hsec-core 0.1.0.0 → 0.2.0.2

raw patch · 4 files changed

+82/−29 lines, 4 filesdep ~Cabal-syntaxdep ~basedep ~cvssnew-uploaderPVP ok

version bump matches the API change (PVP)

Dependency ranges changed: Cabal-syntax, base, cvss, osv, safe, tasty, time

API changes (from Hackage documentation)

Files

• CHANGELOG.md +5/−0
• README.md +15/−0
• hsec-core.cabal +11/−16
• src/Security/Advisories/Core/Advisory.hs +51/−13

@@ -0,0 +1,5 @@+## 0.2.0.2++* Update `osv` dependency bounds+* Update `tasty` dependency bounds+

@@ -0,0 +1,15 @@+# hsec-core++`hesc-core` aims to support [Haskell advisories database](https://github.com/haskell/security-advisories).++## Building++We aim to support both regular cabal-based and nix-based builds.++## Testing++Run (and auto update) the golden test:++```ShellSession+cabal test -O0 --test-show-details=direct --test-option=--accept+```

@@ -1,6 +1,6 @@ cabal-version:      2.4 name:               hsec-core-version:            0.1.0.0+version:            0.2.0.2  -- A short (one-line) description of the package. synopsis:           Core package representing Haskell advisories@@ -19,10 +19,10 @@ -- A copyright notice. -- copyright: category:           Data-extra-doc-files:    CHANGELOG.md+extra-doc-files:    CHANGELOG.md, README.md  tested-with:-  GHC ==8.10.7 || ==9.0.2 || ==9.2.8 || ==9.4.8 || ==9.6.3 || ==9.8.1+  GHC ==8.10.7 || ==9.0.2 || ==9.2.8 || ==9.4.8 || ==9.6.6 || ==9.8.3 || ==9.10.1 || ==9.12.1  library   exposed-modules:@@ -30,19 +30,14 @@     Security.Advisories.Core.HsecId    build-depends:-    , base          >=4.14    && <4.20-    , Cabal-syntax  >=3.8.1.0 && <3.11-    , cvss >= 0.1 && < 0.2-    , osv >= 0.1 && < 0.2+    , base          >=4.14    && <5+    , Cabal-syntax  >=3.8.1.0 && <3.15+    , cvss >= 0.2 && < 0.3+    , osv >= 0.1 && < 0.3     , pandoc-types  >=1.22    && <2-    , safe          >=0.3+    , safe          >=0.3     && <0.4     , text          >=1.2     && <3-    , time          >=1.9     && <1.14--  -- , commonmark            ^>=0.2.2-  -- , commonmark-pandoc     >=0.2     && <0.3-  -- , containers            >=0.6     && <0.7-  -- , mtl                   >=2.2     && <2.4+    , time          >=1.9     && <1.15   hs-source-dirs:   src   default-language: Haskell2010   ghc-options:@@ -54,10 +49,10 @@   hs-source-dirs:   test   main-is:          Spec.hs   build-depends:-    , base         <5+    , base     , cvss     , hsec-core-    , tasty        <1.5+    , tasty        <2     , tasty-hunit  <0.11     , text 

@@ -1,4 +1,4 @@-{-# LANGUAGE DerivingVia #-}+{-# LANGUAGE DerivingVia, OverloadedStrings #-}  module Security.Advisories.Core.Advisory   ( Advisory(..)@@ -10,24 +10,28 @@   , AffectedVersionRange(..)   , OS(..)   , Keyword(..)+  , ComponentIdentifier(..)+  , GHCComponent(..)+  , ghcComponentToText+  , ghcComponentFromText   )   where  import Data.Text (Text)-import Data.Time (ZonedTime)+import Data.Time (UTCTime) import Distribution.Types.Version (Version) import Distribution.Types.VersionRange (VersionRange)  import Text.Pandoc.Definition (Pandoc) -import Security.Advisories.Core.HsecId+import Security.Advisories.Core.HsecId (HsecId) import qualified Security.CVSS as CVSS import Security.OSV (Reference)  data Advisory = Advisory   { advisoryId :: HsecId-  , advisoryModified :: ZonedTime-  , advisoryPublished :: ZonedTime+  , advisoryModified :: UTCTime+  , advisoryPublished :: UTCTime   , advisoryCAPECs :: [CAPEC]   , advisoryCWEs :: [CWE]   , advisoryKeywords :: [Keyword]@@ -44,23 +48,57 @@   }   deriving stock (Show) +data ComponentIdentifier = Hackage Text | GHC GHCComponent+  deriving stock (Show, Eq)++-- Keep this list in sync with the 'ghcComponentFromText' below+data GHCComponent = GHCCompiler | GHCi | GHCRTS | GHCPkg | RunGHC | IServ | HP2PS | HPC | HSC2HS | Haddock+  deriving stock (Show, Eq, Enum, Bounded)++ghcComponentToText :: GHCComponent -> Text+ghcComponentToText c = case c of+  GHCCompiler -> "ghc"+  GHCi -> "ghci"+  GHCRTS -> "rts"+  GHCPkg -> "ghc-pkg"+  RunGHC -> "runghc"+  IServ -> "ghc-iserv"+  HP2PS -> "hp2ps"+  HPC -> "hpc"+  HSC2HS -> "hsc2hs"+  Haddock -> "haddock"++ghcComponentFromText :: Text -> Maybe GHCComponent+ghcComponentFromText c = case c of+  "ghc" -> Just GHCCompiler+  "ghci" -> Just GHCi+  "rts" -> Just GHCRTS+  "ghc-pkg" -> Just GHCPkg+  "runghc" -> Just RunGHC+  "ghc-iserv" -> Just IServ+  "hp2ps" -> Just HP2PS+  "hpc" -> Just HPC+  "hsc2hs" -> Just HSC2HS+  "haddock" -> Just Haddock+  _ -> Nothing+ -- | An affected package (or package component).  An 'Advisory' must -- mention one or more packages. data Affected = Affected-  { affectedPackage :: Text+  { affectedComponentIdentifier :: ComponentIdentifier   , affectedCVSS :: CVSS.CVSS   , affectedVersions :: [AffectedVersionRange]   , affectedArchitectures :: Maybe [Architecture]   , affectedOS :: Maybe [OS]   , affectedDeclarations :: [(Text, VersionRange)]   }-  deriving stock (Show)+  deriving stock (Eq, Show)  newtype CAPEC = CAPEC {unCAPEC :: Integer}-  deriving stock (Show)+  deriving stock (Eq, Show)  newtype CWE = CWE {unCWE :: Integer}-  deriving stock (Show)+  deriving stock (Eq, Show)  data Architecture   = AArch64@@ -88,7 +126,7 @@   | SPARC64   | VAX   | X86_64-  deriving stock (Show)+  deriving stock (Eq, Show, Enum, Bounded)  data OS   = Windows@@ -98,9 +136,9 @@   | Android   | NetBSD   | OpenBSD-  deriving stock (Show)+  deriving stock (Eq, Show, Enum, Bounded) -newtype Keyword = Keyword Text+newtype Keyword = Keyword {unKeyword :: Text}   deriving stock (Eq, Ord)   deriving (Show) via Text @@ -108,4 +146,4 @@   { affectedVersionRangeIntroduced :: Version,     affectedVersionRangeFixed :: Maybe Version   }-  deriving stock (Show)+  deriving stock (Eq, Show)