From c8638c3ffffd379da6df681cb174a5d4f3f018c5 Mon Sep 17 00:00:00 2001 From: Jason Swank <632526+jswank@users.noreply.github.com> Date: Thu, 22 Jan 2026 15:20:52 -0500 Subject: [PATCH] checkov --- Taskfile.yaml | 35 +- config/binstaller.binstaller.yml | 17 - scripts/checkov-install.sh | 615 +++++++++++++++++++++++++++++++ 3 files changed, 637 insertions(+), 30 deletions(-) create mode 100755 scripts/checkov-install.sh diff --git a/Taskfile.yaml b/Taskfile.yaml index f03b131..bb355b1 100644 --- a/Taskfile.yaml +++ b/Taskfile.yaml @@ -54,18 +54,6 @@ tasks: requires: vars: ["REPO"] - latest-release: - desc: Determine the latest release available for a given repo. - summary: | - Determine the latest release available for a given GitHub repository. - - Invoke this task like: - task latest-release REPO=trufflesecurity/trufflehog - cmd: | - gh release view -R {{.REPO}} --json tagName --jq .tagName - requires: - vars: ["REPO"] - embed-checksums: desc: Embed checksums into a binst configuration file. summary: | @@ -81,7 +69,15 @@ tasks: set +o errexit binst embed-checksums --config {{.CONFIG_DIR}}/{{.BINARY}}.binstaller.yml --version {{.VERSION}} --mode download if [ $? -ne 0 ]; then - binst embed-checksums --config {{.CONFIG_DIR}}/{{.BINARY}}.binstaller.yml --version {{.VERSION}} --mode calculate + # this is tougher than it should be... + # without this, checksums aren't written to the file at all + printf 'checksums:\n' >> {{.CONFIG_DIR}}/{{.BINARY}}.binstaller.yml + binst embed-checksums \ + --config {{.CONFIG_DIR}}/{{.BINARY}}.binstaller.yml \ + --version latest \ + --mode calculate + # then the formatting is weird, so in-place edit using yq + yq -i {{.CONFIG_DIR}}/{{.BINARY}}.binstaller.yml fi vars: @@ -103,6 +99,19 @@ tasks: requires: vars: ["BINARY"] + latest-release: + desc: Determine the latest release available for a given repo. + summary: | + Determine the latest release available for a given GitHub repository. + + Invoke this task like: + task latest-release REPO=trufflesecurity/trufflehog + cmd: | + gh release view -R {{.REPO}} --json tagName --jq .tagName + requires: + vars: ["REPO"] + + install-*: desc: Install a binary using its installation script. summary: | diff --git a/config/binstaller.binstaller.yml b/config/binstaller.binstaller.yml index c3d193c..236c367 100644 --- a/config/binstaller.binstaller.yml +++ b/config/binstaller.binstaller.yml @@ -20,20 +20,3 @@ asset: - when: os: windows ext: .zip -checksums: - algorithm: sha256 - template: checksums.txt - embedded_checksums: - v0.12.0: - - filename: binst_Darwin_arm64.tar.gz - hash: 2c3a8cf9b8f95edb5d97b905ccb0204800b25f1a9bc2b4ad704596e756e41eb9 - - filename: binst_Darwin_x86_64.tar.gz - hash: bd9eae149f5735671bf1f32204f5ba9f10de269a290755f21f93bf1bb5d09b03 - - filename: binst_Linux_arm64.tar.gz - hash: 76bca4884ee3fa229d915473ddd53ab4d04c34c9e4b5a1eda36d9751763af916 - - filename: binst_Linux_x86_64.tar.gz - hash: af36ebb92c01ad4b9867a79eb45d1a130efbce20930896ec7578b3746416ee41 - - filename: binst_Windows_arm64.zip - hash: 133784089efd57f5a0164b84ac74c4924c299342c88eb40be65155193ca37761 - - filename: binst_Windows_x86_64.zip - hash: afcc9eab78de6bfa1ce360aebbf1a48738c519cdbe6a9560e6979ec3a4fcb4ef diff --git a/scripts/checkov-install.sh b/scripts/checkov-install.sh new file mode 100755 index 0000000..897d9b1 --- /dev/null +++ b/scripts/checkov-install.sh @@ -0,0 +1,615 @@ +#!