Compare commits
2 Commits
bump-toolh
...
checkov
| Author | SHA1 | Date | |
|---|---|---|---|
|
c8638c3fff | ||
| 6597739343 |
@@ -54,18 +54,6 @@ tasks:
|
|||||||
requires:
|
requires:
|
||||||
vars: ["REPO"]
|
vars: ["REPO"]
|
||||||
|
|
||||||
latest-release:
|
|
||||||
desc: Determine the latest release available for a given repo.
|
|
||||||
summary: |
|
|
||||||
Determine the latest release available for a given GitHub repository.
|
|
||||||
|
|
||||||
Invoke this task like:
|
|
||||||
task latest-release REPO=trufflesecurity/trufflehog
|
|
||||||
cmd: |
|
|
||||||
gh release view -R {{.REPO}} --json tagName --jq .tagName
|
|
||||||
requires:
|
|
||||||
vars: ["REPO"]
|
|
||||||
|
|
||||||
embed-checksums:
|
embed-checksums:
|
||||||
desc: Embed checksums into a binst configuration file.
|
desc: Embed checksums into a binst configuration file.
|
||||||
summary: |
|
summary: |
|
||||||
@@ -81,7 +69,15 @@ tasks:
|
|||||||
set +o errexit
|
set +o errexit
|
||||||
binst embed-checksums --config {{.CONFIG_DIR}}/{{.BINARY}}.binstaller.yml --version {{.VERSION}} --mode download
|
binst embed-checksums --config {{.CONFIG_DIR}}/{{.BINARY}}.binstaller.yml --version {{.VERSION}} --mode download
|
||||||
if [ $? -ne 0 ]; then
|
if [ $? -ne 0 ]; then
|
||||||
binst embed-checksums --config {{.CONFIG_DIR}}/{{.BINARY}}.binstaller.yml --version {{.VERSION}} --mode calculate
|
# this is tougher than it should be...
|
||||||
|
# without this, checksums aren't written to the file at all
|
||||||
|
printf 'checksums:\n' >> {{.CONFIG_DIR}}/{{.BINARY}}.binstaller.yml
|
||||||
|
binst embed-checksums \
|
||||||
|
--config {{.CONFIG_DIR}}/{{.BINARY}}.binstaller.yml \
|
||||||
|
--version latest \
|
||||||
|
--mode calculate
|
||||||
|
# then the formatting is weird, so in-place edit using yq
|
||||||
|
yq -i {{.CONFIG_DIR}}/{{.BINARY}}.binstaller.yml
|
||||||
fi
|
fi
|
||||||
|
|
||||||
vars:
|
vars:
|
||||||
@@ -103,6 +99,19 @@ tasks:
|
|||||||
requires:
|
requires:
|
||||||
vars: ["BINARY"]
|
vars: ["BINARY"]
|
||||||
|
|
||||||
|
latest-release:
|
||||||
|
desc: Determine the latest release available for a given repo.
|
||||||
|
summary: |
|
||||||
|
Determine the latest release available for a given GitHub repository.
|
||||||
|
|
||||||
|
Invoke this task like:
|
||||||
|
task latest-release REPO=trufflesecurity/trufflehog
|
||||||
|
cmd: |
|
||||||
|
gh release view -R {{.REPO}} --json tagName --jq .tagName
|
||||||
|
requires:
|
||||||
|
vars: ["REPO"]
|
||||||
|
|
||||||
|
|
||||||
install-*:
|
install-*:
|
||||||
desc: Install a binary using its installation script.
|
desc: Install a binary using its installation script.
