composable-data-stack 0.12.0__py3-none-any.whl → 0.13.0__py3-none-any.whl

cli/getter.py

@@ -664,7 +664,7 @@ def _extract_dockerfile_instruction_sources(
             continue
         if _contains_template(source):
             continue
-        if Path(source).is_absolute():
+        if Path(source).is_absolute() or source.startswith(("/", "\\")):
             continue
         matches = list(context_path.glob(source))
         if not matches and "*" not in source and "?" not in source and "[" not in source:

cli/k8s_renderer.py

@@ -38,6 +38,11 @@ from .renderer import (
     _resolve_project_root,
     _substitute_values,
 )
+from .secret_leak import (
+    check_generated_text,
+    declared_secret_env_names,
+    resolved_secret_values,
+)
 from .utils import _atomic_write
 
 CHART_API_VERSION = "v2"
@@ -73,12 +78,14 @@ class K8sRenderError(Exception):
 def render_helm(
     plan: dict[str, Any],
     output_dir: str | None = None,
+    env_file: str | None = None,
 ) -> tuple[dict[str, str], list[Diagnostic]]:
     """
     Render a Helm chart from a resolved plan.
 
     Returns a mapping of chart-relative path -> file contents, plus diagnostics.
-    Files are written to `output_dir` when given.
+    Files are written to `output_dir` when given, unless an error was found
+    (including a resolved secret value in any chart file, CDS-SEC-030).
     """
     diagnostics: list[Diagnostic] = []
     metadata = plan.get("metadata", {})
@@ -183,6 +190,11 @@ def render_helm(
 
     diagnostics.extend(_check_unresolved(files))
     diagnostics.extend(_check_secret_references(files, secret_keys))
+    secret_values = resolved_secret_values(declared_secret_env_names(plan), env_file)
+    for relative_path, content in files.items():
+        diagnostics.extend(check_generated_text(
+            content, f"{output_dir or 'chart'}/{relative_path}", secret_values
+        ))
 
     if output_dir and not any(
         diagnostic.level == "error" for diagnostic in diagnostics

cli/main.py

@@ -2,6 +2,8 @@
 from __future__ import annotations
 
 import argparse
+import contextlib
+import io
 import json
 import logging
 import os
@@ -48,6 +50,11 @@ from .planner import build_plan
 from .preflight import preflight_passed, run_preflight
 from .renderer import render_compose
 from .report import build_compliance_report
+from .secret_leak import (
+    CLI_OUTPUT_REDACTED_CODE,
+    RedactingStream,
+    resolved_secret_values,
+)
 from .security import PrecomputedRender, run_security_validation
 from .security_common import (
     COMPLIANCE_CATEGORIES,
@@ -1016,6 +1023,10 @@ def _write_env_file(
     )
     lines.append("")
     _atomic_write(output_path, "\n".join(lines))
+    # Holds secrets: keep it owner-only even if _atomic_write's temp-file
+    # creation ever changes (CDS-SEC-032). No-op semantics on Windows.
+    if os.name != "nt":
+        output_path.chmod(0o600)
 
 
 def _cds_version() -> str:
@@ -1320,7 +1331,7 @@ def _run_image_verification(
         return [_unverifiable_image_finding(f"Image verification failed unexpectedly: {e}")]
 
 
-def _render_helm_chart(plan, output_dir, force):
+def _render_helm_chart(plan, output_dir, force, env_file=None):
     """
     Render the Helm chart for a plan and report where it landed.
 
@@ -1341,7 +1352,7 @@ def _render_helm_chart(plan, output_dir, force):
                 "like a CDS-generated chart. Pass --force to overwrite it."
             )
             return 1, []
-    files, diags = render_helm(plan, output_dir=str(target_dir))
+    files, diags = render_helm(plan, output_dir=str(target_dir), env_file=env_file)
     return 0, diags
 
 
@@ -1366,10 +1377,74 @@ def _maybe_notify_update() -> None:
         _LOGGER.debug("Automatic update notice failed", exc_info=True)
 
 
+_REDACTED_OUTPUT_COMMANDS = frozenset({"validate", "plan", "test", "security"})
+_output_redaction: tuple[Any, Any, set[str]] | None = None
+
+
+def _install_output_redaction(args: argparse.Namespace) -> None:
+    """CDS-SEC-071: redact resolved secret values from this command's stdout/stderr.
+
+    Runs for commands that print plans, diagnostics or findings, unless the
+    user explicitly asked for unredacted output with --reveal-secrets.
+    Failing to work out the secret set must not leave output unprotected, so
+    it falls back to the secret-named CDS_* variables alone.
+    """
+    global _output_redaction
+    if args.command not in _REDACTED_OUTPUT_COMMANDS or getattr(args, "reveal_secrets", False):
+        return
+    declared: set[str] = set()
+    env_file = None
+    try:
+        # The command resolves the profile itself and prints any warning;
+        # don't print it a second time from this pre-pass.
+        with contextlib.redirect_stdout(io.StringIO()):
+            profile_path = resolve_profile_path(args.profile)
+            env_file = str(resolve_env_file_path(profile_path))
+            declared = _collect_profile_env_vars(profile_path, getattr(args, "environment", None))[1]
+    except Exception:  # noqa: BLE001 - redaction must never break the command itself
+        _LOGGER.debug("Could not collect declared secrets for output redaction", exc_info=True)
+    secret_values = resolved_secret_values(declared, env_file)
+    if not secret_values:
+        return
+    hits: set[str] = set()
+    _output_redaction = (sys.stdout, sys.stderr, hits)
+    sys.stdout = RedactingStream(sys.stdout, secret_values, hits)
+    sys.stderr = RedactingStream(sys.stderr, secret_values, hits)
+
+
+def _finish_output_redaction() -> None:
+    global _output_redaction
+    if _output_redaction is None:
+        return
+    original_stdout, original_stderr, hits = _output_redaction
+    _output_redaction = None
+    for stream in (sys.stdout, sys.stderr):
+        if isinstance(stream, RedactingStream):
+            stream.finish()
+        else:
+            stream.flush()
+    sys.stdout, sys.stderr = original_stdout, original_stderr
+    if hits:
+        print(
+            Diagnostic(
+                level="warning",
+                code=CLI_OUTPUT_REDACTED_CODE,
+                message=(
+                    "[CDS-SEC-071] Output contained the resolved value of "
+                    f"{', '.join(sorted(hits))}; it was redacted. Find where the literal "
+                    "value is being copied into config and use a secrets.<alias> reference instead."
+                ),
+                path="cli-output",
+            ).format(),
+            file=sys.stderr,
+        )
+
+
 def main() -> int:
     try:
         return _run()
     finally:
+        _finish_output_redaction()
         _maybe_notify_update()
 
