narvy-cli 1.0.0__tar.gz → 1.0.2__tar.gz

{narvy_cli-1.0.0 → narvy_cli-1.0.2}/CHANGELOG.md

@@ -5,6 +5,47 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.1]
+
+### Fixed
+
+- `--fail-on` no longer green-passes a build whose scan silently degraded. An
+  SCA run that could not reach OSV.dev (outage / cold cache) is now reported as
+  `degraded` and fails the gate (exit 2), not a clean 0. `cloud-scan`,
+  `web-scan` and `host-audit` now feed their own coverage gaps (skipped AWS
+  analyzers, SSRF-blocked redirect, partial non-root audit) into `--fail-on`.
+- `cloud-scan`: one AccessDenied no longer aborts the remaining analyzers for a
+  region; each runs in isolation and skipped checks are reported under
+  `coverage` in the output.
+- SARIF output on every surface (`scan`, `web-scan`, `host-audit`, `cloud-scan`)
+  now carries a per-result `level` and a `security-severity` property, so
+  GitHub/GitLab code scanning can rank findings.
+
+### Changed
+
+- `web-scan`, `host-audit` and `cloud-scan` now use `-o`/`--output` for the
+  format and `-f`/`--file` for the destination, consistent with `scan`. The
+  older `--format` / `--output-file` long options still work as aliases. A file
+  path that is actually a format name (e.g. `-f json`) is now rejected loudly
+  instead of writing a mis-named text file.
+
+## [1.0.0]
+
+First stable release, published to PyPI as `narvy-cli`.
+
+### Changed
+
+- Distribution name is `narvy-cli` on PyPI (`pip install narvy-cli`); the
+  command and import package remain `narvy`.
+- Web/backend rule packs are Narvy-authored and run on the Semgrep OSS engine,
+  which is invoked as a dependency.
+
+### Notes
+
+- Runs entirely on your machine; nothing is uploaded unless you pass `--upload`.
+- Honest coverage limits are surfaced in the tool's own output (for example,
+  FairPlay-encrypted iOS binaries and partial multi-ABI native coverage).
+
 ## [0.9.0]
 
 First public release. A free, local security scanner that runs entirely on your

{narvy_cli-1.0.0/narvy_cli.egg-info → narvy_cli-1.0.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: narvy-cli
-Version: 1.0.0
+Version: 1.0.2
 Summary: Free, local SAST scanner for Android, iOS, and polyglot web/backend source - plus passive web, host-audit, and cloud-posture scanning.
 Author: Narvy
 License: Apache-2.0
@@ -161,5 +161,7 @@ as Narvy's own.
 ## Contributing
 
 Issues and pull requests welcome, especially new or improved detection
-rules. Rule packs live under `narvy/rules/`: Android/iOS
-(`rules/android`, `rules/ios`) and web/backend (`rules/web`, Semgrep-based).
+rules. All rule packs are Narvy's own, under `narvy/rules/`: Android/iOS
+(`rules/android`, `rules/ios`) and web/backend (`rules/web`). The
+web/backend packs run on the Semgrep OSS engine, which Narvy invokes as a
+dependency; the rules themselves are authored by Narvy (Apache-2.0).

{narvy_cli-1.0.0 → narvy_cli-1.0.2}/README.md

@@ -128,5 +128,7 @@ as Narvy's own.
 ## Contributing
 
 Issues and pull requests welcome, especially new or improved detection
-rules. Rule packs live under `narvy/rules/`: Android/iOS
-(`rules/android`, `rules/ios`) and web/backend (`rules/web`, Semgrep-based).
+rules. All rule packs are Narvy's own, under `narvy/rules/`: Android/iOS
+(`rules/android`, `rules/ios`) and web/backend (`rules/web`). The
+web/backend packs run on the Semgrep OSS engine, which Narvy invokes as a
+dependency; the rules themselves are authored by Narvy (Apache-2.0).

{narvy_cli-1.0.0 → narvy_cli-1.0.2}/narvy/__init__.py

@@ -1,3 +1,3 @@
 """Narvy CLI - free, local SAST for Android, iOS and polyglot source."""
 
