gem_guard 0.1.6 → 0.1.10
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +316 -33
- data/SECURITY.md +46 -2
- data/lib/gem_guard/analyzer.rb +4 -1
- data/lib/gem_guard/cli.rb +250 -9
- data/lib/gem_guard/config.rb +193 -0
- data/lib/gem_guard/parser.rb +3 -1
- data/lib/gem_guard/typosquat_checker.rb +157 -0
- data/lib/gem_guard/version.rb +1 -1
- data/lib/gem_guard/vulnerability_fetcher.rb +25 -1
- data/lib/gem_guard.rb +2 -0
- data/templates/circleci-config.yml +107 -0
- data/templates/github-actions.yml +85 -0
- data/templates/gitlab-ci.yml +112 -0
- data/test_nokogiri.lock +13 -0
- metadata +8 -3
- data/gem_guard-0.1.0.gem +0 -0
|
@@ -0,0 +1,107 @@
|
|
|
1
|
+
# CircleCI configuration for GemGuard security scanning
|
|
2
|
+
# Copy this content to .circleci/config.yml in your repository
|
|
3
|
+
|
|
4
|
+
version: 2.1
|
|
5
|
+
|
|
6
|
+
orbs:
|
|
7
|
+
ruby: circleci/ruby@2.1.0
|
|
8
|
+
|
|
9
|
+
jobs:
|
|
10
|
+
security-scan:
|
|
11
|
+
docker:
|
|
12
|
+
- image: cimg/ruby:3.3
|
|
13
|
+
parameters:
|
|
14
|
+
ruby-version:
|
|
15
|
+
type: string
|
|
16
|
+
default: "3.3"
|
|
17
|
+
steps:
|
|
18
|
+
- checkout
|
|
19
|
+
|
|
20
|
+
- ruby/install-deps:
|
|
21
|
+
bundler-version: "2.4.0"
|
|
22
|
+
|
|
23
|
+
- run:
|
|
24
|
+
name: Install GemGuard
|
|
25
|
+
command: gem install gem_guard
|
|
26
|
+
|
|
27
|
+
- run:
|
|
28
|
+
name: Run vulnerability scan
|
|
29
|
+
command: |
|
|
30
|
+
echo "Running GemGuard security scan..."
|
|
31
|
+
gem_guard scan --format json --output security-report.json
|
|
32
|
+
gem_guard scan --format table
|
|
33
|
+
|
|
34
|
+
- run:
|
|
35
|
+
name: Generate SBOM
|
|
36
|
+
command: |
|
|
37
|
+
echo "Generating Software Bill of Materials..."
|
|
38
|
+
gem_guard sbom --format spdx --output sbom-spdx.json
|
|
39
|
+
gem_guard sbom --format cyclone-dx --output sbom-cyclone.json
|
|
40
|
+
|
|
41
|
+
- store_artifacts:
|
|
42
|
+
path: security-report.json
|
|
43
|
+
destination: security-reports/
|
|
44
|
+
|
|
45
|
+
- store_artifacts:
|
|
46
|
+
path: sbom-spdx.json
|
|
47
|
+
destination: sbom/
|
|
48
|
+
|
|
49
|
+
- store_artifacts:
|
|
50
|
+
path: sbom-cyclone.json
|
|
51
|
+
destination: sbom/
|
|
52
|
+
|
|
53
|
+
- run:
|
|
54
|
+
name: Check for vulnerabilities
|
|
55
|
+
command: |
|
|
56
|
+
if [ -f security-report.json ]; then
|
|
57
|
+
VULN_COUNT=$(ruby -rjson -e "puts JSON.parse(File.read('security-report.json'))['vulnerabilities']&.length || 0")
|
|
58
|
+
echo "Found $VULN_COUNT vulnerabilities"
|
|
59
|
+
|
|
60
|
+
if [ "$VULN_COUNT" -gt 0 ]; then
|
|
61
|
+
echo "⚠️ Vulnerabilities detected! Check the artifacts for details."
|
|
62
|
+
exit 1
|
|
63
|
+
else
|
|
64
|
+
echo "✅ No vulnerabilities found!"