 
@@ -1897,6 +1972,8 @@ def _run() -> int:
     if args.command in {"validate", "render", "up", "down", "test", "state", "security"}:
         args.target = getattr(args, "target", None) or load_saved_target() or "compose"
     
+    _install_output_redaction(args)
+
     if args.command == "validate":
         try:
             profile_path = resolve_profile_path(args.profile)
@@ -2158,7 +2235,7 @@ def _run() -> int:
 
             env_file = str(resolve_env_file_path(str(source_profile)))
             if args.target == "helm":
-                code, render_diags = _render_helm_chart(plan, output_path, args.force)
+                code, render_diags = _render_helm_chart(plan, output_path, args.force, env_file=env_file)
                 all_diags = render_diags
                 if code != 0:
                     _record_audit("render", str(source_profile), "failure", plan=plan)
@@ -2222,7 +2299,7 @@ def _run() -> int:
                 )
 
             if args.target == "helm":
-                code, render_diags = _render_helm_chart(plan, output_path, args.force)
+                code, render_diags = _render_helm_chart(plan, output_path, args.force, env_file=env_file)
                 all_diags = all_diags + render_diags
                 if code != 0:
                     _record_audit("render", profile_or_plan, "failure", environment=args.environment, plan=plan)
@@ -2302,7 +2379,7 @@ def _run() -> int:
         if args.target == "helm":
             project_root = resolve_project_root(profile_path)
             chart_dir = (Path(args.chart_dir) if args.chart_dir else project_root / "chart").resolve()
-            code, render_diags = _render_helm_chart(plan, chart_dir, force=True)
+            code, render_diags = _render_helm_chart(plan, chart_dir, force=True, env_file=env_file)
             all_diags.extend(render_diags)
             if code != 0 or has_errors(all_diags):
                 print_diagnostics(all_diags)

cli/preflight.py

@@ -1,9 +1,11 @@
 from __future__ import annotations
 
+import json
 import os
 import re
 import shutil
 import socket
+import stat
 import subprocess  # nosec B404
 from dataclasses import dataclass
 from pathlib import Path
@@ -88,17 +90,156 @@ def _check_runtime(runtime: dict[str, Any]) -> list[PreflightCheck]:
             "Docker Compose is unavailable. Install the Compose plugin.",
         )
     )
-    checks.append(
-        _run_runtime_command(
-            ["docker", "info"],
-            "runtime.daemon",
-            "Docker daemon is reachable.",
-            "Docker daemon is unreachable. Start Docker and verify access with `docker info`.",
+    daemon_check, docker_info = _check_daemon()
+    checks.append(daemon_check)
+    if docker_info is not None:
+        checks.extend(_check_host_hardening(docker_info))
+    return checks
+
+
+def _check_daemon() -> tuple[PreflightCheck, dict[str, Any] | None]:
+    """Probe the daemon with one `docker info` call; also return its parsed JSON."""
+    command = ["docker", "info", "--format", "{{json .}}"]
+    try:
+        result = subprocess.run(  # nosec B603  # noqa: S603
+            command,
+            capture_output=True,
+            text=True,
+            timeout=15,
         )
-    )
+    except (OSError, subprocess.TimeoutExpired):
+        result = None
+
+    if result is None or result.returncode != 0:
+        message = "Docker daemon is unreachable. Start Docker and verify access with `docker info`."
+        detail = ((result.stderr or "").strip().splitlines() or [""])[0][:200] if result else ""
+        if detail:
+            message = f"{message} ({detail})"
+        return PreflightCheck("FAIL", "runtime.daemon", message), None
+
+    info: dict[str, Any] | None = None
+    try:
+        parsed = json.loads(result.stdout or "")
+    except (TypeError, ValueError):
+        parsed = None
+    if isinstance(parsed, dict):
+        info = parsed
+    return PreflightCheck("PASS", "runtime.daemon", "Docker daemon is reachable."), info
+
+
+def _check_host_hardening(info: dict[str, Any]) -> list[PreflightCheck]:
+    """
+    Inspect host/daemon settings from `docker info` without privileged access.
+
+    All findings are advisory (PASS/WARN): the host baseline in
+    docs/docker-host-hardening.md is an operator responsibility, so these
+    checks never fail preflight.
+    """
+    # Docker Desktop's daemon runs in a managed VM the operator cannot harden.
+    if "docker desktop" in str(info.get("OperatingSystem", "")).lower():
+        return []
+
+    raw_options = info.get("SecurityOptions")
+    options = {str(o) for o in raw_options} if isinstance(raw_options, list) else set()
+    rootless = "name=rootless" in options
+    checks = [
+        _host_check(
+            rootless,
+            "host.rootless",
+            "Docker daemon runs in rootless mode.",
+            "Docker daemon runs as root. Prefer rootless mode (HOST-001).",
+        ),
+        _host_check(
+            rootless or "name=userns" in options,
+            "host.userns",
+            "User namespace isolation is active.",
+            "User namespace remapping is not enabled (HOST-002).",
+        ),
+        _host_check(
+            any(o.startswith("name=seccomp") for o in options)
+            and "name=seccomp,profile=unconfined" not in options,
+            "host.seccomp",
+            "Daemon default seccomp profile is active.",
+            "Daemon default seccomp profile is not active (HOST-003).",
+        ),
+        _host_check(
+            info.get("LoggingDriver") not in {None, "", "none"},
+            "host.logging",
+            f'Daemon logging driver "{info.get("LoggingDriver")}" is enabled '
+            "(log rotation is not verified; check daemon.json, HOST-004).",
+            "Daemon logging driver is disabled; container logs are not retained (HOST-004).",
+        ),
+        _host_check(
+            info.get("LiveRestoreEnabled") is True,
+            "host.live-restore",
+            "Live restore is enabled.",
+            "Live restore is not enabled; daemon restarts stop containers (HOST-005).",
+        ),
+    ]
+    socket_check = _check_socket_exposure(rootless=rootless)
+    if socket_check is not None:
+        checks.append(socket_check)
     return checks
 
