archrisks.sh

#!/usr/bin/env bash
#
#    archrisks - Get security risk severity & count of installed packages on Arch Linux
#    Copyright (C) 2021,2024  Pekka Helenius
#
#    This program is free software: you can redistribute it and/or modify
#    it under the terms of the GNU General Public License as published by
#    the Free Software Foundation, either version 3 of the License, or
#    (at your option) any later version.
#
#    This program is distributed in the hope that it will be useful,
#    but WITHOUT ANY WARRANTY; without even the implied warranty of
#    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
#    GNU General Public License for more details.
#
#    You should have received a copy of the GNU General Public License
#    along with this program.  If not, see <https://www.gnu.org/licenses/>.

#####################################

red=$'\33[91m'
orange=$'\033[38;5;208m'
yellow=$'\033[93m'
green=$'\033[92m'
reset=$'\033[0m'

typeset -A ARCH_MANAGERS

# List of known Arch Linux package managers + priority number for each
# Add more if you wish.
# Syntax guidelines:
# [<package manager priority (greater is more prioritized)>,<package manager>]="
# <parameter to refresh local pkg repositories>|
# <parameter to get detailed local pkg info>|
# <parameter to get name and version string of a pkg>|
# <parameter to get detailed remote pkg info>|
# <root=requires root, no_root=does not require root>
# "
ARCH_MANAGERS=(
    [0,/usr/bin/pacman]="-Syy|-Qi|-Q|-Si|root"
    [1,/usr/bin/pacaur]="-Syy|-Qi|-Q|-Si|no_root"
#    [2,yaourt]="-Syy|-Qi|-Q|-Si|no_root"
#    [3,pikaur]="-Syy|-Qi|-Q|-Si|no_root"
#    [4,pacget]="-Syy|-Qi|-Q|-Si|no_root"
#    [5,yay]="-Syy|-Qi|-Q|-Si|no_root"
#    [6,foxaur]="-Syy|-Qi|-Q|-Si|no_root"
#    [7,aurum]="-Syy|-Qi|-Q|-Si|no_root"
#    [8,goaur]="-Syy|-Qi|-Q|-Si|no_root"
#    [9,aurs]="-Syy|-Qi|-Q|-Si|no_root"
#    [10,magico]="-Syy|-Qi|-Q|-Si|no_root"
#    [11,maur]="-Syy|-Qi|-Q|-Si|no_root"
#    [12,pkgbuilder]="-Syy|-Qi|-Q|-Si|no_root"
#    [13,spinach]="-Syy|-Qi|-Q|-Si|no_root"
#    [14,trizen]="-Syy|-Qi|-Q|-Si|no_root"
)
SELECTED_MANAGER=
MANAGER_PRIORITY_LOWLIMIT=-1

SORT_ORDER="level"
SORT_REVERSE=0

NETWORK_HOST_ENDPOINT="security.archlinux.org"

input_count=${#@}
[[ "${input_count}" -eq 1 ]] && input_1="${1}"
[[ "${input_count}" -eq 2 ]] && input_1="${1}"; input_2="${2}"

usage() {
  echo -e "
Usage: $0
  -h|--help
  1st arg: --sort=<name,issues,level,status,desc> (optional)
  2nd arg: --reverse (optional)
"
  exit 0
}

input_parser() {

  if \
  [[ "${input_count}" -gt 2 ]] || \
  [[ "${input_1}" == "-h" ]] || \
  [[ "${input_1}" == "--help" ]]
  then
    usage

  elif [[ "${input_count}" -ne 0 ]]
  then
    SORT_ORDER=$(echo "${input_1}" | sed -r 's/^\-\-sort=(.*)/\1/')

    case "${SORT_ORDER}" in
      name|issues|level|version|desc)
        echo "Custom sort order selected: ${SORT_ORDER}"
        ;;
      *)
        echo "Unknown sorting order selected (${SORT_ORDER})."
        usage
    esac

    if [[ "${input_count}" -eq 2 ]]
    then
      case "${input_2}" in
        "--reverse")
          echo "Reverse ordering"
          SORT_REVERSE=1
          ;;
        *)
          echo "Unknown option '${input_2}'"
          SORT_REVERSE=0
      esac
    fi
  fi
}

connection_test() {

  local host_endpoint

  host_endpoint="${1}"

  if [[ $(ping -c 1 "${host_endpoint}" 2>&1 | grep -c "Name or service not known") -ne 0 ]]
  then
    echo -e "\nCan't connect to $host_endpoint. Please check your internet connection and try again.\n"
    exit 0
  fi

