@ploaness/governance 1.1.0 → 1.3.0

package/dist/blocklist.js

@@ -0,0 +1,187 @@
+// The refusal rule: whether an image reference, an installed package, or a Dockerfile install line
+// names something in `blocklist-entries.ts`, and the one place freshness has to defer to it.
+//
+// A reference is matched on its repository after normalisation, because the same image is written
+// `mongo`, `docker.io/mongo`, `library/mongo`, and `docker.io/library/mongo`, and a list keyed on the
+// spelling would refuse one of them and pull the other. The tag decides only where an entry carries a
+// floor: a tag below the floor is the permissive release line and is left to the licence gate, and a
+// tag that cannot be placed against the floor - `latest`, none, `7` against a floor of `7.4`, an
+// `-alpine` suffix on a floating major - is refused, because a tag that may resolve past the floor
+// tomorrow is not a proof that it sits below it today.
+import { BLOCKED_IMAGES, BLOCKED_PACKAGES, BLOCKED_SYSTEM_PACKAGES, } from './blocklist-entries.js';
+import { systemPackagesInDockerfile } from './container-images.js';
+import { parseVersion } from './dependency-freshness.js';
+import { asRecord, asText, isArray, isRecord, parseJsonc } from './json-shapes.js';
+import { isLicenseAllowed } from './license-allowlist.js';
+const DOCKER_HUB_HOSTS = new Set(['docker.io', 'index.docker.io']);
+const OFFICIAL_NAMESPACE = 'library';
+const LOCAL_HOST = 'localhost';
+const MUTABLE_TAG = 'latest';
+const WILDCARD = '*';
+const NUMERIC_COMPONENTS = /^v?(?<components>\d+(?:\.\d+)*)/;
+// A reference is a name-and-tag and at most one digest after the `@`.
+const REFERENCE_PARTS = 2;
+// A first path segment is a registry host when it carries a dot or a port, or is `localhost`; a Docker
+// Hub namespace never does. The rule the docker CLI itself applies.
+const isRegistryHost = (segment) => segment.includes('.') || segment.includes(':') || segment === LOCAL_HOST;
+const splitHost = (segments) => {
+    const [first] = segments;
+    if (first === undefined || segments.length === 1 || !isRegistryHost(first)) {
+        return { host: undefined, path: segments };
+    }
+    return { host: DOCKER_HUB_HOSTS.has(first) ? undefined : first, path: segments.slice(1) };
+};
+const normaliseRepository = (name) => {
+    const { host, path } = splitHost(name.toLowerCase().split('/'));
+    if (host !== undefined) {
+        return [host, ...path].join('/');
+    }
+    return (path.length > 1 && path[0] === OFFICIAL_NAMESPACE ? path.slice(1) : path).join('/');
+};
+/**
+ * Split an image reference as a Dockerfile, a workflow, or a compose model writes it.
+ * @param raw the reference, such as `docker.io/library/redis:7.4.1@sha256:...`.
+ * @returns the normalised repository, and the tag and digest when present.
+ */
+export const parseImageReference = (raw) => {
+    const [nameAndTag = '', digest] = raw.split('@', REFERENCE_PARTS);
+    const lastSlash = nameAndTag.lastIndexOf('/');
+    const colon = nameAndTag.lastIndexOf(':');
+    const hasTag = colon > lastSlash;
+    return {
+        raw,
+        repository: normaliseRepository(hasTag ? nameAndTag.slice(0, colon) : nameAndTag),
+        tag: hasTag ? nameAndTag.slice(colon + 1) : undefined,
+        digest,
+    };
+};
+/**
+ * Whether a reference may resolve to a different image tomorrow: no digest, and no tag or `latest`.
+ * @param raw the reference as written.
+ * @returns true when nothing in the reference pins what is pulled.
+ */
+export const isMutableImageReference = (raw) => {
+    const reference = parseImageReference(raw);
+    return (reference.digest === undefined && (reference.tag === undefined || reference.tag === MUTABLE_TAG));
+};
+const matchesPattern = (pattern, name) => pattern.endsWith(WILDCARD)
+    ? name.startsWith(pattern.slice(0, -WILDCARD.length))
+    : name === pattern;
+const compareCore = (one, other) => one.major - other.major || one.minor - other.minor || one.patch - other.patch;
+const componentCount = (version) => (NUMERIC_COMPONENTS.exec(version)?.groups?.['components'] ?? '').split('.').filter(Boolean).length;
+// Undecidable is refused: a version that cannot be placed against the floor is not below it.
+const reachesFloor = (version, floor) => {
+    const parsed = version === undefined ? undefined : parseVersion(version);
+    const floorParsed = parseVersion(floor);
+    if (version === undefined || parsed === undefined || floorParsed === undefined) {
+        return true;
+    }
+    return componentCount(version) < componentCount(floor) || compareCore(parsed, floorParsed) >= 0;
+};
+const isAllowedTag = (entry, tag) => entry.allowedTag !== undefined && tag !== undefined && entry.allowedTag.test(tag);
+const refusalOf = (subject, entry) => ({
+    subject,
+    reason: entry.reason,
+    replacement: entry.replacement,
+});
+/**
+ * Whether an image reference names a refused repository at a refused tag.
+ * @param raw the reference as written.
+ * @returns the refusal, or undefined when the image is not one ploaness refuses.
+ */
+export const refuseImage = (raw) => {
+    const reference = parseImageReference(raw);
+    const entry = BLOCKED_IMAGES.find((candidate) => matchesPattern(candidate.repository, reference.repository));
+    if (entry === undefined || isAllowedTag(entry, reference.tag)) {
+        return undefined;
+    }
+    return entry.from !== undefined && !reachesFloor(reference.tag, entry.from)
+        ? undefined
+        : refusalOf(raw, entry);
+};
+/**
+ * Whether an installed package at a version is one ploaness refuses.
+ * @param name the package name.
+ * @param version the resolved version.
+ * @returns the refusal, or undefined when the package is not one ploaness refuses at that version.
+ */
+export const refusePackage = (name, version) => {
+    const entry = BLOCKED_PACKAGES.find((candidate) => matchesPattern(candidate.name, name));
+    if (entry === undefined) {
+        return undefined;
+    }
+    return entry.from !== undefined && !reachesFloor(version, entry.from)
+        ? undefined
+        : refusalOf(`${name}@${version}`, entry);
+};
+/**
+ * The refused system packages a Dockerfile installs.
+ * @param text the Dockerfile body.
+ * @returns one refusal per refused package, in file order.
+ */
+export const refuseSystemPackages = (text) => systemPackagesInDockerfile(text).flatMap((name) => {
+    const entry = BLOCKED_SYSTEM_PACKAGES.find((candidate) => candidate.name === name);
+    return entry === undefined ? [] : [refusalOf(name, entry)];
+});
+/**
+ * The resolved set as `pnpm licenses list --json` reports it: grouped by licence, each entry carrying
+ * the name and the versions installed.
+ * @param json the command's stdout.
+ * @returns every installed package, or undefined when the text is not that inventory.
+ */
+export const packagesInLicenseInventory = (json) => {
+    const inventory = parseJsonc(json).value;
+    if (!isRecord(inventory) || isArray(inventory)) {
+        return undefined;
+    }
+    return Object.values(inventory).flatMap((group) => (isArray(group) ? group : []).map((entry) => {
+        const versions = asRecord(entry)['versions'];
+        return {
+            name: asText(asRecord(entry)['name']),
+            versions: (isArray(versions) ? versions : []).map((raw) => asText(raw)),
+        };
+    }));
+};
+/**
+ * The refusals across an installed set.
+ * @param packages the resolved set.
+ * @returns one refusal per refused name and version, in inventory order.
+ */
+export const refuseInstalledPackages = (packages) => packages.flatMap((entry) => entry.versions.flatMap((version) => {
+    const refusal = refusePackage(entry.name, version);
+    return refusal === undefined ? [] : [refusal];
+}));
+// The one place the freshness bound defers to this rule. A package whose newest major is refused here,
+// or is licensed outside the allowlist, would otherwise fall two majors behind and be failed for not
+// upgrading into the very release the licence gate would then refuse.
+const refusedLatestNote = (status) => {
+    const refusal = refusePackage(status.name, status.latest);
+    const newest = `${status.name}: the newest release ${status.latest}`;
+    if (refusal !== undefined) {
+        return `${newest} is refused (${refusal.reason}), so freshness stops short of it`;
+    }
+    const licence = status.latestLicense;
+    return licence === undefined || isLicenseAllowed(licence)
+        ? undefined
+        : `${newest} is licensed ${licence}, outside the allowlist, so freshness stops short of it`;
+};
+/**
+ * Split the declared coordinates into those freshness may measure and those whose newest release is
+ * refused, which freshness must not demand.
+ * @param statuses every declared coordinate with what the registry answered for it.
+ * @returns the measurable statuses, and the refused ones with the note the report prints.
+ */
+export const scopeFreshness = (statuses) => statuses.reduce((scope, status) => {
+    const note = refusedLatestNote(status);
+    return note === undefined
+        ? { ...scope, measurable: [...scope.measurable, status] }
+        : { ...scope, refused: [...scope.refused, { status, note }] };
+}, { measurable: [], refused: [] });
+/**
+ * The refusals of a repository's own JSON summary, kept exported so the CLI prints the same words.
+ * @param refusal one refusal.
+ * @param location the file or inventory that carries the subject.
+ * @returns one finding line.
+ */
+export const describeRefusal = (refusal, location) => `${location}: ${refusal.subject} - ${refusal.reason}; use ${refusal.replacement}`;
+//# sourceMappingURL=blocklist.js.map