|
||||||
summary: |
|
summary: |
|
||||||
|
|||||||
@@ -20,20 +20,3 @@ asset:
|
|||||||
- when:
|
- when:
|
||||||
os: windows
|
os: windows
|
||||||
ext: .zip
|
ext: .zip
|
||||||
checksums:
|
|
||||||
algorithm: sha256
|
|
||||||
template: checksums.txt
|
|
||||||
embedded_checksums:
|
|
||||||
v0.12.0:
|
|
||||||
- filename: binst_Darwin_arm64.tar.gz
|
|
||||||
hash: 2c3a8cf9b8f95edb5d97b905ccb0204800b25f1a9bc2b4ad704596e756e41eb9
|
|
||||||
- filename: binst_Darwin_x86_64.tar.gz
|
|
||||||
hash: bd9eae149f5735671bf1f32204f5ba9f10de269a290755f21f93bf1bb5d09b03
|
|
||||||
- filename: binst_Linux_arm64.tar.gz
|
|
||||||
hash: 76bca4884ee3fa229d915473ddd53ab4d04c34c9e4b5a1eda36d9751763af916
|
|
||||||
- filename: binst_Linux_x86_64.tar.gz
|
|
||||||
hash: af36ebb92c01ad4b9867a79eb45d1a130efbce20930896ec7578b3746416ee41
|
|
||||||
- filename: binst_Windows_arm64.zip
|
|
||||||
hash: 133784089efd57f5a0164b84ac74c4924c299342c88eb40be65155193ca37761
|
|
||||||
- filename: binst_Windows_x86_64.zip
|
|
||||||
hash: afcc9eab78de6bfa1ce360aebbf1a48738c519cdbe6a9560e6979ec3a4fcb4ef
|
|
||||||
|
|||||||
615
scripts/checkov-install.sh
Executable file
615
scripts/checkov-install.sh
Executable file
@@ -0,0 +1,615 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
# Code generated by binstaller. DO NOT EDIT.
|
||||||
|
#
|
||||||
|
set -e
|
||||||
|
usage() {
|
||||||
|
this=$1
|
||||||
|
cat <<EOF
|
||||||
|
$this: download ${NAME} from ${REPO}
|
||||||
|
|
||||||
|
Usage: $this [-b bindir] [-d] [-q] [-n] [tag]
|
||||||
|
-b sets bindir or installation directory, Defaults to ${BINSTALLER_BIN:-${HOME}/.local/bin}
|
||||||
|
-d turns on debug logging
|
||||||
|
-q turns on quiet mode (errors only)
|
||||||
|
-n turns on dry run mode
|
||||||
|
[tag] is a tag from
|
||||||
|
https://github.com/bridgecrewio/checkov/releases
|
||||||
|
If tag is missing, then latest will be used.
|
||||||
|
|
||||||
|
Environment variables:
|
||||||
|
BINSTALLER_NO_PROGRESS=1 Disable progress indicators
|
||||||
|
BINSTALLER_OS=... Override OS detection
|
||||||
|
BINSTALLER_ARCH=... Override architecture detection
|
||||||
|
|
||||||
|
Generated by binstaller
|
||||||
|
https://github.com/binary-install/binstaller
|
||||||
|
EOF
|
||||||
|
exit 2
|
||||||
|
}
|
||||||
|
|
||||||
|
cat /dev/null <<EOF
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
https://github.com/client9/shlib - portable posix shell functions
|
||||||
|
Public domain - http://unlicense.org
|
||||||
|
https://github.com/client9/shlib/blob/master/LICENSE.md
|
||||||
|
but credit (and pull requests) appreciated.
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
EOF
|
||||||
|
is_command() {
|
||||||
|
command -v "$1" >/dev/null
|
||||||
|
}
|
||||||
|
echoerr() {
|
||||||
|
echo "$@" 1>&2
|
||||||
|
}
|
||||||
|
_logp=6
|
||||||
|
log_set_priority() {
|
||||||
|
_logp="$1"
|
||||||
|
}
|
||||||
|
log_priority() {
|
||||||
|
if test -z "$1"; then
|
||||||
|
echo "$_logp"
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
[ "$1" -le "$_logp" ]
|
||||||
|
}
|
||||||
|
log_tag() {
|
||||||
|
case $1 in
|
||||||
|
0) echo "emerg" ;;
|
||||||
|
1) echo "alert" ;;
|
||||||
|
2) echo "crit" ;;
|
||||||
|
3) echo "err" ;;
|
||||||
|
4) echo "warning" ;;
|
||||||
|
5) echo "notice" ;;
|
||||||
|
6) echo "info" ;;
|
||||||
|
7) echo "debug" ;;
|
||||||
|
*) echo "$1" ;;
|
||||||
|
esac
|
||||||
|
}
|
||||||
|
log_debug() {
|
||||||
|
log_priority 7 || return 0
|
||||||
|
echoerr "$(log_prefix)" "$(log_tag 7)" "$@"
