infraweaver 0.1.0

package/src/mcp/terraform/signing.ts

@@ -0,0 +1,151 @@
+/**
+ * Detached Ed25519 signing for the compliance artefacts (the evidence bundle in
+ * [[evidence]] and the CycloneDX VEX in [[vex]]) — the "signed evidence" story.
+ *
+ * Design constraints, in order:
+ *   - **Sign the exact bytes written to disk.** The builders are already
+ *     deterministic (same inputs ⇒ same bytes), so no JSON canonicaliser is
+ *     needed — the detached `.sig` covers the file verbatim.
+ *   - **`node:crypto` only** (`sign`/`verify` with a `null` digest — Ed25519 is
+ *     a pure signature scheme); no new dependency.
+ *   - **Honest when unsigned.** The private key arrives via env only
+ *     (`INFRAWEAVER_SIGNING_KEY`, a base64-encoded PKCS#8 PEM). Unset ⇒ the
+ *     artefact records an explicit `"signature": null` — never a fake or
+ *     self-referential signature. A key that is SET but malformed throws (a
+ *     mis-configured signer must fail loudly, not silently emit unsigned).
+ *   - The key name matches the `_KEY` suffix in `utils/secrets.ts`
+ *     SENSITIVE_PATTERNS, so it is redacted from logs and stripped from every
+ *     subprocess env by the default-deny filter.
+ *
+ * Verify side: `infraweaver verify-evidence <bundle> <sig> <pubkey>` (src/cli.ts →
+ * commands/verifyEvidence.ts) re-checks a bundle offline with only the public key.
+ */
+import {
+  createHash,
+  createPrivateKey,
+  createPublicKey,
+  sign as cryptoSign,
+  verify as cryptoVerify,
+  type KeyObject,
+} from "node:crypto";
+
+export const SIGNING_KEY_ENV = "INFRAWEAVER_SIGNING_KEY";
+export const SIGNATURE_ALGORITHM = "Ed25519" as const;
+
+export interface SigningKey {
+  privateKey: KeyObject;
+  /** the public half, SPKI PEM — embedded in artefact metadata so a consumer
+   * can verify without any other channel. */
+  publicKeyPem: string;
+  /** sha256 of the SPKI DER, hex — the short handle a PR body / log names. */
+  fingerprint: string;
+}
+
+/** metadata embedded in a signed artefact (never the signature itself — the
+ * signature covers these bytes, so it must live in the detached `.sig`). */
+export interface SignatureMetadata {
+  algorithm: typeof SIGNATURE_ALGORITHM;
+  public_key: string;
+  fingerprint_sha256: string;
+  /** sibling file carrying the base64 detached signature. */
+  detached_signature: string;
+}
+
+/**
+ * Load the signing key from the env (base64-encoded PKCS#8 PEM, Ed25519).
+ * Returns null when unset/empty (the honest-unsigned path); throws when a key
+ * is present but not a valid Ed25519 PKCS#8 PEM — a configured signer that
+ * can't sign is an operator error, never a silent downgrade.
+ */
+export function loadSigningKey(
+  raw: string | undefined = process.env[SIGNING_KEY_ENV],
+): SigningKey | null {
+  const b64 = raw?.trim();
+  if (!b64) return null;
+  const pem = Buffer.from(b64, "base64").toString("utf8");
+  if (!pem.includes("-----BEGIN")) {
+    throw new Error(
+      `${SIGNING_KEY_ENV} is set but does not decode to a PEM — supply the PKCS#8 private key PEM, base64-encoded`,
+    );
+  }
+  let privateKey: KeyObject;
+  try {
+    privateKey = createPrivateKey(pem);
+  } catch (e) {
+    throw new Error(
+      `${SIGNING_KEY_ENV} decodes to a PEM node:crypto cannot parse as a private key: ${e instanceof Error ? e.message : String(e)}`,
+    );
+  }
+  if (privateKey.asymmetricKeyType !== "ed25519") {
+    throw new Error(
+      `${SIGNING_KEY_ENV} must be an Ed25519 key (got ${privateKey.asymmetricKeyType ?? "unknown"})`,
+    );
+  }
+  // derive the public half via a PEM round-trip (the KeyObject overload isn't
+  // in the current @types/node surface; the bytes are identical either way).
