snyk 1.914.0 → 1.915.0

package/README.md

@@ -61,7 +61,7 @@ Use [GitHub Releases](https://github.com/snyk/snyk/releases) to download a stand
 
 We also provide these standalone executables on our official CDN. See [the `release.json` file](https://static.snyk.io/cli/latest/release.json) for the download links:
 
-```http
+```text
 https://static.snyk.io/cli/latest/release.json
 
 # Or for specific version or platform
@@ -87,6 +87,44 @@ You can also use these direct links to download the executables:
 
 Drawback of this method is, that you will have to manually keep the Snyk CLI up to date.
 
+#### Verifying standalone binaries
+
+You can verify both shasum of downloaded binaries and their GPG signatures.
+
+Download location on `static.snyk.io` contains a file called `sha256sums.txt.asc`.
+You can download it directly `https://static.snyk.io/cli/latest/sha256sums.txt.asc` or for a specific version like `https://static.snyk.io/cli/v1.666.0/sha256sums.txt.asc`.
+
+To check that a downloaded file matches the checksum, use a `sha256sum` command like so:
+
+```bash
+grep snyk-macos sha256sums.txt.asc | sha256sum -c -
+```
+
+If you want to verify Snyk CLI standalone binaries against [Snyk CLI GPG key](help/_about-this-project/snyk-code-signing-public.pgp), you will need to import it first:
+
+```bash
+# 68BFBCCEB7794E6FC06A2044A29C32E91F4B9569 is the key belonging to code-signing@snyk.io
+# Copy of this public key is also in this repository /help/_about-this-project/snyk-code-signing-public.pgp
+gpg --keyserver hkps://keys.openpgp.org --recv-keys 68BFBCCEB7794E6FC06A2044A29C32E91F4B9569
+```
+
+Then verify the file is signed with:
+
+```bash
+gpg --verify sha256sums.txt.asc
+```
+
+Command output should look like:
+
+```plain
+gpg: Signature made Mon Apr 25 16:55:01 2022 CEST
+gpg:                using RSA key 68BFBCCEB7794E6FC06A2044A29C32E91F4B9569
+gpg: Good signature from "Snyk Limited <code-signing@snyk.io>" [unknown]
+gpg: WARNING: This key is not certified with a trusted signature!
+gpg:          There is no indication that the signature belongs to the owner.
+Primary key fingerprint: 68BF BCCE B779 4E6F C06A  2044 A29C 32E9 1F4B 9569
+```
+
 </details>
 
 <details>

package/config.default.json

@@ -4,7 +4,6 @@
   "devDeps": false,
   "PRUNE_DEPS_THRESHOLD": 40000,
   "MAX_PATH_COUNT": 1500000,
-  "CODE_CLIENT_PROXY_URL": "https://deeproxy.snyk.io",
   "NPM_TREE_SIZE_LIMIT": 6.0e6,
   "YARN_TREE_SIZE_LIMIT": 6.0e6
 }

package/dist/cli/784.index.js

@@ -491,6 +491,23 @@ class JsonTestCommandResult extends TestCommandResult {
 }
 
 
+/***/ }),
+
+/***/ 55203:
+/***/ ((__unused_webpack_module, exports, __webpack_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.getCodeClientProxyUrl = void 0;
+const config_1 = __webpack_require__(22541);
+function getCodeClientProxyUrl() {
+    return (config_1.default.CODE_CLIENT_PROXY_URL ||
+        config_1.default.API.replace(/snyk\.io.*/, 'snyk.io').replace(/\/\/(app\.)?/, '//deeproxy.'));
+}
+exports.getCodeClientProxyUrl = getCodeClientProxyUrl;
+
+
 /***/ }),
 
 /***/ 65623:
@@ -4951,6 +4968,7 @@ const proxy_from_env_1 = __webpack_require__(21394);
 const global_agent_1 = __webpack_require__(97959);
 const chalk_1 = __webpack_require__(32589);
 const debugLib = __webpack_require__(15158);
+const code_config_1 = __webpack_require__(55203);
 const debug = debugLib('snyk-code');
 async function getCodeAnalysisAndParseResults(root, options, sastSettings, requestId) {
     await spinner_1.spinner.clearAll();
@@ -4969,7 +4987,7 @@ async function getCodeAnalysis(root, options, sastSettings, requestId) {
     const source = 'snyk-cli';
     const baseURL = isLocalCodeEngineEnabled
         ? sastSettings.localCodeEngine.url
-        : config_1.default.CODE_CLIENT_PROXY_URL;
+        : code_config_1.getCodeClientProxyUrl();
     // TODO(james) This mirrors the implementation in request.ts and we need to use this for deeproxy calls
     // This ensures we support lowercase http(s)_proxy values as well
     // The weird IF around it ensures we don't create an envvar with