dawnscanner 1.6.8 → 2.0.0.rc4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA1:
-  metadata.gz: be00270c083b8265e402c4db5af3a5ea77097978
-  data.tar.gz: 1abf4048b91c6a0f8a4c3116880c4c11dbe58a60
+SHA256:
+  metadata.gz: b9ae4a53a59b132a6ce6c85407f0d4fddd88eda75958474a1aee0ce2369b4cf4
+  data.tar.gz: '01479eaa5129162d83ddcce897f74f250b5fe4b0cbe5e7c5e3bb2444b9cffce8'
 SHA512:
-  metadata.gz: 733ab01256a79072b93276bf4cd7b737effa5c46cbe0263c7a512dd1d2c52d0059d5d235cbc841aeac0c230b5df10eaf9cd3ab90cfa2d6f37861d7fcd759574e
-  data.tar.gz: 26e104ea9e588b0e3251e10897daa63cb8a92a165a7f558ff19498b48f931f2956f3e21147dcfc0307743f3c56bec191a47f4fd79c7daf22ba7459b953ccbd7f
+  metadata.gz: b2ddc397e425922f848612c1244b8e0ace964a766673b9a6f70317e441c00dd35c2687de1040fcfa0ef5203c5f7304d274e4a9091637670a8b5c3ccefec33804
+  data.tar.gz: '0345397057005fcd021910298c1befb282eddfcad7e13f876e5d36a8715579d71990dd18bcb9cd3ca3f8387fe99e962ad8e97224d5060dad1f711f49a82e62d2'

data/.gitignore

@@ -19,3 +19,4 @@ test/tmp
 test/version_tmp
 tmp
 db/*
+tags

data/.ruby-version

@@ -1 +1 @@
-2.3.1
+3

data/Changelog.md

@@ -5,7 +5,33 @@ It supports [Sinatra](http://www.sinatrarb.com),
 [Padrino](http://www.padrinorb.com) and [Ruby on Rails](http://rubyonrails.org)
 frameworks.
 
-_latest update: Tue Nov  1 22:47:56 CET 2016_
+_latest update: mer 28 nov 2018, 11.03.53, CET_
+
+## Version 2.0.0 - codename: Finn McMissile (2019-xx-xx)
+
+* New knowledge base, YAML based and distributed separately from the ruby gem.
+* New CLI based on Thor library. Please read README.md file to know how to
+  invoke dawn the right way or use the 'dawn help' command
+* Added a new debug\_verbosely API for engines and checks
+* Removed rake osvdb[name] and rake cve[name] tasks
+* Adding telemetry
+* Dawn::Utils include refactory. Now it's available application wide
+* debug information refactory.
+* engine class, apply_all method now accepts an optional parameter containing a
+  list of security checks to be excluded (issue #230).
+* Fix issue #244. Now the KB path is no more hardcoded but it is relative to
+  $HOME and 'dawnscanner' folder where results are stored.
+* Fix issue #245. Pattern matching check is skipped on empty files.
+
+## Version 1.6.9 - codename: Tow Mater (2018-11-28)
+
+* Removed signing certificate. This will solve issue #233 and #229
+* Removed datamapper support. I will change to active\_record sooner or later.
+  This will solve issue #232 and issue #218
+
+## Version 1.6.8 - codename: Tow Mater (2017-04-07)
+
+* Update signing certficate
 
 ## Version 1.6.7 - codename: Tow Mater (2016-11-24)
 

data/LICENSE.txt

@@ -1,4 +1,4 @@
-Copyright (c) 2013-2015 Paolo Perego
+Copyright (c) 2013-2021 Paolo Perego
 
 MIT License
 

data/README.md

@@ -1,22 +1,40 @@
 # Dawnscanner - The raising security scanner for ruby web applications
 
-dawnscanner is a source code scanner designed to review your ruby code for security
-issues.
+dawnscanner is a source code scanner designed to review your web applications for
+security issues.
 
