Allow to run Guideline_Enforcer #147

cedelavergne-ledger · 2024-10-04T14:56:45Z

Add script allowing to call the Guideline Enforcer checks from ledger-app-workflows repository.
Add missing packages in the container

Bump Speculos & Ragger to their latest version

ledger-wiz-cspm-secret-detection · 2024-10-04T14:56:57Z

Wiz Scan Summary

Scan Module						Total
IaC Misconfigurations	0	0	1	1	1	3
Sensitive Data	0	0	0	0	0	0
Secrets	0	0	0	0	0	0

Total	0	0	1	1	1	3

View scan details in Wiz

To detect these findings earlier in the dev lifecycle, try using Wiz Code VS Code Extension.

dev-tools/enforcer.sh

agrojean-ledger · 2024-10-10T09:07:30Z

@cedelavergne-ledger shouldn't the enforcer.sh live on ledger-app-workflows and be copied from there directly (via a clone of the repo during the image build in a tmp dir) ?

It seems to me the script is tightly linked to the workflows

cedelavergne-ledger · 2024-10-10T10:05:53Z

@cedelavergne-ledger shouldn't the enforcer.sh live on ledger-app-workflows and be copied from there directly (via a clone of the repo during the image build in a tmp dir) ?

It seems to me the script is tightly linked to the workflows

No, because for the VSCode extension, we need a simple and straight forward method, ideally based on a script: The final usage, with the extension, will be to open the dev-tool container, with a bash command. This latter must be as simple as possible and moreover, generic. Using a script will allow to easily maintain/improve the mechanism in the future, if needed, just by updating the container, without needing to hardcode complexe command line in the extension itself.

…sic, not busybox)

ledger-wiz-cspm-secret-detection · 2024-10-17T16:41:54Z

dev-tools/Dockerfile

@@ -19,5 +19,11 @@ ARG PYTHON_BUILD_DEPS=libffi-dev,python3-dev,py3-virtualenv
 # Install the building dependencies.
 RUN apk add $(echo -n "$PYTHON_BUILD_DEPS" | tr , ' ')

+# Install packahes to allow Guideline Enforcer to run
+RUN apk add imagemagick grep


Details

Rule Unpinned Package Version in Apk Add

Rule ID 9b55ae16-9e49-41dc-885f-a59ee0bb54bd

Severity

Resource FROM={{ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:latest}}.{{RUN apk add imagemagick grep}}

Details

Package version pinning reduces the range of versions that can be installed, reducing the chances of failure due to unanticipated changes

Expected: RUN instruction with 'apk add ' should use package pinning form 'apk add =' Found: RUN instruction apk add imagemagick grep does not use package pinning form

ledger-wiz-cspm-secret-detection · 2024-10-17T16:41:54Z

dev-tools/Dockerfile

+RUN pip3 install --no-cache-dir "ragger[tests,all_backends]==1.24.0" "speculos==0.10.0"
+
+# Add the enforcer script
+ADD ./dev-tools/enforcer.sh /opt/enforcer.sh


Details

Rule Add Instead of Copy

Rule ID d3b26264-01d2-4c17-aa13-e056403caf7a

Severity

Resource FROM={{ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:latest}}.{{ADD ./dev-tools/enforcer.sh /opt/enforcer.sh}}

Details

Should use COPY instead of ADD unless, running a tar file

Expected: 'COPY' ./dev-tools/enforcer.sh Found: 'ADD' ./dev-tools/enforcer.sh

ledger-wiz-cspm-secret-detection · 2024-10-17T16:41:54Z

dev-tools/Dockerfile

@@ -19,5 +19,11 @@ ARG PYTHON_BUILD_DEPS=libffi-dev,python3-dev,py3-virtualenv
 # Install the building dependencies.
 RUN apk add $(echo -n "$PYTHON_BUILD_DEPS" | tr , ' ')

+# Install packahes to allow Guideline Enforcer to run
+RUN apk add imagemagick grep


Details

Rule Unpinned Package Version in Apk Add

Rule ID 9b55ae16-9e49-41dc-885f-a59ee0bb54bd

Severity

Resource FROM={{ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:latest}}.{{RUN apk add imagemagick grep}}

Details

Package version pinning reduces the range of versions that can be installed, reducing the chances of failure due to unanticipated changes

Expected: RUN instruction with 'apk add ' should use package pinning form 'apk add =' Found: RUN instruction apk add imagemagick grep does not use package pinning form

ledger-wiz-cspm-secret-detection · 2024-10-17T16:41:54Z

dev-tools/Dockerfile

+RUN pip3 install --no-cache-dir "ragger[tests,all_backends]==1.24.0" "speculos==0.10.0"
+
+# Add the enforcer script
+ADD ./dev-tools/enforcer.sh /opt/enforcer.sh