 
+def _host_check(ok: bool, name: str, pass_message: str, warn_message: str) -> PreflightCheck:
+    return PreflightCheck("PASS" if ok else "WARN", name, pass_message if ok else warn_message)
+
+
+def _uses_non_default_context() -> bool:
+    """True when the Docker CLI targets a named context (possibly a remote daemon)."""
+    context = os.environ.get("DOCKER_CONTEXT", "").strip()
+    if not context:
+        config_dir = Path(os.environ.get("DOCKER_CONFIG") or Path.home() / ".docker")
+        try:
+            config = json.loads((config_dir / "config.json").read_text(encoding="utf-8"))
+        except (OSError, ValueError):
+            return False
+        context = str(config.get("currentContext", "")).strip() if isinstance(config, dict) else ""
+    return context not in {"", "default"}
+
+
+def _check_socket_exposure(rootless: bool = False) -> PreflightCheck | None:
+    """Return None when the socket cannot be meaningfully inspected."""
+    docker_host = os.environ.get("DOCKER_HOST", "").strip()
+    if not docker_host and _uses_non_default_context():
+        return None
+    scheme = docker_host.lower().split("://", 1)[0] if "://" in docker_host else ""
+    if scheme in {"tcp", "http"}:
+        # Docker treats any non-empty DOCKER_TLS_VERIFY value as enabled.
+        if os.environ.get("DOCKER_TLS_VERIFY", "").strip():
+            return PreflightCheck(
+                "PASS", "host.socket", "Daemon is reached over TCP with TLS verification."
+            )
+        return PreflightCheck(
+            "WARN",
+            "host.socket",
+            "DOCKER_HOST uses TCP without DOCKER_TLS_VERIFY; "
+            "an unauthenticated daemon socket grants root on the host (HOST-006).",
+        )
+    if scheme == "ssh":
+        return PreflightCheck("PASS", "host.socket", "Daemon is reached over SSH.")
+    if scheme not in {"", "unix"} or os.name == "nt":
+        return None
+
+    default_socket = "/var/run/docker.sock"
+    runtime_dir = os.environ.get("XDG_RUNTIME_DIR", "").strip()
+    if rootless and runtime_dir:
+        default_socket = str(Path(runtime_dir) / "docker.sock")
+    socket_path = Path(docker_host.removeprefix("unix://") or default_socket)
+    try:
+        mode = socket_path.stat().st_mode
+    except OSError:
+        return None
+    if mode & stat.S_IWOTH:
+        return PreflightCheck(
+            "WARN",
+            "host.socket",
+            f"Daemon socket {socket_path} is world-writable (HOST-006).",
+        )
+    return PreflightCheck("PASS", "host.socket", "Daemon socket is not world-writable.")
+
+
 def _run_runtime_command(
     command: list[str],
     name: str,

cli/renderer.py

@@ -16,6 +16,11 @@ import yaml
 from .constants import MAX_NESTING_DEPTH, MaxNestingDepthExceeded
 from .diagnostics import Diagnostic
 from .loader import resolve_module_dir
+from .secret_leak import (
+    check_generated_text,
+    declared_secret_env_names,
+    resolved_secret_values,
+)
 from .utils import _atomic_write
 
 
@@ -30,12 +35,12 @@ def render_compose(
     Args:
         plan:        Composition plan.
         output_path: Optional output file path.
-        env_file:    Reserved for compatibility; not used.
+        env_file:    .env path used to look up resolved secret values so the
+                     output file is never written if it would contain one.
 
     Returns:
         Tuple of (output_yaml, diagnostics).
     """
-    _ = env_file
     diagnostics: list[Diagnostic] = []
     secrets = plan.get("secrets", {})
     compose_dir = Path(output_path).resolve().parent if output_path else Path.cwd().resolve()
@@ -146,9 +151,17 @@ def render_compose(
     diagnostics.extend(_check_unresolved_expressions(output))
 
     if output_path:
-        path = Path(output_path)
-        path.parent.mkdir(parents=True, exist_ok=True)
-        _atomic_write(path, output)
+        # CDS-SEC-030: scan before writing so a leaking file never lands on disk.
+        leak_diags = check_generated_text(
+            output,
+            output_path,
+            resolved_secret_values(declared_secret_env_names(plan), env_file),
+        )
+        diagnostics.extend(leak_diags)
+        if not leak_diags:
+            path = Path(output_path)
+            path.parent.mkdir(parents=True, exist_ok=True)
+            _atomic_write(path, output)
 
     return output, diagnostics
 

cli/resources/rule-schema.json

@@ -77,6 +77,7 @@
         "service-env",
         "runtime",
         "rendered-compose",
+        "file-permissions",
         "none"
       ]
     },