+  const publicKey = createPublicKey(
+    privateKey.export({ type: "pkcs8", format: "pem" }).toString(),
+  );
+  const spkiDer = publicKey.export({ type: "spki", format: "der" });
+  const publicKeyPem = publicKey
+    .export({ type: "spki", format: "pem" })
+    .toString();
+  return {
+    privateKey,
+    publicKeyPem,
+    fingerprint: createHash("sha256").update(spkiDer).digest("hex"),
+  };
+}
+
+/** detached Ed25519 signature over the exact bytes, base64. */
+export function signBytes(bytes: string | Buffer, key: SigningKey): string {
+  const data = typeof bytes === "string" ? Buffer.from(bytes, "utf8") : bytes;
+  // Ed25519 is a pure scheme: the digest argument MUST be null.
+  return cryptoSign(null, data, key.privateKey).toString("base64");
+}
+
+/** verify a detached base64 signature against the exact bytes + an SPKI PEM
+ * public key. Returns false (never throws) on a malformed signature/key, so a
+ * verifier can report FAILED rather than crash on garbage input. */
+export function verifyBytes(
+  bytes: string | Buffer,
+  signatureB64: string,
+  publicKeyPem: string,
+): boolean {
+  try {
+    const data = typeof bytes === "string" ? Buffer.from(bytes, "utf8") : bytes;
+    const publicKey = createPublicKey(publicKeyPem);
+    return cryptoVerify(
+      null,
+      data,
+      publicKey,
+      Buffer.from(signatureB64.trim(), "base64"),
+    );
+  } catch {
+    return false;
+  }
+}
+
+/** sha256 fingerprint (hex) of an SPKI PEM public key — the same handle
+ * {@link loadSigningKey} derives, computable by a verifier from the PEM alone. */
+export function publicKeyFingerprint(publicKeyPem: string): string {
+  const der = createPublicKey(publicKeyPem).export({
+    type: "spki",
+    format: "der",
+  });
+  return createHash("sha256").update(der).digest("hex");
+}
+
+/** the metadata block an artefact embeds when this key signs it. `sigFile` is
+ * the sibling `.sig` filename (relative — beside the artefact). */
+export function signatureMetadata(
+  key: SigningKey,
+  sigFile: string,
+): SignatureMetadata {
+  return {
+    algorithm: SIGNATURE_ALGORITHM,
+    public_key: key.publicKeyPem,
+    fingerprint_sha256: key.fingerprint,
+    detached_signature: sigFile,
+  };
+}

package/src/mcp/terraform/stateLocking.ts

@@ -0,0 +1,106 @@
+/**
+ * S3 backend state-locking currency.
+ *
+ * HashiCorp deprecated DynamoDB-based locking for the `s3` backend in favour of
+ * native S3 lockfiles (`use_lockfile = true`), and says it "will be removed in a
+ * future minor version". The two may be set together — the documented migration
+ * path is to add `use_lockfile` while leaving `dynamodb_table` in place, so
+ * older Terraform versions in the same team keep locking against DynamoDB until
+ * everyone has moved.
+ *
+ * WHY THIS IS OURS TO REPORT. Checkov and Trivy answer "is this setting wrong?"
+ * and this setting is not wrong — it is *ending*. tflint checks that versions
+ * are pinned, not that arguments are current. Nobody else reports a working
+ * configuration whose mechanism has an announced end date, and that is exactly
+ * the class of thing a Terraform-currency product exists to see.
+ *
+ * WHY ADVISORY, NOT A FAILURE. DynamoDB locking works today; a repo using it is
+ * not exposed. And unlike a resource argument, a backend block cannot be
+ * corrected by a pull request alone — changing it requires an operator to run
+ * `terraform init -migrate-state` against real state. Presenting that as a
+ * fixable violation would be inviting a PR that breaks `init` for everyone.
+ *
+ * DELIBERATELY NO VERSION CLAIM in the user-facing text. `use_lockfile` needs a
+ * recent Terraform, but the backend docs do not pin the version that introduced
+ * it, and a wrong minimum in remediation prose is worse than none — it would
+ * send someone to upgrade for the wrong reason. The finding names the
+ * deprecation, which is checkable, and leaves the version floor to `terraform
+ * init`, which enforces it precisely.
