Is it possible to scan lock files with pseudo type server

[huikang]

I'd like to scan the non-os package on a local host with

type = "pseudo"
findLock = false # auto detect lockfile
lockfiles = [
  "/src/project/Pipfile.lock"
]

However, it seems not working. Is this feature currently supported by vuls? Thanks.

[kotakanbe]

Hi, @huikang

That feature is supported.
If you post your lock file, I'll try to reproduce it.

[huikang]

This is config.toml and command I used to scan the local pipfile

[servers]
[servers.piphost]
type = "pseudo"
findLock = false # auto detect lockfile
lockfiles = [
  "/Users/huikang/research/projects/src/github.ibm.com/kangh/oss/data/Pipfile.lock"
]

 vuls scan --log-dir=vuls-log/  -config=./config.toml piphost

The output is

[Aug 19 09:09:42] ERROR [localhost] Error on piphost, err: [Failed to scan Library:
    github.com/future-architect/vuls/scan.GetScanResults.func1
        /Users/huikang/research/projects/src/github.com/kotakanbe/vuls/scan/serverapi.go:635
  - Failed to get target file: execResult: servername: piphost
      cmd: /usr/bin/ssh -tt -o StrictHostKeyChecking=yes -o LogLevel=quiet -o ConnectionAttempts=3 -o ConnectTimeout=10 -o ControlMaster=auto -o ControlPath=/Users/huikang/.vuls/controlmaster-%r-piphost.%p -o Controlpersist=10m @ -p  stty cols 1000; cat /Users/huikang/research/projects/src/github.ibm.com/kangh/oss/data/Pipfile.lock
      exitstatus: 255
      stdout: 
      stderr: usage: ssh [-46AaCfGgKkMNnqsTtVvXxYy] [-B bind_interface]
               [-b bind_address] [-c cipher_spec] [-D [bind_address:]port]
               [-E log_file] [-e escape_char] [-F configfile] [-I pkcs11]
               [-i identity_file] [-J [user@]host[:port]] [-L address]
               [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port]
               [-Q query_option] [-R address] [-S ctl_path] [-W host:port]
               [-w local_tun[:remote_tun]] destination [command]
    
      err: %!s(<nil>), filepath: /Users/huikang/research/projects/src/github.ibm.com/kangh/oss/data/Pipfile.lock:
    github.com/future-architect/vuls/scan.(*base).scanLibraries
        /Users/huikang/research/projects/src/github.com/kotakanbe/vuls/scan/base.go:568]

So it looks like vuls still tries to ssh to the pseudo host.

• The pipfile is attached.

Thanks.
Pipfile.lock.zip

[huikang]

Hi, @kotakanbe , just want to check if you have a chance to take a look at my question. Thanks.

[kotakanbe]

@huikang

Sorry, I tried and reproduced it.
Now that it's implemented try with the latest version! #1050