When returning errors

#!/usr/bin/env python3
# CVE-2026-42507 verifier for Go stdlib net/textproto
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/runtime error

import argparse
import os
import re
import subprocess
import sys

VERSION_RE = re.compile(r'go(\d+)\.(\d+)(?:\.(\d+))?')


def parse_go_version(text):
    m = VERSION_RE.search(text or "")
    if not m:
        return None
    major = int(m.group(1))
    minor = int(m.group(2))
    patch = int(m.group(3) or 0)
    return (major, minor, patch)


def classify(v):
    if v is None:
        return ("UNKNOWN", "Could not parse Go version")

    major, minor, patch = v

    # CVE-2026-42507 fixed in go1.25.11 and go1.26.4.
    # Go vuln range indicates versions before 1.25.11 are vulnerable,
    # and 1.26.0 through 1.26.3 are vulnerable.
    if major != 1:
        return ("UNKNOWN", f"Unexpected Go major version: go{major}.{minor}.{patch}")

    if minor < 25:
        return ("VULNERABLE", f"go{major}.{minor}.{patch} is older than go1.25.11")
    if minor == 25:
        if patch >= 11:
            return ("PATCHED", f"go{major}.{minor}.{patch} includes the fix threshold go1.25.11")
        return ("VULNERABLE", f"go{major}.{minor}.{patch} is below go1.25.11")
    if minor == 26:
        if patch >= 4:
            return ("PATCHED", f"go{major}.{minor}.{patch} includes the fix threshold go1.26.4")
        return ("VULNERABLE", f"go{major}.{minor}.{patch} is below go1.26.4")
    if minor > 26:
        return ("PATCHED", f"go{major}.{minor}.{patch} is newer than the fixed branches")

    return ("UNKNOWN", f"Unhandled version logic for go{major}.{minor}.{patch}")


def run_cmd(cmd):
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, check=False)
        return p.returncode, (p.stdout or "") + (p.stderr or "")
    except FileNotFoundError:
        return 127, "command not found"
    except Exception as e:
        return 126, str(e)


def get_toolchain_version(go_bin):
    rc, out = run_cmd([go_bin, "version"])
    if rc != 0:
        return None, f"failed to run {' '.join([go_bin, 'version'])}: {out.strip()}"
    v = parse_go_version(out)
    if v is None:
        return None, f"unable to parse toolchain version from: {out.strip()}"
    return v, out.strip()


def get_binary_build_version(go_bin, target_bin):
    rc, out = run_cmd([go_bin, "version", "-m", target_bin])
    if rc != 0:
        return None, f"failed to inspect binary with {' '.join([go_bin, 'version', '-m', target_bin])}: {out.strip()}"
    # The first line usually contains: /path/bin: go1.X.Y
    first_line = out.splitlines()[0] if out.splitlines() else out
    v = parse_go_version(first_line)
    if v is None:
        # Fallback: search anywhere in output.
        v = parse_go_version(out)
    if v is None:
        return None, f"unable to parse embedded Go version from binary metadata: {first_line.strip()}"
    return v, first_line.strip()


def main():
    ap = argparse.ArgumentParser(description="Check exposure to CVE-2026-42507 in Go net/textproto")
    ap.add_argument("--go-bin", help="Path to go executable (default: go from PATH)", default="go")
    ap.add_argument("--target-bin", help="Optional path to a compiled Go binary to inspect with 'go version -m'")
    ap.add_argument("--version", help="Optional literal version string to classify, e.g. 'go1.26.3'")
    args = ap.parse_args()

    if args.version:
        v = parse_go_version(args.version)
        state, reason = classify(v)
        print(f"{state}: {reason}")
        sys.exit(0 if state == "PATCHED" else 1 if state == "VULNERABLE" else 2)

    if args.target_bin:
        if not os.path.exists(args.target_bin):
            print(f"UNKNOWN: target binary not found: {args.target_bin}")
            sys.exit(2)
        v, detail = get_binary_build_version(args.go_bin, args.target_bin)
        if v is None:
            print(f"UNKNOWN: {detail}")
            sys.exit(2)
        state, reason = classify(v)
        print(f"{state}: binary {args.target_bin} built with {detail} -> {reason}")
        sys.exit(0 if state == "PATCHED" else 1 if state == "VULNERABLE" else 2)

    v, detail = get_toolchain_version(args.go_bin)
    if v is None:
        print(f"UNKNOWN: {detail}")
        sys.exit(2)
    state, reason = classify(v)
    print(f"{state}: toolchain {detail} -> {reason}")
    sys.exit(0 if state == "PATCHED" else 1 if state == "VULNERABLE" else 2)


if __name__ == "__main__":
    main()