@skarn-security/skarn-linux-arm64 0.18.0

package/EULA.md

@@ -0,0 +1,103 @@
+# Skarn End User License Agreement
+
+Version 1.0, 2026-07-15
+
+IMPORTANT: THIS AGREEMENT IS LEGALLY BINDING. BY CONFIRMING ACCEPTANCE WHEN THE SOFTWARE OR A FORM AT GETSKARN.COM PRESENTS THIS AGREEMENT, BY DOWNLOADING, INSTALLING, RUNNING, OR ISSUING ANY COMMAND TO THE SOFTWARE, OR BY AUTHORIZING OR ALLOWING A THIRD PARTY TO DO ANY OF THE FOREGOING ON YOUR BEHALF, YOU INDICATE: (1) YOUR ACCEPTANCE OF THIS AGREEMENT; (2) THAT YOU HAVE READ ALL OF ITS TERMS AND CONDITIONS, UNDERSTAND THEM, AND AGREE TO BE LEGALLY BOUND BY THEM; AND (3) THAT YOU ARE AUTHORIZED TO BIND YOURSELF OR THE ENTITY ON WHOSE BEHALF YOU ACT. IF YOU DO NOT ACCEPT THESE TERMS, DECLINE WHEN THE SOFTWARE OR THE FORM ASKS FOR YOUR ACCEPTANCE, AND DO NOT DOWNLOAD, INSTALL, OR USE THE SOFTWARE.
+
+This End User License Agreement (the "Agreement") is a legal agreement between you (an individual or a legal entity, "you") and company Red Black Tree d.o.o. Čačak, Republic of Serbia (the "Licensor") for the Skarn software. The Licensor intends to incorporate Skarn OU in Estonia and to assign this Agreement and the Software to it as described in Section 16. This Agreement is presented to you before use: the Licensor's official distribution channels publish it and distribute it with the Software, the Software presents it and asks for your acceptance the first time you run it, and the registration and purchase forms at getskarn.com present it before a License Token is issued. You accept this Agreement at the earliest of: (a) confirming acceptance when the Software presents it on first run; (b) confirming acceptance when registering for or purchasing a License Token; or (c) downloading, installing, running, or issuing any command to the Software, whether yourself or through a third party you authorize or allow to do so on your behalf. If you do not agree, do not install or use the Software; if the Software asks for your acceptance and you decline, the Software performs no operation. If you accept on behalf of a legal entity, you represent that you are authorized to bind that entity.
+
+## 1. Definitions
+
+"Software" means the Skarn executable program in binary form, together with its embedded detection rules, documentation, and any updates the Licensor makes available under this Agreement. The Software is distributed in binary form only; no source code is licensed under this Agreement.
+
+"Free Features" means the capabilities of the Software that are available at no charge, whether in Unregistered Use or under a Free License, as published in the Licensor's editions documentation (https://getskarn.com/editions/ and the EDITIONS document distributed with the Software). The editions documentation identifies which Free Features require a Free License.
+
+"Unregistered Use" means running the Software without any License Token installed. The Licensor permits Unregistered Use on a perpetual, no-charge basis for the Free Features the editions documentation identifies as available without a License Token. Unregistered Use is use licensed under this Agreement; it is not time-limited and requires no account or registration.
+
+"Free License" means a License Token the Licensor issues at no charge upon registration at getskarn.com, which enables the Free Features the editions documentation identifies as requiring a Free License. A Free License does not unlock Paid Features.
+
+"Paid License" means a License Token designated Team or Enterprise, which unlocks Paid Features for the tier, scope, and term stated in it and in the applicable order.
+
+"Paid Features" means the capabilities of the Software designated as Team or Enterprise in the editions documentation, which operate only with a valid Paid License covering them.
+
+"License Token" means a cryptographically signed file issued by or on behalf of the Licensor that identifies the holder and states the tier, scope, and term it authorizes. A License Token is either a Free License or a Paid License.
+
+"Feed Content" means detection-rule updates and related signed content the Licensor makes available to holders of a covering License Token.
+
+## 2. License grant
+
+Subject to this Agreement, the Licensor grants you a non-exclusive, non-transferable license to install and run the Software, in binary form, on machines you own or control, for your personal use or your organization's internal business use.
+
+Unregistered Use of the Free Features that are available without a License Token is permitted at no charge and is not time-limited. There is no evaluation period, no obligation to purchase, and no obligation to delete the Software.
+
+A Free License additionally enables the Free Features the editions documentation identifies as requiring one, for the term stated at registration or in the applicable order. Paid Features operate only under a valid Paid License covering them, for the tier, scope, and term stated in it and in the applicable order.