-dawnscanner is able to scan plain ruby scripts (e.g. command line applications) but
-all its features are unleashed when dealing with web applications source code.
-dawnscanner is able to scan major MVC (Model View Controller) frameworks, out of the
-box:
+dawnscanner is able to scan web applications written in Ruby and it supports all 
+major MVC (Model View Controller) frameworks, out of the box:
 
 * [Ruby on Rails](http://rubyonrails.org)
 * [Sinatra](http://www.sinatrarb.com)
 * [Padrino](http://www.padrinorb.com)
 
+## Quick update from April, 2019
+
+We just released version 2.0.0 release candidate 1 with a YAML powered revamped
+knowledge base. Please note that dawnscanner will include a telemetry facility
+sending a POST  on https://dawnscanner.org/telemetry with an application id and
+some information about version and knowledge base.
+
+We won't now and ever collect your source code on our side.
+
+## Quick update from November, 2018
+
+As you can see dawnscanner is on hold since more then an year. Sorry for that.
+It's life. I was overwhelmed by tons of stuff and I dedicated free time to
+Offensive Security certifications. True to be told, I'm starting OSCE journey
+really soon.
+
+The dawnscanner project will be updated soon with new security checks and
+kickstarted again.
+
+Paolo
+
 ---
 
 [![Gem Version](https://badge.fury.io/rb/dawnscanner.png)](http://badge.fury.io/rb/dawnscanner)
 [![Build Status](https://travis-ci.org/thesp0nge/dawnscanner.png?branch=master)](https://travis-ci.org/thesp0nge/dawnscanner)
-[![Dependency Status](https://gemnasium.com/thesp0nge/dawnscanner.png)](https://gemnasium.com/thesp0nge/dawnscanner)
 [![Coverage Status](https://coveralls.io/repos/thesp0nge/dawnscanner/badge.png)](https://coveralls.io/r/thesp0nge/dawnscanner)
 [![Code Triagers Badge](https://www.codetriage.com/thesp0nge/dawnscanner/badges/users.svg)](https://www.codetriage.com/thesp0nge/dawnscanner)
 [![Inline docs](http://inch-ci.org/github/thesp0nge/dawnscanner.png?branch=master)](http://inch-ci.org/github/thesp0nge/dawnscanner)
@@ -50,30 +68,11 @@ application.
 
 ## Installation
 
-dawnscanner rubygem is cryptographically signed. To be sure the gem you
-install hasn’t been tampered, you must first add ```paolo@dawnscanner.org```
-public signing certificate as trusted to your gem specific keyring.
-
-```
-$ gem cert --add <(curl -Ls https://raw.githubusercontent.com/thesp0nge/dawnscanner/master/certs/paolo_at_dawnscanner_dot_org.pem)
-```
-
 You can install latest dawnscanner version, fetching it from
 [Rubygems](https://rubygems.org) by typing:
 
 ```
-$ gem install dawnscanner -P MediumSecurity
-```
-
-The MediumSecurity trust profile will verify signed gems, but allow the
-installation of unsigned dependencies. This is necessary because not all of
-dawnscanner’s dependencies are signed, so we cannot use HighSecurity.
-
-In order to install a release candidate version, the gem install command line
-is the following:
-
-```
-$ gem install dawnscanner --pre -P MediumSecurity
+$ gem install dawnscanner 
 ```
 
 If you want to add dawn to your project Gemfile, you must add the following:
@@ -123,44 +122,47 @@ $ dawn -h
 Usage: dawn [options] target_directory
 
