@svp-labs/talos 0.0.0 → 0.1.0

package/dist/checks/runtime/version-files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version-files.js","sourceRoot":"","sources":["../../../src/checks/runtime/version-files.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAoB,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE1D;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,IAAY;IACxD,MAAM,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,WAAW,GAAG,mCAAmC,CAAC;AAExD,SAAS,UAAU,CACjB,IAAY,EACZ,KAAuD;IAEvD,MAAM,KAAK,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;QAC1C,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACxC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,IAAY;IAC1D,OAAO,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;AAE9F,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC9C,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,OAAO,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,OAAe;IAC9C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1E,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,IAAY;IAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,iBAAiB,CAAC,IAAI,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,OAAO,KAAK,SAAS,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAClF,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,IAAI,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,IAAY;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9C,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;CAC9D,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY;IACrD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAG,cAAc,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;IACvE,MAAM,OAAO,GAAG,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3E,IAAI,GAAG,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IACzF,OAAO,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;AACvF,CAAC"}

package/dist/checks/runtime/versions.js

@@ -0,0 +1,51 @@
+/** A release number: dotted digits, nothing else. */
+const RELEASE = /^\d+(?:\.\d+)*$/;
+/** Whether the text is a plain release number, such as `8.4.26` or `22`. */
+export function isRelease(text) {
+    return RELEASE.test(text);
+}
+/** One exact release: major, minor and patch, with no pre-release suffix. */
+export function isExactRelease(text) {
+    return isRelease(text) && text.split('.').length === 3;
+}
+function numbers(version) {
+    return version.split('.').map(Number);
+}
+/** Numeric order of dotted versions; a shorter one sorts first on a tie. */
+export function compareVersions(a, b) {
+    const [x, y] = [numbers(a), numbers(b)];
+    for (let index = 0; index < Math.max(x.length, y.length); index += 1) {
+        const diff = (x[index] ?? -1) - (y[index] ?? -1);
+        if (diff !== 0)
+            return diff;
+    }
+    return 0;
+}
+/** The newest of the versions, or `undefined` for none. */
+export function newest(versions) {
+    let best;
+    for (const version of versions) {
+        if (best === undefined || compareVersions(version, best) > 0)
+            best = version;
+    }
+    return best;
+}
+/** Whether `version` belongs to the release cycle `cycle`: `8.4.26` to `8.4`, `22.1.0` to `22`. */
+export function inCycle(version, cycle) {
+    return version === cycle || version.startsWith(`${cycle}.`);
+}
+/** The most specific of the cycles a version belongs to. */
+export function cycleOf(version, cycles) {
+    let found;
+    for (const cycle of cycles) {
+        if (inCycle(version, cycle) && (found === undefined || cycle.length > found.length)) {
+            found = cycle;
+        }
+    }
+    return found;
+}
+/** The leading release number of a text (`8.4.26` of `8.4.26RC1`), or `undefined`. */
+export function leadingRelease(text) {
+    return /^\d+(?:\.\d+)*/.exec(text)?.[0];
+}
+//# sourceMappingURL=versions.js.map

package/dist/checks/runtime/versions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"versions.js","sourceRoot":"","sources":["../../../src/checks/runtime/versions.ts"],"names":[],"mappings":"AAAA,qDAAqD;AACrD,MAAM,OAAO,GAAG,iBAAiB,CAAC;AAElC,4EAA4E;AAC5E,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,eAAe,CAAC,CAAS,EAAE,CAAS;IAClD,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;IAC9B,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,MAAM,CAAC,QAA2B;IAChD,IAAI,IAAwB,CAAC;IAC7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC;YAAE,IAAI,GAAG,OAAO,CAAC;IAC/E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,mGAAmG;AACnG,MAAM,UAAU,OAAO,CAAC,OAAe,EAAE,KAAa;IACpD,OAAO,OAAO,KAAK,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;AAC9D,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,OAAO,CAAC,OAAe,EAAE,MAAyB;IAChE,IAAI,KAAyB,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;YACpF,KAAK,GAAG,KAAK,CAAC;QAChB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC"}

