proofctl 0.4.3__tar.gz → 0.5.0__tar.gz

{proofctl-0.4.3/proofctl.egg-info → proofctl-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.4.3
+Version: 0.5.0
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT
@@ -28,7 +28,7 @@ Dynamic: license-file
 
 # proofctl
 
-A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **267 rules**, zero dependencies, runs in under a second.
+A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **269 rules**, zero dependencies, runs in under a second.
 
 ```
 proofctl check .
@@ -165,7 +165,7 @@ git commit -m "chore: add proofctl baseline"
 
 ## Rules
 
-267 rules across 14 families. Run `proofctl rules` after install to enumerate.
+269 rules across 14 families. Run `proofctl rules` after install to enumerate.
 
 | Family | Count | What it covers |
 |---|---|---|
@@ -173,9 +173,9 @@ git commit -m "chore: add proofctl baseline"
 | Python — Security (`S`) | 24 | OWASP Top-10 + CWE coverage: SQLi, command injection, weak crypto, JWT bypass, path traversal, XSS, SSRF, file upload, CSRF, missing authz, XPath injection, open redirect, TLS bypass |
 | Secrets (`SECRET`) | 13 | AWS / GCP / GitHub / Slack / Stripe / private keys / JWTs / hardcoded passwords / K8s Secret YAML / connection strings with embedded creds |
 | Python — Other | 12 | Placeholders, leakage (cross-language idioms, PII), import hallucination, method complexity, variant detection, LLM guardrails (OWASP LLM Top-10) |
-| Terraform — General + AI (`TF-T`, `TF-AI`) | 28 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata |
+| Terraform — General + AI (`TF-T`, `TF-AI`) | 29 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata, unused variable declarations |
 | Terraform — AWS (`TF-A`) | 40 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
-| Terraform — GCP (`TF-G`) | 51 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL, firewall ingress, compute access scopes |
+| Terraform — GCP (`TF-G`) | 52 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |
 | Terraform — Azure (`TF-AZ`) | 14 | Storage public blob, SQL public network, AKS RBAC, Key Vault purge protection, NSG SSH/RDP, managed disk CMK |
 | Terraform — Mechanics + Lifecycle (`TF-M`, `TF-V`) | 12 | SG inline mixing, `force_destroy`, mutable module refs, lifecycle antipatterns |
 | Terragrunt (`TG`) | 6 | HCL inputs, mock_outputs, remote state encryption |

{proofctl-0.4.3 → proofctl-0.5.0}/README.md

@@ -1,6 +1,6 @@
 # proofctl
 
-A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **267 rules**, zero dependencies, runs in under a second.
+A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **269 rules**, zero dependencies, runs in under a second.
 
 ```
 proofctl check .
@@ -137,7 +137,7 @@ git commit -m "chore: add proofctl baseline"
 
 ## Rules
 
-267 rules across 14 families. Run `proofctl rules` after install to enumerate.
+269 rules across 14 families. Run `proofctl rules` after install to enumerate.
 
 | Family | Count | What it covers |
 |---|---|---|
@@ -145,9 +145,9 @@ git commit -m "chore: add proofctl baseline"
 | Python — Security (`S`) | 24 | OWASP Top-10 + CWE coverage: SQLi, command injection, weak crypto, JWT bypass, path traversal, XSS, SSRF, file upload, CSRF, missing authz, XPath injection, open redirect, TLS bypass |
 | Secrets (`SECRET`) | 13 | AWS / GCP / GitHub / Slack / Stripe / private keys / JWTs / hardcoded passwords / K8s Secret YAML / connection strings with embedded creds |
 | Python — Other | 12 | Placeholders, leakage (cross-language idioms, PII), import hallucination, method complexity, variant detection, LLM guardrails (OWASP LLM Top-10) |
-| Terraform — General + AI (`TF-T`, `TF-AI`) | 28 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata |
+| Terraform — General + AI (`TF-T`, `TF-AI`) | 29 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata, unused variable declarations |
 | Terraform — AWS (`TF-A`) | 40 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
-| Terraform — GCP (`TF-G`) | 51 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL, firewall ingress, compute access scopes |
+| Terraform — GCP (`TF-G`) | 52 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |
 | Terraform — Azure (`TF-AZ`) | 14 | Storage public blob, SQL public network, AKS RBAC, Key Vault purge protection, NSG SSH/RDP, managed disk CMK |
 | Terraform — Mechanics + Lifecycle (`TF-M`, `TF-V`) | 12 | SG inline mixing, `force_destroy`, mutable module refs, lifecycle antipatterns |
 | Terragrunt (`TG`) | 6 | HCL inputs, mock_outputs, remote state encryption |

