3 commits

Author	SHA1	Message	Date
Claude	b148c8d4b8	Add analyze command to detect reachable vulnerable symbols in Rust projects ... Implements the next phase of cargo-deep-audit: given a Rust project and the enriched vulnerability database, determine which vulnerable symbols are actually called from user code. New modules: - lockfile.rs: Parse Cargo.lock to extract dependency names and versions - scanner.rs: Scan .rs source files for references to vulnerable symbols using import tracking (use statements) and call pattern matching, with High/Medium confidence levels - analyzer.rs: Orchestrate the full pipeline — load vuln_db, match against lockfile versions (semver-aware), scan source, produce structured report Changes: - main.rs refactored into subcommands: `enrich` (Phase 1) and `analyze` (Phase 2) - db.rs/diff_analyzer.rs: Added Deserialize support to load vuln_db.json - CI workflow updated for subcommand syntax - 24 tests total (21 unit + 3 integration), all passing https://claude.ai/code/session_011sdj18ZvQYbDVwEKqrWDj1	2026-03-25 10:50:22 +00:00
Claude	3aeae98506	Fix advisory parsing for .md format and suppress compiler warnings ... The RustSec advisory-db uses .md files with TOML in a fenced code block, not plain .toml files. The parser now extracts the TOML block from markdown. Also fixes: - --limit now means "collect up to N enriched entries" instead of "take first N candidates", so it keeps scanning until enough are found - Suppressed dead_code warnings on Issue variant and deserialization-only fields - Updated test fixtures to match the .md format https://claude.ai/code/session_01AeNG3herWfKhos9uZVUY5d	2026-03-25 01:52:22 +00:00
Claude	430816c717	Add Phase 1: Offline Database Enrichment pipeline ... Build the first phase of cargo deep-audit - a reachability-based vulnerability scanner for Rust. This pipeline: - Clones/caches the RustSec advisory-db and parses TOML advisory files - Extracts crate names, patched versions, CVE/RUSTSEC IDs, and GitHub refs - Fetches patch diffs via GitHub API (PRs resolve to merge commits) - Analyzes unified diffs to extract modified Rust function signatures - Outputs an enriched JSON database mapping advisory IDs to function signatures Modules: - advisory.rs: TOML parser with GitHub reference extraction - github.rs: GitHub API client for commit/PR diffs - diff_analyzer.rs: Unified diff parser extracting fn signatures from hunks - db.rs: JSON output database structure - main.rs: CLI orchestrator with clap https://claude.ai/code/session_01AeNG3herWfKhos9uZVUY5d	2026-03-25 01:28:25 +00:00