Details

Rule Add Instead of Copy

Rule ID d3b26264-01d2-4c17-aa13-e056403caf7a

Severity

Resource FROM={{ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:latest}}.{{ADD ./dev-tools/enforcer.sh /opt/enforcer.sh}}

Details

Should use COPY instead of ADD unless, running a tar file

Expected: 'COPY' ./dev-tools/enforcer.sh Found: 'ADD' ./dev-tools/enforcer.sh

Bump speculos & Ragger versions

52a6f2f

cedelavergne-ledger force-pushed the cev/rule_enforcer branch from 7a0edfb to faeb44c Compare October 7, 2024 09:52

cedelavergne-ledger requested review from agrojean-ledger and lpascal-ledger October 9, 2024 13:51

lpascal-ledger reviewed Oct 10, 2024

View reviewed changes

dev-tools/enforcer.sh Show resolved Hide resolved

cedelavergne-ledger force-pushed the cev/rule_enforcer branch from faeb44c to 9e273e7 Compare October 10, 2024 08:39

cedelavergne-ledger requested a review from lpascal-ledger October 10, 2024 08:52

cedelavergne-ledger added 3 commits October 11, 2024 11:23

Add script allowing to call Guideline_Enforcer in ledger-app-workflow

481fbfa

Add missing tools to check icons (identify) and makefile (grep - clas…

4089b1b

…sic, not busybox)

Update CHANGELOG

ed6294d

cedelavergne-ledger force-pushed the cev/rule_enforcer branch from 9e273e7 to ed6294d Compare October 11, 2024 09:23

agrojean-ledger approved these changes Oct 11, 2024

View reviewed changes

Bump Flex and Stax SDK versions --> v21.3.5

a70efa5

ledger-wiz-cspm-secret-detection bot reviewed Oct 17, 2024

View reviewed changes

apaillier-ledger approved these changes Oct 17, 2024

View reviewed changes

tdejoigny-ledger merged commit 66e7c1e into master Oct 17, 2024
10 checks passed

tdejoigny-ledger deleted the cev/rule_enforcer branch October 17, 2024 17:06

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow to run Guideline_Enforcer #147

Allow to run Guideline_Enforcer #147

cedelavergne-ledger commented Oct 4, 2024 •

edited

Loading

ledger-wiz-cspm-secret-detection bot commented Oct 4, 2024 •

edited

Loading

agrojean-ledger commented Oct 10, 2024 •

edited

Loading

cedelavergne-ledger commented Oct 10, 2024

ledger-wiz-cspm-secret-detection bot Oct 17, 2024

ledger-wiz-cspm-secret-detection bot Oct 17, 2024

ledger-wiz-cspm-secret-detection bot Oct 17, 2024

ledger-wiz-cspm-secret-detection bot Oct 17, 2024


Rule	Unpinned Package Version in Apk Add
Rule ID	9b55ae16-9e49-41dc-885f-a59ee0bb54bd
Severity
Resource	FROM={{ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:latest}}.{{RUN apk add imagemagick grep}}


Rule	Add Instead of Copy
Rule ID	d3b26264-01d2-4c17-aa13-e056403caf7a
Severity
Resource	FROM={{ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:latest}}.{{ADD ./dev-tools/enforcer.sh /opt/enforcer.sh}}

Allow to run Guideline_Enforcer #147

Allow to run Guideline_Enforcer #147

Conversation

cedelavergne-ledger commented Oct 4, 2024 • edited Loading

ledger-wiz-cspm-secret-detection bot commented Oct 4, 2024 • edited Loading

Wiz Scan Summary

agrojean-ledger commented Oct 10, 2024 • edited Loading

cedelavergne-ledger commented Oct 10, 2024

ledger-wiz-cspm-secret-detection bot Oct 17, 2024

Choose a reason for hiding this comment

Details

ledger-wiz-cspm-secret-detection bot Oct 17, 2024

Choose a reason for hiding this comment

Details

ledger-wiz-cspm-secret-detection bot Oct 17, 2024

Choose a reason for hiding this comment

Details

ledger-wiz-cspm-secret-detection bot Oct 17, 2024

Choose a reason for hiding this comment

Details

cedelavergne-ledger commented Oct 4, 2024 •

edited

Loading

ledger-wiz-cspm-secret-detection bot commented Oct 4, 2024 •

edited

Loading

agrojean-ledger commented Oct 10, 2024 •

edited

Loading