+
+Expiry or invalidity of a License Token does not terminate this Agreement, does not require you to delete or stop using the Software, and never disables Unregistered Use; it affects only the capabilities that License Token enables, in the manner described in the editions documentation. License Token requirements are enforced by the Software; if there is any uncertainty about whether a License Token is required for a given use, you may rely upon the behavior of the Software.
+
+You may permit a contractor or service provider to install and run the Software on machines you own or control, solely for your benefit and for your internal business purposes; you remain fully responsible for their use of the Software under this Agreement. This does not permit the contractor or service provider to offer the Software or its functionality to its own clients as a service (Section 3(b)).
+
+## 3. Restrictions
+
+Except to the extent a restriction is not permitted by applicable law, you shall not: (a) redistribute, sell, rent, lease, sublicense, or otherwise make the Software available to any third party, other than installing it within your own organization from the Licensor's official distribution channels; (b) offer the Software, or any part of its functionality, to third parties as a hosted or managed service; (c) modify, translate, or create derivative works of the Software; (d) reverse engineer, decompile, or disassemble the Software, except to the extent expressly permitted by mandatory applicable law (including Articles 5 and 6 of Directive 2009/24/EC) and then only after first requesting the needed information from the Licensor; (e) circumvent, disable, or tamper with license enforcement, License Token validation, or signature verification in the Software; (f) remove or alter any proprietary notices; (g) share a License Token outside the holder or organization it names, or use a License Token you are not authorized to hold; (h) extract, republish, or redistribute the embedded detection rules or Feed Content outside the Software; (i) use the Software to develop a product or service that competes with the Software; (j) use any credential, secret, or other sensitive artefact identified by the Software to access any system or account, other than for verification and remediation by personnel explicitly authorized to administer the affected system; (k) publish or disclose any benchmark, performance comparison, or detection-efficacy results relating to the Software to any third party without the Licensor's prior written consent. Official distribution channels are those operated by the Licensor, currently getskarn.com, the skarn-security repositories on GitHub, and ghcr.io/skarn-security.
+
+## 4. Ownership
+
+The Software is licensed, not sold. The Licensor retains all right, title, and interest in and to the Software, the source code, the binary executable, the detection rules, the Feed Content, and all associated intellectual property rights, including but not limited to copyrights, trademarks, trade secrets, and patent rights. The Software is protected by the copyright laws of the Republic of Serbia, international copyright treaties, and all other applicable intellectual property laws.
+
+Your possession, installation, or use of the Software, including Unregistered Use, does not transfer to you any title, ownership, or intellectual property rights in the Software. Scan outputs and reports the Software generates from your data (such as SARIF or HTML files) are your property and your responsibility. Any unauthorized copying, redistribution, reverse engineering, or modification of the Software constitutes a material breach of this Agreement and a direct infringement of the Licensor's copyright. All rights not expressly granted under this Agreement are strictly reserved by the Licensor.
+
+## 5. Feedback
+
+If you choose to send the Licensor any suggestions, ideas, bug reports, or feedback about the Software, you hereby grant the Licensor a perpetual, irrevocable, worldwide, royalty-free, fully paid-up, sublicensable, and transferable license to use, disclose, reproduce, license, distribute, and exploit such feedback for any purpose, including improving the Software or developing new products, without any obligation, royalty, restriction, or attribution to you. You are not required to provide feedback, and feedback does not include your scanned data, code, or scan results.
+
+## 6. Third-party components
+
+The Software incorporates third-party open-source components (including PCRE2 and SQLite) under their own licenses, listed in the THIRD-PARTY-NOTICES document distributed with the Software. Those licenses govern the respective components; this Agreement governs the Software as a whole.
+
+## 7. Data handling and network features
+
+The Software runs on your machines and processes data locally. It does not transmit scanned session content, scan results, or usage telemetry to the Licensor or to third parties, and it makes no network call when it scans; the only personal data it ever transmits is the License Token holder identity during a license renewal you explicitly invoke, as described below. Unregistered Use requires no account. A License Token is verified offline against a key embedded in the Software; the Software makes no activation, callback, heartbeat, or license-check network request at run time. The record of your acceptance of this Agreement is stored in a file on your machine and is not transmitted to the Licensor. Network connections occur only when you explicitly invoke one of the Software's two network features: (a) rule-feed updates, which download signed Feed Content from the Licensor and transmit at most the feed subscriber token that authenticates the subscription; (b) license renewal, which transmits your License Token, including the holder identity stated in it (such as the account and organization name), to the Licensor's licensing service and installs the renewed License Token it returns. Each of these runs only on your explicit invocation, and neither transmits session content or scan results; rule-feed updates are additionally disabled by the offline flag. You are responsible for the consequences of enabling a network feature, including compliance with your organization's policies. Any online services the Licensor operates for license issuance or account management are governed by their own terms and privacy notice.
