@m2-ai/lattice-cli 0.0.0-stage → 0.8.7

package/dist/security-runtime/src/checks/deps-vuln/index.mjs

@@ -0,0 +1,305 @@
+// deps-vuln (REQ-008, REQ-009): OSV-Scanner over every supported lockfile and manifest, then CISA KEV and FIRST EPSS enrichment.
+// Reads lockfiles only. Never runs package managers (--no-resolve) and never installs anything.
+import fs from 'node:fs';
+import path from 'node:path';
+import { osvExcludeArgs } from '../_lib/osv.mjs';
+
+export const id = 'deps-vuln';
+export const title = 'Dependency vulnerabilities and known-malicious packages';
+export const modes = ['scan', 'deep', 'release'];
+export const requiredIn = ['scan', 'deep', 'release'];
+export const timeoutSec = 600;
+
+export const KEV_URL = 'https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json';
+export const EPSS_URL = 'https://api.first.org/data/v1/epss';
+const DAY = 24 * 60 * 60 * 1000;
+const EPSS_BATCH = 100;
+const REQUIREMENTS = /^requirements.*\.txt$/;
+const base = (f) => f.slice(f.lastIndexOf('/') + 1);
+
+export function applies(ctx) {
+  const d = ctx.detection;
+  const manifests = (d.manifests ?? []).filter((m) => REQUIREMENTS.test(base(m)) || ['go.mod', 'pom.xml'].includes(base(m)));
+  return d.lockfiles.length > 0 || manifests.length > 0
+    ? true
+    : { applies: false, reason: 'no lockfile or dependency manifest that OSV-Scanner supports was found' };
+}
+
+// ---- version helpers (loose: enough to place a version inside an OSV range) ----
+function cmpVersion(a, b) {
+  const tok = (v) => String(v).toLowerCase().replace(/^v/, '').split(/[.\-+_]/).filter(Boolean);
+  const ta = tok(a);
+  const tb = tok(b);
+  for (let i = 0; i < Math.max(ta.length, tb.length); i++) {
+    const x = ta[i] ?? '0';
+    const y = tb[i] ?? '0';
+    const nx = /^\d+$/.test(x);
+    const ny = /^\d+$/.test(y);
+    if (nx && ny) { if (Number(x) !== Number(y)) return Number(x) - Number(y); } else if (nx !== ny) return nx ? 1 : -1; else if (x !== y) return x < y ? -1 : 1;
+  }
+  return 0;
+}
+
+/** Fixed versions from the ranges that contain the installed version. */
+export function fixedVersions(vuln, pkg) {
+  const fixed = new Set();
+  for (const a of vuln?.affected ?? []) {
+    if (a.package?.name?.toLowerCase() !== pkg.name.toLowerCase() || (a.package?.ecosystem && a.package.ecosystem !== pkg.ecosystem)) continue;
+    for (const r of a.ranges ?? []) {
+      if (r.type === 'GIT') continue;
+      let introduced = '0';
+      for (const e of r.events ?? []) {
+        if (e.introduced !== undefined) introduced = e.introduced;
+        if (e.fixed !== undefined && cmpVersion(pkg.version, e.fixed) < 0 && cmpVersion(pkg.version, introduced) >= 0) fixed.add(e.fixed);
+      }
+    }
+  }
+  return [...fixed].sort(cmpVersion);
+}
+
+const LABELS = { CRITICAL: 'critical', HIGH: 'high', MODERATE: 'medium', MEDIUM: 'medium', LOW: 'low' };
+const RANK = ['info', 'low', 'medium', 'high', 'critical'];
+function severityOf(group, vulns) {
+  const candidates = [];
+  const score = parseFloat(group.max_severity);
+  if (Number.isFinite(score)) candidates.push(score >= 9 ? 'critical' : score >= 7 ? 'high' : score >= 4 ? 'medium' : 'low');
+  for (const v of vulns) {
+    const l = LABELS[String(v.database_specific?.severity ?? '').toUpperCase()];
+    if (l) candidates.push(l);
+  }
+  return candidates.sort((a, b) => RANK.indexOf(b) - RANK.indexOf(a))[0] ?? 'medium';
+}
+
+// ---- requirements.txt ----
+const normName = (n) => n.toLowerCase().replace(/[-_.]+/g, '-');
+
+/** Returns { pinned: Set<normalized name>, unpinned: [{ name, line, text }] } for one requirements file. */
