proofctl 0.4.2__tar.gz → 0.5.0__tar.gz

{proofctl-0.4.2/proofctl.egg-info → proofctl-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.4.2
+Version: 0.5.0
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT
@@ -28,7 +28,7 @@ Dynamic: license-file
 
 # proofctl
 
-A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **264 rules**, zero dependencies, runs in under a second.
+A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **269 rules**, zero dependencies, runs in under a second.
 
 ```
 proofctl check .
@@ -165,7 +165,7 @@ git commit -m "chore: add proofctl baseline"
 
 ## Rules
 
-264 rules across 14 families. Run `proofctl rules` after install to enumerate.
+269 rules across 14 families. Run `proofctl rules` after install to enumerate.
 
 | Family | Count | What it covers |
 |---|---|---|
@@ -173,9 +173,9 @@ git commit -m "chore: add proofctl baseline"
 | Python — Security (`S`) | 24 | OWASP Top-10 + CWE coverage: SQLi, command injection, weak crypto, JWT bypass, path traversal, XSS, SSRF, file upload, CSRF, missing authz, XPath injection, open redirect, TLS bypass |
 | Secrets (`SECRET`) | 13 | AWS / GCP / GitHub / Slack / Stripe / private keys / JWTs / hardcoded passwords / K8s Secret YAML / connection strings with embedded creds |
 | Python — Other | 12 | Placeholders, leakage (cross-language idioms, PII), import hallucination, method complexity, variant detection, LLM guardrails (OWASP LLM Top-10) |
-| Terraform — General + AI (`TF-T`, `TF-AI`) | 26 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values |
+| Terraform — General + AI (`TF-T`, `TF-AI`) | 29 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata, unused variable declarations |
 | Terraform — AWS (`TF-A`) | 40 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
-| Terraform — GCP (`TF-G`) | 50 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL, firewall ingress |
+| Terraform — GCP (`TF-G`) | 52 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |
 | Terraform — Azure (`TF-AZ`) | 14 | Storage public blob, SQL public network, AKS RBAC, Key Vault purge protection, NSG SSH/RDP, managed disk CMK |
 | Terraform — Mechanics + Lifecycle (`TF-M`, `TF-V`) | 12 | SG inline mixing, `force_destroy`, mutable module refs, lifecycle antipatterns |
 | Terragrunt (`TG`) | 6 | HCL inputs, mock_outputs, remote state encryption |

{proofctl-0.4.2 → proofctl-0.5.0}/README.md

@@ -1,6 +1,6 @@
 # proofctl
 
-A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **264 rules**, zero dependencies, runs in under a second.
+A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **269 rules**, zero dependencies, runs in under a second.
 
 ```
 proofctl check .
@@ -137,7 +137,7 @@ git commit -m "chore: add proofctl baseline"
 
 ## Rules
 
-264 rules across 14 families. Run `proofctl rules` after install to enumerate.
+269 rules across 14 families. Run `proofctl rules` after install to enumerate.
 
 | Family | Count | What it covers |
 |---|---|---|
@@ -145,9 +145,9 @@ git commit -m "chore: add proofctl baseline"
 | Python — Security (`S`) | 24 | OWASP Top-10 + CWE coverage: SQLi, command injection, weak crypto, JWT bypass, path traversal, XSS, SSRF, file upload, CSRF, missing authz, XPath injection, open redirect, TLS bypass |
 | Secrets (`SECRET`) | 13 | AWS / GCP / GitHub / Slack / Stripe / private keys / JWTs / hardcoded passwords / K8s Secret YAML / connection strings with embedded creds |
 | Python — Other | 12 | Placeholders, leakage (cross-language idioms, PII), import hallucination, method complexity, variant detection, LLM guardrails (OWASP LLM Top-10) |
-| Terraform — General + AI (`TF-T`, `TF-AI`) | 26 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values |
+| Terraform — General + AI (`TF-T`, `TF-AI`) | 29 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata, unused variable declarations |
 | Terraform — AWS (`TF-A`) | 40 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
-| Terraform — GCP (`TF-G`) | 50 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL, firewall ingress |
+| Terraform — GCP (`TF-G`) | 52 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |
 | Terraform — Azure (`TF-AZ`) | 14 | Storage public blob, SQL public network, AKS RBAC, Key Vault purge protection, NSG SSH/RDP, managed disk CMK |
 | Terraform — Mechanics + Lifecycle (`TF-M`, `TF-V`) | 12 | SG inline mixing, `force_destroy`, mutable module refs, lifecycle antipatterns |
 | Terragrunt (`TG`) | 6 | HCL inputs, mock_outputs, remote state encryption |

{proofctl-0.4.2 → proofctl-0.5.0}/proofctl/checkers/terraform.py

@@ -53,44 +53,54 @@ _FIREWALL_RESOURCES = frozenset({
 })
 
 
-def _aws_sg_has_open_ingress(raw_lines: list[str]) -> bool:
-    """Walk an aws_security_group block's lines and return True iff
-    0.0.0.0/0 appears inside an ``ingress { ... }`` sub-block.
-
-    aws_security_group has both inline ``ingress`` and ``egress`` blocks;
-    open egress is normal and should not trigger T-004. Open ingress is
-    the actual finding.
+def _aws_sg_open_ingress_lines(raw_lines: list[str]) -> list[str]:
+    """Return the lines from every ``ingress { ... }`` sub-block in an
+    ``aws_security_group`` body that contains 0.0.0.0/0.
+
+    ``aws_security_group`` declares ``ingress`` and ``egress`` as inline
+    sub-blocks. Open egress is normal (workloads need outbound), so T-004
+    must ignore the egress block entirely — including its ``protocol``
+    and port attributes. This helper returns only the lines from
+    qualifying ingress sub-blocks; the caller scopes port / all-traffic
+    checks to those lines.
     """
-    depth = 0
-    in_ingress = False
-    in_egress = False
-    block_depth = 0
     sub_re = re.compile(r"^\s*(ingress|egress)\s*\{")
+    in_kind: str | None = None
+    block_depth = 0
+    buffer: list[str] = []
+    result: list[str] = []
+    bare_root_lines: list[str] = []
+
     for line in raw_lines:
-        if not in_ingress and not in_egress:
+        if in_kind is None:
             m = sub_re.match(line)
             if m:
-                if m.group(1) == "ingress":
-                    in_ingress = True
-                else:
-                    in_egress = True
+                in_kind = m.group(1)
                 block_depth = line.count("{") - line.count("}")
+                buffer = [line]
                 continue
-        if in_ingress or in_egress:
-            block_depth += line.count("{") - line.count("}")
-            if in_ingress and re.search(r'"0\.0\.0\.0/0"', line):
-                return True
-            if block_depth <= 0:
-                in_ingress = False
-                in_egress = False
-                block_depth = 0
+            # Bare 0.0.0.0/0 at resource level (rare) — collect separately.
+            if re.search(r'"0\.0\.0\.0/0"', line):
+                bare_root_lines.append(line)
             continue
-        # Outside any sub-block — bare 0.0.0.0/0 at the resource level
-        # is uncommon for aws_security_group, but if it appears we
-        # conservatively treat it as ingress-relevant.
-        if re.search(r'"0\.0\.0\.0/0"', line):
-            return True
-    return False
+
+        block_depth += line.count("{") - line.count("}")
+        buffer.append(line)
+        if block_depth <= 0:
+            if in_kind == "ingress" and any(
+                re.search(r'"0\.0\.0\.0/0"', ln) for ln in buffer
+            ):
+                result.extend(buffer)
+            in_kind = None
+            block_depth = 0
+            buffer = []
+
+    return result + bare_root_lines
+
+
+def _aws_sg_has_open_ingress(raw_lines: list[str]) -> bool:
+    """True iff 0.0.0.0/0 appears in any ingress sub-block of an aws_security_group."""
+    return bool(_aws_sg_open_ingress_lines(raw_lines))
 
 # Ports that should never accept 0.0.0.0/0
 _SENSITIVE_PORTS = frozenset({22, 23, 25, 3306, 3389, 5432, 5439, 6379, 27017})
@@ -246,7 +256,7 @@ class TerraformChecker(HclFileChecker):
         out += self._a008(path, blocks)
         out += self._a009(path, blocks)
         out += self._a010(path, blocks)
-        out += self._a011(path, blocks)
+        # A-011 moved to TerraformDirChecker._a011_scan_level (fires once per scan).
         out += self._a012(path, blocks)
         out += self._a013(path, blocks)
         out += self._a014(path, blocks)
@@ -294,6 +304,7 @@ class TerraformChecker(HclFileChecker):
         out += self._g044(path, blocks)
         out += self._g045(path, blocks)
         out += self._g046(path, blocks)
+        out += self._g047(path, blocks)
 
         # Group AZ — Azure
         out += self._az001(path, blocks)
@@ -327,6 +338,8 @@ class TerraformChecker(HclFileChecker):
         out += self._ai009(path, lines)
         out += self._ai010(path, lines)
         out += self._ai011(path, lines)
+        out += self._ai012(path, blocks)
+        out += self._ai013(path, blocks)
 
         return out
 
@@ -501,25 +514,34 @@ class TerraformChecker(HclFileChecker):
             if not b.contains(r'0\.0\.0\.0/0'):
                 continue
 
-            # Skip egress-only rules.
+            # Decide which lines define the open ingress for port/protocol
+            # checks. For aws_security_group (which has inline ingress AND
+            # egress sub-blocks) we MUST scope to the ingress sub-block — the
+            # egress block's `protocol = "-1"` would otherwise spoof an
+            # all-traffic verdict.
+            scoped_lines: list[str]
+
             if b.label1 == "aws_security_group_rule":
                 rule_type = (b.attr_value("type") or "").strip().strip('"').lower()
                 if rule_type == "egress":
                     continue
+                scoped_lines = list(b.raw_lines)
             elif b.label1 == "google_compute_firewall":
                 direction = (b.attr_value("direction") or "").strip().strip('"').upper()
                 if direction == "EGRESS":
                     continue
+                scoped_lines = list(b.raw_lines)
             elif b.label1 == "aws_security_group":
-                # 0.0.0.0/0 in an inline egress { } block is fine — only flag
-                # if 0.0.0.0/0 appears inside an ingress block (or there is
-                # no egress block at all).
-                if not _aws_sg_has_open_ingress(b.raw_lines):
+                scoped_lines = _aws_sg_open_ingress_lines(b.raw_lines)
+                if not scoped_lines:
                     continue
+            else:
+                scoped_lines = list(b.raw_lines)
 
-            # Check if sensitive ports are involved
+            # Check if sensitive ports are involved (scoped to ingress only
+            # for aws_security_group).
             ports: set[int] = set()
-            for line in b.raw_lines:
+            for line in scoped_lines:
                 pm = port_re.search(line)
                 if pm:
                     try:
@@ -527,7 +549,7 @@ class TerraformChecker(HclFileChecker):
                     except ValueError:
                         pass
 
