raxe 0.4.6__py3-none-any.whl

raxe/infrastructure/security/signatures.py

@@ -0,0 +1,171 @@
+"""Cryptographic signature verification for packs.
+
+Uses Ed25519 for fast, secure signatures.
+"""
+import base64
+import hashlib
+from pathlib import Path
+
+try:
+    from cryptography.exceptions import InvalidSignature
+    from cryptography.hazmat.primitives import serialization
+    from cryptography.hazmat.primitives.asymmetric import ed25519
+
+    CRYPTO_AVAILABLE = True
+except ImportError:
+    CRYPTO_AVAILABLE = False
+
+
+class SignatureError(Exception):
+    """Signature verification failed."""
+
+    pass
+
+
+class SignatureVerifier:
+    """
+    Verify cryptographic signatures on rule packs.
+
+    Uses Ed25519 for performance and security:
+    - Fast verification (<1ms)
+    - Small signatures (64 bytes)
+    - Strong security (128-bit)
+    """
+
+    # Embedded RAXE public key (rotatable)
+    # In production, this would be embedded during build
+    RAXE_PUBLIC_KEY_PEM = """-----BEGIN PUBLIC KEY-----
+MCowBQYDK2VwAyEAGb9ECWmEzf6FQbrBZ9w7lshQhqowtrbLDFw4rXAxZuE=
+-----END PUBLIC KEY-----"""
+
+    def __init__(self, public_key_pem: str | None = None):
+        """
+        Initialize verifier.
+
+        Args:
+            public_key_pem: Optional custom public key (for testing)
+        """
+        if not CRYPTO_AVAILABLE:
+            raise ImportError(
+                "cryptography package required for signature verification. "
+                "Install with: pip install cryptography"
+            )
+
+        pem = public_key_pem or self.RAXE_PUBLIC_KEY_PEM
+        self.public_key = self._load_public_key(pem)
+
+    def _load_public_key(self, pem: str) -> "ed25519.Ed25519PublicKey":
+        """Load Ed25519 public key from PEM."""
+        public_key = serialization.load_pem_public_key(pem.encode())
+
+        if not isinstance(public_key, ed25519.Ed25519PublicKey):
+            raise ValueError("Key must be Ed25519")
+
+        return public_key
+
+    def verify_pack(
+        self, pack_dir: Path, signature: str, signature_algorithm: str
+    ) -> bool:
+        """
+        Verify pack signature.
+
+        Args:
+            pack_dir: Directory containing pack files
+            signature: Base64-encoded signature
+            signature_algorithm: Algorithm (must be "ed25519")
+
+        Returns:
+            True if signature valid
+
+        Raises:
+            SignatureError: If verification fails
+        """
+        if signature_algorithm != "ed25519":
+            raise SignatureError(
+                f"Unsupported signature algorithm: {signature_algorithm}"
+            )
+
+        # Parse signature
+        if not signature.startswith("ed25519:"):
+            raise SignatureError("Signature must start with 'ed25519:'")
+
+        sig_b64 = signature.split(":", 1)[1]
+
+        try:
+            signature_bytes = base64.b64decode(sig_b64)
+        except Exception as e:
+            raise SignatureError(f"Invalid base64 signature: {e}") from e
+
+        # Hash pack contents
+        pack_hash = self._hash_pack_contents(pack_dir)
+
+        # Verify signature
+        try:
+            self.public_key.verify(signature_bytes, pack_hash)
+            return True
+        except InvalidSignature as e:
+            raise SignatureError("Pack signature verification failed") from e
+
+    def _hash_pack_contents(self, pack_dir: Path) -> bytes:
+        """
+        Create deterministic hash of pack contents.
+
+        Hashes:
+        1. pack.yaml manifest
+        2. All rule YAML files (sorted by path)
+
+        Returns:
+            SHA-256 hash of pack contents
+        """
+        hasher = hashlib.sha256()
+
+        # Hash manifest
+        manifest_path = pack_dir / "pack.yaml"
+        if manifest_path.exists():
+            with open(manifest_path, "rb") as f:
+                hasher.update(f.read())
+
+        # Hash all rule files (sorted for determinism)
+        rule_files = sorted(pack_dir.rglob("*.yaml"))
+        rule_files = [f for f in rule_files if f.name != "pack.yaml"]
+
+        for rule_file in rule_files:
+            # Include relative path in hash
+            rel_path = rule_file.relative_to(pack_dir)
+            hasher.update(str(rel_path).encode())
+
+            # Include file contents
+            with open(rule_file, "rb") as f:
+                hasher.update(f.read())
+
+        return hasher.digest()
+
+    def generate_signature(self, pack_dir: Path, private_key_pem: str) -> str:
+        """
+        Generate signature for pack (RAXE internal use only).
+
+        Args:
+            pack_dir: Pack directory
+            private_key_pem: Ed25519 private key in PEM format
+
+        Returns:
+            Signature in format "ed25519:<base64>"
+        """
+        # Load private key
+        private_key = serialization.load_pem_private_key(
+            private_key_pem.encode(), password=None
+        )
+
+        if not isinstance(private_key, ed25519.Ed25519PrivateKey):
+            raise ValueError("Key must be Ed25519")
+
+        # Hash pack contents
+        pack_hash = self._hash_pack_contents(pack_dir)
+
+        # Sign
+        signature_bytes = private_key.sign(pack_hash)
+
+        # Encode
+        sig_b64 = base64.b64encode(signature_bytes).decode()
+
+        return f"ed25519:{sig_b64}"

