about summary refs log tree commit diff
path: root/tools
diff options
context:
space:
mode:
Diffstat (limited to 'tools')
-rw-r--r--tools/rust-crates-advisory/default.nix50
1 files changed, 14 insertions, 36 deletions
diff --git a/tools/rust-crates-advisory/default.nix b/tools/rust-crates-advisory/default.nix
index b3e8c850eb4b..d33e78c44250 100644
--- a/tools/rust-crates-advisory/default.nix
+++ b/tools/rust-crates-advisory/default.nix
@@ -4,7 +4,6 @@ let
 
   bins =
     depot.nix.getBins pkgs.s6-portable-utils [ "s6-ln" "s6-cat" "s6-echo" "s6-mkdir" "s6-test" "s6-touch" "s6-dirname" ]
-    // depot.nix.getBins pkgs.coreutils [ "printf" ]
     // depot.nix.getBins pkgs.lr [ "lr" ]
     // depot.nix.getBins pkgs.cargo-audit [ "cargo-audit" ]
     // depot.nix.getBins pkgs.jq [ "jq" ]
@@ -106,41 +105,20 @@ let
     exit "''${PIPESTATUS[0]}" # inherit exit code from cargo-audit
   '';
 
-  tree-lock-file-report = depot.nix.writeExecline "tree-lock-file-report"
-    {
-      readNArgs = 1;
-    } [
-    "backtick"
-    "-E"
-    "report"
-    [
-      "pipeline"
-      [ bins.find "$1" "-name" "Cargo.lock" "-and" "-type" "f" "-print0" ]
-      "forstdin"
-      "-E"
-      "-0"
-      "lockFile"
-      "backtick"
-      "-E"
-      "depotPath"
-      [
-        "pipeline"
-        [ bins.s6-dirname "$lockFile" ]
-        bins.sed
-        "s|^\\.|/|"
-      ]
-      lock-file-report
-      "$depotPath"
-      "$lockFile"
-      "false"
-    ]
-    "if"
-    [ bins.printf "%s\n" "$report" ]
-    # empty report implies success (no advisories)
-    bins.s6-test
-    "-z"
-    "$report"
-  ];
+  tree-lock-file-report = pkgs.writers.writeBash "tree-lock-file-report" ''
+    set -euo pipefail
+    status=0
+
+    root="''${1:-.}"
+
+    # Find prints the found lockfiles as <DEPOT ROOT>\t<LOCKFILE DIR>\t<LOCKFILE PATH>\0
+    while IFS=$'\t' read -r -d $'\0' entryPoint dir lockFile; do
+      label="$(printf '%s' "$dir" | "${bins.sed}" "s|^$entryPoint|/|")"
+      "${lock-file-report}" "$label" "$lockFile" || status=1
+    done < <("${bins.find}" "$root" -type f -name Cargo.lock -printf '%H\t%h\t%p\0' )
+
+    exit $status
+  '';
 
   check-all-our-lock-files = depot.nix.writeExecline "check-all-our-lock-files" { } [
     "backtick"