-            if all_traffic_re.search('\n'.join(b.raw_lines)):
+            if all_traffic_re.search('\n'.join(scoped_lines)):
                 # -1 or all traffic — always sensitive
                 flagged_ports = "all traffic"
             elif ports & _SENSITIVE_PORTS:
@@ -568,14 +590,33 @@ class TerraformChecker(HclFileChecker):
         return out
 
     def _t006(self, path: Path, lines: list[str]) -> list[Finding]:
-        """T-006 — IAM wildcard in actions or resources."""
-        # Match: actions = ["*"] or resources = ["*"] (with possible extra items)
-        pat = re.compile(r'(?:actions|not_actions|resources|not_resources)\s*=\s*\[[^\]]*"\*"')
+        """T-006 — IAM wildcard in actions or resources.
+
+        Matches both shapes:
+
+        1. Terraform-native (``data "aws_iam_policy_document"``):
+           ``actions = ["*"]`` / ``resources = ["*"]``
+        2. AWS JSON policy embedded via ``jsonencode({ Statement = [...] })``:
+           ``Action = "*"`` / ``Resource = "*"`` (bare string) and
+           ``Action = ["*"]`` / ``Resource = ["foo", "*"]`` (list form).
+
+        The capitalised keys + bare-string value were previously uncovered.
+        """
+        # Terraform-native form (lowercase, list-only).
+        tf_pat = re.compile(
+            r'(?:actions|not_actions|resources|not_resources)\s*=\s*\[[^\]]*"\*"'
+        )
+        # AWS JSON policy form (capitalised, accepts bare "*" or list).
+        json_pat = re.compile(
+            r'(?:Action|NotAction|Resource|NotResource)\s*=\s*'
+            r'(?:"\*"|\[[^\]]*"\*"[^\]]*\])'
+        )
         out = []
         for i, line in enumerate(lines, start=1):
-            if line.strip().startswith("#"):
+            stripped = line.strip()
+            if stripped.startswith("#") or stripped.startswith("//"):
                 continue
-            if pat.search(line):
+            if tf_pat.search(line) or json_pat.search(line):
                 out.append(self._f(
                     path, i,
                     "PROOFCTL-TF-T006", "IAM wildcard permission",
@@ -1033,21 +1074,37 @@ class TerraformChecker(HclFileChecker):
         return out
 
     def _g009(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
-        """G-009 — Cloud SQL SSL not required."""
+        """G-009 — Cloud SQL TLS explicitly disabled.
+
+        Fires on either explicit-insecure shape:
+          - Legacy:  ``require_ssl = false``
+          - Modern (provider 5.x+):  ``ssl_mode = "ALLOW_UNENCRYPTED_AND_ENCRYPTED"``
+
+        Does NOT fire on omission of both fields — that case is covered
+        by G-043 (Cloud SQL not requiring SSL). Together the two rules
+        provide orthogonal coverage of the Cloud SQL TLS posture.
+        """
         out = []
+        insecure_legacy_pat = r'require_ssl\s*=\s*false'
+        insecure_modern_pat = r'ssl_mode\s*=\s*"ALLOW_UNENCRYPTED_AND_ENCRYPTED"'
         for b in blocks:
             if b.kind != "resource" or b.label1 != "google_sql_database_instance":
                 continue
-            if b.contains(r'require_ssl\s*=\s*false'):
-                out.append(self._f(
-                    path, b.any_line_matches(r'require_ssl\s*=\s*false') or b.start_line,
-                    "PROOFCTL-TF-G009", "Cloud SQL SSL not required",
-                    Severity.ERROR,
-                    f'SQL instance "{b.label2}" has require_ssl = false',
-                    hint="Set require_ssl = true to enforce TLS for all client connections.",
-                    authority="CIS GCP Benchmark 6.4",
-                    docs_url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform",
-                ))
+            legacy_line = b.any_line_matches(insecure_legacy_pat)
+            modern_line = b.any_line_matches(insecure_modern_pat)
+            if legacy_line is None and modern_line is None:
+                continue
+            line = legacy_line or modern_line
+            detail = "require_ssl = false" if legacy_line else 'ssl_mode = "ALLOW_UNENCRYPTED_AND_ENCRYPTED"'
+            out.append(self._f(
+                path, line or b.start_line,
+                "PROOFCTL-TF-G009", "Cloud SQL TLS explicitly disabled",
+                Severity.ERROR,
+                f'SQL instance "{b.label2}" has TLS explicitly disabled ({detail})',
+                hint='Set ssl_mode = "ENCRYPTED_ONLY" (or "TRUSTED_CLIENT_CERTIFICATE_REQUIRED") to enforce TLS for all client connections.',
+                authority="CIS GCP Benchmark 6.4",
+                docs_url="https://cloud.google.com/sql/docs/mysql/configure-ssl-instance",
+            ))
         return out
 
     def _g010(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
@@ -2861,19 +2918,33 @@ class TerraformChecker(HclFileChecker):
         return out
 