/bin/sh +# Code generated by binstaller. DO NOT EDIT. +# +set -e +usage() { + this=$1 + cat </dev/null +} +echoerr() { + echo "$@" 1>&2 +} +_logp=6 +log_set_priority() { + _logp="$1" +} +log_priority() { + if test -z "$1"; then + echo "$_logp" + return + fi + [ "$1" -le "$_logp" ] +} +log_tag() { + case $1 in + 0) echo "emerg" ;; + 1) echo "alert" ;; + 2) echo "crit" ;; + 3) echo "err" ;; + 4) echo "warning" ;; + 5) echo "notice" ;; + 6) echo "info" ;; + 7) echo "debug" ;; + *) echo "$1" ;; + esac +} +log_debug() { + log_priority 7 || return 0 + echoerr "$(log_prefix)" "$(log_tag 7)" "$@" +} +log_info() { + log_priority 6 || return 0 + echoerr "$(log_prefix)" "$(log_tag 6)" "$@" +} +log_err() { + log_priority 3 || return 0 + echoerr "$(log_prefix)" "$(log_tag 3)" "$@" +} +log_crit() { + log_priority 2 || return 0 + echoerr "$(log_prefix)" "$(log_tag 2)" "$@" +} +uname_os() { + os=$(uname -s | tr '[:upper:]' '[:lower:]') + case "$os" in + msys*) os="windows" ;; + mingw*) os="windows" ;; + cygwin*) os="windows" ;; + esac + if [ "$os" = "sunos" ]; then + if [ "$(uname -o)" = "illumos" ]; then + os="illumos" + else + os="solaris" + fi + fi + echo "$os" +} +uname_arch() { + arch=$(uname -m) + case $arch in + x86_64) arch="amd64" ;; + i86pc) arch="amd64" ;; + x86) arch="386" ;; + i686) arch="386" ;; + i386) arch="386" ;; + aarch64) arch="arm64" ;; + armv5*) arch="armv5" ;; + armv6*) arch="armv6" ;; + armv7*) arch="armv7" ;; + esac + echo "${arch}" +} +uname_os_check() { + os=$(uname_os) + case "$os" in + darwin) return 0 ;; + dragonfly) return 0 ;; + freebsd) return 0 ;; + linux) return 0 ;; + android) return 0 ;; + midnightbsd) return 0 ;; + nacl) return 0 ;; + netbsd) return 0 ;; + openbsd) return 0 ;; + plan9) return 0 ;; + solaris) return 0 ;; + illumos) return 0 ;; + windows) return 0 ;; + esac + log_crit "uname_os_check '$(uname -s)' got converted to '$os' which is not a GOOS value. Please file bug at https://github.com/client9/shlib" + return 1 +} +uname_arch_check() { + arch=$(uname_arch) + case "$arch" in + 386) return 0 ;; + amd64) return 0 ;; + arm64) return 0 ;; + armv5) return 0 ;; + armv6) return 0 ;; + armv7) return 0 ;; + ppc64) return 0 ;; + ppc64le) return 0 ;; + mips) return 0 ;; + mipsle) return 0 ;; + mips64) return 0 ;; + mips64le) return 0 ;; + s390x) return 0 ;; + amd64p32) return 0 ;; + esac + log_crit "uname_arch_check '$(uname -m)' got converted to '$arch' which is not a GOARCH value. Please file bug report at https://github.com/client9/shlib" + return 1 +} +cat /dev/null </dev/null) || return 1 + echo "$hash" | cut -d ' ' -f 1 + elif is_command openssl; then + hash=$(openssl dgst -sha256 "$TARGET") || return 1 + echo "$hash" | cut -d ' ' -f 2 + else + log_crit "hash_sha256 unable to find command to compute sha-256 hash" + return 1 + fi +} + +hash_compute() { + hash_sha256 "$1" +} + + +# shellcheck