{proofctl-0.4.3 → proofctl-0.5.0}/proofctl/checkers/terraform.py

@@ -53,44 +53,54 @@ _FIREWALL_RESOURCES = frozenset({
 })
 
 
-def _aws_sg_has_open_ingress(raw_lines: list[str]) -> bool:
-    """Walk an aws_security_group block's lines and return True iff
-    0.0.0.0/0 appears inside an ``ingress { ... }`` sub-block.
-
-    aws_security_group has both inline ``ingress`` and ``egress`` blocks;
-    open egress is normal and should not trigger T-004. Open ingress is
-    the actual finding.
+def _aws_sg_open_ingress_lines(raw_lines: list[str]) -> list[str]:
+    """Return the lines from every ``ingress { ... }`` sub-block in an
+    ``aws_security_group`` body that contains 0.0.0.0/0.
+
+    ``aws_security_group`` declares ``ingress`` and ``egress`` as inline
+    sub-blocks. Open egress is normal (workloads need outbound), so T-004
+    must ignore the egress block entirely — including its ``protocol``
+    and port attributes. This helper returns only the lines from
+    qualifying ingress sub-blocks; the caller scopes port / all-traffic
+    checks to those lines.
     """
-    depth = 0
-    in_ingress = False
-    in_egress = False
-    block_depth = 0
     sub_re = re.compile(r"^\s*(ingress|egress)\s*\{")
+    in_kind: str | None = None
+    block_depth = 0
+    buffer: list[str] = []
+    result: list[str] = []
+    bare_root_lines: list[str] = []
+
     for line in raw_lines:
-        if not in_ingress and not in_egress:
+        if in_kind is None:
             m = sub_re.match(line)
             if m:
-                if m.group(1) == "ingress":
-                    in_ingress = True
-                else:
-                    in_egress = True
+                in_kind = m.group(1)
                 block_depth = line.count("{") - line.count("}")
+                buffer = [line]
                 continue
-        if in_ingress or in_egress:
-            block_depth += line.count("{") - line.count("}")
-            if in_ingress and re.search(r'"0\.0\.0\.0/0"', line):
-                return True
-            if block_depth <= 0:
-                in_ingress = False
-                in_egress = False
-                block_depth = 0
+            # Bare 0.0.0.0/0 at resource level (rare) — collect separately.
+            if re.search(r'"0\.0\.0\.0/0"', line):
+                bare_root_lines.append(line)
             continue
-        # Outside any sub-block — bare 0.0.0.0/0 at the resource level
-        # is uncommon for aws_security_group, but if it appears we
-        # conservatively treat it as ingress-relevant.
-        if re.search(r'"0\.0\.0\.0/0"', line):
-            return True
-    return False
+
+        block_depth += line.count("{") - line.count("}")
+        buffer.append(line)
+        if block_depth <= 0:
+            if in_kind == "ingress" and any(
+                re.search(r'"0\.0\.0\.0/0"', ln) for ln in buffer
+            ):
+                result.extend(buffer)
+            in_kind = None
+            block_depth = 0
+            buffer = []
+
+    return result + bare_root_lines
+
+
+def _aws_sg_has_open_ingress(raw_lines: list[str]) -> bool:
+    """True iff 0.0.0.0/0 appears in any ingress sub-block of an aws_security_group."""
+    return bool(_aws_sg_open_ingress_lines(raw_lines))
 
 # Ports that should never accept 0.0.0.0/0
 _SENSITIVE_PORTS = frozenset({22, 23, 25, 3306, 3389, 5432, 5439, 6379, 27017})
@@ -246,7 +256,7 @@ class TerraformChecker(HclFileChecker):
         out += self._a008(path, blocks)
         out += self._a009(path, blocks)
         out += self._a010(path, blocks)
-        out += self._a011(path, blocks)
+        # A-011 moved to TerraformDirChecker._a011_scan_level (fires once per scan).
         out += self._a012(path, blocks)
         out += self._a013(path, blocks)
         out += self._a014(path, blocks)
@@ -504,25 +514,34 @@ class TerraformChecker(HclFileChecker):
             if not b.contains(r'0\.0\.0\.0/0'):
                 continue
 