}

function find_my_package_manager() {

  local i
  local managers_list
  local managers_priority_list
  local manager_priority
  local manager

  i=0
  managers_list=()
  managers_priority_list=()

  for manager_str in ${!ARCH_MANAGERS[@]}; do

    OLDIFS=${IFS}
    IFS=","
    manager_array=(${manager_str})
    IFS=${OLDIFS}

    manager_priority="${manager_array[0]}"
    manager="${manager_array[1]}"

    if [[ "${manager_priority}" -lt "${MANAGER_PRIORITY_LOWLIMIT}" ]]
    then
      echo "Minimum priority is $((${MANAGER_PRIORITY_LOWLIMIT} + 1)). You have a package which has lower priority value. Exiting."
      exit 1
    fi

    if [[ $(type -P ${manager}) ]]
    then
      managers_list[$i]="${manager}"
      managers_priority_list[$i]=${manager_priority}
      let i++
    fi
  done

  if [[ ${#managers_list[@]} -eq 0 ]]
  then
    echo "Not any valid package manager found. Exiting."
    exit 1
  fi

  if [[ $(echo ${managers_priority_list[@]} | tr ' ' '\n' | uniq -d | wc -l) -ne 0 ]]
  then
    echo "Package managers with same priority found. Check internal manager list for duplicates. Exiting."
    exit 1
  fi

  # Select package manager by priority. Highest is selected.
  i=0
  while [[ "${i}" -le $((${#managers_list[@]} - 1)) ]]
  do
    if [[ ${managers_priority_list[i]} -gt ${priority_lowlimit} ]]
    then
      priority_lowlimit=${managers_priority_list[i]}
      SELECTED_MANAGER=${managers_list[i]}
    fi
    let i++
  done

  OLDIFS=${IFS}
  IFS="|"
  pkg_command=(${ARCH_MANAGERS["$priority_lowlimit,$SELECTED_MANAGER"]})
  IFS=${OLDIFS}

  command_refresh="${pkg_command[0]}"
  command_pkginfo_local="${pkg_command[1]}"
  command_pkginfo_local_short="${pkg_command[2]}"
  command_pkginfo_remote="${pkg_command[3]}"
  command_require_root="${pkg_command[4]}"

  if [[ "${command_require_root}" == "root" ]]
  then
    if [[ ! $(id -u) -eq 0 ]]
    then
      echo -e "\nThis command requires root privileges.\n"
      exit 0
    fi
  fi
}

# TODO: We can't really depend on parsing output strings since they vary between Arch package managers
package_version_parsed() {
  echo "${1}" | awk -F ' ' '{print $2}' | sed -r 's/[a-z]+.*//; s/[:_+-]/\./g; s/[^0-9]$//;'
}

package_version_check() {

  local system_version
  local repo_version
  local version_array_1
  local version_array_2
  local first_version_numbers
  local last_version_numbers
  local comparables
  local version_status_msg
  local check1
  local check2
  local s

  # Expected output syntax: "^<string> <version number>$"
  # TODO: We can't really depend on parsing output strings since they vary between Arch package managers
  system_version=$(${SELECTED_MANAGER} ${command_pkginfo_local_short} "${1}")
  repo_version=$(${SELECTED_MANAGER} ${command_pkginfo_remote} $1 | grep -E "^Version\s*:" | sed -r 's/.*(:\s*.*$)/\1/')

  version_array_1=$(package_version_parsed "${system_version}")
  version_array_2=$(package_version_parsed "${repo_version}")

