1 files changed, 73 insertions, 0 deletions
diff --git a/cmd/brew-sploits/main.go b/cmd/brew-sploits/main.go
new file mode 100644
index 0000000..534084d
--- /dev/null
+++ b/cmd/brew-sploits/main.go
@@ -0,0 +1,73 @@
+package main
+
+import (
+	"encoding/json"
+	"flag"
+	"fmt"
+	"os"
+
+	app "brew-sploits"
+)
+
+const version = "1.0.0"
+
+const about = `brew-sploits
+
+Scan Homebrew for vulnerabilities that already have known exploits.
+
+For every vulnerability Homebrew reports against your installed formulae,
+brew-sploits consults the fprox service to determine whether public
+proof-of-concepts or exploitation activity are known. It prints a JSON
+report to stdout with four fields:
+
+        exploited             CVEs that have known exploits
+        not_exploited         CVEs that have no known exploits
+        non_cve               vulnerability IDs that are not CVEs (e.g. OSV-*)
+        vulnerable_packages   unique Homebrew formulae affected
+
+CVEs that could not be checked (network or lookup failure) are skipped and
+reported as warnings on stderr; they are never mislabeled.
+
+Usage:
+  brew-sploits [options]
+
+Options:
+  -h, --help     show this help and exit
+  --version      print the version and exit
+
+Examples:
+  brew-sploits
+  brew-sploits | jq '.exploited'
+`
+
+func main() {
+	var showHelp bool
+	var showVersion bool
+
+	flag.Usage = func() { fmt.Fprint(os.Stderr, about) }
+	flag.BoolVar(&showHelp, "help", false, "show help and exit")
+	flag.BoolVar(&showVersion, "version", false, "print the version and exit")
+	flag.Parse()
+
+	if showHelp {
+		fmt.Fprint(os.Stdout, about)
+		return
+	}
+	if showVersion {
+		fmt.Printf("brew-sploits %s\n", version)
+		return
+	}
+
+	report, err := app.BuildBrewVulnsReport()
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "error: %v\n", err)
+		os.Exit(1)
+	}
+
+	enc := json.NewEncoder(os.Stdout)
+	enc.SetIndent("", "  ")
+	if err := enc.Encode(report); err != nil {
+		fmt.Fprintf(os.Stderr, "encode output: %v\n", err)
+		os.Exit(1)
+	}
+}