+export function parseRequirements(text) {
+  const pinned = new Set();
+  const unpinned = [];
+  text.split(/\r?\n/).forEach((raw, i) => {
+    const line = raw.replace(/\s+#.*$/, '').replace(/^#.*$/, '').trim();
+    if (!line || line.startsWith('-') || /^(https?|git\+|file:)/i.test(line) || line.includes('://')) return;
+    const m = /^([A-Za-z0-9][A-Za-z0-9._-]*)\s*(\[[^\]]*\])?\s*(.*)$/.exec(line);
+    if (!m) return;
+    const spec = m[3].split(';')[0];
+    if (/(^|,)\s*===?\s*[^,*\s]+\s*($|,)/.test(spec) && !/\*/.test(spec)) pinned.add(normName(m[1]));
+    else unpinned.push({ name: m[1], line: i + 1, text: line });
+  });
+  return { pinned, unpinned };
+}
+
+// ---- enrichment ----
+async function loadKev(ctx, notes) {
+  try {
+    const r = await ctx.cachedGet(KEV_URL, { ttlMs: DAY, retries: 2, timeoutMs: 30_000 });
+    const j = JSON.parse(r.body.toString('utf8'));
+    if (!Array.isArray(j.vulnerabilities)) throw new Error('unexpected feed shape');
+    if (r.degraded) notes.push(`CISA KEV feed was unreachable; used a cached copy ${Math.floor(r.ageMs / DAY)} day(s) old (degraded).`);
+    return { set: new Set(j.vulnerabilities.map((v) => v.cveID)), version: `${j.catalogVersion ?? 'unknown'} (${r.source})` };
+  } catch (e) {
+    notes.push(`CISA KEV enrichment skipped: ${e.message} KEV status is unknown for this run (degraded).`);
+    return null;
+  }
+}
+
+async function loadEpss(ctx, cves, notes) {
+  const scores = new Map();
+  if (!cves.length) return scores;
+  let failed = 0;
+  for (let i = 0; i < cves.length; i += EPSS_BATCH) {
+    const batch = cves.slice(i, i + EPSS_BATCH);
+    try {
+      const res = await ctx.fetch(`${EPSS_URL}?cve=${batch.join(',')}`, { retries: 2, timeoutMs: 30_000 });
+      if (!res.ok) throw new Error(`HTTP ${res.status}`);
+      const j = JSON.parse(res.body.toString('utf8'));
+      for (const row of j.data ?? []) if (Number.isFinite(Number(row.epss))) scores.set(row.cve, Number(row.epss));
+    } catch (e) { failed++; notes.push(`FIRST EPSS lookup failed for ${batch.length} CVE(s): ${e.message}`); }
+  }
+  if (failed) notes.push('EPSS scores are missing for some findings (degraded).');
+  return scores;
+}
+
+// ---- mapping ----
+const relFile = (repo, p) => path.relative(path.resolve(repo), path.resolve(p)).split(path.sep).join('/');
+const isCve = (s) => /^CVE-\d{4}-\d{4,}$/.test(s);
+
+const majorOf = (v) => /^\d+/.exec(String(v).replace(/^v/i, ''))?.[0] ?? '';
+
+/**
+ * The version to upgrade to: the lowest version that fixes every listed advisory, preferring each advisory's fix inside the installed
+ * major version. Returns { version, majorJump, unfixed (advisories with no fixed version) }.
+ */
+export function recommendFix(advisories, installed) {
+  const picks = [];
+  const unfixed = [];
+  for (const a of advisories) {
+    if (!a.fixed.length) { unfixed.push(a); continue; }
+    picks.push(a.fixed.find((v) => majorOf(v) === majorOf(installed)) ?? a.fixed[0]);
+  }
+  const version = picks.sort(cmpVersion).at(-1) ?? '';
+  return { version, majorJump: !!version && majorOf(version) !== majorOf(installed), unfixed };
+}
+
+const SEV_ORDER = ['critical', 'high', 'medium', 'low', 'info'];
+const worstOf = (sevs) => SEV_ORDER.find((s) => sevs.includes(s)) ?? 'medium';
+
+/**
+ * Maps parsed OSV-Scanner JSON to raw findings. `skip(file, pkg)` suppresses matches against guessed (unpinned) versions.
+ * One finding per ecosystem, package and version (REQ-037): every advisory, every lockfile that holds it and one recommended fix.
+ * MAL- known-malicious packages stay separate findings, one per lockfile.