-            # Skip egress-only rules.
+            # Decide which lines define the open ingress for port/protocol
+            # checks. For aws_security_group (which has inline ingress AND
+            # egress sub-blocks) we MUST scope to the ingress sub-block — the
+            # egress block's `protocol = "-1"` would otherwise spoof an
+            # all-traffic verdict.
+            scoped_lines: list[str]
+
             if b.label1 == "aws_security_group_rule":
                 rule_type = (b.attr_value("type") or "").strip().strip('"').lower()
                 if rule_type == "egress":
                     continue
+                scoped_lines = list(b.raw_lines)
             elif b.label1 == "google_compute_firewall":
                 direction = (b.attr_value("direction") or "").strip().strip('"').upper()
                 if direction == "EGRESS":
                     continue
+                scoped_lines = list(b.raw_lines)
             elif b.label1 == "aws_security_group":
-                # 0.0.0.0/0 in an inline egress { } block is fine — only flag
-                # if 0.0.0.0/0 appears inside an ingress block (or there is
-                # no egress block at all).
-                if not _aws_sg_has_open_ingress(b.raw_lines):
+                scoped_lines = _aws_sg_open_ingress_lines(b.raw_lines)
+                if not scoped_lines:
                     continue
+            else:
+                scoped_lines = list(b.raw_lines)
 
-            # Check if sensitive ports are involved
+            # Check if sensitive ports are involved (scoped to ingress only
+            # for aws_security_group).
             ports: set[int] = set()
-            for line in b.raw_lines:
+            for line in scoped_lines:
                 pm = port_re.search(line)
                 if pm:
                     try:
@@ -530,7 +549,7 @@ class TerraformChecker(HclFileChecker):
                     except ValueError:
                         pass
 
-            if all_traffic_re.search('\n'.join(b.raw_lines)):
+            if all_traffic_re.search('\n'.join(scoped_lines)):
                 # -1 or all traffic — always sensitive
                 flagged_ports = "all traffic"
             elif ports & _SENSITIVE_PORTS:
@@ -571,14 +590,33 @@ class TerraformChecker(HclFileChecker):
         return out
 
     def _t006(self, path: Path, lines: list[str]) -> list[Finding]:
-        """T-006 — IAM wildcard in actions or resources."""
-        # Match: actions = ["*"] or resources = ["*"] (with possible extra items)
-        pat = re.compile(r'(?:actions|not_actions|resources|not_resources)\s*=\s*\[[^\]]*"\*"')
+        """T-006 — IAM wildcard in actions or resources.
+
+        Matches both shapes:
+
+        1. Terraform-native (``data "aws_iam_policy_document"``):
+           ``actions = ["*"]`` / ``resources = ["*"]``
+        2. AWS JSON policy embedded via ``jsonencode({ Statement = [...] })``:
+           ``Action = "*"`` / ``Resource = "*"`` (bare string) and
+           ``Action = ["*"]`` / ``Resource = ["foo", "*"]`` (list form).
+
+        The capitalised keys + bare-string value were previously uncovered.
+        """
+        # Terraform-native form (lowercase, list-only).
+        tf_pat = re.compile(
+            r'(?:actions|not_actions|resources|not_resources)\s*=\s*\[[^\]]*"\*"'
+        )
+        # AWS JSON policy form (capitalised, accepts bare "*" or list).
+        json_pat = re.compile(
+            r'(?:Action|NotAction|Resource|NotResource)\s*=\s*'
+            r'(?:"\*"|\[[^\]]*"\*"[^\]]*\])'
+        )
         out = []
         for i, line in enumerate(lines, start=1):
-            if line.strip().startswith("#"):
+            stripped = line.strip()
+            if stripped.startswith("#") or stripped.startswith("//"):
                 continue
-            if pat.search(line):
+            if tf_pat.search(line) or json_pat.search(line):
                 out.append(self._f(
                     path, i,
                     "PROOFCTL-TF-T006", "IAM wildcard permission",
@@ -1036,21 +1074,37 @@ class TerraformChecker(HclFileChecker):
         return out
 
