proofctl 0.6.0__tar.gz → 0.6.1__tar.gz

{proofctl-0.6.0/proofctl.egg-info → proofctl-0.6.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.6.0
+Version: 0.6.1
 Summary: DevOps linter and security scanner for AI slop and misconfigurations — runs in pre-commit, CI, or post-commit; no external tools required
 Author: Kolawolu Odunola
 License: MIT
@@ -35,7 +35,7 @@ Dynamic: license-file
 
 # proofctl
 
-A static-analysis linter and security scanner for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **267 rules**, no external tools, runs in under a second.
+A static-analysis linter and security scanner for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **271 rules**, no external tools, runs in under a second.
 
 ```
 proofctl check .
@@ -172,7 +172,7 @@ git commit -m "chore: add proofctl baseline"
 
 ## Rules
 
-267 rules across 13 families. Run `proofctl rules` after install to enumerate.
+271 rules across 13 families. Run `proofctl rules` after install to enumerate.
 
 | Family | Count | What it covers |
 |---|---|---|
@@ -182,12 +182,12 @@ git commit -m "chore: add proofctl baseline"
 | Python — Other | 15 | Placeholders, leakage (cross-language idioms, PII), import hallucination, variant detection, LLM guardrails (OWASP LLM Top-10) |
 | Terraform — General + AI (`TF-T`, `TF-AI`) | 25 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata, unused variable declarations |
 | Terraform — AWS (`TF-A`) | 36 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
-| Terraform — GCP (`TF-G`) | 46 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |
+| Terraform — GCP (`TF-G`) | 48 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |
 | Terraform — Azure (`TF-AZ`) | 14 | Storage public blob, SQL public network, AKS RBAC, Key Vault purge protection, NSG SSH/RDP, managed disk CMK |
 | Terraform — Mechanics + Lifecycle (`TF-M`, `TF-V`) | 10 | SG inline mixing, `force_destroy`, mutable module refs, lifecycle antipatterns |
 | Terragrunt (`TG`) | 6 | HCL inputs, mock_outputs, remote state encryption |
 | Dockerfile (`DF`) | 15 | Latest tag, root user, secret leakage, OCI labels, HEALTHCHECK, legacy ENV form |
-| Kubernetes YAML (`YAML`) | 32 | Pod Security Standards, hostPath, default namespace, image digest pinning, RBAC wildcards |
+| Kubernetes YAML (`YAML`) | 34 | Pod Security Standards, hostPath, default namespace, image digest pinning, RBAC wildcards |
 | GitHub Actions (`YAML-GHA`) | 6 | SHA pinning, expression injection, missing permissions, secret env-var leakage, missing timeouts |
 | Shell (`SH`) | 8 | Dangerous globbing, missing `set -euo pipefail` |
 

{proofctl-0.6.0 → proofctl-0.6.1}/README.md

@@ -1,6 +1,6 @@
 # proofctl
 
-A static-analysis linter and security scanner for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **267 rules**, no external tools, runs in under a second.
+A static-analysis linter and security scanner for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **271 rules**, no external tools, runs in under a second.
 
 ```
 proofctl check .
@@ -137,7 +137,7 @@ git commit -m "chore: add proofctl baseline"
 
 ## Rules
 
-267 rules across 13 families. Run `proofctl rules` after install to enumerate.
+271 rules across 13 families. Run `proofctl rules` after install to enumerate.
 