package/dist/blocklist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blocklist.js","sourceRoot":"","sources":["../src/blocklist.ts"],"names":[],"mappings":"AAAA,mGAAmG;AACnG,6FAA6F;AAC7F,EAAE;AACF,kGAAkG;AAClG,sGAAsG;AACtG,sGAAsG;AACtG,qGAAqG;AACrG,iGAAiG;AACjG,mGAAmG;AACnG,uDAAuD;AAEvD,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,uBAAuB,GAIxB,MAAM,wBAAwB,CAAA;AAC/B,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAA;AAClE,OAAO,EAA6C,YAAY,EAAE,MAAM,2BAA2B,CAAA;AACnG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAmBzD,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAA;AACvF,MAAM,kBAAkB,GAAW,SAAS,CAAA;AAC5C,MAAM,UAAU,GAAW,WAAW,CAAA;AACtC,MAAM,WAAW,GAAW,QAAQ,CAAA;AACpC,MAAM,QAAQ,GAAW,GAAG,CAAA;AAC5B,MAAM,kBAAkB,GAAW,iCAAiC,CAAA;AACpE,sEAAsE;AACtE,MAAM,eAAe,GAAW,CAAC,CAAA;AAEjC,uGAAuG;AACvG,oEAAoE;AACpE,MAAM,cAAc,GAAG,CAAC,OAAe,EAAW,EAAE,CAClD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,UAAU,CAAA;AAQ1E,MAAM,SAAS,GAAG,CAAC,QAA2B,EAAkB,EAAE;IAChE,MAAM,CAAC,KAAK,CAAC,GAAoC,QAAQ,CAAA;IACzD,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;IAC5C,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;AAC3F,CAAC,CAAA;AAED,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAU,EAAE;IACnD,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAmB,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAA;IAC/E,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAClC,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC7F,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAW,EAAkB,EAAE;IACjE,MAAM,CAAC,UAAU,GAAG,EAAE,EAAE,MAAM,CAAC,GAAoC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;IAClG,MAAM,SAAS,GAAW,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACrD,MAAM,KAAK,GAAW,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACjD,MAAM,MAAM,GAAY,KAAK,GAAG,SAAS,CAAA;IACzC,OAAO;QACL,GAAG;QACH,UAAU,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;QACjF,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;QACrD,MAAM;KACP,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAW,EAAW,EAAE;IAC9D,MAAM,SAAS,GAAmB,mBAAmB,CAAC,GAAG,CAAC,CAAA;IAC1D,OAAO,CACL,SAAS,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,SAAS,CAAC,GAAG,KAAK,SAAS,IAAI,SAAS,CAAC,GAAG,KAAK,WAAW,CAAC,CACjG,CAAA;AACH,CAAC,CAAA;AAED,MAAM,cAAc,GAAG,CAAC,OAAe,EAAE,IAAY,EAAW,EAAE,CAChE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACxB,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC,CAAC,IAAI,KAAK,OAAO,CAAA;AAEtB,MAAM,WAAW,GAAG,CAAC,GAAkB,EAAE,KAAoB,EAAU,EAAE,CACvE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;AAE/E,MAAM,cAAc,GAAG,CAAC,OAAe,EAAU,EAAE,CACjD,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAA;AAEpG,6FAA6F;AAC7F,MAAM,YAAY,GAAG,CAAC,OAA2B,EAAE,KAAa,EAAW,EAAE;IAC3E,MAAM,MAAM,GACV,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAA;IAC3D,MAAM,WAAW,GAA8B,YAAY,CAAC,KAAK,CAAC,CAAA;IAClE,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC/E,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,cAAc,CAAC,OAAO,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,CAAA;AACjG,CAAC,CAAA;AAED,MAAM,YAAY,GAAG,CAAC,KAAmB,EAAE,GAAuB,EAAW,EAAE,CAC7E,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAEnF,MAAM,SAAS,GAAG,CAChB,OAAe,EACf,KAA2D,EAClD,EAAE,CAAC,CAAC;IACb,OAAO;IACP,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,WAAW,EAAE,KAAK,CAAC,WAAW;CAC/B,CAAC,CAAA;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,GAAW,EAAuB,EAAE;IAC9D,MAAM,SAAS,GAAmB,mBAAmB,CAAC,GAAG,CAAC,CAAA;IAC1D,MAAM,KAAK,GAA6B,cAAc,CAAC,IAAI,CAAC,CAAC,SAAuB,EAAW,EAAE,CAC/F,cAAc,CAAC,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,UAAU,CAAC,CAC3D,CAAA;IACD,IAAI,KAAK,KAAK,SAAS,IAAI,YAAY,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9D,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC;QACzE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;AAC3B,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,OAAe,EAAuB,EAAE;IAClF,MAAM,KAAK,GAA+B,gBAAgB,CAAC,IAAI,CAC7D,CAAC,SAAyB,EAAW,EAAE,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAC7E,CAAA;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC;QACnE,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,EAAE,KAAK,CAAC,CAAA;AAC5C,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,IAAY,EAAsB,EAAE,CACvE,0BAA0B,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAY,EAAsB,EAAE;IAC5E,MAAM,KAAK,GAAqC,uBAAuB,CAAC,IAAI,CAC1E,CAAC,SAA+B,EAAW,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CACtE,CAAA;IACD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;AAC5D,CAAC,CAAC,CAAA;AAQJ;;;;;GAKG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,CACxC,IAAY,EAC6B,EAAE;IAC3C,MAAM,SAAS,GAAY,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,CAAA;IACjD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,KAAc,EAA+B,EAAE,CACtF,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAc,EAAoB,EAAE;QACrE,MAAM,QAAQ,GAAY,QAAQ,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAA;QACrD,OAAO;YACL,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC;YACrC,QAAQ,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAY,EAAU,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;SACzF,CAAA;IACH,CAAC,CAAC,CACH,CAAA;AACH,CAAC,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CACrC,QAAqC,EACjB,EAAE,CACtB,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAuB,EAAsB,EAAE,CAC/D,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAe,EAAsB,EAAE;IAC7D,MAAM,OAAO,GAAwB,aAAa,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACvE,OAAO,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;AAC/C,CAAC,CAAC,CACH,CAAA;AAeH,uGAAuG;AACvG,qGAAqG;AACrG,sEAAsE;AACtE,MAAM,iBAAiB,GAAG,CAAC,MAAwB,EAAsB,EAAE;IACzE,MAAM,OAAO,GAAwB,aAAa,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IAC9E,MAAM,MAAM,GAAW,GAAG,MAAM,CAAC,IAAI,wBAAwB,MAAM,CAAC,MAAM,EAAE,CAAA;IAC5E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,GAAG,MAAM,gBAAgB,OAAO,CAAC,MAAM,mCAAmC,CAAA;IACnF,CAAC;IACD,MAAM,OAAO,GAAuB,MAAM,CAAC,aAAa,CAAA;IACxD,OAAO,OAAO,KAAK,SAAS,IAAI,gBAAgB,CAAC,OAAO,CAAC;QACvD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,GAAG,MAAM,gBAAgB,OAAO,yDAAyD,CAAA;AAC/F,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,QAAqC,EAAkB,EAAE,CACtF,QAAQ,CAAC,MAAM,CACb,CAAC,KAAqB,EAAE,MAAwB,EAAkB,EAAE;IAClE,MAAM,IAAI,GAAuB,iBAAiB,CAAC,MAAM,CAAC,CAAA;IAC1D,OAAO,IAAI,KAAK,SAAS;QACvB,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE;QACzD,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;AACjE,CAAC,EACD,EAAE,UAAU,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAChC,CAAA;AAEH;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,OAAgB,EAAE,QAAgB,EAAU,EAAE,CAC5E,GAAG,QAAQ,KAAK,OAAO,CAAC,OAAO,MAAM,OAAO,CAAC,MAAM,SAAS,OAAO,CAAC,WAAW,EAAE,CAAA"}