  #Count of version elements (0 18 2 1 contains 4 numbers, for example)
  first_version_numbers=$(echo "${version_array_1}" | awk -F '.' '{print split($0, a)}')
  last_version_numbers=$(echo "${version_array_2}" | awk -F '.' '{print split($0, a)}')

  # Count of comparable version elements (maximum)
  # We compare this much of elements, not more
  if [[ "${last_version_numbers}" -lt "${first_version_numbers}" ]]
  then
    comparables="${last_version_numbers}"
  else
    comparables="${first_version_numbers}"
  fi

  # If all numbers are same, we don't analyze them more deeply.
  if [[ "${version_array_1}" == "${version_array_2}" ]]
  then
    version_status_msg="${green}Package is updated"
  else

    s=1
    while [ ${s} -le ${comparables} ]
    do
      check1=$(echo -e "${version_array_1}" | awk -v var=$s -F '.' '{print $var}')
      check2=$(echo -e "${version_array_2}" | awk -v var=$s -F '.' '{print $var}')

      if [[ ${check2} -gt ${check1} ]]
      then
        # Repo number is greater
        version_status_msg="${yellow}Update available"
        break

      elif [[ ${check2} -lt ${check1} ]]
      then
        # System number is greater
        version_status_msg="${reset}Newer package installed"
        break
      fi

      let s++
    done
  fi
  if [[ -z "${version_status_msg}" ]]
  then
    version_status_msg="${reset}Unknown"
  fi

  echo "${version_status_msg}"
}

exec_tool() {

  local i
  local package_count
  local risks_parsed_count
  local risks
  local description_column_max_chars

  local r_package_name
  local r_package_security_issues_count
  local r_package_security_issues_level
  local r_package_security_issues_level
  local r_package_description

  local risk_entries

  local sort_params
  local sort_column

  local package_alert_importance_status
  local package_alert_msg_color
  local package_alert_importance_output_status

  local package_security_issues_count
  local security_issues_package_summary
  local security_issues_total_count

  local security_msg_color

  i=1
  description_column_max_chars=35
  sort_params=()

  input_parser
  connection_test "${NETWORK_HOST_ENDPOINT}"
  find_my_package_manager

  echo "Security report date: $(date '+%d-%m-%Y, %X') (TZ: $(timedatectl status | grep "Time zone:" | awk '{print $3}'))"
  echo -e "\nSynchronizing package databases with ${SELECTED_MANAGER}\n"

  ${SELECTED_MANAGER} ${command_refresh} || exit

  if [[ ! $(type -P arch-audit) ]]
  then
    echo -e "\nCouldn't find Arch Linux security utility (arch-audit) in \$PATH. Please make sure it's installed.\n"
  else

    packages=
    package_count=0
    risks_parsed_count=0
    IFS=$'\n'
    for au in $(arch-audit); do
      package_name=$(echo "${au}" | awk -F ' ' '{print $1}')
      risk_level=$(echo "${au}" | grep -oE "Low|Medium|High|Critical")
      risks_count=$(echo "${au}" | grep -oP "(?<=by ).+(?=\. )" | sed 's/, /\n/g' | wc -l)
      risks[$package_count]="$package_name;$risk_level;$risks_count"
      packages="${packages}, ${package_name}"
      let package_count++
    done

    echo -e "Analyzing ${#risks[*]} vulnerable packages. This takes a while...\n"

    echo -e "Vulnerable packages are:\n\n$(echo ${packages} | sed 's/^, //')\n"

    for risk_parsed in ${risks[@]}; do

      OLDIFS=${IFS}
      IFS=";"
      risk_parsed=(${risk_parsed})
      IFS=${OLDIFS}

      # Package name
      r_package_name="${risk_parsed[0]}"

      echo -en "Analysing package ${i}/${#risks[*]} (${r_package_name})...                    \r"