 | Family | Count | What it covers |
 |---|---|---|
@@ -147,12 +147,12 @@ git commit -m "chore: add proofctl baseline"
 | Python — Other | 15 | Placeholders, leakage (cross-language idioms, PII), import hallucination, variant detection, LLM guardrails (OWASP LLM Top-10) |
 | Terraform — General + AI (`TF-T`, `TF-AI`) | 25 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata, unused variable declarations |
 | Terraform — AWS (`TF-A`) | 36 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
-| Terraform — GCP (`TF-G`) | 46 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |
+| Terraform — GCP (`TF-G`) | 48 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |
 | Terraform — Azure (`TF-AZ`) | 14 | Storage public blob, SQL public network, AKS RBAC, Key Vault purge protection, NSG SSH/RDP, managed disk CMK |
 | Terraform — Mechanics + Lifecycle (`TF-M`, `TF-V`) | 10 | SG inline mixing, `force_destroy`, mutable module refs, lifecycle antipatterns |
 | Terragrunt (`TG`) | 6 | HCL inputs, mock_outputs, remote state encryption |
 | Dockerfile (`DF`) | 15 | Latest tag, root user, secret leakage, OCI labels, HEALTHCHECK, legacy ENV form |
-| Kubernetes YAML (`YAML`) | 32 | Pod Security Standards, hostPath, default namespace, image digest pinning, RBAC wildcards |
+| Kubernetes YAML (`YAML`) | 34 | Pod Security Standards, hostPath, default namespace, image digest pinning, RBAC wildcards |
 | GitHub Actions (`YAML-GHA`) | 6 | SHA pinning, expression injection, missing permissions, secret env-var leakage, missing timeouts |
 | Shell (`SH`) | 8 | Dangerous globbing, missing `set -euo pipefail` |
 

{proofctl-0.6.0 → proofctl-0.6.1}/proofctl/checkers/terraform.py

@@ -121,6 +121,30 @@ _BROAD_GCP_ROLES = frozenset({
     "roles/iam.serviceAccountAdmin",
 })
 
+# Project-scoped roles that grant data-plane access to EVERY resource of that
+# service in the project. Resource-level IAM exists for all of them, so a
+# project-wide grant is the cross-tenant blast-radius shape: one compromised
+# principal reads (or rewrites) every tenant's data.
+_PROJECT_WIDE_DATA_ROLES = frozenset({
+    "roles/secretmanager.admin",
+    "roles/secretmanager.secretAccessor",
+    "roles/secretmanager.secretVersionManager",
+    "roles/datastore.owner",
+    "roles/datastore.user",
+    "roles/datastore.viewer",
+    "roles/storage.objectAdmin",
+    "roles/storage.objectUser",
+    "roles/storage.objectViewer",
+    "roles/cloudkms.cryptoKeyDecrypter",
+    "roles/cloudkms.cryptoKeyEncrypterDecrypter",
+    "roles/bigquery.dataOwner",
+    "roles/bigquery.dataEditor",
+    "roles/bigquery.dataViewer",
+})
+
+# Any `roles/<service>.admin` at project scope (storage.admin, cloudsql.admin…).
+_SERVICE_ADMIN_ROLE_RE = re.compile(r"^roles/[a-z][A-Za-z]*\.admin$")
+
 _GCP_IAM_RESOURCES = frozenset({
     "google_project_iam_binding",
     "google_project_iam_member",
@@ -247,6 +271,8 @@ class TerraformChecker(HclFileChecker):
         out += self._g019(path, blocks)
         out += self._g020(path, blocks)
         out += self._g021(path, blocks)
+        out += self._g049(path, blocks)
+        out += self._g050(path, blocks)
         out += self._g023(path, blocks)
         out += self._g024(path, blocks)
         out += self._g025(path, blocks)
@@ -1359,6 +1385,65 @@ class TerraformChecker(HclFileChecker):
                 ))
         return out
 
