snyk 1.1104.0 → 1.1105.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/cli/519.index.js
CHANGED
|
@@ -117,7 +117,7 @@ function createIacDir() {
|
|
|
117
117
|
const iacPath = path.join(local_cache_1.LOCAL_POLICY_ENGINE_DIR);
|
|
118
118
|
try {
|
|
119
119
|
if (!fs.existsSync(iacPath)) {
|
|
120
|
-
fs.mkdirSync(iacPath,
|
|
120
|
+
fs.mkdirSync(iacPath, { recursive: true, mode: 0o700 });
|
|
121
121
|
}
|
|
122
122
|
fs.accessSync(iacPath, fs.constants.W_OK);
|
|
123
123
|
}
|
|
@@ -203,6 +203,7 @@ exports.makeFileAndDirectoryGenerator = makeFileAndDirectoryGenerator;
|
|
|
203
203
|
/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
|
|
204
204
|
|
|
205
205
|
|
|
206
|
+
var _a;
|
|
206
207
|
Object.defineProperty(exports, "__esModule", ({ value: true }));
|
|
207
208
|
exports.InvalidCustomRulesPath = exports.InvalidCustomRules = exports.FailedToExtractCustomRulesError = exports.FailedToDownloadRulesError = exports.FailedToInitLocalCacheError = exports.cleanLocalCache = exports.initLocalCache = exports.getLocalCachePath = exports.assertNever = exports.CUSTOM_POLICY_ENGINE_WASM_PATH = exports.LOCAL_POLICY_ENGINE_DIR = void 0;
|
|
208
209
|
const path = __webpack_require__(85622);
|
|
@@ -216,8 +217,13 @@ const analytics = __webpack_require__(82744);
|
|
|
216
217
|
const error_utils_1 = __webpack_require__(36401);
|
|
217
218
|
const config_1 = __webpack_require__(25425);
|
|
218
219
|
const request_1 = __webpack_require__(1552);
|
|
220
|
+
const env_paths_1 = __webpack_require__(21766);
|
|
219
221
|
const debug = Debug('iac-local-cache');
|
|
220
|
-
|
|
222
|
+
const cachePath = (_a = config_1.default.CACHE_PATH) !== null && _a !== void 0 ? _a : env_paths_1.default('snyk').cache;
|
|
223
|
+
const uuid = Math.random()
|
|
224
|
+
.toString(36)
|
|
225
|
+
.substring(2);
|
|
226
|
+
exports.LOCAL_POLICY_ENGINE_DIR = cachePath + '/iac-data/' + uuid;
|
|
221
227
|
const KUBERNETES_POLICY_ENGINE_WASM_PATH = path.join(exports.LOCAL_POLICY_ENGINE_DIR, 'k8s_policy.wasm');
|
|
222
228
|
const KUBERNETES_POLICY_ENGINE_DATA_PATH = path.join(exports.LOCAL_POLICY_ENGINE_DIR, 'k8s_data.json');
|
|
223
229
|
const TERRAFORM_POLICY_ENGINE_WASM_PATH = path.join(exports.LOCAL_POLICY_ENGINE_DIR, 'tf_policy.wasm');
|
|
@@ -238,28 +244,28 @@ function getLocalCachePath(engineType) {
|
|
|
238
244
|
switch (engineType) {
|
|
239
245
|
case types_1.EngineType.Kubernetes:
|
|
240
246
|
return [
|
|
241
|
-
`${
|
|
242
|
-
`${
|
|
247
|
+
`${KUBERNETES_POLICY_ENGINE_WASM_PATH}`,
|
|
248
|
+
`${KUBERNETES_POLICY_ENGINE_DATA_PATH}`,
|
|
243
249
|
];
|
|
244
250
|
case types_1.EngineType.Terraform:
|
|
245
251
|
return [
|
|
246
|
-
`${
|
|
247
|
-
`${
|
|
252
|
+
`${TERRAFORM_POLICY_ENGINE_WASM_PATH}`,
|
|
253
|
+
`${TERRAFORM_POLICY_ENGINE_DATA_PATH}`,
|
|
248
254
|
];
|
|
249
255
|
case types_1.EngineType.CloudFormation:
|
|
250
256
|
return [
|
|
251
|
-
`${
|
|
252
|
-
`${
|
|
257
|
+
`${CLOUDFORMATION_POLICY_ENGINE_WASM_PATH}`,
|
|
258
|
+
`${CLOUDFORMATION_POLICY_ENGINE_DATA_PATH}`,
|
|
253
259
|
];
|
|
254
260
|
case types_1.EngineType.ARM:
|
|
255
261
|
return [
|
|
256
|
-
`${
|
|
257
|
-
`${
|
|
262
|
+
`${ARM_POLICY_ENGINE_WASM_PATH}`,
|
|
263
|
+
`${ARM_POLICY_ENGINE_DATA_PATH}`,
|
|
258
264
|
];
|
|
259
265
|
case types_1.EngineType.Custom:
|
|
260
266
|
return [
|
|
261
|
-
`${
|
|
262
|
-
`${
|
|
267
|
+
`${exports.CUSTOM_POLICY_ENGINE_WASM_PATH}`,
|
|
268
|
+
`${CUSTOM_POLICY_ENGINE_DATA_PATH}`,
|
|
263
269
|
];
|
|
264
270
|
default:
|
|
265
271
|
assertNever(engineType);
|
|
@@ -315,7 +321,7 @@ async function initLocalCache({ customRulesPath, } = {}) {
|
|
|
315
321
|
exports.initLocalCache = initLocalCache;
|
|
316
322
|
function cleanLocalCache() {
|
|
317
323
|
// path to delete is hardcoded for now
|
|
318
|
-
const iacPath = path.
|
|
324
|
+
const iacPath = path.normalize(exports.LOCAL_POLICY_ENGINE_DIR);
|
|
319
325
|
try {
|
|
320
326
|
// when we support Node version >= 12.10.0 , we can replace rimraf
|
|
321
327
|
// with the native fs.rmdirSync(path, {recursive: true})
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"519.index.js","mappings":";;;;;;;;;;;AAAA,2CAAgF;AAChF,6CAA0D;AAC1D,gDAAgE;AAEhE,6CAAwE;AAExE,SAAgB,eAAe,CAC7B,gBAAmC,EACnC,IAGC;IAED,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,MAAM,2BAA2B,GAAqC,EAAE,CAAC;IACzE,IAAI,0BAA0B,GAAG,CAAC,CAAC;IACnC,MAAM,oBAAoB,GAA2B,EAAE,CAAC;IACxD,MAAM,eAAe,GAAG,KAAK,EAAU,CAAC;IAExC,gBAAgB,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;;QAC/B,gBAAgB;YACd,CAAC,gBAAgB,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC;QAEjE,MAAM,WAAW,GAAG,GAAG,CAAC,cAAc,CAAC;QACvC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClC,oBAAoB,CAAC,WAAW,CAAC,SAAG,oBAAoB,CAAC,WAAW,CAAC,mCAAI;YACvE,KAAK,EAAE,CAAC;SACT,CAAC;QACF,oBAAoB,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAE7C,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;YAC/C,oBAAoB,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAChD,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAEhE,IAAI,MAAM,CAAC,uBAAuB,EAAE;gBAClC,0BAA0B,EAAE,CAAC;gBAC7B,2BAA2B,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;aACrD;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,sBAAsB,GAAW,MAAM,CAAC,IAAI,CAChD,2BAA2B,CAC5B,CAAC,MAAM,CAAC;IAET,SAAS,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACtE,SAAS,CAAC,GAAG,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;IACpD,SAAS,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnE,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;IAChD,SAAS,CAAC,GAAG,CAAC,aAAa,EAAE,kCAA0B,CAAC,CAAC;IACzD,SAAS,CAAC,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,8DAA8D;IACxH,SAAS,CAAC,GAAG,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC1D,SAAS,CAAC,GAAG,CACX,wBAAwB,EACxB,IAAI,CAAC,WAAW,KAAK,mBAAW,CAAC,KAAK,CACvC,CAAC;IACF,SAAS,CAAC,GAAG,CACX,yBAAyB,EACzB,IAAI,CAAC,WAAW,KAAK,mBAAW,CAAC,MAAM,CACxC,CAAC;IACF,SAAS,CAAC,GAAG,CAAC,+BAA+B,EAAE,0BAA0B,CAAC,CAAC;IAC3E,SAAS,CAAC,GAAG,CACX,2BAA2B,EAC3B,6CAAgC,EAAE,CACnC,CAAC;IACF,SAAS,CAAC,GAAG,CAAC,iCAAiC,EAAE,sBAAsB,CAAC,CAAC;AAC3E,CAAC;AA5DD,0CA4DC;AAEY,kCAA0B,GAGnC;IACF,CAAC,+BAAuB,CAAC,cAAc,CAAC,EAAE,IAAI;IAC9C,CAAC,+BAAuB,CAAC,WAAW,CAAC,EAAE,IAAI;IAC3C,CAAC,+BAAuB,CAAC,WAAW,CAAC,EAAE,IAAI;IAC3C,CAAC,+BAAuB,CAAC,YAAY,CAAC,EAAE,IAAI;IAC5C,CAAC,+BAAuB,CAAC,WAAW,CAAC,EAAE,IAAI;IAC3C,CAAC,+BAAuB,CAAC,gBAAgB,CAAC,EAAE,IAAI;IAChD,CAAC,+BAAuB,CAAC,gBAAgB,CAAC,EAAE,IAAI;IAChD,CAAC,+BAAuB,CAAC,aAAa,CAAC,EAAE,IAAI;IAC7C,CAAC,+BAAuB,CAAC,YAAY,CAAC,EAAE,IAAI;IAC5C,CAAC,+BAAuB,CAAC,KAAK,CAAC,EAAE,IAAI;CACtC,CAAC;AAEF,SAAgB,oBAAoB,CAClC,QAAuB,EACvB,OAAwB;IAExB,SAAS,CAAC,GAAG,CAAC,oBAAoB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvD,SAAS,CAAC,GAAG,CAAC,2BAA2B,EAAE,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7E,SAAS,CAAC,GAAG,CAAC,2BAA2B,EAAE,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7E,SAAS,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACzE,SAAS,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACzE,SAAS,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACzE,SAAS,CAAC,GAAG,CACX,4BAA4B,EAC5B,QAAQ,CAAC,OAAO,CAAC,sBAAsB,CACxC,CAAC;IACF,SAAS,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;IACjE,SAAS,CAAC,GAAG,CAAC,4BAA4B,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACvE,SAAS,CAAC,GAAG,CAAC,mBAAmB,EAAE,0BAAe,CAAC,CAAC;IACpD,SAAS,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;IAEjE,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,OAAO,CAAC,cAAc,CAAC,EAAE;QAC3B,KAAK,GAAG,SAAS,CAAC;KACnB;SAAM,IAAI,OAAO,CAAC,gBAAgB,CAAC,EAAE;QACpC,KAAK,GAAG,WAAW,CAAC;KACrB;IACD,SAAS,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC;AA1BD,oDA0BC;;;;;;;;;;;AC9GD,sCAAyB;AACzB,uCAA2B;AAC3B,wCAA6B;AAC7B,0CAAiC;AACjC,iDAGuB;AACvB,4CAAwD;AACxD,wCAAiC;AACjC,0CAA4B;AAE5B,SAAS,QAAQ,CAAC,CAAS;IACzB,MAAM,UAAU,GAAG,MAAM;SACtB,UAAU,CAAC,MAAM,CAAC;SAClB,MAAM,CAAC,CAAC,CAAC;SACT,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAgB,YAAY;IAC1B,oEAAoE;IACpE,MAAM,OAAO,GAAgB,IAAI,CAAC,IAAI,CAAC,qCAAuB,CAAC,CAAC;IAChE,IAAI;QACF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;YAC3B,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;SAC9B;QACD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;KAC3C;IAAC,MAAM;QACN,MAAM,IAAI,yCAA2B,EAAE,CAAC;KACzC;AACH,CAAC;AAXD,oCAWC;AAED,SAAgB,aAAa,CAAC,QAA+B;IAC3D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ;aACL,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;aACnB,IAAI,CACH,GAAG,CAAC,CAAC,CAAC;YACJ,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,qCAAuB,CAAC;SACtC,CAAC,CACH;aACA,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;aACrB,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAZD,sCAYC;AAED,SAAgB,aAAa,CAAC,QAAgB,EAAE,QAAgB;IAC9D,IAAI;QACF,yEAAyE;QACzE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;KAChE;IAAC,MAAM;QACN,OAAO,KAAK,CAAC;KACd;AACH,CAAC;AAPD,sCAOC;AAED,SAAgB,gCAAgC;IAC9C,IAAI;QACF,MAAM,yBAAyB,GAAG,IAAI,CAAC,IAAI,CACzC,qCAAuB,EACvB,+BAAoB,CACrB,CAAC;QACF,oEAAoE;QACpE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,yBAAyB,CAAC,EAAE;YAC7C,OAAO;SACR;QACD,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAAC;QACtE,OAAO,QAAQ,CAAC,UAAU,CAAC,CAAC;KAC7B;IAAC,OAAO,GAAG,EAAE;QACZ,OAAO;KACR;AACH,CAAC;AAfD,4EAeC;AAED;;;;;GAKG;AACH,6EAA6E;AAC7E,QAAe,CAAC,CAAC,6BAA6B,CAAC,IAAI,GAAG,GAAG,EAAE,QAAiB;IAC1E,QAAQ,CAAC,CAAC,eAAe,CAAC,UAAU,EAAE,YAAY;QAChD;YACE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;SACjC;QACD,IAAI,QAAQ,KAAK,YAAY,EAAE;YAC7B,KAAK,MAAM,MAAM,IAAI,gBAAW,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE;gBACrE,IACE,MAAM,CAAC,WAAW,EAAE;oBACpB,EAAE,CAAC,WAAW,CAAC,WAAI,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAC1D;oBACA,KAAK,CAAC,CAAC,eAAe,CACpB,WAAI,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,EAC7B,YAAY,GAAG,CAAC,CACjB,CAAC;iBACH;qBAAM,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE;oBAC1B,MAAM;wBACJ,IAAI,EAAE;4BACJ,GAAG,EAAE,UAAU;4BACf,QAAQ,EAAE,WAAI,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC;yBACxC;qBACF,CAAC;iBACH;aACF;SACF;IACH,CAAC;IACD,KAAK,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAClC,CAAC;AA3BD,sEA2BC;;;;;;;;;;;AC3GD,wCAA6B;AAC7B,sCAAyB;AACzB,2CAAoD;AACpD,0CAAiC;AACjC,gDAA0E;AAC1E,yCAA+B;AAC/B,4CAAwD;AACxD,6CAA0D;AAC1D,iDAAmD;AACnD,4CAA+C;AAC/C,4CAAmE;AAEnE,MAAM,KAAK,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC;AAE1B,+BAAuB,GAAG,WAAW,CAAC;AAEnD,MAAM,kCAAkC,GAAG,IAAI,CAAC,IAAI,CAClD,+BAAuB,EACvB,iBAAiB,CAClB,CAAC;AACF,MAAM,kCAAkC,GAAG,IAAI,CAAC,IAAI,CAClD,+BAAuB,EACvB,eAAe,CAChB,CAAC;AACF,MAAM,iCAAiC,GAAG,IAAI,CAAC,IAAI,CACjD,+BAAuB,EACvB,gBAAgB,CACjB,CAAC;AACF,MAAM,iCAAiC,GAAG,IAAI,CAAC,IAAI,CACjD,+BAAuB,EACvB,cAAc,CACf,CAAC;AACF,MAAM,sCAAsC,GAAG,IAAI,CAAC,IAAI,CACtD,+BAAuB,EACvB,4BAA4B,CAC7B,CAAC;AACF,MAAM,sCAAsC,GAAG,IAAI,CAAC,IAAI,CACtD,+BAAuB,EACvB,0BAA0B,CAC3B,CAAC;AACF,MAAM,2BAA2B,GAAG,IAAI,CAAC,IAAI,CAC3C,+BAAuB,EACvB,iBAAiB,CAClB,CAAC;AACF,MAAM,2BAA2B,GAAG,IAAI,CAAC,IAAI,CAC3C,+BAAuB,EACvB,eAAe,CAChB,CAAC;AAEF,4EAA4E;AAC5E,6DAA6D;AAChD,sCAA8B,GAAG,IAAI,CAAC,IAAI,CACrD,+BAAuB,EACvB,aAAa,CACd,CAAC;AACF,MAAM,8BAA8B,GAAG,IAAI,CAAC,IAAI,CAC9C,+BAAuB,EACvB,WAAW,CACZ,CAAC;AAEF,SAAgB,WAAW,CAAC,KAAY;IACtC,MAAM,IAAI,KAAK,CACb,yCAAyC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CACjE,CAAC;AACJ,CAAC;AAJD,kCAIC;AAED,SAAgB,iBAAiB,CAAC,UAAsB;IACtD,QAAQ,UAAU,EAAE;QAClB,KAAK,kBAAU,CAAC,UAAU;YACxB,OAAO;gBACL,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,kCAAkC,EAAE;gBACxD,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,kCAAkC,EAAE;aACzD,CAAC;QACJ,KAAK,kBAAU,CAAC,SAAS;YACvB,OAAO;gBACL,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,iCAAiC,EAAE;gBACvD,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,iCAAiC,EAAE;aACxD,CAAC;QACJ,KAAK,kBAAU,CAAC,cAAc;YAC5B,OAAO;gBACL,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,sCAAsC,EAAE;gBAC5D,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,sCAAsC,EAAE;aAC7D,CAAC;QACJ,KAAK,kBAAU,CAAC,GAAG;YACjB,OAAO;gBACL,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,2BAA2B,EAAE;gBACjD,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,2BAA2B,EAAE;aAClD,CAAC;QACJ,KAAK,kBAAU,CAAC,MAAM;YACpB,OAAO;gBACL,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,sCAA8B,EAAE;gBACpD,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,8BAA8B,EAAE;aACrD,CAAC;QACJ;YACE,WAAW,CAAC,UAAU,CAAC,CAAC;KAC3B;AACH,CAAC;AA9BD,8CA8BC;AAEM,KAAK,UAAU,cAAc,CAAC,EACnC,eAAe,MACiB,EAAE;IAClC,IAAI;QACF,yBAAY,EAAE,CAAC;KAChB;IAAC,OAAO,CAAC,EAAE;QACV,MAAM,IAAI,2BAA2B,EAAE,CAAC;KACzC;IAED,8DAA8D;IAC9D,IAAI,eAAe,EAAE;QACnB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE;YACnC,MAAM,IAAI,sBAAsB,CAAC,eAAe,CAAC,CAAC;SACnD;QAED,IAAI;YACF,MAAM,QAAQ,GAAG,EAAE,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;YACtD,MAAM,0BAAa,CAAC,QAAQ,CAAC,CAAC;SAC/B;QAAC,OAAO,CAAC,EAAE;YACV,MAAM,IAAI,+BAA+B,CAAC,eAAe,CAAC,CAAC;SAC5D;QAED,IACE,CAAC,0BAAa,CACZ,sCAA8B,EAC9B,8BAA8B,CAC/B,EACD;YACA,MAAM,IAAI,kBAAkB,CAAC,eAAe,CAAC,CAAC;SAC/C;KACF;IAED,8EAA8E;IAC9E,yCAAyC;IACzC,IAAI,gBAAM,CAAC,eAAe,EAAE;QAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,gBAAgB,CAAC,gBAAM,CAAC,eAAe,CAAC,CAAC;QAC3D,MAAM,0BAAa,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO;KACR;IAED,uEAAuE;IACvE,4CAA4C;IAC5C,IAAI;QACF,MAAM,UAAU,GAAG,+CAA+C,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,uBAAa,CAAC;YACnC,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,UAAU;YACf,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC;QACH,MAAM,0BAAa,CAAC,QAAQ,CAAC,CAAC;KAC/B;IAAC,OAAO,CAAC,EAAE;QACV,MAAM,IAAI,0BAA0B,EAAE,CAAC;KACxC;AACH,CAAC;AAtDD,wCAsDC;AAED,SAAgB,eAAe;IAC7B,sCAAsC;IACtC,MAAM,OAAO,GAAgB,IAAI,CAAC,IAAI,CACpC,GAAG,OAAO,CAAC,GAAG,EAAE,EAAE,EAClB,+BAAuB,CACxB,CAAC;IACF,IAAI;QACF,kEAAkE;QAClE,wDAAwD;QACxD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;KACtB;IAAC,OAAO,CAAC,EAAE;QACV,MAAM,GAAG,GAAG,IAAI,4BAA4B,EAAE,CAAC;QAC/C,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,KAAK,CAAC,gDAAgD,CAAC,CAAC;KACzD;AACH,CAAC;AAfD,0CAeC;AAED,MAAa,2BAA4B,SAAQ,oBAAW;IAC1D,YAAY,OAAgB;QAC1B,KAAK,CAAC,OAAO,IAAI,kCAAkC,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,GAAG,qBAAa,CAAC,2BAA2B,CAAC;QACtD,IAAI,CAAC,OAAO,GAAG,gCAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW;YACd,mIAAmI,CAAC;IACxI,CAAC;CACF;AARD,kEAQC;AAED,MAAa,0BAA2B,SAAQ,oBAAW;IACzD,YAAY,OAAgB;QAC1B,KAAK,CAAC,OAAO,IAAI,6BAA6B,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,qBAAa,CAAC,0BAA0B,CAAC;QACrD,IAAI,CAAC,OAAO,GAAG,gCAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW;YACd,4GAA4G,CAAC;IACjH,CAAC;CACF;AARD,gEAQC;AAED,MAAa,+BAAgC,SAAQ,oBAAW;IAC9D,YAAY,IAAY,EAAE,OAAgB;QACxC,KAAK,CAAC,OAAO,IAAI,6BAA6B,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,qBAAa,CAAC,+BAA+B,CAAC;QAC1D,IAAI,CAAC,OAAO,GAAG,gCAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,oDAAoD,IAAI,kHAAkH,CAAC;IAChM,CAAC;CACF;AAPD,0EAOC;AAED,MAAa,kBAAmB,SAAQ,oBAAW;IACjD,YAAY,IAAY,EAAE,OAAgB;QACxC,KAAK,CAAC,OAAO,IAAI,6BAA6B,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,qBAAa,CAAC,kBAAkB,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,gCAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,oDAAoD,IAAI,4HAA4H,CAAC;IAC1M,CAAC;CACF;AAPD,gDAOC;AAED,MAAa,sBAAuB,SAAQ,oBAAW;IACrD,YAAY,IAAY,EAAE,OAAgB;QACxC,KAAK,CAAC,OAAO,IAAI,qCAAqC,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,GAAG,qBAAa,CAAC,sBAAsB,CAAC;QACjD,IAAI,CAAC,OAAO,GAAG,gCAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,oDAAoD,IAAI,kDAAkD,CAAC;IAChI,CAAC;CACF;AAPD,wDAOC;AAED,MAAM,4BAA6B,SAAQ,oBAAW;IACpD,YAAY,OAAgB;QAC1B,KAAK,CAAC,OAAO,IAAI,6BAA6B,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,qBAAa,CAAC,4BAA4B,CAAC;QACvD,IAAI,CAAC,OAAO,GAAG,gCAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC,2BAA2B;IACpD,CAAC;CACF;;;;;;;;;;;ACjOD,wCAAoC;AACpC,wCAA6B;AAC7B,2CAAmE;AACnE,4CAA2D;AAC3D,iDAAoD;AACpD,iDAAyD;AACzD,yCAA+B;AAC/B,gDAA6C;AAE7C,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;AAEvB,4BAAoB,GAAG,sBAAsB,CAAC;AAE3D,SAAgB,+BAA+B,CAC7C,cAAsB;IAEtB,IAAI;QACF,MAAM,kBAAkB,GAAG,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;YACvD,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAChC,CAAC,CAAC,cAAc,CAAC;QAEnB,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,GAAG;YAClC,kBAAkB,CAAC,SAAS,CAAC,CAAC,EAAE,aAAa,CAAC;YAC9C,kBAAkB,CAAC,SAAS,CAAC,aAAa,GAAG,CAAC,CAAC;SAChD,CAAC;QACF,MAAM,CAAC,IAAI,EAAE,GAAG,GAAG,QAAQ,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,aAAa,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,EAAE;YAClE,MAAM,IAAI,6BAA6B,CAAC,cAAc,CAAC,CAAC;SACzD;QACD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;KAClD;IAAC,MAAM;QACN,MAAM,IAAI,6BAA6B,CAAC,cAAc,CAAC,CAAC;KACzD;AACH,CAAC;AArBD,0EAqBC;AAED;;;;;;;;;;IAUI;AACG,KAAK,UAAU,IAAI,CACxB,QAAqB,EACrB,UAAkB,EAClB,GAAW;IAEX,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC9E,IAAI,aAAa,KAAK,CAAC,EAAE;QACvB,MAAM,IAAI,iCAAiC,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;KACvE;IACD,mEAAmE;IACnE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE;QACrB,KAAK,CAAC,4DAA4D,CAAC,CAAC;KACrE;IACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAEvE,IAAI;QACF,MAAM,YAAY,GAAW,IAAI,CAAC,IAAI,CACpC,qCAAuB,EACvB,4BAAoB,CACrB,CAAC;QACF,yBAAY,EAAE,CAAC;QACf,MAAM,aAAE,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QACvC,OAAO,YAAY,CAAC;KACrB;IAAC,OAAO,GAAG,EAAE;QACZ,MAAM,IAAI,6BAA6B,EAAE,CAAC;KAC3C;AACH,CAAC;AA1BD,oBA0BC;AAED,MAAa,6BAA8B,SAAQ,oBAAW;IAC5D,YAAY,OAAgB;QAC1B,KAAK,CAAC,OAAO,IAAI,8BAA8B,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,qBAAa,CAAC,6BAA6B,CAAC;QACxD,IAAI,CAAC,OAAO,GAAG,gCAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW;YACd,+GAA+G,CAAC;IACpH,CAAC;CACF;AARD,sEAQC;AAED,MAAa,iCAAkC,SAAQ,oBAAW;IAChE,YAAY,OAAgB;QAC1B,KAAK,CAAC,OAAO,IAAI,iCAAiC,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,qBAAa,CAAC,6BAA6B,CAAC;QACxD,IAAI,CAAC,OAAO,GAAG,gCAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,oCAAoC,OAAO,2DAA2D,CAAC;IAC5H,CAAC;CACF;AAPD,8EAOC;AAED,MAAa,6BAA8B,SAAQ,oBAAW;IAC5D,YAAY,GAAY;QACtB,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,qBAAa,CAAC,6BAA6B,CAAC;QACxD,IAAI,CAAC,OAAO,GAAG,gCAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,mCACjB,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,EACvB,qCAAqC,CAAC;IACxC,CAAC;CACF;AATD,sEASC;AAED,MAAa,+BAAgC,SAAQ,oBAAW;IAC9D,YAAY,WAAmB;QAC7B,KAAK,CAAC,wCAAwC,WAAW,cAAc,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,GAAG,qBAAa,CAAC,+BAA+B,CAAC;QAC1D,IAAI,CAAC,OAAO,GAAG,gCAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,8GAA8G,CAAC;IACpI,CAAC;CACF;AAPD,0EAOC","sources":["webpack://snyk/./src/cli/commands/test/iac/local-execution/analytics.ts","webpack://snyk/./src/cli/commands/test/iac/local-execution/file-utils.ts","webpack://snyk/./src/cli/commands/test/iac/local-execution/local-cache.ts","webpack://snyk/./src/cli/commands/test/iac/local-execution/rules/oci-pull.ts"],"sourcesContent":["import { FormattedResult, PerformanceAnalyticsKey, RulesOrigin } from './types';\nimport * as analytics from '../../../../../lib/analytics';\nimport { computeCustomRulesBundleChecksum } from './file-utils';\nimport { DescribeOptions, DriftAnalysis } from '../../../../../lib/iac/types';\nimport { driftctlVersion } from '../../../../../lib/iac/drift/driftctl';\n\nexport function addIacAnalytics(\n formattedResults: FormattedResult[],\n opts: {\n ignoredIssuesCount: number;\n rulesOrigin: RulesOrigin;\n },\n): void {\n let totalIssuesCount = 0;\n const customRulesIdsFoundInIssues: { [customRuleId: string]: true } = {};\n let issuesFromCustomRulesCount = 0;\n const projectTypeAnalytics: Record<string, object> = {};\n const packageManagers = Array<string>();\n\n formattedResults.forEach((res) => {\n totalIssuesCount =\n (totalIssuesCount || 0) + res.result.cloudConfigResults.length;\n\n const projectType = res.packageManager;\n packageManagers.push(projectType);\n projectTypeAnalytics[projectType] = projectTypeAnalytics[projectType] ?? {\n count: 0,\n };\n projectTypeAnalytics[projectType]['count']++;\n\n res.result.cloudConfigResults.forEach((policy) => {\n projectTypeAnalytics[projectType][policy.severity] =\n (projectTypeAnalytics[projectType][policy.severity] || 0) + 1;\n\n if (policy.isGeneratedByCustomRule) {\n issuesFromCustomRulesCount++;\n customRulesIdsFoundInIssues[policy.publicId] = true;\n }\n });\n });\n\n const uniqueCustomRulesCount: number = Object.keys(\n customRulesIdsFoundInIssues,\n ).length;\n\n analytics.add('packageManager', Array.from(new Set(packageManagers)));\n analytics.add('iac-issues-count', totalIssuesCount);\n analytics.add('iac-ignored-issues-count', opts.ignoredIssuesCount);\n analytics.add('iac-type', projectTypeAnalytics);\n analytics.add('iac-metrics', performanceAnalyticsObject);\n analytics.add('iac-test-count', formattedResults.length); // TODO: remove this once we all analytics use iac-files-count\n analytics.add('iac-files-count', formattedResults.length);\n analytics.add(\n 'iac-local-custom-rules',\n opts.rulesOrigin === RulesOrigin.Local,\n );\n analytics.add(\n 'iac-remote-custom-rules',\n opts.rulesOrigin === RulesOrigin.Remote,\n );\n analytics.add('iac-custom-rules-issues-count', issuesFromCustomRulesCount);\n analytics.add(\n 'iac-custom-rules-checksum',\n computeCustomRulesBundleChecksum(),\n );\n analytics.add('iac-custom-rules-coverage-count', uniqueCustomRulesCount);\n}\n\nexport const performanceAnalyticsObject: Record<\n PerformanceAnalyticsKey,\n number | null\n> = {\n [PerformanceAnalyticsKey.InitLocalCache]: null,\n [PerformanceAnalyticsKey.FileLoading]: null,\n [PerformanceAnalyticsKey.FileParsing]: null,\n [PerformanceAnalyticsKey.FileScanning]: null,\n [PerformanceAnalyticsKey.OrgSettings]: null,\n [PerformanceAnalyticsKey.CustomSeverities]: null,\n [PerformanceAnalyticsKey.ResultFormatting]: null,\n [PerformanceAnalyticsKey.UsageTracking]: null,\n [PerformanceAnalyticsKey.CacheCleanup]: null,\n [PerformanceAnalyticsKey.Total]: null,\n};\n\nexport function addIacDriftAnalytics(\n analysis: DriftAnalysis,\n options: DescribeOptions,\n): void {\n analytics.add('iac-drift-coverage', analysis.coverage);\n analytics.add('iac-drift-total-resources', analysis.summary.total_resources);\n analytics.add('iac-drift-total-unmanaged', analysis.summary.total_unmanaged);\n analytics.add('iac-drift-total-managed', analysis.summary.total_managed);\n analytics.add('iac-drift-total-missing', analysis.summary.total_missing);\n analytics.add('iac-drift-total-changed', analysis.summary.total_changed);\n analytics.add(\n 'iac-drift-iac-source-count',\n analysis.summary.total_iac_source_count,\n );\n analytics.add('iac-drift-provider-name', analysis.provider_name);\n analytics.add('iac-drift-provider-version', analysis.provider_version);\n analytics.add('iac-drift-version', driftctlVersion);\n analytics.add('iac-drift-scan-duration', analysis.scan_duration);\n\n let scope = 'all';\n if (options['only-managed']) {\n scope = 'managed';\n } else if (options['only-unmanaged']) {\n scope = 'unmanaged';\n }\n analytics.add('iac-drift-scan-scope', scope);\n}\n","import * as fs from 'fs';\nimport * as tar from 'tar';\nimport * as path from 'path';\nimport * as crypto from 'crypto';\nimport {\n FailedToInitLocalCacheError,\n LOCAL_POLICY_ENGINE_DIR,\n} from './local-cache';\nimport { CUSTOM_RULES_TARBALL } from './rules/oci-pull';\nimport { readdirSync } from 'fs';\nimport { join } from 'path';\n\nfunction hashData(s: string): string {\n const hashedData = crypto\n .createHash('sha1')\n .update(s)\n .digest('hex');\n return hashedData;\n}\n\nexport function createIacDir(): void {\n // this path will be able to be customised by the user in the future\n const iacPath: fs.PathLike = path.join(LOCAL_POLICY_ENGINE_DIR);\n try {\n if (!fs.existsSync(iacPath)) {\n fs.mkdirSync(iacPath, '700');\n }\n fs.accessSync(iacPath, fs.constants.W_OK);\n } catch {\n throw new FailedToInitLocalCacheError();\n }\n}\n\nexport function extractBundle(response: NodeJS.ReadableStream): Promise<void> {\n return new Promise((resolve, reject) => {\n response\n .on('error', reject)\n .pipe(\n tar.x({\n C: path.join(LOCAL_POLICY_ENGINE_DIR),\n }),\n )\n .on('finish', resolve)\n .on('error', reject);\n });\n}\n\nexport function isValidBundle(wasmPath: string, dataPath: string): boolean {\n try {\n // verify that the correct files were generated, since this is user input\n return !(!fs.existsSync(wasmPath) || !fs.existsSync(dataPath));\n } catch {\n return false;\n }\n}\n\nexport function computeCustomRulesBundleChecksum(): string | undefined {\n try {\n const customRulesPolicyWasmPath = path.join(\n LOCAL_POLICY_ENGINE_DIR,\n CUSTOM_RULES_TARBALL,\n );\n // if bundle is not configured we don't want to include the checksum\n if (!fs.existsSync(customRulesPolicyWasmPath)) {\n return;\n }\n const policyWasm = fs.readFileSync(customRulesPolicyWasmPath, 'utf8');\n return hashData(policyWasm);\n } catch (err) {\n return;\n }\n}\n\n/**\n * makeFileAndDirectoryGenerator is a generator function that helps walking the directory and file structure of this pathToScan\n * @param root\n * @param maxDepth? - An optional `maxDepth` argument can be provided to limit how deep in the file tree the search will go.\n * @returns {Generator<object>} - a generator which yields an object with directories or paths for the path to scan\n */\n// eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types\nexport function* makeFileAndDirectoryGenerator(root = '.', maxDepth?: number) {\n function* generatorHelper(pathToScan, currentDepth) {\n {\n yield { directory: pathToScan };\n }\n if (maxDepth !== currentDepth) {\n for (const dirent of readdirSync(pathToScan, { withFileTypes: true })) {\n if (\n dirent.isDirectory() &&\n fs.readdirSync(join(pathToScan, dirent.name)).length !== 0\n ) {\n yield* generatorHelper(\n join(pathToScan, dirent.name),\n currentDepth + 1,\n );\n } else if (dirent.isFile()) {\n yield {\n file: {\n dir: pathToScan,\n fileName: join(pathToScan, dirent.name),\n },\n };\n }\n }\n }\n }\n yield* generatorHelper(root, 0);\n}\n","import * as path from 'path';\nimport * as fs from 'fs';\nimport { EngineType, IaCErrorCodes } from './types';\nimport * as rimraf from 'rimraf';\nimport { createIacDir, extractBundle, isValidBundle } from './file-utils';\nimport * as Debug from 'debug';\nimport { CustomError } from '../../../../../lib/errors';\nimport * as analytics from '../../../../../lib/analytics';\nimport { getErrorStringCode } from './error-utils';\nimport config from '../../../../../lib/config';\nimport { streamRequest } from '../../../../../lib/request/request';\n\nconst debug = Debug('iac-local-cache');\n\nexport const LOCAL_POLICY_ENGINE_DIR = '.iac-data';\n\nconst KUBERNETES_POLICY_ENGINE_WASM_PATH = path.join(\n LOCAL_POLICY_ENGINE_DIR,\n 'k8s_policy.wasm',\n);\nconst KUBERNETES_POLICY_ENGINE_DATA_PATH = path.join(\n LOCAL_POLICY_ENGINE_DIR,\n 'k8s_data.json',\n);\nconst TERRAFORM_POLICY_ENGINE_WASM_PATH = path.join(\n LOCAL_POLICY_ENGINE_DIR,\n 'tf_policy.wasm',\n);\nconst TERRAFORM_POLICY_ENGINE_DATA_PATH = path.join(\n LOCAL_POLICY_ENGINE_DIR,\n 'tf_data.json',\n);\nconst CLOUDFORMATION_POLICY_ENGINE_WASM_PATH = path.join(\n LOCAL_POLICY_ENGINE_DIR,\n 'cloudformation_policy.wasm',\n);\nconst CLOUDFORMATION_POLICY_ENGINE_DATA_PATH = path.join(\n LOCAL_POLICY_ENGINE_DIR,\n 'cloudformation_data.json',\n);\nconst ARM_POLICY_ENGINE_WASM_PATH = path.join(\n LOCAL_POLICY_ENGINE_DIR,\n 'arm_policy.wasm',\n);\nconst ARM_POLICY_ENGINE_DATA_PATH = path.join(\n LOCAL_POLICY_ENGINE_DIR,\n 'arm_data.json',\n);\n\n// NOTE: The filenames used for the custom policy bundles match those output\n// by the `opa` CLI tool, which is why they are very generic.