+
+## 8. Your responsibilities
+
+The Software reads AI coding-assistant session data and related files present on the machines where you run it. You are responsible for ensuring that you are authorized to access and process that data, and for complying with the laws and internal policies that apply to it.
+
+## 9. Security-tool disclaimer
+
+The Software performs pattern-based detection. The Licensor does not warrant that the Software will detect every credential, secret, attack pattern, or security issue, nor that reported findings are free of false positives. The Software surfaces findings; it does not remediate them. You remain responsible for verifying findings, rotating exposed credentials, incident response, and the security of your systems, and you agree not to rely solely on the Software in developing or operating your security program. When the Software's real-time guard operates in an enforcing mode, it may block or delay actions it assesses as risky, including legitimate ones; you are responsible for choosing the enforcement mode and for the consequences of blocked actions. The Software and its output are not legal, compliance, or security advice, and use of the Software does not by itself establish compliance with any law or standard. The Software is not designed or licensed for use in safety-critical systems.
+
+## 10. Feed Content and updates
+
+Feed Content is available to holders of a covering License Token for use within the Software during the subscription term stated in the applicable order. The Licensor may make Software updates available; this Agreement applies to updates unless the update is accompanied by different terms.
+
+## 11. Support
+
+The Free Features are provided without a support commitment. Support for Paid Features, if any, is as stated in the applicable order.
+
+## 12. Warranty disclaimer
+
+THE SOFTWARE IS PROVIDED AS IS AND AS AVAILABLE, WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT, EXCEPT TO THE EXTENT A WARRANTY CANNOT BE DISCLAIMED UNDER APPLICABLE LAW.
+
+## 13. Limitation of liability
+
+TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE LICENSOR SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, OR FOR LOSS OF PROFITS, REVENUE, DATA, OR GOODWILL, ARISING OUT OF OR RELATING TO THIS AGREEMENT OR THE SOFTWARE. NOTWITHSTANDING ANYTHING TO THE CONTRARY IN THIS AGREEMENT, IF YOUR USE OF THE SOFTWARE IS NOT PAID FOR, MEANING UNREGISTERED USE OR USE UNDER A FREE LICENSE, THE SOFTWARE IS PROVIDED ENTIRELY AS IS AND THE LICENSOR'S AGGREGATE LIABILITY FOR ANY DAMAGES, LOSSES, OR CLAIMS ARISING OUT OF OR IN CONNECTION WITH SUCH USE SHALL BE EXACTLY EUR 0; IN THE CASE OF USE UNDER A PAID LICENSE, THE LICENSOR'S AGGREGATE LIABILITY SHALL BE STRICTLY LIMITED TO THE ACTUAL AMOUNTS RECEIVED BY THE LICENSOR FROM YOU IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO SUCH CLAIM, WHETHER PAID AS A LUMP SUM OR AS THE SUM OF ALL INSTALLMENTS DUE AND PAID WITHIN THAT SPECIFIC TWELVE-MONTH PERIOD. NOTHING IN THIS AGREEMENT EXCLUDES OR LIMITS LIABILITY THAT CANNOT BE EXCLUDED OR LIMITED UNDER APPLICABLE LAW, INCLUDING LIABILITY FOR INTENT OR GROSS NEGLIGENCE WHERE SO PROVIDED.
+
+## 14. Term and termination
+
+This Agreement is effective until terminated. It terminates automatically if you materially breach it. Upon termination you must stop using the Software and destroy your copies. Paid entitlements end per the applicable order. Sections 3, 4, 5, 8, 9, 12, 13, and 15 through 17 survive termination.
+
+## 15. Export and sanctions
+
+You shall comply with applicable export-control and sanctions laws in your use of the Software and represent that you are not a person or entity to whom supply of the Software is prohibited under those laws.
+
+## 16. General
+
+This Agreement is the entire agreement between you and the Licensor regarding the Software and supersedes prior discussions on that subject; where you hold a separately negotiated written agreement with the Licensor covering the Software, that agreement prevails to the extent of any conflict. The Licensor may publish revised versions of this Agreement at https://getskarn.com/terms/; the version and date at the top identify the terms in force. Renewal of a License Token, or continued use of the Software after a revised version is published, constitutes acceptance of the revised terms. If a provision is held unenforceable, the remainder stays in effect. A failure to enforce a provision is not a waiver. You may not assign this Agreement without the Licensor's written consent; the Licensor may assign this Agreement, in whole, to a successor of the business, including to Skarn OU upon its incorporation, with the assignment taking effect on notice published at https://getskarn.com/terms/. This Agreement does not limit any rights you hold as a consumer that cannot be limited under applicable law.