+    def _g049(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
+        """G-049 — Project-scoped role granting data access to every resource."""
+        out = []
+        for b in blocks:
+            if b.kind != "resource" or b.label1 not in _GCP_IAM_RESOURCES:
+                continue
+            role = (b.attr_value("role") or "").strip('"')
+            if not role or role in _BROAD_GCP_ROLES:
+                continue  # G-021 already covers the primitive/IAM-admin roles
+            if role not in _PROJECT_WIDE_DATA_ROLES and not _SERVICE_ADMIN_ROLE_RE.match(role):
+                continue
+            out.append(self._f(
+                path, b.attr_line("role") or b.start_line,
+                "PROOFCTL-TF-G049", "Project-wide data-access role",
+                Severity.WARNING,
+                f'"{b.label1}" grants "{role}" at project scope — this principal can '
+                f"reach every resource of that service in the project",
+                hint=(
+                    "Bind the role on the specific resource instead — e.g. "
+                    "google_secret_manager_secret_iam_member / "
+                    "google_storage_bucket_iam_member — so one compromised principal "
+                    "cannot read every tenant's data."
+                ),
+                authority="Google IAM — principle of least privilege",
+                docs_url="https://cloud.google.com/iam/docs/best-practices-service-accounts",
+            ))
+        return out
+
+    def _g050(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
+        """G-050 — Firewall rule allows unrestricted egress to the internet."""
+        out = []
+        for b in blocks:
+            if b.kind != "resource" or b.label1 != "google_compute_firewall":
+                continue
+            if (b.attr_value("direction") or "").strip('"').upper() != "EGRESS":
+                continue
+            if not b.contains(r'destination_ranges\s*=\s*\[[^\]]*"0\.0\.0\.0/0"'):
+                continue
+            # A deny-all egress rule to 0.0.0.0/0 is the protective pattern, not a
+            # finding. Match single-line and multi-line block forms.
+            if b.has_nested("deny") or b.contains(r"\bdeny\s*\{"):
+                continue
+            if not (b.has_nested("allow") or b.contains(r"\ballow\s*\{")):
+                continue
+            out.append(self._f(
+                path, b.start_line,
+                "PROOFCTL-TF-G050", "Firewall allows egress to the internet",
+                Severity.WARNING,
+                f'google_compute_firewall "{b.label2}" allows egress to 0.0.0.0/0 — '
+                f"a compromised workload can exfiltrate data anywhere",
+                hint=(
+                    "Restrict destination_ranges to the CIDRs actually required, or keep "
+                    "an FQDN/CIDR allow-list above a low-priority deny-all egress rule."
+                ),
+                authority="CIS GCP Benchmark 3.x / MITRE ATT&CK T1048",
+                docs_url="https://cloud.google.com/vpc/docs/firewalls",
+            ))
+        return out
+
     def _g023(self, path: Path, blocks: list[HclBlock]) -> list[Finding]:
         """G-023 — KMS key rotation not configured or > 90 days."""
         out = []

{proofctl-0.6.0 → proofctl-0.6.1}/proofctl/checkers/yaml_checker.py

@@ -812,6 +812,116 @@ def _yaml014_k8s(root: yaml.MappingNode, path: Path) -> list[Finding]:
     return findings
 