|
||||||
|
}
|
||||||
|
log_info() {
|
||||||
|
log_priority 6 || return 0
|
||||||
|
echoerr "$(log_prefix)" "$(log_tag 6)" "$@"
|
||||||
|
}
|
||||||
|
log_err() {
|
||||||
|
log_priority 3 || return 0
|
||||||
|
echoerr "$(log_prefix)" "$(log_tag 3)" "$@"
|
||||||
|
}
|
||||||
|
log_crit() {
|
||||||
|
log_priority 2 || return 0
|
||||||
|
echoerr "$(log_prefix)" "$(log_tag 2)" "$@"
|
||||||
|
}
|
||||||
|
uname_os() {
|
||||||
|
os=$(uname -s | tr '[:upper:]' '[:lower:]')
|
||||||
|
case "$os" in
|
||||||
|
msys*) os="windows" ;;
|
||||||
|
mingw*) os="windows" ;;
|
||||||
|
cygwin*) os="windows" ;;
|
||||||
|
esac
|
||||||
|
if [ "$os" = "sunos" ]; then
|
||||||
|
if [ "$(uname -o)" = "illumos" ]; then
|
||||||
|
os="illumos"
|
||||||
|
else
|
||||||
|
os="solaris"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
echo "$os"
|
||||||
|
}
|
||||||
|
uname_arch() {
|
||||||
|
arch=$(uname -m)
|
||||||
|
case $arch in
|
||||||
|
x86_64) arch="amd64" ;;
|
||||||
|
i86pc) arch="amd64" ;;
|
||||||
|
x86) arch="386" ;;
|
||||||
|
i686) arch="386" ;;
|
||||||
|
i386) arch="386" ;;
|
||||||
|
aarch64) arch="arm64" ;;
|
||||||
|
armv5*) arch="armv5" ;;
|
||||||
|
armv6*) arch="armv6" ;;
|
||||||
|
armv7*) arch="armv7" ;;
|
||||||
|
esac
|
||||||
|
echo "${arch}"
|
||||||
|
}
|
||||||
|
uname_os_check() {
|
||||||
|
os=$(uname_os)
|
||||||
|
case "$os" in
|
||||||
|
darwin) return 0 ;;
|
||||||
|
dragonfly) return 0 ;;
|
||||||
|
freebsd) return 0 ;;
|
||||||
|
linux) return 0 ;;
|
||||||
|
android) return 0 ;;
|
||||||
|
midnightbsd) return 0 ;;
|
||||||
|
nacl) return 0 ;;
|
||||||
|
netbsd) return 0 ;;
|
||||||
|
openbsd) return 0 ;;
|
||||||
|
plan9) return 0 ;;
|
||||||
|
solaris) return 0 ;;
|
||||||
|
illumos) return 0 ;;
|
||||||
|
windows) return 0 ;;
|
||||||
|
esac
|
||||||
|
log_crit "uname_os_check '$(uname -s)' got converted to '$os' which is not a GOOS value. Please file bug at https://github.com/client9/shlib"
|
||||||
|
return 1
|
||||||
|
}
|
||||||
|
uname_arch_check() {
|
||||||
|
arch=$(uname_arch)
|
||||||
|
case "$arch" in
|
||||||
|
386) return 0 ;;
|
||||||
|
amd64) return 0 ;;
|
||||||
|
arm64) return 0 ;;
|
||||||
|
armv5) return 0 ;;
|
||||||
|
armv6) return 0 ;;
|
||||||
|
armv7) return 0 ;;
|
||||||
|
ppc64) return 0 ;;
|
||||||
|
ppc64le) return 0 ;;
|
||||||
|
mips) return 0 ;;
|
||||||
|
mipsle) return 0 ;;
|
||||||
|
mips64) return 0 ;;
|
||||||
|
mips64le) return 0 ;;
|
||||||
|
s390x) return 0 ;;
|
||||||
|
amd64p32) return 0 ;;
|
||||||
|
esac
|
||||||
|
log_crit "uname_arch_check '$(uname -m)' got converted to '$arch' which is not a GOARCH value. Please file bug report at https://github.com/client9/shlib"
|
||||||
|
return 1
|
||||||
|
}
|
||||||
|
cat /dev/null <<EOF
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
End of functions from https://github.com/client9/shlib
|
||||||
|
------------------------------------------------------------------------
|
||||||
|
EOF
|
||||||
|
|
||||||
|
|
||||||
|
hash_sha256() {
|
||||||
|
TARGET=${1:-/dev/stdin}
|
||||||
|
if is_command gsha256sum; then
|
||||||
|
hash=$(gsha256sum "$TARGET") || return 1
|
||||||
|
echo "$hash" | cut -d ' ' -f 1
|
||||||
|
elif is_command sha256sum; then
|
||||||
|
hash=$(sha256sum "$TARGET") || return 1
|
||||||
|
echo "$hash" | cut -d ' ' -f 1
|
||||||
|
elif is_command shasum; then
|
||||||
|
hash=$(shasum -a 256 "$TARGET" 2>/dev/null) || return 1
|
||||||
|
echo "$hash" | cut -d ' ' -f 1
|
||||||
|
elif is_command openssl; then
|
||||||
