@quantakrypto/core 0.4.4 → 0.6.0

package/src/detectors/cloud-kms.ts

@@ -5,31 +5,61 @@
  * `GenerateDataKeyPair` select the key type with a `KeySpec` / `KeyPairSpec`
  * (legacy `CustomerMasterKeySpec`) field whose value is `RSA_*` or `ECC_*`.
  *
- * These PascalCase field names + `RSA_2048` / `ECC_NIST_P256` values are specific
- * to the AWS KMS API across every SDK language (JS/TS, Python/boto3, Java, Go,
- * the CLI, JSON policies), so a single lexical rule catches them all with a very
- * low false-positive rate. Terraform uses the snake_case `customer_master_key_spec`
- * instead, so this never double-counts with the IaC detector.
+ * These field names + `RSA_2048` / `ECC_NIST_P256` values are specific to the AWS
+ * KMS/ACM API across every SDK language (JS/TS, Python/boto3, Java, Go, the CLI, JSON
+ * policies), so a single lexical rule catches them at very low false-positive rate.
+ * Covered forms: the quoted-value SDK/JSON form (`KeySpec: "RSA_2048"`), the camelCase
+ * CDK/Pulumi prop form (`customerMasterKeySpec: "RSA_2048"`), and the AWS CDK ENUM
+ * form (`kms.KeySpec.RSA_2048`, `KeyAlgorithm.EC_prime256v1`). Terraform uses the
+ * snake_case `customer_master_key_spec`, so this never double-counts with the IaC
+ * detector.
  *
  * HNDL: an RSA KMS key (encryption/KEM) and an EC KMS key (which AWS KMS can use
  * for ECDH key agreement as well as ECDSA signing) are both harvest-now-decrypt-
  * later exposed → hndl:true.
  */
 import type { Detector, Finding, RuleMeta } from "../types.js";
-import { eachMatch, findingFromRule } from "../detect-utils.js";
+import {
+  DOC_EXTENSIONS,
+  eachMatch,
+  findingFromRule,
+  hasExtension,
+  maskBlockComments,
+  maskCommentLines,
+} from "../detect-utils.js";
+import { isCloudTemplateFile } from "./cloudformation.js";
 import { CWE_BROKEN_CRYPTO } from "../cwe.js";
 
-// The AWS KMS key-spec fields (CreateKey / GenerateDataKeyPair / legacy CMK). The
-// optional `"?` after the field name accepts both the JS/HCL form (`KeySpec:`) and
-// the JSON form where the key is quoted (`"KeySpec":`).
-const SPEC_KEYS = "KeySpec|KeyPairSpec|CustomerMasterKeySpec";
-const RE_KMS_RSA = new RegExp(`\\b(?:${SPEC_KEYS})"?\\s*[:=]\\s*['"]RSA_\\d+['"]`, "g");
-const RE_KMS_EC = new RegExp(`\\b(?:${SPEC_KEYS})"?\\s*[:=]\\s*['"]ECC_[A-Z0-9_]+['"]`, "g");
+// The AWS KMS / ACM key-spec field names. Both PascalCase (SDK / boto3 / JSON) and
+// camelCase (AWS CDK / Pulumi props) leading letters are accepted. `KeyAlgorithm` is
+// the ACM certificate key spec.
+const SPEC_KEYS = "[Kk]eySpec|[Kk]eyPairSpec|[Cc]ustomerMasterKeySpec|[Kk]eyAlgorithm";
+// (a) The QUOTED-VALUE form: `KeySpec: "RSA_2048"` / `"KeySpec": "RSA_2048"` /
+//     `customerMasterKeySpec: "RSA_2048"` (SDK, boto3, JSON, Pulumi props).
+const RE_KMS_RSA = new RegExp(`\\b(?:${SPEC_KEYS})"?\\s*[:=]\\s*['"](?:RSA_\\d+)['"]`, "g");
+const RE_KMS_EC = new RegExp(
+  `\\b(?:${SPEC_KEYS})"?\\s*[:=]\\s*['"](?:ECC_[A-Z0-9_]+|EC_[A-Za-z0-9]+)['"]`,
+  "g",
+);
+// (b) The ENUM-MEMBER form used by AWS CDK: `kms.KeySpec.RSA_2048`,
+//     `KeySpec.ECC_NIST_P256`, `KeyAlgorithm.RSA_2048`, `KeyAlgorithm.EC_prime256v1`
+//     — an enum reference, no quoted value, so (a) never matches it.
+const RE_KMS_RSA_ENUM = /\b(?:KeySpec|KeyAlgorithm)\.RSA_\d+\b/g;
+const RE_KMS_EC_ENUM = /\b(?:KeySpec|KeyAlgorithm)\.(?:ECC_[A-Z0-9_]+|EC_[A-Za-z0-9]+)\b/g;
+// (c) GCP Cloud KMS: the CryptoKeyVersion algorithm — `RSA_SIGN_PSS_2048_SHA256`,
+//     `RSA_DECRYPT_OAEP_*`, `EC_SIGN_P256_SHA256` (enum or quoted string). The
+//     `RSA_SIGN`/`RSA_DECRYPT`/`EC_SIGN` prefixes are GCP-KMS-specific.
+const RE_GCP_KMS_RSA = /\bRSA_(?:SIGN|DECRYPT)_[A-Z0-9_]+/g;
+const RE_GCP_KMS_EC = /\bEC_SIGN_[A-Z0-9_]+/g;
+// (d) Azure Key Vault SDK: `createRsaKey` / `createEcKey` (+ `Create*KeyOptions`) and
+//     `KeyType.Rsa` / `KeyType.Ec`.
+const RE_AZURE_KV_RSA = /\b[Cc]reateRsaKey(?:Options)?\b|\bKeyType\.Rsa\b/g;
+const RE_AZURE_KV_EC = /\b[Cc]reateEcKey(?:Options)?\b|\bKeyType\.Ec\b/g;
 
 const RULE_KMS_RSA: RuleMeta = {
   id: "cloud-kms-rsa",
-  title: "AWS KMS RSA key",
-  description: "AWS KMS CreateKey / GenerateDataKeyPair with an RSA_* key spec",
+  title: "Cloud KMS RSA key",
+  description: "AWS/GCP/Azure KMS RSA key spec (KeySpec / RSA_SIGN_* / createRsaKey)",
   category: "kem",
   severity: "high",
   confidence: "high",
@@ -37,13 +67,13 @@ const RULE_KMS_RSA: RuleMeta = {
   hndl: true,
   cwe: CWE_BROKEN_CRYPTO,
   message:
-    "Mints a classical RSA key via the AWS KMS SDK (harvest-now-decrypt-later exposed for encryption).",
+    "Mints a classical RSA key via a cloud KMS SDK (AWS/GCP/Azure); harvest-now-decrypt-later exposed for encryption.",
   remediation: "Plan migration to PQC as cloud KMS adds ML-KEM / ML-DSA key specs.",
 };
 const RULE_KMS_EC: RuleMeta = {
   id: "cloud-kms-ec",
-  title: "AWS KMS EC key",
-  description: "AWS KMS CreateKey / GenerateDataKeyPair with an ECC_* key spec",
+  title: "Cloud KMS EC key",
+  description: "AWS/GCP/Azure KMS EC key spec (ECC_* / EC_SIGN_* / createEcKey)",
   category: "key-exchange",
   severity: "high",
   confidence: "high",
@@ -51,7 +81,7 @@ const RULE_KMS_EC: RuleMeta = {
   hndl: true,
   cwe: CWE_BROKEN_CRYPTO,
   message:
-    "Mints a classical EC key via the AWS KMS SDK; EC keys feed ECDSA signatures and ECDH key agreement (the ECDH path is harvest-now-decrypt-later exposed).",
+    "Mints a classical EC key via a cloud KMS SDK (AWS/GCP/Azure); EC keys feed ECDSA signatures and ECDH key agreement (the ECDH path is harvest-now-decrypt-later exposed).",
   remediation:
     "For key agreement: hybrid X25519MLKEM768 (ML-KEM-768). For signatures: ML-DSA-65 (FIPS 204).",
 };
@@ -59,29 +89,53 @@ const RULE_KMS_EC: RuleMeta = {
 /** Detects classical asymmetric keys provisioned via a cloud KMS SDK call. */
 export const cloudKmsDetector: Detector = {
   id: "cloud-kms",
-  description: "Classical asymmetric keys minted via a cloud KMS SDK (AWS KMS)",
+  description: "Classical asymmetric keys minted via a cloud KMS/ACM SDK, AWS CDK, or Pulumi",
   scope: "config",
   language: "any",
   rules: [RULE_KMS_RSA, RULE_KMS_EC],
-  appliesTo: () => true,
+  // Skip prose/docs: a README or tutorial showing `KeySpec: "RSA_2048"` to describe
+  // the KMS API is not a live key-minting call.
+  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
   detect({ file, content }): Finding[] {
-    // Fast reject: only proceed if a KMS key-spec field name is present.
+    // Fast reject: only proceed if an AWS / GCP / Azure KMS key-spec marker is present.
+    const lc = content.toLowerCase();
     if (
-      !content.includes("KeySpec") &&
-      !content.includes("KeyPairSpec") &&
-      !content.includes("CustomerMasterKeySpec")
+      !lc.includes("keyspec") &&
+      !lc.includes("keypairspec") &&
+      !lc.includes("keyalgorithm") &&
+      !lc.includes("rsa_sign") &&
+      !lc.includes("rsa_decrypt") &&
+      !lc.includes("ec_sign") &&
+      !lc.includes("creatersakey") &&
+      !lc.includes("createeckey") &&
+      !lc.includes("keytype.")
     ) {
       return [];
     }
+    // Inside a CloudFormation / ARM template FILE, the cloudformation detector owns
+    // the KMS key specs — defer so a KeySpec line is not counted twice. Gated to the
+    // template extensions it scans, so an SDK call in a `.ts` stays covered here.
+    if (isCloudTemplateFile(file, content)) return [];
+    // Mask comments before scanning so a commented-out `# KeySpec: "RSA_2048"` in a
+    // YAML/JSON/HCL config (which the central source-comment stripper doesn't cover)
+    // can't fire. Offsets are preserved, so the finding's snippet — built from the
+    // original `content` — stays exact.
+    const scan = maskCommentLines(maskBlockComments(content), ["#", "//"]);
     const findings: Finding[] = [];
     const add = (re: RegExp, rule: RuleMeta): void =>
-      eachMatch(re, content, (m) =>
+      eachMatch(re, scan, (m) =>
         findings.push(
           findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
         ),
       );
     add(RE_KMS_RSA, RULE_KMS_RSA);
     add(RE_KMS_EC, RULE_KMS_EC);
+    add(RE_KMS_RSA_ENUM, RULE_KMS_RSA);
+    add(RE_KMS_EC_ENUM, RULE_KMS_EC);
+    add(RE_GCP_KMS_RSA, RULE_KMS_RSA);
+    add(RE_GCP_KMS_EC, RULE_KMS_EC);
+    add(RE_AZURE_KV_RSA, RULE_KMS_RSA);
+    add(RE_AZURE_KV_EC, RULE_KMS_EC);
     return findings;
   },
 };

package/src/detectors/cloudformation.ts

@@ -22,7 +22,7 @@
  * these property names in an unrelated context.
  */
 import type { Detector, Finding, RuleMeta } from "../types.js";
-import { eachMatch, findingFromRule, hasExtension } from "../detect-utils.js";
+import { eachMatch, findingFromRule, hasExtension, maskCommentLines } from "../detect-utils.js";
 import { CWE_BROKEN_CRYPTO, CWE_WEAK_STRENGTH } from "../cwe.js";
 
 const CFN_EXTENSIONS: readonly string[] = [".json", ".yaml", ".yml"];
@@ -36,25 +36,51 @@ const CFN_MARKERS: readonly string[] = [
   "AWSTemplateFormatVersion",
   "MinimumProtocolVersion",
   "Microsoft.KeyVault",
-  '"SslPolicy"',
+  "SslPolicy", // unquoted so a YAML `SslPolicy:` key also gates the file in, not just JSON
 ];
 
+/**
+ * True when the content looks like a CloudFormation / ARM deployment template (one
+ * of the {@link CFN_MARKERS} is present).
+ */
+function isCloudTemplate(content: string): boolean {
+  return CFN_MARKERS.some((marker) => content.includes(marker));
+}
+
+/**
+ * True when a file is one THIS detector actually scans (a `.json`/`.yaml`/`.yml`
+ * template). The `cloud-kms` and `jwk` detectors defer to this detector ONLY on
+ * such files — deferring on any extension that merely contains a marker string
+ * (e.g. a `.ts` with an `AWS::KMS` comment) would drop a real finding, since this
+ * detector never runs there.
+ */
+export function isCloudTemplateFile(file: string, content: string): boolean {
+  return hasExtension(file, CFN_EXTENSIONS) && isCloudTemplate(content);
+}
+
 // Each attribute is matched with an optional quote around the key and `:` as
 // the separator (both plain-JSON and YAML-block-scalar forms use `:`). The
 // `(?<![\w"-])` lookbehind stops a longer/prefixed attribute name from
 // matching on its suffix.
-const RE_CFN_KMS_RSA = /(?<![\w"-])"?KeySpec"?\s*:\s*"?RSA_\d+"?/g;
-const RE_CFN_KMS_EC = /(?<![\w"-])"?KeySpec"?\s*:\s*"?ECC_[A-Z0-9_]+"?/g;
+// Match all three AWS KMS spec-key spellings so this detector fully owns KMS keys
+// inside a template (KeySpec, the KeyPair variant, and the legacy CustomerMasterKeySpec).
+const RE_CFN_KMS_RSA =
+  /(?<![\w"-])"?(?:KeySpec|KeyPairSpec|CustomerMasterKeySpec)"?\s*:\s*"?RSA_\d+"?/g;
+const RE_CFN_KMS_EC =
+  /(?<![\w"-])"?(?:KeySpec|KeyPairSpec|CustomerMasterKeySpec)"?\s*:\s*"?ECC_[A-Z0-9_]+"?/g;
 const RE_CFN_ACM_RSA = /(?<![\w"-])"?KeyAlgorithm"?\s*:\s*"?RSA_\d+"?/g;
 const RE_CFN_ACM_EC = /(?<![\w"-])"?KeyAlgorithm"?\s*:\s*"?EC_[A-Za-z0-9]+"?/g;
 // CloudFront: only the pre-2018 "TLSv1" / "TLSv1_2016" / "TLSv1.1_2016"
 // values are legacy; the lookahead delimiter stops this from matching a
 // "TLSv1.2_2018"-style value that merely starts with the same prefix.
 const RE_CFN_CLOUDFRONT_TLS =
-  /(?<![\w"-])"?MinimumProtocolVersion"?\s*:\s*"?(?:TLSv1(?:\.1)?_2016|TLSv1)(?=["'\s,}]|$)/gm;
-// ELB/ALB legacy SSL negotiation policies (named, dated policy strings).
+  /(?<![\w"-])"?MinimumProtocolVersion"?\s*:\s*"?(?:TLSv1(?:\.1)?_2016|TLSv1|SSLv3)(?=["'\s,}]|$)/gm;
+// ELB/ALB legacy SSL negotiation policies (named, dated policy strings). The value
+// quote is optional (`"?`) so YAML block scalars (`SslPolicy: ELBSecurityPolicy-...`)
+// match too, with a delimiter lookahead so a longer/newer policy name that merely
+// shares the prefix is not matched.
 const RE_CFN_ELB_TLS =
-  /(?<![\w"-])"?SslPolicy"?\s*:\s*"ELBSecurityPolicy-(?:2016-08|TLS-1-0-\d{4}-\d{2}|TLS-1-1-\d{4}-\d{2})"/g;
+  /(?<![\w"-])"?SslPolicy"?\s*:\s*"?ELBSecurityPolicy-(?:2016-08|TLS-1-0-\d{4}-\d{2}|TLS-1-1-\d{4}-\d{2})(?=["'\s,}]|$)/g;
 // Azure ARM Microsoft.KeyVault key resource `properties.kty`.
 const RE_CFN_ARM_KV_RSA = /(?<![\w"-])"?kty"?\s*:\s*"?RSA"?(?!\w)/g;
 const RE_CFN_ARM_KV_EC = /(?<![\w"-])"?kty"?\s*:\s*"?EC"?(?!\w)/g;
@@ -195,9 +221,13 @@ export const cloudformationDetector: Detector = {
   detect({ file, content }): Finding[] {
     if (!CFN_MARKERS.some((marker) => content.includes(marker))) return [];
 
+    // Mask whole `#` comment lines (YAML CFN/ARM templates ship large commented-out
+    // blocks); harmless for JSON, which has no comments. Offsets preserved so finding
+    // locations stay exact. `.yaml`/`.json` are not centrally comment-stripped.
+    const scan = maskCommentLines(content, ["#"]);
     const findings: Finding[] = [];
     const add = (re: RegExp, rule: RuleMeta) =>
-      eachMatch(re, content, (m) =>
+      eachMatch(re, scan, (m) =>
         findings.push(
           findingFromRule(rule, { file, content, index: m.index, matchLength: m[0].length }),
         ),
@@ -208,8 +238,13 @@ export const cloudformationDetector: Detector = {
     add(RE_CFN_ACM_EC, RULE_CFN_ACM_EC);
     add(RE_CFN_CLOUDFRONT_TLS, RULE_CFN_CLOUDFRONT_TLS);
     add(RE_CFN_ELB_TLS, RULE_CFN_ELB_TLS);
-    add(RE_CFN_ARM_KV_RSA, RULE_CFN_ARM_KV_RSA);
-    add(RE_CFN_ARM_KV_EC, RULE_CFN_ARM_KV_EC);
+    // The bare `kty` attribute is generic (every JWK has it), so only treat it as
+    // an ARM Key Vault key when the ARM resource type is actually present — otherwise
+    // a JWK in a file gated in by another marker (e.g. SslPolicy) would misfire here.
+    if (content.includes("Microsoft.KeyVault")) {
+      add(RE_CFN_ARM_KV_RSA, RULE_CFN_ARM_KV_RSA);
+      add(RE_CFN_ARM_KV_EC, RULE_CFN_ARM_KV_EC);
+    }
     return findings;
   },
 };

package/src/detectors/codesign.ts

@@ -0,0 +1,214 @@
+/**
+ * Config detector: classical **code-signing CLI** invocations in build scripts —
+ * the tools that sign long-lived, distributable artifacts (Windows installers,
+ * Android APKs, RPM/deb packages, NuGet packages, macOS apps) with a classical
+ * RSA/ECDSA signing identity.
+ *
+ * Why this is quantum-migration debt: a code signature produced today keeps
+ * verifying against its classical public key for the life of the artifact
+ * (installers and packages linger on mirrors and machines for years). Once a
+ * cryptographically-relevant quantum computer (CRQC) can recover the signing
+ * key from that public key, every such signature becomes *forgeable* — an
+ * attacker can mint a validly-signed trojaned installer. This is the
+ * signature-side analogue of harvest-now-decrypt-later: there is no
+ * confidentiality to harvest, so findings are `category:"signature"`,
+ * `hndl:false`, but they are real debt to inventory now.
+ *
+ * How this differs from the two neighbouring signing detectors — kept
+ * deliberately non-overlapping:
+ *
+ *  - `cicd.ts` (cicdDetector) is gated to CI *pipeline* files
+ *    (`.github/workflows/*.yml`, `.gitlab-ci.yml`, Jenkinsfile, azure-pipelines,
+ *    CircleCI) and matches the release-automation signers there
+ *    (cosign / gpg / jarsigner / codesign / minisign). It intentionally does
+ *    NOT fire on a plain `build.sh`, `build.ps1`, `build.gradle`, or Makefile.
+ *  - `supply-chain.ts` (supplyChainDetector) covers container/artifact signing
+ *    (Docker Content Trust, CNCF Notation, in-toto) in CI files, Dockerfiles,
+ *    and shell scripts.
+ *
+ * This detector fills the gap: the *native platform* code-signing CLIs
+ * (`signtool`, `osslsigncode`, `Set-AuthenticodeSignature`, `apksigner`, Gradle
+ * `signingConfigs`, `rpmsign`/`dpkg-sig`, `nuget sign`, `notarytool`) as they
+ * appear in a build script of ANY extension — because that is where developers
+ * actually run them. It applies everywhere except documentation
+ * (a README showing `signtool sign` is prose, not a build step). One token
+ * (`codesign`) can also be matched by `cicd.ts` when it appears inside a CI
+ * file; a duplicate finding across the two detectors is acceptable, and keeping
+ * `codesign` here means a `codesign --sign` in a hand-written `build.sh` — which
+ * `cicd.ts`'s CI-file gate deliberately skips — is still caught.
+ *
+ * Precision comes from two gates, mirroring `dnssec.ts`: a cheap file-level
+ * fast-reject (bail unless some signing-command marker is present) and
+ * comment-line masking (`#` for shell/PowerShell/Makefile/Gradle, `//` for
+ * Gradle/Groovy) so a commented-out signing step never fires. The rule regexes
+ * themselves key on distinctive `<tool> sign` command shapes, so the residual
+ * false-positive risk is low and confidence is `high`.
+ */
+import type { Detector, Finding, RuleMeta } from "../types.js";
+import {
+  eachMatch,
+  findingFromRule,
+  hasExtension,
+  maskCommentLines,
+  DOC_EXTENSIONS,
+} from "../detect-utils.js";
+import { CWE_BROKEN_CRYPTO } from "../cwe.js";
+
+/** Shared one-line explanation, parameterised by the signing tool named in the finding. */
+function signMessage(tool: string): string {
+  return (
+    `${tool} signs an artifact with a classical RSA/ECDSA key; the signature is ` +
+    `forgeable once a CRQC can recover the signing key — inventory the signing ` +
+    `identity and plan PQC migration.`
+  );
+}
+
+/** Shared remediation: no PQC code-signing format is broadly standardized yet. */
+const REMEDIATION =
+  "No PQC code-signing format is broadly standardized yet; track platform roadmaps " +
+  "(e.g. Sigstore/PQC, Authenticode); keep signing-key rotation ready.";
+
+/**
+ * Distinctive markers for the file-level fast-reject. Kept as a SUPERSET of the
+ * rule tokens below so the cheap gate can never exclude a file one of the rules
+ * would match: it includes every rule's trigger token (`--addsign`, `%_gpg_name`,
+ * `codesign`, `nuget`, …), not only the headline command names.
+ */
+const MARKER_RE =
+  /signtool|osslsigncode|AuthenticodeSignature|apksigner|signingConfigs|rpmsign|--addsign|%_gpg_name|dpkg-sig|nuget|notarytool|codesign/;
+
+interface CsRule {
+  re: RegExp;
+  meta: RuleMeta;
+}
+
+const CS_RULES: CsRule[] = [
+  {
+    // Windows Authenticode: `signtool sign …` (optionally `signtool.exe`),
+    // `osslsigncode sign …`, or the PowerShell `Set-AuthenticodeSignature` cmdlet.
+    re: /\bsigntool(?:\.exe)?\s+sign\b|\bosslsigncode\s+sign\b|\bSet-AuthenticodeSignature\b/g,
+    meta: {
+      id: "codesign-authenticode",
+      title: "Windows Authenticode code signing (RSA)",
+      description: "signtool / osslsigncode / Set-AuthenticodeSignature Authenticode signing",
+      category: "signature",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "RSA",
+      hndl: false,
+      cwe: CWE_BROKEN_CRYPTO,
+      message: signMessage(
+        "Windows Authenticode (signtool/osslsigncode/Set-AuthenticodeSignature)",
+      ),
+      remediation: REMEDIATION,
+    },
+  },
+  {
+    // Android: `apksigner sign …` (covers `--ks` / `--ks-key-alias` forms), or a
+    // Gradle `signingConfigs { … }` block (which carries `storeFile`/`keyAlias`).
+    re: /\bapksigner\s+sign\b|\bsigningConfigs\s*\{/g,
+    meta: {
+      id: "codesign-apk",
+      title: "Android APK signing (RSA)",
+      description: "apksigner / Gradle signingConfigs APK signing",
+      category: "signature",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "RSA",
+      hndl: false,
+      cwe: CWE_BROKEN_CRYPTO,
+      message: signMessage("Android APK signing (apksigner/Gradle signingConfigs)"),
+      remediation: REMEDIATION,
+    },
+  },
+  {
+    // RPM/deb: `rpmsign --addsign`, `rpm --addsign`, the `%_gpg_name` rpmmacro, or
+    // `dpkg-sig --sign`. All ultimately GPG (classically RSA) signatures.
+    re: /\brpmsign\s+--addsign\b|\brpm\s+--addsign\b|%_gpg_name\b|\bdpkg-sig\s+--sign\b/g,
+    meta: {
+      id: "codesign-rpm",
+      title: "RPM/deb package signing (RSA)",
+      description: "rpmsign / rpm --addsign / %_gpg_name / dpkg-sig package signing",
+      category: "signature",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "RSA",
+      hndl: false,
+      cwe: CWE_BROKEN_CRYPTO,
+      message: signMessage("RPM/deb package signing (rpmsign/rpm --addsign/dpkg-sig, GPG)"),
+      remediation: REMEDIATION,
+    },
+  },
+  {
+    // NuGet: `nuget sign …` — also matches `dotnet nuget sign …` (the `nuget sign`
+    // token is a substring of it), typically paired with `--certificate-*` flags.
+    re: /\bnuget\s+sign\b/g,
+    meta: {
+      id: "codesign-nuget",
+      title: "NuGet package signing (RSA)",
+      description: "nuget sign / dotnet nuget sign package signing",
+      category: "signature",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "RSA",
+      hndl: false,
+      cwe: CWE_BROKEN_CRYPTO,
+      message: signMessage("NuGet package signing (nuget sign/dotnet nuget sign)"),
+      remediation: REMEDIATION,
+    },
+  },
+  {
+    // Apple: `xcrun notarytool submit …`, or `codesign --sign` / `codesign -s`.
+    // Allow intervening flags before `--sign`/`-s`, bounded to the codesign
+    // invocation so it can't latch onto a later command's flag across `&&`/`|`/`;`
+    // (same shape as cicd.ts's codesign rule). Algorithm is "unknown": an Apple
+    // signing identity may be RSA or ECDSA.
+    re: /\bnotarytool\s+submit\b|\bcodesign\b[^\n&|;]{0,120}?\s(?:-s\b|--sign\b)/g,
+    meta: {
+      id: "codesign-apple",
+      title: "Apple code signing / notarization",
+      description: "codesign --sign / xcrun notarytool submit macOS signing",
+      category: "signature",
+      severity: "medium",
+      confidence: "high",
+      algorithm: "unknown",
+      hndl: false,
+      cwe: CWE_BROKEN_CRYPTO,
+      message: signMessage("Apple code signing (codesign/notarytool)"),
+      remediation: REMEDIATION,
+    },
+  },
+];
+
+/** Detects classical code-signing CLI invocations in build scripts. */
+export const codesignDetector: Detector = {
+  id: "codesign-signing",
+  description:
+    "Classical code-signing CLIs in build scripts (Authenticode, APK, RPM, NuGet, Apple)",
+  scope: "config",
+  language: "any",
+  rules: CS_RULES.map((r) => r.meta),
+  // Applies to build scripts of any extension EXCEPT documentation: a README that
+  // shows `signtool sign` in an example is prose, not a build step.
+  appliesTo: (f) => !hasExtension(f, DOC_EXTENSIONS),
+  detect({ file, content }): Finding[] {
+    // Cheap fast-reject: bail unless some signing-command marker is present, so
+    // the per-rule regexes never run on the overwhelming majority of files.
+    if (!MARKER_RE.test(content)) return [];
+
+    // Mask whole comment lines so a commented-out signing step can't fire.
+    // `#` covers shell / PowerShell / Makefile / Gradle(Groovy & Kotlin DSL);
+    // `//` covers Gradle/Groovy. Offsets are preserved so finding locations stay
+    // exact (see maskCommentLines).
+    const scan = maskCommentLines(content, ["#", "//"]);
+    const findings: Finding[] = [];
+    for (const rule of CS_RULES) {
+      eachMatch(rule.re, scan, (m) => {
+        findings.push(
+          findingFromRule(rule.meta, { file, content, index: m.index, matchLength: m[0].length }),
+        );
+      });
+    }
+    return findings;
+  },
+};

package/src/detectors/csharp.ts

@@ -27,14 +27,24 @@ const RE_CS_DSA = /\bDSA\.Create\s*\(|\bnew\s+DSACryptoServiceProvider\s*\(|\bne
 //   - SslProtocols.Ssl3 / .Tls / .Tls11 → deprecated SSL 3.0 / TLS 1.0 / 1.1.
 // `SslProtocols.Tls` (no suffix) is the legacy TLS 1.0 constant; `Tls12`/`Tls13`
 // are excluded by the trailing \b (the following digit is a word char).
+// Only the genuinely-permissive forms: the built-in accept-any validator, or a
+// callback assigned an always-`true` lambda. A callback assigned a NAMED validator
+// method is typically certificate PINNING (stricter than default) and must NOT fire.
+// An accept-any server-certificate callback: the BouncyCastle helper, or a
+// ServerCertificateCustomValidationCallback that unconditionally yields `true` — as an
+// expression lambda (`=> true`), a block-body lambda (`=> { return true; }`), or a
+// `delegate { return true; }`. Requiring a literal `true` (not just any `=>`) keeps
+// certificate PINNING — which returns a comparison, `=> cert.Thumbprint == pinned` —
+// from being flagged as a disabled validator.
 const RE_CS_TLS_CERT_VALIDATION =
-  /\bDangerousAcceptAnyServerCertificateValidator\b|ServerCertificateCustomValidationCallback\s*=/g;
+  /\bDangerousAcceptAnyServerCertificateValidator\b|ServerCertificateCustomValidationCallback\s*=\s*(?:[^;\n]{0,80}=>\s*(?:true\b|\{\s*return\s+true\b)|delegate\s*(?:\([^)]{0,80}\))?\s*\{\s*return\s+true\b)/g;
 const RE_CS_TLS_LEGACY_VERSION = /\bSslProtocols\.(?:Tls|Tls11|Ssl3)\b/g;
 // Identifier-form JWT/JOSE signature algorithms (audit F7). The quoted-string
 // alg token ("RS256") is caught by the language-agnostic jwt-jose detector, but
 // Microsoft.IdentityModel passes the alg as an IDENTIFIER, not a string literal:
-// SecurityAlgorithms.RsaSha256 / SecurityAlgorithms.EcdsaSha256.
-const RE_CS_JWT_ALG = /\bSecurityAlgorithms\.(?:Rsa|Ecdsa)Sha(?:256|384|512)\b/g;
+// SecurityAlgorithms.RsaSha256 / SecurityAlgorithms.EcdsaSha256, and the
+// `…Signature`-suffixed constants used in SigningCredentials (RsaSha256Signature).
+const RE_CS_JWT_ALG = /\bSecurityAlgorithms\.(?:Rsa|Ecdsa)Sha(?:256|384|512)(?:Signature)?\b/g;
 // BouncyCastle (Org.BouncyCastle) modern-curve and finite-field DH primitives,
 // which System.Security.Cryptography does not expose directly. Each regex is
 // anchored to the distinctive BouncyCastle class names for one family so it