 Examples:
-  $ dawn a_sinatra_webapp_directory
-  $ dawn -C the_rails_blog_engine
-  $ dawn -C --json a_sinatra_webapp_directory
-  $ dawn --ascii-tabular-report my_rails_blog_ecommerce
-  $ dawn --html -F my_report.html my_rails_blog_ecommerce
-
-   -r, --rails          force dawn to consider the target a rails application
-   -s, --sinatra        force dawn to consider the target a sinatra application
-   -p, --padrino        force dawn to consider the target a padrino application
-   -G, --gem-lock       force dawn to scan only for vulnerabilities affecting dependencies in Gemfile.lock
-   -a, --ascii-tabular-report   cause dawn to format findings using table in ascii art
-   -j, --json                   cause dawn to format findings using json
-   -C, --count-only             dawn will only count vulnerabilities (useful for scripts)
-   -z, --exit-on-warn           dawn will return number of found vulnerabilities as exit code
-   -F, --file filename          tells dawn to write output to filename
-   -c, --config-file filename   tells dawn to load configuration from filename
+	$ dawn a_sinatra_webapp_directory
+	$ dawn -C the_rails_blog_engine
+	$ dawn -C --json a_sinatra_webapp_directory
+	$ dawn --ascii-tabular-report my_rails_blog_ecommerce
+	$ dawn --html -F my_report.html my_rails_blog_ecommerce
+
+   -G, --gem-lock				force dawn to scan only for vulnerabilities affecting dependencies in Gemfile.lock (DEPRECATED)
+   -d, --dependencies				force dawn to scan only for vulnerabilities affecting dependencies in Gemfile.lock
+
+Reporting
+
+   -a, --ascii-tabular-report			cause dawn to format findings using tables in ascii art (DEPRECATED)
+   -j, --json					cause dawn to format findings using json
+   -K, --console					cause dawn to format findings using plain ascii text
+   -C, --count-only				dawn will only count vulnerabilities (useful for scripts)
+   -z, --exit-on-warn				dawn will return number of found vulnerabilities as exit code
+   -F, --file filename				tells dawn to write output to filename
+   -c, --config-file filename			tells dawn to load configuration from filename
 
 Disable security check family
 
-       --disable-cve-bulletins  disable all CVE security checks
-       --disable-code-quality   disable all code quality checks
-       --disable-code-style     disable all code style checks
-       --disable-owasp-ror-cheatsheet   disable all Owasp Ruby on Rails cheatsheet checks
-       --disable-owasp-top-10           disable all Owasp Top 10 checks
+       --disable-cve-bulletins			disable all CVE security checks
+       --disable-code-quality			disable all code quality checks
+       --disable-code-style			disable all code style checks
+       --disable-owasp-ror-cheatsheet		disable all Owasp Ruby on Rails cheatsheet checks
+       --disable-owasp-top-10			disable all Owasp Top 10 checks
 
-Flags useful to query dawnscanner
+Flags useful to query Dawn
 
-       -S, --search-knowledge-base [check_name]   search check_name in the knowledge base
-           --list-knowledge-base                  list knowledge-base content
-           --list-known-families                  list security check families contained in dawn's knowledge base
-           --list-known-framework                 list ruby MVC frameworks supported by dawn
+   -S, --search-knowledge-base [check_name]	search check_name in the knowledge base
+       --list-knowledge-base			list knowledge-base content
+       --list-known-families			list security check families contained in dawn's knowledge base
+       --list-known-framework			list ruby MVC frameworks supported by dawn
+       --list-scan-registry			list past scan informations stored in scan registry 
 