|
hash=$(openssl dgst -sha256 "$TARGET") || return 1
|
||||||
|
echo "$hash" | cut -d ' ' -f 2
|
||||||
|
else
|
||||||
|
log_crit "hash_sha256 unable to find command to compute sha-256 hash"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
hash_compute() {
|
||||||
|
hash_sha256 "$1"
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
# shellcheck shell=sh
|
||||||
|
# Terminal progress reporting functions
|
||||||
|
progress_init() {
|
||||||
|
# Only show progress on interactive terminals and when not disabled
|
||||||
|
if [ ! -t 2 ] || [ "${BINSTALLER_NO_PROGRESS}" = "1" ]; then
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
# OSC 9;4 sequences are safely ignored by unsupporting terminals
|
||||||
|
# Only need special handling for tmux passthrough
|
||||||
|
if [ -n "$TMUX" ]; then
|
||||||
|
# Tmux passthrough: DCS tmux; <doubled ESC sequence> ST
|
||||||
|
# ESC characters in the wrapped sequence must be doubled
|
||||||
|
# Format: ESC P tmux; ESC ESC ] 9;4; ... ESC ESC \ ESC \
|
||||||
|
PROGRESS_START=$(printf '\033Ptmux;\033\033]9;4;')
|
||||||
|
# shellcheck disable=SC1003
|
||||||
|
PROGRESS_END=$(printf '\033\033\\\033\\')
|
||||||
|
else
|
||||||
|
# Direct OSC 9;4 - terminals that don't support it will safely ignore
|
||||||
|
PROGRESS_START=$(printf '\033]9;4;')
|
||||||
|
PROGRESS_END=$(printf '\007')
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# Start pulsing progress animation
|
||||||
|
progress_pulse_start() {
|
||||||
|
# Only show progress on interactive terminals and when not disabled
|
||||||
|
if [ ! -t 2 ] || [ "${BINSTALLER_NO_PROGRESS}" = "1" ]; then
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Send OSC 9;4 with state 3 (indeterminate/pulsing) once
|
||||||
|
# The terminal will handle the continuous animation
|
||||||
|
printf "%s3%s" "$PROGRESS_START" "$PROGRESS_END" >&2
|
||||||
|
}
|
||||||
|
|
||||||
|
# Clear progress indicator
|
||||||
|
progress_clear() {
|
||||||
|
# Only show progress on interactive terminals and when not disabled
|
||||||
|
if [ ! -t 2 ] || [ "${BINSTALLER_NO_PROGRESS}" = "1" ]; then
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
printf "%s0;%s" "$PROGRESS_START" "$PROGRESS_END" >&2
|
||||||
|
}
|
||||||
|
|
||||||
|
untar() {
|
||||||
|
tarball=$1
|
||||||
|
strip_components=${2:-0} # default 0
|
||||||
|
case "${tarball}" in
|
||||||
|
*.tar.gz | *.tgz) tar --no-same-owner -xzf "${tarball}" --strip-components "${strip_components}" ;;
|
||||||
|
*.tar.xz) tar --no-same-owner -xJf "${tarball}" --strip-components "${strip_components}" ;;
|
||||||
|
*.tar.bz2) tar --no-same-owner -xjf "${tarball}" --strip-components "${strip_components}" ;;
|
||||||
|
*.tar) tar --no-same-owner -xf "${tarball}" --strip-components "${strip_components}" ;;
|
||||||
|
*.gz) gunzip "${tarball}" ;;
|
||||||
|
*.zip)
|
||||||
|
# unzip doesn't have a standard --strip-components
|
||||||
|
# Workaround: extract to a subdir and move contents up if stripping
|
||||||
|
if [ "$strip_components" -gt 0 ]; then
|
||||||
|
extract_dir=$(basename "${tarball%.zip}")_extracted
|
||||||
|
unzip -q "${tarball}" -d "${extract_dir}"
|
||||||
|
# Move contents of the *first* directory found inside extract_dir up
|
||||||
|
# This assumes wrap_in_directory=true convention
|
||||||
|
first_subdir=$(find "${extract_dir}" -mindepth 1 -maxdepth 1 -type d -print -quit)
|
||||||
|
if [ -n "$first_subdir" ]; then
|
||||||
|
# Move all contents (* includes hidden files)
|
||||||
|
mv "${first_subdir}"/* .