cli/resources/rule-set.json

@@ -156,8 +156,8 @@
     },
     {
       "id": "CDS-SEC-006",
-      "$comment": "Deferred: this rule is about secrets leaking into rendered Compose, generated artifacts, or CLI text output after resolution. The current scanner only flattens profile inputs and loaded .env secrets, so enabling a non-'none' scope here would still never inspect the output surfaces this rule names.",
-      "title": "Resolved secret present in generated or CLI output",
+      "$comment": "Enforced entirely in code by _check_rendered_secret_values in cli/security.py, not the declarative match engine: it looks for the literal value of every known secret (declared under spec.secrets.values or a secret-named CDS_* variable of at least 8 characters, per cli/secret_leak.py) anywhere in the rendered Compose model. CDS only ever renders ${CDS_*} placeholders, so a literal value means a secret was copied into config. The match block below is therefore documentation only. This rule was split by #356: written files are CDS-SEC-030 and printed CLI output is CDS-SEC-071. `enabled` stays false because `scope: [\"none\"]` rules can never produce a declarative-engine finding (see the scope-none `enabled` invariant test); `codeEnforced` is the actual on/off switch.",
+      "title": "Resolved secret present in rendered Compose output",
       "severity": "high",
       "category": "secrets",
       "complianceCategory": "secrets-management",
@@ -173,13 +173,14 @@
           }
         ]
       },
-      "message": "Rendered or planned output appears to contain a resolved secret",
+      "message": "Rendered Compose output contains a resolved secret value",
       "whyItMatters": "Generated artifacts are often stored, shared, or captured by CI systems.",
       "recommendation": [
         "Redact secrets in plan and render output.",
         "Avoid writing resolved secret values to generated files."
       ],
-      "enabled": false
+      "enabled": false,
+      "codeEnforced": true
     },
     {
       "id": "CDS-SEC-010",
@@ -410,7 +411,7 @@
     },
     {
       "id": "CDS-SEC-030",
-      "$comment": "Deferred: this rule needs an on-disk generated-file scan after render/write. The current matcher only sees profile values and loaded .env secrets, not file contents created by cds render or cds up.",
+      "$comment": "Enforced entirely in code by cli.secret_leak.check_generated_text, called from render_compose (docker-compose.yml) and render_helm (every chart file) before anything is written: if the content contains the literal value of a known secret (same value set as CDS-SEC-006) the file is not written and error E096 is reported, so cds render and cds up fail closed. `enabled` stays false because `scope: [\"none\"]` rules can never produce a declarative-engine finding; `codeEnforced` is the actual on/off switch. The match block below is documentation only.",
       "title": "Generated file contains resolved secrets",
       "severity": "high",
       "category": "file-output-safety",
@@ -433,7 +434,8 @@
         "Redact generated output or write secret references only.",
         "Keep rendered artifacts free of resolved secrets."
       ],
-      "enabled": false
+      "enabled": false,
+      "codeEnforced": true
     },
     {
       "id": "CDS-SEC-031",
@@ -463,12 +465,12 @@
     },
     {
       "id": "CDS-SEC-032",
-      "$comment": "Deferred: the rule schema exposes a permissions condition, but cli/security.py does not evaluate it and the scanner does not stat files on disk. Supporting this needs file metadata collection plus condition evaluation for actual mode bits.",
+      "$comment": "Evaluated against the \"file-permissions\" scope: _flatten_file_permissions in cli/security.py stats the .env file the scan loads secrets from and emits its octal mode (e.g. \"0644\") as a synthetic <path>.permissions item; the \"permissions\" condition then flags any group (\"group-readable\") or other (\"world-readable\") read/write/execute bit, i.e. anything broader than owner-only. POSIX only: on Windows (os.name == \"nt\") no item is emitted, so the rule never fires there rather than reporting meaningless modes. A missing .env emits nothing. Secret files CDS itself writes (cds init) are created owner-only (0600). Filesystems without POSIX modes (e.g. WSL /mnt/c) report 0777 and always trigger the rule.",
       "title": "Secret file permissions too broad",
       "severity": "medium",
       "category": "file-output-safety",
       "complianceCategory": "secrets-management",
-      "scope": ["none"],
+      "scope": ["file-permissions"],
       "match": {
         "any": [
           {
@@ -485,7 +487,7 @@
         "Set permissions to owner-only for files containing secrets.",
         "Tighten file creation umask for generated secret artifacts."
       ],
-      "enabled": false
+      "enabled": true
     },
     {
       "id": "CDS-SEC-033",
@@ -755,7 +757,7 @@
     },
     {
       "id": "CDS-SEC-071",
-      "$comment": "Deferred: this rule is about literal CLI plan/validate output text, which is produced after formatting findings/diagnostics. The current matcher has no capture of stdout/stderr or rendered plan text to scan.",
+      "$comment": "Enforced entirely in code: cds plan, validate, test and security wrap stdout/stderr in cli.secret_leak.RedactingStream, which replaces the literal value of any known secret (same value set as CDS-SEC-006) with ***REDACTED*** before it is printed and then warns (W102) on stderr that redaction happened. Passing --reveal-secrets (where offered) disables the wrapper. `enabled` stays false because `scope: [\"none\"]` rules can never produce a declarative-engine finding; `codeEnforced` is the actual on/off switch. The match block below is documentation only.",
       "title": "CLI plan or validate output prints secrets",
       "severity": "high",
       "category": "observability-leakage",
@@ -781,7 +783,8 @@
         "Redact sensitive output by default.",
         "Provide explicit unsafe flags for debugging only."
       ],
-      "enabled": false
+      "enabled": false,
+      "codeEnforced": true
     },
     {
       "id": "CDS-SEC-072",

cli/secret_leak.py

@@ -0,0 +1,210 @@
+"""Value-based detection of resolved secrets in generated or printed output.
+
+Backs the code-enforced rules CDS-SEC-006 (rendered Compose model),
+CDS-SEC-030 (generated files) and CDS-SEC-071 (CLI output). Rather than
+guessing from entropy, these look for the literal secret values CDS knows
+about (the `CDS_*` variables from `.env`/the environment), so a hit is a real
+leak: CDS only ever renders `${CDS_*}` placeholders, never resolved values.
+"""
+from __future__ import annotations
+
+import io
+import os
+from pathlib import Path
+from typing import Any, TextIO
+
+from .diagnostics import Diagnostic
+from .secrets import load_secrets_from_env
+from .security_common import SECRET_KEY_RE
+
+# Shorter values (e.g. "admin") would match ordinary words and mangle output;
+# weak credentials are reported separately by the CDS-SEC-010 family.
+MIN_SECRET_LENGTH = 8
+
+REDACTED = "***REDACTED***"
+
+GENERATED_FILE_LEAK_CODE = "E096"
+CLI_OUTPUT_REDACTED_CODE = "W102"
+
+# CDS_* variables that configure the CLI itself and are never secret even if
+# their names happen to contain a secret-like word.
+_NON_SECRET_ENV_NAMES = frozenset({
+    "CDS_CHECK_UPDATES",
+    "CDS_CHECK_IMAGE_DIGESTS",
+    "CDS_MODULE_PATH",
+    "CDS_PROFILE_PATH",
+    "CDS_CONFIG_PATH",
+    "CDS_AUDIT_LOG_DISABLE",
+})
+
+
+def declared_secret_env_names(plan: dict[str, Any] | None) -> set[str]:
+    """Env var names a plan maps its secret aliases to (never their values)."""
+    if not isinstance(plan, dict):
+        return set()
+    secrets = plan.get("secrets", {})
+    if not isinstance(secrets, dict):
+        return set()
+    return {
+        value for alias, value in secrets.items()
+        if isinstance(value, str) and alias != value
+    }
+
+
+def resolved_secret_values(
+    declared_env_names: set[str] | frozenset[str] | None = None,
+    env_file: str | None = None,
+) -> dict[str, str]:
+    """Return {env name: value} for every CDS_* variable that holds a secret.
+
+    A variable counts as secret when the profile declares it under
+    `spec.secrets.values` or its name looks secret-like. Unreadable env files
+    simply yield no extra values; the process environment is still covered.
+    """
+    declared = declared_env_names or frozenset()
+    values, _ = load_secrets_from_env(Path(env_file) if env_file else None)
+    # load_secrets_from_env returns nothing when the env file is unreadable;
+    # always merging the process environment keeps that case fail-closed.
+    for name, value in os.environ.items():
+        if name.startswith("CDS_"):
+            values.setdefault(name, value)
+    result: dict[str, str] = {}
+    for name, value in values.items():
+        if name in _NON_SECRET_ENV_NAMES or len(value) < MIN_SECRET_LENGTH:
+            continue
+        if name in declared or SECRET_KEY_RE.search(name):
+            result[name] = value
+    return result
+
+
+def find_secret_leaks(text: str, secret_values: dict[str, str]) -> list[tuple[str, int]]:
+    """Return (env name, 1-based line) for each literal secret occurrence."""
+    leaks: list[tuple[str, int]] = []
+    for name, value in secret_values.items():
+        start = 0
+        while (index := text.find(value, start)) != -1:
+            leaks.append((name, text.count("\n", 0, index) + 1))
+            start = index + len(value)
+    return sorted(leaks, key=lambda leak: (leak[1], leak[0]))
+
+
+def check_generated_text(
+    text: str,
+    label: str,
+    secret_values: dict[str, str],
+) -> list[Diagnostic]:
+    """CDS-SEC-030: one error per distinct secret found in generated content."""
+    diagnostics: list[Diagnostic] = []
+    seen: set[str] = set()
+    for name, line in find_secret_leaks(text, secret_values):
+        if name in seen:
+            continue
+        seen.add(name)
+        diagnostics.append(Diagnostic(
+            level="error",
+            code=GENERATED_FILE_LEAK_CODE,
+            message=(
+                f"[CDS-SEC-030] Generated content contains the resolved value of {name}; "
+                "refusing to write it. Render secrets as ${CDS_*} placeholders instead of "
+                "literal values (for example by moving the literal out of module/profile "
+                "config and into spec.secrets.values)."
+            ),
+            path=f"{label}:{line}",
+        ))
+    return diagnostics
+
+
+def _redaction_candidates(secret_values: dict[str, str]) -> list[tuple[str, str]]:
+    """Secret values, longest first, plus each long line of multi-line values.
+
+    Output is redacted line by line, so a multi-line secret (e.g. a PEM key)
+    can only be caught through its individual lines.
+    """
+    candidates: list[tuple[str, str]] = []
+    for name, value in secret_values.items():
+        candidates.append((name, value))
+        if "\n" in value:
+            stripped = (line.strip() for line in value.splitlines())
+            candidates.extend((name, line) for line in stripped if len(line) >= MIN_SECRET_LENGTH)
+    return sorted(candidates, key=lambda item: -len(item[1]))
+
+
+def redact_text(text: str, secret_values: dict[str, str]) -> tuple[str, set[str]]:
+    """Replace literal secret values with a marker; return (text, names hit).
+
+    Longer values are replaced first so a secret that contains another secret
+    as a substring is still fully redacted.
+    """
+    hit: set[str] = set()
+    for name, value in _redaction_candidates(secret_values):
+        if value in text:
+            hit.add(name)
+            text = text.replace(value, REDACTED)
+    return text, hit
+
+
+class RedactingStream(io.TextIOBase):
+    """Text stream wrapper that redacts known secret values (CDS-SEC-071).
+
+    Output is buffered per line so a value is still caught when a single
+    `print()` reaches the stream in several `write()` calls.
+    """
+
+    def __init__(self, wrapped: TextIO, secret_values: dict[str, str], hits: set[str]):
+        self._wrapped = wrapped
+        self._secrets = secret_values
+        self._hits = hits
+        self._buffer = ""
+
+    def writable(self) -> bool:
+        return True
+
+    @property
+    def encoding(self) -> str:  # type: ignore[override]
+        return getattr(self._wrapped, "encoding", "utf-8")
+
+    def isatty(self) -> bool:
+        return self._wrapped.isatty()
+
+    def fileno(self) -> int:
+        return self._wrapped.fileno()
+
+    def write(self, text: str) -> int:
+        self._buffer += text
+        head, newline, tail = self._buffer.rpartition("\n")
+        if newline:
+            self._emit(head + newline)
+            self._buffer = tail
+        return len(text)
+
+    def flush(self) -> None:
+        # Hold back only a tail that could be the start of a secret so a value
+        # split across a flush is still caught; prompts are unaffected.
+        keep = self._partial_secret_suffix()
+        cut = len(self._buffer) - keep
+        self._emit(self._buffer[:cut])
+        self._buffer = self._buffer[cut:]
+        self._wrapped.flush()
+
+    def finish(self) -> None:
+        """Emit everything still buffered; call once before unwrapping."""
+        self._emit(self._buffer)
+        self._buffer = ""
+        self._wrapped.flush()
+
+    def _partial_secret_suffix(self) -> int:
+        longest = 0
+        for _, value in _redaction_candidates(self._secrets):
+            for size in range(min(len(value) - 1, len(self._buffer)), longest, -1):
+                if self._buffer.endswith(value[:size]):
+                    longest = size
+                    break
+        return longest
+
+    def _emit(self, text: str) -> None:
+        if not text:
+            return
+        redacted, hit = redact_text(text, self._secrets)
+        self._hits.update(hit)
+        self._wrapped.write(redacted)
+

