diff --git a/README.md b/README.md index 69c7fd0..aadb43e 100644 --- a/README.md +++ b/README.md @@ -29,6 +29,8 @@ pnpm add - [Binaries](#binaries) - [Build from Source](#build-from-source) - [Usage](#usage) + - [Silent Mode](#silent-mode) + - [Verbose Mode](#verbose-mode) - [Debugging](#debugging) - [PMG in Action](#pmg-in-action) - [Malicious Package Detection](#malicious-package-detection) @@ -95,6 +97,22 @@ npm install pnpm add ``` +### Silent Mode + +Use the `--silent` flag to run PMG in silent mode: + +```bash +pmg --silent npm install +``` + +### Verbose Mode + +Use the `--verbose` flag to run PMG in verbose mode: + +```bash +pmg --verbose npm install +``` + ### Debugging Use the `--debug` flag to enable debug mode: diff --git a/analyzer/analyzer.go b/analyzer/analyzer.go index dad1fd4..c4d80c0 100644 --- a/analyzer/analyzer.go +++ b/analyzer/analyzer.go @@ -26,6 +26,9 @@ type PackageVersionAnalysisResult struct { // Analyser specific analysis ID AnalysisID string + // Reference URL for the analysis + ReferenceURL string + // The action to take as recommended by the analyzer Action Action diff --git a/analyzer/malysis_query.go b/analyzer/malysis_query.go index dcf1aab..568cd65 100644 --- a/analyzer/malysis_query.go +++ b/analyzer/malysis_query.go @@ -55,6 +55,7 @@ func (a *malysisQueryAnalyzer) Analyze(ctx context.Context, // By default, the analyzer allows the package version analysisResult := &PackageVersionAnalysisResult{ PackageVersion: packageVersion, + ReferenceURL: malysisReportUrl(res.GetAnalysisId()), Action: ActionAllow, AnalysisID: res.GetAnalysisId(), Summary: res.GetReport().GetInference().GetSummary(), @@ -73,3 +74,7 @@ func (a *malysisQueryAnalyzer) Analyze(ctx context.Context, return analysisResult, nil } + +func malysisReportUrl(analysisId string) string { + return fmt.Sprintf("https://platform.safedep.io/community/malysis/%s", analysisId) +} diff --git a/internal/ui/ui.go b/internal/ui/ui.go index 12f8fe7..d66d1cd 100644 --- a/internal/ui/ui.go +++ b/internal/ui/ui.go @@ -59,14 +59,25 @@ func SetStatus(status string) { func GetConfirmationOnMalware(malwarePackages []*analyzer.PackageVersionAnalysisResult) (bool, error) { StopSpinner() - fmt.Println(Colors.Red(fmt.Sprintf("🚨 Malicious packages detected: %d", len(malwarePackages)))) + fmt.Println() + fmt.Println(Colors.Red(fmt.Sprintf("🚨 Suspicious package(s) detected: %d", len(malwarePackages)))) for _, mp := range malwarePackages { + fmt.Println() fmt.Println("⚠️ ", Colors.Red(fmt.Sprintf("%s@%s", mp.PackageVersion.GetPackage().GetName(), mp.PackageVersion.GetVersion()))) - fmt.Println(Colors.Yellow(termWidthFormatText(mp.Summary, 60))) - fmt.Println() + + if verbosityLevel == VerbosityLevelVerbose { + fmt.Println(Colors.Yellow(termWidthFormatText(mp.Summary, 60))) + + if mp.ReferenceURL != "" { + fmt.Println() + fmt.Println(Colors.Yellow(fmt.Sprintf("Reference: %s", mp.ReferenceURL))) + } + + fmt.Println() + } } fmt.Println() diff --git a/main.go b/main.go index 7b8ed68..61400b5 100644 --- a/main.go +++ b/main.go @@ -7,11 +7,14 @@ import ( "github.com/safedep/dry/log" "github.com/safedep/pmg/cmd/npm" "github.com/safedep/pmg/config" + "github.com/safedep/pmg/internal/ui" "github.com/spf13/cobra" ) var ( debug bool + silent bool + verbose bool globalConfig config.Config ) @@ -26,6 +29,17 @@ func main() { log.InitZapLogger("pmg", "") + if silent && verbose { + fmt.Println("pmg: --silent and --verbose cannot be used together") + os.Exit(1) + } + + if silent { + ui.SetVerbosityLevel(ui.VerbosityLevelSilent) + } else if verbose { + ui.SetVerbosityLevel(ui.VerbosityLevelVerbose) + } + cmd.SetContext(globalConfig.Inject(cmd.Context())) }, RunE: func(cmd *cobra.Command, args []string) error { @@ -38,7 +52,9 @@ func main() { }, } - cmd.PersistentFlags().BoolVar(&debug, "debug", false, "Enable debug logging") + cmd.PersistentFlags().BoolVar(&silent, "silent", false, "Silent mode for invisible experience") + cmd.PersistentFlags().BoolVar(&verbose, "verbose", false, "Verbose mode for more information") + cmd.PersistentFlags().BoolVar(&debug, "debug", false, "Enable debug logging (defaults to stdout)") cmd.PersistentFlags().BoolVar(&globalConfig.Transitive, "transitive", true, "Resolve transitive dependencies") cmd.PersistentFlags().IntVar(&globalConfig.TransitiveDepth, "transitive-depth", 20, "Maximum depth of transitive dependencies to resolve")