|
||||||
|
# Optionally remove the now-empty subdir and the extract_dir
|
||||||
|
rmdir "${first_subdir}"
|
||||||
|
rmdir "${extract_dir}"
|
||||||
|
else
|
||||||
|
log_warn "Could not find subdirectory in zip to strip components from ${extract_dir}"
|
||||||
|
# Files are extracted in current dir anyway, proceed
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
unzip -q "${tarball}"
|
||||||
|
fi
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
log_err "untar unknown archive format for ${tarball}"
|
||||||
|
return 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
hash_verify() {
|
||||||
|
TARGET_PATH=$1
|
||||||
|
SUMFILE=$2
|
||||||
|
if [ -z "${SUMFILE}" ]; then
|
||||||
|
log_err "hash_verify checksum file not specified in arg2"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
got=$(hash_compute "$TARGET_PATH")
|
||||||
|
if [ -z "${got}" ]; then
|
||||||
|
log_err "failed to calculate hash: ${TARGET_PATH}"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
BASENAME=${TARGET_PATH##*/}
|
||||||
|
|
||||||
|
# Check for line matches in checksum file
|
||||||
|
# Format: "<hash> <filename>" or "<hash> *<filename>"
|
||||||
|
# Filename may include path prefix (e.g., "deployment/m2/file.tar.gz")
|
||||||
|
while IFS= read -r line || [ -n "$line" ]; do
|
||||||
|
# Normalize tabs to spaces
|
||||||
|
line=$(echo "$line" | tr '\t' ' ')
|
||||||
|
|
||||||
|
# Remove trailing spaces for hash-only line check
|
||||||
|
line_trimmed=$(echo "$line" | sed 's/[[:space:]]*$//')
|
||||||
|
|
||||||
|
# Check for hash-only line (no filename) - early return
|
||||||
|
if [ "$line_trimmed" = "$got" ]; then
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Extract hash and filename parts
|
||||||
|
# First field is the hash, rest is filename (which may contain spaces)
|
||||||
|
line_hash=$(echo "$line" | cut -d' ' -f1)
|
||||||
|
|
||||||
|
# Skip if hash doesn't match
|
||||||
|
if [ "$line_hash" != "$got" ]; then
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Hash matches, now check filename
|
||||||
|
# Remove the hash part from the beginning of the line
|
||||||
|
line_rest="${line#"$got"}"
|
||||||
|
# Remove leading spaces
|
||||||
|
while [ "${line_rest#[ ]}" != "$line_rest" ]; do
|
||||||
|
line_rest="${line_rest#[ ]}"
|
||||||
|
done
|
||||||
|
|
||||||
|
# Remove leading asterisk if present (binary mode indicator)
|
||||||
|
if [ "${line_rest#\*}" != "$line_rest" ]; then
|
||||||
|
line_rest="${line_rest#\*}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Extract just the filename without any path
|
||||||
|
line_filename="${line_rest##*/}"
|
||||||
|
|
||||||
|
# Check if the filename matches
|
||||||
|
if [ "$line_filename" = "$BASENAME" ]; then
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
done < "$SUMFILE"
|
||||||
|
|
||||||
|
log_err "hash_verify checksum for '$TARGET_PATH' did not verify"
|
||||||
|
log_err " Expected hash: ${got}"
|
||||||
|
log_err " Checksum file content:"
|
||||||
|
cat "$SUMFILE" >&2
|
||||||
|
return 1
|
||||||
|
}
|
||||||
|
|
||||||
|
# GitHub HTTP download functions with GITHUB_TOKEN support
|
||||||
|
github_http_download_curl() {
|
||||||
|
local_file=$1
|
||||||
|
source_url=$2
|
||||||
|
header=$3
|
||||||
|
if [ -n "$GITHUB_TOKEN" ]; then
|
||||||
|
log_debug "Using GITHUB_TOKEN for authentication"
|
||||||
|
if [ -z "$header" ]; then
|
||||||
|
curl -fsSL -H "Authorization: Bearer $GITHUB_TOKEN" -o "$local_file" "$source_url"
|
||||||
|
else
|
||||||
|