\nexport const CUSTOM_POLICY_ENGINE_WASM_PATH = path.join(\n LOCAL_POLICY_ENGINE_DIR,\n 'policy.wasm',\n);\nconst CUSTOM_POLICY_ENGINE_DATA_PATH = path.join(\n LOCAL_POLICY_ENGINE_DIR,\n 'data.json',\n);\n\nexport function assertNever(value: never): never {\n throw new Error(\n `Unhandled discriminated union member: ${JSON.stringify(value)}`,\n );\n}\n\nexport function getLocalCachePath(engineType: EngineType): string[] {\n switch (engineType) {\n case EngineType.Kubernetes:\n return [\n `${process.cwd()}/${KUBERNETES_POLICY_ENGINE_WASM_PATH}`,\n `${process.cwd()}/${KUBERNETES_POLICY_ENGINE_DATA_PATH}`,\n ];\n case EngineType.Terraform:\n return [\n `${process.cwd()}/${TERRAFORM_POLICY_ENGINE_WASM_PATH}`,\n `${process.cwd()}/${TERRAFORM_POLICY_ENGINE_DATA_PATH}`,\n ];\n case EngineType.CloudFormation:\n return [\n `${process.cwd()}/${CLOUDFORMATION_POLICY_ENGINE_WASM_PATH}`,\n `${process.cwd()}/${CLOUDFORMATION_POLICY_ENGINE_DATA_PATH}`,\n ];\n case EngineType.ARM:\n return [\n `${process.cwd()}/${ARM_POLICY_ENGINE_WASM_PATH}`,\n `${process.cwd()}/${ARM_POLICY_ENGINE_DATA_PATH}`,\n ];\n case EngineType.Custom:\n return [\n `${process.cwd()}/${CUSTOM_POLICY_ENGINE_WASM_PATH}`,\n `${process.cwd()}/${CUSTOM_POLICY_ENGINE_DATA_PATH}`,\n ];\n default:\n assertNever(engineType);\n }\n}\n\nexport async function initLocalCache({\n customRulesPath,\n}: { customRulesPath?: string } = {}): Promise<void> {\n try {\n createIacDir();\n } catch (e) {\n throw new FailedToInitLocalCacheError();\n }\n\n // Attempt to extract the custom rules from the path provided.\n if (customRulesPath) {\n if (!fs.existsSync(customRulesPath)) {\n throw new InvalidCustomRulesPath(customRulesPath);\n }\n\n try {\n const response = fs.createReadStream(customRulesPath);\n await extractBundle(response);\n } catch (e) {\n throw new FailedToExtractCustomRulesError(customRulesPath);\n }\n\n if (\n !isValidBundle(\n CUSTOM_POLICY_ENGINE_WASM_PATH,\n CUSTOM_POLICY_ENGINE_DATA_PATH,\n )\n ) {\n throw new InvalidCustomRules(customRulesPath);\n }\n }\n\n // IAC_BUNDLE_PATH is a developer setting that is not useful to most users. It\n // is not a replacement for custom rules.\n if (config.IAC_BUNDLE_PATH) {\n const stream = fs.createReadStream(config.IAC_BUNDLE_PATH);\n await extractBundle(stream);\n return;\n }\n\n // We extract the Snyk rules after the custom rules to ensure our files\n // always overwrite whatever might be there.\n try {\n const BUNDLE_URL = 'https://static.snyk.io/cli/wasm/bundle.tar.gz';\n const response = await streamRequest({\n method: 'get',\n url: BUNDLE_URL,\n body: null,\n headers: {},\n });\n await extractBundle(response);\n } catch (e) {\n throw new FailedToDownloadRulesError();\n }\n}\n\nexport function cleanLocalCache() {\n // path to delete is hardcoded for now\n const iacPath: fs.PathLike = path.join(\n `${process.cwd()}`,\n LOCAL_POLICY_ENGINE_DIR,\n );\n try {\n // when we support Node version >= 12.10.0 , we can replace rimraf\n // with the native fs.rmdirSync(path, {recursive: true})\n rimraf.sync(iacPath);\n } catch (e) {\n const err = new FailedToCleanLocalCacheError();\n analytics.add('error-code', err.code);\n debug('The local cache directory could not be deleted');\n }\n}\n\nexport class FailedToInitLocalCacheError extends CustomError {\n constructor(message?: string) {\n super(message || 'Failed to initialize local cache');\n this.code = IaCErrorCodes.FailedToInitLocalCacheError;\n this.strCode = getErrorStringCode(this.code);\n this.userMessage =\n 'We were unable to create a local directory to store the test assets, please ensure that the current working directory is writable';\n }\n}\n\nexport class FailedToDownloadRulesError extends CustomError {\n constructor(message?: string) {\n super(message || 'Failed to download policies');\n this.code = IaCErrorCodes.FailedToDownloadRulesError;\n this.strCode = getErrorStringCode(this.code);\n this.userMessage =\n 'We were unable to download the security rules, please ensure the network can access https://static.snyk.io';\n }\n}\n\nexport class FailedToExtractCustomRulesError extends CustomError {\n constructor(path: string, message?: string) {\n super(message || 'Failed to download policies');\n this.code = IaCErrorCodes.FailedToExtractCustomRulesError;\n this.strCode = getErrorStringCode(this.code);\n this.userMessage = `We were unable to extract the rules provided at: ${path}. The provided bundle may be corrupted or invalid. Please ensure it was generated using the 'snyk-iac-rules' SDK`;\n }\n}\n\nexport class InvalidCustomRules extends CustomError {\n constructor(path: string, message?: string) {\n super(message || 'Invalid custom rules bundle');\n this.code = IaCErrorCodes.InvalidCustomRules;\n this.strCode = getErrorStringCode(this.code);\n this.userMessage = `We were unable to extract the rules provided at: ${path}. The provided bundle does not match the required structure. Please ensure it was generated using the 'snyk-iac-rules' SDK`;\n }\n}\n\nexport class InvalidCustomRulesPath extends CustomError {\n constructor(path: string, message?: string) {\n super(message || 'Invalid path to custom rules bundle');\n this.code = IaCErrorCodes.InvalidCustomRulesPath;\n this.strCode = getErrorStringCode(this.code);\n this.userMessage = `We were unable to extract the rules provided at: ${path}. The bundle at the provided path does not exist`;\n }\n}\n\nclass FailedToCleanLocalCacheError extends CustomError {\n constructor(message?: string) {\n super(message || 'Failed to clean local cache');\n this.code = IaCErrorCodes.FailedToCleanLocalCacheError;\n this.strCode = getErrorStringCode(this.code);\n this.userMessage = ''; // Not a user facing error.\n }\n}\n","import { promises as fs } from 'fs';\nimport * as path from 'path';\nimport { IaCErrorCodes, OCIRegistryURLComponents } from '../types';\nimport { CustomError } from '../../../../../../lib/errors';\nimport { getErrorStringCode } from '../error-utils';\nimport { LOCAL_POLICY_ENGINE_DIR } from '../local-cache';\nimport * as Debug from 'debug';\nimport { createIacDir } from '../file-utils';\nimport { OciRegistry } from './oci-registry';\nconst debug = Debug('iac-oci-pull');\n\nexport const CUSTOM_RULES_TARBALL = 'custom-bundle.tar.gz';\n\nexport function extractOCIRegistryURLComponents(\n OCIRegistryURL: string,\n): OCIRegistryURLComponents {\n try {\n const urlWithoutProtocol = OCIRegistryURL.includes('://')\n ? OCIRegistryURL.split('://')[1]\n : OCIRegistryURL;\n\n const firstSlashIdx = urlWithoutProtocol.indexOf('/');\n const [registryHost, repoWithTag] = [\n urlWithoutProtocol.substring(0, firstSlashIdx),\n urlWithoutProtocol.substring(firstSlashIdx + 1),\n ];\n const [repo, tag = 'latest'] = repoWithTag.split(':');\n if (firstSlashIdx === -1 || !registryHost || !repoWithTag || !repo) {\n throw new InvalidRemoteRegistryURLError(OCIRegistryURL);\n }\n return { registryBase: registryHost, repo, tag };\n } catch {\n throw new InvalidRemoteRegistryURLError(OCIRegistryURL);\n }\n}\n\n/**\n * Downloads an OCI Artifact from a remote OCI Registry and writes it to the\n * disk. The artifact here is a custom rules bundle stored in a remote registry.\n * In order to do that, it calls an external docker registry v2 client to get\n * the manifests, the layers and then builds the artifact. Example:\n * https://github.com/opencontainers/image-spec/blob/main/manifest.md#example-image-manifest\n *\n * @param registry The client for accessing an OCI registry.\n * @param repository The name of an OCI repository.\n * @param tag The tag of an image in an OCI repository.\n **/\nexport async function pull(\n registry: OciRegistry,\n repository: string,\n tag: string,\n): Promise<string> {\n const { schemaVersion, layers } = await registry.getManifest(repository, tag);\n if (schemaVersion !