|
|
65
|
+
fi
|
|
66
|
+
fi
|
|
67
|
+
|
|
68
|
+
security-scan-matrix:
|
|
69
|
+
docker:
|
|
70
|
+
- image: cimg/ruby:<< parameters.ruby-version >>
|
|
71
|
+
parameters:
|
|
72
|
+
ruby-version:
|
|
73
|
+
type: string
|
|
74
|
+
steps:
|
|
75
|
+
- checkout
|
|
76
|
+
- ruby/install-deps
|
|
77
|
+
- run:
|
|
78
|
+
name: Install GemGuard
|
|
79
|
+
command: gem install gem_guard
|
|
80
|
+
- run:
|
|
81
|
+
name: Security scan for Ruby << parameters.ruby-version >>
|
|
82
|
+
command: |
|
|
83
|
+
gem_guard scan --format json --output security-report-<< parameters.ruby-version >>.json
|
|
84
|
+
gem_guard scan
|
|
85
|
+
- store_artifacts:
|
|
86
|
+
path: security-report-<< parameters.ruby-version >>.json
|
|
87
|
+
|
|
88
|
+
workflows:
|
|
89
|
+
security-checks:
|
|
90
|
+
jobs:
|
|
91
|
+
- security-scan:
|
|
92
|
+
name: security-scan-main
|
|
93
|
+
|
|
94
|
+
security-matrix:
|
|
95
|
+
jobs:
|
|
96
|
+
- security-scan-matrix:
|
|
97
|
+
matrix:
|
|
98
|
+
parameters:
|
|
99
|
+
ruby-version: ["3.1", "3.2", "3.3"]
|
|
100
|
+
name: security-scan-ruby-<< matrix.ruby-version >>
|
|
101
|
+
triggers:
|
|
102
|
+
- schedule:
|
|
103
|
+
cron: "0 2 * * *" # Daily at 2 AM UTC
|
|
104
|
+
filters:
|
|
105
|
+
branches:
|
|
106
|
+
only:
|
|
107
|
+
- main
|
|
@@ -0,0 +1,85 @@
|
|
|
1
|
+
# GitHub Actions workflow for GemGuard security scanning
|
|
2
|
+
# Copy this file to .github/workflows/gemguard.yml in your repository
|
|
3
|
+
|
|
4
|
+
name: Security Scan with GemGuard
|
|
5
|
+
|
|
6
|
+
on:
|
|
7
|
+
push:
|
|
8
|
+
branches: [ main, develop ]
|
|
9
|
+
pull_request:
|
|
10
|
+
branches: [ main ]
|
|
11
|
+
schedule:
|
|
12
|
+
# Run daily at 2 AM UTC
|
|
13
|
+
- cron: '0 2 * * *'
|
|
14
|
+
|
|
15
|
+
jobs:
|
|
16
|
+
security-scan:
|
|
17
|
+
runs-on: ubuntu-latest
|
|
18
|
+
|
|
19
|
+
strategy:
|
|
20
|
+
matrix:
|
|
21
|
+
ruby-version: ['3.1', '3.2', '3.3']
|
|
22
|
+
|
|
23
|
+
steps:
|
|
24
|
+
- uses: actions/checkout@v4
|
|
25
|
+
|
|
26
|
+
- name: Set up Ruby ${{ matrix.ruby-version }}
|
|
27
|
+
uses: ruby/setup-ruby@v1
|
|
28
|
+
with:
|
|
29
|
+
ruby-version: ${{ matrix.ruby-version }}
|
|
30
|
+
bundler-cache: true
|
|
31
|
+
|
|
32
|
+
- name: Install GemGuard
|
|
33
|
+
run: gem install gem_guard
|
|
34
|
+
|
|
35
|
+
- name: Run GemGuard vulnerability scan
|
|
36
|
+
run: |
|
|
37
|
+
gem_guard scan --format json --output security-report.json
|
|
38
|
+
gem_guard scan --format table
|
|
39
|
+
|
|
40
|
+
- name: Generate SBOM
|
|
41
|
+
run: |
|
|
42
|
+
gem_guard sbom --format spdx --output sbom-spdx.json
|
|
43
|
+
gem_guard sbom --format cyclone-dx --output sbom-cyclone.json
|
|
44
|
+
|
|
45
|
+
- name: Upload security artifacts
|
|
46
|
+
uses: actions/upload-artifact@v4
|
|
47
|
+
if: always()
|
|
48
|
+
with:
|
|
49
|
+
name: security-reports-ruby-${{ matrix.ruby-version }}
|
|
50
|
+
path: |
|
|
51
|
+
security-report.json
|
|
52
|
+
sbom-spdx.json
|
|
53
|
+
sbom-cyclone.json
|
|
54
|
+
retention-days: 30
|
|
55
|
+
|
|
56
|
+
- name: Comment PR with security report
|
|
57
|
+
if: github.event_name == 'pull_request'
|
|
58
|
+
uses: actions/github-script@v7
|
|
59
|
+
with:
|
|
60
|
+
script: |
|
|
61
|
+
const fs = require('fs');
|
|
62
|
+
try {
|
|
63
|
+
const report = fs.readFileSync('security-report.json', 'utf8');
|
|
64
|
+
const data = JSON.parse(report);
|
|
65
|
+
|
|
66
|
+
if (data.vulnerabilities && data.vulnerabilities.length > 0) {
|
|
67
|
+
const comment = `## 🚨 Security Vulnerabilities Found
|
|
68
|
+
|
|
69
|
+
GemGuard detected ${data.vulnerabilities.length} vulnerabilities in this PR.