-__version__ = "1.0.0"
+__version__ = "1.0.2"

{narvy_cli-1.0.0 → narvy_cli-1.0.2}/narvy/apk_memory_preflight.py

@@ -209,9 +209,9 @@ def check_memory_preflight(apk_path: str, max_mem: str,
                 f"\n\nRaising --max-mem on its own will not be enough: {suggest_gb}g of heap needs "
                 f"roughly {_fmt_mb(need_rss_mb)} of real memory, and this machine only has "
                 f"{_fmt_mb(available_mb)} available right now. Options:\n"
-                f"  - free up that much memory (close other apps), then re-run with --max-mem {suggest_gb}g\n"
-                f"  - scan this app on a bigger machine, or use the hosted scan (`--upload`)\n"
-                f"  - run it anyway with --force if you know your setup can take it"
+                f"  - use the hosted scan (`--upload`): the platform decompiles any app size with no local memory ceiling\n"
+                f"  - or free up that much memory (close other apps) and re-run with --max-mem {suggest_gb}g\n"
+                f"  - or run it anyway with --force if your setup can take it"
             )
         else:
             avail_note = (f" (this machine has {_fmt_mb(available_mb)} available)"

narvy_cli-1.0.2/narvy/ci_templates/bitbucket.yml

@@ -0,0 +1,15 @@
+# Narvy SAST for Bitbucket Pipelines. Written by `narvy init-ci --bitbucket`; edit freely.
+# Already have a bitbucket-pipelines.yml? Copy the step below into it instead of overwriting.
+# Note: SARIF is stored as a build artifact (not Code Insights); the --fail-on gate still fails the build.
+image: python:3.11
+
+pipelines:
+  default:
+    - step:
+        name: Narvy SAST
+        script:
+          - pip install --upgrade pip
+          - pip install narvy-cli
+          - narvy scan . --output sarif --file narvy-results.sarif --fail-on high
+        artifacts:
+          - narvy-results.sarif

narvy_cli-1.0.2/narvy/ci_templates/github.yml

@@ -0,0 +1,48 @@
+# Narvy SAST for GitHub Actions. Written by `narvy init-ci --github`; edit freely.
+# Scans this repo, uploads SARIF to the Security tab, and fails the build on --fail-on.
+name: Narvy SAST
+
+on:
+  push:
+    branches: [ main, master ]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  security-events: write   # required to upload SARIF to code scanning
+
+jobs:
+  narvy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install Narvy CLI
+        run: |
+          python -m pip install --upgrade pip
+          pip install narvy-cli
+
+      - name: Run Narvy scan
+        # SARIF is written before the --fail-on gate, so the Security tab fills even on a failing build.
+        run: |
+          narvy scan . \
+            --output sarif \
+            --file narvy-results.sarif \
+            --fail-on high
+
+      - name: Upload SARIF to GitHub code scanning
+        if: always()   # upload even when the scan step failed the build via --fail-on
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: narvy-results.sarif
+
+# To also scan a web app URL, add a step:
+#   - run: narvy web-scan "https://staging.example.com" --format sarif --output-file web.sarif --fail-on high
+#   - if: always()
+#     uses: github/codeql-action/upload-sarif@v3
+#     with: { sarif_file: web.sarif, category: narvy-web }

narvy_cli-1.0.2/narvy/ci_templates/gitlab.yml

@@ -0,0 +1,19 @@
+# Narvy SAST for GitLab CI. Written by `narvy init-ci --gitlab`; edit freely.
+# Already have a .gitlab-ci.yml? Copy the narvy_sast job below into it instead of overwriting.
+# Note: SARIF is stored as a plain artifact (not GitLab's SAST schema), but the --fail-on gate still blocks the MR.
+stages:
+  - test
+
+narvy_sast:
+  stage: test
+  image: python:3.11-slim
+  before_script:
+    - pip install --upgrade pip
+    - pip install narvy-cli
+  script:
+    - narvy scan . --output sarif --file narvy-results.sarif --fail-on high
+  artifacts:
+    when: always   # keep the SARIF even when --fail-on failed the pipeline
+    paths:
+      - narvy-results.sarif
+    expire_in: 1 week

{narvy_cli-1.0.0 → narvy_cli-1.0.2}/narvy/cloud/aws_scan.py

@@ -1055,6 +1055,18 @@ def analyze_aws_security(credentials, region=None, endpoint_url=None):
         # letting the per-check handlers below report an empty, clean scan.
         _verify_credentials(endpoint_url=endpoint_url)
 
+        # Track every analyzer that could not complete (AccessDenied / throttling /
+        # missing permission) so 0 findings from a blinded scan is reported as a
+        # coverage gap, not as a clean pass.
+        coverage_errors = []
+
+        def _collect(dest, label, fn):
+            try:
+                dest.extend(fn())
+            except Exception as e:
+                coverage_errors.append(f"{label}: {e}")
+                logger.error(f"Error analyzing {label}: {e}")
+
         all_vulnerable_groups = []
         all_vulnerable_vpcs = []
         all_vulnerable_rds = []
@@ -1085,84 +1097,56 @@ def analyze_aws_security(credentials, region=None, endpoint_url=None):
             logger.info(f"Scanning {len(regions)} region(s)")
         except Exception as e:
             logger.error(f"Error getting regions: {str(e)}")
+            coverage_errors.append(f"region enumeration (ec2:DescribeRegions): {e}")
             regions = []
 