+ *
+ * Pure: HCL text in, findings out.
+ */
+import { parseBlocks, stripTrailingComment, topLevelAssignments } from "#app/mcp/terraform/hcl";
+import {
+  BAND_SEVERITY,
+  DEPRECATED_STATE_LOCKING,
+  NATIVE_SOURCE,
+} from "#app/mcp/terraform/nativeRules";
+import { buildConcern, type Concern } from "#app/mcp/terraform/types";
+
+export interface DeprecatedLockingSite {
+  /** 1-based line of the `backend "s3"` block. */
+  line: number;
+  /** the `dynamodb_table` value as written (a literal, or an expression). */
+  table: string;
+}
+
+/** `use_lockfile = true` — the only value that actually enables native locking.
+ *  `false`, or an expression we cannot resolve, leaves DynamoDB as the sole
+ *  mechanism, so the finding still stands. */
+function enablesLockfile(value: string | undefined): boolean {
+  return value !== undefined && stripTrailingComment(value) === "true";
+}
+
+/**
+ * Every `terraform { backend "s3" { … } }` that locks via `dynamodb_table`
+ * without `use_lockfile = true`.
+ *
+ * Walks `terraform` → `backend` explicitly rather than matching `dynamodb_table`
+ * anywhere: `aws_dynamodb_table` resources and module inputs of the same name
+ * are common, and a currency finding fabricated from one of those would be
+ * indistinguishable from a real one to whoever reads the report.
+ */
+export function findDeprecatedStateLocking(hcl: string): DeprecatedLockingSite[] {
+  const out: DeprecatedLockingSite[] = [];
+  for (const tf of parseBlocks(hcl, ["terraform"])) {
+    for (const backend of parseBlocks(tf.body, ["backend"])) {
+      if (backend.labels[0] !== "s3") continue;
+      const args = topLevelAssignments(backend.body);
+      const get = (key: string): string | undefined => args.find((a) => a.name === key)?.value;
+      const table = get("dynamodb_table");
+      if (table === undefined) continue;
+      if (enablesLockfile(get("use_lockfile"))) continue;
+      out.push({
+        line: tf.bodyLine + backend.line - 1,
+        table: stripTrailingComment(table),
+      });
+    }
+  }
+  return out;
+}
+
+export function deprecatedStateLockingToConcerns(
+  sites: DeprecatedLockingSite[],
+  file: string,
+): Concern[] {
+  return sites.map((site) =>
+    buildConcern({
+      source: NATIVE_SOURCE,
+      rule: DEPRECATED_STATE_LOCKING,
+      file,
+      line: site.line,
+      severity: BAND_SEVERITY.advisory,
+      category: "correctness",
+      evidence:
+        `backend "s3" locks state via dynamodb_table = ${site.table} with no use_lockfile. ` +
+        "DynamoDB-based locking is deprecated and HashiCorp will remove it in a future release",
+      remediation_hint:
+        "Add `use_lockfile = true` to the backend block and keep `dynamodb_table` for now — the two are " +
+        "supported together precisely so a team can migrate without a flag day, and older Terraform " +
+        "versions still locking through DynamoDB keep working. Drop `dynamodb_table` (and the table) " +
+        "only once every consumer of this state has moved. ⚠️ A backend change is NOT a code-only fix: " +
+        "it needs `terraform init -migrate-state` run by someone with access to the real state, so this " +
+        "belongs in a human-owned change, not an automated remediation PR.",
+    }),
+  );
+}

package/src/mcp/terraform/subprocess.ts

@@ -0,0 +1,102 @@
+import { spawnSync } from "node:child_process";
+import { log } from "#app/utils/cli";
+import { resolveEnv } from "#app/utils/secrets";
+
+export type RunResult = { status: number; stdout: string; stderr: string; missing: boolean };
+
+/**
+ * Hard wall-clock cap on any single scanner/terraform invocation. Bounds a hung
+ * subprocess (e.g. `terraform init`/`plan` stalling on a private registry, a
+ * tflint plugin fetch that never returns) so it can't block the run forever.
+ * Generous (5 min) so it only ever fires on a genuine hang, never a slow-but-
+ * progressing plan. A timeout surfaces as a non-zero/`-1` status the caller
+ * already treats as "this scanner did not produce results".
