Skip to content

feat(scan): add REQUIRE_SIGNED to forbid unsigned rules #49

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
joeymussalli wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat(scan): add REQUIRE_SIGNED to forbid unsigned rules #49

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 20 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,3 +41,23 @@ marketplaces. Distribution is **copy-paste**: vendor the `scan/` directory plus
the relevant wrapper into your repo. A native CodePipeline action provider is an
AWS Partner integration; an AWS Marketplace listing is a separate product
(container/SaaS) motion.

## Rule integrity

`trustabl` verifies rules against an embedded trust keyring by default and
refuses to run unverified rules, exiting 2 on a verification failure. It also
has an unsigned git path, and this plugin exposes two inputs that reach it:

| Var | Default | Effect on integrity |
|---|---|---|
| `RULES_REPO` | _(default)_ | Exported as `TRUSTABL_RULES_REPO` — points the scan at a different rules source. |
| `RULES_REF` | _(default)_ | Pins a git ref rather than taking the current signed bundle. |
| `REQUIRE_SIGNED` | `false` | `true` passes `--require-signed`, which forbids the unsigned fallback. |

Neither of the first two is wrong to use — pinning a ref is a reasonable way to
get reproducible scans. What matters is that a gate should be explicit about it.
Set `REQUIRE_SIGNED=true` and the scan fails rather than quietly falling back to
unsigned rules; leave it unset and the behaviour is exactly as before.

A scanner is only as trustworthy as the rules it runs, so it is worth deciding
this deliberately rather than inheriting a default.
11 changes: 10 additions & 1 deletion scan/trustabl-scan.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@
# GitLab-only bits (gl-sast report, CI_* env) are swapped for AWS equivalents.
#
# Inputs are environment variables (all optional; sensible defaults):
# TARGET VERSION DETECTORS STRICT RULES_REF RULES_REPO
# TARGET VERSION DETECTORS STRICT RULES_REF RULES_REPO REQUIRE_SIGNED
# SARIF_FILE JSON_FILE RISK_SCORE_THRESHOLD SEVERITY_THRESHOLD
# BRANCH GITHUB_TOKEN DEBUG

Expand Down Expand Up @@ -132,6 +132,15 @@ BASE_ARGS=(scan "$TARGET")
[ -n "$DETECTORS" ] && BASE_ARGS+=(--detectors "$DETECTORS")
[ "$STRICT" = "true" ] && BASE_ARGS+=(--strict)
[ -n "$RULES_REF" ] && BASE_ARGS+=(--rules-ref "$RULES_REF")
# trustabl verifies rules against an embedded keyring by default and exits 2 on
# a verification failure, but it also has an unsigned git path. This plugin
# hands users two knobs onto that path -- RULES_REPO (exported above as
# TRUSTABL_RULES_REPO) and RULES_REF -- and offered no way to say "never accept
# unsigned rules", which is exactly the guarantee a CI gate wants.
# Matched case-insensitively on purpose: silently ignoring REQUIRE_SIGNED=TRUE
# would be a fail-open on the one input whose job is to tighten the gate.
REQ_SIGNED="${REQUIRE_SIGNED:-false}"
[ "${REQ_SIGNED,,}" = "true" ] && BASE_ARGS+=(--require-signed)

# Run 1: SARIF (file emit).
trustabl "${BASE_ARGS[@]}" --format sarif > "$SARIF_FILE"
Expand Down