+ */
+export function mapOsv(osv, repo, { skip = () => false } = {}) {
+  const findings = [];
+  const packages = new Map();
+  for (const result of osv?.results ?? []) {
+    const file = relFile(repo, result.source?.path ?? '');
+    for (const p of result.packages ?? []) {
+      const pkg = p.package;
+      if (skip(file, pkg)) continue;
+      const byId = new Map((p.vulnerabilities ?? []).map((v) => [v.id, v]));
+      const groups = p.groups?.length ? p.groups : (p.vulnerabilities ?? []).map((v) => ({ ids: [v.id], aliases: v.aliases ?? [], max_severity: '' }));
+      for (const g of groups) {
+        const ids = [...new Set(g.ids)].sort();
+        const vulns = ids.map((i) => byId.get(i)).filter(Boolean);
+        const all = [...new Set([...ids, ...(g.aliases ?? []), ...vulns.flatMap((v) => v.aliases ?? [])])].sort();
+        const malId = all.find((i) => i.startsWith('MAL-'));
+        const primary = malId ?? ids.find((i) => i.startsWith('GHSA-')) ?? ids.find(isCve) ?? ids[0];
+        const summary = vulns.map((v) => v.summary).find(Boolean) ?? '';
+        const urls = vulns.flatMap((v) => (v.references ?? []).filter((r) => r.type === 'ADVISORY' || r.type === 'ARTICLE' || r.type === 'REPORT').map((r) => r.url));
+        const where = { file, package: pkg.name, version: pkg.version, ecosystem: pkg.ecosystem };
+        if (malId) {
+          const evidence = `${pkg.name}@${pkg.version} (${pkg.ecosystem}) in ${file} matches ${ids.join(', ')}${all.length > ids.length ? ` (also ${all.filter((a) => !ids.includes(a)).join(', ')})` : ''}`;
+          findings.push({
+            category: 'malicious-package', severity: 'critical', confidence: 'high', key: malId, tool: 'osv-scanner', ruleId: malId, location: where,
+            title: `Known malicious package: ${pkg.name}@${pkg.version}`,
+            description: `${summary || 'OSV lists this package version as malicious.'} This package version is in ${file}. Treat any machine, CI runner or build that installed it as compromised.`,
+            evidence, refs: [...new Set([...all, ...urls])].slice(0, 12),
+            fix: `Remove ${pkg.name}@${pkg.version} from ${file} and its manifest, reinstall from a clean state, and rotate any secrets available to machines that installed it.`,
+          });
+          continue;
+        }
+        const k = `${pkg.ecosystem}\0${pkg.name}\0${pkg.version}`;
+        if (!packages.has(k)) packages.set(k, { pkg, files: new Set(), advisories: new Map() });
+        const entry = packages.get(k);
+        entry.files.add(file);
+        if (!entry.advisories.has(primary)) {
+          entry.advisories.set(primary, {
+            primary, ids, all, summary, urls, severity: severityOf(g, vulns), fixed: [...new Set(vulns.flatMap((v) => fixedVersions(v, pkg)))].sort(cmpVersion),
+            cwe: vulns.flatMap((v) => v.database_specific?.cwe_ids ?? []), cves: all.filter(isCve),
+          });
+        }
+      }
+    }
+  }
+  for (const { pkg, files, advisories } of packages.values()) findings.push(packageFinding(pkg, [...files].sort(), [...advisories.values()]));
+  return findings;
+}
+
+/** One finding for a package version: all its advisories, lockfiles and the single recommended upgrade. */
+function packageFinding(pkg, files, advisories) {
+  advisories.sort((a, b) => SEV_ORDER.indexOf(a.severity) - SEV_ORDER.indexOf(b.severity) || a.primary.localeCompare(b.primary));
+  const worst = worstOf(advisories.map((a) => a.severity));
+  const lead = advisories[0];
+  const { version: fixTo, majorJump, unfixed } = recommendFix(advisories, pkg.version);
+  const name = `${pkg.name}@${pkg.version}`;
+  const upgrade = fixTo
+    ? `Upgrade ${pkg.name} to ${fixTo} or later in ${files.length > 1 ? 'each of its lockfiles' : files[0]}, the lowest version that fixes ${unfixed.length ? 'every advisory that has a fix' : advisories.length === 1 ? 'the advisory' : `all ${advisories.length} advisories`}.${majorJump ? ` This is a major-version jump (${majorOf(pkg.version)}.x to ${majorOf(fixTo)}.x): read the changelog and test before merging.` : ''}${unfixed.length ? ` No fixed version is published yet for ${unfixed.map((a) => a.primary).join(', ')}.` : ''}`
+    : '';
+  // The gate blocks High only when a fix exists, so the fix field stays empty unless a High or Critical advisory is fixable.
