aws-delivlib 13.5.19 → 13.6.2

package/lib/package-integrity/handler/validate.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/lib/package-integrity/handler/validate.js

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const integrity_1 = require("./integrity");
+const repository_1 = require("./repository");
+function requiredEnv(name) {
+    const value = process.env[name];
+    if (value)
+        return value;
+    throw new Error(`${name} env variable is required`);
+}
+function optionalEnv(name, defaultValue) {
+    var _a;
+    return (_a = process.env[name]) !== null && _a !== void 0 ? _a : defaultValue;
+}
+const GITHUB_REPOSITORY = requiredEnv('GITHUB_REPOSITORY');
+const GITHUB_TOKEN_ARN = optionalEnv('GITHUB_TOKEN_ARN');
+const TAG_PREFIX = optionalEnv('TAG_PREFIX');
+const PACK_TASK = optionalEnv('PACK_TASK');
+async function main() {
+    const repo = await repository_1.Repository.fromGitHub({
+        githubTokenSecretArn: GITHUB_TOKEN_ARN,
+        slug: GITHUB_REPOSITORY,
+        tagPrefix: TAG_PREFIX,
+    });
+    const integrity = new integrity_1.RepositoryIntegrity({
+        repository: repo,
+        packCommand: PACK_TASK,
+    });
+    await integrity.validate();
+}
+main()
+    .catch(e => {
+    console.log(`Error: ${e.message}`);
+    process.exitCode = 1;
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidmFsaWRhdGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJ2YWxpZGF0ZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFDQSwyQ0FBa0Q7QUFDbEQsNkNBQTBDO0FBRTFDLFNBQVMsV0FBVyxDQUFDLElBQVk7SUFDL0IsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUNoQyxJQUFJLEtBQUs7UUFBRSxPQUFPLEtBQUssQ0FBQztJQUN4QixNQUFNLElBQUksS0FBSyxDQUFDLEdBQUcsSUFBSSwyQkFBMkIsQ0FBQyxDQUFDO0FBQ3RELENBQUM7QUFFRCxTQUFTLFdBQVcsQ0FBQyxJQUFZLEVBQUUsWUFBcUI7O0lBQ3RELE9BQU8sTUFBQSxPQUFPLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxtQ0FBSSxZQUFZLENBQUM7QUFDM0MsQ0FBQztBQUVELE1BQU0saUJBQWlCLEdBQUcsV0FBVyxDQUFDLG1CQUFtQixDQUFDLENBQUM7QUFDM0QsTUFBTSxnQkFBZ0IsR0FBRyxXQUFXLENBQUMsa0JBQWtCLENBQUMsQ0FBQztBQUN6RCxNQUFNLFVBQVUsR0FBRyxXQUFXLENBQUMsWUFBWSxDQUFDLENBQUM7QUFDN0MsTUFBTSxTQUFTLEdBQUcsV0FBVyxDQUFDLFdBQVcsQ0FBQyxDQUFDO0FBRTNDLEtBQUssVUFBVSxJQUFJO0lBRWpCLE1BQU0sSUFBSSxHQUFHLE1BQU0sdUJBQVUsQ0FBQyxVQUFVLENBQUM7UUFDdkMsb0JBQW9CLEVBQUUsZ0JBQWdCO1FBQ3RDLElBQUksRUFBRSxpQkFBaUI7UUFDdkIsU0FBUyxFQUFFLFVBQVU7S0FDdEIsQ0FBQyxDQUFDO0lBRUgsTUFBTSxTQUFTLEdBQUcsSUFBSSwrQkFBbUIsQ0FBQztRQUN4QyxVQUFVLEVBQUUsSUFBSTtRQUNoQixXQUFXLEVBQUUsU0FBUztLQUN2QixDQUFDLENBQUM7SUFFSCxNQUFNLFNBQVMsQ0FBQyxRQUFRLEVBQUUsQ0FBQztBQUU3QixDQUFDO0FBRUQsSUFBSSxFQUFFO0tBQ0gsS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFO0lBQ1QsT0FBTyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQ25DLE9BQU8sQ0FBQyxRQUFRLEdBQUcsQ0FBQyxDQUFDO0FBQ3ZCLENBQUMsQ0FBQyxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiIyEvdXNyL2Jpbi9lbnYgbm9kZVxuaW1wb3J0IHsgUmVwb3NpdG9yeUludGVncml0eSB9IGZyb20gJy4vaW50ZWdyaXR5JztcbmltcG9ydCB7IFJlcG9zaXRvcnkgfSBmcm9tICcuL3JlcG9zaXRvcnknO1xuXG5mdW5jdGlvbiByZXF1aXJlZEVudihuYW1lOiBzdHJpbmcpOiBzdHJpbmcge1xuICBjb25zdCB2YWx1ZSA9IHByb2Nlc3MuZW52W25hbWVdO1xuICBpZiAodmFsdWUpIHJldHVybiB2YWx1ZTtcbiAgdGhyb3cgbmV3IEVycm9yKGAke25hbWV9IGVudiB2YXJpYWJsZSBpcyByZXF1aXJlZGApO1xufVxuXG5mdW5jdGlvbiBvcHRpb25hbEVudihuYW1lOiBzdHJpbmcsIGRlZmF1bHRWYWx1ZT86IHN0cmluZykge1xuICByZXR1cm4gcHJvY2Vzcy5lbnZbbmFtZV0gPz8gZGVmYXVsdFZhbHVlO1xufVxuXG5jb25zdCBHSVRIVUJfUkVQT1NJVE9SWSA9IHJlcXVpcmVkRW52KCdHSVRIVUJfUkVQT1NJVE9SWScpO1xuY29uc3QgR0lUSFVCX1RPS0VOX0FSTiA9IG9wdGlvbmFsRW52KCdHSVRIVUJfVE9LRU5fQVJOJyk7XG5jb25zdCBUQUdfUFJFRklYID0gb3B0aW9uYWxFbnYoJ1RBR19QUkVGSVgnKTtcbmNvbnN0IFBBQ0tfVEFTSyA9IG9wdGlvbmFsRW52KCdQQUNLX1RBU0snKTtcblxuYXN5bmMgZnVuY3Rpb24gbWFpbigpIHtcblxuICBjb25zdCByZXBvID0gYXdhaXQgUmVwb3NpdG9yeS5mcm9tR2l0SHViKHtcbiAgICBnaXRodWJUb2tlblNlY3JldEFybjogR0lUSFVCX1RPS0VOX0FSTixcbiAgICBzbHVnOiBHSVRIVUJfUkVQT1NJVE9SWSxcbiAgICB0YWdQcmVmaXg6IFRBR19QUkVGSVgsXG4gIH0pO1xuXG4gIGNvbnN0IGludGVncml0eSA9IG5ldyBSZXBvc2l0b3J5SW50ZWdyaXR5KHtcbiAgICByZXBvc2l0b3J5OiByZXBvLFxuICAgIHBhY2tDb21tYW5kOiBQQUNLX1RBU0ssXG4gIH0pO1xuXG4gIGF3YWl0IGludGVncml0eS52YWxpZGF0ZSgpO1xuXG59XG5cbm1haW4oKVxuICAuY2F0Y2goZSA9PiB7XG4gICAgY29uc29sZS5sb2coYEVycm9yOiAke2UubWVzc2FnZX1gKTtcbiAgICBwcm9jZXNzLmV4aXRDb2RlID0gMTtcbiAgfSk7XG4iXX0=