 
+def _netpol_meta(root: yaml.MappingNode) -> tuple[str, yaml.MappingNode | None]:
+    """Return (name, spec) for a NetworkPolicy document, or ("", None)."""
+    if _scalar(_get_key(root, "kind")) != "NetworkPolicy":
+        return "", None
+    name = "unnamed"
+    meta = _get_key(root, "metadata")
+    if isinstance(meta, yaml.MappingNode):
+        name = _scalar(_get_key(meta, "name")) or "unnamed"
+    spec = _get_key(root, "spec")
+    return name, spec if isinstance(spec, yaml.MappingNode) else None
+
+
+def _yaml027_netpol_no_egress(root: yaml.MappingNode, path: Path) -> list[Finding]:
+    """PROOFCTL-YAML-027 — NetworkPolicy does not restrict egress.
+
+    Omitting `Egress` from policyTypes means Kubernetes defaults to
+    `policyTypes: [Ingress]`, leaving outbound traffic completely
+    unrestricted — the pod can still reach the cloud metadata endpoint
+    and any internet host.
+    """
+    name, spec = _netpol_meta(root)
+    if spec is None:
+        return []
+
+    types_node = _get_key(spec, "policyTypes")
+    declared = []
+    if isinstance(types_node, yaml.SequenceNode):
+        declared = [_scalar(v) or "" for v in types_node.value]
+    if "Egress" in declared:
+        return []
+    # An explicit `egress:` block implies Egress even if policyTypes is absent.
+    if _get_key(spec, "egress") is not None:
+        return []
+
+    node = types_node or spec
+    return [Finding(
+        file=str(path),
+        line=node.start_mark.line + 1,
+        col=node.start_mark.column,
+        rule_id="PROOFCTL-YAML-027",
+        rule_name="NetworkPolicy does not restrict egress",
+        severity=Severity.WARNING,
+        message=(
+            f"NetworkPolicy '{name}' has no Egress policyType — outbound traffic is "
+            f"unrestricted, so a compromised pod can reach the metadata endpoint and "
+            f"exfiltrate to any host"
+        ),
+        hint=(
+            "Add 'Egress' to policyTypes and an egress allow-list (DNS, the datastore "
+            "CIDR, required APIs). Default-deny egress also blocks 169.254.169.254."
+        ),
+        authority="Kubernetes Network Policies / NSA-CISA Kubernetes Hardening",
+        docs_url="https://kubernetes.io/docs/concepts/services-networking/network-policies/",
+    )]
+
+
+def _yaml028_netpol_broad_peer(root: yaml.MappingNode, path: Path) -> list[Finding]:
+    """PROOFCTL-YAML-028 — NetworkPolicy peer selects a whole namespace, all ports.
+
+    A `from`/`to` peer carrying only a namespaceSelector admits every pod in any
+    matching namespace. With no `ports:` on the rule it is every port too, so any
+    workload landing in that namespace reaches the datastore tier directly.
+    """
+    name, spec = _netpol_meta(root)
+    if spec is None:
+        return []
+
+    findings: list[Finding] = []
+    for direction, peer_key in (("ingress", "from"), ("egress", "to")):
+        rules_node = _get_key(spec, direction)
+        if not isinstance(rules_node, yaml.SequenceNode):
+            continue
+        for rule in rules_node.value:
+            if not isinstance(rule, yaml.MappingNode):
+                continue
+            has_ports = _get_key(rule, "ports") is not None
+            peers = _get_key(rule, peer_key)
+            if not isinstance(peers, yaml.SequenceNode):
+                continue
+            for peer in peers.value:
+                if not isinstance(peer, yaml.MappingNode):
+                    continue
+                keys = {_scalar(k) for k, _ in peer.value}
+                # Only a namespaceSelector: no pod narrowing within the namespace.
+                if "namespaceSelector" not in keys or "podSelector" in keys:
+                    continue
+                if has_ports:
+                    continue  # port-scoped: materially narrower, don't flag
+                findings.append(Finding(
+                    file=str(path),
+                    line=peer.start_mark.line + 1,
+                    col=peer.start_mark.column,
+                    rule_id="PROOFCTL-YAML-028",
+                    rule_name="NetworkPolicy peer selects entire namespace",
+                    severity=Severity.WARNING,
+                    message=(
+                        f"NetworkPolicy '{name}' {direction} rule admits every pod in the "
+                        f"selected namespace on every port"
+                    ),
+                    hint=(
+                        "Pair the namespaceSelector with a podSelector in the same peer "
+                        "(logical AND) and add a 'ports:' list, so only the intended "
+                        "workload and port are reachable."
+                    ),
+                    authority="Kubernetes Network Policies / NSA-CISA Kubernetes Hardening",
+                    docs_url="https://kubernetes.io/docs/concepts/services-networking/network-policies/",
+                ))
+    return findings
+
+
 def _yaml015_k8s(root: yaml.MappingNode, path: Path) -> list[Finding]:
     """PROOFCTL-YAML-015 — ClusterRoleBinding with roleRef.name: cluster-admin."""
     findings: list[Finding] = []
@@ -1793,6 +1903,8 @@ class _YamlCheckerImpl(YamlFileChecker):
                 findings.extend(_yaml024_runasuser_low(root, path))
                 findings.extend(_yaml025_rbac_wildcard_admin(root, path))
                 findings.extend(_yaml026_net_raw(root, path))
+                findings.extend(_yaml027_netpol_no_egress(root, path))
+                findings.extend(_yaml028_netpol_broad_peer(root, path))
                 # AI-slop: removed apiVersions, PSP, explicit root, deprecated annotations
                 findings.extend(_yaml_ai001_k8s_removed_api(root, path))
                 findings.extend(_yaml_ai002_pod_security_policy(root, path))

{proofctl-0.6.0 → proofctl-0.6.1/proofctl.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proofctl
-Version: 0.6.0
+Version: 0.6.1
 Summary: DevOps linter and security scanner for AI slop and misconfigurations — runs in pre-commit, CI, or post-commit; no external tools required
 Author: Kolawolu Odunola
 License: MIT
@@ -35,7 +35,7 @@ Dynamic: license-file
 