raxe/infrastructure/suppression/__init__.py

@@ -0,0 +1,36 @@
+"""Infrastructure layer for suppression system - ALL I/O operations.
+
+This module provides concrete implementations of the SuppressionRepository:
+
+YAML format (.raxe/suppressions.yaml) - RECOMMENDED:
+- YamlSuppressionRepository: Reads/writes .raxe/suppressions.yaml files
+- YamlCompositeSuppressionRepository: Combines YAML + SQLite storage
+- CompositeSuppressionRepository: Alias for YamlCompositeSuppressionRepository
+
+Common:
+- SQLiteSuppressionRepository: Logs audit entries to SQLite
+
+Note: The legacy .raxeignore file format (FileSuppressionRepository) has been
+removed in v1.0. Use .raxe/suppressions.yaml format instead. See UPDATE.md
+for migration instructions.
+"""
+from raxe.infrastructure.suppression.composite_repository import (
+    CompositeSuppressionRepository,
+)
+from raxe.infrastructure.suppression.sqlite_repository import (
+    SQLiteSuppressionRepository,
+)
+from raxe.infrastructure.suppression.yaml_composite_repository import (
+    YamlCompositeSuppressionRepository,
+)
+from raxe.infrastructure.suppression.yaml_repository import (
+    YamlSuppressionRepository,
+)
+
+__all__ = [
+    # Sorted alphabetically for lint compliance
+    "CompositeSuppressionRepository",
+    "SQLiteSuppressionRepository",
+    "YamlCompositeSuppressionRepository",
+    "YamlSuppressionRepository",
+]