 Service flags
 
-   -D, --debug                                  enters dawn debug mode
-   -V, --verbose                                the output will be more verbose
-   -v, --version                                show version information
-   -h, --help                                   show this help
+   -D, --debug					enters dawn debug mode
+   -V, --verbose				the output will be more verbose
+   -v, --version				show version information
+   -h, --help					show this help
 ```
 
 ### Rake task

data/Rakefile

@@ -8,7 +8,6 @@ require 'cucumber/rake/task'
 require 'fileutils'
 require "dawn/utils"
 require "dawn/knowledge_base"
-require "dawn/knowledge_base_experimental"
 
 Cucumber::Rake::Task.new(:features) do |t|
   t.cucumber_opts = "features --format pretty -x"
@@ -45,7 +44,7 @@ namespace :version do
       f.puts("module Dawn")
 
       puts "#{branch_name}|"
-      if branch_name != "master"
+      if branch_name != "main"
         av = version.split('.')
         f.puts "    VERSION = \"#{av[0]}.#{av[1]}.#{commit_hash.chop}\""
         f.puts "    CODENAME = \"#{codename.lstrip!.chop}\""
@@ -63,214 +62,6 @@ namespace :version do
   end
 end
 
-# namespace :check do
-# desc "Create a dependency check"
-# task :dependency, :name do |t, args|
-# end
-
-# end
-desc "Create a new CVE test"
-task :cve, :name do |t,args|
-  name      = args.name
-  SRC_DIR   = "./lib/dawn/kb/"
-  SPEC_DIR  = "./spec/lib/kb/"
-
-  raise "### It seems that #{name} is already in Dawn knowledge base" unless Dawn::KnowledgeBase.find(nil, name).nil?
-  raise "### Invalid CVE title: #{name}" if name.nil? or name.empty? or /CVE-\d{4}-\d{4}/.match(name).nil?
-  raise "### No target directory: #{SRC_DIR}" unless Dir.exists?(SRC_DIR)
-  raise "### No rspec directory: #{SPEC_DIR}" unless Dir.exists?(SPEC_DIR)
-
-  puts "Adding #{name} to knowledge base..."
-
-  rb_filename = SRC_DIR+name.downcase.gsub("-", "_")+".rb"
-  spec_filename = SPEC_DIR+name.downcase.gsub("-", "_")+"_spec.rb"
-  class_name = name.gsub("-", "_")
-
-  open(rb_filename, "w") do |file|
-    file.puts "module Dawn"
-    file.puts "\t\tmodule Kb"
-    file.puts "\t\t\t# Automatically created with rake on #{Time.now.strftime('%Y-%m-%d')}"
-    file.puts "\t\t\tclass #{class_name}"
-    file.puts "\t\t\t\t# Include the testing skeleton for this CVE"
-    file.puts "\t\t\t\t# include PatternMatchCheck"
-    file.puts "\t\t\t\t# include DependencyCheck"
-    file.puts "\t\t\t\t# include RubyVersionCheck"
-    file.puts ""
-    file.puts "\t\t\t\tdef initialize"
-    file.puts "\t\t\t\t\ttitle   = \"\""
-    file.puts "\t\t\t\t\tmessage = \"\""
-    file.puts "\t\t\t\tend"
-    file.puts "\t\t\tend"
-    file.puts "\t\tend"
-    file.puts "end"
-  end
-  puts "#{rb_filename} created"
-
-  open(spec_filename, "w") do |file|
-    file.puts "require 'spec_helper'"
-
-    file.puts "describe \"The #{name} vulnerability\" do"
-    file.puts "\tbefore(:all) do"
-    file.puts "\t\t@check = Dawn::Kb::#{class_name}.new"
-    file.puts "\t\t# @check.debug = true"
-    file.puts "\tend"
-    file.puts "\tit \"is reported when the vulnerable gem is detected\" do"
