@orionscanner/cli 0.1.0

package/src/orion/engine/provenance/engine.py

@@ -0,0 +1,242 @@
+"""Provenance attestation engine - generates SLSA-like provenance metadata."""
+import subprocess
+import hashlib
+import json
+import os
+import time
+from pathlib import Path
+from typing import Dict, List, Optional, Any
+from dataclasses import dataclass, asdict
+
+from orion.engine.config import EngineConfig
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+@dataclass
+class ProvenanceData:
+    build_timestamp: str
+    git_commit_sha: Optional[str] = None
+    git_tag: Optional[str] = None
+    git_branch: Optional[str] = None
+    builder_identity: Optional[str] = None
+    file_hashes: Dict[str, str] = None
+    dependencies: Dict[str, str] = None
+    environment: Dict[str, str] = None
+
+    def __post_init__(self):
+        if self.file_hashes is None:
+            self.file_hashes = {}
+        if self.dependencies is None:
+            self.dependencies = {}
+        if self.environment is None:
+            self.environment = {}
+
+
+class ProvenanceEngine:
+    name = "provenance"
+    version = "1.0.0"
+
+    CI_ENV_VARS = {
+        "github": "GITHUB_SHA",
+        "gitlab": "GITLAB_COMMIT_SHA",
+        "buildkite": "BUILDKITE_COMMIT",
+        "circleci": "CIRCLE_SHA1",
+        "travis": "TRAVIS_COMMIT",
+        "jenkins": "GIT_COMMIT",
+        "azure": "BUILD_SOURCEVERSION",
+        "bitbucket": "BITBUCKET_COMMIT",
+        "drone": "DRONE_COMMIT_SHA",
+        "codebuild": "CODEBUILD_RESOLVED_SOURCE_VERSION",
+    }
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self):
+        from orion.engine.config import ResourceLimits
+        return ResourceLimits(max_cpu_seconds=30, max_memory_mb=128)
+
+    def _get_git_info(self, project_root: str) -> Dict[str, Optional[str]]:
+        """Extract git information from the project."""
+        info = {"commit_sha": None, "tag": None, "branch": None}
+        try:
+            # Get commit SHA
+            result = subprocess.run(
+                ["git", "rev-parse", "HEAD"],
+                cwd=project_root,
+                capture_output=True,
+                text=True,
+                timeout=5,
+            )
+            if result.returncode == 0:
+                info["commit_sha"] = result.stdout.strip()
+
+            # Get tag
+            result = subprocess.run(
+                ["git", "describe", "--tags", "--exact-match"],
+                cwd=project_root,
+                capture_output=True,
+                text=True,
+                timeout=5,
+            )
+            if result.returncode == 0:
+                info["tag"] = result.stdout.strip()
+
+            # Get branch
+            result = subprocess.run(
+                ["git", "rev-parse", "--abbrev-ref", "HEAD"],
+                cwd=project_root,
+                capture_output=True,
+                text=True,
+                timeout=5,
+            )
+            if result.returncode == 0:
+                info["branch"] = result.stdout.strip()
+        except Exception:
+            pass
+        return info
+
+    def _get_builder_identity(self) -> Optional[str]:
+        """Detect CI environment and get builder identity."""
+        for ci_name, env_var in self.CI_ENV_VARS.items():
+            value = os.environ.get(env_var)
+            if value:
+                return f"{ci_name}:{value}"
+        return None
+
+    def _calculate_file_hashes(self, all_files: Dict[str, OrionIR]) -> Dict[str, str]:
+        """Calculate SHA256 hashes for all source files."""