package/dist/checks/security/dependencies.js

@@ -0,0 +1,70 @@
+import { readFile, writeFile } from 'node:fs/promises';
+import { join, posix } from 'node:path';
+import { allowedLicences } from './licences.js';
+import { osvIgnores, osvLockfiles } from './osv-config.js';
+import { dependencyFindings, parseOsvReport } from './osv.js';
+import { APPLIES, EngineError, skip, } from '../../core/check.js';
+import { sameName } from '../supply/advisories.js';
+import { LOCKFILE_NAMES, readLockfile } from '../supply/lockfiles/index.js';
+/** osv-scanner: 0 nothing found, 1 something found, 128 no package in any lockfile. */
+const READ_EXITS = new Set([0, 1, 128]);
+function hasOsvLockfile(ctx) {
+    return osvLockfiles(ctx.facts).length > 0 ? APPLIES : skip('the repository has no lockfile');
+}
+/** Each lockfile Talos reads itself, indexed so a scanned package finds its entry. */
+async function lockedLookup(ctx, files) {
+    const readable = files.filter((file) => LOCKFILE_NAMES.includes(posix.basename(file)));
+    const entries = new Map();
+    for (const file of readable)
+        entries.set(file, await readLockfile(ctx.root, file));
+    return (lockfile, name, version) => entries
+        .get(lockfile)
+        ?.find((locked) => locked.version === version && sameName(locked.ecosystem, locked.name, name));
+}
+async function scan(ctx, files) {
+    const tool = await ctx.tools.path('osv-scanner');
+    const config = join(ctx.scratch, 'osv-scanner.toml');
+    const output = join(ctx.scratch, 'osv.json');
+    await writeFile(config, osvIgnores(ctx.config));
+    const args = [
+        'scan',
+        'source',
+        '--format=json',
+        `--output-file=${output}`,
+        '--verbosity=error',
+        '--no-call-analysis=all',
+        `--config=${config}`,
+        `--licenses=${allowedLicences(ctx.config).join(',')}`,
+        ...files.flatMap((file) => ['-L', file]),
+    ];
+    const result = await ctx.exec(tool, args, { cwd: ctx.root });
+    if (!READ_EXITS.has(result.code)) {
+        const detail = result.stderr.trim().split('\n').at(-1) ?? '';
+        throw new EngineError(`osv-scanner exited ${result.code}: ${detail}`);
+    }
+    return result.code === 128 ? undefined : readFile(output, 'utf8');
+}
+/**
+ * osv-scanner over every lockfile: each advisory is a finding, a high or critical one failing
+ * every change until it is fixed or an unexpired exception covers it; each licence outside the
+ * org's allowlist and the project's additions is a finding too.
+ */
+export function dependenciesCheck() {
+    return {
+        id: 'security/dependencies',
+        tier: 'head',
+        scope: 'repo',
+        title: 'osv-scanner: known vulnerabilities and licences in every lockfile',
+        applies: hasOsvLockfile,
+        run: async (ctx) => {
+            const files = osvLockfiles(ctx.facts);
+            const report = await scan(ctx, files);
+            if (report === undefined)
+                return [];
+            const packages = parseOsvReport(report, ctx.root);
+            const lookup = await lockedLookup(ctx, files);
+            return dependencyFindings(packages, lookup, allowedLicences(ctx.config));
+        },
+    };
+}
+//# sourceMappingURL=dependencies.js.map

package/dist/checks/security/dependencies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependencies.js","sourceRoot":"","sources":["../../../src/checks/security/dependencies.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAChD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAqB,cAAc,EAAE,MAAM,UAAU,CAAC;AACjF,OAAO,EACL,OAAO,EAKP,WAAW,EACX,IAAI,GACL,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAe,cAAc,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAC;AAEzF,uFAAuF;AACvF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AAExC,SAAS,cAAc,CAAC,GAAiB;IACvC,OAAO,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;AAC/F,CAAC;AAED,sFAAsF;AACtF,KAAK,UAAU,YAAY,CAAC,GAAiB,EAAE,KAAwB;IACrE,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,IAAI,GAAG,EAA6B,CAAC;IACrD,KAAK,MAAM,IAAI,IAAI,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;IACnF,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CACjC,OAAO;SACJ,GAAG,CAAC,QAAQ,CAAC;QACd,EAAE,IAAI,CACJ,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,KAAK,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CACxF,CAAC;AACR,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,GAAiB,EAAE,KAAwB;IAC7D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC7C,MAAM,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG;QACX,MAAM;QACN,QAAQ;QACR,eAAe;QACf,iBAAiB,MAAM,EAAE;QACzB,mBAAmB;QACnB,wBAAwB;QACxB,YAAY,MAAM,EAAE;QACpB,cAAc,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACrD,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;KACzC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7D,MAAM,IAAI,WAAW,CAAC,sBAAsB,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO;QACL,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,MAAM;QACZ,KAAK,EAAE,MAAM;QACb,KAAK,EAAE,mEAAmE;QAC1E,OAAO,EAAE,cAAc;QACvB,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACjB,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACtC,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,EAAE,CAAC;YACpC,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAClD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,OAAO,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAC3E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/checks/security/gitleaks-config.js

