@memrov2/pentcloud-reference 0.0.0-stage → 0.1.1-dev.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 PentCloud contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,16 @@
-# Temporary Holding Version
+# PentCloud reference
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Searchsploit and pinned ExploitDB references in a separate native Cloudflare runtime. **Version 0.1.0 SDK.** readSource(path) returns bounded source bytes and SHA-256 from the same pinned revision, without execution.
+
+```js
+export { ReferenceRunner } from '@memrov2/pentcloud-reference/worker';
+const runner = env.TOOL.getByName(runId);
+try {
+  const result = await runner.run({tool:'searchsploit',query:'2.4.49'});
+  // Save the result in your existing private assessment store.
+} finally {
+  await runner.stop();
+}
+```
+
+Configure the matching named Container image. See [interfaces, build instructions, verification and limits](https://github.com/Memrov/PentCloud-tools/blob/main/docs/remaining-bundles.md) before integration. This package does not deploy or modify PentCloud.

package/THIRD_PARTY_NOTICES.md

@@ -0,0 +1,3 @@
+# Third-party notices
+
+The adapter is MIT licensed. Original runtime programs and data retain their upstream licenses and notices, preserved in the image. The package lock lists every pinned input. Unreleased candidate; no license grant for third-party redistribution is implied.

package/package.json

@@ -1,6 +1,38 @@
 {
   "name": "@memrov2/pentcloud-reference",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.1-dev.0",
+  "type": "module",
+  "license": "MIT",
+  "description": "Cloudflare-native reference tool pack",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Memrov/PentCloud-tools.git",
+    "directory": "packages/reference"
+  },
+  "engines": {
+    "node": ">=22"
+  },
+  "exports": {
+    ".": {
+      "types": "./src/index.d.mts",
+      "import": "./src/index.mjs"
+    },
+    "./worker": {
+      "types": "./src/worker.d.mts",
+      "import": "./src/worker.mjs"
+    },
+    "./tools.lock.json": "./tools.lock.json"
+  },
+  "files": [
+    "src",
+    "tools.lock.json",
+    "LICENSE",
+    "THIRD_PARTY_NOTICES.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "@memrov2/pentcloud-tool-runtime": "0.1.1-dev.0"
+  }
+}

package/src/index.d.mts

@@ -0,0 +1,16 @@
+import type { ToolCommand, PackLock } from "@memrov2/pentcloud-tool-runtime";
+export type PackRequest = { tool: "searchsploit"; query: string };
+export declare const lock: PackLock;
+export declare function buildCommand(input: PackRequest): ToolCommand;
+
+export declare function fetchReference(
+  path: string,
+  fetcher?: typeof fetch,
+): Promise<{
+  path: string;
+  revision: string;
+  sha256: string;
+  bytes: Uint8Array;
+}>;
+
+export declare function referencePath(path: string): string;

package/src/index.mjs

@@ -0,0 +1,81 @@
+import lock from "../tools.lock.json" with { type: "json" };
+export { lock };
+export function referencePath(path) {
+  if (typeof path === "string" && path.startsWith("/opt/exploitdb/"))
+    path = path.slice("/opt/exploitdb/".length);
+  if (
+    typeof path !== "string" ||
+    path.length > 240 ||
+    !/^(?:exploits|shellcodes)\/[a-z0-9_./-]+$/i.test(path) ||
+    path.split("/").some((p) => !p || p === "." || p === "..")
+  )
+    throw new TypeError("Select a pinned exploit reference path");
+  return path;
+}
+export async function fetchReference(path, fetcher = fetch) {
+  path = referencePath(path);
+  const url =
+    "https://gitlab.com/exploit-database/exploitdb/-/raw/" +
+    lock.dataRevision +
+    "/" +
+    path;
+  const response = await fetcher(url, {
+    redirect: "manual",
+    credentials: "omit",
+    signal: AbortSignal.timeout(15000),
+  });
+  if (
+    !response.ok ||
+    Number(response.headers.get("Content-Length") ?? 0) > 1048576
+  ) {
+    await response.body?.cancel();
+    throw new Error("Reference source unavailable or oversized");
+  }
+  const reader = response.body?.getReader();
+  if (!reader) throw new Error("Reference source body missing");
+  const chunks = [];
+  let length = 0;
+  while (true) {
+    const item = await reader.read();
+    if (item.done) break;
+    length += item.value.length;
+    if (length > 1048576) {
+      await reader.cancel();
+      throw new Error("Reference source exceeds one MiB");
+    }
+    chunks.push(item.value);
+  }
+  const bytes = new Uint8Array(length);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.length;
+  }
+  const digest = await crypto.subtle.digest("SHA-256", bytes);
+  return {
+    path,
+    revision: lock.dataRevision,
+    sha256: [...new Uint8Array(digest)]
+      .map((x) => x.toString(16).padStart(2, "0"))
+      .join(""),
+    bytes,
+  };
+}
+export function buildCommand(input) {
+  if (
+    !input ||
+    Object.keys(input).some((k) => !["tool", "query"].includes(k)) ||
+    input.tool !== "searchsploit" ||
+    typeof input.query !== "string" ||
+    !input.query.trim() ||
+    input.query.length > 160 ||
+    input.query.startsWith("-") ||
+    !/^[a-z0-9 _./:+-]+$/i.test(input.query)
+  )
+    throw new TypeError("Use read-only search words");
+  return {
+    argv: ["/opt/pentcloud-reference/bin/searchsploit", "--json", input.query],
+    stdin: "",
+    timeoutMs: 75000,
+  };
+}