     def _g009(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
-        """G-009 — Cloud SQL SSL not required."""
+        """G-009 — Cloud SQL TLS explicitly disabled.
+
+        Fires on either explicit-insecure shape:
+          - Legacy:  ``require_ssl = false``
+          - Modern (provider 5.x+):  ``ssl_mode = "ALLOW_UNENCRYPTED_AND_ENCRYPTED"``
+
+        Does NOT fire on omission of both fields — that case is covered
+        by G-043 (Cloud SQL not requiring SSL). Together the two rules
+        provide orthogonal coverage of the Cloud SQL TLS posture.
+        """
         out = []
+        insecure_legacy_pat = r'require_ssl\s*=\s*false'
+        insecure_modern_pat = r'ssl_mode\s*=\s*"ALLOW_UNENCRYPTED_AND_ENCRYPTED"'
         for b in blocks:
             if b.kind != "resource" or b.label1 != "google_sql_database_instance":
                 continue
-            if b.contains(r'require_ssl\s*=\s*false'):
-                out.append(self._f(
-                    path, b.any_line_matches(r'require_ssl\s*=\s*false') or b.start_line,
-                    "PROOFCTL-TF-G009", "Cloud SQL SSL not required",
-                    Severity.ERROR,
-                    f'SQL instance "{b.label2}" has require_ssl = false',
-                    hint="Set require_ssl = true to enforce TLS for all client connections.",
-                    authority="CIS GCP Benchmark 6.4",
-                    docs_url="https://www.cisecurity.org/benchmark/google_cloud_computing_platform",
-                ))
+            legacy_line = b.any_line_matches(insecure_legacy_pat)
+            modern_line = b.any_line_matches(insecure_modern_pat)
+            if legacy_line is None and modern_line is None:
+                continue
+            line = legacy_line or modern_line
+            detail = "require_ssl = false" if legacy_line else 'ssl_mode = "ALLOW_UNENCRYPTED_AND_ENCRYPTED"'
+            out.append(self._f(
+                path, line or b.start_line,
+                "PROOFCTL-TF-G009", "Cloud SQL TLS explicitly disabled",
+                Severity.ERROR,
+                f'SQL instance "{b.label2}" has TLS explicitly disabled ({detail})',
+                hint='Set ssl_mode = "ENCRYPTED_ONLY" (or "TRUSTED_CLIENT_CERTIFICATE_REQUIRED") to enforce TLS for all client connections.',
+                authority="CIS GCP Benchmark 6.4",
+                docs_url="https://cloud.google.com/sql/docs/mysql/configure-ssl-instance",
+            ))
         return out
 
     def _g010(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
@@ -2864,19 +2918,33 @@ class TerraformChecker(HclFileChecker):
         return out
 
     def _g043(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
-        """G-043 — Cloud SQL instance without require_ssl."""
+        """G-043 — Cloud SQL TLS not enforced (no enforcement attribute set).
+
+        Fires when NONE of the safe enforcement attributes are present:
+          - Legacy:  ``require_ssl = true``
+          - Modern (provider 5.x+):  ``ssl_mode = "ENCRYPTED_ONLY"`` OR
+                                     ``ssl_mode = "TRUSTED_CLIENT_CERTIFICATE_REQUIRED"``
+
+        Without one of these, Cloud SQL accepts unencrypted connections
+        by default. G-009 covers the *explicit* opt-out cases; this rule
+        covers the *implicit* opt-out (omission).
+        """
         out = []
+        require_ssl_true = r'require_ssl\s*=\s*true'
+        ssl_mode_enforced = (
+            r'ssl_mode\s*=\s*"(?:ENCRYPTED_ONLY|TRUSTED_CLIENT_CERTIFICATE_REQUIRED)"'
+        )
         for b in blocks:
             if b.kind != "resource" or b.label1 != "google_sql_database_instance":
                 continue
-            if b.contains(r'require_ssl\s*=\s*true'):
+            if b.contains(require_ssl_true) or b.contains(ssl_mode_enforced):
                 continue
             out.append(self._f(
                 path, b.start_line,
-                "PROOFCTL-TF-G043", "Cloud SQL not requiring SSL",
+                "PROOFCTL-TF-G043", "Cloud SQL TLS not enforced",
                 Severity.ERROR,
-                f'google_sql_database_instance "{b.label2}" does not require SSL/TLS connections',
-                hint="Set settings.ip_configuration.require_ssl = true.",
+                f'google_sql_database_instance "{b.label2}" does not enforce TLS — no require_ssl = true or ssl_mode = ENCRYPTED_ONLY present',
+                hint='Set settings.ip_configuration.ssl_mode = "ENCRYPTED_ONLY" (preferred; provider 5.x+) or settings.ip_configuration.require_ssl = true (legacy).',
                 authority="CIS GCP Benchmark 6.4",
                 docs_url="https://cloud.google.com/sql/docs/mysql/configure-ssl-instance",
             ))
@@ -3512,23 +3580,93 @@ class TerraformChecker(HclFileChecker):
 
 
 class TerraformDirChecker(HclDirChecker):
-    """Cross-file Terraform checks: M-001 SG mixing, A-002 S3 public access block."""
+    """Cross-file Terraform checks: M-001 SG mixing, A-002 S3 public access block,
+    A-011 CloudTrail (scan-level), T-014 required_version (root-module-only).
+    """
 
     def check(self, root: Path, hcl_files: list[Path]) -> list[Finding]:
         tf_files = [f for f in hcl_files if f.suffix == ".tf"]
         out: list[Finding] = []
         out += self._m001(tf_files)
         out += self._a002(tf_files)
+        out += self._a011_scan_level(tf_files)
         out += self._t014(tf_files)
+        out += self._t016(tf_files)
+        out += self._g048(tf_files)
         return out
 