@@ -0,0 +1,114 @@
+import { parse, stringify } from 'smol-toml';
+import { z } from 'zod';
+import { generatedHeader } from '../../configs/header.js';
+const GITLEAKS_BASE = '.gitleaks.toml';
+export const GITLEAKS_PROJECT = '.gitleaks.project.toml';
+/**
+ * gitleaks extends one file at a time, and only to two levels, so the base extends the
+ * project's file and the project's file extends gitleaks' defaults.
+ */
+export function renderGitleaksBase(version) {
+    return [
+        generatedHeader('#', version, GITLEAKS_PROJECT).trimEnd(),
+        "# gitleaks' default rules and the project's own, through the project's file.",
+        'title = "Talos"',
+        '',
+        '[extend]',
+        `path = "${GITLEAKS_PROJECT}"`,
+        '',
+    ].join('\n');
+}
+const PROJECT_INITIAL = [
+    `# This project's additions to ${GITLEAKS_BASE}: rules of its own, each with its own allowlist.`,
+    "# It keeps gitleaks' default rules: it disables none and adds no global allowlist.",
+    '[extend]',
+    'useDefault = true',
+    '',
+].join('\n');
+export const gitleaksBase = {
+    path: GITLEAKS_BASE,
+    scope: 'repo',
+    applies: () => true,
+    render: (ctx) => renderGitleaksBase(ctx.version),
+    extension: { path: GITLEAKS_PROJECT, initial: () => PROJECT_INITIAL },
+};
+const rule = z.looseObject({ id: z.string() });
+const project = z.looseObject({
+    extend: z
+        .looseObject({
+        useDefault: z.boolean().optional(),
+        path: z.string().optional(),
+        url: z.string().optional(),
+        disabledRules: z.array(z.string()).default([]),
+    })
+        .optional(),
+    allowlist: z.unknown().optional(),
+    allowlists: z.unknown().optional(),
+    rules: z.array(rule).default([]),
+});
+function extendFaults(extend) {
+    const found = [];
+    if (extend?.useDefault !== true) {
+        found.push({
+            key: 'useDefault',
+            how: "drops gitleaks' default rules (keep useDefault = true)",
+        });
+    }
+    if (extend?.path !== undefined || extend?.url !== undefined) {
+        found.push({ key: 'extend', how: "extends another file in place of gitleaks' defaults" });
+    }
+    for (const id of extend?.disabledRules ?? []) {
+        found.push({ key: `disabled ${id}`, how: `disables gitleaks' rule ${id}` });
+    }
+    return found;
+}
+/**
+ * The project's rules, and what in the file weakens gitleaks: dropping or disabling its default
+ * rules, extending something else, or an allowlist outside the project's own rules (a global
+ * one, or one aimed at default rules through `targetRules`).
+ */
+export function readGitleaksProject(text) {
+    let parsed;
+    try {
+        parsed = project.parse(parse(text));
+    }
+    catch {
+        return {
+            rules: [],
+            faults: [{ key: 'unreadable', how: 'cannot be read as a gitleaks configuration' }],
+        };
+    }
+    const faults = extendFaults(parsed.extend);
+    if (parsed.allowlist !== undefined || parsed.allowlists !== undefined) {
+        faults.push({
+            key: 'global allowlist',
+            how: "adds an allowlist outside its own rules, which gitleaks' rules would honour too",
+        });
+    }
+    return { rules: parsed.rules, faults };
+}
+/** A project rule that reuses a default rule's id replaces that rule's pattern. */
+export function redefinitions(ids) {
+    return [...ids].map((id) => ({
+        key: `redefines ${id}`,
+        how: `redefines gitleaks' rule ${id} (give the project's rule an id of its own)`,
+    }));
+}
+/**
+ * The configuration the gate scans with: gitleaks' defaults, whatever the project's file says
+ * about them, plus the project's own rules that redefine none of them.
+ */
+export function scanConfig(rules) {
+    return stringify({ title: 'Talos', extend: { useDefault: true }, rules });
+}
+/**
+ * A configuration gitleaks loads only when `id` names one of its default rules: an allowlist
+ * aimed at a rule that doesn't exist stops it.
+ */
+export function probeConfig(id) {
+    return stringify({
+        extend: { useDefault: true },
+        allowlists: [{ description: 'probe', targetRules: [id], regexes: ['^$'] }],
+    });
+}
+//# sourceMappingURL=gitleaks-config.js.map