     def _g043(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
-        """G-043 — Cloud SQL instance without require_ssl."""
+        """G-043 — Cloud SQL TLS not enforced (no enforcement attribute set).
+
+        Fires when NONE of the safe enforcement attributes are present:
+          - Legacy:  ``require_ssl = true``
+          - Modern (provider 5.x+):  ``ssl_mode = "ENCRYPTED_ONLY"`` OR
+                                     ``ssl_mode = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"``
+
+        Without one of these, Cloud SQL accepts unencrypted connections
+        by default. G-009 covers the *explicit* opt-out cases; this rule
+        covers the *implicit* opt-out (omission).
+        """
         out = []
+        require_ssl_true = r'require_ssl\s*=\s*true'
+        ssl_mode_enforced = (
+            r'ssl_mode\s*=\s*"(?:ENCRYPTED_ONLY|TRUSTED_CLIENT_CERTIFICATE_REQUIRED)"'
+        )
         for b in blocks:
             if b.kind != "resource" or b.label1 != "google_sql_database_instance":
                 continue
-            if b.contains(r'require_ssl\s*=\s*true'):
+            if b.contains(require_ssl_true) or b.contains(ssl_mode_enforced):
                 continue
             out.append(self._f(
                 path, b.start_line,
-                "PROOFCTL-TF-G043", "Cloud SQL not requiring SSL",
+                "PROOFCTL-TF-G043", "Cloud SQL TLS not enforced",
                 Severity.ERROR,
-                f'google_sql_database_instance "{b.label2}" does not require SSL/TLS connections',
-                hint="Set settings.ip_configuration.require_ssl = true.",
+                f'google_sql_database_instance "{b.label2}" does not enforce TLS — no require_ssl = true or ssl_mode = ENCRYPTED_ONLY present',
+                hint='Set settings.ip_configuration.ssl_mode = "ENCRYPTED_ONLY" (preferred; provider 5.x+) or settings.ip_configuration.require_ssl = true (legacy).',
                 authority="CIS GCP Benchmark 6.4",
                 docs_url="https://cloud.google.com/sql/docs/mysql/configure-ssl-instance",
             ))
@@ -2935,6 +3006,36 @@ class TerraformChecker(HclFileChecker):
                     break
         return out
 
+    def _g047(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
+        """G-047 — Compute instance with `cloud-platform` access scope.
+
+        Access scopes are a coarse, IAM-bypassing layer on top of service-account
+        permissions. `cloud-platform` grants the metadata server permission to
+        mint tokens for every GCP API — so any role the SA ever acquires becomes
+        immediately usable from the VM. Best practice: rely on IAM only, and
+        narrow the scope to `cloud-platform.read-only` or use the default
+        scopes set with explicit IAM roles.
+        """
+        out = []
+        for b in blocks:
+            if b.kind != "resource" or b.label1 != "google_compute_instance":
+                continue
+            for sa in b.nested("service_account"):
+                # Match "cloud-platform" exactly inside the scopes list — not
+                # cloud-platform.read-only or other narrower scopes.
+                if sa.contains(r'"cloud-platform"'):
+                    out.append(self._f(
+                        path, sa.attr_line("scopes") or sa.start_line,
+                        "PROOFCTL-TF-G047", "Compute instance with cloud-platform scope",
+                        Severity.WARNING,
+                        f'google_compute_instance "{b.label2}" has access scope "cloud-platform" — broadest possible API access',
+                        hint='Use narrower scopes (e.g. "cloud-platform.read-only") or omit and rely on IAM bindings on the service account.',
+                        authority="GCP Compute Engine — Access scopes vs IAM",
+                        docs_url="https://cloud.google.com/compute/docs/access/service-accounts#scopes_best_practice",
+                    ))
+                    break
+        return out
+
     # ════════════════════════════════════════════════════════════════════════
     # Group AZ — Azure data-exfiltration rules (extended)
     # ════════════════════════════════════════════════════════════════════════
@@ -3328,28 +3429,244 @@ class TerraformChecker(HclFileChecker):
             ))
         return out
 