+  const blockingFixable = advisories.some((a) => ['critical', 'high'].includes(a.severity) && a.fixed.length);
+  const policyFix = worst === 'high' && !blockingFixable ? '' : upgrade;
+  const lines = advisories.slice(0, 40).map((a) => `- ${a.primary}${a.cves.length && !a.primary.startsWith('CVE-') ? ` (${a.cves.join(', ')})` : ''} [${a.severity}]${a.summary ? ` ${a.summary}` : ''}; ${a.fixed.length ? `fixed in ${a.fixed[0]}` : 'no fixed version'}`);
+  if (advisories.length > 40) lines.push(`- and ${advisories.length - 40} more`);
+  const ids = [...new Set(advisories.flatMap((a) => [...a.ids, ...a.all]))];
+  const urls = [...new Set(advisories.flatMap((a) => a.urls))].slice(0, 12);
+  const single = advisories.length === 1;
+  return {
+    category: 'dependency-vuln', severity: worst, confidence: 'high', key: `${pkg.ecosystem}:${pkg.name}@${pkg.version}`, tool: 'osv-scanner', ruleId: lead.primary,
+    location: { file: files[0], package: pkg.name, version: pkg.version, ecosystem: pkg.ecosystem },
+    cwe: [...new Set(advisories.flatMap((a) => a.cwe))],
+    title: single ? `${name} has a known vulnerability: ${lead.primary}${lead.summary ? ` (${lead.summary})` : ''}`
+      : `${name} has ${advisories.length} known vulnerabilities (worst ${worst}): ${lead.primary} and ${advisories.length - 1} more`,
+    description: `${single ? '' : `${advisories.length} advisories, worst severity ${worst}. `}${upgrade || 'No fixed version is published yet. Replace or remove the package, or pin a patched fork.'}`,
+    evidence: `${name} (${pkg.ecosystem}) in ${files.join(', ')}\n${lines.join('\n')}`,
+    refs: [...ids, ...urls], fix: policyFix,
+    _cves: [...new Set(advisories.flatMap((a) => a.cves))],
+  };
+}
+
+function unpinnedFindings(repo, files) {
+  const out = [];
+  const pinnedByFile = new Map();
+  for (const file of files) {
+    let text;
+    try { text = fs.readFileSync(path.join(repo, file), 'utf8'); } catch { continue; }
+    const { pinned, unpinned } = parseRequirements(text);
+    pinnedByFile.set(file, { pinned, unpinned: new Set(unpinned.map((u) => normName(u.name))) });
+    if (!unpinned.length) continue;
+    out.push({
+      category: 'dependency-vuln', severity: 'medium', confidence: 'medium', key: 'unpinned-requirements', tool: 'vsg', ruleId: 'unpinned-requirements',
+      location: { file, ecosystem: 'PyPI' },
+      title: `Unpinned Python requirements in ${file} (${unpinned.length})`,
+      description: 'These requirements do not pin an exact version with ==, so vulnerabilities cannot be matched precisely and the installed version can change between builds. Vulnerability results for these packages are not reported.',
+      evidence: unpinned.map((u) => `line ${u.line}: ${u.text}`).join('\n'),
+      refs: [], fix: `Pin each requirement to an exact version with == (or use a lock file such as pip-compile or uv.lock): ${unpinned.map((u) => u.name).join(', ')}.`,
+    });
+  }
+  return { findings: out, pinnedByFile };
+}
+
+export async function run(ctx) {
+  const res = await ctx.runTool('osv-scanner', [
+    // --no-ignore: detection found these lockfiles regardless of .gitignore, so OSV must read them too (otherwise a clean result could be silent).
+    'scan', 'source', '-r', '--format', 'json', '--no-resolve', '--all-vulns', '--allow-no-lockfiles', '--no-ignore',
+    ...osvExcludeArgs(ctx),
+    '.',
+  ]);
+  if (res.status !== 'ran') return { status: 'not_run', reason: res.reason };
+  if (res.truncated) return { status: 'not_run', reason: 'OSV-Scanner output was too large to read completely.' };
+  // exit 0 = nothing found, exit 1 = vulnerabilities found. Anything else is a tool failure.
+  if (res.exitCode !== 0 && res.exitCode !== 1) {
+    const tail = res.stderr.trim().split(/\r?\n/).slice(-3).join(' | ');
+    return { status: 'not_run', reason: `OSV-Scanner failed with exit code ${res.exitCode}${tail ? `: ${tail}` : ''}. Check network access to api.osv.dev.` };
+  }
+  let osv;
+  try { osv = JSON.parse(res.stdout); } catch { return { status: 'not_run', reason: 'OSV-Scanner did not return valid JSON.' }; }
+
+  const reqFiles = (ctx.detection.manifests ?? []).filter((m) => REQUIREMENTS.test(base(m)));
+  const { findings: unpinned, pinnedByFile } = unpinnedFindings(ctx.repo, reqFiles);
+  // OSV reads an unpinned requirement such as "flask>=2.0" as version 2.0; that match is a guess, so it is not reported.
+  const skip = (file, pkg) => pkg.ecosystem === 'PyPI' && pinnedByFile.has(file) && !pinnedByFile.get(file).pinned.has(normName(pkg.name));
+  const findings = [...mapOsv(osv, ctx.repo, { skip }), ...unpinned];
+
+  const notes = [];
+  const cves = [...new Set(findings.flatMap((f) => f._cves ?? []))];
+  const dataVersions = {};
+  if (cves.length) {
+    const kev = await loadKev(ctx, notes);
+    const epss = await loadEpss(ctx, cves, notes);
+    if (kev) dataVersions.kev = kev.version;
+    dataVersions.epss = epss.size ? `${epss.size}/${cves.length} CVEs scored` : 'none';
+    for (const f of findings) {
+      if (!f._cves) continue;
+      const scores = f._cves.map((c) => epss.get(c)).filter((s) => s !== undefined);
+      f.exploited = { kev: !!kev && f._cves.some((c) => kev.set.has(c)), epss: scores.length ? Math.max(...scores) : null };
+      if (f.exploited.kev) f.description = `Listed in the CISA Known Exploited Vulnerabilities catalog. ${f.description}`;
+    }
+  }
+  for (const f of findings) delete f._cves;
+  if (notes.length) {
+    findings.push({
+      category: 'other', severity: 'info', confidence: 'high', key: 'enrichment-degraded', tool: 'vsg', ruleId: 'enrichment-degraded', location: {},
+      title: 'Exploit-data enrichment was degraded', description: notes.join(' '), evidence: notes.join('\n'), refs: [], fix: 'Re-run when the network is available.',
+    });
+  }
+  const packages = (osv.results ?? []).reduce((n, r) => n + (r.packages?.length ?? 0), 0);
+  return {
+    status: 'ran',
+    reason: notes.length ? `degraded: ${notes[0]}` : '',
+    findings, dataVersions, toolVersion: ctx.registry?.get('osv-scanner')?.version ?? null,
+    evidence: { osvExitCode: res.exitCode, vulnerablePackages: packages, enrichment: { cves: cves.length, notes }, osv },
+  };
+}
+
+export default { id, title, modes, requiredIn, timeoutSec, applies, run };

package/dist/security-runtime/src/checks/desktop-config/index.mjs

@@ -0,0 +1,112 @@
+// desktop-config (REQ-033): packaging, code signing and updater checks for a Python Windows desktop app.