package/dist/checks/security/gitleaks-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitleaks-config.js","sourceRoot":"","sources":["../../../src/checks/security/gitleaks-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAG1D,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,MAAM,CAAC,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAEzD;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO;QACL,eAAe,CAAC,GAAG,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,OAAO,EAAE;QACzD,8EAA8E;QAC9E,iBAAiB;QACjB,EAAE;QACF,UAAU;QACV,WAAW,gBAAgB,GAAG;QAC9B,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,eAAe,GAAG;IACtB,iCAAiC,aAAa,kDAAkD;IAChG,oFAAoF;IACpF,UAAU;IACV,mBAAmB;IACnB,EAAE;CACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb,MAAM,CAAC,MAAM,YAAY,GAAc;IACrC,IAAI,EAAE,aAAa;IACnB,KAAK,EAAE,MAAM;IACb,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI;IACnB,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC;IAChD,SAAS,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,eAAe,EAAE;CACtE,CAAC;AAEF,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAE/C,MAAM,OAAO,GAAG,CAAC,CAAC,WAAW,CAAC;IAC5B,MAAM,EAAE,CAAC;SACN,WAAW,CAAC;QACX,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;QAClC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC1B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC/C,CAAC;SACD,QAAQ,EAAE;IACb,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACjC,CAAC,CAAC;AAYH,SAAS,YAAY,CAAC,MAAyC;IAC7D,MAAM,KAAK,GAAgB,EAAE,CAAC;IAC9B,IAAI,MAAM,EAAE,UAAU,KAAK,IAAI,EAAE,CAAC;QAChC,KAAK,CAAC,IAAI,CAAC;YACT,GAAG,EAAE,YAAY;YACjB,GAAG,EAAE,wDAAwD;SAC9D,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,EAAE,IAAI,KAAK,SAAS,IAAI,MAAM,EAAE,GAAG,KAAK,SAAS,EAAE,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,qDAAqD,EAAE,CAAC,CAAC;IAC5F,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,aAAa,IAAI,EAAE,EAAE,CAAC;QAC7C,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE,GAAG,EAAE,2BAA2B,EAAE,EAAE,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,KAAK,EAAE,EAAE;YACT,MAAM,EAAE,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,4CAA4C,EAAE,CAAC;SACnF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QACtE,MAAM,CAAC,IAAI,CAAC;YACV,GAAG,EAAE,kBAAkB;YACvB,GAAG,EAAE,iFAAiF;SACvF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;AACzC,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,GAAwB;IACpD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3B,GAAG,EAAE,aAAa,EAAE,EAAE;QACtB,GAAG,EAAE,4BAA4B,EAAE,6CAA6C;KACjF,CAAC,CAAC,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,KAA6B;IACtD,OAAO,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,EAAU;IACpC,OAAO,SAAS,CAAC;QACf,MAAM,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE;QAC5B,UAAU,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC;AACL,CAAC"}