|
|
70
|
+
|
|
71
|
+
Please review the security report artifact for details.
|
|
72
|
+
|
|
73
|
+
**High/Critical vulnerabilities:** ${data.high_severity_count || 0}
|
|
74
|
+
`;
|
|
75
|
+
|
|
76
|
+
github.rest.issues.createComment({
|
|
77
|
+
issue_number: context.issue.number,
|
|
78
|
+
owner: context.repo.owner,
|
|
79
|
+
repo: context.repo.repo,
|
|
80
|
+
body: comment
|
|
81
|
+
});
|
|
82
|
+
}
|
|
83
|
+
} catch (error) {
|
|
84
|
+
console.log('No security report found or error reading report');
|
|
85
|
+
}
|
|
@@ -0,0 +1,112 @@
|
|
|
1
|
+
# GitLab CI configuration for GemGuard security scanning
|
|
2
|
+
# Copy this content to your .gitlab-ci.yml file
|
|
3
|
+
|
|
4
|
+
stages:
|
|
5
|
+
- security
|
|
6
|
+
- report
|
|
7
|
+
|
|
8
|
+
variables:
|
|
9
|
+
BUNDLE_PATH: vendor/bundle
|
|
10
|
+
BUNDLE_JOBS: 4
|
|
11
|
+
BUNDLE_RETRY: 3
|
|
12
|
+
|
|
13
|
+
.ruby_template: &ruby_template
|
|
14
|
+
image: ruby:3.3
|
|
15
|
+
before_script:
|
|
16
|
+
- gem install bundler
|
|
17
|
+
- bundle install --path $BUNDLE_PATH
|
|
18
|
+
- gem install gem_guard
|
|
19
|
+
cache:
|
|
20
|
+
key: gems-$CI_COMMIT_REF_SLUG
|
|
21
|
+
paths:
|
|
22
|
+
- vendor/bundle/
|
|
23
|
+
|
|
24
|
+
security_scan:
|
|
25
|
+
<<: *ruby_template
|
|
26
|
+
stage: security
|
|
27
|
+
script:
|
|
28
|
+
- echo "Running GemGuard security scan..."
|
|
29
|
+
- gem_guard scan --format json --output security-report.json
|
|
30
|
+
- gem_guard scan --format table
|
|
31
|
+
- echo "Generating SBOM..."
|
|
32
|
+
- gem_guard sbom --format spdx --output sbom-spdx.json
|
|
33
|
+
- gem_guard sbom --format cyclone-dx --output sbom-cyclone.json
|
|
34
|
+
artifacts:
|
|
35
|
+
reports:
|
|
36
|
+
# GitLab security report format (if you want to convert)
|
|
37
|
+
dependency_scanning: security-report.json
|
|
38
|
+
paths:
|
|
39
|
+
- security-report.json
|
|
40
|
+
- sbom-spdx.json
|
|
41
|
+
- sbom-cyclone.json
|
|
42
|
+
expire_in: 30 days
|
|
43
|
+
when: always
|
|
44
|
+
allow_failure: false
|
|
45
|
+
only:
|
|
46
|
+
- main
|
|
47
|
+
- develop
|
|
48
|
+
- merge_requests
|
|
49
|
+
|
|
50
|
+
security_scan_ruby_3_1:
|
|
51
|
+
<<: *ruby_template
|
|
52
|
+
image: ruby:3.1
|
|
53
|
+
stage: security
|
|
54
|
+
script:
|
|
55
|
+
- gem_guard scan --format json --output security-report-ruby31.json
|
|
56
|
+
- gem_guard scan
|
|
57
|
+
artifacts:
|
|
58
|
+
paths:
|
|
59
|
+
- security-report-ruby31.json
|
|
60
|
+
expire_in: 7 days
|
|
61
|
+
only:
|
|
62
|
+
- schedules
|
|
63
|
+
|
|
64
|
+
security_scan_ruby_3_2:
|
|
65
|
+
<<: *ruby_template
|
|
66
|
+
image: ruby:3.2
|
|
67
|
+
stage: security
|
|
68
|
+
script:
|
|
69
|
+
- gem_guard scan --format json --output security-report-ruby32.json
|
|
70
|
+
- gem_guard scan
|
|
71
|
+
artifacts:
|
|
72
|
+
paths:
|
|
73
|
+
- security-report-ruby32.json
|
|
74
|
+
expire_in: 7 days
|
|
75
|
+
only:
|
|
76
|
