Visitar URL original
Support GHC tools advisory matching by dancewithheart · Pull Request #70 · MangoIV/cabal-audit · GitHub
Skip to content

Support GHC tools advisory matching - #70

Merged
MangoIV merged 11 commits into
MangoIV:mainfrom
dancewithheart:ghc-tool-advisories
Apr 21, 2026
Merged

Support GHC tools advisory matching#70
MangoIV merged 11 commits into
MangoIV:mainfrom
dancewithheart:ghc-tool-advisories

Conversation

@dancewithheart

@dancewithheart dancewithheart commented Apr 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Fixes #53.

Now cabal-audit matchs advisories in the GHC namespace.

Example:

cd test/assets/test-ghc-tools-issue-project/
cabal build --with-compiler=ghc-9.12.1
~/cabal-audit/result/bin/cabal-audit

outputs:

Found advisories:

dependency base at version 4.21.0.0 is vulnerable for:
  HSEC-2023-0007 "readFloat: memory exhaustion with large exponent"
  published: 2025-11-14 14:45:34 UTC
  https://haskell.github.io/security-advisories/advisory/HSEC-2023-0007
  No fix version available
  toml, parser, dos

dependency cryptonite at version 0.30 is vulnerable for:
  HSEC-2025-0002 "Double Public Key Signing Function Oracle Attack on Ed25519"
  published: 2025-11-14 14:45:34 UTC
  https://haskell.github.io/security-advisories/advisory/HSEC-2025-0002
  No fix version available
  crypto

GHC tool ghc at version 9.12.1 is vulnerable for:
  HSEC-2024-0008 "Sign extension error in the PPC64le FFI"
  published: 2025-11-14 14:45:34 UTC
  https://haskell.github.io/security-advisories/advisory/HSEC-2024-0008
  Fix available since version 9.6.6
  integrity, dos

  HSEC-2025-0001 "Subword division operations may produce incorrect results"
  published: 2025-11-14 14:45:34 UTC
  https://haskell.github.io/security-advisories/advisory/HSEC-2025-0001
  Fix available since version 9.12.2
  integrity, dos

@dancewithheart

dancewithheart commented Apr 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Draft as I am adding project in test assets to verify.

Unit tests are added around advisory matching/rendering - so partially address #19

Maybe adding property tests e.g. using QuickCheck would be useful.

@dancewithheart
dancewithheart marked this pull request as ready for review April 18, 2026 17:09
@dancewithheart dancewithheart changed the title Ghc tool advisories Support GHC tools advisory matching Apr 18, 2026
MangoIV
MangoIV requested changes Apr 19, 2026
View reviewed changes

@MangoIV MangoIV left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you for the contribution!

I think this is a useful change.

I will merge this if you do the requested adjustments :)

Comment thread src/Security/Advisories/Cabal.hs Resolved
Comment thread src/Security/Advisories/Cabal.hs Resolved
Comment thread src/Distribution/Audit.hs Resolved
Comment thread test/Spec.hs Resolved
Comment thread test/Spec.hs Resolved
Comment thread test/Spec.hs Resolved
Comment thread cabal.project Resolved
@dancewithheart
dancewithheart requested a review from MangoIV April 20, 2026 11:48
MangoIV
MangoIV reviewed Apr 20, 2026
View reviewed changes

@MangoIV MangoIV left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry for the second pass -- if you want, I can apply these changes myself, if you don't feel like doing another pass.

Comment thread src/Security/Advisories/Cabal.hs Resolved
Comment thread src/Security/Advisories/Cabal.hs Resolved
Comment thread src/Security/Advisories/Cabal.hs Resolved
dancewithheart and others added 2 commits April 20, 2026 14:11
@dancewithheart @MangoIV
Update src/Security/Advisories/Cabal.hs
2d0c804 
Co-authored-by: MangoIV <40720523+MangoIV@users.noreply.github.com>
@dancewithheart
review more bulletproof mkGhcToolLookup, reuse ghcComponentToText ins…
742cc1e 
…tead of renderGhcComponent
@dancewithheart

dancewithheart commented Apr 20, 2026

Copy link
Copy Markdown
Contributor Author

Sorry for the second pass -- if you want, I can apply these changes myself, if you don't feel like doing another pass.

No worries at all :) I appreciate the careful review.
This touches security-related behavior, I’m happy to iterate until the code looks right.

@dancewithheart dancewithheart mentioned this pull request Apr 20, 2026
Merged
1 of 4 tasks
@dancewithheart
dancewithheart requested a review from MangoIV April 20, 2026 14:12
MangoIV
MangoIV approved these changes Apr 21, 2026
View reviewed changes

@MangoIV MangoIV left a comment

Copy link
Copy Markdown
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks a lot for your contribution!

@MangoIV
MangoIV merged commit 87d5f16 into MangoIV:main Apr 21, 2026
21 of 22 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@MangoIV MangoIV MangoIV approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

also reflect security advisories for GHC tools

2 participants

@dancewithheart @MangoIV