+        # Each analyzer is isolated: one AccessDenied must not skip its siblings for the region.
         for reg in regions:
             logger.info(f"Analyzing region: {reg}")
-            try:
-                all_vulnerable_groups.extend(analyze_security_groups(reg, endpoint_url=endpoint_url))
-                all_vulnerable_vpcs.extend(analyze_vpc_configuration(reg, endpoint_url=endpoint_url))
-                all_vulnerable_rds.extend(analyze_rds_instances(reg, endpoint_url=endpoint_url))
-                all_vulnerable_lambdas.extend(analyze_lambda_functions(reg, endpoint_url=endpoint_url))
-                all_vulnerable_ecs.extend(analyze_ecs_clusters(reg, endpoint_url=endpoint_url))
-                all_vulnerable_eb.extend(analyze_elastic_beanstalk(reg, endpoint_url=endpoint_url))
-                all_vulnerable_apis.extend(analyze_api_gateway(reg, endpoint_url=endpoint_url))
-                all_vulnerable_dynamodb.extend(analyze_dynamodb(reg, endpoint_url=endpoint_url))
-                all_gd_issues.extend(analyze_guardduty(reg, endpoint_url=endpoint_url))
-                all_vulnerable_eks.extend(analyze_eks(reg, endpoint_url=endpoint_url))
-                all_vulnerable_redshift.extend(analyze_redshift(reg, endpoint_url=endpoint_url))
-                all_vulnerable_secrets.extend(analyze_secrets_manager(reg, endpoint_url=endpoint_url))
-                all_vulnerable_sqs.extend(analyze_sqs(reg, endpoint_url=endpoint_url))
-                all_vulnerable_sns.extend(analyze_sns(reg, endpoint_url=endpoint_url))
-                all_vulnerable_glue_jobs.extend(analyze_glue(reg, endpoint_url=endpoint_url))
-                all_vulnerable_emr_clusters.extend(analyze_emr(reg, endpoint_url=endpoint_url))
-                all_vulnerable_kms_keys.extend(analyze_kms(reg, endpoint_url=endpoint_url))
-                all_waf_issues.extend(analyze_waf(reg, endpoint_url=endpoint_url))
-            except Exception as e:
-                logger.error(f"Error analyzing region {reg}: {str(e)}")
+            _collect(all_vulnerable_groups, f"{reg}/ec2_security_groups", lambda r=reg: analyze_security_groups(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_vpcs, f"{reg}/vpc_configuration", lambda r=reg: analyze_vpc_configuration(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_rds, f"{reg}/rds_instances", lambda r=reg: analyze_rds_instances(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_lambdas, f"{reg}/lambda_functions", lambda r=reg: analyze_lambda_functions(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_ecs, f"{reg}/ecs_clusters", lambda r=reg: analyze_ecs_clusters(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_eb, f"{reg}/elastic_beanstalk", lambda r=reg: analyze_elastic_beanstalk(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_apis, f"{reg}/api_gateway", lambda r=reg: analyze_api_gateway(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_dynamodb, f"{reg}/dynamodb", lambda r=reg: analyze_dynamodb(r, endpoint_url=endpoint_url))
+            _collect(all_gd_issues, f"{reg}/guardduty", lambda r=reg: analyze_guardduty(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_eks, f"{reg}/eks_clusters", lambda r=reg: analyze_eks(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_redshift, f"{reg}/redshift_clusters", lambda r=reg: analyze_redshift(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_secrets, f"{reg}/secrets_manager", lambda r=reg: analyze_secrets_manager(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_sqs, f"{reg}/sqs_queues", lambda r=reg: analyze_sqs(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_sns, f"{reg}/sns_topics", lambda r=reg: analyze_sns(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_glue_jobs, f"{reg}/glue_jobs", lambda r=reg: analyze_glue(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_emr_clusters, f"{reg}/emr_clusters", lambda r=reg: analyze_emr(r, endpoint_url=endpoint_url))
+            _collect(all_vulnerable_kms_keys, f"{reg}/kms_keys", lambda r=reg: analyze_kms(r, endpoint_url=endpoint_url))
+            _collect(all_waf_issues, f"{reg}/waf", lambda r=reg: analyze_waf(r, endpoint_url=endpoint_url))
 
