cvehound-spatch 1.3.3.post1

Coccinelle 1.3.3, now able to say whether a scan finished. Handed a directory,
stock spatch skips any file it raised on and still exits 0, so an empty answer
cannot tell a clean tree from a file that was never scanned. This build reports
which it was, keeps a damaged or foreign AST-cache entry from costing a file,
and lets a consumer detect all of it with spatch --features.

Every scan ends with a summary

Every scan prints one line on stderr as its last line, even under --very-quiet:

SPATCH-SUMMARY groups=<n> handled=<n> skipped=<n> dropped=<n> timeouts=<n> unreadable=<n>

groups = handled + skipped + dropped. The key order is fixed, and new keys are
only ever appended. Each file the scan lost gets its own line, with the file
last so a path with spaces survives:

SPATCH-DROP kind=<timeout|exn|unreadable> reason=<...> file=<path>

This includes unreadable files, which used to leave no trace at all. A missing
summary means the scan did not finish. The exit code does not change, so a
harness that needs to know whether a scan was complete reads the summary.

The AST cache no longer costs a file

• cache-selfheal: a --cache-prefix entry that fails to read is now a
  cache miss: the file is parsed again and the entry rewritten. Before, the
  read error dropped the file on every scan sharing that cache, with exit 0,
  until the source changed.
• cache-buildid: spatch --version now ends with a Build: <commit>
  line. The cache key now also includes the build, the OCaml version and the
  parse flags, so an entry written by another build or under other options is
  parsed again instead of read. Entries left by older wheels miss once and are
  overwritten.

--timeout no longer cuts a directory scan short

The CPU timer behind --timeout was never stopped after a file group finished.
With --timeout 5 and a file that took 1 s, the remaining 4 s could run out
later in the prefilter, which does not catch a timeout. The whole scan then
exited 124 without looking at the rest of the tree and without naming a file.
The timer is now stopped when each group finishes.

Zygote replies

• If a request's environment contains COCCI_ZYGOTE_PROTO=2, the reply also
  says how many bytes the child left in each capture file and, for a signal,
  gives its name. A capture that was cut short is now detectable:

  exit <n> stdout=<bytes> stderr=<bytes>
  signal <n> name=<SIGNAME> stdout=<bytes> stderr=<bytes>
  

  A size is -1 when the child died before creating that file.

• The v1 reply is unchanged except for the signal number, which is now the
  host's own: signal 9 for SIGKILL. It used to be OCaml's negative constant,
  signal -7, which a client that flipped the sign read as exit code 7.

Feature detection

spatch --features prints one token per line; older builds reject it with exit
2. FEATURES is still measured from the built binary, now through that option:

>>> sorted(cvehound_spatch.FEATURES)
['cache-buildid', 'cache-selfheal', 'exit124', 'features', 'shared-cache',
 'summary', 'zygote', 'zygote-v2']

A consumer checks for a token, e.g. 'summary' in getattr(cvehound_spatch, 'FEATURES', frozenset()), and still works with any older wheel.

Wheels for Linux x86_64/aarch64 (manylinux_2_28) and macOS arm64
(macosx_11_0_arm64). Needs pip 20.3 or newer to install, and diff on the
system at run time.

pip install 'cvehound[spatch]'