package/dist/checks/security/gitleaks.js

@@ -0,0 +1,93 @@
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { z } from 'zod';
+import { probeConfig } from './gitleaks-config.js';
+import { EngineError } from '../../core/check.js';
+/**
+ * gitleaks' report, through its Go template: never the secret, only its SHA-256 (sprig's
+ * `sha256sum`), so the report on disk holds nothing to leak. `--redact` would hash the word
+ * REDACTED instead, so the scan runs without it.
+ */
+const REPORT_TEMPLATE = '[{{ range $i, $f := . }}{{ if $i }},{{ end }}' +
+    '{"rule":{{ $f.RuleID | toJson }},"file":{{ $f.File | toJson }},' +
+    '"line":{{ $f.StartLine }},"commit":{{ $f.Commit | toJson }},' +
+    '"hash":{{ $f.Secret | sha256sum | toJson }}}{{ end }}]\n';
+const report = z.array(z.object({
+    rule: z.string(),
+    file: z.string(),
+    line: z.number(),
+    commit: z.string(),
+    hash: z.string().regex(/^[0-9a-f]{64}$/),
+}));
+/**
+ * One finding per secret gitleaks found anywhere in the history. A secret in an old commit
+ * points at no line of the checkout, so its key is the rule and a hash of the secret: the same
+ * secret committed again counts again, and its commit and line never change its identity.
+ */
+export function parseGitleaksReport(text) {
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch {
+        throw new EngineError("gitleaks' report is not JSON");
+    }
+    const parsed = report.safeParse(raw);
+    if (!parsed.success)
+        throw new EngineError("gitleaks' report is not in the expected form");
+    return parsed.data.map((leak) => ({
+        rule: `gitleaks/${leak.rule}`,
+        key: `${leak.rule} ${leak.hash.slice(0, 16)}`,
+        message: `A secret (${leak.rule}) was committed to ${leak.file} at line ${leak.line} in ` +
+            `${leak.commit.slice(0, 8)}; revoke it, then remove it.`,
+    }));
+}
+const COLOUR = new RegExp(`${String.fromCodePoint(27)}\\[[\\d;]*m`, 'g');
+/** The last line gitleaks logged, without its terminal colours. */
+function lastLine(text) {
+    const lines = text.replaceAll(COLOUR, '').trim().split('\n');
+    return lines.findLast((line) => line.trim() !== '') ?? '';
+}
+/** Scans every commit reachable from the checked-out one; `--all` would reach other branches. */
+export async function scanHistory(ctx, tool, config) {
+    const template = join(ctx.scratch, 'report-template.txt');
+    const output = join(ctx.scratch, 'gitleaks.json');
+    await writeFile(template, REPORT_TEMPLATE);
+    const args = [
+        'git',
+        '--no-banner',
+        '--log-level=error',
+        '--exit-code=0',
+        `--config=${config}`,
+        '--report-format=template',
+        `--report-template=${template}`,
+        `--report-path=${output}`,
+        `--log-opts=--full-history ${ctx.sha}`,
+        '.',
+    ];
+    const result = await ctx.exec(tool, args, { cwd: ctx.root });
+    if (result.code !== 0) {
+        throw new EngineError(`gitleaks exited ${result.code}: ${lastLine(result.stderr)}`);
+    }
+    return parseGitleaksReport(await readFile(output, 'utf8'));
+}
+/** Which of `ids` name one of gitleaks' default rules, asked of gitleaks itself. */
+export async function defaultRuleIds(ctx, tool, ids) {
+    if (ids.length === 0)
+        return new Set();
+    return ctx.memo(`security/gitleaks-defaults/${JSON.stringify(ids)}`, async () => {
+        const empty = join(ctx.scratch, 'probe-target');
+        await mkdir(empty, { recursive: true });
+        const known = await Promise.all(ids.map(async (id, index) => {
+            const config = join(ctx.scratch, `probe-${index}.toml`);
+            await writeFile(config, probeConfig(id));
+            const args = ['dir', '--no-banner', '--log-level=fatal', '--exit-code=0'];
+            const result = await ctx.exec(tool, [...args, `--config=${config}`, empty], {
+                cwd: ctx.scratch,
+            });
+            return result.code === 0 ? [id] : [];
+        }));
+        return new Set(known.flat());
+    });
+}
+//# sourceMappingURL=gitleaks.js.map

package/dist/checks/security/gitleaks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gitleaks.js","sourceRoot":"","sources":["../../../src/checks/security/gitleaks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAqB,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGrE;;;;GAIG;AACH,MAAM,eAAe,GACnB,+CAA+C;IAC/C,iEAAiE;IACjE,8DAA8D;IAC9D,0DAA0D,CAAC;AAE7D,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CACpB,CAAC,CAAC,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;IAClB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;CACzC,CAAC,CACH,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,8BAA8B,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,WAAW,CAAC,8CAA8C,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAChC,IAAI,EAAE,YAAY,IAAI,CAAC,IAAI,EAAE;QAC7B,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE;QAC7C,OAAO,EACL,aAAa,IAAI,CAAC,IAAI,sBAAsB,IAAI,CAAC,IAAI,YAAY,IAAI,CAAC,IAAI,MAAM;YAChF,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,8BAA8B;KAC3D,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC;AAEzE,mEAAmE;AACnE,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,EAAE,CAAC;AAC5D,CAAC;AAED,iGAAiG;AACjG,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,GAAiB,EACjB,IAAY,EACZ,MAAc;IAEd,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IAClD,MAAM,SAAS,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG;QACX,KAAK;QACL,aAAa;QACb,mBAAmB;QACnB,eAAe;QACf,YAAY,MAAM,EAAE;QACpB,0BAA0B;QAC1B,qBAAqB,QAAQ,EAAE;QAC/B,iBAAiB,MAAM,EAAE;QACzB,6BAA6B,GAAG,CAAC,GAAG,EAAE;QACtC,GAAG;KACJ,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,WAAW,CAAC,mBAAmB,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,mBAAmB,CAAC,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAiB,EACjB,IAAY,EACZ,GAAsB;IAEtB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IACvC,OAAO,GAAG,CAAC,IAAI,CAAC,8BAA8B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QAChD,MAAM,KAAK,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAC7B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE;YAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC;YACxD,MAAM,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;YACzC,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,mBAAmB,EAAE,eAAe,CAAC,CAAC;YAC1E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,YAAY,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE;gBAC1E,GAAG,EAAE,GAAG,CAAC,OAAO;aACjB,CAAC,CAAC;YACH,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvC,CAAC,CAAC,CACH,CAAC;QACF,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/checks/security/index.js

