refactor(rust-crates-advisory): redo tree-lock-file-report in bash r/5246

I think migrating the execline scripts over to bash makes sense:

1. Ever since nixpkgs-fmt, execline scripts in depot have become a huge
   pain to write and edit and I can't think of a satisfying solution to
   this problem.

2. The scripts here require remembering things across loop cycles (i. e.
   the status variable) which is not possible in pure execline. As a a
   workaround we used to read the entire report into memory first and
   check if it was empty (tying us to the argv limit for the report
   length).

Change-Id: I954b08b982ef947f9014a685676d2b83a2aec4d2
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5259
Reviewed-by: tazjin <tazjin@tvl.su>
Tested-by: BuildkiteCI

1 files changed, 14 insertions, 36 deletions

diff --git a/tools/rust-crates-advisory/default.nix b/tools/rust-crates-advisory/default.nix
index b3e8c850eb..d33e78c442 100644
--- a/tools/rust-crates-advisory/default.nix
+++ b/tools/rust-crates-advisory/default.nix
@@ -4,7 +4,6 @@ let
 
   bins =
     depot.nix.getBins pkgs.s6-portable-utils [ "s6-ln" "s6-cat" "s6-echo" "s6-mkdir" "s6-test" "s6-touch" "s6-dirname" ]
-    // depot.nix.getBins pkgs.coreutils [ "printf" ]
     // depot.nix.getBins pkgs.lr [ "lr" ]
     // depot.nix.getBins pkgs.cargo-audit [ "cargo-audit" ]
     // depot.nix.getBins pkgs.jq [ "jq" ]
@@ -106,41 +105,20 @@ let
     exit "''${PIPESTATUS[0]}" # inherit exit code from cargo-audit
   '';
 
-  tree-lock-file-report = depot.nix.writeExecline "tree-lock-file-report"
-    {
-      readNArgs = 1;
-    } [
-    "backtick"
-    "-E"
-    "report"
-    [
-      "pipeline"
-      [ bins.find "$1" "-name" "Cargo.lock" "-and" "-type" "f" "-print0" ]
-      "forstdin"
-      "-E"
-      "-0"
-      "lockFile"
-      "backtick"
-      "-E"
-      "depotPath"
-      [
-        "pipeline"
-        [ bins.s6-dirname "$lockFile" ]
-        bins.sed
-        "s|^\\.|/|"
-      ]
-      lock-file-report
-      "$depotPath"
-      "$lockFile"
-      "false"
-    ]
-    "if"
-    [ bins.printf "%s\n" "$report" ]
-    # empty report implies success (no advisories)
-    bins.s6-test
-    "-z"
-    "$report"
-  ];
+  tree-lock-file-report = pkgs.writers.writeBash "tree-lock-file-report" ''
+    set -euo pipefail
+    status=0
+
+    root="''${1:-.}"
+
+    # Find prints the found lockfiles as <DEPOT ROOT>\t<LOCKFILE DIR>\t<LOCKFILE PATH>\0
+    while IFS=$'\t' read -r -d $'\0' entryPoint dir lockFile; do
+      label="$(printf '%s' "$dir" | "${bins.sed}" "s|^$entryPoint|/|")"
+      "${lock-file-report}" "$label" "$lockFile" || status=1
+    done < <("${bins.find}" "$root" -type f -name Cargo.lock -printf '%H\t%h\t%p\0' )
+
+    exit $status
+  '';
 
   check-all-our-lock-files = depot.nix.writeExecline "check-all-our-lock-files" { } [
     "backtick"