package/lib/package-integrity/handler/validate.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+
+set -euo pipefail
+
+node ${SCRIPT_DIR}/validate.bundle.js

package/lib/package-integrity/handler/validate.ts

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+import { RepositoryIntegrity } from './integrity';
+import { Repository } from './repository';
+
+function requiredEnv(name: string): string {
+  const value = process.env[name];
+  if (value) return value;
+  throw new Error(`${name} env variable is required`);
+}
+
+function optionalEnv(name: string, defaultValue?: string) {
+  return process.env[name] ?? defaultValue;
+}
+
+const GITHUB_REPOSITORY = requiredEnv('GITHUB_REPOSITORY');
+const GITHUB_TOKEN_ARN = optionalEnv('GITHUB_TOKEN_ARN');
+const TAG_PREFIX = optionalEnv('TAG_PREFIX');
+const PACK_TASK = optionalEnv('PACK_TASK');
+
+async function main() {
+
+  const repo = await Repository.fromGitHub({
+    githubTokenSecretArn: GITHUB_TOKEN_ARN,
+    slug: GITHUB_REPOSITORY,
+    tagPrefix: TAG_PREFIX,
+  });
+
+  const integrity = new RepositoryIntegrity({
+    repository: repo,
+    packCommand: PACK_TASK,
+  });
+
+  await integrity.validate();
+
+}
+
+main()
+  .catch(e => {
+    console.log(`Error: ${e.message}`);
+    process.exitCode = 1;
+  });