+// Reads files as text only. Requirement pinning is deps-vuln's job; installer and executable malware scans are the malware check's job.
+import fs from 'node:fs';
+import path from 'node:path';
+import { listFiles } from '../../core/detect.mjs';
+import { resolveArtifacts, walkTree } from '../malware/targets.mjs';
+
+export const id = 'desktop-config';
+export const title = 'Desktop (Python) packaging, signing and updater';
+export const modes = ['deep', 'release'];
+export const requiredIn = [];
+export const timeoutSec = 300;
+
+const MAX_BYTES = 1024 * 1024;
+const base = (f) => f.slice(f.lastIndexOf('/') + 1);
+const read = (repo, rel) => { try { const p = path.join(repo, rel); return fs.statSync(p).size > MAX_BYTES ? '' : fs.readFileSync(p, 'utf8'); } catch { return ''; } };
+
+const PACKAGER = /\b(pyinstaller|cx[-_]?freeze|nuitka|py2exe|briefcase)\b/i;
+const MANIFEST = /^(requirements.*\.txt|pyproject\.toml|Pipfile|setup\.py|setup\.cfg)$/;
+const SCRIPT = /\.(?:bat|cmd|ps1|sh|ya?ml|iss|nsi|toml|cfg|spec|py|txt|md)$/i;
+const SIGNING = /\b(signtool|AzureSignTool|trusted-signing|azure\/trusted-signing-action|codesign|osslsigncode|jsign|signpath|smctl)\b/i;
+const TEST_PATH = /(^|\/)(tests?|__tests__|fixtures|docs?)\//i;
+
+function packagingMarkers(repo, files) {
+  const hits = [];
+  for (const f of files) {
+    if (f.endsWith('.spec')) { hits.push({ file: f, marker: '.spec file' }); continue; }
+    if (MANIFEST.test(base(f)) || /\.(?:bat|cmd|ps1|ya?ml)$/i.test(f)) {
+      const m = PACKAGER.exec(read(repo, f));
+      if (m) hits.push({ file: f, marker: m[1].toLowerCase() });
+    }
+  }
+  return hits;
+}
+
+export const applies = (ctx) => {
+  if (!ctx.detection.python) return { applies: false, reason: 'no Python project was detected' };
+  return packagingMarkers(ctx.repo, listFiles(ctx.repo)).length > 0
+    ? true
+    : { applies: false, reason: 'no Python desktop packaging marker (pyinstaller, cx_Freeze, nuitka, py2exe, briefcase or a .spec file) was found' };
+};
+
+// update-check heuristics
+const UPDATER = /update|upgrade|self[-_]?update|new[-_]version|latest[-_]version/i;
+const DOWNLOAD = /\b(?:requests\.(?:get|post)|urllib\.request\.(?:urlretrieve|urlopen)|urlretrieve|httpx\.(?:get|stream|Client)|session\.get)\s*\(/;
+const EXECUTES = /\b(?:os\.startfile|subprocess\.(?:run|Popen|call|check_call)|os\.exec\w*|os\.replace|os\.rename|shutil\.(?:move|copy\w*)|ShellExecute\w*|\.extractall)\b/;
+const VERIFY = /\b(?:hashlib|sha256|sha512|hmac|minisign|nacl|gpg|pgp|ed25519|rsa|cryptography|signature|signed|checksum|verify_\w+|verify\s*\()/i; // "verify=" (TLS flag) does not count
+const WINDOW = 60;
+
+export function updaterFindings(file, text) {
+  if (!UPDATER.test(file) && !/def\s+\w*(?:update|upgrade)\w*\s*\(/i.test(text)) return [];
+  const lines = text.split(/\r?\n/);
+  const out = [];
+  lines.forEach((line, i) => {
+    if (out.length || line.trim().startsWith('#') || !DOWNLOAD.test(line)) return;
+    const near = lines.slice(Math.max(0, i - WINDOW), i + WINDOW).join('\n');
+    if (!EXECUTES.test(near) || VERIFY.test(near)) return;
+    out.push({
+      category: 'config', severity: 'medium', confidence: 'low', tool: 'vsg', ruleId: 'vsg/desktop/update-unverified', key: 'desktop:update-unverified',
+      title: 'Update code downloads a file and runs or replaces files with no visible signature or hash check',
+      description: 'This update routine downloads with requests, urllib or httpx and then executes, extracts or replaces files, and nothing within 60 lines of the download checks a signature or hash. Anyone who can alter the download (a compromised host, a bad TLS setting, a hijacked URL) can run code on every installation. Found by text heuristic; the agent review should read the updater end to end (playbook/desktop-python.md, item 7).',
+      location: { file, line: i + 1 }, evidence: `file: ${file}\nline: ${line.trim().slice(0, 160)}`,
