1 files changed, 81 insertions, 0 deletions
diff --git a/brew_vulns.go b/brew_vulns.go
new file mode 100644
index 0000000..7816e47
--- /dev/null
+++ b/brew_vulns.go
@@ -0,0 +1,81 @@
+package app
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"os/exec"
+)
+
+// This file was generated from JSON Schema using quicktype, do not modify it directly.
+// To parse and unparse this JSON data, add this code to your project and do:
+//
+//    brewVulns, err := UnmarshalBrewVulns(bytes)
+//    bytes, err = brewVulns.Marshal()
+
+func UnmarshalBrewVulns(data []byte) (BrewVulns, error) {
+	var r BrewVulns
+	err := json.Unmarshal(data, &r)
+	return r, err
+}
+
+func (r *BrewVulns) Marshal() ([]byte, error) {
+	return json.Marshal(r)
+}
+
+type BrewVulns struct {
+	Findings        []Finding `json:"findings"`
+	SkippedFormulae []string  `json:"skipped_formulae"`
+}
+
+type Finding struct {
+	Formula         string    `json:"formula"`
+	Version         string    `json:"version"`
+	Tag             string    `json:"tag"`
+	RepoURL         string    `json:"repo_url"`
+	Vulnerabilities []Patched `json:"vulnerabilities"`
+	Patched         []Patched `json:"patched"`
+}
+
+type Patched struct {
+	ID            string   `json:"id"`
+	Severity      Severity `json:"severity"`
+	Summary       *string  `json:"summary"`
+	Aliases       []string `json:"aliases"`
+	FixedVersions []string `json:"fixed_versions"`
+}
+
+type Severity string
+
+const (
+	High    Severity = "HIGH"
+	Low     Severity = "LOW"
+	Medium  Severity = "MEDIUM"
+	Unknown Severity = "UNKNOWN"
+)
+
+// runBrewVulns executes `brew vulns --json` and decodes the findings.
+func runBrewVulns() (BrewVulns, error) {
+	cmd := exec.Command("brew", "vulns", "--json")
+	var out, errBuf bytes.Buffer
+	cmd.Stdout = &out
+	cmd.Stderr = &errBuf
+
+	if err := cmd.Run(); err != nil && out.Len() == 0 {
+		msg := errBuf.String()
+		if msg == "" {
+			msg = err.Error()
+		}
+		return BrewVulns{}, fmt.Errorf("brew vulns: %v: %s", err, msg)
+	}
+
+	r, err := UnmarshalBrewVulns(out.Bytes())
+	if err != nil {
+		if msg := errBuf.String(); msg != "" {
+			return BrewVulns{}, fmt.Errorf("decode brew vulns output: %v: %s", err, msg)
+		}
+		return BrewVulns{}, fmt.Errorf("decode brew vulns output: %w", err)
+	}
+
+	return r, nil
+}