package/lib/package-integrity/index.d.ts

@@ -0,0 +1 @@
+export * from './integrity';

package/lib/package-integrity/index.js

@@ -0,0 +1,14 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./integrity"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyJpbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7Ozs7Ozs7Ozs7QUFBQSw4Q0FBNEIiLCJzb3VyY2VzQ29udGVudCI6WyJleHBvcnQgKiBmcm9tICcuL2ludGVncml0eSc7Il19

package/lib/package-integrity/index.ts

@@ -0,0 +1 @@
+export * from './integrity';

package/lib/package-integrity/integrity.d.ts

@@ -0,0 +1,64 @@
+import { Construct, aws_cloudwatch as cloudwatch, aws_events as events, aws_secretsmanager as sm } from 'monocdk';
+import { ShellPlatform } from '../shellable';
+/**
+ * Properties for `PackageIntegrityValidation`.
+ */
+export interface PackageIntegrityValidationProps {
+    /**
+     * The repository slug of the package (i.e cdklabs/jsii-docgen)
+     */
+    readonly repository: string;
+    /**
+     * Secret containing a github token.
+     */
+    readonly githubTokenSecret?: sm.ISecret;
+    /**
+     * The build platform to use. This platform should contain all necessary tools to package the artifacts
+     * in the repository. Note that by default, this also means running the tests.
+     *
+     * @default ShellPlatform.LinuxUbuntu
+     */
+    readonly buildPlatform?: ShellPlatform;
+    /**
+     * Run the validation on a schedule.
+     *
+     * @default - once a day.
+     */
+    readonly schedule?: events.Schedule;
+    /**
+     * Wether or not the environment should be privileged, necessary to run container images.
+     *
+     * @default false
+     */
+    readonly privileged?: boolean;
+    /**
+     * Tag prefix for this specific validation. Only needed for repositories that either release
+     * multiple packages or multiple major versions.
+     *
+     * @default - no prefix
+     */
+    readonly tagPrefix?: string;
+    /**
+     * The projen task that produces the local artifacts.
+     *
+     * @default 'release'
+     */
+    readonly packTask?: string;
+}
+/**
+ * Perform periodic integrity checks on published packages based on the
+ * source code of the package. Currently supports only GitHub hosted packages.
+ *
+ * The check is done by downloading the published artifact, building the source code, and comparing the two.
+ * If they differ, it means that of the following was compromised:
+ *
+ * - The publishing platform (for example GitHub runners)
+ * - The artifact storage (for example npmjs.com)
+ */
+export declare class PackageIntegrityValidation extends Construct {
+    /**
+     * The alarm that will trigger if the validation fails.
+     */
+    readonly failureAlarm: cloudwatch.Alarm;
+    constructor(scope: Construct, id: string, props: PackageIntegrityValidationProps);
+}

