDevice) != 0 +} + +func divider(n int) string { + return strings.Repeat("─", n) +} + +func red(s string, useColor bool) string { + if useColor { + return colorRed + s + colorReset + } + return s +} + +func green(s string, useColor bool) string { + if useColor { + return colorGreen + s + colorReset + } + return s +} + +func yellow(s string, useColor bool) string { + if useColor { + return colorYellow + s + colorReset + } + return s +} + +func cyan(s string, useColor bool) string { + if useColor { + return colorCyan + s + colorReset + } + return s +} + +func bold(s string, useColor bool) string { + if useColor { + return colorBold + s + colorReset + } + return s +} diff --git a/go.mod b/go.mod index 2ea8872..a27752f 100644 --- a/go.mod +++ b/go.mod @@ -1,3 +1,3 @@ module github.com/ghostsecurity/wraith -go 1.24.3 +go 1.25.6 diff --git a/pkg/scanner.go b/pkg/scanner.go index 74af08b..66df29e 100644 --- a/pkg/scanner.go +++ b/pkg/scanner.go @@ -29,18 +29,31 @@ type ScanOptions struct { type ScanOption func(*ScanOptions) // NewScanner creates a new scanner instance -// It will look for osv-scanner in PATH or use the provided binary path +// It will look for osv-scanner in the following order: +// 1. Provided binary path (if specified) +// 2. Same directory as the wraith executable (bundled) +// 3. System PATH func NewScanner(binaryPath ...string) (*Scanner, error) { var path string if len(binaryPath) > 0 && binaryPath[0] != "" { path = binaryPath[0] } else { - // Look for osv-scanner in PATH - var err error - path, err = exec.LookPath("osv-scanner") - if err != nil { - return nil, fmt.Errorf("osv-scanner not found in PATH: %w", err) + // First, try to find bundled osv-scanner next to the executable + if execPath, err := os.Executable(); err == nil { + bundledPath := filepath.Join(filepath.Dir(execPath), "osv-scanner") + if _, err := os.Stat(bundledPath); err == nil { + path = bundledPath + } + } + + // Fall back to PATH if bundled binary not found + if path == "" { + var err error + path, err = exec.LookPath("osv-scanner") + if err != nil { + return nil, fmt.Errorf("osv-scanner not found (install it or place it next to wraith): %w", err) + } } } diff --git a/scripts/download-osv-scanner.sh b/scripts/download-osv-scanner.sh new file mode 100755 index 0000000..585aaf8 --- /dev/null +++ b/scripts/download-osv-scanner.sh @@ -0,0 +1,46 @@ +#!/bin/bash +set -e + +OSV_VERSION="${OSV_VERSION:-v2.3.2}" +BUILD_DIR="build/osv-scanner" + +echo "Downloading osv-scanner ${OSV_VERSION}..." + +# Create platform-specific directories with simple binary names +mkdir -p "$BUILD_DIR/linux_amd64" +mkdir -p "$BUILD_DIR/linux_arm64" +mkdir -p "$BUILD_DIR/darwin_amd64" +mkdir -p "$BUILD_DIR/darwin_arm64" +mkdir -p "$BUILD_DIR/windows_amd64" + +# Linux amd64 +curl -L --fail --silent --show-error \ + "https://github.com/google/osv-scanner/releases/download/${OSV_VERSION}/osv-scanner_linux_amd64" \ + -o "$BUILD_DIR/linux_amd64/osv-scanner" +chmod +x "$BUILD_DIR/linux_amd64/osv-scanner" + +# Linux arm64 +curl -L --fail --silent --show-error \ + "https://github.com/google/osv-scanner/releases/download/${OSV_VERSION}/osv-scanner_linux_arm64" \ + -o "$BUILD_DIR/linux_arm64/osv-scanner" +chmod +x "$BUILD_DIR/linux_arm64/osv-scanner" + +# Darwin amd64 +curl -L --fail --silent --show-error \ + "https://github.com/google/osv-scanner/releases/download/${OSV_VERSION}/osv-scanner_darwin_amd64" \ + -o "$BUILD_DIR/darwin_amd64/osv-scanner" +chmod +x "$BUILD_DIR/darwin_amd64/osv-scanner" + +# Darwin arm64 +curl -L --fail --silent --show-error \ + "https://github.com/google/osv-scanner/releases/download/${OSV_VERSION}/osv-scanner_darwin_arm64" \ + -o "$BUILD_DIR/darwin_arm64/osv-scanner" +chmod +x "$BUILD_DIR/darwin_arm64/osv-scanner" + +# Windows amd64 +curl -L --fail --silent --show-error \ + "https://github.com/google/osv-scanner/releases/download/${OSV_VERSION}/osv-scanner_windows_amd64.exe" \ + -o "$BUILD_DIR/windows_amd64/osv-scanner.exe" + +echo "Downloaded osv-scanner ${OSV_VERSION} for all platforms" +find "$BUILD_DIR" -type f