+        hashes = {}
+        for filepath, file_ir in all_files.items():
+            try:
+                # Only hash source files (not binary, not generated)
+                path = Path(filepath)
+                if path.suffix in (".py", ".js", ".ts", ".java", ".go", ".rs", ".rb", ".php",
+                                   ".cs", ".cpp", ".c", ".h", ".hpp", ".sh", ".yaml", ".yml",
+                                   ".json", ".toml", ".xml", ".html", ".css", ".sql", ".md",
+                                   ".txt", ".cfg", ".ini", ".conf", ".dockerfile", ".gitignore"):
+                    content = file_ir.content
+                    if isinstance(content, str):
+                        content = content.encode("utf-8")
+                    sha256 = hashlib.sha256(content).hexdigest()
+                    hashes[filepath] = sha256
+            except Exception:
+                pass
+        return hashes
+
+    def _get_dependencies(self, all_files: Dict[str, OrionIR], project_root: str) -> Dict[str, str]:
+        """Extract dependencies with hashes from lock files."""
+        deps = {}
+
+        # Python dependencies
+        lock_files = [
+            "requirements.txt", "requirements.lock", "Pipfile.lock",
+            "poetry.lock", "pyproject.toml", "setup.py", "setup.cfg",
+        ]
+        for lock_file in lock_files:
+            path = Path(project_root) / lock_file
+            if path.exists():
+                try:
+                    content = path.read_bytes()
+                    deps[lock_file] = hashlib.sha256(content).hexdigest()
+                except Exception:
+                    pass
+
+        # Node.js dependencies
+        for lock_file in ["package-lock.json", "yarn.lock", "pnpm-lock.yaml"]:
+            path = Path(project_root) / lock_file
+            if path.exists():
+                try:
+                    content = path.read_bytes()
+                    deps[lock_file] = hashlib.sha256(content).hexdigest()
+                except Exception:
+                    pass
+
+        # Go dependencies
+        for lock_file in ["go.sum", "go.mod"]:
+            path = Path(project_root) / lock_file
+            if path.exists():
+                try:
+                    content = path.read_bytes()
+                    deps[lock_file] = hashlib.sha256(content).hexdigest()
+                except Exception:
+                    pass
+
+        # Rust dependencies
+        path = Path(project_root) / "Cargo.lock"
+        if path.exists():
+            try:
+                content = path.read_bytes()
+                deps["Cargo.lock"] = hashlib.sha256(content).hexdigest()
+            except Exception:
+                pass
+
+        # Java dependencies
+        for lock_file in ["pom.xml", "build.gradle", "build.gradle.kts"]:
+            path = Path(project_root) / lock_file
+            if path.exists():
+                try:
+                    content = path.read_bytes()
+                    deps[lock_file] = hashlib.sha256(content).hexdigest()
+                except Exception:
+                    pass
+
+        return deps
+
+    def _get_environment(self) -> Dict[str, str]:
+        """Capture relevant environment variables."""
+        env = {}
+        relevant_vars = [
+            "CI", "GITHUB_ACTIONS", "GITLAB_CI", "BUILDKITE", "CIRCLECI",
+            "TRAVIS", "JENKINS_URL", "AZURE_PIPELINES", "BITBUCKET_BUILD_NUMBER",
+            "DRONE", "CODEBUILD_BUILD_ID", "PYTHON_VERSION", "NODE_VERSION",
+            "GO_VERSION", "RUST_VERSION", "JAVA_VERSION",
+        ]
+        for var in relevant_vars:
+            value = os.environ.get(var)
+            if value:
+                env[var] = value
+        return env
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        project_root = ir.metadata.get("project_root", ".")
