proofctl 0.4.2__tar.gz → 0.4.3__tar.gz

{proofctl-0.4.2/proofctl.egg-info → proofctl-0.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.4.2
+Version: 0.4.3
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT
@@ -28,7 +28,7 @@ Dynamic: license-file
 
 # proofctl
 
-A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **264 rules**, zero dependencies, runs in under a second.
+A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **267 rules**, zero dependencies, runs in under a second.
 
 ```
 proofctl check .
@@ -165,7 +165,7 @@ git commit -m "chore: add proofctl baseline"
 
 ## Rules
 
-264 rules across 14 families. Run `proofctl rules` after install to enumerate.
+267 rules across 14 families. Run `proofctl rules` after install to enumerate.
 
 | Family | Count | What it covers |
 |---|---|---|
@@ -173,9 +173,9 @@ git commit -m "chore: add proofctl baseline"
 | Python — Security (`S`) | 24 | OWASP Top-10 + CWE coverage: SQLi, command injection, weak crypto, JWT bypass, path traversal, XSS, SSRF, file upload, CSRF, missing authz, XPath injection, open redirect, TLS bypass |
 | Secrets (`SECRET`) | 13 | AWS / GCP / GitHub / Slack / Stripe / private keys / JWTs / hardcoded passwords / K8s Secret YAML / connection strings with embedded creds |
 | Python — Other | 12 | Placeholders, leakage (cross-language idioms, PII), import hallucination, method complexity, variant detection, LLM guardrails (OWASP LLM Top-10) |
-| Terraform — General + AI (`TF-T`, `TF-AI`) | 26 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values |
+| Terraform — General + AI (`TF-T`, `TF-AI`) | 28 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata |
 | Terraform — AWS (`TF-A`) | 40 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
-| Terraform — GCP (`TF-G`) | 50 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL, firewall ingress |
+| Terraform — GCP (`TF-G`) | 51 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL, firewall ingress, compute access scopes |
 | Terraform — Azure (`TF-AZ`) | 14 | Storage public blob, SQL public network, AKS RBAC, Key Vault purge protection, NSG SSH/RDP, managed disk CMK |
 | Terraform — Mechanics + Lifecycle (`TF-M`, `TF-V`) | 12 | SG inline mixing, `force_destroy`, mutable module refs, lifecycle antipatterns |
 | Terragrunt (`TG`) | 6 | HCL inputs, mock_outputs, remote state encryption |

{proofctl-0.4.2 → proofctl-0.4.3}/README.md

@@ -1,6 +1,6 @@
 # proofctl
 
-A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **264 rules**, zero dependencies, runs in under a second.
+A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **267 rules**, zero dependencies, runs in under a second.
 
 ```
 proofctl check .
@@ -137,7 +137,7 @@ git commit -m "chore: add proofctl baseline"
 
 ## Rules
 
-264 rules across 14 families. Run `proofctl rules` after install to enumerate.
+267 rules across 14 families. Run `proofctl rules` after install to enumerate.
 
 | Family | Count | What it covers |
 |---|---|---|
@@ -145,9 +145,9 @@ git commit -m "chore: add proofctl baseline"
 | Python — Security (`S`) | 24 | OWASP Top-10 + CWE coverage: SQLi, command injection, weak crypto, JWT bypass, path traversal, XSS, SSRF, file upload, CSRF, missing authz, XPath injection, open redirect, TLS bypass |
 | Secrets (`SECRET`) | 13 | AWS / GCP / GitHub / Slack / Stripe / private keys / JWTs / hardcoded passwords / K8s Secret YAML / connection strings with embedded creds |
 | Python — Other | 12 | Placeholders, leakage (cross-language idioms, PII), import hallucination, method complexity, variant detection, LLM guardrails (OWASP LLM Top-10) |
-| Terraform — General + AI (`TF-T`, `TF-AI`) | 26 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values |
+| Terraform — General + AI (`TF-T`, `TF-AI`) | 28 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata |
 | Terraform — AWS (`TF-A`) | 40 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
-| Terraform — GCP (`TF-G`) | 50 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL, firewall ingress |
+| Terraform — GCP (`TF-G`) | 51 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL, firewall ingress, compute access scopes |
 | Terraform — Azure (`TF-AZ`) | 14 | Storage public blob, SQL public network, AKS RBAC, Key Vault purge protection, NSG SSH/RDP, managed disk CMK |
 | Terraform — Mechanics + Lifecycle (`TF-M`, `TF-V`) | 12 | SG inline mixing, `force_destroy`, mutable module refs, lifecycle antipatterns |
 | Terragrunt (`TG`) | 6 | HCL inputs, mock_outputs, remote state encryption |

