From b95a0a881c4fdc2c336f2a1cff8518ffc5adef81 Mon Sep 17 00:00:00 2001 From: Richard Hull Date: Sun, 26 Nov 2023 21:40:09 +0000 Subject: [PATCH] Update references from `master` to `main` --- .github/workflows/ci.yaml | 2 +- .github/workflows/dependencies.yaml | 2 +- README.md | 16 ++++++++-------- project.clj | 2 +- 4 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index b636649..410113e 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -1,7 +1,7 @@ name: Continuous Integration on: push: - branches: [master] + branches: [main] pull_request: schedule: # The cron job aims to exercise dogfooding regularly, as NVD results are always subject to change. diff --git a/.github/workflows/dependencies.yaml b/.github/workflows/dependencies.yaml index ae32b07..d5f23fe 100644 --- a/.github/workflows/dependencies.yaml +++ b/.github/workflows/dependencies.yaml @@ -58,4 +58,4 @@ jobs: commit-message: Update stale dependencies title: Update stale dependencies branch: update-dependencies - base: master + base: main diff --git a/README.md b/README.md index d6871b8..5fc9681 100644 --- a/README.md +++ b/README.md @@ -42,7 +42,7 @@ Then you can run, within this helper project: lein with-profile -user run -m nvd.task.check "nvd-clojure.edn" "$(cd ; lein with-profile -user,-dev classpath)" ``` -The first argument denotes a .edn file with extra options ([example](https://github.com/rm-hull/nvd-clojure/blob/master/.github/nvd-config.edn), [doc](#configuration-options)). You can pass an empty string `""` to mean "please use the default filename" (which is `nvd-clojure.edn`). If this file didn't exist, it will be automatically created for you, with some useful contents and comments. +The first argument denotes a .edn file with extra options ([example](https://github.com/rm-hull/nvd-clojure/blob/main/.github/nvd-config.edn), [doc](#configuration-options)). You can pass an empty string `""` to mean "please use the default filename" (which is `nvd-clojure.edn`). If this file didn't exist, it will be automatically created for you, with some useful contents and comments. The `classpath` Leiningen command should reflect a production-like classpath as closely as possible: it should not include dev/test tooling, plugins, etc. @@ -66,7 +66,7 @@ Then you can run, within this helper project: clojure -J-Dclojure.main.report=stderr -M -m nvd.task.check "nvd-clojure.edn" "$(cd ; clojure -Spath -A:any:aliases)" ``` -The first argument denotes a .edn file with extra options ([example](https://github.com/rm-hull/nvd-clojure/blob/master/.github/nvd-config.edn), [doc](#configuration-options)). You can pass an empty string `""` to mean "please use the default filename" (which is `nvd-clojure.edn`). If this file didn't exist, it will be automatically created for you, with some useful contents and comments. +The first argument denotes a .edn file with extra options ([example](https://github.com/rm-hull/nvd-clojure/blob/main/.github/nvd-config.edn), [doc](#configuration-options)). You can pass an empty string `""` to mean "please use the default filename" (which is `nvd-clojure.edn`). If this file didn't exist, it will be automatically created for you, with some useful contents and comments. The `-Spath` command should reflect a production-like classpath as closely as possible: it should not include dev/test tooling, etc. @@ -90,7 +90,7 @@ Then you can run: clojure -J-Dclojure.main.report=stderr -Tnvd nvd.task/check :classpath \""$(clojure -Spath -A:any:aliases)\"" :config-filename \""nvd-config.edn\"" ``` -The `:config-filename` argument denotes an .edn file with extra options ([example](https://github.com/rm-hull/nvd-clojure/blob/master/.github/nvd-config.edn), [doc](#configuration-options)). +The `:config-filename` argument denotes an .edn file with extra options ([example](https://github.com/rm-hull/nvd-clojure/blob/main/.github/nvd-config.edn), [doc](#configuration-options)). If this file didn't exist, it will be automatically created for you, with some useful contents and comments. The `-Spath` command should reflect a production-like classpath as closely as possible: it should not include dev/test tooling, etc. @@ -114,7 +114,7 @@ setting a `:fail-threshold` in the project [configuration](#configuration-option ### Example -There is an [example project](https://github.com/rm-hull/nvd-clojure/blob/master/example/project.clj) +There is an [example project](https://github.com/rm-hull/nvd-clojure/blob/main/example/project.clj) which has dependencies with known vulnerabilities ([CVE-2016-3720](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-3720), [CVE-2015-5262](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-5262), @@ -130,7 +130,7 @@ This will download the NVD database, and then cross-check the classpath dependencies against known vulnerabilities. The following summary report will be displayed on the console: -![summary-report](https://raw.githubusercontent.com/rm-hull/nvd-clojure/master/example/img/summary-report.png) +![summary-report](https://raw.githubusercontent.com/rm-hull/nvd-clojure/main/example/img/summary-report.png) Note that as there were some vulnerabilities detected, the process was aborted, with error code `-1` hence the reported `subprocess failed` message. @@ -139,7 +139,7 @@ More detailed reports (both HTML & XML) are written into the `./example/target/nvd/` directory as follows: --- -![detail-report](https://raw.githubusercontent.com/rm-hull/nvd-clojure/master/example/img/detail-report.png) +![detail-report](https://raw.githubusercontent.com/rm-hull/nvd-clojure/main/example/img/detail-report.png) ## Upgrading dependencies @@ -160,7 +160,7 @@ to update the project file. ## Configuration The default settings for `nvd-clojure` are usually sufficient for most projects, but -can be customized with an .edn config file ([example](https://github.com/rm-hull/nvd-clojure/blob/master/.github/nvd-config.edn)). +can be customized with an .edn config file ([example](https://github.com/rm-hull/nvd-clojure/blob/main/.github/nvd-config.edn)). The filename denoting that file is the first argument to be passed to nvd-clojure when invoking it as a `main` (`-m`) program. When invoking it via Clojure Tools, it must be passed as a `:config-filename` option, e.g. @@ -175,7 +175,7 @@ Note the escaped double quotes around the filename, to ensure that Clojure reads There are many DependencyCheck settings (for example to connect via a proxy, or to specify an alternative to the H2 database). The exact settings can be seen -in the [config.clj](https://github.com/rm-hull/nvd-clojure/blob/master/src/nvd/config.clj) source file and cross-referenced to the DependencyCheck +in the [config.clj](https://github.com/rm-hull/nvd-clojure/blob/main/src/nvd/config.clj) source file and cross-referenced to the DependencyCheck wiki. There are some specific settings below which are worthy of a few comments: diff --git a/project.clj b/project.clj index fc09a44..91c2b34 100644 --- a/project.clj +++ b/project.clj @@ -32,7 +32,7 @@ :jar-exclusions [#"(?:^|/).git"] :codox {:source-paths ["src"] :output-path "doc/api" - :source-uri "https://github.com/rm-hull/nvd-clojure/blob/master/{filepath}#L{line}"} + :source-uri "https://github.com/rm-hull/nvd-clojure/blob/main/{filepath}#L{line}"} :min-lein-version "2.8.1" :target-path "target/%s" :jvm-opts ["-Dclojure.main.report=stderr"]