-    file.puts "\t\t@check.dependencies = [{:name=>\"\", :version=>\"\"}]"
-    file.puts "\t\texpect(@check.vuln?).to   eq(true)"
-    file.puts "\tend"
-    file.puts "\tit \"is not reported when a fixed release is detected\" do"
-    file.puts "\t\t@check.dependencies = [{:name=>\"\", :version=>\"\"}]"
-    file.puts "\t\texpect(@check.vuln?).to   eq(false)"
-    file.puts "\tend"
-    file.puts "end"
-  end
-  puts "#{spec_filename} created"
-
-  puts "*** PLEASE IMPLEMENT TEST FOR #{name} IN ./spec/lib/dawn/codesake_knowledgebase_spec.rb in order to reflect changes"
-  puts "*** PLEASE ADD THIS CODE IN ./lib/dawn/knowledge_base.rb in order to reflect changes"
-  puts "require \"dawn/kb/#{class_name.downcase}\""
-  puts "it \"must have test for #{name}\" do"
-  puts "  sc = kb.find(\"#{name}\")"
-  puts "  expect(sc).not_to   be_nil"
-  puts "  expect(sc.class).to eq(Dawn::Kb::#{class_name})"
-  puts "end"
-
-
-end
-
-desc "Create a new OSVDB security check"
-task :osvdb, :name do |t,args|
-  name      = args.name
-  SRC_DIR   = "./lib/dawn/kb/"
-  SPEC_DIR  = "./spec/lib/kb/"
-
-  raise "### It seems that #{name} is already in Dawn knowledge base" unless Dawn::KnowledgeBase.find(nil, name).nil?
-  raise "### Invalid OSVDB identifier: #{name}" if name.nil? or name.empty? or /\d{6}/.match(name).nil?
-  raise "### No target directory: #{SRC_DIR}" unless Dir.exists?(SRC_DIR)
-  raise "### No rspec directory: #{SPEC_DIR}" unless Dir.exists?(SPEC_DIR)
-
-  puts "Adding #{name} to knowledge base..."
-
-  name = "OSVDB_"+name
-
-  rb_filename = SRC_DIR+name.downcase.gsub("-", "_")+".rb"
-  spec_filename = SPEC_DIR+name.downcase.gsub("-", "_")+"_spec.rb"
-  class_name = name.gsub("-", "_")
-
-  open(rb_filename, "w") do |file|
-    file.puts "module Dawn"
-    file.puts "\t\tmodule Kb"
-    file.puts "\t\t\t# Automatically created with rake on #{Time.now.strftime('%Y-%m-%d')}"
-    file.puts "\t\t\tclass #{class_name}"
-    file.puts "\t\t\t\t# Include the testing skeleton for this Security Check"
-    file.puts "\t\t\t\t# include PatternMatchCheck"
-    file.puts "\t\t\t\t# include DependencyCheck"
-    file.puts "\t\t\t\t# include RubyVersionCheck"
-    file.puts ""
-    file.puts "\t\t\t\tdef initialize"
-    file.puts "\t\t\t\t\ttitle   = \"\""
-    file.puts "\t\t\t\t\tmessage = \"\""
-    file.puts "\t\t\t\tend"
-    file.puts "\t\t\tend"
-    file.puts "\t\tend"
-    file.puts "end"
-  end
-  puts "#{rb_filename} created"
-
-  open(spec_filename, "w") do |file|
-    file.puts "require 'spec_helper'"
-
-    file.puts "describe \"The #{name} vulnerability\" do"
-    file.puts "\tbefore(:all) do"
-    file.puts "\t\t@check = Dawn::Kb::#{class_name}.new"
-    file.puts "\t\t# @check.debug = true"
-    file.puts "\tend"
-    file.puts "\tit \"is reported when the vulnerable gem is detected\" do"
-    file.puts "\t\t@check.dependencies = [{:name=>\"\", :version=>\"\"}]"
-    file.puts "\t\texpect(@check.vuln?).to   eq(true)"
-    file.puts "\tend"
-    file.puts "\tit \"is not reported when a fixed release is detected\" do"
-    file.puts "\t\t@check.dependencies = [{:name=>\"\", :version=>\"\"}]"
-    file.puts "\t\texpect(@check.vuln?).to   eq(false)"