{proofctl-0.4.2 → proofctl-0.4.3}/proofctl/checkers/terraform.py

@@ -294,6 +294,7 @@ class TerraformChecker(HclFileChecker):
         out += self._g044(path, blocks)
         out += self._g045(path, blocks)
         out += self._g046(path, blocks)
+        out += self._g047(path, blocks)
 
         # Group AZ — Azure
         out += self._az001(path, blocks)
@@ -327,6 +328,8 @@ class TerraformChecker(HclFileChecker):
         out += self._ai009(path, lines)
         out += self._ai010(path, lines)
         out += self._ai011(path, lines)
+        out += self._ai012(path, blocks)
+        out += self._ai013(path, blocks)
 
         return out
 
@@ -2935,6 +2938,36 @@ class TerraformChecker(HclFileChecker):
                     break
         return out
 
+    def _g047(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
+        """G-047 — Compute instance with `cloud-platform` access scope.
+
+        Access scopes are a coarse, IAM-bypassing layer on top of service-account
+        permissions. `cloud-platform` grants the metadata server permission to
+        mint tokens for every GCP API — so any role the SA ever acquires becomes
+        immediately usable from the VM. Best practice: rely on IAM only, and
+        narrow the scope to `cloud-platform.read-only` or use the default
+        scopes set with explicit IAM roles.
+        """
+        out = []
+        for b in blocks:
+            if b.kind != "resource" or b.label1 != "google_compute_instance":
+                continue
+            for sa in b.nested("service_account"):
+                # Match "cloud-platform" exactly inside the scopes list — not
+                # cloud-platform.read-only or other narrower scopes.
+                if sa.contains(r'"cloud-platform"'):
+                    out.append(self._f(
+                        path, sa.attr_line("scopes") or sa.start_line,
+                        "PROOFCTL-TF-G047", "Compute instance with cloud-platform scope",
+                        Severity.WARNING,
+                        f'google_compute_instance "{b.label2}" has access scope "cloud-platform" — broadest possible API access',
+                        hint='Use narrower scopes (e.g. "cloud-platform.read-only") or omit and rely on IAM bindings on the service account.',
+                        authority="GCP Compute Engine — Access scopes vs IAM",
+                        docs_url="https://cloud.google.com/compute/docs/access/service-accounts#scopes_best_practice",
+                    ))
+                    break
+        return out
+
     # ════════════════════════════════════════════════════════════════════════
     # Group AZ — Azure data-exfiltration rules (extended)
     # ════════════════════════════════════════════════════════════════════════
@@ -3328,6 +3361,152 @@ class TerraformChecker(HclFileChecker):
             ))
         return out
 