+      fix: 'Publish a SHA-256 (or better, a detached signature) with each release, ship the verifying public key or pinned hash inside the app, verify the downloaded file before running or extracting it, use HTTPS with certificate checks on, and refuse versions older than the installed one.',
+    });
+  });
+  return out;
+}
+
+export async function run(ctx) {
+  const repo = ctx.repo;
+  const files = listFiles(repo);
+  const markers = packagingMarkers(repo, files);
+  const findings = [];
+
+  // (b) executables and installers: the malware check scans the tree, build output and configured artifacts
+  const art = resolveArtifacts(repo, ctx.config?.artifacts ?? []);
+  const tree = walkTree(repo, { skip: ['.vsg', 'node_modules', '.venv', 'venv', ...(ctx.nestedRepos ?? []).map((n) => n.path)] });
+  const isBin = (f) => /\.(?:exe|msi)$/i.test(f);
+  const built = tree.filter((f) => isBin(f) && /(^|\/)(dist|build|out|installer|release)\//i.test(f));
+  const configured = [...art.inside].filter(isBin);
+  const binaries = [...new Set([...built, ...configured])].sort();
+  if (binaries.length) {
+    findings.push({
+      category: 'config', severity: 'info', confidence: 'high', tool: 'vsg', ruleId: 'vsg/desktop/binaries-scanned', key: 'desktop:binaries-scanned',
+      title: `${binaries.length} Windows executable or installer file(s) in build output or configured artifacts`,
+      description: `Files: ${binaries.slice(0, 10).join(', ')}${binaries.length > 10 ? ', ...' : ''}. The malware check (Defender and YARA) scans these files; see that check's coverage entry and evidence for the engines that actually ran. Before release, also configure the installer path in vsg.config.json artifacts if it is built outside the repository.`,
+      location: { file: binaries[0] }, evidence: `files: ${binaries.length}`, fix: 'Confirm the malware check ran with at least one antivirus engine on the exact files you will publish.',
+    });
+  }
+
+  // (c) code signing in packaging or CI
+  const texts = files.filter((f) => SCRIPT.test(f) && !TEST_PATH.test(f) && !/^(README|CHANGELOG)/i.test(base(f)));
+  const signingFile = texts.find((f) => SIGNING.test(read(repo, f)));
+  if (!signingFile) {
+    const anchor = markers[0].file;
+    findings.push({
+      category: 'config', severity: 'low', confidence: 'medium', tool: 'vsg', ruleId: 'vsg/desktop/no-code-signing', key: 'desktop:no-code-signing',
+      title: 'No Windows code-signing step found in the packaging scripts or CI',
+      description: 'No signtool, AzureSignTool, trusted-signing, osslsigncode or codesign step appears in the repository. Unsigned Windows executables and installers trigger SmartScreen and Defender reputation warnings, and users cannot tell a tampered copy from the real one.',
+      location: { file: anchor }, evidence: `packaging marker: ${markers[0].marker} in ${anchor}`,
+      fix: 'Sign the executable and installer in the build (for example Azure Trusted Signing or signtool with a certificate held in a secrets store, never in the repository) and timestamp the signature. If signing happens outside this repository, record that in the release notes.',
+    });
+  }
+
+  // (d) unverified updater
+  for (const f of files.filter((x) => x.endsWith('.py') && !TEST_PATH.test(x))) findings.push(...updaterFindings(f, read(repo, f)));
+
+  const evidence = { packagingMarkers: markers, binaries, malwareCheck: 'The malware check scans these files; read its coverage entry for the engines that ran.', signingStep: signingFile ?? null };
+  return { status: 'ran', reason: '', findings, evidence };
+}
+
+export default { id, title, modes, requiredIn, timeoutSec, applies, run };

package/dist/security-runtime/src/checks/dns-mail/index.mjs

@@ -0,0 +1,71 @@
+// dns-mail (optional, REQ-023): SPF, DMARC and CAA records for the target's registrable domain, using Node's dns module.
+// Registrable domain is the last two labels, or the last three under a common two-part suffix such as co.uk. (No public suffix
+// list is bundled; an unusual suffix gives a wrong domain and the check reports the domain it used.)