== 2) {\n throw new InvalidManifestSchemaVersionError(schemaVersion.toString());\n }\n // We assume that we will always have an artifact of a single layer\n if (layers.length > 1) {\n debug('There were more than one layers found in the OCI Artifact.');\n }\n const { blob } = await registry.getLayer(repository, layers[0].digest);\n\n try {\n const downloadPath: string = path.join(\n LOCAL_POLICY_ENGINE_DIR,\n CUSTOM_RULES_TARBALL,\n );\n createIacDir();\n await fs.writeFile(downloadPath, blob);\n return downloadPath;\n } catch (err) {\n throw new FailedToBuildOCIArtifactError();\n }\n}\n\nexport class FailedToBuildOCIArtifactError extends CustomError {\n constructor(message?: string) {\n super(message || 'Could not build OCI Artifact');\n this.code = IaCErrorCodes.FailedToBuildOCIArtifactError;\n this.strCode = getErrorStringCode(this.code);\n this.userMessage =\n 'We were unable to build the remote OCI Artifact locally, please ensure that the local directory is writeable.';\n }\n}\n\nexport class InvalidManifestSchemaVersionError extends CustomError {\n constructor(message?: string) {\n super(message || 'Invalid manifest schema version');\n this.code = IaCErrorCodes.InvalidRemoteRegistryURLError;\n this.strCode = getErrorStringCode(this.code);\n this.userMessage = `Invalid manifest schema version: ${message}. We currently support Image Manifest Version 2, Schema 2`;\n }\n}\n\nexport class InvalidRemoteRegistryURLError extends CustomError {\n constructor(url?: string) {\n super('Invalid URL for Remote Registry');\n this.code = IaCErrorCodes.InvalidRemoteRegistryURLError;\n this.strCode = getErrorStringCode(this.code);\n this.userMessage = `The provided remote registry URL${\n url ? `: \"${url}\"` : ''\n } is invalid. Please check it again.`;\n }\n}\n\nexport class UnsupportedEntitlementPullError extends CustomError {\n constructor(entitlement: string) {\n super(`OCI Pull not supported - Missing the ${entitlement} entitlement`);\n this.code = IaCErrorCodes.UnsupportedEntitlementPullError;\n this.strCode = getErrorStringCode(this.code);\n this.userMessage = `The custom rules feature is currently not supported for this org. To enable it, please contact snyk support.`;\n }\n}\n"],"names":[],"sourceRoot":""}
|
|
1
|
+
{"version":3,"file":"519.index.js","mappings":";;;;;;;;;;;AAAA,2CAAgF;AAChF,6CAA0D;AAC1D,gDAAgE;AAEhE,6CAAwE;AAExE,SAAgB,eAAe,CAC7B,gBAAmC,EACnC,IAGC;IAED,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,MAAM,2BAA2B,GAAqC,EAAE,CAAC;IACzE,IAAI,0BAA0B,GAAG,CAAC,CAAC;IACnC,MAAM,oBAAoB,GAA2B,EAAE,CAAC;IACxD,MAAM,eAAe,GAAG,KAAK,EAAU,CAAC;IAExC,gBAAgB,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;;QAC/B,gBAAgB;YACd,CAAC,gBAAgB,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC;QAEjE,MAAM,WAAW,GAAG,GAAG,CAAC,cAAc,CAAC;QACvC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClC,oBAAoB,CAAC,WAAW,CAAC,SAAG,oBAAoB,CAAC,WAAW,CAAC,mCAAI;YACvE,KAAK,EAAE,CAAC;SACT,CAAC;QACF,oBAAoB,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAE7C,GAAG,CAAC,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE;YAC/C,oBAAoB,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;gBAChD,CAAC,oBAAoB,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAEhE,IAAI,MAAM,CAAC,uBAAuB,EAAE;gBAClC,0BAA0B,EAAE,CAAC;gBAC7B,2BAA2B,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;aACrD;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,sBAAsB,GAAW,MAAM,CAAC,IAAI,CAChD,2BAA2B,CAC5B,CAAC,MAAM,CAAC;IAET,SAAS,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACtE,SAAS,CAAC,GAAG,CAAC,kBAAkB,EAAE,gBAAgB,CAAC,CAAC;IACpD,SAAS,CAAC,GAAG,CAAC,0BAA0B,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnE,SAAS,CAAC,GAAG,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;IAChD,SAAS,CAAC,GAAG,CAAC,aAAa,EAAE,kCAA0B,CAAC,CAAC;IACzD,SAAS,CAAC,GAAG,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,8DAA8D;IACxH,SAAS,CAAC,GAAG,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAC1D,SAAS,CAAC,GAAG,CACX,wBAAwB,EACxB,IAAI,CAAC,WAAW,KAAK,mBAAW,CAAC,KAAK,CACvC,CAAC;IACF,SAAS,CAAC,GAAG,CACX,yBAAyB,EACzB,IAAI,CAAC,WAAW,KAAK,mBAAW,CAAC,MAAM,CACxC,CAAC;IACF,SAAS,CAAC,GAAG,CAAC,+BAA+B,EAAE,0BAA0B,CAAC,CAAC;IAC3E,SAAS,CAAC,GAAG,CACX,2BAA2B,EAC3B,6CAAgC,EAAE,CACnC,CAAC;IACF,SAAS,CAAC,GAAG,CAAC,iCAAiC,EAAE,sBAAsB,CAAC,CAAC;AAC3E,CAAC;AA5DD,0CA4DC;AAEY,kCAA0B,GAGnC;IACF,CAAC,+BAAuB,CAAC,cAAc,CAAC,EAAE,IAAI;IAC9C,CAAC,+BAAuB,CAAC,WAAW,CAAC,EAAE,IAAI;IAC3C,CAAC,+BAAuB,CAAC,WAAW,CAAC,EAAE,IAAI;IAC3C,CAAC,+BAAuB,CAAC,YAAY,CAAC,EAAE,IAAI;IAC5C,CAAC,+BAAuB,CAAC,WAAW,CAAC,EAAE,IAAI;IAC3C,CAAC,+BAAuB,CAAC,gBAAgB,CAAC,EAAE,IAAI;IAChD,CAAC,+BAAuB,CAAC,gBAAgB,CAAC,EAAE,IAAI;IAChD,CAAC,+BAAuB,CAAC,aAAa,CAAC,EAAE,IAAI;IAC7C,CAAC,+BAAuB,CAAC,YAAY,CAAC,EAAE,IAAI;IAC5C,CAAC,+BAAuB,CAAC,KAAK,CAAC,EAAE,IAAI;CACtC,CAAC;AAEF,SAAgB,oBAAoB,CAClC,QAAuB,EACvB,OAAwB;IAExB,SAAS,CAAC,GAAG,CAAC,oBAAoB,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvD,SAAS,CAAC,GAAG,CAAC,2BAA2B,EAAE,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7E,SAAS,CAAC,GAAG,CAAC,2BAA2B,EAAE,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC7E,SAAS,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACzE,SAAS,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACzE,SAAS,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IACzE,SAAS,CAAC,GAAG,CACX,4BAA4B,EAC5B,QAAQ,CAAC,OAAO,CAAC,sBAAsB,CACxC,CAAC;IACF,SAAS,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;IACjE,SAAS,CAAC,GAAG,CAAC,4BAA4B,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IACvE,SAAS,CAAC,GAAG,CAAC,mBAAmB,EAAE,0BAAe,CAAC,CAAC;IACpD,SAAS,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,aAAa,CAAC,CAAC;IAEjE,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,OAAO,CAAC,cAAc,CAAC,EAAE;QAC3B,KAAK,GAAG,SAAS,CAAC;KACnB;SAAM,IAAI,OAAO,CAAC,gBAAgB,CAAC,EAAE;QACpC,KAAK,GAAG,WAAW,CAAC;KACrB;IACD,SAAS,CAAC,GAAG,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC;AA1BD,oDA0BC;;;;;;;;;;;AC9GD,sCAAyB;AACzB,uCAA2B;AAC3B,wCAA6B;AAC7B,0CAAiC;AACjC,iDAGuB;AACvB,4CAAwD;AACxD,wCAAiC;AACjC,0CAA4B;AAE5B,SAAS,QAAQ,CAAC,CAAS;IACzB,MAAM,UAAU,GAAG,MAAM;SACtB,UAAU,CAAC,MAAM,CAAC;SAClB,MAAM,CAAC,CAAC,CAAC;SACT,MAAM,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAgB,YAAY;IAC1B,oEAAoE;IACpE,MAAM,OAAO,GAAgB,IAAI,CAAC,IAAI,CAAC,qCAAuB,CAAC,CAAC;IAChE,IAAI;QACF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE;YAC3B,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;SACzD;QACD,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;KAC3C;IAAC,MAAM;QACN,MAAM,IAAI,yCAA2B,EAAE,CAAC;KACzC;AACH,CAAC;AAXD,oCAWC;AAED,SAAgB,aAAa,CAAC,QAA+B;IAC3D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ;aACL,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC;aACnB,IAAI,CACH,GAAG,CAAC,CAAC,CAAC;YACJ,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,qCAAuB,CAAC;SACtC,CAAC,CACH;aACA,EAAE,CAAC,QAAQ,EAAE,OAAO,CAAC;aACrB,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAZD,sCAYC;AAED,SAAgB,aAAa,CAAC,QAAgB,EAAE,QAAgB;IAC9D,IAAI;QACF,yEAAyE;QACzE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;KAChE;IAAC,MAAM;QACN,OAAO,KAAK,CAAC;KACd;AACH,CAAC;AAPD,sCAOC;AAED,SAAgB,gCAAgC;IAC9C,IAAI;QACF,MAAM,yBAAyB,GAAG,IAAI,CAAC,IAAI,CACzC,qCAAuB,EACvB,+BAAoB,CACrB,CAAC;QACF,oEAAoE;QACpE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,yBAAyB,CAAC,EAAE;YAC7C,OAAO;SACR;QACD,MAAM,UAAU,GAAG,EAAE,CAAC,YAAY,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAAC;QACtE,OAAO,QAAQ,CAAC,UAAU,CAAC,CAAC;KAC7B;IAAC,OAAO,GAAG,EAAE;QACZ,OAAO;KACR;AACH,CAAC;AAfD,4EAeC;AAED;;;;;GAKG;AACH,6EAA6E;AAC7E,QAAe,CAAC,CAAC,6BAA6B,CAAC,IAAI,GAAG,GAAG,EAAE,QAAiB;IAC1E,QAAQ,CAAC,CAAC,eAAe,CAAC,UAAU,EAAE,YAAY;QAChD;YACE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;SACjC;QACD,IAAI,QAAQ,KAAK,YAAY,EAAE;YAC7B,KAAK,MAAM,MAAM,IAAI,gBAAW,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE;gBACrE,IACE,MAAM,CAAC,WAAW,EAAE;oBACpB,EAAE,CAAC,WAAW,CAAC,WAAI,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAC1D;oBACA,KAAK,CAAC,CAAC,eAAe,CACpB,WAAI,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,EAC7B,YAAY,GAAG,CAAC,CACjB,CAAC;iBACH;qBAAM,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE;oBAC1B,MAAM;wBACJ,IAAI,EAAE;4BACJ,GAAG,EAAE,UAAU;4BACf,QAAQ,EAAE,WAAI,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC;yBACxC;qBACF,CAAC;iBACH;aACF;SACF;IACH,CAAC;IACD,KAAK,CAAC,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAClC,CAAC;AA3BD,sEA2BC;;;;;;;;;;;;AC3GD,wCAA6B;AAC7B,sCAAyB;AACzB,2CAAoD;AACpD,0CAAiC;AACjC,gDAA0E;AAC1E,yCAA+B;AAC/B,4CAAwD;AACxD,6CAA0D;AAC1D,iDAAmD;AACnD,4CAA+C;AAC/C,4CAAmE;AACnE,+CAAiC;AAEjC,MAAM,KAAK,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC;AAEvC,MAAM,SAAS,SAAG,gBAAM,CAAC,UAAU,mCAAI,mBAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC;AAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE;KACvB,QAAQ,CAAC,EAAE,CAAC;KACZ,SAAS,CAAC,CAAC,CAAC,CAAC;AACH,+BAAuB,GAAG,SAAS,GAAG,YAAY,GAAG,IAAI,CAAC;AAEvE,MAAM,kCAAkC,GAAG,IAAI,CAAC,IAAI,CAClD,+BAAuB,EACvB,iBAAiB,CAClB,CAAC;AACF,MAAM,kCAAkC,GAAG,IAAI,CAAC,IAAI,CAClD,+BAAuB,EACvB,eAAe,CAChB,CAAC;AACF,MAAM,iCAAiC,GAAG,IAAI,CAAC,IAAI,CACjD,+BAAuB,EACvB,gBAAgB,CACjB,CAAC;AACF,MAAM,iCAAiC,GAAG,IAAI,CAAC,IAAI,CACjD,+BAAuB,EACvB,cAAc,CACf,CAAC;AACF,MAAM,sCAAsC,GAAG,IAAI,CAAC,IAAI,CACtD,+BAAuB,EACvB,4BAA4B,CAC7B,CAAC;AACF,MAAM,sCAAsC,GAAG,IAAI,CAAC,IAAI,CACtD,+BAAuB,EACvB,0BAA0B,CAC3