shell=sh +# Terminal progress reporting functions +progress_init() { + # Only show progress on interactive terminals and when not disabled + if [ ! -t 2 ] || [ "${BINSTALLER_NO_PROGRESS}" = "1" ]; then + return 0 + fi + # OSC 9;4 sequences are safely ignored by unsupporting terminals + # Only need special handling for tmux passthrough + if [ -n "$TMUX" ]; then + # Tmux passthrough: DCS tmux; ST + # ESC characters in the wrapped sequence must be doubled + # Format: ESC P tmux; ESC ESC ] 9;4; ... ESC ESC \ ESC \ + PROGRESS_START=$(printf '\033Ptmux;\033\033]9;4;') + # shellcheck disable=SC1003 + PROGRESS_END=$(printf '\033\033\\\033\\') + else + # Direct OSC 9;4 - terminals that don't support it will safely ignore + PROGRESS_START=$(printf '\033]9;4;') + PROGRESS_END=$(printf '\007') + fi +} + +# Start pulsing progress animation +progress_pulse_start() { + # Only show progress on interactive terminals and when not disabled + if [ ! -t 2 ] || [ "${BINSTALLER_NO_PROGRESS}" = "1" ]; then + return 0 + fi + + # Send OSC 9;4 with state 3 (indeterminate/pulsing) once + # The terminal will handle the continuous animation + printf "%s3%s" "$PROGRESS_START" "$PROGRESS_END" >&2 +} + +# Clear progress indicator +progress_clear() { + # Only show progress on interactive terminals and when not disabled + if [ ! -t 2 ] || [ "${BINSTALLER_NO_PROGRESS}" = "1" ]; then + return 0 + fi + printf "%s0;%s" "$PROGRESS_START" "$PROGRESS_END" >&2 +} + +untar() { + tarball=$1 + strip_components=${2:-0} # default 0 + case "${tarball}" in + *.tar.gz | *.tgz) tar --no-same-owner -xzf "${tarball}" --strip-components "${strip_components}" ;; + *.tar.xz) tar --no-same-owner -xJf "${tarball}" --strip-components "${strip_components}" ;; + *.tar.bz2) tar --no-same-owner -xjf "${tarball}" --strip-components "${strip_components}" ;; + *.tar) tar --no-same-owner -xf "${tarball}" --strip-components "${strip_components}" ;; + *.gz) gunzip "${tarball}" ;; + *.zip) + # unzip doesn't have a standard --strip-components + # Workaround: extract to a subdir and move contents up if stripping + if [ "$strip_components" -gt 0 ]; then + extract_dir=$(basename "${tarball%.zip}")_extracted + unzip -q "${tarball}" -d "${extract_dir}" + # Move contents of the *first* directory found inside extract_dir up + # This assumes wrap_in_directory=true convention + first_subdir=$(find "${extract_dir}" -mindepth 1 -maxdepth 1 -type d -print -quit) + if [ -n "$first_subdir" ]; then + # Move all contents (* includes hidden files) + mv "${first_subdir}"/* . + # Optionally remove the now-empty subdir and the extract_dir + rmdir "${first_subdir}" + rmdir "${extract_dir}" + else + log_warn "Could not find subdirectory in zip to strip components from ${extract_dir}" + # Files are extracted in current dir anyway, proceed + fi + else + unzip -q "${tarball}" + fi + ;; + *) + log_err "untar unknown archive format for ${tarball}" + return 1 + ;; + esac +} + + + +hash_verify() { + TARGET_PATH=$1 + SUMFILE=$2 + if [ -z "${SUMFILE}" ]; then + log_err "hash_verify checksum file not specified in arg2" + return 1 + fi + got=$(hash_compute "$TARGET_PATH") + if [ -z "${got}" ]; then + log_err "failed to calculate hash: ${TARGET_PATH}" + return 1 + fi + + BASENAME=${TARGET_PATH##*/} + + # Check for line matches in checksum file + # Format: " " or " *" + # Filename may include path prefix (e.g., "deployment/m2/file.tar.gz") + while IFS= read -r line || [ -n "$line" ]; do + # Normalize tabs to spaces + line=$(echo "$line" | tr '\t' ' ') + + # Remove trailing spaces for hash-only line check + line_trimmed=$(echo "$line" | sed 's/[[:space:]]*$//') + + # Check for hash-only line (no filename) - early return + if [ "$line_trimmed" = "$got" ]; then + return 0 + fi + + # Extract hash and filename parts + # First field is the hash, rest is filename (which may contain spaces) + line_hash=$(echo "$line" | cut -d' ' -f1) + + # Skip if hash doesn't match + if [ "$line_hash" != "$got" ]; then + continue + fi + + # Hash matches, now check filename + # Remove the hash part from the beginning of the line + line_rest="${line#"$got"}" + # Remove leading spaces + while [ "${line_rest#[ ]}" != "$line_rest" ]; do + line_rest="${line_rest#[ ]}" + done + + # Remove leading asterisk if present (binary mode indicator) + if [ "${line_rest#\*}" != "$line_rest" ]; then + line_rest="${line_rest#\*}" + fi + + # Extract just the filename without any path + line_filename="${line_rest##*/}" + + # Check if the filename matches + if [ "$line_filename" = "$BASENAME" ]; then + return 0 + fi + done < "$SUMFILE" + + log_err "hash_verify checksum for '$TARGET_PATH' did not verify" + log_err " Expected hash: ${got}" + log_err " Checksum file content:" + cat "$SUMFILE" >&2 + return 1 +} + +# GitHub HTTP download functions with GITHUB_TOKEN support +github_http_download_curl() { + local_file=$1 + source_url=$2 + header=$3 + if [ -n "$GITHUB_TOKEN" ]; then + log_debug "Using GITHUB_TOKEN for authentication" + if [ -z "$header" ]; then + curl -fsSL -H "Authorization: Bearer $GITHUB_TOKEN" -o "$local_file" "$source_url" + else + curl -fsSL -H "Authorization: Bearer $GITHUB_TOKEN" -H "$header" -o "$local_file" "$source_url" + fi + else + if [ -z "$header" ]; then + curl -fsSL -o "$local_file" "$source_url" + else + curl -fsSL -H "$header" -o "$local_file" "$source_url" + fi + fi +} +github_http_download_wget() { + local_file=$1 + source_url=$2 + header=$3 + if [ -n "$GITHUB_TOKEN" ]; then + log_debug "Using GITHUB_TOKEN for authentication" + if [ -z "$header" ]; then + wget -q --header "Authorization: Bearer $GITHUB_TOKEN" -O "$local_file" "$source_url" + else + wget -q --header "Authorization: Bearer $GITHUB_TOKEN" --header "$header" -O "$local_file" "$source_url" + fi + else + if [ -z "$header" ]; then + wget -q -O "$local_file" "$source_url" + else + wget -q --header "$header" -O "$local_file" "$source_url" + fi + fi +} +github_http_download() { + log_debug "github_http_download $2" + if is_command curl; then + github_http_download_curl "$@" + return + elif is_command wget; then + github_http_download_wget "$@" + return + fi + log_crit "github_http_download unable to find wget or curl" + return 1 +} +github_http_copy() { + tmp=$(mktemp) + github_http_download "${tmp}" "$@" || return 1 + body=$(cat "$tmp") + rm -f "${tmp}" + echo "$body" +} +github_release() { + owner_repo=$1 + version=$2 + test -z "$version" && version="latest" + giturl="https://github.com/${owner_repo}/releases/${version}" + json=$(github_http_copy "$giturl" "Accept:application/json") + test -z "$json" && return 1 + version=$(echo "$json" | tr -s '\n' ' ' | sed 's/.