+import dns from 'node:dns/promises';
+import net from 'node:net';
+
+export const id = 'dns-mail';
+export const title = 'Mail and certificate DNS records (SPF, DMARC, CAA)';
+export const modes = ['url', 'release'];
+export const requiredIn = [];
+export const timeoutSec = 120;
+
+const SECOND_LEVEL = new Set(['co', 'com', 'org', 'net', 'gov', 'edu', 'ac', 'or', 'ne', 'go']);
+
+export function registrableDomain(hostname) {
+  const labels = hostname.toLowerCase().replace(/\.$/, '').split('.');
+  if (labels.length <= 2) return labels.join('.');
+  const [tld, sld] = [labels.at(-1), labels.at(-2)];
+  return (tld.length === 2 && SECOND_LEVEL.has(sld) ? labels.slice(-3) : labels.slice(-2)).join('.');
+}
+
+const isNamed = (hostname) => !net.isIP(hostname.replace(/^\[|\]$/g, '')) && hostname.includes('.') && !/(^|\.)localhost$/.test(hostname);
+
+export function applies(ctx) {
+  if (!ctx.live) return { applies: false, reason: 'no target URL was given' };
+  return isNamed(ctx.live.hostname) ? true : { applies: false, reason: `${ctx.live.hostname} is not a public domain name` };
+}
+
+const EMPTY = new Set(['ENODATA', 'ENOTFOUND', 'NXDOMAIN']);
+async function lookup(fn, name) {
+  try { return await fn(name); } catch (e) { if (EMPTY.has(e.code)) return []; throw e; }
+}
+
+const live = (f) => ({ category: 'live', tool: 'dns', refs: [], confidence: 'high', ...f });
+
+export async function run(ctx) {
+  const resolver = ctx.live.resolver ?? dns;
+  const domain = registrableDomain(ctx.live.hostname);
+  let txt;
+  let dmarc;
+  let caa;
+  try {
+    txt = (await lookup((n) => resolver.resolveTxt(n), domain)).map((parts) => parts.join(''));
+    dmarc = (await lookup((n) => resolver.resolveTxt(n), `_dmarc.${domain}`)).map((parts) => parts.join(''));
+    caa = await lookup((n) => resolver.resolveCaa(n), domain);
+  } catch (e) { return { status: 'not_run', reason: `DNS lookup for ${domain} failed: ${e.code ?? e.message}.` }; }
+
+  const findings = [];
+  const where = { url: `dns:${domain}` };
+  if (!txt.some((r) => /^v=spf1\b/i.test(r))) {
+    findings.push(live({ ruleId: 'spf-missing', key: 'spf-missing', severity: 'medium', title: `No SPF record for ${domain}`, location: where,
+      description: 'Without SPF, mail servers cannot tell which servers may send email for this domain, so spoofed mail is easier to deliver.',
+      evidence: `TXT records for ${domain} contain no "v=spf1" entry.`, fix: `Publish a TXT record such as "v=spf1 include:<your mail provider> -all" at ${domain}. Publish "v=spf1 -all" if the domain sends no mail.`, cwe: [290] }));
+  }
+  const policy = dmarc.map((r) => /^v=DMARC1\b/i.test(r) && /\bp\s*=\s*(\w+)/i.exec(r)?.[1]?.toLowerCase()).find(Boolean);
+  if (!dmarc.some((r) => /^v=DMARC1\b/i.test(r))) {
+    findings.push(live({ ruleId: 'dmarc-missing', key: 'dmarc-missing', severity: 'medium', title: `No DMARC record for ${domain}`, location: where,
+      description: 'Without DMARC, receivers have no instruction on what to do with mail that fails SPF and DKIM, so the domain can be spoofed in phishing.',
+      evidence: `No "v=DMARC1" TXT record at _dmarc.${domain}.`, fix: `Publish a TXT record at _dmarc.${domain}, starting with "v=DMARC1; p=none; rua=mailto:<address>" and moving to p=quarantine and then p=reject.`, cwe: [290] }));
+  } else if (policy === 'none') {
+    findings.push(live({ ruleId: 'dmarc-none', key: 'dmarc-none', severity: 'low', title: `DMARC policy for ${domain} is p=none`, location: where,
+      description: 'The policy only monitors. Spoofed mail is still delivered.', evidence: `DMARC record at _dmarc.${domain} sets p=none.`, fix: 'After reviewing the reports, move to p=quarantine and then p=reject.', cwe: [290] }));
+  }
+  if (!caa.length) {
+    findings.push(live({ ruleId: 'caa-missing', key: 'caa-missing', severity: 'info', title: `No CAA record for ${domain}`, location: where,
+      description: 'A CAA record limits which certificate authorities may issue certificates for the domain.', evidence: `No CAA records at ${domain}.`, fix: `Publish CAA records at ${domain} naming the authorities you use, for example 0 issue "letsencrypt.org".`, cwe: [295] }));
+  }
+  return { status: 'ran', reason: '', findings, evidence: { 'summary.json': { domain, spf: txt.some((r) => /^v=spf1\b/i.test(r)), dmarcPolicy: policy ?? null, caaRecords: caa.length } } };
+}
+
+export default { id, title, modes, requiredIn, timeoutSec, applies, run };

package/dist/security-runtime/src/checks/iac/index.mjs

@@ -0,0 +1,83 @@
+// iac (REQ-022): Trivy config scanning over Dockerfiles, compose files, Kubernetes manifests and Terraform.