      # Package security issues detected
      r_package_security_issues_count="${risk_parsed[2]}"

      # Package security issues overall level: Critical, High, Medium or Low
      r_package_security_issues_level=$(echo "${risk_parsed[1]}" | sed 's/Critical/0/g; s/High/1/g; s/Medium/2/g; s/Low/3/g')

      r_package_description=$(${SELECTED_MANAGER} "${command_pkginfo_local}" "${r_package_name}" | grep -i description | awk -F ": " '{print $2}')

      if [[ $(echo "${r_package_description}" | wc -m) -gt ${description_column_max_chars} ]]
      then
        r_package_description=$(printf "%s..." $(echo "${r_package_description}" | cut -c 1-${description_column_max_chars}))
      fi

      r_package_version_status=$(package_version_check "${r_package_name}")

      risk_entries[$risks_parsed_count]=$(printf "%s|%s|%s|%s|%s\n" \
        "${r_package_name}" \
        "${r_package_security_issues_count}" \
        "${r_package_security_issues_level}" \
        "${r_package_version_status}" \
        "${r_package_description}" \
      )

      let risks_parsed_count++
      let i++

    done

    echo -e "\e[1m"
    printf "\n%-25s%-20s%-15s%-25s%s\n" "Package" "Security issues" "Risk level" "Version status" "Description"
    echo -e "\e[0m"

    case "${SORT_ORDER}" in
      name)
        sort_column="-k1"
        ;;
      issues)
        sort_column="-k2"
        sort_params+=("-n")
        ;;
      level)
        sort_column="-k3"
        ;;
      version)
        sort_column="-k4"
        ;;
      desc)
        sort_column="-k5"
        ;;
      #*)
      #    echo "Unknown sorting order selected. Exiting."
      #    exit 1
    esac

    if [[ "${SORT_REVERSE}" -eq 1 ]]
    then
      sort_params+=("-r")
    fi

    i=0
    IFS=$'\n'
    for line in $(echo "${risk_entries[*]}" | sort ${sort_params[*]} -t'|' ${sort_column})
    do

      package_alert_importance_status=$(echo "${line}" | awk -F '|' '{print $3}')

      case "${package_alert_importance_status}" in
        0)
          package_alert_msg_color="${red}"
          package_alert_importance_output_status="Critical"
          ;;
        1)
          package_alert_msg_color="${orange}"
          package_alert_importance_output_status="High"
          ;;
        2)
          package_alert_msg_color="${yellow}"
          package_alert_importance_output_status="Medium"
          ;;
        3)
          package_alert_msg_color="${green}"
          package_alert_importance_output_status="Low"
          ;;
      esac

      package_security_issues_count=$(echo "${line}" | awk -F '|' '{print $2}')

      if [[ ${package_security_issues_count} -lt 5 ]]
      then
        security_msg_color="${green}"
      elif [[ ${package_security_issues_count} -ge 5 ]] && [[ ${package_security_issues_count} -lt 10 ]]
      then
        security_msg_color="${yellow}"
      elif [[ ${package_security_issues_count} -ge 10 ]] && [[ ${package_security_issues_count} -lt 20 ]]
      then
        security_msg_color="${orange}"
      else
        security_msg_color="${red}"
      fi

      security_issues_package_summary[$i]=${package_security_issues_count}

      echo "${line}" | awk -F '|' \
        -v clr1="${package_alert_msg_color}" \
        -v clr2="${security_msg_color}" \
        -v rs="${reset}" \
        -v var="${package_alert_importance_output_status}" \
        '{printf "%-25s%s%-20s%s%-15s%-30s%s%s\n",$1,clr2,$2,clr1,var,$4,rs,$5}'

      let i++
    done

    security_issues_total_count=$(echo $(printf "%d+" "${security_issues_package_summary[@]}")0 | bc)

    echo -e "\nTotal:"
    printf "%-25s%s\n\n" "${package_count}" "${security_issues_total_count}"
    printf "Check %s for more information.\n\n" "${NETWORK_HOST_ENDPOINT}"
  fi
}

exec_tool