-    file.puts "\tend"
-    file.puts "end"
-  end
-  puts "#{spec_filename} created"
-
-
-  puts "*** PLEASE IMPLEMENT TEST FOR #{name} IN ./spec/lib/dawn/codesake_knowledgebase_spec.rb in order to reflect changes"
-  puts "*** PLEASE ADD THIS CODE IN ./lib/dawn/knowledge_base.rb in order to reflect changes"
-  puts "require \"dawn/kb/#{class_name.downcase}\""
-  puts "it \"must have test for #{name}\" do"
-  puts "  sc = kb.find(\"#{name}\")"
-  puts "  expect(sc).not_to   be_nil"
-  puts "  expect(sc.class).to eq(Dawn::Kb::#{class_name})"
-  puts "end"
-
-end
-
-
-
-desc "Create a new Generic security check"
-task :check, :name do |t,args|
-  name      = args.name
-  SRC_DIR   = "./lib/dawn/kb/"
-  SPEC_DIR  = "./spec/lib/kb/"
-
-  raise "### It seems that #{name} is already in Dawn knowledge base" unless Dawn::KnowledgeBase.find(nil, name).nil?
-  raise "### No target directory: #{SRC_DIR}" unless Dir.exists?(SRC_DIR)
-  raise "### No rspec directory: #{SPEC_DIR}" unless Dir.exists?(SPEC_DIR)
-
-  puts "Adding #{name} to knowledge base..."
-
-  rb_filename = SRC_DIR+name.downcase.gsub("-", "_")+".rb"
-  spec_filename = SPEC_DIR+name.downcase.gsub("-", "_")+"_spec.rb"
-  class_name = name.gsub("-", "_")
-
-  open(rb_filename, "w") do |file|
-    file.puts "module Dawn"
-    file.puts "\t\tmodule Kb"
-    file.puts "\t\t\t# Automatically created with rake on #{Time.now.strftime('%Y-%m-%d')}"
-    file.puts "\t\t\tclass #{class_name}"
-    file.puts "\t\t\t\t# Include the testing skeleton for this Security Check"
-    file.puts "\t\t\t\t# include PatternMatchCheck"
-    file.puts "\t\t\t\t# include DependencyCheck"
-    file.puts "\t\t\t\t# include RubyVersionCheck"
-    file.puts ""
-    file.puts "\t\t\t\tdef initialize"
-    file.puts "\t\t\t\tend"
-    file.puts "\t\t\tend"
-    file.puts "\t\tend"
-    file.puts "end"
-  end
-  puts "#{rb_filename} created"
-
-  open(spec_filename, "w") do |file|
-    file.puts "require 'spec_helper'"
-
-    file.puts "describe \"The #{name} vulnerability\" do"
-    file.puts "\tbefore(:all) do"
-    file.puts "\t\t@check = Dawn::Kb::#{class_name}.new"
-    file.puts "\t\t# @check.debug = true"
-    file.puts "\tend"
-    file.puts "\tit \"is reported when...\""
-    file.puts "end"
-  end
-  puts "#{spec_filename} created"
-
-
-  puts "*** PLEASE IMPLEMENT TEST FOR #{name} IN ./spec/lib/dawn/codesake_knowledgebase_spec.rb in order to reflect changes"
-  puts "*** PLEASE ADD THIS CODE IN ./lib/dawn/knowledge_base.rb in order to reflect changes"
-  puts "require \"dawn/kb/#{class_name.downcase}\""
-  puts "it \"must have test for #{name}\" do"
-  puts "  sc = kb.find(\"#{name}\")"
-  puts "  sc.should_not   be_nil"
-  puts "  sc.class.should == Dawn::Kb::#{class_name}"
-  puts "end"
-
-
-end
-
 namespace :kb do
   desc 'Check information lint'
   task :lint do
@@ -283,27 +74,8 @@ namespace :kb do
   desc 'Pack the library for shipping'
 
   task :pack do
-    YAML_KB = File.join(Dir.pwd, 'db')
-    __kb_pack
-  end
-
-  desc 'Transform all checks to YAML file and pack the library for shipping'
-  task :to_yaml do
-    YAML_KB = File.join(Dir.pwd, 'db')
-    FileUtils.rm_rf YAML_KB
