Commit 98850936 authored by David Spencer's avatar David Spencer

pkgsrc: Use libversion to compare versions.

parent bcc249d7
......@@ -11,6 +11,7 @@ import re
import fnmatch
import braceexpand # https://pypi.org/project/braceexpand/
import libversion # https://pypi.org/project/libversion/
#-----------------------------------------------------------------------
# Pathnames.
......@@ -104,25 +105,28 @@ def printvulns(vglob,vcondlist,vcategory,vurl):
* 'p.version' 'vcond.op' 'vcond.version', for all vcond in vcondlist
"""
# Explictly compare in lower-case, because we want to be case
# insensitive, but these aren't filenames and we don't want
# to be at the mercy Python being "clever" about the host OS.
reglob=re.compile(fnmatch.translate(vglob.lower()))
for p in plist:
# explictly compare in lower-case, because we want to be case
# insensitive, but these aren't filenames and we don't want
# to be at the mercy Python being "clever" about the host OS
matched = fnmatch.fnmatchcase(p.name.lower(),vglob.lower())
matched = reglob.fullmatch(p.name.lower()) is not None
if matched:
vulnerable=True
for vcond in vcondlist:
compare = libversion.version_compare(p.version,vcond.version)
if vcond.op == "<=":
matched = matched and p.version <= vcond.version
matched = matched and compare <= 0
elif vcond.op == ">=":
matched = matched and p.version >= vcond.version
matched = matched and compare >= 0
elif vcond.op == "<":
matched = matched and p.version < vcond.version
matched = matched and compare < 0
elif vcond.op == "=":
matched = matched and p.version == vcond.version
matched = matched and compare == 0
elif vcond.op == ">":
matched = matched and p.version > vcond.version
matched = matched and compare > 0
else:
# silently drop the condition
continue
......@@ -131,7 +135,8 @@ def printvulns(vglob,vcondlist,vcategory,vurl):
# we have a vulnerability!
print("{:s},{:s},{:s},{:s},{:s},{:s}".format(
p.name, p.version, p.patched, p.ignored,
vcategory, vurl))
vcategory, vurl),
file=report)
recnum=0
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment