@sebastienrousseau/dotfiles 0.2.519 → 0.2.521

package/scripts/security/check-disclosure-key-expiry.sh

@@ -1,111 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-#
-# scripts/security/check-disclosure-key-expiry.sh
-#
-# Reads the disclosure public key from `docs/security/security-pubkey.asc`,
-# parses its expiry, and exits non-zero when the remaining lifetime is
-# below threshold. Closes the R3 audit N2 finding (no automated alert
-# for the 2029-05-15 expiry).
-#
-# Two thresholds:
-#   --warn-days N    Emit a `::warning::` if expiry is < N days away.
-#                    Default 90.
-#   --fail-days N    Exit 1 (CI failure) if expiry is < N days away.
-#                    Default 30.
-#
-# Usage:
-#   bash scripts/security/check-disclosure-key-expiry.sh
-#   bash scripts/security/check-disclosure-key-expiry.sh --warn-days 180 --fail-days 60
-#
-# Designed to run from `.github/workflows/verify-gpg-wkd.yml` on the
-# weekly schedule, and from a maintainer's local pre-release sanity
-# check. Does NOT require network — reads the in-repo .asc only.
-
-set -euo pipefail
-
-WARN_DAYS=90
-FAIL_DAYS=30
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --warn-days)
-      WARN_DAYS="$2"
-      shift 2
-      ;;
-    --fail-days)
-      FAIL_DAYS="$2"
-      shift 2
-      ;;
-    -h | --help)
-      sed -n '5,25p' "${BASH_SOURCE[0]}"
-      exit 0
-      ;;
-    *)
-      echo "Unknown arg: $1" >&2
-      exit 2
-      ;;
-  esac
-done
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
-ASC="$REPO_ROOT/docs/security/security-pubkey.asc"
-
-if [[ ! -f "$ASC" ]]; then
-  echo "::error::no public key at $ASC" >&2
-  exit 2
-fi
-
-if ! command -v gpg >/dev/null 2>&1; then
-  echo "::warning::gpg not installed — cannot verify key expiry" >&2
-  exit 0
-fi
-
-# Import into a throwaway keyring so we don't pollute the user's real one.
-GNUPGHOME="$(mktemp -d -t dot-disclosure-key.XXXXXX)"
-export GNUPGHOME
-chmod 700 "$GNUPGHOME"
-trap 'rm -rf "$GNUPGHOME"' EXIT
-
-# gpg can emit harmless warnings ("keyboxd older than us", "gpg-agent
-# IPC failed" in fresh GNUPGHOME, etc.) and exit non-zero under
-# `set -e` even when the import itself succeeded. Verify success by
-# checking the err log for the literal `imported: N` (N >= 1) line
-# rather than trusting gpg's exit code.
-gpg --batch --import "$ASC" >/dev/null 2>"$GNUPGHOME/import.err" || true
-if ! grep -qE '^gpg:[[:space:]]*imported: [1-9]' "$GNUPGHOME/import.err"; then
-  echo "::error::gpg import failed for $ASC" >&2
-  cat "$GNUPGHOME/import.err" >&2
-  exit 2
-fi
-
-# `--with-colons` field 7 of the `pub:` line is the expiry in Unix
-# seconds; 0 means no expiry.
-expires=$(gpg --with-colons --fingerprint 2>/dev/null | awk -F: '/^pub:/{print $7; exit}')
-
-if [[ -z "$expires" || "$expires" == "0" ]]; then
-  echo "::warning::disclosure key has no expiry — set one per docs/security/KEY_ROTATION.md" >&2
-  exit 0
-fi
-
-now=$(date -u +%s)
-remaining_days=$(((expires - now) / 86400))
-
-expires_date=$(date -u -r "$expires" '+%Y-%m-%d' 2>/dev/null || date -u -d "@$expires" '+%Y-%m-%d' 2>/dev/null || echo "(date format unknown)")
-
-echo "Disclosure key expires: $expires_date ($remaining_days days from now)"
-echo "  warn threshold: $WARN_DAYS days"
-echo "  fail threshold: $FAIL_DAYS days"
-
-if ((remaining_days < FAIL_DAYS)); then
-  echo "::error::Disclosure key expires in $remaining_days days. Rotate now per docs/security/KEY_ROTATION.md." >&2
-  exit 1
-fi
-
-if ((remaining_days < WARN_DAYS)); then
-  echo "::warning::Disclosure key expires in $remaining_days days. Schedule rotation per docs/security/KEY_ROTATION.md." >&2
-fi
-
-exit 0

package/scripts/security/dns-doh.sh

@@ -1,52 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../../lib/dot/ui.sh
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/../../lib/dot/ui.sh"
-# shellcheck source=../../lib/dot/platform.sh
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/../../lib/dot/platform.sh"
-
-DRY_RUN=0
-for arg in "$@"; do
-  case "$arg" in --dry-run | -n) DRY_RUN=1 ;; esac
-done
-_run_cmd() {
-  if [[ "$DRY_RUN" -eq 1 ]]; then ui_info "[dry-run]" "$*"; else "$@"; fi
-}
-
-ui_init
-ui_header "DNS-over-HTTPS"
-
-if [[ "$DRY_RUN" -eq 1 ]]; then
-  ui_info "Mode" "dry-run (no changes will be made)"
-elif [ "${DOTFILES_DOH:-}" != "1" ]; then
-  ui_warn "DoH" "disabled by default"
-  ui_info "Re-run" "DOTFILES_DOH=1"
-  exit 1
-fi
-
-case "$(dot_platform_id)" in
-  linux | wsl)
-    if command -v resolvectl >/dev/null; then
-      ui_info "Enabling" "systemd-resolved DoH (Cloudflare)"
-      _run_cmd sudo resolvectl dns-over-https on
-      _run_cmd sudo resolvectl dns 1.1.1.1 1.0.0.1
-    else
-      ui_err "systemd-resolved" "not detected"
-      exit 1
-    fi
-    ;;
-  macos)
-    ui_info "Configure" "DoH in your browser"
-    exit 0
-    ;;
-  *)
-    ui_err "Unsupported OS" "DoH config"
-    exit 1
-    ;;
-esac

package/scripts/security/encryption-check.sh

@@ -1,55 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../../lib/dot/ui.sh
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/../../lib/dot/ui.sh"
-# shellcheck source=../../lib/dot/platform.sh
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/../../lib/dot/platform.sh"
-
-ui_init
-ui_header "Encryption Check"
-
-case "$(dot_platform_id)" in
-  macos)
-    if command -v fdesetup >/dev/null; then
-      status=$(fdesetup status || true)
-      echo "$status"
-      echo "$status" | grep -qi "FileVault is On" && {
-        ui_ok "FileVault" "On"
-        exit 0
-      }
-      ui_warn "FileVault" "appears to be off"
-      exit 1
-    else
-      ui_err "fdesetup" "not found"
-      exit 1
-    fi
-    ;;
-  linux | wsl)
-    if command -v lsblk >/dev/null; then
-      lsblk_output=$(lsblk -f)
-      if command -v rg >/dev/null; then
-        if echo "$lsblk_output" | rg -i "crypto|luks" >/dev/null; then
-          ui_ok "LUKS" "encrypted block device detected"
-          exit 0
-        fi
-      else
-        if echo "$lsblk_output" | grep -Ei "crypto|luks" >/dev/null; then
-          ui_ok "LUKS" "encrypted block device detected"
-          exit 0
-        fi
-      fi
-      ui_warn "LUKS" "no crypto volume detected"
-      exit 1
-    fi
-    ;;
-  *)
-    ui_err "Unsupported OS" "encryption check"
-    exit 1
-    ;;
-esac

package/scripts/security/enforce-policies.sh

@@ -1,335 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-# Security Policy Enforcement Script
-# This script enforces security policies across the dotfiles repository
-
-set -euo pipefail
-
-# Script configuration
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-readonly SCRIPT_DIR
-REPO_ROOT="$(cd "${SCRIPT_DIR}/../.." && pwd)"
-readonly REPO_ROOT
-readonly POLICIES_DIR="${REPO_ROOT}/.github/security-policies"
-readonly LOG_FILE="${REPO_ROOT}/.security-audit.log"
-
-# shellcheck source=../../lib/dot/ui.sh
-# shellcheck disable=SC1091
-source "${SCRIPT_DIR}/../../lib/dot/ui.sh"
-ui_init
-
-# Logging function (also writes to log file)
-log() {
-  local level="$1"
-  shift
-  local message="$*"
-  local timestamp
-  timestamp=$(date -u '+%Y-%m-%d %H:%M:%S UTC')
-  echo "[${timestamp}] [${level}] ${message}" | tee -a "${LOG_FILE}"
-}
-
-# Error handling
-error_exit() {
-  log "ERROR" "$1"
-  exit 1
-}
-
-# Check if required tools are installed
-check_dependencies() {
-  log "INFO" "Checking dependencies..."
-
-  local missing_tools=()
-
-  # Required tools
-  local tools=("opa" "gitleaks" "shellcheck" "grep" "find")
-
-  for tool in "${tools[@]}"; do
-    if ! command -v "$tool" &>/dev/null; then
-      missing_tools+=("$tool")
-    fi
-  done
-
-  if [[ ${#missing_tools[@]} -gt 0 ]]; then
-    error_exit "Missing required tools: ${missing_tools[*]}"
-  fi
-
-  log "INFO" "All dependencies satisfied"
-}
-
-# Scan for hardcoded secrets
-scan_secrets() {
-  log "INFO" "Scanning for hardcoded secrets..."
-
-  local violations=0
-
-  # Run gitleaks
-  if gitleaks detect --source="${REPO_ROOT}" --config="${REPO_ROOT}/config/gitleaks.toml" --no-git >/dev/null 2>&1; then
-    log "INFO" "✅ No secrets detected by gitleaks"
-  else
-    log "WARN" "❌ Potential secrets detected by gitleaks"
-    violations=$((violations + 1))
-  fi
-
-  # Manual pattern checks
-  local secret_patterns=(
-    'password\s*=\s*["\047][^"\047]*["\047]'
-    'token\s*=\s*["\047][^"\047]*["\047]'
-    'secret\s*=\s*["\047][^"\047]*["\047]'
-    'key\s*=\s*["\047][^"\047]*["\047]'
-    'AKIA[0-9A-Z]{16}' # AWS Access Key
-    '[0-9a-f]{32,}'    # Potential hash/token
-  )
-
-  for pattern in "${secret_patterns[@]}"; do
-    if grep -r -E -i "${pattern}" "${REPO_ROOT}" \
-      --exclude-dir=".git" \
-      --exclude="*.log" \
-      --exclude="enforce-policies.sh" \
-      --exclude="environment-template.env" >/dev/null 2>&1; then
-      log "WARN" "❌ Potential hardcoded credential pattern found: ${pattern}"
-      violations=$((violations + 1))
-    fi
-  done
-
-  if [[ $violations -eq 0 ]]; then
-    log "INFO" "✅ No hardcoded secrets detected"
-  fi
-
-  return $violations
-}
-
-# Check file permissions
-check_file_permissions() {
-  log "INFO" "Checking file permissions..."
-
-  local violations=0
-
-  # Check for overly permissive files
-  while IFS= read -r -d '' file; do
-    if [[ -f "$file" ]]; then
-      local perms
-      perms=$(stat -c %a "$file" 2>/dev/null || stat -f %OLp "$file")
-      if [[ $perms -gt 755 ]]; then
-        log "WARN" "❌ Overly permissive file: ${file} (${perms})"
-        violations=$((violations + 1))
-      fi
-    fi
-  done < <(find "${REPO_ROOT}" -type f -not -path "*/.git/*" -print0)
-
-  # Check for executable text files
-  local text_extensions=("md" "txt" "json" "yaml" "yml" "toml")
-
-  for ext in "${text_extensions[@]}"; do
-    while IFS= read -r -d '' file; do
-      if [[ -x "$file" ]]; then
-        log "WARN" "❌ Executable text file: ${file}"
-        violations=$((violations + 1))
-      fi
-    done < <(find "${REPO_ROOT}" -name "*.${ext}" -executable -not -path "*/.git/*" -print0)
-  done
-
-  if [[ $violations -eq 0 ]]; then
-    log "INFO" "✅ File permissions are appropriate"
-  fi
-
-  return $violations
-}
-
-# Validate shell scripts
-validate_shell_scripts() {
-  log "INFO" "Validating shell scripts..."
-
-  local violations=0
-
-  while IFS= read -r -d '' script; do
-    if ! shellcheck "$script" >/dev/null 2>&1; then
-      log "WARN" "❌ ShellCheck violations in: ${script}"
-      violations=$((violations + 1))
-    fi
-  done < <(find "${REPO_ROOT}" -name "*.sh" -not -path "*/.git/*" -print0)
-
-  if [[ $violations -eq 0 ]]; then
-    log "INFO" "✅ All shell scripts pass validation"
-  fi
-
-  return $violations
-}
-
-# Check environment variable usage
-check_environment_variables() {
-  log "INFO" "Checking environment variable usage..."
-
-  local violations=0
-
-  # Look for unprotected variable assignments
-  while IFS= read -r -d '' file; do
-    # Skip binary files and specific files
-    if file "$file" | grep -q "text" && [[ ! "$file" =~ \.(log|env)$ ]]; then
-      # Check for variables that should use default patterns
-      if grep -E '^[A-Z_]+=.+$' "$file" >/dev/null 2>&1; then
-        # Check if they use proper defaulting
-        if ! grep -E '\$\{[A-Z_]+:-[^}]*\}' "$file" >/dev/null 2>&1; then
-          local suspicious_vars
-          suspicious_vars=$(grep -E '^[A-Z_]+=.+$' "$file" | head -3)
-          if [[ -n "$suspicious_vars" ]]; then
-            log "WARN" "❌ Potential hardcoded variables in ${file}: ${suspicious_vars}"
-            violations=$((violations + 1))
-          fi
-        fi
-      fi
-    fi
-  done < <(find "${REPO_ROOT}" -type f -not -path "*/.git/*" -not -path "*/.github/security-policies/*" -print0)
-
-  if [[ $violations -eq 0 ]]; then
-    log "INFO" "✅ Environment variable usage is appropriate"
-  fi
-
-  return $violations
-}
-
-# Validate OPA policies
-validate_policies() {
-  log "INFO" "Validating OPA policies..."
-
-  if [[ ! -f "${POLICIES_DIR}/security.rego" ]]; then
-    log "WARN" "❌ Security policy file not found"
-    return 1
-  fi
-
-  if opa test "${POLICIES_DIR}" >/dev/null 2>&1; then
-    log "INFO" "✅ OPA policies are valid"
-    return 0
-  else
-    log "WARN" "❌ OPA policy validation failed"
-    return 1
-  fi
-}
-
-# Check for sensitive files
-check_sensitive_files() {
-  log "INFO" "Checking for sensitive files..."
-
-  local violations=0
-  local sensitive_patterns=(
-    "*.key"
-    "*.pem"
-    "*.p12"
-    "*.pfx"
-    "*.jks"
-    "*.keystore"
-    ".env"
-    ".env.*"
-    "credentials.json"
-    "service-account.json"
-    "id_rsa"
-    "id_dsa"
-    "id_ecdsa"
-    "id_ed25519"
-  )
-
-  for pattern in "${sensitive_patterns[@]}"; do
-    while IFS= read -r -d '' file; do
-      # Skip allowed files
-      if [[ ! "$file" =~ (environment-template\.env|\.pub$) ]]; then
-        log "WARN" "❌ Sensitive file detected: ${file}"
-        violations=$((violations + 1))
-      fi
-    done < <(find "${REPO_ROOT}" -name "${pattern}" -not -path "*/.git/*" -print0)
-  done
-
-  if [[ $violations -eq 0 ]]; then
-    log "INFO" "✅ No sensitive files detected"
-  fi
-
-  return $violations
-}
-
-# Generate security report
-generate_report() {
-  local total_violations="$1"
-  local report_file="${REPO_ROOT}/security-report.md"
-
-  log "INFO" "Generating security report..."
-
-  cat >"${report_file}" <<EOF
-# Security Policy Enforcement Report
-
-**Generated:** $(date -u '+%Y-%m-%d %H:%M:%S UTC')
-**Repository:** $(basename "${REPO_ROOT}")
-**Total Violations:** ${total_violations}
-
-## Security Checks Performed
-
-- ✅ Secrets scanning (gitleaks + manual patterns)
-- ✅ File permissions validation
-- ✅ Shell script analysis (shellcheck)
-- ✅ Environment variable usage check
-- ✅ OPA policy validation
-- ✅ Sensitive files detection
-
-## Security Score
-
-$(if [[ $total_violations -eq 0 ]]; then echo "🟢 **PASSED** - No security violations detected"; else echo "🔴 **FAILED** - ${total_violations} violations detected"; fi)
-
-## Recommendations
-
-1. Review any flagged violations in the audit log
-2. Update hardcoded values to use environment variables
-3. Ensure proper file permissions (644 for files, 755 for executables)
-4. Use the provided environment template for configuration
-5. Run this script regularly as part of your development workflow
-
-## Next Steps
-
-- Fix any identified violations
-- Run \`scripts/security/enforce-policies.sh\` again to verify fixes
-- Consider setting up automated policy enforcement in CI/CD
-
----
-*This report was generated by the automated security policy enforcement system.*
-EOF
-
-  log "INFO" "Security report generated: ${report_file}"
-}
-
-# Main execution
-main() {
-  log "INFO" "Starting security policy enforcement..."
-
-  # Initialize log file
-  echo "# Security Audit Log - $(date -u '+%Y-%m-%d %H:%M:%S UTC')" >"${LOG_FILE}"
-
-  check_dependencies
-
-  local total_violations=0
-
-  # Run all checks
-  scan_secrets || total_violations=$((total_violations + $?))
-  check_file_permissions || total_violations=$((total_violations + $?))
-  validate_shell_scripts || total_violations=$((total_violations + $?))
-  check_environment_variables || total_violations=$((total_violations + $?))
-  validate_policies || total_violations=$((total_violations + 1))
-  check_sensitive_files || total_violations=$((total_violations + $?))
-
-  # Generate report
-  generate_report "$total_violations"
-
-  # Final result
-  if [[ $total_violations -eq 0 ]]; then
-    ui_ok "All security checks passed"
-    log "INFO" "Security policy enforcement completed successfully"
-    exit 0
-  else
-    ui_err "$total_violations violations" "Security policy enforcement failed"
-    ui_warn "Details" "Check ${LOG_FILE}"
-    ui_warn "Report" "Review security-report.md"
-    log "ERROR" "Security policy enforcement failed with ${total_violations} violations"
-    exit 1
-  fi
-}
-
-# Script entry point
-if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
-  main "$@"
-fi

package/scripts/security/firewall.sh

@@ -1,91 +0,0 @@
-#!/usr/bin/env bash
-# SPDX-License-Identifier: MIT
-# Copyright (c) 2015-2026 Sebastien Rousseau
-## Configure system firewall with secure defaults.
-##
-## Enables firewall with deny-by-default policy and minimal exceptions.
-## Requires explicit opt-in via DOTFILES_FIREWALL=1 to prevent accidental
-## lockouts.
-##
-## # Usage
-## DOTFILES_FIREWALL=1 dot firewall
-##
-## # Dependencies
-## - macOS: socketfilterfw (built-in)
-## - Linux: ufw (Uncomplicated Firewall)
-##
-## # Platform Notes
-## ### Platform: macOS
-## - Enables Application Firewall via socketfilterfw
-## - Enables stealth mode (no ICMP responses)
-## - Allows signed applications
-##
-## ### Platform: Linux
-## - Configures UFW with deny incoming / allow outgoing
-## - Allows OpenSSH to prevent lockout
-## - Requires ufw package installed
-##
-## # Security
-## **Requires sudo.** All changes logged to dotfiles.log.
-##
-## # Side Effects
-## - Modifies system firewall rules
-## - May block existing connections
-##
-## # Idempotency
-## Safe to run repeatedly. Applies same rules each time.
-
-set -euo pipefail
-
-SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-# shellcheck source=../../lib/dot/ui.sh
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/../../lib/dot/ui.sh"
-# shellcheck source=../../lib/dot/platform.sh
-# shellcheck disable=SC1091
-source "$SCRIPT_DIR/../../lib/dot/platform.sh"
-
-DRY_RUN=0
-for arg in "$@"; do
-  case "$arg" in --dry-run | -n) DRY_RUN=1 ;; esac
-done
-_run_cmd() {
-  if [[ "$DRY_RUN" -eq 1 ]]; then ui_info "[dry-run]" "$*"; else "$@"; fi
-}
-
-ui_init
-ui_header "Firewall"
-
-if [[ "$DRY_RUN" -eq 1 ]]; then
-  ui_info "Mode" "dry-run (no changes will be made)"
-elif [ "${DOTFILES_FIREWALL:-}" != "1" ]; then
-  ui_warn "Firewall" "disabled by default"
-  ui_info "Re-run" "DOTFILES_FIREWALL=1"
-  exit 1
-fi
-
-case "$(dot_platform_id)" in
-  macos)
-    ui_info "Enabling" "macOS firewall"
-    _run_cmd sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
-    _run_cmd sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsigned on
-    _run_cmd sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setallowsignedapp on
-    _run_cmd sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on
-    ;;
-  linux | wsl)
-    if command -v ufw >/dev/null; then
-      ui_info "Enabling" "UFW"
-      _run_cmd sudo ufw default deny incoming
-      _run_cmd sudo ufw default allow outgoing
-      _run_cmd sudo ufw allow OpenSSH
-      _run_cmd sudo ufw --force enable
-    else
-      ui_err "ufw" "not installed; re-run after install"
-      exit 1
-    fi
-    ;;
-  *)
-    ui_err "Unsupported OS" "firewall setup"
-    exit 1
-    ;;
-esac