Scanning the entire Ports tree for Rust vulns

TLDR; It's possible to preemptively scan the whole ports tree for Rust
crates with known vulnerabilities, without building anything

Background: Every Rust project lists its dependencies in a
standardized format (Cargo.lock).  A widely used tool (cargo-audit)
can read that format to look for any dependencies with known security
vulnerabilities registered in a public database[^1].

Our ports tree doesn't store the Cargo.lock files; those come from the
projects themselves.  However, the majority of our Rust ports do store
their dependencies in a different standardized format: Makefile.crates
.  And it turns out that this format actually contains all of the
information that cargo-audit needs.  An awk script is sufficient to
turn a Makefile.crates file into a partial Cargo.lock file that's good
enough for cargo-audit.

Doing that turns up about 185 unique vulnerabilities and 3000 known
port-vulnerability pairs.  Many of them are minor, more like lints
than vulnerabilities.  But some are serious.  For example, we have 38
ports vulnerable to one particular remote DoS bug [^2].

Fixing all of the alerts would obviously be a ton of work.  The first
step would be filtering it to discard many of the less-serious alerts.
So I don't know if it would really be worthwhile.  I'm not planning to
do it myself, but I thought I would share my work here in case anybody
else is interested.

Here is the basic script:

#! /bin/sh

for f in `find . -name Makefile.crates`; do
    awk -F '([\t ]|-)' '
BEGIN {
    print("version = 4");
}
$(NF-1) ~ /[0-9]+\.[0-9]+\.[0-9]+/ {
    print("[[package]]");
    print("name = \"" $(NF-2) "\"");
    print("version = \"" $(NF-1) "\"");
}'    $f > /tmp/Cargo.lock
    cargo-audit audit -f /tmp/Cargo.lock
done

[^1]: https://rustsec.org/
[^2]: https://rustsec.org/advisories/RUSTSEC-2024-0336.html