cleanup-cve

name	cleanup-cve
description	Cleans up irrelevant CVE fixes by seeking replace directives in distribution manifest.yaml files, finding the current version of the modules in the generated go.sum files, and removing replace directives where the go mod version exceeds the replacing (fixed) versions.

CVE Cleanup Skill

Steps

1. Generate go.sum files

The current version of any given module comes from from the go.sum files generated by OCB. Build source files for each distribution first (even if distribution/*/_build exists, as it may be out of date):

make build

2. Seek replace directives and find current versions

We need to determine which replace directives are stale in the current version of NRDOT. Find all replaced modules and, determine if the current go.sum version exceeds the fixed version (e.g. right side of =>).

SRC_ROOT=$(git rev-parse --show-toplevel)
for distribution in "$SRC_ROOT"/distributions/*/; do
  pushd "$distribution" > /dev/null

  # Print the module and fixed (e.g. right side of =>) version for each CVE replace
  echo "=== $distribution ==="
  yq '.replaces[] | split(" => ") | .[1]' manifest.yaml 2>/dev/null | while read -r replace_directive; do
    echo "Replace Version: $replace_directive"

    module=$(echo "$replace_directive" | awk '{print $1}')
    # Filter out non-compiled dependencies
    current=$(grep "^$module" _build/go.sum | grep -v "/go.mod")
    echo "Current Version: $current"
    
  done

  popd > /dev/null
done

3. Remove replace directives

For any modules whose current versions exceed the fixed versions in the replace directive, remove those replace directives and their comments.