+        all_files = ir.metadata.get("all_files", {})
+
+        if not all_files:
+            all_files = {ir.metadata.get("path", "unknown"): ir}
+
+        # Gather provenance data
+        git_info = self._get_git_info(project_root)
+        builder_identity = self._get_builder_identity()
+        file_hashes = self._calculate_file_hashes(all_files)
+        dependencies = self._get_dependencies(all_files, project_root)
+        environment = self._get_environment()
+
+        provenance = ProvenanceData(
+            build_timestamp=time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
+            git_commit_sha=git_info["commit_sha"],
+            git_tag=git_info["tag"],
+            git_branch=git_info["branch"],
+            builder_identity=builder_identity,
+            file_hashes=file_hashes,
+            dependencies=dependencies,
+            environment=environment,
+        )
+
+        # Store in metrics (no findings for provenance engine)
+        return EngineResult(
+            engine=self.name,
+            findings=[],
+            ok=True,
+            metrics={
+                "provenance": asdict(provenance),
+                "files_hashed": len(file_hashes),
+                "dependency_files": len(dependencies),
+                "git_info_available": git_info["commit_sha"] is not None,
+                "ci_detected": builder_identity is not None,
+            },
+        )
+
+
+Engine = ProvenanceEngine

package/src/orion/engine/registry.py

@@ -0,0 +1,55 @@
+from typing import Dict, Type
+import importlib
+import pkgutil
+import sys
+
+
+class EngineRegistry:
+    _instance = None
+
+    def __new__(cls):
+        if cls._instance is None:
+            cls._instance = super().__new__(cls)
+            cls._instance._engines: Dict[str, Type] = {}
+            cls._instance._discovered = False
+        return cls._instance
+
+    def register(self, name: str, cls):
+        self._engines[name] = cls
+
+    def get(self, name: str):
+        return self._engines.get(name)
+
+    def all(self):
+        if not self._discovered:
+            self._discover_engines()
+        return dict(self._engines)
+
+    def _discover_engines(self):
+        """Auto-discover all engines in the orion.engine package."""
+        if self._discovered:
+            return
+
+        # In-house proprietary commercial engines
+        engine_names = [
+            "sast", "secrets", "deps", "taint", "callgraph", "cfg", "symbol",
+            "dataflow", "authorization", "orphan", "prompt_security", "contract_probe",
+            "wiring_trace", "state", "license", "complexity", "duplication", "dead_import",
+            "error_handling", "logging_c", "config_engine", "chaos", "chaos_config",
+            "regression", "perf_guard", "data_residency", "noise", "supply_chain_sbom",
+            "hunter", "lint", "architecture", "test_coverage", "container",
+            "compliance", "provenance", "fp_learn", "sandbox_escape", "config_validation",
+            "iac_security", "crypto_guard", "llm_security", "api_security",
+            "threat_model", "sensitive_data"
+        ]
+
+        for name in engine_names:
+            try:
+                mod = importlib.import_module(f"orion.engine.{name}.engine")
+                if hasattr(mod, "Engine"):
+                    self._engines[name] = mod.Engine
+            except Exception as e:
+                # Engine not available or failed to load
+                pass
+
+        self._discovered = True

package/src/orion/engine/regression/engine.py

@@ -0,0 +1,213 @@
+"""Regression risk patterns detection engine - AST analysis for fragile patterns."""
+import ast
+from orion.engine.config import EngineConfig
+from orion.engine.ir import OrionIR
+from orion.engine.results import EngineResult, Finding
+
+
+class Engine:
+    name = "regression"
+    version = "1.0.0"
+
+    async def check_availability(self) -> bool:
+        return True
+
+    def resource_limits(self):
+        from orion.engine.config import ResourceLimits
+        return ResourceLimits(max_cpu_seconds=60, max_memory_mb=256)
+
+    async def run(self, ir: OrionIR, config: EngineConfig) -> EngineResult:
+        try:
+            text = ir.content.decode("utf-8", errors="replace")
+        except Exception:
+            return EngineResult(engine=self.name, findings=[], ok=True)
+
+        path = ir.metadata.get("path", "unknown")
+        is_test = self._is_test_file(path)
+
+        try:
+            tree = ast.parse(text, filename=path)
+        except SyntaxError:
+            return EngineResult(engine=self.name, findings=[], ok=True)
+
+        findings = []
+        visitor = RegressionVisitor(path, is_test, text.splitlines())
+        visitor.visit(tree)
+        findings.extend(visitor.findings)
+
+        return EngineResult(engine=self.name, findings=findings, ok=True)
+
+    def _is_test_file(self, path: str) -> bool:
+        return any(p in path for p in ["test_", "_test.py", "/tests/", "/test/", "conftest.py"])
+
+
+class RegressionVisitor(ast.NodeVisitor):
+    def __init__(self, filepath: str, is_test: bool, lines: list[str]):
+        self.filepath = filepath
+        self.is_test = is_test
+        self.lines = lines
+        self.findings = []
+        self.module_level_code = True
+
+    def visit_Assign(self, node: ast.Assign):
+        if self.module_level_code:
+            for target in node.targets:
+                if isinstance(target, ast.Attribute):
+                    if isinstance(target.value, ast.Name):
+                        self._check_monkey_patching(target.value.id, target.attr, node)
+                elif isinstance(target, ast.Subscript):
+                    # Check for sys.modules['x'] = y pattern
+                    if (isinstance(target.value, ast.Attribute) and
+                        isinstance(target.value.value, ast.Name) and
+                        target.value.value.id == "sys" and
+                        target.value.attr == "modules"):
+                        self._add_finding(node, "sys_modules_mutation",
+                            "sys.modules mutation detected",
+                            "Modifying sys.modules at runtime causes import system instability",
+                            confidence=0.9)
+                    elif isinstance(target.value, ast.Name):
+                        self._check_registry_mutation(target.value.id, node)
+        self.generic_visit(node)
+
+    def visit_Call(self, node: ast.Call):
+        func_name = self._get_call_name(node)
+
+        if func_name:
+            if func_name in ("setattr", "delattr"):
+                self._check_setattr_delattr(node, func_name)
+            elif func_name in ("__import__", "importlib.import_module", "importlib.util.module_from_spec"):
+                self._check_dynamic_import(node, func_name)
+            elif func_name == "signal.signal":
+                self._check_signal_handler(node)
+            elif func_name == "atexit.register":
+                self._check_atexit(node)
+            elif func_name in ("threading.Thread", "multiprocessing.Process", "concurrent.futures.ThreadPoolExecutor.submit"):
+                if self.module_level_code:
+                    self._check_module_level_concurrency(node, func_name)
+
+        self.generic_visit(node)
+
+    def visit_ImportFrom(self, node: ast.ImportFrom):
+        if node.module == "builtins":
+            for alias in node.names:
+                if alias.name in ("__import__",):
+                    pass
+        self.generic_visit(node)
+
+    def visit_FunctionDef(self, node: ast.FunctionDef):
+        old_module = self.module_level_code
+        self.module_level_code = False
+
+        if node.name in ("__getattr__", "__getattribute__", "__del__"):
+            self._add_finding(node, f"override_{node.name}",
+                f"Overriding {node.name}() - fragile and error-prone",
+                f"Consider alternatives to {node.name}() override",
+                confidence=0.85 if node.name == "__del__" else 0.8)
+
+        if self._is_os_environ_mutation(node):
+            self._check_os_environ_mutation(node)
+
+        self.generic_visit(node)
+        self.module_level_code = old_module
+
+    def visit_AsyncFunctionDef(self, node: ast.AsyncFunctionDef):
+        self.visit_FunctionDef(node)
+
+    def visit_ClassDef(self, node: ast.ClassDef):
+        self.generic_visit(node)
+
+    def _get_call_name(self, node: ast.Call) -> str | None:
+        if isinstance(node.func, ast.Name):
+            return node.func.id
+        elif isinstance(node.func, ast.Attribute):
+            parts = []
+            current = node.func
+            while isinstance(current, ast.Attribute):
+                parts.append(current.attr)
+                current = current.value
+            if isinstance(current, ast.Name):
+                parts.append(current.id)
+            return ".".join(reversed(parts))
+        return None
+
+    def _check_monkey_patching(self, module_name: str, attr: str, node: ast.Assign):
+        if module_name in ("sys", "os", "builtins", "types", "importlib"):