raxe/infrastructure/suppression/composite_repository.py

@@ -0,0 +1,154 @@
+"""Composite suppression repository (YAML + SQLite).
+
+This infrastructure layer module combines:
+- YamlSuppressionRepository: .raxe/suppressions.yaml file storage
+- SQLiteSuppressionRepository: Audit log persistence
+
+Note: The legacy .raxeignore file format has been deprecated in v1.0.
+Use .raxe/suppressions.yaml instead. See UPDATE.md for migration guide.
+"""
+import logging
+from pathlib import Path
+from typing import Any
+
+from raxe.domain.suppression import AuditEntry, Suppression
+from raxe.infrastructure.suppression.sqlite_repository import (
+    SQLiteSuppressionRepository,
+)
+from raxe.infrastructure.suppression.yaml_repository import (
+    DEFAULT_SUPPRESSIONS_PATH,
+    YamlSuppressionRepository,
+)
+
+logger = logging.getLogger(__name__)
+
+
+class CompositeSuppressionRepository:
+    """Repository that combines YAML storage + SQLite audit logging.
+
+    This repository provides:
+    - Load/save suppressions from .raxe/suppressions.yaml (YamlSuppressionRepository)
+    - Log audit entries to SQLite (SQLiteSuppressionRepository)
+
+    This is the recommended repository for new projects as it provides:
+    - Full YAML format with action overrides (SUPPRESS, FLAG, LOG)
+    - Expiration dates with proper validation
+    - Schema versioning
+    - SQLite audit logging for compliance
+    """
+
+    def __init__(
+        self,
+        config_path: Path | None = None,
+        db_path: Path | None = None,
+    ):
+        """Initialize composite repository.
+
+        Args:
+            config_path: Path to suppressions.yaml file.
+                        Default: ./.raxe/suppressions.yaml
+            db_path: Path to SQLite database (default: ~/.raxe/suppressions.db)
+        """
+        if config_path is None:
+            config_path = Path.cwd() / DEFAULT_SUPPRESSIONS_PATH
+
+        self.yaml_repo = YamlSuppressionRepository(config_path=config_path)
+        self.sqlite_repo = SQLiteSuppressionRepository(db_path=db_path)
+
+        logger.debug(
+            "composite_repository_initialized",
+            extra={
+                "config_path": str(self.yaml_repo.config_path),
+                "db_path": str(self.sqlite_repo.db_path),
+            },
+        )
+
+    def load_suppressions(self) -> list[Suppression]:
+        """Load suppressions from .raxe/suppressions.yaml file.
+
+        Returns:
+            List of Suppression objects
+        """
+        return self.yaml_repo.load_suppressions()
+
+    def save_suppression(self, suppression: Suppression) -> None:
+        """Save a suppression to YAML repository.
+
+        Note: This only updates the in-memory cache.
+        Call save_all_suppressions() to persist to file.
+
+        Args:
+            suppression: Suppression to save
+        """
+        self.yaml_repo.save_suppression(suppression)
+
+    def remove_suppression(self, pattern: str) -> bool:
+        """Remove a suppression from YAML repository.
+
+        Note: This only updates the in-memory cache.
+        Call save_all_suppressions() to persist to file.
+
+        Args:
+            pattern: Pattern to remove
+
+        Returns:
+            True if removed, False if not found
+        """
+        return self.yaml_repo.remove_suppression(pattern)
+
+    def save_all_suppressions(self, suppressions: list[Suppression]) -> None:
+        """Replace all suppressions and write to .raxe/suppressions.yaml file.
+
+        Args:
+            suppressions: List of suppressions to save
+        """
+        self.yaml_repo.save_all_suppressions(suppressions)
+
+    def log_audit(self, entry: AuditEntry) -> None:
+        """Log audit entry to SQLite database.
+
+        Args:
+            entry: Audit entry to log
+        """
+        self.sqlite_repo.log_audit(entry)
+
+    def get_audit_log(
+        self,
+        limit: int = 100,
+        pattern: str | None = None,
+        action: str | None = None,
+    ) -> list[dict[str, Any]]:
+        """Get audit log entries from SQLite database.
+
+        Args:
+            limit: Maximum entries to return
+            pattern: Filter by pattern (optional)
+            action: Filter by action (added/removed/applied, optional)
+
+        Returns:
+            List of audit log entries as dictionaries
+        """
+        return self.sqlite_repo.get_audit_log(
+            limit=limit,
+            pattern=pattern,
+            action=action,
+        )
+
+    @property
+    def config_path(self) -> Path:
+        """Get the config file path (for backward compatibility)."""
+        return self.yaml_repo.config_path
+
+    @property
+    def db_path(self) -> Path:
+        """Get the database path (for backward compatibility)."""
+        return self.sqlite_repo.db_path
+
+    @property
+    def file_exists(self) -> bool:
+        """Check if the YAML configuration file exists.
+
+        Returns:
+            True if file exists, False otherwise
+        """
+        return self.yaml_repo.file_exists