-    def _t014(self, tf_files: list[Path]) -> list[Finding]:
-        """T-014 (module-level) — fire once per directory if no .tf file in that dir
-        has a `terraform { required_version }` block.
+    def _a011_scan_level(self, tf_files: list[Path]) -> list[Finding]:
+        """A-011 (scan-level) — fire once for the entire scan when any AWS
+        resource is present but no aws_cloudtrail exists anywhere.
+
+        Previously this fired once per file via the file-level dispatcher,
+        which produced N-1 duplicate findings on real codebases (one per .tf
+        file containing aws_* resources). CloudTrail is account-wide; a
+        single finding is sufficient.
+        """
+        if not tf_files:
+            return []
+        has_aws = False
+        has_trail = False
+        first_aws_path: Path | None = None
+        for path in sorted(tf_files):
+            if _is_test_fixture_path(path):
+                continue
+            try:
+                source = path.read_text(encoding="utf-8", errors="replace")
+            except OSError:
+                continue
+            blocks = parse_blocks(source)
+            for b in blocks:
+                if b.kind != "resource":
+                    continue
+                if b.label1.startswith("aws_cloudtrail"):
+                    has_trail = True
+                elif b.label1.startswith("aws_") and not has_aws:
+                    has_aws = True
+                    first_aws_path = path
+            if has_trail:
+                return []
+        if not has_aws or first_aws_path is None:
+            return []
+        return [self._f(
+            first_aws_path, None,
+            "PROOFCTL-TF-A011", "No CloudTrail resource",
+            Severity.WARNING,
+            "No aws_cloudtrail resource found anywhere in the scanned tree — AWS API activity is not being audited",
+            hint="Add an aws_cloudtrail resource with multi_region_trail = true and log validation enabled.",
+            authority="CIS AWS Benchmark 3.1",
+            docs_url="https://www.cisecurity.org/benchmark/amazon_web_services",
+        )]
+
+    @staticmethod
+    def _is_root_module(blocks: list[HclBlock]) -> bool:
+        """A directory is a *root* Terraform module if it configures providers
+        (`provider "X" { ... }`), persists state (`terraform { backend ... }`),
+        or composes other modules (`module "X" { ... }`).
+
+        Child modules in `modules/<name>/` typically have only resources +
+        variables + outputs + a `required_providers` block, inheriting
+        `required_version` from the caller. Pinning `required_version` in a
+        child module is a style choice, not a correctness requirement.
+        """
+        has_provider = any(b.kind == "provider" for b in blocks)
+        has_module_call = any(b.kind == "module" for b in blocks)
+        has_backend = any(
+            b.kind == "terraform" and b.has_nested("backend")
+            for b in blocks
+        )
+        return has_provider or has_module_call or has_backend
 
-        File-level T014 was wrong: a module's `versions.tf` typically holds the
-        version constraint while `main.tf` declares the resources. Per-file
-        scanning fired on `main.tf` even when the constraint was in `versions.tf`.
+    def _t014(self, tf_files: list[Path]) -> list[Finding]:
+        """T-014 (root-module-level) — fire once per *root* module directory
+        when no .tf file in that directory has a
+        `terraform { required_version }` block.
+
+        Child modules (in `modules/*/`) are intentionally skipped — they
+        inherit the Terraform version constraint from the calling root
+        module, and pinning a duplicate version in every child module is
+        not a documented best practice.
         """
         from collections import defaultdict
         by_dir: dict[Path, list[Path]] = defaultdict(list)
@@ -3541,6 +3679,7 @@ class TerraformDirChecker(HclDirChecker):
         for d, paths in by_dir.items():
             has_resources = False
             has_required_version = False
+            all_blocks: list[HclBlock] = []
             first_path: Path | None = None
             for path in sorted(paths):
                 try:
@@ -3548,6 +3687,7 @@ class TerraformDirChecker(HclDirChecker):
                 except OSError:
                     continue
                 blocks = parse_blocks(source)
+                all_blocks.extend(blocks)
                 if first_path is None:
                     first_path = path
                 if not has_resources:
@@ -3557,14 +3697,17 @@ class TerraformDirChecker(HclDirChecker):
                         b.kind == "terraform" and b.has_attr("required_version")
                         for b in blocks
                     )
-                if has_required_version:
-                    break
-            if has_resources and not has_required_version and first_path is not None:
+            if (
+                has_resources
+                and not has_required_version
+                and first_path is not None
+                and self._is_root_module(all_blocks)
+            ):
                 out.append(self._f(
                     first_path, None,
                     "PROOFCTL-TF-T014", "Missing required_version constraint",
                     Severity.WARNING,
-                    "No terraform { required_version } constraint in this module — Terraform version drift risk",
+                    "No terraform { required_version } constraint in this root module — Terraform version drift risk",
                     hint='Add terraform { required_version = ">= 1.5" } in versions.tf or main.tf.',
                     docs_url="https://developer.hashicorp.com/terraform/language/providers/requirements#best-practices-for-provider-versions",
                 ))
@@ -3572,6 +3715,153 @@ class TerraformDirChecker(HclDirChecker):
 
