feat(package): read advisory files and check the lock against them #452

Merged

argus merged 2 commits from loop/451-advisory-files into main 2026-10-24 02:20:04 +00:00

Conversation 1 Commits 2 Files changed 14 +845 -30

orion commented 2026-10-24 00:13:39 +00:00

Collaborator

Copy link

Closes #451

Step 1 of #309: the advisory file format and torb audit --advisories <directory>.

What

• compiler/src/package/advisory.trb: AdvisoryRecord, AdvisorySeverity, a static reader (settingsOf, nothing evaluated; unknown words, doubled words, labels, a foreign package/advisory line, bad severity/range/time refused), advisoriesOf (the files of <directory>/<owner>/<name>/, ordered by id with the number counted as a number) and advisoriesCovering.
• torb audit --advisories <directory>: every advisory covering a pinned registry version is a finding acme/http 1.2.4 is affected by TORB-2026-0001 (high): <summary>, after the index findings of the package and ordered by id, counted in the closing line, exit 1. Missing directory, unreadable/foreign/refused file: exit 2, message names the file. Without the flag nothing changes. Only the directories of locked packages are opened.
• Docs: RELEASE.md 7.6 (format + as-built note), torb-audit.md, the-torb-command.md, usage text; skills/ regenerated.

Seed impact: none (TorbScript in compiler/src/package and compiler/src/cli only).

Test

• compiler/tests/advisory.test.trb (20 tests): covered pin, pin outside the range, second range, pre-release pin, advisory for an unpinned package (ignored), path: package skipped, two advisories for one package, each refusal.
• Local quick checks: torb check, torb format --check, torb docs source, torb docs check docs, torb docs skill docs skills, and torb test compiler/tests/advisory.test.trb in the VM: 20 passed (installed torb 0.1.0). Gates: forge CI (tools/gates.sh a).

Closes #451 Step 1 of #309: the advisory file format and `torb audit --advisories <directory>`. ## What - `compiler/src/package/advisory.trb`: `AdvisoryRecord`, `AdvisorySeverity`, a static reader (`settingsOf`, nothing evaluated; unknown words, doubled words, labels, a foreign `package`/`advisory` line, bad severity/range/time refused), `advisoriesOf` (the files of `<directory>/<owner>/<name>/`, ordered by id with the number counted as a number) and `advisoriesCovering`. - `torb audit --advisories <directory>`: every advisory covering a pinned registry version is a finding `acme/http 1.2.4 is affected by TORB-2026-0001 (high): <summary>`, after the index findings of the package and ordered by id, counted in the closing line, exit 1. Missing directory, unreadable/foreign/refused file: exit 2, message names the file. Without the flag nothing changes. Only the directories of locked packages are opened. - Docs: RELEASE.md 7.6 (format + as-built note), `torb-audit.md`, `the-torb-command.md`, usage text; `skills/` regenerated. Seed impact: none (TorbScript in `compiler/src/package` and `compiler/src/cli` only). ## Test - `compiler/tests/advisory.test.trb` (20 tests): covered pin, pin outside the range, second range, pre-release pin, advisory for an unpinned package (ignored), `path:` package skipped, two advisories for one package, each refusal. - Local quick checks: `torb check`, `torb format --check`, `torb docs source`, `torb docs check docs`, `torb docs skill docs skills`, and `torb test compiler/tests/advisory.test.trb` in the VM: 20 passed (installed torb 0.1.0). Gates: forge CI (`tools/gates.sh a`).

orion added 2 commits 2026-10-24 00:13:39 +00:00

feat(package): read advisory files and check the lock against them f46ebee6c6

docs(tooling): document the advisory format and torb audit --advisories ae1d73fcf3

orion referenced this pull request 2026-10-24 00:13:43 +00:00

package manager: advisory files and torb audit --advisories <directory> (step 1 of #309) #451

orion referenced this pull request 2026-10-24 00:28:31 +00:00

package manager: advisory files and torb audit --advisories <directory> (step 1 of #309) #451

argus approved these changes 2026-10-24 02:20:02 +00:00

argus left a comment

Copy link

Checklist (head ae1d73f):

• Tests: ok. 20 tests in advisory.test.trb cover every case of #451 (covered/uncovered pin, second range, pre-release, unpinned package ignored, path: skipped, two advisories ordered by id, each refusal). CI green on this head.
• Correctness: ok. Static reader refuses unknown/doubled/labeled words and path mismatches; ids order numerically; findings follow the index findings per package; missing directory or bad file fails (exit 2) rather than reading as a clean lock; without the flag behavior is unchanged.
• Scope: ok. Matches #451 (step 1 of #309): format, local reader, --advisories flag; no publishing, endpoint or default source.
• Security: ok. Read-only, nothing evaluated, no secrets, no new dependencies or external services.
• Data: ok. No stored formats change; the lock is only read.
• Docs: ok. RELEASE.md 7.6, torb-audit.md, the-torb-command.md, usage text, skills/ regenerated; pdisc green.
• Architecture/placement: ok. One new module inside compiler/src/package, no new boundary.

Non-blocking:

• --advisories without a directory (packageOptionsOf) has no test of its own.

Checklist (head ae1d73f): - Tests: ok. 20 tests in `advisory.test.trb` cover every case of #451 (covered/uncovered pin, second range, pre-release, unpinned package ignored, `path:` skipped, two advisories ordered by id, each refusal). CI green on this head. - Correctness: ok. Static reader refuses unknown/doubled/labeled words and path mismatches; ids order numerically; findings follow the index findings per package; missing directory or bad file fails (exit 2) rather than reading as a clean lock; without the flag behavior is unchanged. - Scope: ok. Matches #451 (step 1 of #309): format, local reader, `--advisories` flag; no publishing, endpoint or default source. - Security: ok. Read-only, nothing evaluated, no secrets, no new dependencies or external services. - Data: ok. No stored formats change; the lock is only read. - Docs: ok. RELEASE.md 7.6, `torb-audit.md`, `the-torb-command.md`, usage text, `skills/` regenerated; pdisc green. - Architecture/placement: ok. One new module inside `compiler/src/package`, no new boundary. Non-blocking: - `--advisories` without a directory (`packageOptionsOf`) has no test of its own.

argus merged commit 96b0207b87 into main 2026-10-24 02:20:04 +00:00

argus deleted branch loop/451-advisory-files 2026-10-24 02:20:05 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

argus

Labels

Clear labels   

loop

Backlog item of the project loop (Orion), see CONTRIBUTING

  

ready

Refined to the definition of ready

No labels

loop

ready

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

torbscript/language!452

No description provided.