+ */
+export const SUBPROCESS_TIMEOUT_MS = 300_000;
+
+/**
+ * Run a scanner without throwing. Terraform tools exit non-zero when they FIND
+ * issues, so a non-zero status is normal, not an error. `missing` is set when
+ * the binary isn't on PATH (ENOENT) — the scanner then degrades to "skipped"
+ * rather than failing the run (a tool being absent must not block).
+ *
+ * `extraEnv` opts a specific command back into a needed credential: the scanners
+ * run with a restricted env that strips every `*_KEY`/secret, but infracost
+ * legitimately needs its `INFRACOST_API_KEY`. resolveEnv(object) merges the
+ * restricted base with the explicit vars, so only the named keys get through.
+ */
+export function run(
+  cmd: string,
+  args: string[],
+  cwd: string,
+  extraEnv?: Record<string, string>,
+): RunResult {
+  const result = spawnSync(cmd, args, {
+    cwd,
+    encoding: "utf-8",
+    // restricted env: keeps PATH/HOME, strips secrets so a scanner (or a tflint
+    // plugin) can't exfiltrate credentials. `extraEnv` re-admits only the named vars.
+    env: resolveEnv(extraEnv ?? "restricted") as NodeJS.ProcessEnv,
+    stdio: ["ignore", "pipe", "pipe"],
+    maxBuffer: 64 * 1024 * 1024,
+    timeout: SUBPROCESS_TIMEOUT_MS,
+  });
+  if (result.error) {
+    // ENOENT = binary absent (degrade to "skipped"); a timeout (ETIMEDOUT, or a
+    // SIGTERM kill on timeout) is a real failure surfaced as status -1, which the
+    // scanner callers already treat as "no results from this tool".
+    const missing = (result.error as NodeJS.ErrnoException).code === "ENOENT";
+    return { status: -1, stdout: "", stderr: result.error.message, missing };
+  }
+  return {
+    status: result.status ?? -1,
+    stdout: result.stdout ?? "",
+    stderr: result.stderr ?? "",
+    missing: false,
+  };
+}
+
+// which Terraform-compatible CLI answered, resolved lazily from the first real
+// invocation (not a separate probe) and memoised so the fallback is attempted at
+// most once per process. `undefined` = not yet resolved.
+let resolvedTfCli: "terraform" | "tofu" | undefined;
+
+/** test seam — forget the resolved CLI so a test can exercise both branches. */
+export function resetTerraformCliCache(): void {
+  resolvedTfCli = undefined;
+}
+
+/**
+ * Run a Terraform CLI command, preferring `terraform` and transparently falling
+ * back to OpenTofu (`tofu`) when `terraform` is ABSENT from PATH (ENOENT). The two
+ * share the exact surface the engine uses (fmt / validate / init / plan / show),
+ * and the licence posture already prefers OpenTofu (Terraform is BUSL) — so an
+ * OpenTofu-only runner keeps full fmt/validate/plan coverage instead of reporting
+ * everything skipped. The fallback is probed via the FIRST real command (no
+ * separate `version` call, so a mocked runner that answers `fmt`/`init`/`plan`
+ * needs no extra stubbing) and the chosen binary is memoised for the rest of the
+ * process — the one-time resolution to `tofu` is logged so the operator sees which
+ * CLI ran. When BOTH are absent the terraform result (missing) is returned so the
+ * caller degrades to "skipped" exactly as before. `runner` is injectable for tests.
+ */
+export function runTf(
+  args: string[],
+  cwd: string,
+  extraEnv?: Record<string, string>,
+  runner: typeof run = run,
+): RunResult {
+  if (resolvedTfCli) return runner(resolvedTfCli, args, cwd, extraEnv);
+  const tf = runner("terraform", args, cwd, extraEnv);
+  if (!tf.missing) {
+    resolvedTfCli = "terraform";
+    return tf;
+  }
+  const tofu = runner("tofu", args, cwd, extraEnv);
+  if (!tofu.missing) {
+    resolvedTfCli = "tofu";
+    log.info("» terraform not found on PATH — using OpenTofu (tofu) for fmt/validate/plan");
+    return tofu;
+  }
+  // neither installed — return terraform's missing result (caller skips).
+  return tf;
+}