B,CAAC;AACF,MAAM,2BAA2B,GAAG,IAAI,CAAC,IAAI,CAC3C,+BAAuB,EACvB,iBAAiB,CAClB,CAAC;AACF,MAAM,2BAA2B,GAAG,IAAI,CAAC,IAAI,CAC3C,+BAAuB,EACvB,eAAe,CAChB,CAAC;AAEF,4EAA4E;AAC5E,6DAA6D;AAChD,sCAA8B,GAAG,IAAI,CAAC,IAAI,CACrD,+BAAuB,EACvB,aAAa,CACd,CAAC;AACF,MAAM,8BAA8B,GAAG,IAAI,CAAC,IAAI,CAC9C,+BAAuB,EACvB,WAAW,CACZ,CAAC;AAEF,SAAgB,WAAW,CAAC,KAAY;IACtC,MAAM,IAAI,KAAK,CACb,yCAAyC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CACjE,CAAC;AACJ,CAAC;AAJD,kCAIC;AAED,SAAgB,iBAAiB,CAAC,UAAsB;IACtD,QAAQ,UAAU,EAAE;QAClB,KAAK,kBAAU,CAAC,UAAU;YACxB,OAAO;gBACL,GAAG,kCAAkC,EAAE;gBACvC,GAAG,kCAAkC,EAAE;aACxC,CAAC;QACJ,KAAK,kBAAU,CAAC,SAAS;YACvB,OAAO;gBACL,GAAG,iCAAiC,EAAE;gBACtC,GAAG,iCAAiC,EAAE;aACvC,CAAC;QACJ,KAAK,kBAAU,CAAC,cAAc;YAC5B,OAAO;gBACL,GAAG,sCAAsC,EAAE;gBAC3C,GAAG,sCAAsC,EAAE;aAC5C,CAAC;QACJ,KAAK,kBAAU,CAAC,GAAG;YACjB,OAAO;gBACL,GAAG,2BAA2B,EAAE;gBAChC,GAAG,2BAA2B,EAAE;aACjC,CAAC;QACJ,KAAK,kBAAU,CAAC,MAAM;YACpB,OAAO;gBACL,GAAG,sCAA8B,EAAE;gBACnC,GAAG,8BAA8B,EAAE;aACpC,CAAC;QACJ;YACE,WAAW,CAAC,UAAU,CAAC,CAAC;KAC3B;AACH,CAAC;AA9BD,8CA8BC;AAEM,KAAK,UAAU,cAAc,CAAC,EACnC,eAAe,MACiB,EAAE;IAClC,IAAI;QACF,yBAAY,EAAE,CAAC;KAChB;IAAC,OAAO,CAAC,EAAE;QACV,MAAM,IAAI,2BAA2B,EAAE,CAAC;KACzC;IAED,8DAA8D;IAC9D,IAAI,eAAe,EAAE;QACnB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE;YACnC,MAAM,IAAI,sBAAsB,CAAC,eAAe,CAAC,CAAC;SACnD;QAED,IAAI;YACF,MAAM,QAAQ,GAAG,EAAE,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC;YACtD,MAAM,0BAAa,CAAC,QAAQ,CAAC,CAAC;SAC/B;QAAC,OAAO,CAAC,EAAE;YACV,MAAM,IAAI,+BAA+B,CAAC,eAAe,CAAC,CAAC;SAC5D;QAED,IACE,CAAC,0BAAa,CACZ,sCAA8B,EAC9B,8BAA8B,CAC/B,EACD;YACA,MAAM,IAAI,kBAAkB,CAAC,eAAe,CAAC,CAAC;SAC/C;KACF;IAED,8EAA8E;IAC9E,yCAAyC;IACzC,IAAI,gBAAM,CAAC,eAAe,EAAE;QAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,gBAAgB,CAAC,gBAAM,CAAC,eAAe,CAAC,CAAC;QAC3D,MAAM,0BAAa,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO;KACR;IAED,uEAAuE;IACvE,4CAA4C;IAC5C,IAAI;QACF,MAAM,UAAU,GAAG,+CAA+C,CAAC;QACnE,MAAM,QAAQ,GAAG,MAAM,uBAAa,CAAC;YACnC,MAAM,EAAE,KAAK;YACb,GAAG,EAAE,UAAU;YACf,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC;QACH,MAAM,0BAAa,CAAC,QAAQ,CAAC,CAAC;KAC/B;IAAC,OAAO,CAAC,EAAE;QACV,MAAM,IAAI,0BAA0B,EAAE,CAAC;KACxC;AACH,CAAC;AAtDD,wCAsDC;AAED,SAAgB,eAAe;IAC7B,sCAAsC;IACtC,MAAM,OAAO,GAAgB,IAAI,CAAC,SAAS,CAAC,+BAAuB,CAAC,CAAC;IACrE,IAAI;QACF,kEAAkE;QAClE,wDAAwD;QACxD,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;KACtB;IAAC,OAAO,CAAC,EAAE;QACV,MAAM,GAAG,GAAG,IAAI,4BAA4B,EAAE,CAAC;QAC/C,SAAS,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,KAAK,CAAC,gDAAgD,CAAC,CAAC;KACzD;AACH,CAAC;AAZD,0CAYC;AAED,MAAa,2BAA4B,SAAQ,oBAAW;IAC1D,YAAY,OAAgB;QAC1B,KAAK,CAAC,OAAO,IAAI,kCAAkC,CAAC,CAAC;QACrD,IAAI,CAAC,IAAI,GAAG,qBAAa,CAAC,2BAA2B,CAAC;QACtD,IAAI,CAAC,OAAO,GAAG,gCAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW;YACd,mIAAmI,CAAC;IACxI,CAAC;CACF;AARD,kEAQC;AAED,MAAa,0BAA2B,SAAQ,oBAAW;IACzD,YAAY,OAAgB;QAC1B,KAAK,CAAC,OAAO,IAAI,6BAA6B,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,qBAAa,CAAC,0BAA0B,CAAC;QACrD,IAAI,CAAC,OAAO,GAAG,gCAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW;YACd,4GAA4G,CAAC;IACjH,CAAC;CACF;AARD,gEAQC;AAED,MAAa,+BAAgC,SAAQ,oBAAW;IAC9D,YAAY,IAAY,EAAE,OAAgB;QACxC,KAAK,CAAC,OAAO,IAAI,6BAA6B,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,qBAAa,CAAC,+BAA+B,CAAC;QAC1D,IAAI,CAAC,OAAO,GAAG,gCAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,oDAAoD,IAAI,kHAAkH,CAAC;IAChM,CAAC;CACF;AAPD,0EAOC;AAED,MAAa,kBAAmB,SAAQ,oBAAW;IACjD,YAAY,IAAY,EAAE,OAAgB;QACxC,KAAK,CAAC,OAAO,IAAI,6BAA6B,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,qBAAa,CAAC,kBAAkB,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,gCAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,oDAAoD,IAAI,4HAA4H,CAAC;IAC1M,CAAC;CACF;AAPD,gDAOC;AAED,MAAa,sBAAuB,SAAQ,oBAAW;IACrD,YAAY,IAAY,EAAE,OAAgB;QACxC,KAAK,CAAC,OAAO,IAAI,qCAAqC,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,GAAG,qBAAa,CAAC,sBAAsB,CAAC;QACjD,IAAI,CAAC,OAAO,GAAG,gCAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,oDAAoD,IAAI,kDAAkD,CAAC;IAChI,CAAC;CACF;AAPD,wDAOC;AAED,MAAM,4BAA6B,SAAQ,oBAAW;IACpD,YAAY,OAAgB;QAC1B,KAAK,CAAC,OAAO,IAAI,6BAA6B,CAAC,CAAC;QAChD,IAAI,CAAC,IAAI,GAAG,qBAAa,CAAC,4BAA4B,CAAC;QACvD,IAAI,CAAC,OAAO,GAAG,gCAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC,2BAA2B;IACpD,CAAC;CACF;;;;;;;;;;;ACnOD,wCAAoC;AACpC,wCAA6B;AAC7B,2CAAmE;AACnE,4CAA2D;AAC3D,iDAAoD;AACpD,iDAAyD;AACzD,yCAA+B;AAC/B,gDAA6C;AAE7C,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC;AAEvB,4BAAoB,GAAG,sBAAsB,CAAC;AAE3D,SAAgB,+BAA+B,CAC7C,cAAsB;IAEtB,IAAI;QACF,MAAM,kBAAkB,GAAG,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC;YACvD,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAChC,CAAC,CAAC,cAAc,CAAC;QAEnB,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,CAAC,YAAY,EAAE,WAAW,CAAC,GAAG;YAClC,kBAAkB,CAAC,SAAS,CAAC,CAAC,EAAE,aAAa,CAAC;YAC9C,kBAAkB,CAAC,SAAS,CAAC,aAAa,GAAG,CAAC,CAAC;SAChD,CAAC;QACF,MAAM,CAAC,IAAI,EAAE,GAAG,GAAG,QAAQ,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtD,IAAI,aAAa,KAAK,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,EAAE;YAClE,MAAM,IAAI,6BAA6B,CAAC,cAAc,CAAC,CAAC;SACzD;QACD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;KAClD;IAAC,MAAM;QACN,MAAM,IAAI,6BAA6B,CAAC,cAAc,CAAC,CAAC;KACzD;AACH,CAAC;AArBD,0EAqBC;AAED;;;;;;;;;;IAUI;AACG,KAAK,UAAU,IAAI,CACxB,QAAqB,EACrB,UAAkB,EAClB,GAAW;IAEX,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC9E,IAAI,aAAa,KAAK,CAAC,EAAE;QACvB,MAAM,IAAI,iCAAiC,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC,CAAC;KACvE;IACD,mEAAmE;IACnE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE;QACrB,KAAK,CAAC,4DAA4D,CAAC,CAAC;KACrE;IACD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAEvE,IAAI;QACF,MAAM,YAAY,GAAW,IAAI,CAAC,IAAI,CACpC,qCAAuB,EACvB,4BAAoB,CACrB,CAAC;QACF,yBAAY,EAAE,CAAC;QACf,MAAM,aAAE,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QACvC,OAAO,YAAY,CAAC;KACrB;IAAC,OAAO,GAAG,EAAE;QACZ,MAAM,IAAI,6BAA6B,EAAE,CAAC;KAC3C;AACH,CAAC;AA1BD,oBA0BC;AAED,MAAa,6BAA8B,SAAQ,oBAAW;IAC5D,YAAY,OAAgB;QAC1B,KAAK,CAAC,OAAO,IAAI,8BAA8B,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,qBAAa,CAAC,6BAA6B,CAAC;QACxD,IAAI,CAAC,OAAO,GAAG,gCAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW;YACd,+GAA+G,CAAC;IACpH,CAAC;CACF;AARD,sEAQC;AAED,MAAa,iCAAkC,SAAQ,oBAAW;IAChE,YAAY,OAAgB;QAC1B,KAAK,CAAC,OAAO,IAAI,iCAAiC,CAAC,CAAC;QACpD,IAAI,CAAC,IAAI,GAAG,qBAAa,CAAC,6BAA6B,CAAC;QACxD,IAAI,CAAC,OAAO,GAAG,gCAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,oCAAoC,OAAO,2DAA2D,CAAC;IAC5H,CAAC;CACF;AAPD,8EAOC;AAED,MAAa,6BAA8B,SAAQ,oBAAW;IAC5D,YAAY,GAAY;QACtB,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACzC,IAAI,CAAC,IAAI,GAAG,qBAAa,CAAC,6BAA6B,CAAC;QACxD,IAAI,CAAC,OAAO,GAAG,gCAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,mCACjB,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,EACvB,qCAAqC,CAAC;IACxC,CAAC;CACF;AATD,sEASC;AAED,MAAa,+BAAgC,SAAQ,oBAAW;IAC9D,YAAY,WAAmB;QAC7B,KAAK,CAAC,wCAAwC,WAAW,cAAc,CAAC,CAAC;QACzE,IAAI,CAAC,IAAI,GAAG,qBAAa,CAAC,+BAA+B,CAAC;QAC1D,IAAI,CAAC,OAAO,GAAG,gCAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC,WAAW,GAAG,8GAA8G,CAAC;IACpI,CAAC;CACF;AAPD,0EAOC","sources":["webpack://snyk/./src/cli/commands/test/iac/local-execution/analytics.ts","webpack://snyk/./src/cli/commands/test/iac/local-execution/file-utils.ts","webpack://snyk/./src/cli/commands/test/iac/local-execution/local-cache.ts","webpack://snyk/./src/cli/commands/test/iac/local-execution/rules/oci-pull.ts"],"sourcesContent":["import { FormattedResult, PerformanceAnalyticsKey, RulesOrigin } from './types';\nimport * as analytics from '../../../../../lib/analytics';\nimport { computeCustomRulesBundleChecksum } from './file-utils';\nimport { DescribeOptions, DriftAnalysis } from '../../../../../lib/iac/types';\nimport { driftctlVersion } from '../../../../../lib/iac/drift/driftctl';\n\nexport function addIacAnalytics(\n formattedResults: FormattedResult[],\n opts: {\n ignoredIssuesCount: number;\n rulesOrigin: RulesOrigin;\n },\n): void {\n let totalIssuesCount = 0;\n const customRulesIdsFoundInIssues: { [customRuleId: string]: true } = {};\n let issuesFromCustomRulesCount = 0;\n const projectTypeAnalytics: Record<string, object> = {};\n const packageManagers = Array<string>();\n\n formattedResults.forEach((res) => {\n totalIssuesCount =\n (totalIssuesCount || 0) + res.result.cloudConfigResults.length;\n\n const projectType = res.packageManager;\n packageManagers.push(projectType);\n projectTypeAnalytics[projectType] = projectTypeAnalytics[projectType] ?? {\n count: 0,\n };\n projectTypeAnalytics[projectType]['count']++;\n\n res.result.cloudConfigResults.forEach((policy) => {\n projectTypeAnalytics[projectType][policy.severity] =\n (projectTypeAnalytics[projectType][policy.severity] || 0) + 1;\n\n if (policy.isGeneratedByCustomRule) {\n issuesFromCustomRulesCount++;\n customRulesIdsFoundInIssues[policy.publicId] = true;\n }\n });\n });\n\n const uniqueCustomRulesCount: number = Object.keys(\n