package/dist/checkov-check.d.ts

@@ -0,0 +1,9 @@
+/** A provider this harness has curated checks for, named as its resource types spell it. */
+export type CuratedProviderName = 'aws' | 'azurerm' | 'google' | 'digitalocean' | 'linode';
+/** One enabled check: the identifier checkov knows it by, its provider, and why the finding is refused. */
+export interface CheckovCheck {
+    readonly id: string;
+    readonly provider: CuratedProviderName;
+    readonly reason: string;
+}
+//# sourceMappingURL=checkov-check.d.ts.map

package/dist/checkov-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkov-check.d.ts","sourceRoot":"","sources":["../src/checkov-check.ts"],"names":[],"mappings":"AAGA,4FAA4F;AAC5F,MAAM,MAAM,mBAAmB,GAAG,KAAK,GAAG,SAAS,GAAG,QAAQ,GAAG,cAAc,GAAG,QAAQ,CAAA;AAE1F,2GAA2G;AAC3G,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAA;IACtC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB"}

package/dist/checkov-check.js

@@ -0,0 +1,4 @@
+// The shape of one enabled checkov check, declared apart from the tables that list them and the policy
+// that reads them so that neither imports the other.
+export {};
+//# sourceMappingURL=checkov-check.js.map

package/dist/checkov-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkov-check.js","sourceRoot":"","sources":["../src/checkov-check.ts"],"names":[],"mappings":"AAAA,uGAAuG;AACvG,qDAAqD"}

package/dist/checkov-checks-aws.d.ts

@@ -0,0 +1,4 @@
+import type { CheckovCheck } from './checkov-check.js';
+/** The AWS checks enabled at error severity. */
+export declare const AWS_CHECKS: readonly CheckovCheck[];
+//# sourceMappingURL=checkov-checks-aws.d.ts.map

package/dist/checkov-checks-aws.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkov-checks-aws.d.ts","sourceRoot":"","sources":["../src/checkov-checks-aws.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAItD,gDAAgD;AAChD,eAAO,MAAM,UAAU,EAAE,SAAS,YAAY,EAoH7C,CAAA"}

package/dist/checkov-checks-aws.js

@@ -0,0 +1,93 @@
+const aws = (id, reason) => ({ id, provider: 'aws', reason });
+/** The AWS checks enabled at error severity. */
+export const AWS_CHECKS = [
+    // Identity and access.
+    aws('CKV_AWS_274', 'a role, user or group carries AdministratorAccess, so one environment can destroy another'),
+    aws('CKV_AWS_275', 'the same administrator policy reached through a data source rather than an attachment'),
+    aws('CKV_AWS_1', 'a policy document grants every action on every resource'),
+    aws('CKV_AWS_49', 'a policy document names "*" as a statement action'),
+    aws('CKV_AWS_62', 'the same administrative grant written as an inline policy'),
+    aws('CKV_AWS_63', 'the same wildcard action written as an inline policy'),
+    aws('CKV2_AWS_40', 'a policy grants every IAM action, which is administrator access under another name'),
+    aws('CKV2_AWS_56', 'a principal carries IAMFullAccess'),
+    aws('CKV_AWS_283', 'a resource policy grants an action to every principal with no condition'),
+    aws('CKV_AWS_41', 'a long-lived access key is written into a provider block'),
+    aws('CKV_AWS_348', 'an access key is minted for the root user'),
+    aws('CKV_AWS_364', 'a service principal may invoke the function from any account, with no source ARN or account'),
+    aws('CKV_AWS_33', 'a key policy grants a wildcard principal with no condition'),
+    // Databases, caches and search.
+    aws('CKV_AWS_17', 'the database is reachable from the public internet'),
+    aws('CKV_AWS_16', 'the database instance stores its content unencrypted'),
+    aws('CKV_AWS_96', 'the database cluster stores its content unencrypted'),
+    aws('CKV_AWS_140', 'the global database cluster stores its content unencrypted'),
+    aws('CKV_AWS_211', 'the database pins a retired certificate authority bundle'),
+    aws('CKV_AWS_302', 'a database snapshot is shared with every AWS account'),
+    aws('CKV_AWS_74', 'the document database stores its content unencrypted'),
+    aws('CKV_AWS_90', 'the document database explicitly disables TLS'),
+    aws('CKV_AWS_44', 'the graph database stores its content unencrypted'),
+    aws('CKV_AWS_102', 'the graph database is reachable from the public internet'),
+    aws('CKV_AWS_64', 'the warehouse stores its content unencrypted'),
+    aws('CKV_AWS_87', 'the warehouse is reachable from the public internet, which is its default'),
+    aws('CKV_AWS_29', 'the cache stores its content unencrypted'),
+    aws('CKV_AWS_30', 'the cache accepts plaintext connections'),
+    aws('CKV_AWS_202', 'the in-memory database explicitly disables TLS'),
+    aws('CKV_AWS_47', 'the DynamoDB accelerator stores its content unencrypted'),
+    aws('CKV_AWS_239', 'the DynamoDB accelerator endpoint is plaintext'),
+    aws('CKV_AWS_5', 'the search domain stores its content unencrypted'),
+    aws('CKV_AWS_6', 'a multi-node search domain moves data between nodes in plaintext'),
+    aws('CKV_AWS_83', 'the search domain explicitly allows plain HTTP'),
+    aws('CKV_AWS_228', 'the search endpoint accepts TLS below 1.2, which is its default policy'),
+    aws('CKV_AWS_89', 'the migration instance is reachable from the public internet'),
+    aws('CKV2_AWS_49', 'a migration endpoint explicitly sets its SSL mode to none'),
+    // Storage.
+    aws('CKV_AWS_20', 'a bucket ACL grants public read, which serves unpublished media to anybody'),
+    aws('CKV_AWS_57', 'a bucket ACL grants public write, which is arbitrary upload to the site own origin'),
+    aws('CKV_AWS_70', 'a bucket policy names any principal, which is the policy spelling of the same exposure'),
+    aws('CKV_AWS_375', 'a bucket ACL grant gives full control or ACL reads to every user'),
+    aws('CKV2_AWS_43', 'a bucket ACL grant targets every authenticated AWS user'),
+    aws('CKV_AWS_19', 'the bucket stores uploads unencrypted'),
+    aws('CKV_AWS_53', 'the bucket does not block public ACLs'),
+    aws('CKV_AWS_54', 'the bucket does not block a public policy'),
+    aws('CKV_AWS_55', 'the bucket does not ignore public ACLs already set'),
+    aws('CKV_AWS_56', 'the bucket does not restrict public access at the account boundary'),
+    aws('CKV_AWS_392', 'an access point disables all four public-access blocks'),
+    aws('CKV_AWS_3', 'a volume stores its content unencrypted'),
+    aws('CKV_AWS_8', 'an instance root device stores its content unencrypted'),
+    aws('CKV_AWS_106', 'account default volume encryption is explicitly switched off'),
+    aws('CKV_AWS_42', 'the file system stores its content unencrypted'),
+    aws('CKV_AWS_97', 'a task mounts the file system without transit encryption'),
+    aws('CKV_AWS_204', 'an image block device is unencrypted'),
+    aws('CKV_AWS_235', 'an image copy is unencrypted'),
+    // Network.
+    aws('CKV_AWS_277', 'a security group admits every port from the whole internet'),
+    aws('CKV_AWS_100', 'a node group sets an SSH key with no source security group, which AWS opens to the world'),
+    aws('CKV_AWS_79', 'instance metadata v1 is enabled, so any request forgery becomes credential theft'),
+    aws('CKV_AWS_371', 'the notebook instance allows instance metadata v1'),
+    // Compute and build.
+    aws('CKV_AWS_210', 'a batch container runs privileged'),
+    aws('CKV_AWS_78', 'build artifact encryption is explicitly disabled'),
+    aws('CKV_AWS_386', 'an image lookup names no owner and a wildcard name, which is the substitution attack'),
+    aws('CKV_AWS_390', 'the cluster block on public access is switched off'),
+    // The edge.
+    aws('CKV_AWS_328', 'the load balancer runs request-desync mitigation in monitor mode only'),
+    aws('CKV_AWS_34', 'a cache behaviour serves the site over plain HTTP as well as HTTPS'),
+    aws('CKV2_AWS_54', 'an origin lists SSLv3 among its protocols'),
+    aws('CKV_AWS_308', 'a stage caches responses unencrypted'),
+    // Messaging.
+    aws('CKV_AWS_168', 'the queue policy is reachable from the internet'),
+    aws('CKV_AWS_169', 'the topic policy is reachable from the internet'),
+    aws('CKV_AWS_43', 'the stream stores records unencrypted'),
+    aws('CKV_AWS_240', 'the delivery stream stores records unencrypted'),
+    aws('CKV_AWS_291', 'the message brokers carry public IP addresses'),
+    aws('CKV_AWS_69', 'the message broker is reachable from the public internet'),
+    // Other services a project may reach for.
+    aws('CKV_AWS_32', 'the container registry policy is reachable from the internet'),
+    aws('CKV_AWS_167', 'the vault access policy is reachable from the internet'),
+    aws('CKV_AWS_303', 'a systems manager document is shared with every AWS account'),
+    aws('CKV_AWS_357', 'the transfer server enables plaintext FTP'),
+    aws('CKV_AWS_214', 'the API cache stores responses unencrypted'),
+    aws('CKV_AWS_215', 'the API cache moves responses in plaintext'),
+    aws('CKV_AWS_218', 'the search endpoint accepts TLS 1.0'),
+    aws('CKV_AWS_220', 'the search endpoint allows plain HTTP'),
+];
+//# sourceMappingURL=checkov-checks-aws.js.map

package/dist/checkov-checks-aws.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkov-checks-aws.js","sourceRoot":"","sources":["../src/checkov-checks-aws.ts"],"names":[],"mappings":"AA0BA,MAAM,GAAG,GAAG,CAAC,EAAU,EAAE,MAAc,EAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAA;AAE3F,gDAAgD;AAChD,MAAM,CAAC,MAAM,UAAU,GAA4B;IACjD,uBAAuB;IACvB,GAAG,CACD,aAAa,EACb,2FAA2F,CAC5F;IACD,GAAG,CACD,aAAa,EACb,uFAAuF,CACxF;IACD,GAAG,CAAC,WAAW,EAAE,yDAAyD,CAAC;IAC3E,GAAG,CAAC,YAAY,EAAE,mDAAmD,CAAC;IACtE,GAAG,CAAC,YAAY,EAAE,2DAA2D,CAAC;IAC9E,GAAG,CAAC,YAAY,EAAE,sDAAsD,CAAC;IACzE,GAAG,CACD,aAAa,EACb,oFAAoF,CACrF;IACD,GAAG,CAAC,aAAa,EAAE,mCAAmC,CAAC;IACvD,GAAG,CAAC,aAAa,EAAE,yEAAyE,CAAC;IAC7F,GAAG,CAAC,YAAY,EAAE,0DAA0D,CAAC;IAC7E,GAAG,CAAC,aAAa,EAAE,2CAA2C,CAAC;IAC/D,GAAG,CACD,aAAa,EACb,6FAA6F,CAC9F;IACD,GAAG,CAAC,YAAY,EAAE,4DAA4D,CAAC;IAC/E,gCAAgC;IAChC,GAAG,CAAC,YAAY,EAAE,oDAAoD,CAAC;IACvE,GAAG,CAAC,YAAY,EAAE,sDAAsD,CAAC;IACzE,GAAG,CAAC,YAAY,EAAE,qDAAqD,CAAC;IACxE,GAAG,CAAC,aAAa,EAAE,4DAA4D,CAAC;IAChF,GAAG,CAAC,aAAa,EAAE,0DAA0D,CAAC;IAC9E,GAAG,CAAC,aAAa,EAAE,sDAAsD,CAAC;IAC1E,GAAG,CAAC,YAAY,EAAE,sDAAsD,CAAC;IACzE,GAAG,CAAC,YAAY,EAAE,+CAA+C,CAAC;IAClE,GAAG,CAAC,YAAY,EAAE,mDAAmD,CAAC;IACtE,GAAG,CAAC,aAAa,EAAE,0DAA0D,CAAC;IAC9E,GAAG,CAAC,YAAY,EAAE,8CAA8C,CAAC;IACjE,GAAG,CAAC,YAAY,EAAE,2EAA2E,CAAC;IAC9F,GAAG,CAAC,YAAY,EAAE,0CAA0C,CAAC;IAC7D,GAAG,CAAC,YAAY,EAAE,yCAAyC,CAAC;IAC5D,GAAG,CAAC,aAAa,EAAE,gDAAgD,CAAC;IACpE,GAAG,CAAC,YAAY,EAAE,yDAAyD,CAAC;IAC5E,GAAG,CAAC,aAAa,EAAE,gDAAgD,CAAC;IACpE,GAAG,CAAC,WAAW,EAAE,kDAAkD,CAAC;IACpE,GAAG,CAAC,WAAW,EAAE,kEAAkE,CAAC;IACpF,GAAG,CAAC,YAAY,EAAE,gDAAgD,CAAC;IACnE,GAAG,CAAC,aAAa,EAAE,wEAAwE,CAAC;IAC5F,GAAG,CAAC,YAAY,EAAE,8DAA8D,CAAC;IACjF,GAAG,CAAC,aAAa,EAAE,2DAA2D,CAAC;IAC/E,WAAW;IACX,GAAG,CAAC,YAAY,EAAE,4EAA4E,CAAC;IAC/F,GAAG,CACD,YAAY,EACZ,oFAAoF,CACrF;IACD,GAAG,CACD,YAAY,EACZ,wFAAwF,CACzF;IACD,GAAG,CAAC,aAAa,EAAE,kEAAkE,CAAC;IACtF,GAAG,CAAC,aAAa,EAAE,yDAAyD,CAAC;IAC7E,GAAG,CAAC,YAAY,EAAE,uCAAuC,CAAC;IAC1D,GAAG,CAAC,YAAY,EAAE,uCAAuC,CAAC;IAC1D,GAAG,CAAC,YAAY,EAAE,2CAA2C,CAAC;IAC9D,GAAG,CAAC,YAAY,EAAE,oDAAoD,CAAC;IACvE,GAAG,CAAC,YAAY,EAAE,oEAAoE,CAAC;IACvF,GAAG,CAAC,aAAa,EAAE,wDAAwD,CAAC;IAC5E,GAAG,CAAC,WAAW,EAAE,yCAAyC,CAAC;IAC3D,GAAG,CAAC,WAAW,EAAE,wDAAwD,CAAC;IAC1E,GAAG,CAAC,aAAa,EAAE,8DAA8D,CAAC;IAClF,GAAG,CAAC,YAAY,EAAE,gDAAgD,CAAC;IACnE,GAAG,CAAC,YAAY,EAAE,0DAA0D,CAAC;IAC7E,GAAG,CAAC,aAAa,EAAE,sCAAsC,CAAC;IAC1D,GAAG,CAAC,aAAa,EAAE,8BAA8B,CAAC;IAClD,WAAW;IACX,GAAG,CAAC,aAAa,EAAE,4DAA4D,CAAC;IAChF,GAAG,CACD,aAAa,EACb,0FAA0F,CAC3F;IACD,GAAG,CACD,YAAY,EACZ,kFAAkF,CACnF;IACD,GAAG,CAAC,aAAa,EAAE,mDAAmD,CAAC;IACvE,qBAAqB;IACrB,GAAG,CAAC,aAAa,EAAE,mCAAmC,CAAC;IACvD,GAAG,CAAC,YAAY,EAAE,kDAAkD,CAAC;IACrE,GAAG,CACD,aAAa,EACb,sFAAsF,CACvF;IACD,GAAG,CAAC,aAAa,EAAE,oDAAoD,CAAC;IACxE,YAAY;IACZ,GAAG,CAAC,aAAa,EAAE,uEAAuE,CAAC;IAC3F,GAAG,CAAC,YAAY,EAAE,oEAAoE,CAAC;IACvF,GAAG,CAAC,aAAa,EAAE,2CAA2C,CAAC;IAC/D,GAAG,CAAC,aAAa,EAAE,sCAAsC,CAAC;IAC1D,aAAa;IACb,GAAG,CAAC,aAAa,EAAE,iDAAiD,CAAC;IACrE,GAAG,CAAC,aAAa,EAAE,iDAAiD,CAAC;IACrE,GAAG,CAAC,YAAY,EAAE,uCAAuC,CAAC;IAC1D,GAAG,CAAC,aAAa,EAAE,gDAAgD,CAAC;IACpE,GAAG,CAAC,aAAa,EAAE,+CAA+C,CAAC;IACnE,GAAG,CAAC,YAAY,EAAE,0DAA0D,CAAC;IAC7E,0CAA0C;IAC1C,GAAG,CAAC,YAAY,EAAE,8DAA8D,CAAC;IACjF,GAAG,CAAC,aAAa,EAAE,wDAAwD,CAAC;IAC5E,GAAG,CAAC,aAAa,EAAE,6DAA6D,CAAC;IACjF,GAAG,CAAC,aAAa,EAAE,2CAA2C,CAAC;IAC/D,GAAG,CAAC,aAAa,EAAE,4CAA4C,CAAC;IAChE,GAAG,CAAC,aAAa,EAAE,4CAA4C,CAAC;IAChE,GAAG,CAAC,aAAa,EAAE,qCAAqC,CAAC;IACzD,GAAG,CAAC,aAAa,EAAE,uCAAuC,CAAC;CAC5D,CAAA"}

package/dist/checkov-checks-azure.d.ts

@@ -0,0 +1,4 @@
+import type { CheckovCheck } from './checkov-check.js';
+/** The Azure checks enabled at error severity. */
+export declare const AZURE_CHECKS: readonly CheckovCheck[];
+//# sourceMappingURL=checkov-checks-azure.d.ts.map

package/dist/checkov-checks-azure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkov-checks-azure.d.ts","sourceRoot":"","sources":["../src/checkov-checks-azure.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAItD,kDAAkD;AAClD,eAAO,MAAM,YAAY,EAAE,SAAS,YAAY,EA4B/C,CAAA"}

package/dist/checkov-checks-azure.js

@@ -0,0 +1,32 @@
+const azure = (id, reason) => ({ id, provider: 'azurerm', reason });
+/** The Azure checks enabled at error severity. */
+export const AZURE_CHECKS = [
+    // Identity and registries.
+    azure('CKV_AZURE_39', 'a custom role grants every action, which is an owner written by hand'),
+    azure('CKV_AZURE_137', 'the container registry exposes a shared administrator credential'),
+    azure('CKV_AZURE_138', 'the container registry serves images to unauthenticated pulls'),
+    azure('CKV2_AZURE_30', 'the registry webhook posts to a plain-HTTP endpoint'),
+    // Databases.
+    azure('CKV_AZURE_11', 'a database firewall rule admits every IP address'),
+    azure('CKV2_AZURE_26', 'the PostgreSQL server admits every Azure tenant, or every address'),
+    azure('CKV2_AZURE_34', 'the SQL server admits every Azure tenant'),
+    azure('CKV2_AZURE_25', 'the SQL database explicitly stores its content unencrypted'),
+    // Storage.
+    azure('CKV_AZURE_34', 'the blob container serves its blobs anonymously'),
+    // Network.
+    azure('CKV_AZURE_9', 'a network security rule admits RDP from the whole internet'),
+    azure('CKV_AZURE_10', 'a network security rule admits SSH from the whole internet'),
+    // Compute.
+    azure('CKV_AZURE_149', 'the Linux virtual machine or scale set accepts password logins'),
+    azure('CKV_AZURE_5', 'the Kubernetes cluster runs without role-based access control'),
+    azure('CKV_AZURE_143', 'the Kubernetes nodes carry public IP addresses'),
+    azure('CKV_AZURE_246', 'the retired, unauthenticated HTTP application routing add-on is on'),
+    // Web.
+    azure('CKV_AZURE_14', 'the web app serves plain HTTP, which is its default'),
+    azure('CKV_AZURE_153', 'a deployment slot serves plain HTTP, which is its default'),
+    azure('CKV_AZURE_70', 'the function app serves plain HTTP, which is its default'),
+    azure('CKV_AZURE_15', 'the web app accepts TLS 1.0 or 1.1'),
+    azure('CKV_AZURE_145', 'the function app accepts TLS 1.0 or 1.1'),
+    azure('CKV_AZURE_72', 'the app exposes its remote-debugging endpoint'),
+];
+//# sourceMappingURL=checkov-checks-azure.js.map

package/dist/checkov-checks-azure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkov-checks-azure.js","sourceRoot":"","sources":["../src/checkov-checks-azure.ts"],"names":[],"mappings":"AA6BA,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,MAAc,EAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAA;AAEjG,kDAAkD;AAClD,MAAM,CAAC,MAAM,YAAY,GAA4B;IACnD,2BAA2B;IAC3B,KAAK,CAAC,cAAc,EAAE,sEAAsE,CAAC;IAC7F,KAAK,CAAC,eAAe,EAAE,kEAAkE,CAAC;IAC1F,KAAK,CAAC,eAAe,EAAE,+DAA+D,CAAC;IACvF,KAAK,CAAC,eAAe,EAAE,qDAAqD,CAAC;IAC7E,aAAa;IACb,KAAK,CAAC,cAAc,EAAE,kDAAkD,CAAC;IACzE,KAAK,CAAC,eAAe,EAAE,mEAAmE,CAAC;IAC3F,KAAK,CAAC,eAAe,EAAE,0CAA0C,CAAC;IAClE,KAAK,CAAC,eAAe,EAAE,4DAA4D,CAAC;IACpF,WAAW;IACX,KAAK,CAAC,cAAc,EAAE,iDAAiD,CAAC;IACxE,WAAW;IACX,KAAK,CAAC,aAAa,EAAE,4DAA4D,CAAC;IAClF,KAAK,CAAC,cAAc,EAAE,4DAA4D,CAAC;IACnF,WAAW;IACX,KAAK,CAAC,eAAe,EAAE,gEAAgE,CAAC;IACxF,KAAK,CAAC,aAAa,EAAE,+DAA+D,CAAC;IACrF,KAAK,CAAC,eAAe,EAAE,gDAAgD,CAAC;IACxE,KAAK,CAAC,eAAe,EAAE,oEAAoE,CAAC;IAC5F,OAAO;IACP,KAAK,CAAC,cAAc,EAAE,qDAAqD,CAAC;IAC5E,KAAK,CAAC,eAAe,EAAE,2DAA2D,CAAC;IACnF,KAAK,CAAC,cAAc,EAAE,0DAA0D,CAAC;IACjF,KAAK,CAAC,cAAc,EAAE,oCAAoC,CAAC;IAC3D,KAAK,CAAC,eAAe,EAAE,yCAAyC,CAAC;IACjE,KAAK,CAAC,cAAc,EAAE,+CAA+C,CAAC;CACvE,CAAA"}

package/dist/checkov-checks-google.d.ts

@@ -0,0 +1,6 @@
+import type { CheckovCheck } from './checkov-check.js';
+/** The Google Cloud checks enabled at error severity. */
+export declare const GOOGLE_CHECKS: readonly CheckovCheck[];
+/** The DigitalOcean and Linode checks enabled at error severity: the pinned image ships ten in all. */
+export declare const SMALL_CLOUD_CHECKS: readonly CheckovCheck[];
+//# sourceMappingURL=checkov-checks-google.d.ts.map

package/dist/checkov-checks-google.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkov-checks-google.d.ts","sourceRoot":"","sources":["../src/checkov-checks-google.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAItD,yDAAyD;AACzD,eAAO,MAAM,aAAa,EAAE,SAAS,YAAY,EAmChD,CAAA;AAED,uGAAuG;AACvG,eAAO,MAAM,kBAAkB,EAAE,SAAS,YAAY,EAYrD,CAAA"}

package/dist/checkov-checks-google.js

@@ -0,0 +1,53 @@
+const google = (id, reason) => ({ id, provider: 'google', reason });
+/** The Google Cloud checks enabled at error severity. */
+export const GOOGLE_CHECKS = [
+    // Identity and keys.
+    google('CKV_GCP_41', 'a principal may act as every service account in the project'),
+    google('CKV_GCP_31', 'the virtual machine runs as the default compute account with every API'),
+    google('CKV_GCP_112', 'the KMS key can be used by anybody'),
+    google('CKV2_GCP_8', 'the whole key ring can be used by anybody'),
+    // Databases and caches.
+    google('CKV_GCP_11', 'the Cloud SQL instance admits every address on the internet'),
+    google('CKV_GCP_95', 'the Redis instance accepts unauthenticated connections'),
+    // Storage.
+    google('CKV_GCP_28', 'the bucket is readable or writable by anybody'),
+    google('CKV_GCP_29', 'the bucket honours per-object ACLs, so one object can be made public'),
+    google('CKV_GCP_114', 'the bucket can be made public by any later grant'),
+    // Network.
+    google('CKV_GCP_2', 'a firewall admits SSH from the whole internet'),
+    google('CKV_GCP_3', 'a firewall admits RDP from the whole internet'),
+    google('CKV_GCP_88', 'a firewall admits MySQL from the whole internet'),
+    google('CKV_GCP_75', 'a firewall admits FTP control from the whole internet'),
+    google('CKV_GCP_77', 'a firewall admits FTP data from the whole internet'),
+    google('CKV2_GCP_12', 'a firewall admits every port and protocol from the whole internet'),
+    google('CKV_GCP_27', 'the project gets the default network and its allow-from-anywhere rules'),
+    // Compute.
+    google('CKV_GCP_7', 'the cluster honours legacy ABAC, which bypasses RBAC'),
+    google('CKV_GCP_18', "the control plane's authorised network list is the whole internet"),
+    google('CKV_GCP_34', 'the virtual machine opts out of OS Login'),
+    google('CKV_GCP_35', 'the virtual machine exposes an interactive serial console'),
+    google('CKV2_GCP_10', 'the HTTP-triggered function answers plaintext HTTP'),
+    // The edge.
+    google('CKV_GCP_4', 'the TLS policy admits TLS 1.0 or 1.1, or a non-forward-secret cipher suite'),
+    google('CKV_GCP_17', 'DNSSEC signs the zone with RSASHA1'),
+    // Other services a project may reach for.
+    google('CKV_GCP_99', 'the topic can be published to or read by anybody'),
+    google('CKV_GCP_100', 'the table can be read by anybody'),
+    google('CKV_GCP_101', 'the image repository can be pulled by anybody'),
+    google('CKV_GCP_98', 'the cluster can be driven by anybody'),
+];
+/** The DigitalOcean and Linode checks enabled at error severity: the pinned image ships ten in all. */
+export const SMALL_CLOUD_CHECKS = [
+    { id: 'CKV_DIO_3', provider: 'digitalocean', reason: 'the Spaces bucket is world-readable' },
+    {
+        id: 'CKV_LIN_1',
+        provider: 'linode',
+        reason: 'a Linode API token is written into the provider block',
+    },
+    {
+        id: 'CKV_LIN_5',
+        provider: 'linode',
+        reason: "the firewall's default inbound action is allow, so every port not listed is open",
+    },
+];
+//# sourceMappingURL=checkov-checks-google.js.map

package/dist/checkov-checks-google.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkov-checks-google.js","sourceRoot":"","sources":["../src/checkov-checks-google.ts"],"names":[],"mappings":"AA8BA,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,MAAc,EAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAA;AAEjG,yDAAyD;AACzD,MAAM,CAAC,MAAM,aAAa,GAA4B;IACpD,qBAAqB;IACrB,MAAM,CAAC,YAAY,EAAE,6DAA6D,CAAC;IACnF,MAAM,CAAC,YAAY,EAAE,wEAAwE,CAAC;IAC9F,MAAM,CAAC,aAAa,EAAE,oCAAoC,CAAC;IAC3D,MAAM,CAAC,YAAY,EAAE,2CAA2C,CAAC;IACjE,wBAAwB;IACxB,MAAM,CAAC,YAAY,EAAE,6DAA6D,CAAC;IACnF,MAAM,CAAC,YAAY,EAAE,wDAAwD,CAAC;IAC9E,WAAW;IACX,MAAM,CAAC,YAAY,EAAE,+CAA+C,CAAC;IACrE,MAAM,CAAC,YAAY,EAAE,sEAAsE,CAAC;IAC5F,MAAM,CAAC,aAAa,EAAE,kDAAkD,CAAC;IACzE,WAAW;IACX,MAAM,CAAC,WAAW,EAAE,+CAA+C,CAAC;IACpE,MAAM,CAAC,WAAW,EAAE,+CAA+C,CAAC;IACpE,MAAM,CAAC,YAAY,EAAE,iDAAiD,CAAC;IACvE,MAAM,CAAC,YAAY,EAAE,uDAAuD,CAAC;IAC7E,MAAM,CAAC,YAAY,EAAE,oDAAoD,CAAC;IAC1E,MAAM,CAAC,aAAa,EAAE,mEAAmE,CAAC;IAC1F,MAAM,CAAC,YAAY,EAAE,wEAAwE,CAAC;IAC9F,WAAW;IACX,MAAM,CAAC,WAAW,EAAE,sDAAsD,CAAC;IAC3E,MAAM,CAAC,YAAY,EAAE,mEAAmE,CAAC;IACzF,MAAM,CAAC,YAAY,EAAE,0CAA0C,CAAC;IAChE,MAAM,CAAC,YAAY,EAAE,2DAA2D,CAAC;IACjF,MAAM,CAAC,aAAa,EAAE,oDAAoD,CAAC;IAC3E,YAAY;IACZ,MAAM,CAAC,WAAW,EAAE,4EAA4E,CAAC;IACjG,MAAM,CAAC,YAAY,EAAE,oCAAoC,CAAC;IAC1D,0CAA0C;IAC1C,MAAM,CAAC,YAAY,EAAE,kDAAkD,CAAC;IACxE,MAAM,CAAC,aAAa,EAAE,kCAAkC,CAAC;IACzD,MAAM,CAAC,aAAa,EAAE,+CAA+C,CAAC;IACtE,MAAM,CAAC,YAAY,EAAE,sCAAsC,CAAC;CAC7D,CAAA;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,kBAAkB,GAA4B;IACzD,EAAE,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,qCAAqC,EAAE;IAC5F;QACE,EAAE,EAAE,WAAW;QACf,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,uDAAuD;KAChE;IACD;QACE,EAAE,EAAE,WAAW;QACf,QAAQ,EAAE,QAAQ;QAClB,MAAM,EAAE,kFAAkF;KAC3F;CACF,CAAA"}

package/dist/checkov-policy.d.ts

@@ -0,0 +1,63 @@
+import type { CheckovCheck } from './checkov-check.js';
+/** The checks enabled at error severity, each confirmed present in the pinned image. */
+export declare const CHECKOV_CHECKS: readonly CheckovCheck[];
+/**
+ * The value of checkov's `--check` flag.
+ *
+ * Read from the catalogue rather than written out, so the list that runs and the list that carries the
+ * reasons cannot drift. An empty value would run EVERY check rather than none, which is why the spec
+ * beside this asserts the catalogue is not empty.
+ * @returns the enabled identifiers, comma separated.
+ */
+export declare const checkovCheckList: () => string;
+/**
+ * How many checks checkov reports as failed.
+ * @param output the analyzer's output for a scan that found at least one resource.
+ * @returns the tally, or undefined when the output carries none - which a caller treats as a run that
+ * did not complete rather than as a clean one.
+ */
+export declare const failedCheckCount: (output: string) => number | undefined;
+/**
+ * The checks that can apply to a set of providers.
+ * @param providers provider names as the resource types spell them.
+ * @returns every enabled check bound to one of them.
+ */
+export declare const checksFor: (providers: readonly string[]) => readonly CheckovCheck[];
+/**
+ * Why a provider has no enabled check. The summary says which, rather than claiming checks that could
+ * not have run: a `--check` id bound to no resource in the tree matches nothing and raises no error, so
+ * without this the analyzer exits 0 over a cloud it never looked at.
+ */
+export type ProviderStanding = 'utility' | 'unsupported' | 'audited';
+/**
+ * Every provider this harness knows to have no enabled check, and why. A provider on neither this map
+ * nor the catalogue is refused: the harness cannot tell whether the analyzer covers it and does not
+ * guess. The `unsupported` entries were confirmed absent from the pinned image with `--list`, and are
+ * re-confirmed when the pin moves.
+ */
+export declare const PROVIDERS_WITHOUT_CHECKS: ReadonlyMap<string, ProviderStanding>;
+/** The providers a tree declares, sorted into what the gate does about each. */
+export interface ProviderClassification {
+    /** At least one enabled check binds to it. */
+    readonly curated: readonly string[];
+    readonly utility: readonly string[];
+    readonly unsupported: readonly string[];
+    readonly audited: readonly string[];
+    /** On no list; the gate refuses to guess. */
+    readonly unclassified: readonly string[];
+}
+/**
+ * The providers at least one enabled check binds to.
+ *
+ * Derived from the catalogue rather than declared beside it, so a cloud cannot be listed as curated
+ * with nothing enabled for it.
+ * @returns the provider names.
+ */
+export declare const curatedProviders: () => ReadonlySet<string>;
+/**
+ * Sort the providers a tree declares by what the gate does about each.
+ * @param detected provider names, in any order and with any repetition.
+ * @returns each provider once, in its standing, ordered so a report reads the same on every machine.
+ */
+export declare const classifyProviders: (detected: readonly string[]) => ProviderClassification;
+//# sourceMappingURL=checkov-policy.d.ts.map

package/dist/checkov-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkov-policy.d.ts","sourceRoot":"","sources":["../src/checkov-policy.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAKtD,wFAAwF;AACxF,eAAO,MAAM,cAAc,EAAE,SAAS,YAAY,EAKjD,CAAA;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,QAAO,MACqC,CAAA;AAMzE;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,GAAI,QAAQ,MAAM,KAAG,MAAM,GAAG,SAG1D,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,SAAS,GAAI,WAAW,SAAS,MAAM,EAAE,KAAG,SAAS,YAAY,EACe,CAAA;AAE7F;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,CAAA;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAoCzE,CAAA;AAEF,gFAAgF;AAChF,MAAM,WAAW,sBAAsB;IACrC,8CAA8C;IAC9C,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;IACvC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,6CAA6C;IAC7C,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAA;CACzC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,QAAO,WAAW,CAAC,MAAM,CACwB,CAAA;AAQ9E;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAAI,UAAU,SAAS,MAAM,EAAE,KAAG,sBAc/D,CAAA"}