curl -fsSL -H "Authorization: Bearer $GITHUB_TOKEN" -H "$header" -o "$local_file" "$source_url"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
if [ -z "$header" ]; then
|
||||||
|
curl -fsSL -o "$local_file" "$source_url"
|
||||||
|
else
|
||||||
|
curl -fsSL -H "$header" -o "$local_file" "$source_url"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
github_http_download_wget() {
|
||||||
|
local_file=$1
|
||||||
|
source_url=$2
|
||||||
|
header=$3
|
||||||
|
if [ -n "$GITHUB_TOKEN" ]; then
|
||||||
|
log_debug "Using GITHUB_TOKEN for authentication"
|
||||||
|
if [ -z "$header" ]; then
|
||||||
|
wget -q --header "Authorization: Bearer $GITHUB_TOKEN" -O "$local_file" "$source_url"
|
||||||
|
else
|
||||||
|
wget -q --header "Authorization: Bearer $GITHUB_TOKEN" --header "$header" -O "$local_file" "$source_url"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
if [ -z "$header" ]; then
|
||||||
|
wget -q -O "$local_file" "$source_url"
|
||||||
|
else
|
||||||
|
wget -q --header "$header" -O "$local_file" "$source_url"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
github_http_download() {
|
||||||
|
log_debug "github_http_download $2"
|
||||||
|
if is_command curl; then
|
||||||
|
github_http_download_curl "$@"
|
||||||
|
return
|
||||||
|
elif is_command wget; then
|
||||||
|
github_http_download_wget "$@"
|
||||||
|
return
|
||||||
|
fi
|
||||||
|
log_crit "github_http_download unable to find wget or curl"
|
||||||
|
return 1
|
||||||
|
}
|
||||||
|
github_http_copy() {
|
||||||
|
tmp=$(mktemp)
|
||||||
|
github_http_download "${tmp}" "$@" || return 1
|
||||||
|
body=$(cat "$tmp")
|
||||||
|
rm -f "${tmp}"
|
||||||
|
echo "$body"
|
||||||
|
}
|
||||||
|
github_release() {
|
||||||
|
owner_repo=$1
|
||||||
|
version=$2
|
||||||
|
test -z "$version" && version="latest"
|
||||||
|
giturl="https://github.com/${owner_repo}/releases/${version}"
|
||||||
|
json=$(github_http_copy "$giturl" "Accept:application/json")
|
||||||
|
test -z "$json" && return 1
|
||||||
|
version=$(echo "$json" | tr -s '\n' ' ' | sed 's/.*"tag_name":"//' | sed 's/".*//')
|
||||||
|
test -z "$version" && return 1
|
||||||
|
echo "$version"
|
||||||
|
}
|
||||||
|
|
||||||
|
# --- Embedded Checksums (Format: VERSION:FILENAME:HASH) ---
|
||||||
|
EMBEDDED_CHECKSUMS="
|
||||||
|
3.2.497:checkov_darwin_X86_64.zip:35129a227f25dc37c2347e8b7b6f61984243201807beeb27eb4f33fda0cbe32a
|
||||||
|
3.2.497:checkov_linux_X86_64.zip:f713e29c9b0d477df4d2e4b57428dfe3b8333ce425093d626cc02d87e532e627
|
||||||
|
3.2.497:checkov_linux_arm64.zip:05060050d59207e6c99fd1d4aae8b2711d0f192c33bbfca7a1de139468bdaeea
|
||||||
|
3.2.497:checkov_windows_X86_64.zip:3b2e958c4b6d8a50c573e693ba3a3e6270145a26fad403635179b51e51152f1f"
|
||||||
|
|
||||||
|
# Find embedded checksum for a given version and filename
|
||||||
|
find_embedded_checksum() {
|
||||||
|
version="$1"
|
||||||
|
filename="$2"
|
||||||
|
echo "$EMBEDDED_CHECKSUMS" | grep -E "^${version}:${filename}:" | cut -d':' -f3
|
||||||
|
}
|
||||||
|
parse_args() {
|
||||||
|
BINDIR="${BINSTALLER_BIN:-${HOME}/.local/bin}"
|
||||||
|
DRY_RUN=0
|
||||||
|
while getopts "b:dqh?xn" arg; do
|
||||||
|
case "$arg" in
|
||||||
|
b) BINDIR="$OPTARG" ;;
|
||||||
|
d) log_set_priority 10 ;;
|
||||||
|
q) log_set_priority 3 ;;
|
||||||
|
h | \?) usage "$0" ;;
|
||||||
|
x) set -x ;;
|
||||||
|
n) DRY_RUN=1 ;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
shift $((OPTIND - 1))
|
||||||
|
TAG="${1:-latest}"
|
||||||
|
}
|
||||||
|
tag_to_version() {
|
||||||
|
if [ "$TAG" = "latest" ]; then
|
||||||
|
log_info "checking GitHub for latest tag"
|
||||||
|