+    # GCE boot disk that references an image *family* rather than a specific
+    # image is the GCP equivalent of `:latest` — Google promotes new images
+    # into a family on its own schedule. Any apply that triggers VM rebuild
+    # picks up whatever's current that day. Sneaky drift / surprise OS upgrade
+    # vector that AI tools default to because the canonical examples use it.
+    _IMAGE_FAMILY_RE = re.compile(
+        r'image\s*=\s*"[^"]*?/images/family/[^"]+"',
+    )
+
+    def _ai012(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
+        """AI-012 — GCE boot disk references an image *family* (mutable)."""
+        out = []
+        for b in blocks:
+            if b.kind != "resource" or b.label1 != "google_compute_instance":
+                continue
+            for bd in b.nested("boot_disk"):
+                # `image` can live either directly on boot_disk or inside
+                # the nested initialize_params block.
+                targets = [bd] + bd.nested("initialize_params")
+                for t in targets:
+                    line = t.any_line_matches(self._IMAGE_FAMILY_RE.pattern)
+                    if line is not None:
+                        out.append(self._f(
+                            path, line,
+                            "PROOFCTL-TF-AI-012",
+                            "GCE boot disk uses image family (mutable)",
+                            Severity.WARNING,
+                            f'google_compute_instance "{b.label2}" references an image family — Google promotes new images into the family at any time',
+                            hint="Pin to a specific image name (e.g. ubuntu-2404-amd64-20251101) or set lifecycle { ignore_changes = [boot_disk[0].initialize_params[0].image] } to opt out of rebuilds.",
+                            authority="GCP Compute Engine — Image families",
+                            docs_url="https://cloud.google.com/compute/docs/images/image-families-best-practices",
+                        ))
+                        break  # one finding per boot_disk is enough
+        return out
+
+    # Variables likely to hold credential material — used by AI-013 to decide
+    # which `var.X` references are dangerous to embed in compute metadata.
+    # Aligns with the SECRET-007 name set so engineers don't have to learn
+    # two parallel taxonomies.
+    _SENSITIVE_VAR_NAME_RE = re.compile(
+        r"\bvar\.((?:[a-zA-Z0-9_]*_)?"
+        r"(?:password|passwd|pwd|secret|token|api[_-]?key|access[_-]?key|"
+        r"private[_-]?key|client[_-]?secret|encryption[_-]?key|auth[_-]?token|"
+        r"bearer[_-]?token|jwt|credential|tunnel[_-]?token)"
+        r"[a-zA-Z0-9_]*)\b",
+        re.IGNORECASE,
+    )
+
+    @staticmethod
+    def _line_range_of_attr(
+        block: HclBlock, attr_name: str
+    ) -> tuple[int, int] | None:
+        """Find (start_idx, end_idx) into block.raw_lines that span the attribute
+        ``attr_name = <value>`` including any continuation lines opened by
+        parentheses or brackets.
+
+        Returns indices relative to ``block.raw_lines`` (0-based), inclusive of
+        the closing bracket / paren line. Returns None if the attribute is not
+        present.
+        """
+        head = re.compile(rf"^\s*{re.escape(attr_name)}\s*=\s*(.*)$")
+        for i, line in enumerate(block.raw_lines):
+            m = head.match(line)
+            if not m:
+                continue
+            rest = m.group(1)
+            depth = rest.count("(") + rest.count("[") + rest.count("{")
+            depth -= rest.count(")") + rest.count("]") + rest.count("}")
+            if depth <= 0:
+                return (i, i)
+            j = i + 1
+            while j < len(block.raw_lines) and depth > 0:
+                ln = block.raw_lines[j]
+                depth += ln.count("(") + ln.count("[") + ln.count("{")
+                depth -= ln.count(")") + ln.count("]") + ln.count("}")
+                j += 1
+            return (i, j - 1)
+        return None
+
+    def _ai013(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
+        """AI-013 — Sensitive variable interpolated into compute metadata.
+
+        Pattern: `var.<secret-shaped-name>` appears inside ``metadata_startup_script``
+        or any nested ``metadata { ... }`` block on a ``google_compute_instance``
+        resource.
+
+        Risk: anything that ends up in VM metadata is readable by any caller
+        with ``compute.instances.get`` and is written to plan / state. The
+        Cloudflare-tunnel-in-startup-script pattern is the canonical AI-slop
+        instance.
+        """
+        out = []
+        seen: set[tuple[Path, int]] = set()
+
+        def _emit(b: HclBlock, line: int, var_name: str, surface: str) -> None:
+            key = (path, line)
+            if key in seen:
+                return
+            seen.add(key)
+            out.append(self._f(
+                path, line,
+                "PROOFCTL-TF-AI-013",
+                "Sensitive variable in compute metadata",
+                Severity.ERROR,
+                f'google_compute_instance "{b.label2}" passes var.{var_name} into {surface} — secret will be readable from VM metadata and visible in plan/state',
+                hint=(
+                    "Mount the secret from Secret Manager inside the VM at runtime "
+                    "(google_secret_manager_secret_iam_member + a startup script that "
+                    "calls `gcloud secrets versions access`). Do not bake the value into metadata."
+                ),
+                authority="CIS GCP Benchmark 4.6 / OWASP A02 Cryptographic Failures",
+                docs_url="https://cloud.google.com/compute/docs/metadata/overview#metadata_security_considerations",
+            ))
+
+        for b in blocks:
+            if b.kind != "resource" or b.label1 != "google_compute_instance":
+                continue
+            # 1. Scan metadata_startup_script line range.
+            rng = self._line_range_of_attr(b, "metadata_startup_script")
+            if rng is not None:
+                lo, hi = rng
+                for offset in range(lo, hi + 1):
+                    line_text = b.raw_lines[offset]
+                    m = self._SENSITIVE_VAR_NAME_RE.search(line_text)
+                    if m:
+                        _emit(b, b.start_line + offset, m.group(1),
+                              "metadata_startup_script")
+            # 2. Scan nested metadata { ... } blocks (HCL block form).
+            for md in b.nested("metadata"):
+                for offset, line_text in enumerate(md.raw_lines):
+                    m = self._SENSITIVE_VAR_NAME_RE.search(line_text)
+                    if m:
+                        _emit(b, md.start_line + offset, m.group(1),
+                              "metadata block")
+            # 3. Scan metadata = { ... } attribute (HCL object-attribute form).
+            rng = self._line_range_of_attr(b, "metadata")
+            if rng is not None:
+                lo, hi = rng
+                for offset in range(lo, hi + 1):
+                    line_text = b.raw_lines[offset]
+                    m = self._SENSITIVE_VAR_NAME_RE.search(line_text)
+                    if m:
+                        _emit(b, b.start_line + offset, m.group(1),
+                              "metadata block")
+        return out
+
 