package/src/worker.d.mts

@@ -0,0 +1,22 @@
+import { DurableObject } from "cloudflare:workers";
+import type { ToolResult } from "@memrov2/pentcloud-tool-runtime";
+import type { PackRequest } from "./index.mjs";
+export declare class ReferenceRunner extends DurableObject {
+  ready(): Promise<{ image: string; instance: "lite"; readyMs: number }>;
+  run(input: PackRequest): Promise<ToolResult>;
+  retire(): Promise<{ stopped: boolean; retired: true }>;
+  stop(): Promise<{ stopped: boolean }>;
+  readSource(
+    path: string,
+  ): Promise<{
+    path: string;
+    revision: string;
+    sha256: string;
+    bytes: Uint8Array;
+  }>;
+  capabilities(): Promise<{
+    platform: string;
+    architecture: string;
+    rawPacketSocket: boolean;
+  }>;
+}

package/src/worker.mjs

@@ -0,0 +1,9 @@
+import { createRunner } from "@memrov2/pentcloud-tool-runtime/worker";
+import { lock, buildCommand, fetchReference } from "./index.mjs";
+const Runtime = createRunner(lock, buildCommand);
+export class ReferenceRunner extends Runtime {
+  async readSource(path) {
+    if(await this.ctx.storage.get("retired"))throw new Error("Owned tool runtime is retired");
+    return fetchReference(path);
+  }
+}

package/tools.lock.json

@@ -0,0 +1,89 @@
+{
+  "schemaVersion": 1,
+  "packId": "reference",
+  "packVersion": "0.1.0",
+  "platform": "linux/amd64",
+  "baseImage": "docker.io/library/debian@sha256:a72b4433de1cf7d6bae0c4cee74d0547f58601a643b3375f070c51600d63b6b2",
+  "tools": [
+    {
+      "tool": "searchsploit",
+      "version": "f08907b1"
+    }
+  ],
+  "assets": [
+    {
+      "url": "https://gitlab.com/exploit-database/exploitdb/-/raw/f08907b131f851c2ec3c052906f82ca83703ebef/searchsploit",
+      "path": "exploitdb/searchsploit",
+      "sha256": "16efc27312c6d3d9ea1be6e24ebc187e811c0606a33e52e80f1cbaabab77845f",
+      "executable": true
+    },
+    {
+      "url": "https://gitlab.com/exploit-database/exploitdb/-/raw/f08907b131f851c2ec3c052906f82ca83703ebef/.searchsploit_rc",
+      "path": "exploitdb/.searchsploit_rc",
+      "sha256": "a06c057c1bd2ce5c1ca42d04e1fe0b43127c9ba7dffeabc491681e5bf7ddad6c",
+      "executable": false
+    },
+    {
+      "url": "https://gitlab.com/exploit-database/exploitdb/-/raw/f08907b131f851c2ec3c052906f82ca83703ebef/files_exploits.csv",
+      "path": "exploitdb/files_exploits.csv",
+      "sha256": "10f31864b85c342c8a777a0248227dcd1e11ae50b246fcfa8bb8051bdc151062",
+      "executable": false
+    },
+    {
+      "url": "https://gitlab.com/exploit-database/exploitdb/-/raw/f08907b131f851c2ec3c052906f82ca83703ebef/files_shellcodes.csv",
+      "path": "exploitdb/files_shellcodes.csv",
+      "sha256": "d458fe46dff2144fa0a6f9ea5dcaa185f881b90d7ef5117740abb4ad5c2beb92",
+      "executable": false
+    },
+    {
+      "url": "https://gitlab.com/exploit-database/exploitdb/-/raw/f08907b131f851c2ec3c052906f82ca83703ebef/LICENSE.md",
+      "path": "exploitdb/LICENSE.md",
+      "sha256": "8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643",
+      "executable": false
+    }
+  ],
+  "debs": [
+    {
+      "package": "libonig5",
+      "version": "6.9.9-1+b1",
+      "url": "https://deb.debian.org/debian/pool/main/libo/libonig/libonig5_6.9.9-1%2bb1_amd64.deb",
+      "sha256": "3abee130696244050500bcc7870e3b4cb82ddd87149ece3fd55010c3d4e1d18c",
+      "format": "deb"
+    },
+    {
+      "package": "libjq1",
+      "version": "1.7.1-6+deb13u4",
+      "url": "https://deb.debian.org/debian-security/pool/updates/main/j/jq/libjq1_1.7.1-6%2bdeb13u4_amd64.deb",
+      "sha256": "70bb2cbd66d5ada4349067ae9f61d0560b3b359d4203f2c051ca5773153ae0ba",
+      "format": "deb"
+    },
+    {
+      "package": "jq",
+      "version": "1.7.1-6+deb13u4",
+      "url": "https://deb.debian.org/debian-security/pool/updates/main/j/jq/jq_1.7.1-6%2bdeb13u4_amd64.deb",
+      "sha256": "7350392f700e20e46b7ae174a57f54e4ea106dd559753646d629b4e618bf2bff",
+      "format": "deb"
+    }
+  ],
+  "executables": [
+    "searchsploit"
+  ],
+  "runtime": {
+    "enableInternet": false,
+    "vcpu": 1,
+    "memoryMib": 512,
+    "diskMb": 3000
+  },
+  "files": false,
+  "dataRevision": "f08907b131f851c2ec3c052906f82ca83703ebef",
+  "referenceFiles": {
+    "searchsploit": "exploitdb/searchsploit",
+    ".searchsploit_rc": "exploitdb/.searchsploit_rc",
+    "files_exploits.csv": "exploitdb/files_exploits.csv",
+    "files_shellcodes.csv": "exploitdb/files_shellcodes.csv",
+    "LICENSE.md": "exploitdb/LICENSE.md"
+  },
+  "links": {
+    "searchsploit": "/opt/exploitdb/searchsploit"
+  }
+}