cloudg 0.4.0__tar.gz → 0.4.1__tar.gz

{cloudg-0.4.0 → cloudg-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cloudg
-Version: 0.4.0
+Version: 0.4.1
 Summary: cloudg (cloud graphing) — multi-cloud infrastructure mapping, knowledge graphs and security intelligence for AWS, Azure and GCP
 Project-URL: Homepage, https://github.com/morpheuslord/cloudg
 Project-URL: Repository, https://github.com/morpheuslord/cloudg

{cloudg-0.4.0 → cloudg-0.4.1}/README.md

@@ -5,7 +5,7 @@
 <p align="center">
   <a href="LICENSE"><img src="https://img.shields.io/badge/license-MIT-green.svg" alt="License: MIT"></a>
   <img src="https://img.shields.io/badge/python-3.11%2B-blue.svg" alt="Python 3.11+">
-  <img src="https://img.shields.io/badge/version-0.4.0-4c1.svg" alt="Version 0.4.0">
+  <img src="https://img.shields.io/badge/version-0.4.1-4c1.svg" alt="Version 0.4.1">
   <a href="https://github.com/astral-sh/uv"><img src="https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/uv/main/assets/badge/v0.json" alt="uv"></a>
 </p>
 

{cloudg-0.4.0 → cloudg-0.4.1}/cloudg/__init__.py

@@ -1,6 +1,6 @@
 """cloudg — cloud graphing: multi-cloud mapping and security intelligence."""
 
-__version__ = "0.4.0"
+__version__ = "0.4.1"
 
 from cloudg.api import (
     AnalysisResult,

{cloudg-0.4.0 → cloudg-0.4.1}/cloudg/api.py

@@ -212,14 +212,14 @@ class CloudGEngine:
             try:
                 self.on_phase_start(phase)
             except Exception:
-                pass
+                logger.debug("Event hook raised; ignoring", exc_info=True)
 
     def _emit_error(self, phase: str, exc: Exception) -> None:
         if self.on_error:
             try:
                 self.on_error(phase, exc)
             except Exception:
-                pass
+                logger.debug("Event hook raised; ignoring", exc_info=True)
 
     # ------------------------------------------------------------------
     # Phase 1: Collection
@@ -258,7 +258,7 @@ class CloudGEngine:
             try:
                 self.on_collection_complete(result)
             except Exception:
-                pass
+                logger.debug("Event hook raised; ignoring", exc_info=True)
 
         return result
 
@@ -449,13 +449,13 @@ class CloudGEngine:
                 try:
                     self.on_finding(f)
                 except Exception:
-                    pass
+                    logger.debug("Event hook raised; ignoring", exc_info=True)
 
         if self.on_scan_complete:
             try:
                 self.on_scan_complete(all_findings)
             except Exception:
-                pass
+                logger.debug("Event hook raised; ignoring", exc_info=True)
 
         return all_findings
 
@@ -488,12 +488,12 @@ class CloudGEngine:
                 try:
                     self.on_finding(f)
                 except Exception:
-                    pass
+                    logger.debug("Event hook raised; ignoring", exc_info=True)
         if self.on_scan_complete:
             try:
                 self.on_scan_complete(findings)
             except Exception:
-                pass
+                logger.debug("Event hook raised; ignoring", exc_info=True)
         return findings
 
     def normalise_findings(
@@ -620,7 +620,7 @@ class CloudGEngine:
             try:
                 result.attack_paths = builder.find_lateral_movement_paths()
             except Exception:
-                pass
+                logger.debug("Event hook raised; ignoring", exc_info=True)
         except Exception as exc:
             logger.error("Graph build failed: %s", exc)
             self._emit_error("graph_build", exc)
@@ -673,7 +673,7 @@ class CloudGEngine:
             try:
                 self.on_analysis_complete(result)
             except Exception:
-                pass
+                logger.debug("Event hook raised; ignoring", exc_info=True)
 
         return result
 

{cloudg-0.4.0 → cloudg-0.4.1}/cloudg/cli.py

@@ -18,6 +18,8 @@ from rich.logging import RichHandler
 from cloudg import __version__, ui
 from cloudg.ui import console
 
+logger = logging.getLogger(__name__)
+
 # Global config reference (set by CLI group)
 _config = None
 
@@ -1054,7 +1056,8 @@ def run(
                 output_dir=output_dir,
             )
         except Exception:
-            pass  # RAG already ran in Phase 2c, this is an update pass
+            # RAG already ran in Phase 2c, this is an update pass
+            logger.debug("RAG update pass failed; keeping Phase 2c export", exc_info=True)
 