+            self._add_finding(node, "monkey_patching_stdlib",
+                f"Monkey patching stdlib module {module_name}.{attr}",
+                "Avoid modifying standard library modules at runtime",
+                confidence=0.9)
+
+    def _check_registry_mutation(self, registry_name: str, node: ast.Assign):
+        registry_upper = registry_name.upper()
+        if "REGISTRY" in registry_upper or "REGISTRY" == registry_upper:
+            self._add_finding(node, "global_registry_mutation",
+                f"Mutating global registry {registry_name}",
+                "Global registry mutations cause test pollution and flaky tests",
+                confidence=0.85)
+
+    def _check_setattr_delattr(self, node: ast.Call, func_name: str):
+        if node.args and isinstance(node.args[0], ast.Name):
+            target = node.args[0].id
+            if target in ("sys", "os", "builtins", "types", "importlib", "logging"):
+                self._add_finding(node, f"{func_name}_stdlib",
+                    f"{func_name}() on stdlib module {target}",
+                    f"Avoid {func_name}() on standard library modules",
+                    confidence=0.9)
+
+    def _check_dynamic_import(self, node: ast.Call, func_name: str):
+        # Only flag if importing directly with untrusted eval or non-literal module names
+        if node.args and not isinstance(node.args[0], ast.Constant):
+            self._add_finding(node, "dynamic_import_untrusted",
+                f"Dynamic import ({func_name}) with computed module name",
+                "Dynamic imports with non-constant module names can cause arbitrary module execution",
+                confidence=0.85)
+
+    def _check_signal_handler(self, node: ast.Call):
+        pass
+
+    def _check_atexit(self, node: ast.Call):
+        pass
+
+    def _check_module_level_concurrency(self, node: ast.Call, func_name: str):
+        self._add_finding(node, "module_level_concurrency",
+            f"Thread/process pool created at module level: {func_name}",
+            "Module-level concurrency initialization causes import-time side effects",
+            confidence=0.9)
+
+    def _is_os_environ_mutation(self, node: ast.FunctionDef) -> bool:
+        for stmt in ast.walk(node):
+            if isinstance(stmt, ast.Call):
+                func_name = self._get_call_name(stmt)
+                if func_name in ("os.environ.__setitem__", "os.environ.update", "os.putenv", "os.unsetenv"):
+                    return True
+            if isinstance(stmt, ast.Assign):
+                for target in stmt.targets:
+                    if isinstance(target, ast.Subscript):
+                        if isinstance(target.value, ast.Attribute):
+                            if isinstance(target.value.value, ast.Name) and target.value.value.id == "os":
+                                if isinstance(target.value.attr, str) and target.value.attr == "environ":
+                                    return True
+        return False
+
+    def _check_os_environ_mutation(self, node: ast.FunctionDef):
+        self._add_finding(node, "os_environ_mutation",
+            "os.environ mutation detected in function",
+            "Environment mutations affect global state and cause test pollution",
+            confidence=0.85)
+
+    def _add_finding(self, node: ast.AST, pattern: str, title: str, description: str, confidence: float):
+        line_no = getattr(node, "lineno", 0)
+        snippet = self.lines[line_no - 1].strip() if 0 < line_no <= len(self.lines) else ""
+        self.findings.append(Finding(
+            engine="regression",
+            severity="high" if confidence >= 0.85 else "medium",
+            title=title,
+            description=description,
+            location=f"{self.filepath}:{line_no}",
+            metadata={
+                "confidence": confidence,
+                "pattern": pattern,
+                "snippet": snippet[:200],
+                "cwe": "CWE-474" if "monkey" in pattern or "dynamic_import" in pattern else "CWE-667",
+            },
+        ))

package/src/orion/engine/results.py

@@ -0,0 +1,21 @@
+from dataclasses import dataclass, field
+from typing import Any
+
+
+@dataclass
+class Finding:
+    engine: str
+    severity: str
+    title: str
+    description: str = ""
+    location: str = ""
+    metadata: dict = field(default_factory=dict)
+
+
+@dataclass
+class EngineResult:
+    engine: str
+    findings: list = field(default_factory=list)
+    errors: list = field(default_factory=list)
+    metrics: dict = field(default_factory=dict)
+    ok: bool = True