+// `trivy config` runs only the misconfiguration scanners (vulnerabilities and secrets are covered by deps-vuln and the secrets checks).
+// Image scanning of images named in config is not done: it would pull images.
+import fs from 'node:fs';
+import path from 'node:path';
+import { listFiles } from '../../core/detect.mjs';
+import { normalizeSarif } from '../../core/sarif.mjs';
+
+export const id = 'iac';
+export const title = 'Container and infrastructure-as-code misconfiguration (Trivy)';
+export const modes = ['scan', 'deep', 'release'];
+export const requiredIn = [];
+export const timeoutSec = 600;
+
+const MAX_YAML_BYTES = 1_000_000;
+
+/** A Kubernetes manifest is a YAML file with top-level apiVersion and kind. */
+export function hasKubernetesManifest(repo, files = listFiles(repo)) {
+  return files.some((f) => {
+    if (!/\.ya?ml$/i.test(f) || /(^|\/)\.github\//.test(f)) return false;
+    try {
+      const full = path.join(repo, f);
+      if (fs.statSync(full).size > MAX_YAML_BYTES) return false;
+      const text = fs.readFileSync(full, 'utf8');
+      return /^apiVersion:/m.test(text) && /^kind:/m.test(text);
+    } catch { return false; }
+  });
+}
+
+export function applies(ctx) {
+  const d = ctx.detection;
+  if (d.docker.length || d.iac.length || hasKubernetesManifest(ctx.repo)) return true;
+  return { applies: false, reason: 'no Dockerfile, compose file, Kubernetes manifest or Terraform file was found' };
+}
+
+/** Maps Trivy SARIF to raw findings. Category "config": reported, never blocking (build spec blocking policy). */
+export function mapTrivy(sarif, repo) {
+  const rules = new Map((sarif?.runs ?? []).flatMap((r) => r.tool?.driver?.rules ?? []).map((r) => [r.id, r]));
+  return normalizeSarif(sarif, { tool: 'trivy', category: 'iac', repo }).map((f) => {
+    const rule = rules.get(f.ruleId);
+    // Trivy's result message repeats the artifact path and says "Vulnerability"; the rule help carries the useful parts.
+    const message = /^Message: (.+)$/m.exec(rule?.help?.text ?? '')?.[1] ?? '';
+    return {
+      ...f,
+      title: `${f.title} (${f.ruleId})`,
+      description: rule?.fullDescription?.text ?? f.description,
+      fix: message || (rule?.helpUri ? `See ${rule.helpUri}.` : 'See the Trivy check documentation for this rule.'),
+    };
+  });
+}
+
+export async function run(ctx) {
+  // cwd is the output directory, not the repository, so a trivy.yaml or .trivyignore inside the scanned repo cannot change the scan;
+  // --config "" and --ignorefile "" disable both anyway. --skip-check-update keeps the run offline with the checks built into the pinned binary.
+  const args = [
+    'config', '--format', 'sarif', '--config', '', '--ignorefile', '', '--skip-check-update', '--disable-telemetry', '--skip-version-check', '-q',
+    '--skip-dirs', '**/node_modules', '--skip-dirs', '**/.git', '--skip-dirs', '**/.vsg',
+    // nested repositories and worktrees: exact paths relative to the target (verified on 0.75.0 with a worktree fixture)
+    ...(ctx.nestedRepos ?? []).flatMap((n) => ['--skip-dirs', n.path]),
+    ctx.repo,
+  ];
+  const res = await ctx.runTool('trivy', args, { cwd: ctx.out });
+  if (res.status !== 'ran') return { status: 'not_run', reason: res.reason };
+  if (res.truncated) return { status: 'not_run', reason: 'Trivy output was too large to read completely.' };
+  if (res.exitCode !== 0) {
+    const tail = res.stderr.trim().split(/\r?\n/).slice(-3).join(' | ');
+    return { status: 'not_run', reason: `Trivy failed with exit code ${res.exitCode}${tail ? `: ${tail}` : ''}.` };
+  }
+  let sarif;
+  try { sarif = JSON.parse(res.stdout); } catch { return { status: 'not_run', reason: 'Trivy did not return valid SARIF.' }; }
+  const findings = mapTrivy(sarif, ctx.repo);
+  const version = ctx.registry?.get('trivy')?.version ?? null;
+  return {
+    status: 'ran',
+    reason: '',
+    findings,
+    toolVersion: version,
+    dataVersions: { checks: version ? `built into trivy ${version} (update skipped)` : 'built in' },
+    evidence: { trivyExitCode: res.exitCode, results: findings.length, imageScanning: 'not performed (would pull images)' },
+  };
+}
+
+export default { id, title, modes, requiredIn, timeoutSec, applies, run };