package/lib/package-integrity/integrity.js

@@ -0,0 +1,64 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    Object.defineProperty(o, k2, { enumerable: true, get: function() { return m[k]; } });
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PackageIntegrityValidation = void 0;
+const path = __importStar(require("path"));
+const monocdk_1 = require("monocdk");
+const shellable_1 = require("../shellable");
+/**
+ * Perform periodic integrity checks on published packages based on the
+ * source code of the package. Currently supports only GitHub hosted packages.
+ *
+ * The check is done by downloading the published artifact, building the source code, and comparing the two.
+ * If they differ, it means that of the following was compromised:
+ *
+ * - The publishing platform (for example GitHub runners)
+ * - The artifact storage (for example npmjs.com)
+ */
+class PackageIntegrityValidation extends monocdk_1.Construct {
+    constructor(scope, id, props) {
+        var _a, _b, _c, _d, _e;
+        super(scope, id);
+        const shellable = new shellable_1.Shellable(this, 'Default', {
+            scriptDirectory: path.join(__dirname, 'handler'),
+            entrypoint: 'validate.sh',
+            privileged: (_a = props.privileged) !== null && _a !== void 0 ? _a : false,
+            platform: (_b = props.buildPlatform) !== null && _b !== void 0 ? _b : shellable_1.ShellPlatform.LinuxUbuntu,
+            environment: {
+                GITHUB_REPOSITORY: props.repository,
+                TAG_PREFIX: (_c = props.tagPrefix) !== null && _c !== void 0 ? _c : '',
+                GITHUB_TOKEN_ARN: (_d = props.githubTokenSecret) === null || _d === void 0 ? void 0 : _d.secretArn,
+                PACK_TASK: props.packTask,
+            },
+        });
+        if (props.githubTokenSecret) {
+            const grant = props.githubTokenSecret.grantRead(shellable.role);
+            grant.assertSuccess();
+        }
+        new monocdk_1.aws_events.Rule(this, 'ScheduledTrigger', {
+            schedule: (_e = props.schedule) !== null && _e !== void 0 ? _e : monocdk_1.aws_events.Schedule.rate(monocdk_1.Duration.days(1)),
+            targets: [new monocdk_1.aws_events_targets.CodeBuildProject(shellable.project)],
+        });
+        this.failureAlarm = shellable.alarm;
+    }
+}
+exports.PackageIntegrityValidation = PackageIntegrityValidation;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW50ZWdyaXR5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiaW50ZWdyaXR5LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7QUFBQSwyQ0FBNkI7QUFDN0IscUNBT2lCO0FBQ2pCLDRDQUF3RDtBQXdEeEQ7Ozs7Ozs7OztHQVNHO0FBQ0gsTUFBYSwwQkFBMkIsU0FBUSxtQkFBUztJQU92RCxZQUFZLEtBQWdCLEVBQUUsRUFBVSxFQUFFLEtBQXNDOztRQUM5RSxLQUFLLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBRWpCLE1BQU0sU0FBUyxHQUFHLElBQUkscUJBQVMsQ0FBQyxJQUFJLEVBQUUsU0FBUyxFQUFFO1lBQy9DLGVBQWUsRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUM7WUFDaEQsVUFBVSxFQUFFLGFBQWE7WUFDekIsVUFBVSxFQUFFLE1BQUEsS0FBSyxDQUFDLFVBQVUsbUNBQUksS0FBSztZQUNyQyxRQUFRLEVBQUUsTUFBQSxLQUFLLENBQUMsYUFBYSxtQ0FBSSx5QkFBYSxDQUFDLFdBQVc7WUFDMUQsV0FBVyxFQUFFO2dCQUNYLGlCQUFpQixFQUFFLEtBQUssQ0FBQyxVQUFVO2dCQUNuQyxVQUFVLEVBQUUsTUFBQSxLQUFLLENBQUMsU0FBUyxtQ0FBSSxFQUFFO2dCQUNqQyxnQkFBZ0IsRUFBRSxNQUFBLEtBQUssQ0FBQyxpQkFBaUIsMENBQUUsU0FBUztnQkFDcEQsU0FBUyxFQUFFLEtBQUssQ0FBQyxRQUFRO2FBQzFCO1NBQ0YsQ0FBQyxDQUFDO1FBRUgsSUFBSSxLQUFLLENBQUMsaUJBQWlCLEVBQUU7WUFDM0IsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLGlCQUFpQixDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLENBQUM7WUFDaEUsS0FBSyxDQUFDLGFBQWEsRUFBRSxDQUFDO1NBQ3ZCO1FBRUQsSUFBSSxvQkFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLEVBQUUsa0JBQWtCLEVBQUU7WUFDeEMsUUFBUSxFQUFFLE1BQUEsS0FBSyxDQUFDLFFBQVEsbUNBQUksb0JBQU0sQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLGtCQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQ2xFLE9BQU8sRUFBRSxDQUFDLElBQUksNEJBQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDLENBQUM7U0FDM0QsQ0FBQyxDQUFDO1FBRUgsSUFBSSxDQUFDLFlBQVksR0FBRyxTQUFTLENBQUMsS0FBSyxDQUFDO0lBRXRDLENBQUM7Q0FDRjtBQXBDRCxnRUFvQ0MiLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgKiBhcyBwYXRoIGZyb20gJ3BhdGgnO1xuaW1wb3J0IHtcbiAgQ29uc3RydWN0LFxuICBhd3NfY2xvdWR3YXRjaCBhcyBjbG91ZHdhdGNoLFxuICBhd3NfZXZlbnRzIGFzIGV2ZW50cyxcbiAgYXdzX2V2ZW50c190YXJnZXRzIGFzIHRhcmdldHMsXG4gIGF3c19zZWNyZXRzbWFuYWdlciBhcyBzbSxcbiAgRHVyYXRpb24sXG59IGZyb20gJ21vbm9jZGsnO1xuaW1wb3J0IHsgU2hlbGxhYmxlLCBTaGVsbFBsYXRmb3JtIH0gZnJvbSAnLi4vc2hlbGxhYmxlJztcblxuLyoqXG4gKiBQcm9wZXJ0aWVzIGZvciBgUGFja2FnZUludGVncml0eVZhbGlkYXRpb25gLlxuICovXG5leHBvcnQgaW50ZXJmYWNlIFBhY2thZ2VJbnRlZ3JpdHlWYWxpZGF0aW9uUHJvcHMge1xuXG4gIC8qKlxuICAgKiBUaGUgcmVwb3NpdG9yeSBzbHVnIG9mIHRoZSBwYWNrYWdlIChpLmUgY2RrbGFicy9qc2lpLWRvY2dlbilcbiAgICovXG4gIHJlYWRvbmx5IHJlcG9zaXRvcnk6IHN0cmluZztcblxuICAvKipcbiAgICogU2VjcmV0IGNvbnRhaW5pbmcgYSBnaXRodWIgdG9rZW4uXG4gICAqL1xuICByZWFkb25seSBnaXRodWJUb2tlblNlY3JldD86IHNtLklTZWNyZXQ7XG5cbiAgLyoqXG4gICAqIFRoZSBidWlsZCBwbGF0Zm9ybSB0byB1c2UuIFRoaXMgcGxhdGZvcm0gc2hvdWxkIGNvbnRhaW4gYWxsIG5lY2Vzc2FyeSB0b29scyB0byBwYWNrYWdlIHRoZSBhcnRpZmFjdHNcbiAgICogaW4gdGhlIHJlcG9zaXRvcnkuIE5vdGUgdGhhdCBieSBkZWZhdWx0LCB0aGlzIGFsc28gbWVhbnMgcnVubmluZyB0aGUgdGVzdHMuXG4gICAqXG4gICAqIEBkZWZhdWx0IFNoZWxsUGxhdGZvcm0uTGludXhVYnVudHVcbiAgICovXG4gIHJlYWRvbmx5IGJ1aWxkUGxhdGZvcm0/OiBTaGVsbFBsYXRmb3JtO1xuXG4gIC8qKlxuICAgKiBSdW4gdGhlIHZhbGlkYXRpb24gb24gYSBzY2hlZHVsZS5cbiAgICpcbiAgICogQGRlZmF1bHQgLSBvbmNlIGEgZGF5LlxuICAgKi9cbiAgcmVhZG9ubHkgc2NoZWR1bGU/OiBldmVudHMuU2NoZWR1bGU7XG5cbiAgLyoqXG4gICAqIFdldGhlciBvciBub3QgdGhlIGVudmlyb25tZW50IHNob3VsZCBiZSBwcml2aWxlZ2VkLCBuZWNlc3NhcnkgdG8gcnVuIGNvbnRhaW5lciBpbWFnZXMuXG4gICAqXG4gICAqIEBkZWZhdWx0IGZhbHNlXG4gICAqL1xuICByZWFkb25seSBwcml2aWxlZ2VkPzogYm9vbGVhbjtcblxuICAvKipcbiAgICogVGFnIHByZWZpeCBmb3IgdGhpcyBzcGVjaWZpYyB2YWxpZGF0aW9uLiBPbmx5IG5lZWRlZCBmb3IgcmVwb3NpdG9yaWVzIHRoYXQgZWl0aGVyIHJlbGVhc2VcbiAgICogbXVsdGlwbGUgcGFja2FnZXMgb3IgbXVsdGlwbGUgbWFqb3IgdmVyc2lvbnMuXG4gICAqXG4gICAqIEBkZWZhdWx0IC0gbm8gcHJlZml4XG4gICAqL1xuICByZWFkb25seSB0YWdQcmVmaXg/OiBzdHJpbmc7XG5cbiAgLyoqXG4gICAqIFRoZSBwcm9qZW4gdGFzayB0aGF0IHByb2R1Y2VzIHRoZSBsb2NhbCBhcnRpZmFjdHMuXG4gICAqXG4gICAqIEBkZWZhdWx0ICdyZWxlYXNlJ1xuICAgKi9cbiAgcmVhZG9ubHkgcGFja1Rhc2s/OiBzdHJpbmc7XG5cbn1cblxuLyoqXG4gKiBQZXJmb3JtIHBlcmlvZGljIGludGVncml0eSBjaGVja3Mgb24gcHVibGlzaGVkIHBhY2thZ2VzIGJhc2VkIG9uIHRoZVxuICogc291cmNlIGNvZGUgb2YgdGhlIHBhY2thZ2UuIEN1cnJlbnRseSBzdXBwb3J0cyBvbmx5IEdpdEh1YiBob3N0ZWQgcGFja2FnZXMuXG4gKlxuICogVGhlIGNoZWNrIGlzIGRvbmUgYnkgZG93bmxvYWRpbmcgdGhlIHB1Ymxpc2hlZCBhcnRpZmFjdCwgYnVpbGRpbmcgdGhlIHNvdXJjZSBjb2RlLCBhbmQgY29tcGFyaW5nIHRoZSB0d28uXG4gKiBJZiB0aGV5IGRpZmZlciwgaXQgbWVhbnMgdGhhdCBvZiB0aGUgZm9sbG93aW5nIHdhcyBjb21wcm9taXNlZDpcbiAqXG4gKiAtIFRoZSBwdWJsaXNoaW5nIHBsYXRmb3JtIChmb3IgZXhhbXBsZSBHaXRIdWIgcnVubmVycylcbiAqIC0gVGhlIGFydGlmYWN0IHN0b3JhZ2UgKGZvciBleGFtcGxlIG5wbWpzLmNvbSlcbiAqL1xuZXhwb3J0IGNsYXNzIFBhY2thZ2VJbnRlZ3JpdHlWYWxpZGF0aW9uIGV4dGVuZHMgQ29uc3RydWN0IHtcblxuICAvKipcbiAgICogVGhlIGFsYXJtIHRoYXQgd2lsbCB0cmlnZ2VyIGlmIHRoZSB2YWxpZGF0aW9uIGZhaWxzLlxuICAgKi9cbiAgcHVibGljIHJlYWRvbmx5IGZhaWx1cmVBbGFybTogY2xvdWR3YXRjaC5BbGFybTtcblxuICBjb25zdHJ1Y3RvcihzY29wZTogQ29uc3RydWN0LCBpZDogc3RyaW5nLCBwcm9wczogUGFja2FnZUludGVncml0eVZhbGlkYXRpb25Qcm9wcykge1xuICAgIHN1cGVyKHNjb3BlLCBpZCk7XG5cbiAgICBjb25zdCBzaGVsbGFibGUgPSBuZXcgU2hlbGxhYmxlKHRoaXMsICdEZWZhdWx0Jywge1xuICAgICAgc2NyaXB0RGlyZWN0b3J5OiBwYXRoLmpvaW4oX19kaXJuYW1lLCAnaGFuZGxlcicpLFxuICAgICAgZW50cnlwb2ludDogJ3ZhbGlkYXRlLnNoJyxcbiAgICAgIHByaXZpbGVnZWQ6IHByb3BzLnByaXZpbGVnZWQgPz8gZmFsc2UsXG4gICAgICBwbGF0Zm9ybTogcHJvcHMuYnVpbGRQbGF0Zm9ybSA/PyBTaGVsbFBsYXRmb3JtLkxpbnV4VWJ1bnR1LFxuICAgICAgZW52aXJvbm1lbnQ6IHtcbiAgICAgICAgR0lUSFVCX1JFUE9TSVRPUlk6IHByb3BzLnJlcG9zaXRvcnksXG4gICAgICAgIFRBR19QUkVGSVg6IHByb3BzLnRhZ1ByZWZpeCA/PyAnJyxcbiAgICAgICAgR0lUSFVCX1RPS0VOX0FSTjogcHJvcHMuZ2l0aHViVG9rZW5TZWNyZXQ/LnNlY3JldEFybixcbiAgICAgICAgUEFDS19UQVNLOiBwcm9wcy5wYWNrVGFzayxcbiAgICAgIH0sXG4gICAgfSk7XG5cbiAgICBpZiAocHJvcHMuZ2l0aHViVG9rZW5TZWNyZXQpIHtcbiAgICAgIGNvbnN0IGdyYW50ID0gcHJvcHMuZ2l0aHViVG9rZW5TZWNyZXQuZ3JhbnRSZWFkKHNoZWxsYWJsZS5yb2xlKTtcbiAgICAgIGdyYW50LmFzc2VydFN1Y2Nlc3MoKTtcbiAgICB9XG5cbiAgICBuZXcgZXZlbnRzLlJ1bGUodGhpcywgJ1NjaGVkdWxlZFRyaWdnZXInLCB7XG4gICAgICBzY2hlZHVsZTogcHJvcHMuc2NoZWR1bGUgPz8gZXZlbnRzLlNjaGVkdWxlLnJhdGUoRHVyYXRpb24uZGF5cygxKSksXG4gICAgICB0YXJnZXRzOiBbbmV3IHRhcmdldHMuQ29kZUJ1aWxkUHJvamVjdChzaGVsbGFibGUucHJvamVjdCldLFxuICAgIH0pO1xuXG4gICAgdGhpcy5mYWlsdXJlQWxhcm0gPSBzaGVsbGFibGUuYWxhcm07XG5cbiAgfVxufVxuIl19