+
- schedules
|
|
77
|
+
|
|
78
|
+
# Optional: Create a summary report
|
|
79
|
+
security_report:
|
|
80
|
+
stage: report
|
|
81
|
+
image: alpine:latest
|
|
82
|
+
before_script:
|
|
83
|
+
- apk add --no-cache jq
|
|
84
|
+
script:
|
|
85
|
+
- |
|
|
86
|
+
echo "## Security Scan Summary" > security-summary.md
|
|
87
|
+
echo "" >> security-summary.md
|
|
88
|
+
if [ -f security-report.json ]; then
|
|
89
|
+
VULN_COUNT=$(jq '.vulnerabilities | length' security-report.json)
|
|
90
|
+
HIGH_COUNT=$(jq '.high_severity_count // 0' security-report.json)
|
|
91
|
+
echo "- **Total vulnerabilities found:** $VULN_COUNT" >> security-summary.md
|
|
92
|
+
echo "- **High/Critical severity:** $HIGH_COUNT" >> security-summary.md
|
|
93
|
+
echo "" >> security-summary.md
|
|
94
|
+
|
|
95
|
+
if [ "$VULN_COUNT" -gt 0 ]; then
|
|
96
|
+
echo "⚠️ **Action required:** Please review and address the identified vulnerabilities." >> security-summary.md
|
|
97
|
+
else
|
|
98
|
+
echo "✅ **No vulnerabilities found!**" >> security-summary.md
|
|
99
|
+
fi
|
|
100
|
+
else
|
|
101
|
+
echo "❌ **Error:** Security report not found." >> security-summary.md
|
|
102
|
+
fi
|
|
103
|
+
cat security-summary.md
|
|
104
|
+
artifacts:
|
|
105
|
+
paths:
|
|
106
|
+
- security-summary.md
|
|
107
|
+
expire_in: 30 days
|
|
108
|
+
dependencies:
|
|
109
|
+
- security_scan
|
|
110
|
+
only:
|
|
111
|
+
- main
|
|
112
|
+
- develop
|
data/test_nokogiri.lock
ADDED
metadata
CHANGED
|
@@ -1,14 +1,14 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: gem_guard
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version: 0.1.
|
|
4
|
+
version: 0.1.10
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- Wilbur Suero
|
|
8
8
|
autorequire:
|
|
9
9
|
bindir: exe
|
|
10
10
|
cert_chain: []
|
|
11
|
-
date: 2025-08-
|
|
11
|
+
date: 2025-08-10 00:00:00.000000000 Z
|
|
12
12
|
dependencies:
|
|
13
13
|
- !ruby/object:Gem::Dependency
|
|
14
14
|
name: thor
|
|
@@ -96,17 +96,22 @@ files:
|
|
|
96
96
|
- Rakefile
|
|
97
97
|
- SECURITY.md
|
|
98
98
|
- exe/gem_guard
|
|
99
|
-
- gem_guard-0.1.0.gem
|
|
100
99
|
- gem_guard.gemspec
|
|
101
100
|
- lib/gem_guard.rb
|
|
102
101
|
- lib/gem_guard/analyzer.rb
|
|
103
102
|
- lib/gem_guard/cli.rb
|
|
103
|
+
- lib/gem_guard/config.rb
|
|
104
104
|
- lib/gem_guard/parser.rb
|
|
105
105
|
- lib/gem_guard/reporter.rb
|
|
106
106
|
- lib/gem_guard/sbom_generator.rb
|
|
107
|
+
- lib/gem_guard/typosquat_checker.rb
|
|
107
108
|
- lib/gem_guard/version.rb
|
|
108
109
|
- lib/gem_guard/vulnerability_fetcher.rb
|
|
109
110
|
- plan.md
|
|
111
|
+
- templates/circleci-config.yml
|
|
112
|
+
- templates/github-actions.yml
|
|
113
|
+
- templates/gitlab-ci.yml
|
|
114
|
+
- test_nokogiri.lock
|
|
110
115
|
homepage: https://github.com/wilburhimself/gem_guard
|
|
111
116
|
licenses:
|
|
112
117
|
- MIT
|
data/gem_guard-0.1.0.gem
DELETED
|
Binary file
|