cli/security.py

@@ -9,6 +9,7 @@ from __future__ import annotations
 import json
 import os
 import re
+import stat
 from dataclasses import dataclass
 from importlib.resources import files
 from importlib.resources.abc import Traversable
@@ -23,6 +24,11 @@ from .loader import load_yaml_file, resolve_module_file
 from .planner import build_plan
 from .renderer import _compose_service_name, render_compose
 from .resolver import parse_contract_ref
+from .secret_leak import (
+    declared_secret_env_names,
+    find_secret_leaks,
+    resolved_secret_values,
+)
 from .secrets import load_secrets_from_env
 from .security_common import SECRET_KEY_RE, SEVERITY_ORDER, infer_profile_class
 
@@ -40,6 +46,15 @@ _ENV_SCOPES = {
     "runtime",
 }
 
+# Rules in this scope are matched against the permission bits of secret-bearing
+# files on disk (currently the .env file), not their contents.
+_FILE_PERMISSION_SCOPES = {
+    "file-permissions",
+}
+
+_GROUP_ACCESS_BITS = stat.S_IRGRP | stat.S_IWGRP | stat.S_IXGRP
+_OTHER_ACCESS_BITS = stat.S_IROTH | stat.S_IWOTH | stat.S_IXOTH
+
 # Rules in this scope are matched against the *rendered* Compose service
 # definitions (command/entrypoint/logging), not the profile or .env inputs.
 # This is the only way to see where a module's implementation template
@@ -203,6 +218,50 @@ def _flatten_env_inputs(
     return items
 
 
+def _is_windows() -> bool:
+    return os.name == "nt"
+
+
+def _flatten_file_permissions(env_file: str | None) -> list[tuple[str, str, Any]]:
+    """
+    Emit the POSIX permission bits of the secret-bearing .env file as a
+    synthetic item whose value is the octal mode string (e.g. "0644").
+
+    POSIX mode bits don't describe access on Windows, so nothing is emitted
+    there rather than reporting meaningless (and always-broad) modes. A file
+    that can't be stat'ed is skipped: the missing/unreadable case is already
+    reported by the env loader.
+    """
+    if _is_windows():
+        return []
+    env_path = Path(env_file) if env_file is not None else Path(".env")
+    try:
+        mode = stat.S_IMODE(env_path.stat().st_mode)
+    except OSError:
+        return []
+    return [("<env>", f"{_normalize_scan_path(env_path)}.permissions", f"{mode:04o}")]
+
+
+def _permission_mode(value: str) -> int | None:
+    try:
+        return int(value, 8)
+    except ValueError:
+        return None
+
+
+def _permissions_match(policy: str, value: str) -> bool:
+    mode = _permission_mode(value)
+    if mode is None:
+        return False
+    if policy == "world-readable":
+        return bool(mode & _OTHER_ACCESS_BITS)
+    if policy == "group-readable":
+        return bool(mode & _GROUP_ACCESS_BITS)
+    if policy == "owner-only":
+        return not mode & (_GROUP_ACCESS_BITS | _OTHER_ACCESS_BITS)
+    return False
+
+
 def _flatten_rendered_leak_surfaces(
     compose: dict[str, Any] | None,
     service_to_module: dict[str, str] | None = None,
@@ -377,6 +436,8 @@ def _eval_condition(
         return False
     if "minLength" in cond and len(sval) < cond["minLength"]:
         return False
+    if "permissions" in cond and not _permissions_match(cond["permissions"], sval):
+        return False
     if "serviceTypes" in cond and _service_type_for_path(path) not in cond["serviceTypes"]:
         return False
 
@@ -500,7 +561,8 @@ def _rule_matches(
                 "module": module_id,
                 "message": rule["message"],
                 "path": path,
-                "value": _redact(value) if redact_values else value,
+                # A file mode is not sensitive and is the whole point of the finding.
+                "value": _redact(value) if redact_values and "file-permissions" not in rule.get("scope", []) else value,
                 "recommendation": rule["recommendation"],
             })
 
@@ -662,6 +724,56 @@ def _rule_enabled(rule_set: dict[str, Any], rule_id: str, key: str = "enabled",
     return default
 
 
+def _profile_declared_secret_env_names(profile: dict[str, Any]) -> set[str]:
+    values = profile.get("spec", {}).get("secrets", {}).get("values", {})
+    if not isinstance(values, dict):
+        return set()
+    return {
+        definition["env"]
+        for definition in values.values()
+        if isinstance(definition, dict) and isinstance(definition.get("env"), str)
+    }
+
+
+def _check_rendered_secret_values(
+    rendered_compose: dict[str, Any] | None,
+    service_to_module: dict[str, str],
+    secret_values: dict[str, str],
+    rule: dict[str, Any] | None,
+    redact_values: bool,
+    rule_enabled: bool,
+) -> list[dict[str, Any]]:
+    """CDS-SEC-006: a resolved secret value appears in the rendered Compose model.
+
+    Enforced in code (see the rule's $comment): CDS renders only ``${CDS_*}``
+    placeholders, so the literal value of a known secret anywhere in the
+    rendered document -- keys or values -- means it was copied in from
+    config rather than referenced.
+    """
+    if not rule_enabled or rule is None or not isinstance(rendered_compose, dict) or not secret_values:
+        return []
+
+    findings: list[dict[str, Any]] = []
+    for path, value in _flatten(rendered_compose):
+        if not isinstance(value, str):
+            continue
+        leaked = sorted({name for name, _ in find_secret_leaks(value, secret_values)})
+        if not leaked:
+            continue
+        parts = path.split(".")
+        module_id = service_to_module.get(parts[1], parts[1]) if parts[0] == "services" and len(parts) > 1 else "<rendered>"
+        findings.append({
+            "rule_id": rule["id"],
+            "severity": rule["severity"],
+            "module": module_id,
+            "message": f"{rule['message']} ({', '.join(leaked)})",
+            "path": path,
+            "value": _redact(value) if redact_values else value,
+            "recommendation": rule["recommendation"],
+        })
+    return findings
+
+
 def _check_production_plaintext_exposure(
     profile: dict[str, Any],
     profile_class: str,
@@ -1107,6 +1219,7 @@ def run_security_validation(
 