REALTAG=$(github_release "${REPO}" "${TAG}") && true
|
||||||
|
test -n "$REALTAG" || {
|
||||||
|
log_crit "Could not determine latest tag for ${REPO}"
|
||||||
|
exit 1
|
||||||
|
}
|
||||||
|
else
|
||||||
|
# Assume TAG is a valid tag/version string
|
||||||
|
REALTAG="$TAG"
|
||||||
|
fi
|
||||||
|
if test -z "$REALTAG"; then
|
||||||
|
log_crit "unable to find '${TAG}' - use 'latest' or see https://github.com/${REPO}/releases for details"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
VERSION=${REALTAG#v} # Strip leading 'v'
|
||||||
|
TAG="$REALTAG" # Use the resolved tag
|
||||||
|
log_info "Resolved version: ${VERSION} (tag: ${TAG})"
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
is_rosetta2_available() {
|
||||||
|
[ "$(uname -s)" = Darwin ] || return 1
|
||||||
|
[ "$(uname -m)" = arm64 ] || return 1
|
||||||
|
arch -arch x86_64 true 2>/dev/null
|
||||||
|
}
|
||||||
|
resolve_asset_filename() {
|
||||||
|
|
||||||
|
# --- Apply Rules ---
|
||||||
|
ASSET_FILENAME=""
|
||||||
|
if [ "${UNAME_ARCH}" = 'amd64' ] && true
|
||||||
|
then
|
||||||
|
ARCH='X86_64'
|
||||||
|
fi
|
||||||
|
if [ -z "${ASSET_FILENAME}" ]; then
|
||||||
|
ASSET_FILENAME="checkov_${OS}_${ARCH}${EXT}"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
# Cleanup function to remove temporary files and stop progress
|
||||||
|
cleanup() {
|
||||||
|
# Stop progress animation
|
||||||
|
progress_clear
|
||||||
|
|
||||||
|
if [ -n "$TMPDIR" ] && [ -d "$TMPDIR" ]; then
|
||||||
|
log_debug "Cleaning up temporary directory: $TMPDIR"
|
||||||
|
rm -rf -- "$TMPDIR"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
execute() {
|
||||||
|
STRIP_COMPONENTS=0
|
||||||
|
CHECKSUM_FILENAME=""
|
||||||
|
|
||||||
|
# --- Construct URLs ---
|
||||||
|
GITHUB_DOWNLOAD="https://github.com/${REPO}/releases/download"
|
||||||
|
ASSET_URL="${GITHUB_DOWNLOAD}/${TAG}/${ASSET_FILENAME}"
|
||||||
|
CHECKSUM_URL=""
|
||||||
|
if [ -n "$CHECKSUM_FILENAME" ]; then
|
||||||
|
CHECKSUM_URL="${GITHUB_DOWNLOAD}/${TAG}/${CHECKSUM_FILENAME}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- Download and Verify ---
|
||||||
|
TMPDIR=$(mktemp -d)
|
||||||
|
# Set up cleanup trap that includes progress clearing
|
||||||
|
trap cleanup EXIT HUP INT TERM
|
||||||
|
log_debug "Downloading files into ${TMPDIR}"
|
||||||
|
log_info "Downloading ${ASSET_URL}"
|
||||||
|
github_http_download "${TMPDIR}/${ASSET_FILENAME}" "${ASSET_URL}"
|
||||||
|
|
||||||
|
# Try to find embedded checksum first
|
||||||
|
EMBEDDED_HASH=$(find_embedded_checksum "$VERSION" "$ASSET_FILENAME")
|
||||||
|
|
||||||
|
if [ -n "$EMBEDDED_HASH" ]; then
|
||||||
|
log_info "Using embedded checksum for verification"
|
||||||
|
|
||||||
|
# Verify using embedded hash
|
||||||
|
got=$(hash_compute "${TMPDIR}/${ASSET_FILENAME}")
|
||||||
|
if [ "$got" != "$EMBEDDED_HASH" ]; then
|
||||||
|
log_crit "Checksum verification failed for ${ASSET_FILENAME}"
|
||||||
|
log_crit "Expected: ${EMBEDDED_HASH}"
|
||||||
|
log_crit "Got: ${got}"
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
log_info "Checksum verification successful"
|
||||||
|
elif [ -n "$CHECKSUM_URL" ]; then
|
||||||
|
# Fall back to downloading checksum file
|
||||||
|
log_info "Downloading checksums from ${CHECKSUM_URL}"
|
||||||
|
github_http_download "${TMPDIR}/${CHECKSUM_FILENAME}" "${CHECKSUM_URL}"
|
||||||
|
log_info "Verifying checksum ..."
|
||||||
|
hash_verify "${TMPDIR}/${ASSET_FILENAME}" "${TMPDIR}/${CHECKSUM_FILENAME}"
|
||||||
|
else
|
||||||
|
log_info "No checksum found, skipping verification."