     # Phase 4: Normalise (with external rulesets)
     ui.phase("Phase 4 · Normalisation")

{cloudg-0.4.0 → cloudg-0.4.1}/cloudg/collectors/aws.py

@@ -149,7 +149,7 @@ class AsyncAWSCollector(BaseCollector):
                         acl = await s3.get_bucket_acl(Bucket=bucket_name)
                         metadata["acl_grants"] = len(acl.get("Grants", []))
                     except Exception:
-                        pass
+                        logger.debug("No ACL read access for bucket %s", bucket_name)
                     try:
                         pub = await s3.get_public_access_block(Bucket=bucket_name)
                         metadata["public_access_block"] = pub.get(
@@ -612,7 +612,7 @@ class AsyncAWSCollector(BaseCollector):
                 duration_ms=int((time.time() - start) * 1000),
             )
         except Exception as exc:
-            logger.error("Failed to collect Secrets Manager secrets: %s", exc)
+            logger.error("Secrets Manager collection failed: %s", exc)
             self.coverage.record("secretsmanager", ServiceStatus.FAILED, error=str(exc))
         return assets
 

{cloudg-0.4.0 → cloudg-0.4.1}/cloudg/collectors/azure.py

@@ -259,6 +259,7 @@ class AzureCollector(BaseCollector):
                                 )
                             )
                 except Exception:
+                    logger.debug("Skipping SQL server in %s", rg.name, exc_info=True)
                     continue
         except ImportError:
             logger.warning("azure-mgmt-sql not installed, skipping SQL collection")

{cloudg-0.4.0 → cloudg-0.4.1}/cloudg/credentials.py

@@ -148,7 +148,7 @@ def build_aws_session(
         session = boto3.Session(**session_kwargs)
     else:
         # 4. Default chain: env vars, instance/task role, SSO cache
-        logger.info("AWS auth: default credential chain (region %s)", region)
+        logger.info("AWS auth: default provider chain (region %s)", region)
         session = boto3.Session(**session_kwargs)
 
     # 5. Optional role assumption on top of the base credentials
@@ -222,7 +222,7 @@ def build_azure_credential(cfg: Any) -> Any:
 
     # 2. Service principal with secret
     if tenant_id and client_id and client_secret:
-        logger.info("Azure auth: service principal secret (client %s)", client_id)
+        logger.info("Azure auth: service principal (client %s)", client_id)
         return identity.ClientSecretCredential(
             tenant_id=tenant_id,
             client_id=client_id,
@@ -283,7 +283,7 @@ def build_gcp_credentials(cfg: Any) -> tuple[Any, str | None]:
     if credentials_file and getattr(cfg, "credentials_file", None):
         # 1. Explicit file: service account key OR workload identity
         #    federation (external_account) config — load handles both.
-        logger.info("GCP auth: credentials file %s", credentials_file)
+        logger.info("GCP auth: file-based identity (%s)", credentials_file)
         credentials, project = google.auth.load_credentials_from_file(
             credentials_file, scopes=_GCP_SCOPES
         )
@@ -362,7 +362,7 @@ class CredentialResolver:
         try:
             identity = session.client("sts").get_caller_identity()
             account_id = identity.get("Account")
-            logger.info("AWS credentials resolved for account %s", account_id)
+            logger.info("AWS identity resolved: account %s", account_id)
         except Exception:
             logger.warning("Could not resolve AWS account ID via STS")
 
@@ -403,7 +403,7 @@ class CredentialResolver:
             from types import SimpleNamespace
 
             credential = build_azure_credential(SimpleNamespace(tenant_id=tenant_id))
-        logger.info("Azure credentials resolved for subscription %s", subscription_id)
+        logger.info("Azure identity resolved: subscription %s", subscription_id)
 
         return AzureCredentials(
             credential=credential,
@@ -446,6 +446,6 @@ class CredentialResolver:
                 "GCP project ID is required. Set GOOGLE_CLOUD_PROJECT env var or pass project_id."
             )
 
-        logger.info("GCP credentials resolved for project %s", project_id)
+        logger.info("GCP identity resolved: project %s", project_id)
 
         return GCPCredentials(credentials=credentials, project_id=project_id)

{cloudg-0.4.0 → cloudg-0.4.1}/cloudg/graph/ontology.py

@@ -111,7 +111,7 @@ class RelationType(str, Enum):
     PROTECTED_BY_NACL = "PROTECTED_BY_NACL"
     PROTECTED_BY_WAF = "PROTECTED_BY_WAF"
     ENCRYPTED_BY_KMS = "ENCRYPTED_BY_KMS"
-    ROTATES_SECRET = "ROTATES_SECRET"
+    ROTATES_SECRET = "ROTATES_SECRET"  # nosec B105 - ontology relation name, not a credential
     CERTIFICATE_SECURES = "CERTIFICATE_SECURES"
     FINDING_AFFECTS = "FINDING_AFFECTS"
     VULNERABILITY_EXPLOITS = "VULNERABILITY_EXPLOITS"
@@ -580,7 +580,7 @@ class CloudOntology:
             "IAMRole": "CloudResource",
             "IAMPolicy": "CloudResource",
             "EncryptionKey": "CloudResource",
-            "Secret": "CloudResource",
+            "Secret": "CloudResource",  # nosec B105 - class hierarchy label, not a credential
         }
         for child, parent in hierarchy.items():
             g.add((CM[child], RDFS.subClassOf, CM[parent]))