@@ -0,0 +1,12 @@
+import { dependenciesCheck } from './dependencies.js';
+import { gitleaksBase } from './gitleaks-config.js';
+import { osvConfig } from './osv-config.js';
+import { secretsCheck } from './secrets.js';
+import { semgrepCheck, semgrepignore } from './semgrep.js';
+import { strengthCheck } from './strength.js';
+export const securityPack = {
+    name: 'security',
+    checks: [secretsCheck(), dependenciesCheck(), semgrepCheck(), strengthCheck()],
+    generated: [gitleaksBase, osvConfig, semgrepignore],
+};
+//# sourceMappingURL=index.js.map

package/dist/checks/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/checks/security/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAG9C,MAAM,CAAC,MAAM,YAAY,GAAS;IAChC,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,CAAC,YAAY,EAAE,EAAE,iBAAiB,EAAE,EAAE,YAAY,EAAE,EAAE,aAAa,EAAE,CAAC;IAC9E,SAAS,EAAE,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC;CACpD,CAAC"}

package/dist/checks/security/licences.js

@@ -0,0 +1,50 @@
+/**
+ * The licences every SVP-Labs repository may depend on: permissive ones, public-domain
+ * dedications, and attribution-only data licences. A project adds others under `licences` in
+ * `talos.yml`, each with its reason.
+ */
+const ORG_LICENCES = [
+    '0BSD',
+    'Apache-2.0',
+    'BlueOak-1.0.0',
+    'BSD-2-Clause',
+    'BSD-3-Clause',
+    'BSL-1.0',
+    'CC-BY-4.0',
+    'CC0-1.0',
+    'ISC',
+    'MIT',
+    'MIT-0',
+    'PSF-2.0',
+    'Python-2.0',
+    'Unicode-3.0',
+    'Unicode-DFS-2016',
+    'Unlicense',
+    'WTFPL',
+    'Zlib',
+];
+/** The org's licences and the project's additions. */
+export function allowedLicences(config) {
+    return [...new Set([...ORG_LICENCES, ...Object.keys(config.licences)])];
+}
+function strip(expression) {
+    let text = expression.trim();
+    while (text.startsWith('(') && text.endsWith(')'))
+        text = text.slice(1, -1).trim();
+    return text;
+}
+/**
+ * Whether an SPDX expression is satisfied by the allowed licences: `OR` needs one side, `AND`
+ * both. Enough for the flat expressions lockfiles record; osv-scanner judges the rest.
+ */
+export function satisfies(expression, allowed) {
+    const text = strip(expression);
+    const either = text.split(/ OR /i);
+    if (either.length > 1)
+        return either.some((part) => satisfies(part, allowed));
+    const both = text.split(/ AND /i);
+    if (both.length > 1)
+        return both.every((part) => satisfies(part, allowed));
+    return allowed.some((licence) => licence.toLowerCase() === text.toLowerCase());
+}
+//# sourceMappingURL=licences.js.map

package/dist/checks/security/licences.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"licences.js","sourceRoot":"","sources":["../../../src/checks/security/licences.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,YAAY,GAAsB;IACtC,MAAM;IACN,YAAY;IACZ,eAAe;IACf,cAAc;IACd,cAAc;IACd,SAAS;IACT,WAAW;IACX,SAAS;IACT,KAAK;IACL,KAAK;IACL,OAAO;IACP,SAAS;IACT,YAAY;IACZ,aAAa;IACb,kBAAkB;IAClB,WAAW;IACX,OAAO;IACP,MAAM;CACP,CAAC;AAEF,sDAAsD;AACtD,MAAM,UAAU,eAAe,CAAC,MAAmB;IACjD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,YAAY,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,KAAK,CAAC,UAAkB;IAC/B,IAAI,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACnF,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,UAAkB,EAAE,OAA0B;IACtE,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9E,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3E,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;AACjF,CAAC"}