     flat_profile = _flatten_profile_by_module(profile, profile_dir=profile_path.parent)
     flat_env = _flatten_env_inputs(secrets, env_file)
+    flat_permissions = _flatten_file_permissions(env_file)
 
     # Planning and rendering the profile is only useful when some enabled
     # rule actually declares the "rendered-compose" scope -- e.g. a custom
@@ -1118,8 +1231,10 @@ def run_security_validation(
     plaintext_exposure_rule_enabled = _rule_enabled(rule_set, "CDS-SEC-074", key="codeEnforced")
     backup_target_rule_enabled = _rule_enabled(rule_set, "CDS-SEC-080", key="codeEnforced")
     admin_identity_rule_enabled = _rule_enabled(rule_set, "CDS-SEC-081", key="codeEnforced")
+    rendered_secret_rule_enabled = _rule_enabled(rule_set, "CDS-SEC-006", key="codeEnforced")
     needs_rendered_compose = (
         (profile_class == "prod" and plaintext_exposure_rule_enabled)
+        or rendered_secret_rule_enabled
         or backup_target_rule_enabled
         or admin_identity_rule_enabled
         or any(
@@ -1155,6 +1270,12 @@ def run_security_validation(
                 redact_values=redact_values,
             ))
 
+        if rule_scopes & _FILE_PERMISSION_SCOPES:
+            findings.extend(_rule_matches(
+                rule, flat_permissions, profile_class,
+                redact_values=redact_values,
+            ))
+
         if rule_scopes & _RENDERED_COMPOSE_SCOPES:
             findings.extend(_rule_matches(
                 rule, flat_rendered, profile_class,
@@ -1173,6 +1294,21 @@ def run_security_validation(
     )
     findings.extend(plaintext_findings)
 
+    rendered_secret_rule = next(
+        (rule for rule in rule_set["rules"] if rule.get("id") == "CDS-SEC-006"), None
+    )
+    findings.extend(_check_rendered_secret_values(
+        rendered_compose=rendered_compose,
+        service_to_module=service_to_module,
+        secret_values=resolved_secret_values(
+            _profile_declared_secret_env_names(profile) | declared_secret_env_names(rendered_plan),
+            env_file,
+        ),
+        rule=rendered_secret_rule,
+        redact_values=redact_values,
+        rule_enabled=rendered_secret_rule_enabled,
+    ))
+
     findings.extend(_check_backup_target_binding(
         plan=rendered_plan,
         rule_enabled=backup_target_rule_enabled,

{composable_data_stack-0.12.0.dist-info → composable_data_stack-0.13.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: composable-data-stack
-Version: 0.12.0
+Version: 0.13.0
 Summary: CLI for validating and composing composable data stack profiles
 Author: Ronald Hensbergen
 License-Expression: Apache-2.0
@@ -32,7 +32,7 @@ Provides-Extra: dev
 Requires-Dist: coverage>=7.6; extra == "dev"
 Requires-Dist: bandit>=1.7; extra == "dev"
 Requires-Dist: pip-audit>=2.7; extra == "dev"
-Requires-Dist: ruff==0.17.0; extra == "dev"
+Requires-Dist: ruff==0.17.1; extra == "dev"
 Dynamic: license-file
 
 # 🚀 Composable Data Stack (CDS)

{composable_data_stack-0.12.0.dist-info → composable_data_stack-0.13.0.dist-info}/RECORD