customRulesIdsFoundInIssues,\n ).length;\n\n analytics.add('packageManager', Array.from(new Set(packageManagers)));\n analytics.add('iac-issues-count', totalIssuesCount);\n analytics.add('iac-ignored-issues-count', opts.ignoredIssuesCount);\n analytics.add('iac-type', projectTypeAnalytics);\n analytics.add('iac-metrics', performanceAnalyticsObject);\n analytics.add('iac-test-count', formattedResults.length); // TODO: remove this once we all analytics use iac-files-count\n analytics.add('iac-files-count', formattedResults.length);\n analytics.add(\n 'iac-local-custom-rules',\n opts.rulesOrigin === RulesOrigin.Local,\n );\n analytics.add(\n 'iac-remote-custom-rules',\n opts.rulesOrigin === RulesOrigin.Remote,\n );\n analytics.add('iac-custom-rules-issues-count', issuesFromCustomRulesCount);\n analytics.add(\n 'iac-custom-rules-checksum',\n computeCustomRulesBundleChecksum(),\n );\n analytics.add('iac-custom-rules-coverage-count', uniqueCustomRulesCount);\n}\n\nexport const performanceAnalyticsObject: Record<\n PerformanceAnalyticsKey,\n number | null\n> = {\n [PerformanceAnalyticsKey.InitLocalCache]: null,\n [PerformanceAnalyticsKey.FileLoading]: null,\n [PerformanceAnalyticsKey.FileParsing]: null,\n [PerformanceAnalyticsKey.FileScanning]: null,\n [PerformanceAnalyticsKey.OrgSettings]: null,\n [PerformanceAnalyticsKey.CustomSeverities]: null,\n [PerformanceAnalyticsKey.ResultFormatting]: null,\n [PerformanceAnalyticsKey.UsageTracking]: null,\n [PerformanceAnalyticsKey.CacheCleanup]: null,\n [PerformanceAnalyticsKey.Total]: null,\n};\n\nexport function addIacDriftAnalytics(\n analysis: DriftAnalysis,\n options: DescribeOptions,\n): void {\n analytics.add('iac-drift-coverage', analysis.coverage);\n analytics.add('iac-drift-total-resources', analysis.summary.total_resources);\n analytics.add('iac-drift-total-unmanaged', analysis.summary.total_unmanaged);\n analytics.add('iac-drift-total-managed', analysis.summary.total_managed);\n analytics.add('iac-drift-total-missing', analysis.summary.total_missing);\n analytics.add('iac-drift-total-changed', analysis.summary.total_changed);\n analytics.add(\n 'iac-drift-iac-source-count',\n analysis.summary.total_iac_source_count,\n );\n analytics.add('iac-drift-provider-name', analysis.provider_name);\n analytics.add('iac-drift-provider-version', analysis.provider_version);\n analytics.add('iac-drift-version', driftctlVersion);\n analytics.add('iac-drift-scan-duration', analysis.scan_duration);\n\n let scope = 'all';\n if (options['only-managed']) {\n scope = 'managed';\n } else if (options['only-unmanaged']) {\n scope = 'unmanaged';\n }\n analytics.add('iac-drift-scan-scope', scope);\n}\n","import * as fs from 'fs';\nimport * as tar from 'tar';\nimport * as path from 'path';\nimport * as crypto from 'crypto';\nimport {\n FailedToInitLocalCacheError,\n LOCAL_POLICY_ENGINE_DIR,\n} from './local-cache';\nimport { CUSTOM_RULES_TARBALL } from './rules/oci-pull';\nimport { readdirSync } from 'fs';\nimport { join } from 'path';\n\nfunction hashData(s: string): string {\n const hashedData = crypto\n .createHash('sha1')\n .update(s)\n .digest('hex');\n return hashedData;\n}\n\nexport function createIacDir(): void {\n // this path will be able to be customised by the user in the future\n const iacPath: fs.PathLike = path.join(LOCAL_POLICY_ENGINE_DIR);\n try {\n if (!fs.existsSync(iacPath)) {\n fs.mkdirSync(iacPath, { recursive: true, mode: 0o700 });\n }\n fs.accessSync(iacPath, fs.constants.W_OK);\n } catch {\n throw new FailedToInitLocalCacheError();\n }\n}\n\nexport function extractBundle(response: NodeJS.ReadableStream): Promise<void> {\n return new Promise((resolve, reject) => {\n response\n .on('error', reject)\n .pipe(\n tar.x({\n C: path.join(LOCAL_POLICY_ENGINE_DIR),\n }),\n )\n .on('finish', resolve)\n .on('error', reject);\n });\n}\n\nexport function isValidBundle(wasmPath: string, dataPath: string): boolean {\n try {\n // verify that the correct files were generated, since this is user input\n return !(!fs.existsSync(wasmPath) || !fs.existsSync(dataPath));\n } catch {\n return false;\n }\n}\n\nexport function computeCustomRulesBundleChecksum(): string | undefined {\n try {\n const customRulesPolicyWasmPath = path.join(\n LOCAL_POLICY_ENGINE_DIR,\n CUSTOM_RULES_TARBALL,\n );\n // if bundle is not configured we don't want to include the checksum\n if (!fs.existsSync(customRulesPolicyWasmPath)) {\n return;\n }\n const policyWasm = fs.readFileSync(customRulesPolicyWasmPath, 'utf8');\n return hashData(policyWasm);\n } catch (err) {\n return;\n }\n}\n\n/**\n * makeFileAndDirectoryGenerator is a generator function that helps walking the directory and file structure of this pathToScan\n * @param root\n * @param maxDepth? - An optional `maxDepth` argument can be provided to limit how deep in the file tree the search will go.\n * @returns {Generator<object>} - a generator which yields an object with directories or paths for the path to scan\n */\n// eslint-disable-next-line @typescript-eslint/explicit-module-boundary-types\nexport function* makeFileAndDirectoryGenerator(root = '.', maxDepth?: number) {\n function* generatorHelper(pathToScan, currentDepth) {\n {\n yield { directory: pathToScan };\n }\n if (maxDepth !== currentDepth) {\n for (const dirent of readdirSync(pathToScan, { withFileTypes: true })) {\n if (\n dirent.isDirectory() &&\n fs.readdirSync(join(pathToScan, dirent.name)).length !== 0\n ) {\n yield* generatorHelper(\n join(pathToScan, dirent.name),\n currentDepth + 1,\n );\n } else if (dirent.isFile()) {\n yield {\n file: {\n dir: pathToScan,\n fileName: join(pathToScan, dirent.name),\n },\n };\n }\n }\n }\n }\n yield* generatorHelper(root, 0);\n}\n","import * as path from 'path';\nimport * as fs from 'fs';\nimport { EngineType, IaCErrorCodes } from './types';\nimport * as rimraf from 'rimraf';\nimport { createIacDir, extractBundle, isValidBundle } from './file-utils';\nimport * as Debug from 'debug';\nimport { CustomError } from '../../../../../lib/errors';\nimport * as analytics from '../../../../../lib/analytics';\nimport { getErrorStringCode } from './error-utils';\nimport config from '../../../../../lib/config';\nimport { streamRequest } from '../../../../../lib/request/request';\nimport envPaths from 'env-paths';\n\nconst debug = Debug('iac-local-cache');\n\nconst cachePath = config.CACHE_PATH ?? envPaths('snyk').cache;\nconst uuid = Math.random()\n .toString(36)\n .substring(2);\nexport const LOCAL_POLICY_ENGINE_DIR = cachePath + '/iac-data/' + uuid;\n\nconst KUBERNETES_POLICY_ENGINE_WASM_PATH = path.join(\n LOCAL_POLICY_ENGINE_DIR,\n 'k8s_policy.wasm',\n);\nconst KUBERNETES_POLICY_ENGINE_DATA_PATH = path.join(\n LOCAL_POLICY_ENGINE_DIR,\n 'k8s_data.json',\n);\nconst TERRAFORM_POLICY_ENGINE_WASM_PATH = path.join(\n LOCAL_POLICY_ENGINE_DIR,\n 'tf_policy.wasm',\n);\nconst TERRAFORM_POLICY_ENGINE_DATA_PATH = path.join(\n LOCAL_POLICY_ENGINE_DIR,\n 'tf_data.json',\n);\nconst CLOUDFORMATION_POLICY_ENGINE_WASM_PATH = path.join(\n LOCAL_POLICY_ENGINE_DIR,\n 'cloudformation_policy.wasm',\n);\nconst CLOUDFORMATION_POLICY_ENGINE_DATA_PATH = path.join(\n LOCAL_POLICY_ENGINE_DIR,\n 'cloudformation_data.json',\n);\nconst ARM_POLICY_ENGINE_WASM_PATH = path.join(\n LOCAL_POLICY_ENGINE_DIR,\n 'arm_policy.wasm',\n);\nconst ARM_POLICY_ENGINE_DATA_PATH = path.join(\n LOCAL_POLICY_ENGINE_DIR,\n 'arm_data.json',\n);\n\n// NOTE: The filenames used for the custom policy bundles match those output\n// by the `opa` CLI tool, which is why they are very generic.\nexport const CUSTOM_POLICY_ENGINE_WASM_PATH = path.join(\n LOCAL_POLICY_ENGINE_DIR,\n 'policy.wasm',\n);\nconst CUSTOM_POLICY_ENGINE_DATA_PATH = path.join(\n LOCAL_POLICY_ENGINE_DIR,\n 'data.json',\n);\n\nexport function assertNever(value: never): never {\n throw new Error(\n `Unhandled discriminated union member: ${JSON.stringify(value)}`,\n );\n}\n\nexport function getLocalCachePath(engineType: EngineType): string[] {\n switch (engineType) {\n case EngineType.Kubernetes:\n return [\n `${KUBERNETES_POLICY_ENGINE_WASM_PATH}`,\n `${KUBERNETES_POLICY_ENGINE_DATA_PATH}`,\n ];\n case EngineType.Terraform:\n return [\n `${TERRAFORM_POLICY_ENGINE_WASM_PATH}`,\n `${TERRAFORM_POLICY_ENGINE_DATA_PATH}`,\n ];\n case EngineType.CloudFormation:\n return [\n `${CLOUDFORMATION_POLICY_ENGINE_WASM_PATH}`,\n `${CLOUDFORMATION_POLICY_ENGINE_DATA_PATH}`,\n ];\n case EngineType.ARM:\n return [\n `${ARM_POLICY_ENGINE_WASM_PATH}`,\n `${ARM_POLICY_ENGINE_DATA_PATH}`,\n ];\n case EngineType.Custom:\n return [\n `${CUSTOM_POLICY_ENGINE_WASM_PATH}`,\n `${CUSTOM_POLICY_ENGINE_DATA_PATH}`,\n ];\n default:\n assertNever(engineType);\n }\n}\n\nexport async function initLocalCache({\n customRulesPath,\n}: { customRulesPath?: string } = {}): Promise<void> {\n try {\n createIacDir();\n } catch (e) {\n throw new FailedToInitLocalCacheError();\n }\n\n // Attempt to extract the custom rules from the path provided.