 # proofctl
 
-A static-analysis linter and security scanner for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **267 rules**, no external tools, runs in under a second.
+A static-analysis linter and security scanner for the DevOps stack — Python, Terraform, Kubernetes, Helm, Dockerfiles, GitHub Actions, Shell — that catches the specific kinds of mistakes AI coding tools introduce. **271 rules**, no external tools, runs in under a second.
 
 ```
 proofctl check .
@@ -172,7 +172,7 @@ git commit -m "chore: add proofctl baseline"
 
 ## Rules
 
-267 rules across 13 families. Run `proofctl rules` after install to enumerate.
+271 rules across 13 families. Run `proofctl rules` after install to enumerate.
 
 | Family | Count | What it covers |
 |---|---|---|
@@ -182,12 +182,12 @@ git commit -m "chore: add proofctl baseline"
 | Python — Other | 15 | Placeholders, leakage (cross-language idioms, PII), import hallucination, variant detection, LLM guardrails (OWASP LLM Top-10) |
 | Terraform — General + AI (`TF-T`, `TF-AI`) | 25 | required_version, sensitive outputs, IAM wildcards, mutable git refs, deprecated resources, AWS-region-in-GCP, placeholder values, image-family pinning, sensitive vars in VM metadata, unused variable declarations |
 | Terraform — AWS (`TF-A`) | 36 | EC2 IMDSv2, S3 public-access-block, EBS encryption, VPC flow logs, KMS rotation, RDS hardening, SG / NACL / EKS / DynamoDB / ElastiCache / CloudTrail / IAM |
-| Terraform — GCP (`TF-G`) | 46 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |
+| Terraform — GCP (`TF-G`) | 48 | GKE hardening, GCS public-access prevention, IAM roles, KMS rotation, Cloud Function/Run public, BigQuery, Pub/Sub CMEK, Cloud SQL (TLS ssl_mode aware), firewall ingress, compute access scopes, Secret Manager CMEK consistency |
 | Terraform — Azure (`TF-AZ`) | 14 | Storage public blob, SQL public network, AKS RBAC, Key Vault purge protection, NSG SSH/RDP, managed disk CMK |
 | Terraform — Mechanics + Lifecycle (`TF-M`, `TF-V`) | 10 | SG inline mixing, `force_destroy`, mutable module refs, lifecycle antipatterns |
 | Terragrunt (`TG`) | 6 | HCL inputs, mock_outputs, remote state encryption |
 | Dockerfile (`DF`) | 15 | Latest tag, root user, secret leakage, OCI labels, HEALTHCHECK, legacy ENV form |
-| Kubernetes YAML (`YAML`) | 32 | Pod Security Standards, hostPath, default namespace, image digest pinning, RBAC wildcards |
+| Kubernetes YAML (`YAML`) | 34 | Pod Security Standards, hostPath, default namespace, image digest pinning, RBAC wildcards |
 | GitHub Actions (`YAML-GHA`) | 6 | SHA pinning, expression injection, missing permissions, secret env-var leakage, missing timeouts |
 | Shell (`SH`) | 8 | Dangerous globbing, missing `set -euo pipefail` |
 

{proofctl-0.6.0 → proofctl-0.6.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "proofctl"
-version = "0.6.0"
+version = "0.6.1"
 description = "DevOps linter and security scanner for AI slop and misconfigurations — runs in pre-commit, CI, or post-commit; no external tools required"
 readme = "README.md"
 license = { text = "MIT" }
@@ -59,9 +59,11 @@ target-version = "py311"
 line-length = 120
 
 [tool.ruff.lint]
-# Default rules (pycodestyle errors E4/E7/E9 + pyflakes F) catch the real bug
-# class: undefined names, unused imports/variables. E701 (compact one-line
-# `if cond: return`) is an intentional style in the type-dispatch helpers.
+# Pinned explicitly, NOT left to ruff's default: the default set changes between
+# ruff versions, and `ruff>=0.4` in [dev] would then silently move a hard CI gate.
+# E4/E7/E9 + F are the bug-class rules (undefined names, unused imports/vars).
+select = ["E4", "E7", "E9", "F"]
+# E701 (compact one-line `if cond: return`) is intentional in the type-dispatch helpers.
 ignore = ["E701"]
 
 [tool.setuptools.packages.find]