     # ── helpers ───────────────────────────────────────────────────────────────
 
+
+    # ── T-016 / G-048 added in the 0.4.x precision sprint ────────────────────
+
+    _VAR_REF_RE = __import__("re").compile(r"\bvar\.([a-zA-Z_][a-zA-Z0-9_]*)")
+
+    def _t016(self, tf_files: list[Path]) -> list[Finding]:
+        """T-016 — variable declared in a module but never referenced.
+
+        Walks every ``.tf`` in each module directory, collects:
+          - declared variable names (from ``variable "X" { ... }`` blocks)
+          - referenced names (from ``var.X`` occurrences across all files)
+
+        A variable in the declared set that is absent from the referenced
+        set is dead module surface area — confuses callers about whether
+        the field is required and accumulates as a maintenance hazard.
+
+        Fires once per unused variable, with the finding attached to the
+        line where the variable was declared.
+
+        Test fixtures are skipped. Reserved names that intentionally
+        document inputs without being consumed (none today) would go on a
+        suppress list — none yet known.
+        """
+        from collections import defaultdict
+        by_dir: dict[Path, list[Path]] = defaultdict(list)
+        for path in tf_files:
+            if _is_test_fixture_path(path):
+                continue
+            by_dir[path.parent].append(path)
+
+        out: list[Finding] = []
+        for d, paths in by_dir.items():
+            declared: dict[str, tuple[Path, int]] = {}
+            joined_source = []
+            for path in sorted(paths):
+                try:
+                    source = path.read_text(encoding="utf-8", errors="replace")
+                except OSError:
+                    continue
+                joined_source.append(source)
+                blocks = parse_blocks(source)
+                for b in blocks:
+                    if b.kind == "variable" and b.label1:
+                        declared.setdefault(b.label1, (path, b.start_line))
+            referenced = set()
+            full_text = "\n".join(joined_source)
+            for m in self._VAR_REF_RE.finditer(full_text):
+                referenced.add(m.group(1))
+
+            for name, (path, line) in declared.items():
+                if name in referenced:
+                    continue
+                out.append(self._f(
+                    path, line,
+                    "PROOFCTL-TF-T016", "Variable declared but never used",
+                    Severity.WARNING,
+                    f'variable "{name}" is declared but never referenced via var.{name} anywhere in the module',
+                    hint="Remove the unused variable, or wire it into the resource that should consume it.",
+                    docs_url="https://developer.hashicorp.com/terraform/language/values/variables",
+                ))
+        return out
+
+    # CMEK signals across resource types. If any of these attributes appear on a
+    # resource in the module, we treat the module as "CMEK-using" — secrets
+    # should then also use customer_managed_encryption.
+    _CMEK_USE_PATTERNS = (
+        r'\bkms_key_name\b',
+        r'\bencryption_key_name\b',
+        r'\bcustomer_managed_encryption\b',
+        r'\bkms_key_self_link\b',
+        r'\bkms_key_arn\b',
+        r'\bdefault_kms_key_name\b',
+    )
+
+    def _g048(self, tf_files: list[Path]) -> list[Finding]:
+        """G-048 — Secret Manager secret without CMEK in a CMEK-using module.
+
+        Cross-resource consistency check. If the module already uses CMEK on
+        any other resource (Cloud SQL, GCS, Compute disk, etc.) but the
+        ``google_secret_manager_secret`` resource uses