+    # GCE boot disk that references an image *family* rather than a specific
+    # image is the GCP equivalent of `:latest` — Google promotes new images
+    # into a family on its own schedule. Any apply that triggers VM rebuild
+    # picks up whatever's current that day. Sneaky drift / surprise OS upgrade
+    # vector that AI tools default to because the canonical examples use it.
+    _IMAGE_FAMILY_RE = re.compile(
+        r'image\s*=\s*"[^"]*?/images/family/[^"]+"',
+    )
+
+    def _ai012(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
+        """AI-012 — GCE boot disk references an image *family* (mutable)."""
+        out = []
+        for b in blocks:
+            if b.kind != "resource" or b.label1 != "google_compute_instance":
+                continue
+            for bd in b.nested("boot_disk"):
+                # `image` can live either directly on boot_disk or inside
+                # the nested initialize_params block.
+                targets = [bd] + bd.nested("initialize_params")
+                for t in targets:
+                    line = t.any_line_matches(self._IMAGE_FAMILY_RE.pattern)
+                    if line is not None:
+                        out.append(self._f(
+                            path, line,
+                            "PROOFCTL-TF-AI-012",
+                            "GCE boot disk uses image family (mutable)",
+                            Severity.WARNING,
+                            f'google_compute_instance "{b.label2}" references an image family — Google promotes new images into the family at any time',
+                            hint="Pin to a specific image name (e.g. ubuntu-2404-amd64-20251101) or set lifecycle { ignore_changes = [boot_disk[0].initialize_params[0].image] } to opt out of rebuilds.",
+                            authority="GCP Compute Engine — Image families",
+                            docs_url="https://cloud.google.com/compute/docs/images/image-families-best-practices",
+                        ))
+                        break  # one finding per boot_disk is enough
+        return out
+
+    # Variables likely to hold credential material — used by AI-013 to decide
+    # which `var.X` references are dangerous to embed in compute metadata.
+    # Aligns with the SECRET-007 name set so engineers don't have to learn
+    # two parallel taxonomies.
+    _SENSITIVE_VAR_NAME_RE = re.compile(
+        r"\bvar\.((?:[a-zA-Z0-9_]*_)?"
+        r"(?:password|passwd|pwd|secret|token|api[_-]?key|access[_-]?key|"
+        r"private[_-]?key|client[_-]?secret|encryption[_-]?key|auth[_-]?token|"
+        r"bearer[_-]?token|jwt|credential|tunnel[_-]?token)"
+        r"[a-zA-Z0-9_]*)\b",
+        re.IGNORECASE,
+    )
+
+    @staticmethod
+    def _line_range_of_attr(
+        block: HclBlock, attr_name: str
+    ) -> tuple[int, int] | None:
+        """Find (start_idx, end_idx) into block.raw_lines that span the attribute
+        ``attr_name = <value>`` including any continuation lines opened by
+        parentheses or brackets.
+
+        Returns indices relative to ``block.raw_lines`` (0-based), inclusive of
+        the closing bracket / paren line. Returns None if the attribute is not
+        present.
+        """
+        head = re.compile(rf"^\s*{re.escape(attr_name)}\s*=\s*(.*)$")
+        for i, line in enumerate(block.raw_lines):
+            m = head.match(line)
+            if not m:
+                continue
+            rest = m.group(1)
+            depth = rest.count("(") + rest.count("[") + rest.count("{")
+            depth -= rest.count(")") + rest.count("]") + rest.count("}")
+            if depth <= 0:
+                return (i, i)
+            j = i + 1
+            while j < len(block.raw_lines) and depth > 0:
+                ln = block.raw_lines[j]
+                depth += ln.count("(") + ln.count("[") + ln.count("{")
+                depth -= ln.count(")") + ln.count("]") + ln.count("}")
+                j += 1
+            return (i, j - 1)
+        return None
+
+    def _ai013(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
+        """AI-013 — Sensitive variable interpolated into compute metadata.
+
+        Pattern: `var.<secret-shaped-name>` appears inside ``metadata_startup_script``
+        or any nested ``metadata { ... }`` block on a ``google_compute_instance``
+        resource.
+
+        Risk: anything that ends up in VM metadata is readable by any caller
+        with ``compute.instances.get`` and is written to plan / state. The
+        Cloudflare-tunnel-in-startup-script pattern is the canonical AI-slop
+        instance.
+        """
+        out = []
+        seen: set[tuple[Path, int]] = set()
+
+        def _emit(b: HclBlock, line: int, var_name: str, surface: str) -> None:
+            key = (path, line)
+            if key in seen:
+                return
+            seen.add(key)
+            out.append(self._f(
+                path, line,
+                "PROOFCTL-TF-AI-013",
+                "Sensitive variable in compute metadata",
+                Severity.ERROR,
+                f'google_compute_instance "{b.label2}" passes var.{var_name} into {surface} — secret will be readable from VM metadata and visible in plan/state',
+                hint=(
+                    "Mount the secret from Secret Manager inside the VM at runtime "
+                    "(google_secret_manager_secret_iam_member + a startup script that "
+                    "calls `gcloud secrets versions access`). Do not bake the value into metadata."
+                ),
+                authority="CIS GCP Benchmark 4.6 / OWASP A02 Cryptographic Failures",
+                docs_url="https://cloud.google.com/compute/docs/metadata/overview#metadata_security_considerations",
+            ))
+
+        for b in blocks:
+            if b.kind != "resource" or b.label1 != "google_compute_instance":
+                continue
+            # 1. Scan metadata_startup_script line range.
+            rng = self._line_range_of_attr(b, "metadata_startup_script")
+            if rng is not None:
+                lo, hi = rng
+                for offset in range(lo, hi + 1):
+                    line_text = b.raw_lines[offset]
+                    m = self._SENSITIVE_VAR_NAME_RE.search(line_text)
+                    if m:
+                        _emit(b, b.start_line + offset, m.group(1),
+                              "metadata_startup_script")
+            # 2. Scan nested metadata { ... } blocks (HCL block form).
+            for md in b.nested("metadata"):
+                for offset, line_text in enumerate(md.raw_lines):
+                    m = self._SENSITIVE_VAR_NAME_RE.search(line_text)
+                    if m:
+                        _emit(b, md.start_line + offset, m.group(1),
+                              "metadata block")
+            # 3. Scan metadata = { ... } attribute (HCL object-attribute form).
+            rng = self._line_range_of_attr(b, "metadata")
+            if rng is not None:
+                lo, hi = rng
+                for offset in range(lo, hi + 1):
+                    line_text = b.raw_lines[offset]
+                    m = self._SENSITIVE_VAR_NAME_RE.search(line_text)
+                    if m:
+                        _emit(b, b.start_line + offset, m.group(1),
+                              "metadata block")
+        return out
+
 
 # ── Directory-level checker (cross-file rules) ───────────────────────────────
 
 
 class TerraformDirChecker(HclDirChecker):
-    """Cross-file Terraform checks: M-001 SG mixing, A-002 S3 public access block."""
+    """Cross-file Terraform checks: M-001 SG mixing, A-002 S3 public access block,
+    A-011 CloudTrail (scan-level), T-014 required_version (root-module-only).
+    """
 
     def check(self, root: Path, hcl_files: list[Path]) -> list[Finding]:
         tf_files = [f for f in hcl_files if f.suffix == ".tf"]
         out: list[Finding] = []
         out += self._m001(tf_files)
         out += self._a002(tf_files)
+        out += self._a011_scan_level(tf_files)
         out += self._t014(tf_files)
+        out += self._t016(tf_files)
+        out += self._g048(tf_files)
         return out
 