@@ -3,24 +3,25 @@ cli/audit_log.py,sha256=YMm1GB8Lzcp3p7g06SGe39nv-C-McN1wWNm4Ql8OtWY,5726
 cli/composer.py,sha256=xaCSmHqTVzhJE2N-ogYii7SnzN-k8C9MuV1B12b6V9s,14128
 cli/constants.py,sha256=cp4135iisFhiOfhxm_jWI99sdQAi4SbSAX7qRJGNylQ,390
 cli/diagnostics.py,sha256=Vu_uY7OPJqrAvrG-DAcIjQVMiQ4WcGWSl32UYCtOCmA,260
-cli/getter.py,sha256=FRyTRVHDdJljHtUH6uZk_WSZCJne8MVXsTUvhJhn-I0,36542
+cli/getter.py,sha256=obxQ1sPJ8o_hYk09qSj27PjwwpF1Nf13mHaxzNkQSmA,36576
 cli/graph.py,sha256=TNx0EuTVxN4G0EIs_9eX0_x7-So3XVMh6AYjgukMMZs,1828
 cli/image_digest_check.py,sha256=xO2RQY7ShEJuC_tp5w92DjhFDOp3Joqou7lv7nLCvzA,7285
 cli/image_updates.py,sha256=WCA5YNRJ2ctWJPI7xmja5T7qKJTndqpJ0qVp8dbvR8Q,11833
 cli/image_verification.py,sha256=rlF_ZboHM07CIV1X99vdcmI4J9kMugaICPz13HbjsSQ,19758
-cli/k8s_renderer.py,sha256=GiNn_Yu1IeFba9Rz5oFnr80QWYhqWtaf7hOOZ_Y0J8I,52063
+cli/k8s_renderer.py,sha256=m4MZhjcZTYGT1IxmZLLVLGEciUzS5vjolLDP7o-ITts,52582
 cli/k8s_runner.py,sha256=ICfN4oYdQxowpoNUD8iPqxd90Wponpm867tNAxup4Mw,12615
 cli/k8s_security.py,sha256=-pbtNtbxYuca9yiaGNkwJOyAuXzSHrSs9mCvrVGcbPo,6568
 cli/loader.py,sha256=VufkoXW5pdYjq2zneBA12KKJq24G54JQgiKBRDGYBps,11847
-cli/main.py,sha256=vZ8HyX0nxuUD_u4pdVzTpCGwSRpmXdAQbBDw_nn0B2A,135016
+cli/main.py,sha256=8pVSp2Iv9BsNeP14MWJCvisp7LSnMB6i8y7kv1l9paM,138199
 cli/overlay.py,sha256=dZ0bJqgJ-52cFU3ZVYER9leJ7Ssqb5vI1ZVkPXd81ME,20669
 cli/planner.py,sha256=zNOFSYnlgrX9QxYR1NBMmTstQ-2PCRAx0o0OFpGUA3c,33846
-cli/preflight.py,sha256=Juby_q6mHghwwGRFvVdpf0AkPKHxR0JtoEo73neRWCQ,14089
-cli/renderer.py,sha256=PgwOifSbinwStTbM33JkROqixO9MYyH0rh8rvNTITtE,36945
+cli/preflight.py,sha256=Jsx8jtc2nVIGSzVrIeWBoEIc7InPS4Th3IN6o_RgrpY,19946
+cli/renderer.py,sha256=H2IpA5lOQUtDy2bBEvd_Fa5uXWPV9YFtJHNrMS25sik,37472
 cli/report.py,sha256=w-i-5tCcLtF8sqv0pOM1laIZPgSGjWJDVzCdOHz3uQ8,9916
 cli/resolver.py,sha256=JPmfjpT6MMLbF4-BYRwSPqWkyXjBZN3oCBv1AnD0gU0,2923
+cli/secret_leak.py,sha256=Ph3bGkhXUy_KHKBXyRa1E4A1398kAGA6tXHoA-8qQWM,7633
 cli/secrets.py,sha256=0w8MrZ-K-YVn7AZV0PlsJ43NUtHL-2kQFgmf2_4MsJ8,5886
-cli/security.py,sha256=Qq4xh5ra-Eglf4Hj0UQLG7kzFqKnV_XP1oXvJoD3J8c,48674
+cli/security.py,sha256=UY4LCxh-8zzVNJ4CjaEVQgbWqMYiifHUOiTwtgy2N_4,53688
 cli/security_common.py,sha256=oqJobLupYUDqNAe0r45GCBUsxgadtB1avoJMRm_Vcu0,6624
 cli/state.py,sha256=6NCh3P9vf0V_Q4FeaxRm0JVRiwOTP125sX-IRyjSlQ8,5579
 cli/up_runner.py,sha256=-w9uJ3Ti1J_Gl7bIy1OuvSkyRJepAdz2yq6jNX8fVlw,14117
@@ -33,11 +34,11 @@ cli/resources/compatibility-registry.schema.json,sha256=xYrquLDPORO-yJEbUa01xOZP
 cli/resources/contract.schema.json,sha256=wP6ElZDm4I2CwHY86FRKV37ot6J20oP6vxWD_JBZq3Q,1644
 cli/resources/module.schema.json,sha256=gehPtHEyfWz-Pcm9UavJOF7S3ctDvllZgi8cKolxUm8,18359
 cli/resources/profile.schema.json,sha256=rJuQcTZtaGEBOc6AkJLrS3wg1acGMzsyvZFXm8ouVK0,7664
-cli/resources/rule-schema.json,sha256=WWSnM1dgnmKoArOnk8d9lK0dMINylXV1prmmPZHLcmY,8226
-cli/resources/rule-set.json,sha256=ACxFGzjZcbJOFB6RoLDhcw0ieQKUqEaTOQWix77shyI,37085
-composable_data_stack-0.12.0.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
-composable_data_stack-0.12.0.dist-info/METADATA,sha256=fiklJ9wzQA3Q22UpnV1hIaO27MAxhqjoNaIpbe_aEIA,37127
-composable_data_stack-0.12.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-composable_data_stack-0.12.0.dist-info/entry_points.txt,sha256=GBhnbsVzmlnBKLC5Do-tirjz3hTzOfgGXGuZNQxb5ak,38
-composable_data_stack-0.12.0.dist-info/top_level.txt,sha256=2ImG917oaVHlm0nP9oJE-Qrgs-fq_fGWgba2H1f8fpE,4
-composable_data_stack-0.12.0.dist-info/RECORD,,
+cli/resources/rule-schema.json,sha256=1D2rA1GdwXlwFbftWK3eaNf0jVo4mxv2HXdMfp0uRIs,8254
+cli/resources/rule-set.json,sha256=Uiq3yYzYX-BPO5SYXDuvkCo3uDP-93kY1WhLvcD1slE,38832
+composable_data_stack-0.13.0.dist-info/licenses/LICENSE,sha256=xx0jnfkXJvxRnG63LTGOxlggYnIysveWIZ6H3PNdCrQ,11357
+composable_data_stack-0.13.0.dist-info/METADATA,sha256=z8Cbp1AdJZYxj_RKnk7bis_b1D47bftdqMq99OOdLgA,37127
+composable_data_stack-0.13.0.dist-info/WHEEL,sha256=mOdXR9C3wMVov7cSY8PY-XCzo3SmmWCHvGQr5csJoao,91
+composable_data_stack-0.13.0.dist-info/entry_points.txt,sha256=GBhnbsVzmlnBKLC5Do-tirjz3hTzOfgGXGuZNQxb5ak,38
+composable_data_stack-0.13.0.dist-info/top_level.txt,sha256=2ImG917oaVHlm0nP9oJE-Qrgs-fq_fGWgba2H1f8fpE,4
+composable_data_stack-0.13.0.dist-info/RECORD,,

{composable_data_stack-0.12.0.dist-info → composable_data_stack-0.13.0.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: setuptools (84.0.0)
+Generator: setuptools (84.2.1)
 Root-Is-Purelib: true
 Tag: py3-none-any