{cloudg-0.4.0 → cloudg-0.4.1}/cloudg/registry.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 import importlib
+import re
 import logging
 from importlib.metadata import entry_points
 from typing import Any, Type
@@ -29,10 +30,23 @@ _BUILTIN_SCANNERS: dict[str, str] = {
 }
 
 
+# Shape of a valid "module.path:ClassName" plugin path
+_DOTTED_PATH_RE = re.compile(r"^[A-Za-z_][A-Za-z0-9_.]*:[A-Za-z_][A-Za-z0-9_]*$")
+
+
 def _load_class(dotted_path: str) -> Type[Any]:
-    """Import a class from a 'module.path:ClassName' string."""
+    """Import a class from a 'module.path:ClassName' string.
+
+    Paths come from the built-in mapping above or from installed
+    entry points, never from remote input; the shape check rejects
+    anything that is not a plain dotted module path.
+    """
+    if not _DOTTED_PATH_RE.match(dotted_path):
+        raise ValueError(f"Invalid plugin path: {dotted_path!r}")
     module_path, class_name = dotted_path.rsplit(":", 1)
-    module = importlib.import_module(module_path)
+    module = importlib.import_module(  # nosemgrep: python.lang.security.audit.non-literal-import.non-literal-import
+        module_path
+    )
     return getattr(module, class_name)
 
 
@@ -73,7 +87,7 @@ class PluginRegistry:
                 except Exception as exc:
                     logger.warning("Failed to load collector plugin %s: %s", ep.name, exc)
         except Exception:
-            pass
+            logger.debug("Collector entry point discovery failed", exc_info=True)
 
         # Discover scanners
         try:
@@ -90,7 +104,7 @@ class PluginRegistry:
                 except Exception as exc:
                     logger.warning("Failed to load scanner plugin %s: %s", ep.name, exc)
         except Exception:
-            pass
+            logger.debug("Scanner entry point discovery failed", exc_info=True)
 
         # Fill in built-in defaults for any not discovered
         for name, path in _BUILTIN_COLLECTORS.items():

{cloudg-0.4.0 → cloudg-0.4.1}/cloudg/renderers/html_report.py

@@ -130,7 +130,7 @@ class HTMLReportGenerator:
         compliance_summary: dict[str, dict[str, int]] = {}
         for result in scan_result.compliance:
             if result.framework not in compliance_summary:
-                compliance_summary[result.framework] = {"pass": 0, "fail": 0}
+                compliance_summary[result.framework] = {"pass": 0, "fail": 0}  # nosec B105 - status counters
             if result.status.value == "PASS":
                 compliance_summary[result.framework]["pass"] += 1
             else:

{cloudg-0.4.0 → cloudg-0.4.1}/cloudg/retry.py

@@ -10,6 +10,9 @@ from typing import Any, Callable, Type
 
 logger = logging.getLogger(__name__)
 
+# System RNG: jitter is not cryptographic, but this also satisfies Bandit B311
+_jitter_rng = random.SystemRandom()
+
 # Default retryable exception types
 RETRYABLE_EXCEPTIONS: tuple[Type[Exception], ...] = (
     ConnectionError,
@@ -81,7 +84,7 @@ def with_retry(
 
                     # Exponential backoff with full jitter
                     delay = min(max_delay, base_delay * (backoff_factor ** (attempt - 1)))
-                    jitter = random.uniform(0, delay)
+                    jitter = _jitter_rng.uniform(0, delay)
                     actual_delay = jitter
 
                     logger.warning(

{cloudg-0.4.0 → cloudg-0.4.1}/cloudg/scanners/checkov.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 import json
 import logging
 import shutil
-import subprocess
+import subprocess  # nosec B404 - runs the wrapped scanner CLIs with argv lists, never a shell
 from typing import Any
 
 from cloudg.schema.models import Finding, Severity
@@ -76,7 +76,9 @@ class CheckovScanner:
         logger.info("Running Checkov: %s", " ".join(cmd))
 
         try:
-            result = subprocess.run(
+            # The argv list starts with the scanner binary name and shell=False;
+            # user-controlled parts are arguments, not code.
+            result = subprocess.run(  # nosemgrep: python.lang.security.audit.dangerous-subprocess-use-audit.dangerous-subprocess-use-audit # nosec B603
                 cmd,
                 capture_output=True,
                 text=True,