package/lib/package-integrity/integrity.ts

@@ -0,0 +1,112 @@
+import * as path from 'path';
+import {
+  Construct,
+  aws_cloudwatch as cloudwatch,
+  aws_events as events,
+  aws_events_targets as targets,
+  aws_secretsmanager as sm,
+  Duration,
+} from 'monocdk';
+import { Shellable, ShellPlatform } from '../shellable';
+
+/**
+ * Properties for `PackageIntegrityValidation`.
+ */
+export interface PackageIntegrityValidationProps {
+
+  /**
+   * The repository slug of the package (i.e cdklabs/jsii-docgen)
+   */
+  readonly repository: string;
+
+  /**
+   * Secret containing a github token.
+   */
+  readonly githubTokenSecret?: sm.ISecret;
+
+  /**
+   * The build platform to use. This platform should contain all necessary tools to package the artifacts
+   * in the repository. Note that by default, this also means running the tests.
+   *
+   * @default ShellPlatform.LinuxUbuntu
+   */
+  readonly buildPlatform?: ShellPlatform;
+
+  /**
+   * Run the validation on a schedule.
+   *
+   * @default - once a day.
+   */
+  readonly schedule?: events.Schedule;
+
+  /**
+   * Wether or not the environment should be privileged, necessary to run container images.
+   *
+   * @default false
+   */
+  readonly privileged?: boolean;
+
+  /**
+   * Tag prefix for this specific validation. Only needed for repositories that either release
+   * multiple packages or multiple major versions.
+   *
+   * @default - no prefix
+   */
+  readonly tagPrefix?: string;
+
+  /**
+   * The projen task that produces the local artifacts.
+   *
+   * @default 'release'
+   */
+  readonly packTask?: string;
+
+}
+
+/**
+ * Perform periodic integrity checks on published packages based on the
+ * source code of the package. Currently supports only GitHub hosted packages.
+ *
+ * The check is done by downloading the published artifact, building the source code, and comparing the two.
+ * If they differ, it means that of the following was compromised:
+ *
+ * - The publishing platform (for example GitHub runners)
+ * - The artifact storage (for example npmjs.com)
+ */
+export class PackageIntegrityValidation extends Construct {
+
+  /**
+   * The alarm that will trigger if the validation fails.
+   */
+  public readonly failureAlarm: cloudwatch.Alarm;
+
+  constructor(scope: Construct, id: string, props: PackageIntegrityValidationProps) {
+    super(scope, id);
+
+    const shellable = new Shellable(this, 'Default', {
+      scriptDirectory: path.join(__dirname, 'handler'),
+      entrypoint: 'validate.sh',
+      privileged: props.privileged ?? false,
+      platform: props.buildPlatform ?? ShellPlatform.LinuxUbuntu,
+      environment: {
+        GITHUB_REPOSITORY: props.repository,
+        TAG_PREFIX: props.tagPrefix ?? '',
+        GITHUB_TOKEN_ARN: props.githubTokenSecret?.secretArn,
+        PACK_TASK: props.packTask,
+      },
+    });
+
+    if (props.githubTokenSecret) {
+      const grant = props.githubTokenSecret.grantRead(shellable.role);
+      grant.assertSuccess();
+    }
+
+    new events.Rule(this, 'ScheduledTrigger', {
+      schedule: props.schedule ?? events.Schedule.rate(Duration.days(1)),
+      targets: [new targets.CodeBuildProject(shellable.project)],
+    });
+
+    this.failureAlarm = shellable.alarm;
+
+  }
+}