         # Account-scoped checks: run once against the primary region only.
         primary_region = regions[0] if regions else (region or 'us-east-1')
-        try:
-            all_cloudtrail_issues.extend(
-                analyze_cloudtrail(primary_region, endpoint_url=endpoint_url))
-        except Exception as e:
-            logger.error(f"Error analyzing CloudTrail: {str(e)}")
-        try:
-            all_config_issues.extend(
-                analyze_config(primary_region, endpoint_url=endpoint_url))
-        except Exception as e:
-            logger.error(f"Error analyzing Config: {str(e)}")
-        try:
-            all_cloudwatch_issues.extend(
-                analyze_cloudwatch(primary_region, endpoint_url=endpoint_url))
-        except Exception as e:
-            logger.error(f"Error analyzing CloudWatch: {str(e)}")
+        _collect(all_cloudtrail_issues, "cloudtrail", lambda: analyze_cloudtrail(primary_region, endpoint_url=endpoint_url))
+        _collect(all_config_issues, "config", lambda: analyze_config(primary_region, endpoint_url=endpoint_url))
+        _collect(all_cloudwatch_issues, "cloudwatch", lambda: analyze_cloudwatch(primary_region, endpoint_url=endpoint_url))
 
-        try:
-            logger.info("Analyzing S3 Buckets...")
-            vulnerable_buckets = analyze_s3_buckets(endpoint_url=endpoint_url)
-        except Exception as e:
-            logger.error(f"Error analyzing S3 buckets: {str(e)}")
-            vulnerable_buckets = []
+        vulnerable_buckets = []
+        logger.info("Analyzing S3 Buckets...")
+        _collect(vulnerable_buckets, "s3_buckets", lambda: analyze_s3_buckets(endpoint_url=endpoint_url))
 
-        try:
-            logger.info("Analyzing IAM Users for MFA...")
-            users_without_mfa = analyze_iam_users(endpoint_url=endpoint_url)
-        except Exception as e:
-            logger.error(f"Error analyzing IAM users: {str(e)}")
-            users_without_mfa = []
+        users_without_mfa = []
+        logger.info("Analyzing IAM Users for MFA...")
+        _collect(users_without_mfa, "iam_users", lambda: analyze_iam_users(endpoint_url=endpoint_url))
 
-        try:
-            logger.info("Analyzing IAM Policies...")
-            risky_policies = analyze_iam_policies(endpoint_url=endpoint_url)
-        except Exception as e:
-            logger.error(f"Error analyzing IAM policies: {str(e)}")
-            risky_policies = []
+        risky_policies = []
+        logger.info("Analyzing IAM Policies...")
+        _collect(risky_policies, "iam_policies", lambda: analyze_iam_policies(endpoint_url=endpoint_url))
 
-        try:
-            logger.info("Analyzing CloudFront Distributions...")
-            vulnerable_cf = analyze_cloudfront(endpoint_url=endpoint_url)
-        except Exception as e:
-            logger.error(f"Error analyzing CloudFront: {str(e)}")
-            vulnerable_cf = []
+        vulnerable_cf = []
+        logger.info("Analyzing CloudFront Distributions...")
+        _collect(vulnerable_cf, "cloudfront", lambda: analyze_cloudfront(endpoint_url=endpoint_url))
 
-        try:
-            logger.info("Checking CIS Compliance...")
-            compliance_issues = check_cis_compliance(endpoint_url=endpoint_url)
-        except Exception as e:
-            logger.error(f"Error checking CIS compliance: {str(e)}")
-            compliance_issues = []
+        compliance_issues = []
+        logger.info("Checking CIS Compliance...")
+        _collect(compliance_issues, "cis_compliance", lambda: check_cis_compliance(endpoint_url=endpoint_url))
 
         logger.info("Generating report")
         report = generate_report(
@@ -1175,6 +1159,14 @@ def analyze_aws_security(credentials, region=None, endpoint_url=None):
             all_vulnerable_kms_keys, all_config_issues, all_cloudtrail_issues, all_cloudwatch_issues
         )
 
+        # Coverage: a scan that could not read some services/regions is NOT a clean 0.
+        report["coverage"] = {
+            "status": "partial" if coverage_errors else "complete",
+            "regions_scanned": len(regions),
+            "checks_skipped": len(coverage_errors),
+            "errors": coverage_errors,
+        }
+
         logger.info("AWS security analysis complete")
         return report
 