\n if (customRulesPath) {\n if (!fs.existsSync(customRulesPath)) {\n throw new InvalidCustomRulesPath(customRulesPath);\n }\n\n try {\n const response = fs.createReadStream(customRulesPath);\n await extractBundle(response);\n } catch (e) {\n throw new FailedToExtractCustomRulesError(customRulesPath);\n }\n\n if (\n !isValidBundle(\n CUSTOM_POLICY_ENGINE_WASM_PATH,\n CUSTOM_POLICY_ENGINE_DATA_PATH,\n )\n ) {\n throw new InvalidCustomRules(customRulesPath);\n }\n }\n\n // IAC_BUNDLE_PATH is a developer setting that is not useful to most users. It\n // is not a replacement for custom rules.\n if (config.IAC_BUNDLE_PATH) {\n const stream = fs.createReadStream(config.IAC_BUNDLE_PATH);\n await extractBundle(stream);\n return;\n }\n\n // We extract the Snyk rules after the custom rules to ensure our files\n // always overwrite whatever might be there.\n try {\n const BUNDLE_URL = 'https://static.snyk.io/cli/wasm/bundle.tar.gz';\n const response = await streamRequest({\n method: 'get',\n url: BUNDLE_URL,\n body: null,\n headers: {},\n });\n await extractBundle(response);\n } catch (e) {\n throw new FailedToDownloadRulesError();\n }\n}\n\nexport function cleanLocalCache() {\n // path to delete is hardcoded for now\n const iacPath: fs.PathLike = path.normalize(LOCAL_POLICY_ENGINE_DIR);\n try {\n // when we support Node version >= 12.10.0 , we can replace rimraf\n // with the native fs.rmdirSync(path, {recursive: true})\n rimraf.sync(iacPath);\n } catch (e) {\n const err = new FailedToCleanLocalCacheError();\n analytics.add('error-code', err.code);\n debug('The local cache directory could not be deleted');\n }\n}\n\nexport class FailedToInitLocalCacheError extends CustomError {\n constructor(message?: string) {\n super(message || 'Failed to initialize local cache');\n this.code = IaCErrorCodes.FailedToInitLocalCacheError;\n this.strCode = getErrorStringCode(this.code);\n this.userMessage =\n 'We were unable to create a local directory to store the test assets, please ensure that the current working directory is writable';\n }\n}\n\nexport class FailedToDownloadRulesError extends CustomError {\n constructor(message?: string) {\n super(message || 'Failed to download policies');\n this.code = IaCErrorCodes.FailedToDownloadRulesError;\n this.strCode = getErrorStringCode(this.code);\n this.userMessage =\n 'We were unable to download the security rules, please ensure the network can access https://static.snyk.io';\n }\n}\n\nexport class FailedToExtractCustomRulesError extends CustomError {\n constructor(path: string, message?: string) {\n super(message || 'Failed to download policies');\n this.code = IaCErrorCodes.FailedToExtractCustomRulesError;\n this.strCode = getErrorStringCode(this.code);\n this.userMessage = `We were unable to extract the rules provided at: ${path}. The provided bundle may be corrupted or invalid. Please ensure it was generated using the 'snyk-iac-rules' SDK`;\n }\n}\n\nexport class InvalidCustomRules extends CustomError {\n constructor(path: string, message?: string) {\n super(message || 'Invalid custom rules bundle');\n this.code = IaCErrorCodes.InvalidCustomRules;\n this.strCode = getErrorStringCode(this.code);\n this.userMessage = `We were unable to extract the rules provided at: ${path}. The provided bundle does not match the required structure. Please ensure it was generated using the 'snyk-iac-rules' SDK`;\n }\n}\n\nexport class InvalidCustomRulesPath extends CustomError {\n constructor(path: string, message?: string) {\n super(message || 'Invalid path to custom rules bundle');\n this.code = IaCErrorCodes.InvalidCustomRulesPath;\n this.strCode = getErrorStringCode(this.code);\n this.userMessage = `We were unable to extract the rules provided at: ${path}. The bundle at the provided path does not exist`;\n }\n}\n\nclass FailedToCleanLocalCacheError extends CustomError {\n constructor(message?: string) {\n super(message || 'Failed to clean local cache');\n this.code = IaCErrorCodes.FailedToCleanLocalCacheError;\n this.strCode = getErrorStringCode(this.code);\n this.userMessage = ''; // Not a user facing error.\n }\n}\n","import { promises as fs } from 'fs';\nimport * as path from 'path';\nimport { IaCErrorCodes, OCIRegistryURLComponents } from '../types';\nimport { CustomError } from '../../../../../../lib/errors';\nimport { getErrorStringCode } from '../error-utils';\nimport { LOCAL_POLICY_ENGINE_DIR } from '../local-cache';\nimport * as Debug from 'debug';\nimport { createIacDir } from '../file-utils';\nimport { OciRegistry } from './oci-registry';\nconst debug = Debug('iac-oci-pull');\n\nexport const CUSTOM_RULES_TARBALL = 'custom-bundle.tar.gz';\n\nexport function extractOCIRegistryURLComponents(\n OCIRegistryURL: string,\n): OCIRegistryURLComponents {\n try {\n const urlWithoutProtocol = OCIRegistryURL.includes('://')\n ? OCIRegistryURL.split('://')[1]\n : OCIRegistryURL;\n\n const firstSlashIdx = urlWithoutProtocol.indexOf('/');\n const [registryHost, repoWithTag] = [\n urlWithoutProtocol.substring(0, firstSlashIdx),\n urlWithoutProtocol.substring(firstSlashIdx + 1),\n ];\n const [repo, tag = 'latest'] = repoWithTag.split(':');\n if (firstSlashIdx === -1 || !registryHost || !repoWithTag || !repo) {\n throw new InvalidRemoteRegistryURLError(OCIRegistryURL);\n }\n return { registryBase: registryHost, repo, tag };\n } catch {\n throw new InvalidRemoteRegistryURLError(OCIRegistryURL);\n }\n}\n\n/**\n * Downloads an OCI Artifact from a remote OCI Registry and writes it to the\n * disk. The artifact here is a custom rules bundle stored in a remote registry.\n * In order to do that, it calls an external docker registry v2 client to get\n * the manifests, the layers and then builds the artifact. Example:\n * https://github.com/opencontainers/image-spec/blob/main/manifest.md#example-image-manifest\n *\n * @param registry The client for accessing an OCI registry.\n * @param repository The name of an OCI repository.\n * @param tag The tag of an image in an OCI repository.\n **/\nexport async function pull(\n registry: OciRegistry,\n repository: string,\n tag: string,\n): Promise<string> {\n const { schemaVersion, layers } = await registry.getManifest(repository, tag);\n if (schemaVersion !== 2) {\n throw new InvalidManifestSchemaVersionError(schemaVersion.toString());\n }\n // We assume that we will always have an artifact of a single layer\n if (layers.length > 1) {\n debug('There were more than one layers found in the OCI Artifact.');\n }\n const { blob } = await registry.getLayer(repository, layers[0].digest);\n\n try {\n const downloadPath: string = path.join(\n LOCAL_POLICY_ENGINE_DIR,\n CUSTOM_RULES_TARBALL,\n );\n createIacDir();\n await fs.writeFile(downloadPath, blob);\n return downloadPath;\n } catch (err) {\n throw new FailedToBuildOCIArtifactError();\n }\n}\n\nexport class FailedToBuildOCIArtifactError extends CustomError {\n constructor(message?: string) {\n super(message || 'Could not build OCI Artifact');\n this.code = IaCErrorCodes.FailedToBuildOCIArtifactError;\n this.strCode = getErrorStringCode(this.code);\n this.userMessage =\n 'We were unable to build the remote OCI Artifact locally, please ensure that the local directory is writeable.';\n }\n}\n\nexport class InvalidManifestSchemaVersionError extends CustomError {\n constructor(message?: string) {\n super(message || 'Invalid manifest schema version');\n this.code = IaCErrorCodes.InvalidRemoteRegistryURLError;\n this.strCode = getErrorStringCode(this.code);\n this.userMessage = `Invalid manifest schema version: ${message}. We currently support Image Manifest Version 2, Schema 2`;\n }\n}\n\nexport class InvalidRemoteRegistryURLError extends CustomError {\n constructor(url?: string) {\n super('Invalid URL for Remote Registry');\n this.code = IaCErrorCodes.InvalidRemoteRegistryURLError;\n this.strCode = getErrorStringCode(this.code);\n this.userMessage = `The provided remote registry URL${\n url ? `: \"${url}\"` : ''\n } is invalid. Please check it again.`;\n }\n}\n\nexport class UnsupportedEntitlementPullError extends CustomError {\n constructor(entitlement: string) {\n super(`OCI Pull not supported - Missing the ${entitlement} entitlement`);\n this.code = IaCErrorCodes.UnsupportedEntitlementPullError;\n this.strCode = getErrorStringCode(this.code);\n this.userMessage = `The custom rules feature is currently not supported for this org. To enable it, please contact snyk support.`;\n }\n}\n"],"names":[],"sourceRoot":""}
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import { EngineType } from './types';
|
|
2
2
|
import { CustomError } from '../../../../../lib/errors';
|
|
3
|
-
export declare const LOCAL_POLICY_ENGINE_DIR
|
|
3
|
+
export declare const LOCAL_POLICY_ENGINE_DIR: string;
|
|
4
4
|
export declare const CUSTOM_POLICY_ENGINE_WASM_PATH: string;
|
|
5
5
|
export declare function assertNever(value: never): never;
|
|
6
6
|
export declare function getLocalCachePath(engineType: EngineType): string[];
|