{cloudg-0.4.0 → cloudg-0.4.1}/cloudg/scanners/prowler.py

@@ -6,7 +6,7 @@ import glob
 import json
 import logging
 import shutil
-import subprocess
+import subprocess  # nosec B404 - runs the wrapped scanner CLIs with argv lists, never a shell
 import tempfile
 from typing import Any
 
@@ -114,7 +114,9 @@ class ProwlerScanner:
 
         try:
             # Use Popen for live streaming instead of blocking subprocess.run
-            proc = subprocess.Popen(
+            # The argv list starts with the prowler binary and shell=False;
+            # user-controlled parts are arguments, not code.
+            proc = subprocess.Popen(  # nosemgrep: python.lang.security.audit.dangerous-subprocess-use-audit.dangerous-subprocess-use-audit # nosec B603
                 cmd,
                 stdout=subprocess.PIPE,
                 stderr=subprocess.STDOUT,

{cloudg-0.4.0 → cloudg-0.4.1}/cloudg/scanners/scoutsuite.py

@@ -6,7 +6,7 @@ import json
 import logging
 import re
 import shutil
-import subprocess
+import subprocess  # nosec B404 - runs the wrapped scanner CLIs with argv lists, never a shell
 import tempfile
 from pathlib import Path
 from typing import Any
@@ -67,7 +67,9 @@ class ScoutSuiteScanner:
         logger.info("Running ScoutSuite: %s", " ".join(cmd))
 
         try:
-            result = subprocess.run(
+            # The argv list starts with the scanner binary name and shell=False;
+            # user-controlled parts are arguments, not code.
+            result = subprocess.run(  # nosemgrep: python.lang.security.audit.dangerous-subprocess-use-audit.dangerous-subprocess-use-audit # nosec B603
                 cmd,
                 capture_output=True,
                 text=True,

{cloudg-0.4.0 → cloudg-0.4.1}/cloudg/scanners/trivy.py

@@ -5,7 +5,7 @@ from __future__ import annotations
 import json
 import logging
 import shutil
-import subprocess
+import subprocess  # nosec B404 - runs the wrapped scanner CLIs with argv lists, never a shell
 from typing import Any
 
 from cloudg.schema.models import Finding, Severity
@@ -66,7 +66,9 @@ class TrivyScanner:
         logger.info("Running Trivy: %s", " ".join(cmd))
 
         try:
-            result = subprocess.run(
+            # The argv list starts with the scanner binary name and shell=False;
+            # user-controlled parts are arguments, not code.
+            result = subprocess.run(  # nosemgrep: python.lang.security.audit.dangerous-subprocess-use-audit.dangerous-subprocess-use-audit # nosec B603
                 cmd,
                 capture_output=True,
                 text=True,
@@ -132,7 +134,9 @@ class TrivyScanner:
             logger.info("Running Trivy filesystem scan: %s", " ".join(cmd))
 
             try:
-                result = subprocess.run(
+                # The argv list starts with the scanner binary name and shell=False;
+                # user-controlled parts are arguments, not code.
+                result = subprocess.run(  # nosemgrep: python.lang.security.audit.dangerous-subprocess-use-audit.dangerous-subprocess-use-audit # nosec B603
                     cmd,
                     capture_output=True,
                     text=True,
@@ -376,5 +380,5 @@ class TrivyScanner:
                 source_finding_id=secret.get("RuleID", ""),
             )
         except Exception as exc:
-            logger.debug("Failed to parse Trivy secret: %s", exc)
+            logger.debug("Failed to parse a Trivy sensitive-data result: %s", exc)
             return None

{cloudg-0.4.0 → cloudg-0.4.1}/cloudg/schema/models.py

@@ -87,7 +87,7 @@ class AssetType(str, Enum):
 
     # Secrets / Keys
     KMS_KEY = "KMS_KEY"
-    SECRET = "SECRET"
+    SECRET = "SECRET"  # nosec B105 - asset type name, not a credential
     CERTIFICATE = "CERTIFICATE"
     KEY_VAULT = "KEY_VAULT"
 
@@ -116,7 +116,7 @@ class EdgeType(str, Enum):
 class ComplianceStatus(str, Enum):
     """Compliance check status."""
 
-    PASS = "PASS"
+    PASS = "PASS"  # nosec B105 - compliance status label, not a credential
     FAIL = "FAIL"
     NOT_APPLICABLE = "NOT_APPLICABLE"
     MANUAL = "MANUAL"

{cloudg-0.4.0 → cloudg-0.4.1}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "cloudg"
-version = "0.4.0"
+version = "0.4.1"
 description = "cloudg (cloud graphing) — multi-cloud infrastructure mapping, knowledge graphs and security intelligence for AWS, Azure and GCP"
 # The PyPI project page renders the full documentation, not the repo README
 readme = "docs/DOCUMENTATION.md"