This package aims to secure your R projects against insecure
dependencies using OSS Index.
Essentially, we check R packages for any known security
vulnerabilities. For a more in-depth discussion check out this detailed
walkthrough
by Colin Gillespie, one of the co-authors of {oysteR}
.
The package has a few key functions for determining vulnerabilities:
audit_installed_r_pkgs()
for scanning all currently installed R
packagesaudit_description()
for scanning all packages (and their
dependencies) in a DESCRIPTION fileaudit_renv_lock()
and audit_req_txt()
expect_secure()
for use within {testthat}
All of these functions ultimately parse relevant files and call the
audit()
function.
To get started, install the package and simply scan your installed packages
library("oysteR")
audit = audit_installed_r_pkgs()
To extract the vulnerabilities into a nice data frame, use
get_vulnerabilities(audit)
You can include this as part of your Unit testing framework, via {testthat}. Simply create a file in tests/testthat and add
test_that("Test expect_secure", {
skip_on_cran()
## Tests function and this package
oysteR::expect_secure("PKG_NAME")
})
This test will pass if there are no known vulnerabilities. Remember to add {oysteR} under Suggests in your DESCRIPTION file.
Heavy use against OSS Index will likely run you into rate limiting (yikes!), but you can:
Set the following environment variables in your .Renviron
file:
OSSINDEX_USER
(this is set to your email address)OSSINDEX_TOKEN
(this is set to your API token)Or create a config file at ~/.ossindex/.oss-index-config
and add
# This config file is picked up by other Sonatype apps
ossi:
Username: XXXX
Token: YYY
These will be used by {oysteR}
to authenticate with OSS Index, bumping
up the amount of requests you can make.
We care a lot about making the world a safer place, and that’s why we continue to work on this and other plugins for Sonatype OSS Index. If you as well want to speed up the pace of software development by working on this project, jump on in! Before you start work, create a new issue, or comment on an existing issue, to let others know you are!
OSS Index contains data from public advisories. We do our best to keep it up to date, but from time to time things may slip through the cracks. If you notice some missing or incorrect data, please let us know! To report missing or incorrect vulnerabilities in OSS Index data, create an issue in the vulnerability reporting project.
If you need help, then feel free to join us on the oysteR Gitter or raise an an issue
It is worth noting that this is NOT SUPPORTED by Sonatype, and is a contribution of ours to the open source community (read: you!)
Remember:
{oysteR}
Phew, that was easier than I thought. Last but not least of all:
Have fun creating and using this extension and Sonatype OSS Index, we are glad to have you here!