package/package.json

@@ -8,6 +8,7 @@
   "scripts": {
     "build": "npx projen build",
     "bump": "npx projen bump",
+    "bundle:package-integrity": "npx projen bundle:package-integrity",
     "clobber": "npx projen clobber",
     "compile": "npx projen compile",
     "compile:custom-resource-handlers": "npx projen compile:custom-resource-handlers",
@@ -36,36 +37,43 @@
     "organization": false
   },
   "devDependencies": {
-    "@monocdk-experiment/assert": "^1.145.0",
+    "@monocdk-experiment/assert": "^1.146.0",
+    "@types/adm-zip": "^0.4.34",
     "@types/aws-lambda": "^8.10.92",
+    "@types/fs-extra": "^9.0.13",
     "@types/jest": "^27.4.1",
     "@types/node": "^12",
+    "@types/tar": "^6.1.1",
     "@typescript-eslint/eslint-plugin": "^5",
     "@typescript-eslint/parser": "^5",
-    "aws-cdk": "^1.145.0",
-    "aws-sdk": "^2.1080.0",
-    "constructs": "^3.3.225",
+    "adm-zip": "^0.5.9",
+    "aws-cdk": "^1.146.0",
+    "aws-sdk": "^2.1082.0",
+    "constructs": "^3.3.227",
     "esbuild": "^0.14.23",
     "eslint": "^8",
     "eslint-import-resolver-node": "^0.3.6",
     "eslint-import-resolver-typescript": "^2.5.0",
     "eslint-plugin-import": "^2.25.4",
+    "fs-extra": "^10.0.1",
     "jest": "^27.5.1",
     "jest-create-mock-instance": "^2.0.0",
     "jest-junit": "^13",
     "json-schema": "^0.4.0",
-    "monocdk": "^1.145.0",
+    "JSONStream": "^1.3.5",
+    "monocdk": "^1.146.0",
     "node-ical": "^0.14.1",
     "npm-check-updates": "^12",
-    "projen": "^0.52.44",
+    "projen": "^0.52.48",
     "rrule": "^2.6.8",
     "standard-version": "^9",
+    "tar": "^6.1.11",
     "ts-jest": "^27.1.3",
     "typescript": "~4.5.5"
   },
   "peerDependencies": {
-    "constructs": "^3.3.225",
-    "monocdk": "^1.145.0"
+    "constructs": "^3.3.227",
+    "monocdk": "^1.146.0"
   },
   "dependencies": {
     "changelog-parser": "^2.8.0"
@@ -78,7 +86,7 @@
   ],
   "main": "lib/index.js",
   "license": "Apache-2.0",
-  "version": "13.5.19",
+  "version": "13.6.2",
   "jest": {
     "testMatch": [
       "**/lib/__tests__/**/?(*.)+(spec|test).js?(x)"