 # ── Directory-level checker (cross-file rules) ───────────────────────────────
 

{proofctl-0.4.2 → proofctl-0.4.3/proofctl.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.4.2
+Version: 0.4.3
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT
@@ -28,7 +28,7 @@ Dynamic: license-file
 
 # proofctl
 
-A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **264 rules**, zero dependencies, runs in under a second.
+A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **267 rules**, zero dependencies, runs in under a second.
 
 ```
 proofctl check .
@@ -165,7 +165,7 @@ git commit -m "chore: add proofctl baseline"
 
 ## Rules
 
-264 rules across 14 families. Run `proofctl rules` after install to enumerate.
+267 rules across 14 families. Run `proofctl rules` after install to enumerate.
 
 | Family | Count | What it covers |
 |---|---|---|
@@ -173,9 +173,9 @@ git commit -m "chore: add proofctl baseline"
 | Python — Security (`S`) | 24 | OWASP Top-10 + CWE coverage: SQLi, command injection, weak crypto, JWT bypass, path traversal, XSS, SSRF, file upload, CSRF, missing authz, XPath injection, open redirect, TLS bypass |
 | Secrets (`SECRET`) | 13 | AWS / GCP / GitHub / Slack / Stripe / private keys / JWTs / hardcoded passwords / K8s Secret YAML / connection strings with embedded creds |
 | Python — Other | 12 | Placeholders, leakage (cross-language idioms, PII), import hallucination, method complexity, variant detection, LLM guardrails (OWASP LLM Top-10) |
-| Terraform — General + AI (`TF-T`, `TF-AI`) | 26 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values |
+| Terraform — General + AI (`TF-T`, `TF-AI`) | 28 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata |
 | Terraform — AWS (`TF-A`) | 40 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
-| Terraform — GCP (`TF-G`) | 50 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL, firewall ingress |
+| Terraform — GCP (`TF-G`) | 51 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL, firewall ingress, compute access scopes |
 | Terraform — Azure (`TF-AZ`) | 14 | Storage public blob, SQL public network, AKS RBAC, Key Vault purge protection, NSG SSH/RDP, managed disk CMK |
 | Terraform — Mechanics + Lifecycle (`TF-M`, `TF-V`) | 12 | SG inline mixing, `force_destroy`, mutable module refs, lifecycle antipatterns |
 | Terragrunt (`TG`) | 6 | HCL inputs, mock_outputs, remote state encryption |

{proofctl-0.4.2 → proofctl-0.4.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofctl"
-version = "0.4.2"
+version = "0.4.3"
 description = "Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit"
 readme = "README.md"
 license = { text = "MIT" }