+        ``replication { auto {} }`` (Google-managed encryption), the CMEK
+        posture is undermined — the most sensitive material (credentials)
+        sits under a weaker key than the data it unlocks.
+
+        Detection:
+          1. Scan every .tf in the module directory.
+          2. If any line matches one of _CMEK_USE_PATTERNS, the module is
+             CMEK-using.
+          3. For each google_secret_manager_secret with no
+             customer_managed_encryption inside its replication block, fire.
+
+        Skips test fixtures.
+        """
+        import re
+        from collections import defaultdict
+        by_dir: dict[Path, list[Path]] = defaultdict(list)
+        for path in tf_files:
+            if _is_test_fixture_path(path):
+                continue
+            by_dir[path.parent].append(path)
+
+        cmek_re = re.compile("|".join(self._CMEK_USE_PATTERNS))
+        out: list[Finding] = []
+
+        for d, paths in by_dir.items():
+            module_uses_cmek = False
+            secret_blocks: list[tuple[Path, HclBlock]] = []
+
+            for path in sorted(paths):
+                try:
+                    source = path.read_text(encoding="utf-8", errors="replace")
+                except OSError:
+                    continue
+                if cmek_re.search(source):
+                    module_uses_cmek = True
+                for b in parse_blocks(source):
+                    if b.kind == "resource" and b.label1 == "google_secret_manager_secret":
+                        secret_blocks.append((path, b))
+
+            if not module_uses_cmek or not secret_blocks:
+                continue
+
+            for path, b in secret_blocks:
+                # The secret has CMEK iff customer_managed_encryption appears
+                # inside its body (which lives in user_managed.replicas[*]).
+                if b.contains(r"customer_managed_encryption"):
+                    continue
+                line = b.any_line_matches(r"replication\s*\{") or b.start_line
+                out.append(self._f(
+                    path, line,
+                    "PROOFCTL-TF-G048",
+                    "Secret Manager secret without CMEK in CMEK-using module",
+                    Severity.WARNING,
+                    f'google_secret_manager_secret "{b.label2}" uses Google-managed encryption while the rest of the module uses CMEK — credential is weaker-protected than the data it unlocks',
+                    hint=(
+                        'Switch to replication { user_managed { replicas { '
+                        'location = ... customer_managed_encryption '
+                        '{ kms_key_name = var.kms_key_id } } } } and grant '
+                        'the Secret Manager service agent '
+                        '(service-{project_number}@gcp-sa-secretmanager.iam.gserviceaccount.com) '
+                        'cryptoKeyEncrypterDecrypter on the KMS key.'
+                    ),
+                    authority="CIS GCP Benchmark / Customer-Managed Encryption Keys",
+                    docs_url="https://cloud.google.com/secret-manager/docs/cmek",
+                ))
+        return out
+
     @staticmethod
     def _f(
         path: Path,
@@ -3581,13 +3871,14 @@ class TerraformDirChecker(HclDirChecker):
         severity: Severity,
         message: str,
         hint: str = "",
+        authority: str = "",
         docs_url: str = "",
     ) -> Finding:
         return Finding(
             file=str(path), line=line, col=None,
             rule_id=rule_id, rule_name=rule_name,
             severity=severity, message=message, hint=hint,
-            docs_url=docs_url,
+            authority=authority, docs_url=docs_url,
         )
 