package/dist/checks/security/osv-config.js

@@ -0,0 +1,56 @@
+import { generatedHeader } from '../../configs/header.js';
+export const OSV_CONFIG = 'osv-scanner.toml';
+/** The lockfiles osv-scanner reads, by file name. */
+const OSV_LOCKFILES = [
+    'pnpm-lock.yaml',
+    'package-lock.json',
+    'npm-shrinkwrap.json',
+    'yarn.lock',
+    'bun.lock',
+    'uv.lock',
+    'poetry.lock',
+    'pdm.lock',
+    'Pipfile.lock',
+    'requirements.txt',
+    'composer.lock',
+    'Cargo.lock',
+    'go.mod',
+    'Gemfile.lock',
+];
+/** Every tracked lockfile osv-scanner reads, sorted. */
+export function osvLockfiles(facts) {
+    return facts
+        .matching(...OSV_LOCKFILES.map((name) => `**/${name}`))
+        .sort((a, b) => a.localeCompare(b));
+}
+/**
+ * `supply_chain.exceptions` as osv-scanner's ignore list. An exception stops applying on its
+ * expiry date, when `ignoreUntil` stops ignoring.
+ */
+export function osvIgnores(config) {
+    return Object.entries(config.supply_chain.exceptions)
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([id, exception]) => [
+        '[[IgnoredVulns]]',
+        `id = ${JSON.stringify(id)}`,
+        `ignoreUntil = ${exception.expires}`,
+        `reason = ${JSON.stringify(exception.reason)}`,
+        '',
+    ].join('\n'))
+        .join('\n');
+}
+export function renderOsvConfig(config, version) {
+    const header = [
+        generatedHeader('#', version).trimEnd(),
+        "# The exceptions are talos.yml's supply_chain.exceptions, each with a reason and an expiry.",
+        '',
+    ].join('\n');
+    return `${header}${osvIgnores(config)}`;
+}
+export const osvConfig = {
+    path: OSV_CONFIG,
+    scope: 'repo',
+    applies: (ctx) => osvLockfiles(ctx.facts).length > 0,
+    render: (ctx) => renderOsvConfig(ctx.config, ctx.version),
+};
+//# sourceMappingURL=osv-config.js.map

package/dist/checks/security/osv-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"osv-config.js","sourceRoot":"","sources":["../../../src/checks/security/osv-config.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAK1D,MAAM,CAAC,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAE7C,qDAAqD;AACrD,MAAM,aAAa,GAAG;IACpB,gBAAgB;IAChB,mBAAmB;IACnB,qBAAqB;IACrB,WAAW;IACX,UAAU;IACV,SAAS;IACT,aAAa;IACb,UAAU;IACV,cAAc;IACd,kBAAkB;IAClB,eAAe;IACf,YAAY;IACZ,QAAQ;IACR,cAAc;CACf,CAAC;AAEF,wDAAwD;AACxD,MAAM,UAAU,YAAY,CAAC,KAAgB;IAC3C,OAAO,KAAK;SACT,QAAQ,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;SACtD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,MAAmB;IAC5C,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC;SAClD,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;SACtC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CACvB;QACE,kBAAkB;QAClB,QAAQ,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE;QAC5B,iBAAiB,SAAS,CAAC,OAAO,EAAE;QACpC,YAAY,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE;QAC9C,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CACb;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAmB,EAAE,OAAe;IAClE,MAAM,MAAM,GAAG;QACb,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,EAAE;QACvC,6FAA6F;QAC7F,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,GAAG,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAc;IAClC,IAAI,EAAE,UAAU;IAChB,KAAK,EAAE,MAAM;IACb,OAAO,EAAE,CAAC,GAAiB,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;IAClE,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC;CAC1D,CAAC"}

