# CVE Checks
## Background.

Here we generate reports for listing any used packages that are
subject to CVEs.  We do this for both Haskell and Python.

For background, approach, and useful boilerplate, refer to
  https://github.com/GaloisInc/hello-cve-scans.git

## Prerequisites

First, build the software of interest:
 - cryptol itself
 - cryptol-remote-api/python (a Python project), e.g.,
     ```
     cd cryptol-remote-api/python
     poetry install
     ```

Ensure you have the following installed (beyond what's required by cryptol):
  * wget
  * jq      (json query, command line tool used to finagle json files)

## Quick Start

Run this script to build & install software needed to do the checks:
```
cve-reports/bin/cvecheck-build.sh
```

Run this script to run both checks, writing freeform text to stdout:
```
cve-reports/bin/cvecheck-all.sh
```

Run this to generate both *JSON* reports (each with their own json structure):
```
cve-reports/bin/cvecheck-all.sh  --write-json
```

Individual reports can be run also:
```
cve-reports/bin/cvecheck-hs.sh               # generate the Haskell CVE report
cve-reports/bin/cvecheck-py.sh               # generate the Python CVE report
```
As well as the json output for each language:
```
cve-reports/bin/cvecheck-hs.sh --write-json
cve-reports/bin/cvecheck-py.sh --write-json
```

A concise rollup of the three JSON reports can be created with:
```
cve-reports/bin/cvecheck-consolidated.sh
```
which prints a sequence of normalized JSON values to the standard
output for the known CVEs.  The form of each CVE is like this example:
```
{
  "language": "Haskell",
  "id": "HSEC-2023-0007",
  "title": "readFloat: memory exhaustion with large exponent",
  "package": {
    "name": "base",
    "version": "4.17.2.1"
  }
}
```
Note that `cvecheck-consolidated.sh` does not generate the respective
JSON reports, the user must do that with the above shell scripts.

## What we check

We check both these projects
  * the top level Haskell project as captured in saw-script.cabal.
  * the Python project in `cryptol-remote-api/python/`.

We ignore the projects (packages, etc.) in `dep/`, if any are used in
the above projects, the dependencies should be reflected in the
builds of the above.

NOTE: if further projects get added to the repo, they need to be added
to the scripts.

## Caveats

For further background refer to
  https://github.com/GaloisInc/hello-cve-scans.git
but in a nutshell
  - we may report false positives, as using a package does not imply
    exercising the code in a package (or environment) that exhibits the
    vulnerability.

## Further details on the CVE checks for our three languages:
### Haskell: `bin/cvecheck-hs.sh`

We use the `MangoIV/cabal-audit` package
  https://github.com/MangoIV/cabal-audit.git
which is not to be confused with the `cabal-audit` in hackage.
The latter is hopelessly out of date, while the former

  - is beta quality, but is being maintained
  - calls the cabal libraries and thus (for better or worse), inherits
    the cabal settings and environment.
  - uses the advisories in
    https://github.com/haskell/security-advisories.git
    (this repo contains the database as well as some customized Haskell packages.)

Note that the advisory database is checked and downloaded each time
that `cabal-audit` is called.

### Python: `bin/cvecheck-py.sh`

We use the `python-audit` package.
Since are using `poetry`, we need to first "extract" a
requirements.txt using `poetry export`.