     def _m001(self, tf_files: list[Path]) -> list[Finding]:
@@ -3646,7 +3937,13 @@ class TerraformDirChecker(HclDirChecker):
                     buckets[d][b.label2] = (b.start_line, path)
                 elif b.kind == "resource" and b.label1 == "aws_s3_bucket_public_access_block":
                     bucket_val = b.attr_value("bucket") or ""
-                    ref_m = re.search(r'aws_s3_bucket\.(\w+)\.', bucket_val)
+                    # Match both `aws_s3_bucket.<name>.<attr>` and the
+                    # count-conditional `aws_s3_bucket.<name>[0].<attr>` /
+                    # for_each `aws_s3_bucket.<name>["k"].<attr>` shapes.
+                    ref_m = re.search(
+                        r'aws_s3_bucket\.(\w+)(?:\[[^\]]+\])?\.',
+                        bucket_val,
+                    )
                     if ref_m:
                         pab_refs[d].add(ref_m.group(1))
 

{proofctl-0.4.3 → proofctl-0.5.0}/proofctl/engine.py

@@ -215,6 +215,18 @@ _DOCKERFILE_RE = re.compile(r"^Dockerfile(\..*)?$")
 _HCL_EXTS = (".tf", ".tfvars", ".hcl")
 _YAML_EXTS = (".yml", ".yaml")
 _SHELL_EXTS = (".sh", ".bash", ".zsh", ".ksh")
+# Terraform template files. We classify by content: a .tftpl whose
+# rendered output is a shell script (shebang #!/bin/bash, #!/bin/sh,
+# /usr/bin/env bash, etc.) should be scanned by the SH rules so the
+# template's shell content participates in lint / secret / pattern
+# checks even though it's stored as a Terraform template.
+_TFTPL_EXTS = (".tftpl",)
+_SHELL_SHEBANG_RE = re.compile(
+    rb'^\s*#!\s*(?:'
+    rb'/(?:usr/local/|usr/)?bin/'                # /bin/, /usr/bin/, /usr/local/bin/
+    rb'|/usr/bin/env\s+'                         # /usr/bin/env <name>
+    rb')(?:ba|z|k|ash|d)?sh\b'                   # sh / bash / zsh / ksh / ash / dash
+)
 
 
 def _classify(path: Path) -> str | None:
@@ -227,11 +239,29 @@ def _classify(path: Path) -> str | None:
         return "yaml"
     if path.suffix in _SHELL_EXTS:
         return "shell"
+    if path.suffix in _TFTPL_EXTS and _is_shell_template(path):
+        return "shell"
     if _DOCKERFILE_RE.match(path.name):
         return "dockerfile"
     return None
 
 
+def _is_shell_template(path: Path) -> bool:
+    """True iff a `.tftpl` file looks like a shell-script template.
+
+    Cheapest possible check: read up to 128 bytes and match a shell
+    shebang. We don't try to actually render the template — variables
+    like ``${var.x}`` may sit between the shebang and the script body,
+    but the shebang itself is on line 1 either way.
+    """
+    try:
+        with path.open("rb") as f:
+            head = f.read(128)
+    except OSError:
+        return False
+    return bool(_SHELL_SHEBANG_RE.match(head))
+
+
 def _internal_finding(
     *, scope: str, path: Path | None, exc: BaseException, strict: bool,
 ) -> Finding:

{proofctl-0.4.3 → proofctl-0.5.0/proofctl.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.4.3
+Version: 0.5.0
 Summary: Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit
 Author-email: Kolawolu Odunola <kolawolu.o@gmail.com>
 License: MIT
@@ -28,7 +28,7 @@ Dynamic: license-file
 
 # proofctl
 
-A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **267 rules**, zero dependencies, runs in under a second.
+A linter built for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **269 rules**, zero dependencies, runs in under a second.
 
 ```
 proofctl check .
@@ -165,7 +165,7 @@ git commit -m "chore: add proofctl baseline"
 
 ## Rules
 
-267 rules across 14 families. Run `proofctl rules` after install to enumerate.
+269 rules across 14 families. Run `proofctl rules` after install to enumerate.
 
 | Family | Count | What it covers |
 |---|---|---|
@@ -173,9 +173,9 @@ git commit -m "chore: add proofctl baseline"
 | Python — Security (`S`) | 24 | OWASP Top-10 + CWE coverage: SQLi, command injection, weak crypto, JWT bypass, path traversal, XSS, SSRF, file upload, CSRF, missing authz, XPath injection, open redirect, TLS bypass |
 | Secrets (`SECRET`) | 13 | AWS / GCP / GitHub / Slack / Stripe / private keys / JWTs / hardcoded passwords / K8s Secret YAML / connection strings with embedded creds |
 | Python — Other | 12 | Placeholders, leakage (cross-language idioms, PII), import hallucination, method complexity, variant detection, LLM guardrails (OWASP LLM Top-10) |
-| Terraform — General + AI (`TF-T`, `TF-AI`) | 28 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata |
+| Terraform — General + AI (`TF-T`, `TF-AI`) | 29 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata, unused variable declarations |
 | Terraform — AWS (`TF-A`) | 40 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
-| Terraform — GCP (`TF-G`) | 51 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL, firewall ingress, compute access scopes |
+| Terraform — GCP (`TF-G`) | 52 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |
 | Terraform — Azure (`TF-AZ`) | 14 | Storage public blob, SQL public network, AKS RBAC, Key Vault purge protection, NSG SSH/RDP, managed disk CMK |
 | Terraform — Mechanics + Lifecycle (`TF-M`, `TF-V`) | 12 | SG inline mixing, `force_destroy`, mutable module refs, lifecycle antipatterns |
 | Terragrunt (`TG`) | 6 | HCL inputs, mock_outputs, remote state encryption |

{proofctl-0.4.3 → proofctl-0.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofctl"
-version = "0.4.3"
+version = "0.5.0"
 description = "Zero-dependency linter for Python, Terraform, Dockerfiles, Kubernetes, and GitHub Actions — catches AI slop and security misconfigurations pre-commit"
 readme = "README.md"
 license = { text = "MIT" }