Merge ~alextu/plainbox-provider-pc-sanity:cve-test into plainbox-provider-pc-sanity:master

[Alex Tu]

the result of running this test case:
https://pastebin.canonical.com/p/kH2cYHSWXy/

[Alex Tu (alextu)]

trello card requested this test case : https://trello.com/c/GsQ1dJL8

[Shih-Yuan Lee (fourdollars)]

Some typos and syntax corrections.

review: Needs Fixing

[Shih-Yuan Lee (fourdollars)]

More wordings suggestions.

review: Needs Fixing

[Alex Tu (alextu)]

gitlab pipline verified.
https://gitlab.com/alex-tu-cc/plainbox-provider-pc-sanity/-/pipelines/234377305

[Shih-Yuan Lee (fourdollars)]

LGTM

review: Approve

diff --git a/bin/cvescan.sh b/bin/cvescan.sh
new file mode 100755
index 0000000..e3acbec
--- /dev/null
+++ b/bin/cvescan.sh
@@ -0,0 +1,65 @@
+#!/bin/bash
+OUT="$PWD"
+usage() {
+cat << EOF
+usage: $0 options
+
+    -h|--help print this message
+    --out     The folder you for generated json file. Default is \$PWD
+EOF
+exit 0
+}
+
+prepare() {
+# https://github.com/canonical/sec-cvescan
+    for pkg in python3-apt python3-pip git jq; do
+        [ "$(dpkg-query -W -f='${Status}' "$pkg")" = "install ok installed" ] || (sudo apt-get update && DEBIAN_FRONTEND=noninteractive sudo apt install -y "$pkg")
+    done
+    git clone https://github.com/canonical/sec-cvescan
+    export PATH=$HOME/.local/bin/:$PATH
+    pip3 install --user sec-cvescan/ > /dev/null
+    rm -rf sec-cvescan
+}
+main() {
+    while [ $# -gt 0 ]
+    do
+        case "$1" in
+            -h | --help)
+                usage 0
+                exit 0
+                ;;
+            --out)
+                shift
+                OUT="$1";
+                ;;
+            *)
+            usage
+           esac
+           shift
+    done
+
+    prepare
+    get_cvescan_json  "$OUT/cvescan.json"
+    parse_cvescan_json "$OUT/cvescan.json"
+}
+
+get_cvescan_json() {
+    [ -n "$1" ] || exit 1
+    command -v cvescan || exit 1
+    cvescan --json > "$1"
+}
+
+parse_cvescan_json() {
+    [ -n "$1" ] || exit 1
+    command -v jq || exit 1
+    if [ "$(jq -r '.summary.num_cves' < "$1")" != "0" ]; then
+        echo "You have some packages that need an update for CVE."
+        echo "Please check $1 for details"
+        exit 1
+    fi
+}
+
+if [ "${BASH_SOURCE[0]}" = "$0" ]; then
+    main "$@"
+fi
+
diff --git a/debian/control b/debian/control
index 73d99aa..67a7a09 100644
--- a/debian/control
+++ b/debian/control
@@ -8,10 +8,14 @@ Vcs-Browser: https://code.launchpad.net/~ville-team/ville/+git/plainbox-provider
 
 Package: plainbox-provider-pc-sanity
 Architecture: all
-Depends: plainbox-provider-checkbox (>= 0.27),
+Depends: git,
+         jq,
+         plainbox-provider-checkbox (>= 0.27),
          powertop,
          python3 (>= 3.2),
+         python3-apt,
          python3-checkbox-support (>= 0.27),
+         python3-pip,
          xautomation,
          ${misc:Depends},
          ${shlibs:Depends}
diff --git a/units/pc-sanity/pc-sanity-check-env.pxu b/units/pc-sanity/pc-sanity-check-env.pxu
index fec17c8..47db4da 100644
--- a/units/pc-sanity/pc-sanity-check-env.pxu
+++ b/units/pc-sanity/pc-sanity-check-env.pxu
@@ -41,3 +41,12 @@ _summary: to confirm the dell-recoery is what we expected.
 _description:
  based on the meeting conclusion of 4/22, we need somerville version before Mario agree Canonical take the duty of dell-recovery sru.
  Let it support ubuntu-recovery and dell-recovery.
+
+plugin: shell
+category_id: com.canonical.plainbox::miscellanea
+id: miscellanea/cvescan
+command:
+ cvescan.sh --out "$PLAINBOX_SESSION_SHARE"
+_summary: Scan if all CVEs are fixed well.
+_description:
+ Refer to https://github.com/canonical/sec-cvescan, to scan if all CVEs are fixed well on the target machine.
diff --git a/units/pc-sanity/pc-sanity.pxu b/units/pc-sanity/pc-sanity.pxu
index b500151..60924f8 100644
--- a/units/pc-sanity/pc-sanity.pxu
+++ b/units/pc-sanity/pc-sanity.pxu
@@ -6,6 +6,7 @@ _description:
 include:
     com.canonical.certification::somerville-installation
     com.canonical.certification::misc/generic/grub_boothole
+    com.canonical.certification::miscellanea/cvescan
     com.canonical.certification::miscellanea/check-nvidia
     com.canonical.certification::miscellanea/debsums
     com.canonical.certification::miscellanea/turbostate-long-idle-c10