russell@unturf.com
1f48d1b89c
Self-contained C scanner that reads UNDF-REGISTRY.json, parses patch .md files to extract file paths and code patterns, walks a target directory tree, and classifies each registered defect as PATCHED/UNPATCHED/UNKNOWN/ NOT_FOUND. Thread pool via pthreads. Bundled MD5+SHA256, no external deps.
41 lines
1,018 B
YAML
41 lines
1,018 B
YAML
stages:
|
|
- build
|
|
- scan
|
|
|
|
build-scanner:
|
|
stage: build
|
|
script:
|
|
- make -C scanner
|
|
artifacts:
|
|
paths:
|
|
- scanner/undfscand
|
|
expire_in: 1 hour
|
|
|
|
undf-scan:
|
|
stage: scan
|
|
needs: [build-scanner]
|
|
script:
|
|
- ./scanner/undfscand
|
|
--registry UNDF-REGISTRY.json
|
|
--defects defects/
|
|
--target ${CI_PROJECT_DIR}
|
|
--threads 4
|
|
--format json
|
|
--output scan-report.json
|
|
- |
|
|
python3 -c "
|
|
import json, sys
|
|
r = json.load(open('scan-report.json'))
|
|
s = r['summary']
|
|
print(f'UNDF Scan: {s[\"total\"]} checked | {s[\"patched\"]} patched | {s[\"unpatched\"]} UNPATCHED | {s[\"not_found\"]} not_found')
|
|
unpatched = [f for f in r['findings'] if f['status'] == 'UNPATCHED']
|
|
for f in unpatched:
|
|
print(f' !! {f[\"undf\"]} {f[\"defect_id\"]}: {f[\"evidence\"]}')
|
|
sys.exit(1 if unpatched else 0)
|
|
"
|
|
artifacts:
|
|
when: always
|
|
paths:
|
|
- scan-report.json
|
|
expire_in: 30 days
|
|
allow_failure: true
|