{narvy_cli-1.0.0 → narvy_cli-1.0.2}/narvy/doctor.py

@@ -87,7 +87,7 @@ def _check_icdump():
     else:
         detail = "Not installed - iOS binary scans will fall back to symbol-table-only Obj-C detection"
     return True, detail, (
-        "Optional: `pip install narvy[ios-full]` (Linux/macOS/WSL only - no Windows wheel exists) "
+        "Optional: `pip install narvy-cli[ios-full]` (Linux/macOS/WSL only - no Windows wheel exists) "
         "for full Obj-C class/method/property introspection on .ipa scans. Not required - iOS binary "
         "scanning still works without it, just with coarser Obj-C detection (class names only, via LIEF's "
         "symbol table, no methods/properties/protocols)."
@@ -110,10 +110,10 @@ def _check_memory():
     )
     if avail < 5 * 1024:
         return True, detail, (
-            "Large commercial apps (large production app scale) need 8-24 GB of free "
-            "memory to decompile. `narvy scan` will tell you before it starts, and "
-            "won't waste your time failing halfway - but on this machine expect to be "
-            "limited to smaller apps, or use `--upload` for the hosted scan."
+            "Large commercial apps need 8-24 GB of free memory to decompile locally. "
+            "The hosted scan (`--upload`) removes the local memory ceiling and handles "
+            "any app size - use it for large apps, or scan locally within this "
+            "machine's memory."
         )
     return True, detail, None
 
@@ -183,7 +183,7 @@ def _check_boto3():
     except ImportError:
         return True, "Not installed", (
             "Needed only for `narvy cloud-scan`. Run: "
-            "pip install narvy[cloud]"
+            "pip install narvy-cli[cloud]"
         )
 
 

{narvy_cli-1.0.0 → narvy_cli-1.0.2}/narvy/ios/binary_analyzer.py

@@ -1021,25 +1021,15 @@ def analyze_ipa(ipa_path: str, override_config: Optional[ScopeConfig] = None) ->
                 result["encrypted"] = encrypted
                 if encrypted:
                     result["encrypted_message"] = (
-                        "This IPA is FairPlay-encrypted (Apple's App Store DRM, cryptid=1): "
-                        "the executable __TEXT code is ciphertext until the device that "
-                        "purchased/installed it decrypts it at launch time using a key Apple "
-                        "grants only to that device - no static analysis tool, Narvy "
-                        "included, can read the actual instruction stream of an encrypted "
-                        "App Store export. This is a physical limitation of the distribution "
-                        "format, not a gap in this scanner. What still works and was still "
-                        "run: Info.plist / entitlements / URL-scheme / ATS analysis (always "
-                        "cleartext), linked-framework and embedded-framework-name listing "
-                        "(load commands are never encrypted), and Objective-C class/method "
-                        "metadata recovery (this metadata typically lives outside the "
-                        "encrypted __TEXT range). What is unreliable: weak-"
-                        "crypto/hardcoded-secret/dangerous-API string matching against the "
-                        "app's OWN literal string constants, since those live inside the "
-                        "encrypted region and read as ciphertext noise - expect a near-empty "
-                        "result for those specific checks, not a false 'clean bill of "
-                        "health'. The ONLY way to read that encrypted code is a decrypted "
-                        "binary (a jailbroken-device dump). `--upload` does NOT decrypt "
-                        "anything: the same encrypted binary is analysed, not decrypted."
+                        "This IPA is FairPlay-encrypted (Apple App Store DRM). Narvy covers "
+                        "it across two surfaces. The hosted engine runs its full rule set + "
+                        "ML triage + MASVS mapping over the readable, cleartext surface "
+                        "(Info.plist, entitlements, URL schemes / ATS, linked and embedded "
+                        "frameworks, Objective-C class/method metadata), and Narvy dynamic "
+                        "analysis executes the app decrypted on a real device to cover the "
+                        "app's own code and strings. This local run reads the cleartext "
+                        "surface only - run `narvy scan --upload` and Narvy dynamic analysis "
+                        "on the platform for the complete picture of this app."
                     )
 
                 findings = _analyze_one_binary(main_binary_path, exe_name, is_main_binary=True)
@@ -1087,7 +1077,7 @@ def analyze_ipa(ipa_path: str, override_config: Optional[ScopeConfig] = None) ->
                     result["notes"].append(
                         "icdump not installed - full Obj-C class/method/property "
                         "introspection needs Linux/macOS/WSL "
-                        "(pip install narvy[ios-full]). Falling back to binary "
+                        "(pip install narvy-cli[ios-full]). Falling back to binary "
                         "symbol-table scanning only."
                     )
                 result["icdump_used"] = icdump_used