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ -z "${EXT}" ] || [ "${EXT}" = ".exe" ]; then
|
||||||
|
log_debug "Target is raw binary"
|
||||||
|
else
|
||||||
|
log_info "Extracting ${ASSET_FILENAME}..."
|
||||||
|
(cd "${TMPDIR}" && untar "${ASSET_FILENAME}" "${STRIP_COMPONENTS}")
|
||||||
|
fi
|
||||||
|
BINARY_NAME='checkov'
|
||||||
|
if [ -z "${EXT}" ] || [ "${EXT}" = ".exe" ]; then
|
||||||
|
BINARY_PATH="${TMPDIR}/${ASSET_FILENAME}"
|
||||||
|
else
|
||||||
|
BINARY_PATH="${TMPDIR}/dist/checkov"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ "${UNAME_OS}" = "windows" ]; then
|
||||||
|
case "${BINARY_NAME}" in *.exe) ;; *) BINARY_NAME="${BINARY_NAME}.exe" ;; esac
|
||||||
|
case "${BINARY_PATH}" in *.exe) ;; *) BINARY_PATH="${BINARY_PATH}.exe" ;; esac
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ ! -f "${BINARY_PATH}" ]; then
|
||||||
|
log_crit "Binary not found: ${BINARY_PATH}"
|
||||||
|
log_crit "Listing contents of ${TMPDIR} ..."
|
||||||
|
if command -v find >/dev/null 2>&1; then
|
||||||
|
cd "${TMPDIR}" && find .
|
||||||
|
else
|
||||||
|
cd "${TMPDIR}" && ls -R .
|
||||||
|
fi
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
progress_clear
|
||||||
|
# Install the binary
|
||||||
|
INSTALL_PATH="${BINDIR}/${BINARY_NAME}"
|
||||||
|
|
||||||
|
if [ "$DRY_RUN" = "1" ]; then
|
||||||
|
log_info "[DRY RUN] ${BINARY_NAME} dry-run installation succeeded! (Would install to: ${INSTALL_PATH})"
|
||||||
|
else
|
||||||
|
log_info "Installing binary to ${INSTALL_PATH}"
|
||||||
|
test ! -d "${BINDIR}" && install -d "${BINDIR}"
|
||||||
|
install "${BINARY_PATH}" "${INSTALL_PATH}"
|
||||||
|
log_info "${BINARY_NAME} installation complete!"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
# --- Configuration ---
|
||||||
|
NAME='checkov'
|
||||||
|
REPO='bridgecrewio/checkov'
|
||||||
|
EXT='.zip'
|
||||||
|
|
||||||
|
# use in logging routines
|
||||||
|
log_prefix() {
|
||||||
|
echo "${REPO}"
|
||||||
|
}
|
||||||
|
|
||||||
|
parse_args "$@"
|
||||||
|
|
||||||
|
progress_init
|
||||||
|
progress_pulse_start
|
||||||
|
|
||||||
|
# --- Determine target platform ---
|
||||||
|
OS="${BINSTALLER_OS:-$(uname_os)}"
|
||||||
|
UNAME_OS="${OS}"
|
||||||
|
|
||||||
|
if is_rosetta2_available; then
|
||||||
|
log_info 'Apple Silicon with Rosetta 2 found: using amd64 as ARCH'
|
||||||
|
ARCH="${BINSTALLER_ARCH:-amd64}"
|
||||||
|
else
|
||||||
|
ARCH="${BINSTALLER_ARCH:-$(uname_arch)}"
|
||||||
|
fi
|
||||||
|
|
||||||
|
UNAME_ARCH="${ARCH}"
|
||||||
|
log_info "Detected Platform: ${OS}/${ARCH}"
|
||||||
|
|
||||||
|
# --- Validate platform ---
|
||||||
|
uname_os_check "$OS"
|
||||||
|
uname_arch_check "$ARCH"
|
||||||
|
|
||||||
|
tag_to_version
|
||||||
|
|
||||||
|
resolve_asset_filename
|
||||||
|
execute
|
||||||
Reference in New Issue
Block a user