+
+## 17. Governing law and venue
+
+This Agreement is governed by the laws of the Republic of Serbia, excluding its conflict-of-law rules and the United Nations Convention on Contracts for the International Sale of Goods. The competent court in Belgrade, Serbia has exclusive jurisdiction, subject to any mandatory consumer venue rules.
+
+## 18. Contact
+
+Licensing questions: hello@getskarn.com

package/THIRD-PARTY-NOTICES.md

@@ -0,0 +1,123 @@
+# Third-Party Notices
+
+Skarn is distributed as a single statically linked binary. It incorporates the third-party components and adapted detection-rule patterns listed below. Each notice applies only to the referenced component or patterns, not to Skarn itself.
+
+## PCRE2
+
+- Project: https://github.com/PCRE2Project/pcre2
+- License: BSD-3-Clause WITH PCRE2-exception
+- Statically linked into the Skarn binary as the regular-expression engine for detection rules and session search.
+
+```
+Copyright (c) 1997-2007 University of Cambridge
+Copyright (c) 2007-2024 Philip Hazel
+All rights reserved.
+
+PCRE2 Just-In-Time compilation support and the Stack-less Just-In-Time
+compiler:
+Copyright (c) 2009-2024 Zoltan Herczeg
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notices,
+  this list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright
+  notices, this list of conditions and the following disclaimer in the
+  documentation and/or other materials provided with the distribution.
+
+* Neither the name of the University of Cambridge nor the names of any
+  contributors may be used to endorse or promote products derived from this
+  software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
+LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.
+```
+
+## SQLite
+
+- Project: https://sqlite.org
+- License: Public domain
+
+The vendored SQLite amalgamation is compiled into the Skarn binary to read Cursor and VS Code session stores. SQLite is in the public domain and requires no license or attribution; it is listed here for completeness.
+
+## Detection rules
+
+Skarn's bundled community detection rules were adapted from the open-source secret-detection projects listed below. Their license terms require that the attribution and license text be retained in redistribution; they are reproduced here. These notices apply only to the detection-rule patterns adapted from each project, not to Skarn itself.
+
+### gitleaks
+
+- Project: https://github.com/gitleaks/gitleaks
+- Copyright (c) 2019 Zachary Rice
+- License: MIT
+
+```
+MIT License
+
+Copyright (c) 2019 Zachary Rice
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+```
+
+### Kingfisher
+
+- Project: https://github.com/mongodb/kingfisher
+- Copyright MongoDB, Inc.
+- License: Apache License 2.0
+
+### Titus
+
+- Project: https://github.com/praetorian-inc/titus
+- Copyright Praetorian, Inc.
+- License: Apache License 2.0
+
+### Apache License 2.0
+
+The Kingfisher and Titus rule patterns are licensed under the Apache License, Version 2.0. You may obtain a copy of the License at:
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. Rule patterns adapted from these projects have been modified for Skarn's detection engine.
+
+### Upstream NOTICE attributions
+
+Kingfisher and Titus each distribute a NOTICE file under Section 4(d) of the Apache License 2.0. The attributions in those files that pertain to rule patterns adapted into Skarn are reproduced below.
+
+Titus's detection rules are derived from NoseyParker (https://github.com/praetorian-inc/noseyparker), licensed under the Apache License, Version 2.0. Certain rule patterns adapted from Kingfisher (among them the Firebase, Kubernetes, and Redis rules) are derived in part from Titus.
+
+```
+NoseyParker
+Copyright 2023-2026 Praetorian Security, Inc.
+
+This product includes software developed at Praetorian Security, Inc.
+(https://www.praetorian.com/).
+
+Licensed under the Apache License, Version 2.0.
+```

package/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "@skarn-security/skarn-linux-arm64",
+  "version": "0.18.0",
+  "description": "Skarn prebuilt binary for Linux arm64. Installed automatically by @skarn-security/skarn; do not depend on it directly.",
+  "homepage": "https://getskarn.com",
+  "license": "SEE LICENSE IN EULA.md",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/skarn-security/skarn-dist.git"
+  },
+  "os": [
+    "linux"
+  ],
+  "cpu": [
+    "arm64"
+  ],
+  "files": [
+    "bin/skarn",
+    "EULA.md",
+    "THIRD-PARTY-NOTICES.md"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}