raxe/infrastructure/suppression/sqlite_repository.py

@@ -0,0 +1,231 @@
+"""SQLite-based suppression repository (audit logging).
+
+This infrastructure layer module handles ALL SQLite I/O operations:
+- Database connection management
+- Table creation and migrations
+- Audit log persistence
+- Query execution
+"""
+import json
+import logging
+import sqlite3
+from pathlib import Path
+from typing import Any
+
+from raxe.domain.suppression import AuditEntry, Suppression
+
+logger = logging.getLogger(__name__)
+
+
+class SQLiteSuppressionRepository:
+    """Repository that stores audit logs in SQLite database.
+
+    Handles:
+    - SQLite database operations
+    - Audit log persistence
+    - Query execution
+    - Schema management
+
+    Does NOT handle:
+    - File I/O for .raxeignore (use FileSuppressionRepository)
+    """
+
+    def __init__(self, db_path: Path | None = None):
+        """Initialize SQLite repository.
+
+        Args:
+            db_path: Path to SQLite database (default: ~/.raxe/suppressions.db)
+        """
+        if db_path is None:
+            db_path = Path.home() / ".raxe" / "suppressions.db"
+
+        self.db_path = Path(db_path)
+
+        # Initialize database schema
+        self._init_database()
+
+    def _init_database(self) -> None:
+        """Initialize SQLite database for audit logging."""
+        # Ensure directory exists
+        self.db_path.parent.mkdir(parents=True, exist_ok=True)
+
+        conn = sqlite3.connect(self.db_path)
+        cursor = conn.cursor()
+
+        # Create suppressions audit table
+        cursor.execute("""
+            CREATE TABLE IF NOT EXISTS suppression_audit (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                pattern TEXT NOT NULL,
+                reason TEXT NOT NULL,
+                action TEXT NOT NULL,
+                scan_id INTEGER,
+                rule_id TEXT,
+                created_at TEXT NOT NULL,
+                created_by TEXT,
+                metadata TEXT
+            )
+        """)
+
+        # Create indexes for efficient queries
+        cursor.execute("""
+            CREATE INDEX IF NOT EXISTS idx_audit_pattern
+            ON suppression_audit(pattern)
+        """)
+        cursor.execute("""
+            CREATE INDEX IF NOT EXISTS idx_audit_action
+            ON suppression_audit(action)
+        """)
+        cursor.execute("""
+            CREATE INDEX IF NOT EXISTS idx_audit_created_at
+            ON suppression_audit(created_at)
+        """)
+
+        conn.commit()
+        conn.close()
+
+        logger.debug(f"Initialized suppression database: {self.db_path}")
+
+    def load_suppressions(self) -> list[Suppression]:
+        """Load suppressions (NO-OP for SQLite repository).
+
+        SQLite repository only handles audit logging, not suppression storage.
+        Use FileSuppressionRepository or CompositeSuppressionRepository.
+
+        Returns:
+            Empty list (no suppressions stored)
+        """
+        return []
+
+    def save_suppression(self, suppression: Suppression) -> None:
+        """Save suppression (NO-OP for SQLite repository).
+
+        SQLite repository only handles audit logging, not suppression storage.
+        Use FileSuppressionRepository or CompositeSuppressionRepository.
+
+        Args:
+            suppression: Suppression to save (ignored)
+        """
+        # NO-OP: SQLite repository only does audit logging
+        pass
+
+    def remove_suppression(self, pattern: str) -> bool:
+        """Remove suppression (NO-OP for SQLite repository).
+
+        SQLite repository only handles audit logging, not suppression storage.
+        Use FileSuppressionRepository or CompositeSuppressionRepository.
+
+        Args:
+            pattern: Pattern to remove (ignored)
+
+        Returns:
+            False (no suppressions stored)
+        """
+        return False
+
+    def save_all_suppressions(self, suppressions: list[Suppression]) -> None:
+        """Save all suppressions (NO-OP for SQLite repository).
+
+        SQLite repository only handles audit logging, not suppression storage.
+        Use FileSuppressionRepository or CompositeSuppressionRepository.
+
+        Args:
+            suppressions: List of suppressions to save (ignored)
+        """
+        # NO-OP: SQLite repository only does audit logging
+        pass
+
+    def log_audit(self, entry: AuditEntry) -> None:
+        """Log audit entry to database.
+
+        Args:
+            entry: Audit entry to log
+        """
+        conn = sqlite3.connect(self.db_path)
+        cursor = conn.cursor()
+
+        try:
+            cursor.execute("""
+                INSERT INTO suppression_audit (
+                    pattern, reason, action, scan_id, rule_id, created_at, created_by, metadata
+                ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+            """, (
+                entry.pattern,
+                entry.reason,
+                entry.action,
+                entry.scan_id,
+                entry.rule_id,
+                entry.created_at,
+                entry.created_by,
+                json.dumps(entry.metadata) if entry.metadata else None,
+            ))
+
+            conn.commit()
+            logger.debug(f"Logged audit entry: {entry.action} {entry.pattern}")
+
+        except sqlite3.Error as e:
+            logger.error(f"Failed to log audit entry: {e}")
+            raise
+
+        finally:
+            conn.close()
+
+    def get_audit_log(
+        self,
+        limit: int = 100,
+        pattern: str | None = None,
+        action: str | None = None,
+    ) -> list[dict[str, Any]]:
+        """Get audit log entries from database.
+
+        Args:
+            limit: Maximum entries to return
+            pattern: Filter by pattern (optional)
+            action: Filter by action (added/removed/applied, optional)
+
+        Returns:
+            List of audit log entries as dictionaries
+        """
+        conn = sqlite3.connect(self.db_path)
+        conn.row_factory = sqlite3.Row
+        cursor = conn.cursor()
+
+        try:
+            # Build query
+            query = "SELECT * FROM suppression_audit WHERE 1=1"
+            params: list[Any] = []
+
+            if pattern:
+                query += " AND pattern = ?"
+                params.append(pattern)
+
+            if action:
+                query += " AND action = ?"
+                params.append(action)
+
+            query += " ORDER BY created_at DESC LIMIT ?"
+            params.append(limit)
+
+            cursor.execute(query, params)
+            rows = cursor.fetchall()
+
+            # Convert to dicts
+            results = []
+            for row in rows:
+                entry = dict(row)
+                # Parse metadata JSON
+                if entry.get("metadata"):
+                    try:
+                        entry["metadata"] = json.loads(entry["metadata"])
+                    except json.JSONDecodeError:
+                        entry["metadata"] = None
+                results.append(entry)
+
+            return results
+
+        except sqlite3.Error as e:
+            logger.error(f"Failed to get audit log: {e}")
+            return []
+
+        finally:
+            conn.close()