Allow to run Guideline_Enforcer

[cedelavergne-ledger]

Add script allowing to call the Guideline Enforcer checks from ledger-app-workflows repository.
Add missing packages in the container

Bump Speculos & Ragger to their latest version

[ledger-wiz-cspm-secret-detection]

Wiz Scan Summary

Scan Module						Total
IaC Misconfigurations	0	0	1	1	1	3
Sensitive Data	0	0	0	0	0	0
Secrets	0	0	0	0	0	0
Total	0	0	1	1	1	3

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

[agrojean-ledger]

@cedelavergne-ledger shouldn't the enforcer.sh live on ledger-app-workflows and be copied from there directly (via a clone of the repo during the image build in a tmp dir) ?

It seems to me the script is tightly linked to the workflows

[cedelavergne-ledger]

@cedelavergne-ledger shouldn't the enforcer.sh live on ledger-app-workflows and be copied from there directly (via a clone of the repo during the image build in a tmp dir) ?

It seems to me the script is tightly linked to the workflows

No, because for the VSCode extension, we need a simple and straight forward method, ideally based on a script: The final usage, with the extension, will be to open the dev-tool container, with a bash command. This latter must be as simple as possible and moreover, generic. Using a script will allow to easily maintain/improve the mechanism in the future, if needed, just by updating the container, without needing to hardcode complexe command line in the extension itself.

[ledger-wiz-cspm-secret-detection]

Details

Rule	Unpinned Package Version in Apk Add
Rule ID	9b55ae16-9e49-41dc-885f-a59ee0bb54bd
Severity
Resource	FROM={{ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:latest}}.{{RUN apk add imagemagick grep}}

Details

Package version pinning reduces the range of versions that can be installed, reducing the chances of failure due to unanticipated changes

Expected: RUN instruction with 'apk add ' should use package pinning form 'apk add ='
Found: RUN instruction apk add imagemagick grep does not use package pinning form

[ledger-wiz-cspm-secret-detection]

Details

Rule	Add Instead of Copy
Rule ID	d3b26264-01d2-4c17-aa13-e056403caf7a
Severity
Resource	FROM={{ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:latest}}.{{ADD ./dev-tools/enforcer.sh /opt/enforcer.sh}}

Details

Should use COPY instead of ADD unless, running a tar file

Expected: 'COPY' ./dev-tools/enforcer.sh
Found: 'ADD' ./dev-tools/enforcer.sh

[ledger-wiz-cspm-secret-detection]

Details

Rule	Unpinned Package Version in Apk Add
Rule ID	9b55ae16-9e49-41dc-885f-a59ee0bb54bd
Severity
Resource	FROM={{ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:latest}}.{{RUN apk add imagemagick grep}}

Details

Package version pinning reduces the range of versions that can be installed, reducing the chances of failure due to unanticipated changes

Expected: RUN instruction with 'apk add ' should use package pinning form 'apk add ='
Found: RUN instruction apk add imagemagick grep does not use package pinning form

[ledger-wiz-cspm-secret-detection]

Details

Rule	Add Instead of Copy
Rule ID	d3b26264-01d2-4c17-aa13-e056403caf7a
Severity
Resource	FROM={{ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:latest}}.{{ADD ./dev-tools/enforcer.sh /opt/enforcer.sh}}

Details

Should use COPY instead of ADD unless, running a tar file

Expected: 'COPY' ./dev-tools/enforcer.sh
Found: 'ADD' ./dev-tools/enforcer.sh