*"tag_name":"//' | sed 's/".*//') + test -z "$version" && return 1 + echo "$version" +} + +# --- Embedded Checksums (Format: VERSION:FILENAME:HASH) --- +EMBEDDED_CHECKSUMS=" +3.2.497:checkov_darwin_X86_64.zip:35129a227f25dc37c2347e8b7b6f61984243201807beeb27eb4f33fda0cbe32a +3.2.497:checkov_linux_X86_64.zip:f713e29c9b0d477df4d2e4b57428dfe3b8333ce425093d626cc02d87e532e627 +3.2.497:checkov_linux_arm64.zip:05060050d59207e6c99fd1d4aae8b2711d0f192c33bbfca7a1de139468bdaeea +3.2.497:checkov_windows_X86_64.zip:3b2e958c4b6d8a50c573e693ba3a3e6270145a26fad403635179b51e51152f1f" + +# Find embedded checksum for a given version and filename +find_embedded_checksum() { + version="$1" + filename="$2" + echo "$EMBEDDED_CHECKSUMS" | grep -E "^${version}:${filename}:" | cut -d':' -f3 +} +parse_args() { + BINDIR="${BINSTALLER_BIN:-${HOME}/.local/bin}" + DRY_RUN=0 + while getopts "b:dqh?xn" arg; do + case "$arg" in + b) BINDIR="$OPTARG" ;; + d) log_set_priority 10 ;; + q) log_set_priority 3 ;; + h | \?) usage "$0" ;; + x) set -x ;; + n) DRY_RUN=1 ;; + esac + done + shift $((OPTIND - 1)) + TAG="${1:-latest}" +} +tag_to_version() { + if [ "$TAG" = "latest" ]; then + log_info "checking GitHub for latest tag" + REALTAG=$(github_release "${REPO}" "${TAG}") && true + test -n "$REALTAG" || { + log_crit "Could not determine latest tag for ${REPO}" + exit 1 + } + else + # Assume TAG is a valid tag/version string + REALTAG="$TAG" + fi + if test -z "$REALTAG"; then + log_crit "unable to find '${TAG}' - use 'latest' or see https://github.com/${REPO}/releases for details" + exit 1 + fi + VERSION=${REALTAG#v} # Strip leading 'v' + TAG="$REALTAG" # Use the resolved tag + log_info "Resolved version: ${VERSION} (tag: ${TAG})" +} + + + +is_rosetta2_available() { + [ "$(uname -s)" = Darwin ] || return 1 + [ "$(uname -m)" = arm64 ] || return 1 + arch -arch x86_64 true 2>/dev/null +} +resolve_asset_filename() { + + # --- Apply Rules --- + ASSET_FILENAME="" + if [ "${UNAME_ARCH}" = 'amd64' ] && true + then + ARCH='X86_64' + fi + if [ -z "${ASSET_FILENAME}" ]; then + ASSET_FILENAME="checkov_${OS}_${ARCH}${EXT}" + fi +} +# Cleanup function to remove temporary files and stop progress +cleanup() { + # Stop progress animation + progress_clear + + if [ -n "$TMPDIR" ] && [ -d "$TMPDIR" ]; then + log_debug "Cleaning up temporary directory: $TMPDIR" + rm -rf -- "$TMPDIR" + fi +} + +execute() { + STRIP_COMPONENTS=0 + CHECKSUM_FILENAME="" + + # --- Construct URLs --- + GITHUB_DOWNLOAD="https://github.com/${REPO}/releases/download" + ASSET_URL="${GITHUB_DOWNLOAD}/${TAG}/${ASSET_FILENAME}" + CHECKSUM_URL="" + if [ -n "$CHECKSUM_FILENAME" ]; then + CHECKSUM_URL="${GITHUB_DOWNLOAD}/${TAG}/${CHECKSUM_FILENAME}" + fi + + # --- Download and Verify --- + TMPDIR=$(mktemp -d) + # Set