-    def _t014(self, tf_files: list[Path]) -> list[Finding]:
-        """T-014 (module-level) — fire once per directory if no .tf file in that dir
-        has a `terraform { required_version }` block.
+    def _a011_scan_level(self, tf_files: list[Path]) -> list[Finding]:
+        """A-011 (scan-level) — fire once for the entire scan when any AWS
+        resource is present but no aws_cloudtrail exists anywhere.
+
+        Previously this fired once per file via the file-level dispatcher,
+        which produced N-1 duplicate findings on real codebases (one per .tf
+        file containing aws_* resources). CloudTrail is account-wide; a
+        single finding is sufficient.
+        """
+        if not tf_files:
+            return []
+        has_aws = False
+        has_trail = False
+        first_aws_path: Path | None = None
+        for path in sorted(tf_files):
+            if _is_test_fixture_path(path):
+                continue
+            try:
+                source = path.read_text(encoding="utf-8", errors="replace")
+            except OSError:
+                continue
+            blocks = parse_blocks(source)
+            for b in blocks:
+                if b.kind != "resource":
+                    continue
+                if b.label1.startswith("aws_cloudtrail"):
+                    has_trail = True
+                elif b.label1.startswith("aws_") and not has_aws:
+                    has_aws = True
+                    first_aws_path = path
+            if has_trail:
+                return []
+        if not has_aws or first_aws_path is None:
+            return []
+        return [self._f(
+            first_aws_path, None,
+            "PROOFCTL-TF-A011", "No CloudTrail resource",
+            Severity.WARNING,
+            "No aws_cloudtrail resource found anywhere in the scanned tree — AWS API activity is not being audited",
+            hint="Add an aws_cloudtrail resource with multi_region_trail = true and log validation enabled.",
+            authority="CIS AWS Benchmark 3.1",
+            docs_url="https://www.cisecurity.org/benchmark/amazon_web_services",
+        )]
 
-        File-level T014 was wrong: a module's `versions.tf` typically holds the
-        version constraint while `main.tf` declares the resources. Per-file
-        scanning fired on `main.tf` even when the constraint was in `versions.tf`.
+    @staticmethod
+    def _is_root_module(blocks: list[HclBlock]) -> bool:
+        """A directory is a *root* Terraform module if it configures providers
+        (`provider "X" { ... }`), persists state (`terraform { backend ... }`),
+        or composes other modules (`module "X" { ... }`).
+
+        Child modules in `modules/<name>/` typically have only resources +
+        variables + outputs + a `required_providers` block, inheriting
+        `required_version` from the caller. Pinning `required_version` in a
+        child module is a style choice, not a correctness requirement.
+        """
+        has_provider = any(b.kind == "provider" for b in blocks)
+        has_module_call = any(b.kind == "module" for b in blocks)
+        has_backend = any(
+            b.kind == "terraform" and b.has_nested("backend")
+            for b in blocks
+        )
+        return has_provider or has_module_call or has_backend
+
+    def _t014(self, tf_files: list[Path]) -> list[Finding]:
+        """T-014 (root-module-level) — fire once per *root* module directory
+        when no .tf file in that directory has a
+        `terraform { required_version }` block.
+
+        Child modules (in `modules/*/`) are intentionally skipped — they
+        inherit the Terraform version constraint from the calling root
+        module, and pinning a duplicate version in every child module is
+        not a documented best practice.
         """
         from collections import defaultdict
         by_dir: dict[Path, list[Path]] = defaultdict(list)
@@ -3362,6 +3679,7 @@ class TerraformDirChecker(HclDirChecker):
         for d, paths in by_dir.items():
             has_resources = False
             has_required_version = False
+            all_blocks: list[HclBlock] = []
             first_path: Path | None = None
             for path in sorted(paths):
                 try:
@@ -3369,6 +3687,7 @@ class TerraformDirChecker(HclDirChecker):
                 except OSError:
                     continue
                 blocks = parse_blocks(source)
+                all_blocks.extend(blocks)
                 if first_path is None:
                     first_path = path
                 if not has_resources:
@@ -3378,14 +3697,17 @@ class TerraformDirChecker(HclDirChecker):
                         b.kind == "terraform" and b.has_attr("required_version")
                         for b in blocks
                     )
-                if has_required_version:
-                    break
-            if has_resources and not has_required_version and first_path is not None:
+            if (
+                has_resources
+                and not has_required_version
+                and first_path is not None
+                and self._is_root_module(all_blocks)
+            ):
                 out.append(self._f(
                     first_path, None,
                     "PROOFCTL-TF-T014", "Missing required_version constraint",
                     Severity.WARNING,
-                    "No terraform { required_version } constraint in this module — Terraform version drift risk",
+                    "No terraform { required_version } constraint in this root module — Terraform version drift risk",
                     hint='Add terraform { required_version = ">= 1.5" } in versions.tf or main.tf.',
                     docs_url="https://developer.hashicorp.com/terraform/language/providers/requirements#best-practices-for-provider-versions",
                 ))
@@ -3393,6 +3715,153 @@ class TerraformDirChecker(HclDirChecker):
 