package/dist/checks/security/osv.js

@@ -0,0 +1,146 @@
+import { posix, relative, sep } from 'node:path';
+import { z } from 'zod';
+import { satisfies } from './licences.js';
+import { EngineError } from '../../core/check.js';
+const vulnerability = z.looseObject({
+    id: z.string(),
+    summary: z.string().default(''),
+    database_specific: z.looseObject({ severity: z.unknown().optional() }).optional(),
+    affected: z
+        .array(z.looseObject({
+        package: z.looseObject({ name: z.string() }).optional(),
+        ranges: z
+            .array(z.looseObject({ events: z.array(z.looseObject({ fixed: z.string().optional() })) }))
+            .default([]),
+    }))
+        .default([]),
+});
+const group = z.looseObject({
+    ids: z.array(z.string()),
+    aliases: z.array(z.string()).default([]),
+    max_severity: z.string().default(''),
+});
+const scanned = z.looseObject({
+    package: z.looseObject({
+        name: z.string(),
+        version: z.string().default(''),
+        ecosystem: z.string().default(''),
+    }),
+    groups: z.array(group).default([]),
+    vulnerabilities: z.array(vulnerability).default([]),
+    license_violations: z.array(z.string()).default([]),
+});
+const output = z.looseObject({
+    results: z
+        .array(z.looseObject({
+        source: z.looseObject({ path: z.string() }),
+        packages: z.array(scanned).default([]),
+    }))
+        .default([]),
+});
+/** A group's own id: the GitHub advisory when it has one, so exceptions name what people see. */
+function groupId(found) {
+    const ids = [...found.ids].sort((a, b) => a.localeCompare(b));
+    return ids.find((id) => id.startsWith('GHSA-')) ?? ids[0] ?? 'unknown';
+}
+/** High or critical: GitHub's rating says so, or the CVSS score is 7.0 or more. */
+function severe(found, entries) {
+    const rated = entries.some((entry) => {
+        const rating = entry.database_specific?.severity;
+        return rating === 'HIGH' || rating === 'CRITICAL';
+    });
+    const score = Number.parseFloat(found.max_severity);
+    return rated || (Number.isFinite(score) && score >= 7);
+}
+function advisoryOf(found, pkg) {
+    const members = new Set([...found.ids, ...found.aliases]);
+    const entries = pkg.vulnerabilities.filter((entry) => members.has(entry.id));
+    const fixed = entries
+        .flatMap((entry) => entry.affected)
+        .filter((entry) => entry.package?.name === pkg.package.name)
+        .flatMap((entry) => entry.ranges.flatMap((range) => range.events))
+        .flatMap((event) => (event.fixed === undefined ? [] : [event.fixed]));
+    return {
+        id: groupId(found),
+        severe: severe(found, entries),
+        summary: entries.find((entry) => entry.summary !== '')?.summary ?? '',
+        fixed: [...new Set(fixed)],
+    };
+}
+/** osv-scanner's JSON report, with each lockfile's path made repository-relative. */
+export function parseOsvReport(text, root) {
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch {
+        throw new EngineError("osv-scanner's report is not JSON");
+    }
+    const parsed = output.safeParse(raw);
+    if (!parsed.success)
+        throw new EngineError("osv-scanner's report is not in the expected form");
+    return parsed.data.results.flatMap((result) => {
+        const lockfile = relative(root, result.source.path).split(sep).join(posix.sep);
+        return result.packages.map((pkg) => ({
+            lockfile,
+            name: pkg.package.name,
+            version: pkg.package.version,
+            ecosystem: pkg.package.ecosystem,
+            advisories: pkg.groups.map((found) => advisoryOf(found, pkg)),
+            licenceViolations: pkg.license_violations,
+        }));
+    });
+}
+function sentence(text) {
+    return text.trim().replace(/\.$/, '');
+}
+function vulnerabilityFinding(pkg, advisory) {
+    const about = advisory.summary === '' ? '' : `, ${sentence(advisory.summary)}`;
+    const fix = advisory.fixed.length === 0 ? 'no fixed release yet' : `fixed in ${advisory.fixed.join(', ')}`;
+    return {
+        rule: `osv/${advisory.id}`,
+        key: `${pkg.name}@${pkg.version} ${advisory.id}`,
+        message: `${pkg.name} ${pkg.version} in ${pkg.lockfile} is affected by ${advisory.id}${about}; ${fix}.`,
+        ...(advisory.severe ? { policy: 'always' } : {}),
+    };
+}
+function licenceFinding(pkg, licence) {
+    return {
+        rule: `licence/${licence}`,
+        key: `${pkg.name}@${pkg.version} ${licence}`,
+        message: `${pkg.name} ${pkg.version} in ${pkg.lockfile} is licensed ${licence}, which neither the org's allowlist nor talos.yml's licences allow.`,
+    };
+}
+/**
+ * Licence findings for a package from a registry. osv-scanner knows no licence for some
+ * registries' packages (Packagist's); where the lockfile records one, it is judged instead.
+ */
+function licenceFindings(pkg, locked, allowed) {
+    if (pkg.ecosystem === 'GIT' || (locked !== undefined && locked.source.kind !== 'registry')) {
+        return [];
+    }
+    return pkg.licenceViolations.flatMap((licence) => {
+        const recorded = licence === 'UNKNOWN' ? (locked?.licences ?? []) : [];
+        if (recorded.length === 0)
+            return [licenceFinding(pkg, licence)];
+        if (recorded.some((own) => satisfies(own, allowed)))
+            return [];
+        return [licenceFinding(pkg, recorded.join(' OR '))];
+    });
+}
+/**
+ * Advisories and licences for every scanned package but the repository's own: a workspace
+ * member's name can match an unrelated registry package's.
+ */
+export function dependencyFindings(packages, lookup, allowed) {
+    return packages.flatMap((pkg) => {
+        const locked = lookup(pkg.lockfile, pkg.name, pkg.version);
+        if (locked?.source.kind === 'local')
+            return [];
+        return [
+            ...pkg.advisories.map((advisory) => vulnerabilityFinding(pkg, advisory)),
+            ...licenceFindings(pkg, locked, allowed),
+        ];
+    });
+}
+//# sourceMappingURL=osv.js.map