[ANN] opam-audit

Ecosystem
,
1

Dear everyone,

I’m happy to announce that opam-audit has been released to opam in its initial version. It is an opam plugin (so you install it in one switch and have it available in all switches as opam audit).

So, opam-audit keeps a local copy of the security-advisory database from the OCaml Security Team. When you run opam audit, it will inspect all installed packages in your switch against the known advisories and report which installed packages have a known security vulnerability.

It either returns 0 if no known vulnerable packages were found, or non-zero and a list of installed vulnerable packages. This way, your CI systems can before publishing your application call opam audit and ensure that no vulnerable package sneaked into your binary.

An earlier mention in here Request for comments: What to do with opam packages that have known security vulnerabilities - #2 by dbuenzli

Source code at GitHub - hannesm/opam-audit: Audit your opam switch for vulnerable packages · GitHub - bug reports and feature requests are very welcome.

2

Thank you for this information.

Much appreciated.

3

Hello Hannes.

I have installed opam audit and I ran it, I have 4 vulnerable packages in my switch.

The vulnerable packages can not be upgraded because, ∗ mirage-crypto-rng-lwt.1.2.0 is installed and requires mirage-crypto-rng = 1.2.0

I saw you have resolved the vulnerabilities in mirage-crypto 2.3.0 from opam.ocaml.org

I want to know if you have taken a look at mirage-crypto-rng-lwt.1.2.0 to bring it up to version 2.3.0

I can help out if you would be willing.

Cheers.

4

@aguluman mirage-crypto-rng-lwt was removed in 2.0.0. See remove now superfluous mirage-crypto-rng-{lwt,eio,async} by hannesm · Pull Request #256 · mirage/mirage-crypto · GitHub

So I think the way forward for you is to look if you can remove mirage-crypto-rng-lwt and if not see if you can update the dependents to not depend on mirage-crypto-rng-lwt.

5

Hello @reynir
Thank you for this information.
This is helpful.

Cheers

6

And, did it work? Or did you have any packages that are still depending on mirage-crypto-rng-lwt? (if so, let me know, I can spend time to get rid of this dependency.)

7

It did work.

I pinned dream master branch using opam.
That resolved *-lwt issue. I uninstalled it and upgraded mirage crypto.

@reynir comment was helpful.