     # ── helpers ───────────────────────────────────────────────────────────────
 
+
+    # ── T-016 / G-048 added in the 0.4.x precision sprint ────────────────────
+
+    _VAR_REF_RE = __import__("re").compile(r"\bvar\.([a-zA-Z_][a-zA-Z0-9_]*)")
+
+    def _t016(self, tf_files: list[Path]) -> list[Finding]:
+        """T-016 — variable declared in a module but never referenced.
+
+        Walks every ``.tf`` in each module directory, collects:
+          - declared variable names (from ``variable "X" { ... }`` blocks)
+          - referenced names (from ``var.X`` occurrences across all files)
+
+        A variable in the declared set that is absent from the referenced
+        set is dead module surface area — confuses callers about whether
+        the field is required and accumulates as a maintenance hazard.
+
+        Fires once per unused variable, with the finding attached to the
+        line where the variable was declared.
+
+        Test fixtures are skipped. Reserved names that intentionally
+        document inputs without being consumed (none today) would go on a
+        suppress list — none yet known.
+        """
+        from collections import defaultdict
+        by_dir: dict[Path, list[Path]] = defaultdict(list)
+        for path in tf_files:
+            if _is_test_fixture_path(path):
+                continue
+            by_dir[path.parent].append(path)
+
+        out: list[Finding] = []
+        for d, paths in by_dir.items():
+            declared: dict[str, tuple[Path, int]] = {}
+            joined_source = []
+            for path in sorted(paths):
+                try:
+                    source = path.read_text(encoding="utf-8", errors="replace")
+                except OSError:
+                    continue
+                joined_source.append(source)
+                blocks = parse_blocks(source)
+                for b in blocks:
+                    if b.kind == "variable" and b.label1:
+                        declared.setdefault(b.label1, (path, b.start_line))
+            referenced = set()
+            full_text = "\n".join(joined_source)
+            for m in self._VAR_REF_RE.finditer(full_text):
+                referenced.add(m.group(1))
+
+            for name, (path, line) in declared.items():
+                if name in referenced:
+                    continue
+                out.append(self._f(
+                    path, line,
+                    "PROOFCTL-TF-T016", "Variable declared but never used",
+                    Severity.WARNING,
+                    f'variable "{name}" is declared but never referenced via var.{name} anywhere in the module',
+                    hint="Remove the unused variable, or wire it into the resource that should consume it.",
+                    docs_url="https://developer.hashicorp.com/terraform/language/values/variables",
+                ))
+        return out
+
+    # CMEK signals across resource types. If any of these attributes appear on a
+    # resource in the module, we treat the module as "CMEK-using" — secrets
+    # should then also use customer_managed_encryption.
+    _CMEK_USE_PATTERNS = (
+        r'\bkms_key_name\b',
+        r'\bencryption_key_name\b',
+        r'\bcustomer_managed_encryption\b',
+        r'\bkms_key_self_link\b',
+        r'\bkms_key_arn\b',
+        r'\bdefault_kms_key_name\b',
+    )
+
+    def _g048(self, tf_files: list[Path]) -> list[Finding]:
+        """G-048 — Secret Manager secret without CMEK in a CMEK-using module.
+
+        Cross-resource consistency check. If the module already uses CMEK on
+        any other resource (Cloud SQL, GCS, Compute disk, etc.) but the
+        ``google_secret_manager_secret`` resource uses
+        ``replication { auto {} }`` (Google-managed encryption), the CMEK
+        posture is undermined — the most sensitive material (credentials)
+        sits under a weaker key than the data it unlocks.
+
+        Detection:
+          1. Scan every .tf in the module directory.
+          2. If any line matches one of _CMEK_USE_PATTERNS, the module is
+             CMEK-using.
+          3. For each google_secret_manager_secret with no
+             customer_managed_encryption inside its replication block, fire.
+
+        Skips test fixtures.
+        """
+        import re
+        from collections import defaultdict
+        by_dir: dict[Path, list[Path]] = defaultdict(list)
+        for path in tf_files:
+            if _is_test_fixture_path(path):
+                continue
+            by_dir[path.parent].append(path)
+
+        cmek_re = re.compile("|".join(self._CMEK_USE_PATTERNS))
+        out: list[Finding] = []
+
+        for d, paths in by_dir.items():
+            module_uses_cmek = False
+            secret_blocks: list[tuple[Path, HclBlock]] = []
+
+            for path in sorted(paths):
+                try:
+                    source = path.read_text(encoding="utf-8", errors="replace")
+                except OSError:
+                    continue
+                if cmek_re.search(source):
+                    module_uses_cmek = True
+                for b in parse_blocks(source):
+                    if b.kind == "resource" and b.label1 == "google_secret_manager_secret":
+                        secret_blocks.append((path, b))
+
+            if not module_uses_cmek or not secret_blocks:
+                continue
+
+            for path, b in secret_blocks:
+                # The secret has CMEK iff customer_managed_encryption appears
+                # inside its body (which lives in user_managed.replicas[*]).
+                if b.contains(r"customer_managed_encryption"):
+                    continue
+                line = b.any_line_matches(r"replication\s*\{") or b.start_line
+                out.append(self._f(
+                    path, line,
+                    "PROOFCTL-TF-G048",
+                    "Secret Manager secret without CMEK in CMEK-using module",
+                    Severity.WARNING,
+                    f'google_secret_manager_secret "{b.label2}" uses Google-managed encryption while the rest of the module uses CMEK — credential is weaker-protected than the data it unlocks',
+                    hint=(
+                        'Switch to replication { user_managed { replicas { '
+                        'location = ... customer_managed_encryption '
+                        '{ kms_key_name = var.kms_key_id } } } } and grant '
+                        'the Secret Manager service agent '
+                        '(service-{project_number}@gcp-sa-secretmanager.iam.gserviceaccount.com) '
+                        'cryptoKeyEncrypterDecrypter on the KMS key.'
+                    ),
+                    authority="CIS GCP Benchmark / Customer-Managed Encryption Keys",
+                    docs_url="https://cloud.google.com/secret-manager/docs/cmek",
+                ))
+        return out
+
     @staticmethod
     def _f(
         path: Path,
@@ -3402,13 +3871,14 @@ class TerraformDirChecker(HclDirChecker):
         severity: Severity,
         message: str,
         hint: str = "",
+        authority: str = "",
         docs_url: str = "",
     ) -> Finding:
         return Finding(
             file=str(path), line=line, col=None,
             rule_id=rule_id, rule_name=rule_name,
             severity=severity, message=message, hint=hint,
-            docs_url=docs_url,
+            authority=authority, docs_url=docs_url,
         )
 
     def _m001(self, tf_files: list[Path]) -> list[Finding]:
@@ -3467,7 +3937,13 @@ class TerraformDirChecker(HclDirChecker):
                     buckets[d][b.label2] = (b.start_line, path)
                 elif b.kind == "resource" and b.label1 == "aws_s3_bucket_public_access_block":
                     bucket_val = b.attr_value("bucket") or ""
-                    ref_m = re.search(r'aws_s3_bucket\.(\w+)\.', bucket_val)
+                    # Match both `aws_s3_bucket.<name>.<attr>` and the
+                    # count-conditional `aws_s3_bucket.<name>[0].<attr>` /
+                    # for_each `aws_s3_bucket.<name>["k"].<attr>` shapes.
+                    ref_m = re.search(
+                        r'aws_s3_bucket\.(\w+)(?:\[[^\]]+\])?\.',
+                        bucket_val,
+                    )
                     if ref_m:
                         pab_refs[d].add(ref_m.group(1))
 

