Add plugin update checking and a plugins command (#898)

mirror of https://github.com/mvt-project/mvt.git synced 2026-09-03 08:30:51 +02:00

* Add plugin update checking

Report available updates to the installed MVT plugin packages in the
startup banner, for plugins installed from a package index and for
plugins installed directly from a repository. Repository installs pinned
to a commit or a tag are never reported as outdated.

MVT only prints the command which upgrades a plugin. Installing the
update stays a deliberate choice of the analyst. The check runs at most
once every twelve hours, and in between prints the findings of the
latest check which still apply to what is installed.

Nothing about the check can interrupt a running command: the parts of
the suggested command come from package metadata and are quoted for the
shell, the repository query refuses to prompt for credentials and never
passes metadata as a git option, and a corrupt or stale cache is
discarded rather than trusted.

* Add a plugins command to list installed plugins and check updates

Add a "plugins" command to the platform-neutral mvt command. "plugins
list" shows every installed plugin package with its version, where it was
installed from, how many forensic modules it contributes and which
commands it adds. "plugins check-updates" checks for updates immediately,
without waiting for the automatic check, and prints the command which
upgrades a plugin instead of installing anything.

It lives on mvt only. The packages it lists extend mvt-ios and mvt-android
too, but auditing them is not the job of a command which analyses one
platform, and the two platform CLIs should not carry commands which are
not about an acquisition.

The command is registered as a built-in, before any external command, so
that an installed package cannot replace this audit surface.

This commit is contained in:

Donncha Ó Cearbhaill

2026-08-27 14:47:15 +02:00

committed by

GitHub

parent a78894aaa5

commit dcfd500112

13 changed files with 1849 additions and 74 deletions

									
										docs/development/index.md
									
		+3
		
												View File
												
				@@ -214,6 +214,9 @@ module came from:

				- When a command runs with an `--output` folder, the `command.log` file

				  records one line per module source with the source's version or hash and

				  the list of modules loaded from it.

				- `mvt plugins list` lists the installed packages, where each of them

				  was installed from and how many modules it contributes, see

				  [Managing Plugins](plugins.md).

				## Profiling