up cleanup trap that includes progress clearing + trap cleanup EXIT HUP INT TERM + log_debug "Downloading files into ${TMPDIR}" + log_info "Downloading ${ASSET_URL}" + github_http_download "${TMPDIR}/${ASSET_FILENAME}" "${ASSET_URL}" + + # Try to find embedded checksum first + EMBEDDED_HASH=$(find_embedded_checksum "$VERSION" "$ASSET_FILENAME") + + if [ -n "$EMBEDDED_HASH" ]; then + log_info "Using embedded checksum for verification" + + # Verify using embedded hash + got=$(hash_compute "${TMPDIR}/${ASSET_FILENAME}") + if [ "$got" != "$EMBEDDED_HASH" ]; then + log_crit "Checksum verification failed for ${ASSET_FILENAME}" + log_crit "Expected: ${EMBEDDED_HASH}" + log_crit "Got: ${got}" + return 1 + fi + log_info "Checksum verification successful" + elif [ -n "$CHECKSUM_URL" ]; then + # Fall back to downloading checksum file + log_info "Downloading checksums from ${CHECKSUM_URL}" + github_http_download "${TMPDIR}/${CHECKSUM_FILENAME}" "${CHECKSUM_URL}" + log_info "Verifying checksum ..." + hash_verify "${TMPDIR}/${ASSET_FILENAME}" "${TMPDIR}/${CHECKSUM_FILENAME}" + else + log_info "No checksum found, skipping verification." + fi + + if [ -z "${EXT}" ] || [ "${EXT}" = ".exe" ]; then + log_debug "Target is raw binary" + else + log_info "Extracting ${ASSET_FILENAME}..." + (cd "${TMPDIR}" && untar "${ASSET_FILENAME}" "${STRIP_COMPONENTS}") + fi + BINARY_NAME='checkov' + if [ -z "${EXT}" ] || [ "${EXT}" = ".exe" ]; then + BINARY_PATH="${TMPDIR}/${ASSET_FILENAME}" + else + BINARY_PATH="${TMPDIR}/dist/checkov" + fi + + if [ "${UNAME_OS}" = "windows" ]; then + case "${BINARY_NAME}" in *.exe) ;; *) BINARY_NAME="${BINARY_NAME}.exe" ;; esac + case "${BINARY_PATH}" in *.exe) ;; *) BINARY_PATH="${BINARY_PATH}.exe" ;; esac + fi + + if [ ! -f "${BINARY_PATH}" ]; then + log_crit "Binary not found: ${BINARY_PATH}" + log_crit "Listing contents of ${TMPDIR} ..." + if command -v find >/dev/null 2>&1; then + cd "${TMPDIR}" && find . + else + cd "${TMPDIR}" && ls -R . + fi + return 1 + fi + + progress_clear + # Install the binary + INSTALL_PATH="${BINDIR}/${BINARY_NAME}" + + if [ "$DRY_RUN" = "1" ]; then + log_info "[DRY RUN] ${BINARY_NAME} dry-run installation succeeded! (Would install to: ${INSTALL_PATH})" + else + log_info "Installing binary to ${INSTALL_PATH}" + test ! -d "${BINDIR}" && install -d "${BINDIR}" + install "${BINARY_PATH}" "${INSTALL_PATH}" + log_info "${BINARY_NAME} installation complete!" + fi +} + +# --- Configuration --- +NAME='checkov' +REPO='bridgecrewio/checkov' +EXT='.zip' + +# use in logging routines +log_prefix() { + echo "${REPO}" +} + +parse_args "$@" + +progress_init +progress_pulse_start + +# --- Determine target platform --- +OS="${BINSTALLER_OS:-$(uname_os)}" +UNAME_OS="${OS}" + +if is_rosetta2_available; then + log_info 'Apple Silicon with Rosetta 2 found: using amd64 as ARCH' + ARCH="${BINSTALLER_ARCH:-amd64}" +else + ARCH="${BINSTALLER_ARCH:-$(uname_arch)}" +fi + +UNAME_ARCH="${ARCH}" +log_info "Detected Platform: ${OS}/${ARCH}" + +# --- Validate platform --- +uname_os_check "$OS" +uname_arch_check "$ARCH" + +tag_to_version + +resolve_asset_filename +execute