{proofctl-0.4.2 → proofctl-0.5.0}/proofctl/engine.py

@@ -215,6 +215,18 @@ _DOCKERFILE_RE = re.compile(r"^Dockerfile(\..*)?$")
 _HCL_EXTS = (".tf", ".tfvars", ".hcl")
 _YAML_EXTS = (".yml", ".yaml")
 _SHELL_EXTS = (".sh", ".bash", ".zsh", ".ksh")
+# Terraform template files. We classify by content: a .tftpl whose
+# rendered output is a shell script (shebang #!/bin/bash, #!/bin/sh,
+# /usr/bin/env bash, etc.) should be scanned by the SH rules so the
+# template's shell content participates in lint / secret / pattern
+# checks even though it's stored as a Terraform template.
+_TFTPL_EXTS = (".tftpl",)
+_SHELL_SHEBANG_RE = re.compile(
+    rb'^\s*#!\s*(?:'
+    rb'/(?:usr/local/|usr/)?bin/'                # /bin/, /usr/bin/, /usr/local/bin/
+    rb'|/usr/bin/env\s+'                         # /usr/bin/env <name>
+    rb')(?:ba|z|k|ash|d)?sh\b'                   # sh / bash / zsh / ksh / ash / dash
+)
 
 
 def _classify(path: Path) -> str | None:
@@ -227,11 +239,29 @@ def _classify(path: Path) -> str | None:
         return "yaml"
     if path.suffix in _SHELL_EXTS:
         return "shell"
+    if path.suffix in _TFTPL_EXTS and _is_shell_template(path):
+        return "shell"
     if _DOCKERFILE_RE.match(path.name):
         return "dockerfile"
     return None
 
 
+def _is_shell_template(path: Path) -> bool:
+    """True iff a `.tftpl` file looks like a shell-script template.
+
+    Cheapest possible check: read up to 128 bytes and match a shell
+    shebang. We don't try to actually render the template — variables
+    like ``${var.x}`` may sit between the shebang and the script body,
+    but the shebang itself is on line 1 either way.
+    """
+    try:
+        with path.open("rb") as f:
+            head = f.read(128)
+    except OSError:
+        return False
+    return bool(_SHELL_SHEBANG_RE.match(head))
+
+
 def _internal_finding(
     *, scope: str, path: Path | None, exc: BaseException, strict: bool,
 ) -> Finding:

{proofctl-0.4.2 → proofctl-0.5.0/proofctl.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.4.2
+Version: 0.5.0
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT
@@ -28,7 +28,7 @@ Dynamic: license-file
 
 # proofctl
 
-A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **264 rules**, zero dependencies, runs in under a second.
+A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **269 rules**, zero dependencies, runs in under a second.
 
 ```
 proofctl check .
@@ -165,7 +165,7 @@ git commit -m "chore: add proofctl baseline"
 
 ## Rules
 
-264 rules across 14 families. Run `proofctl rules` after install to enumerate.
+269 rules across 14 families. Run `proofctl rules` after install to enumerate.
 
 | Family | Count | What it covers |
 |---|---|---|
@@ -173,9 +173,9 @@ git commit -m "chore: add proofctl baseline"
 | Python — Security (`S`) | 24 | OWASP Top-10 + CWE coverage: SQLi, command injection, weak crypto, JWT bypass, path traversal, XSS, SSRF, file upload, CSRF, missing authz, XPath injection, open redirect, TLS bypass |
 | Secrets (`SECRET`) | 13 | AWS / GCP / GitHub / Slack / Stripe / private keys / JWTs / hardcoded passwords / K8s Secret YAML / connection strings with embedded creds |
 | Python — Other | 12 | Placeholders, leakage (cross-language idioms, PII), import hallucination, method complexity, variant detection, LLM guardrails (OWASP LLM Top-10) |
-| Terraform — General + AI (`TF-T`, `TF-AI`) | 26 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values |
+| Terraform — General + AI (`TF-T`, `TF-AI`) | 29 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata, unused variable declarations |
 | Terraform — AWS (`TF-A`) | 40 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
-| Terraform — GCP (`TF-G`) | 50 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL, firewall ingress |
+| Terraform — GCP (`TF-G`) | 52 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |
 | Terraform — Azure (`TF-AZ`) | 14 | Storage public blob, SQL public network, AKS RBAC, Key Vault purge protection, NSG SSH/RDP, managed disk CMK |
 | Terraform — Mechanics + Lifecycle (`TF-M`, `TF-V`) | 12 | SG inline mixing, `force_destroy`, mutable module refs, lifecycle antipatterns |
 | Terragrunt (`TG`) | 6 | HCL inputs, mock_outputs, remote state encryption |

{proofctl-0.4.2 → proofctl-0.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofctl"
-version = "0.4.2"
+version = "0.5.0"
 description = "Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit"
 readme = "README.md"
 license = { text = "MIT" }