-    FileUtils.mkdir_p YAML_KB
-
-    Dawn::KnowledgeBase.new.all.each do |check|
-      out_dir = File.join(YAML_KB, check.check_family.to_s)
-      FileUtils.mkdir_p(out_dir) unless Dir.exists? out_dir
-
-      filename = File.join(out_dir, check.name.gsub(" ", "_").gsub("-", "_") + '.yml')
-      open(filename, 'w') do |f|
-        f.puts(check.to_yaml)
-      end
-      puts "#{filename} created"
-    end
-
+    YAML_KB = File.join(Dir.home, "dawnscanner", 'db')
+    FileUtils.mkdir_p(YAML_KB)
     __kb_pack
   end
 
@@ -393,50 +165,46 @@ end
 
 def __kb_pack
   if Dir.exists? "#{YAML_KB}/bulletin"
-    system "tar cfvz #{YAML_KB}/bulletin.tar.gz #{YAML_KB}/bulletin"
+    system "tar cfvz #{YAML_KB}/bulletin.tar.gz -C #{YAML_KB} bulletin"
     system "rm -rf #{YAML_KB}/bulletin"
     system "shasum -a 256 #{YAML_KB}/bulletin.tar.gz > #{YAML_KB}/bulletin.tar.gz.sig"
   end
 
   if Dir.exists? "#{YAML_KB}/generic_check"
-    system "tar cfvz #{YAML_KB}/generic_check.tar.gz #{YAML_KB}/generic_check"
+    system "tar cfvz #{YAML_KB}/generic_check.tar.gz -C #{YAML_KB} generic_check"
     system "rm -rf #{YAML_KB}/generic_check"
     system "shasum -a 256 #{YAML_KB}/generic_check.tar.gz > #{YAML_KB}/generic_check.tar.gz.sig"
   end
 
   if Dir.exists? "#{YAML_KB}/owasp_ror_cheatsheet"
-    system "tar cfvz #{YAML_KB}/owasp_ror_cheatsheet.tar.gz #{YAML_KB}/owasp_ror_cheatsheet"
+    system "tar cfvz #{YAML_KB}/owasp_ror_cheatsheet.tar.gz -C #{YAML_KB} owasp_ror_cheatsheet"
     system "rm -rf #{YAML_KB}/owasp_ror_cheatsheet"
     system "shasum -a 256 #{YAML_KB}/owasp_ror_cheatsheet.tar.gz > #{YAML_KB}/owasp_ror_cheatsheet.tar.gz.sig"
   end
 
   if Dir.exists? "#{YAML_KB}/code_style"
-    system "tar cfvz #{YAML_KB}/code_style.tar.gz #{YAML_KB}/code_style"
+    system "tar cfvz #{YAML_KB}/code_style.tar.gz -C #{YAML_KB} code_style"
     system "rm -rf #{YAML_KB}/code_style"
     system "shasum -a 256 #{YAML_KB}/code_style.tar.gz > #{YAML_KB}/code_style.tar.gz.sig"
   end
   if Dir.exists? "#{YAML_KB}/code_quality"
-    system "tar cfvz #{YAML_KB}/code_quality.tar.gz #{YAML_KB}/code_quality"
+    system "tar cfvz #{YAML_KB}/code_quality.tar.gz -C #{YAML_KB} code_quality"
     system "rm -rf #{YAML_KB}/code_quality"
     system "shasum -a 256 #{YAML_KB}/code_quality.tar.gz > #{YAML_KB}/code_quality.tar.gz.sig"
   end
   if Dir.exists? "#{YAML_KB}/owasp_top_10"
-    system "tar cfvz #{YAML_KB}/owasp_top_10.tar.gz #{YAML_KB}/owasp_top_10"
+    system "tar cfvz #{YAML_KB}/owasp_top_10.tar.gz -C #{YAML_KB} owasp_top_10"
     system "rm -rf #{YAML_KB}/owasp_top_10"
     system "shasum -a 256 #{YAML_KB}/owasp_top_10.tar.gz > #{YAML_KB}/owasp_top_10.tar.gz.sig"
   end
 
 
   open(File.join(YAML_KB, "kb.yaml"), 'w') do |f|
-    f.puts(Dawn::KnowledgeBaseExperimental.kb_descriptor)
+    f.puts(Dawn::KnowledgeBase.kb_descriptor)
   end
   puts "kb.yaml created"
   system "shasum -a 256 #{YAML_KB}/kb.yaml > #{YAML_KB}/kb.yaml.sig"
 
-  system "tar cfvz #{YAML_KB}/signatures.tar.gz #{YAML_KB}/*.tar.gz.sig"
-  system "rm -rf #{YAML_KB}/*.tar.gz.sig "
-  puts "#{YAML_KB}/signatures.tar.gz created"
-
   puts "Library ready to be shipped"
 
 end