Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow to run Guideline_Enforcer #147

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,14 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [3.38.0] - 2024-10-03

### Added
- New script to call guideline enforcer from ledger-app-worflow

### Changed
- Bump Speculos & Ragger versions

## [3.37.0] - 2024-09-30

### Changed
Expand Down
8 changes: 7 additions & 1 deletion dev-tools/Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -19,5 +19,11 @@
# Install the building dependencies.
RUN apk add $(echo -n "$PYTHON_BUILD_DEPS" | tr , ' ')

# Install packahes to allow Guideline Enforcer to run
RUN apk add imagemagick grep

Check warning on line 23 in dev-tools/Dockerfile

View check run for this annotation

Ledger Wiz (CSPM & secret detection) / Wiz IaC Scanner

Unpinned Package Version in Apk Add

Rule ID: 9b55ae16-9e49-41dc-885f-a59ee0bb54bd Severity: Medium Resource: FROM={{ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:latest}}.{{RUN apk add imagemagick grep}} Package version pinning reduces the range of versions that can be installed, reducing the chances of failure due to unanticipated changes
Raw output
Expected: RUN instruction with 'apk add <package>' should use package pinning form 'apk add <package>=<version>'
Found: RUN instruction apk add imagemagick grep does not use package pinning form

Check notice on line 23 in dev-tools/Dockerfile

View check run for this annotation

Ledger Wiz (CSPM & secret detection) / Wiz IaC Scanner

Apk Add Using Local Cache Path

Rule ID: 8ac96529-88bd-41af-ad98-b24bf7a8a85c Severity: None Resource: FROM={{ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:latest}}.{{RUN apk add imagemagick grep}} When installing packages, use the '--no-cache' switch to avoid the need to use '--update' and remove '/var/cache/apk/*'
Raw output
Expected: 'RUN' should not contain 'apk add' command without '--no-cache' switch
Found: 'RUN' contains 'apk add' command without '--no-cache' switch

# Install test tools (Ragger framework, Speculos emulator, Ledgerblue...)
RUN pip3 install --no-cache-dir "ragger[tests,all_backends]==1.23.0" "speculos==0.9.7"
RUN pip3 install --no-cache-dir "ragger[tests,all_backends]==1.24.0" "speculos==0.10.0"

# Add the enforcer script
ADD ./dev-tools/enforcer.sh /opt/enforcer.sh

Check notice on line 29 in dev-tools/Dockerfile

View check run for this annotation

Ledger Wiz (CSPM & secret detection) / Wiz IaC Scanner

Add Instead of Copy

Rule ID: d3b26264-01d2-4c17-aa13-e056403caf7a Severity: Low Resource: FROM={{ghcr.io/ledgerhq/ledger-app-builder/ledger-app-builder:latest}}.{{ADD ./dev-tools/enforcer.sh /opt/enforcer.sh}} Should use COPY instead of ADD unless, running a tar file
Raw output
Expected: 'COPY' ./dev-tools/enforcer.sh
Found: 'ADD' ./dev-tools/enforcer.sh
138 changes: 138 additions & 0 deletions dev-tools/enforcer.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,138 @@
#!/usr/bin/env bash
#
# script to run Guideline_enforcer checks
#

exeName=$(readlink -f "$0")

VERBOSE=false
IS_RUST=false

# All available checks (to be updated from the ledger-app-workflows repository)
ALL_CHECKS="icons app_load_params makefile readme scan"

APP_MANIFEST="ledger_app.toml"

#===============================================================================
#
# help - Prints script help and usage
#
#===============================================================================
# shellcheck disable=SC2154 # var is referenced but not assigned
help() {
echo
echo "Usage: ${exeName} <options>"
echo
echo "Options:"
echo
echo " -c <check> : Requested check from (${ALL_CHECKS}). Default is all."
echo " -d <dir> : Database directory"
echo " -w <dir> : Workflows directory"
echo " -a <dir> : Application directory"
echo " -b <dir> : Application build directory"
echo " -t <device> : Targeted device"
echo " -g <ref> : Git reference to clone ledger-app-workflows repository"
echo " -v : Verbose mode"
echo " -h : Displays this help"
echo
exit 1
}

#===============================================================================
#
# Parsing parameters
#
#===============================================================================

while getopts ":a:b:c:d:w:t:g:vh" opt; do
case ${opt} in
a) APP_DIR=${OPTARG} ;;
b) BUILD_DIR=${OPTARG} ;;
c) REQUESTED_CHECK=${OPTARG} ;;
d) DATABASE_DIR=${OPTARG} ;;
w) WORKFLOW_DIR=${OPTARG} ;;
t) TARGET=${OPTARG} ;;
g) GIT_REF=(-b "${OPTARG}") ;;
v) VERBOSE=true ;;
h) help ;;

\?) echo "Unknown option: -${OPTARG}" >&2; exit 1;;
: ) echo "Missing option argument for -${OPTARG}" >&2; exit 1;;
* ) echo "Unimplemented option: -${OPTARG}" >&2; exit 1;;
esac
done

#===============================================================================
#
# Checking parameters
#
#===============================================================================

# Init verbose options
[[ ${VERBOSE} == false ]] && verbose_mode=(-q)

if [[ -z "${APP_DIR}" ]]; then
if [[ -f /app/ledger_app.toml ]]; then
APP_DIR="/app"
elif [[ -f ./app-repository/ledger_app.toml ]]; then
APP_DIR="./app-repository"
elif [[ -f ./ledger_app.toml ]]; then
APP_DIR=$(dirname "$(readlink -f .)")
fi
fi

#===============================================================================
#
# get_app_metadata - Retrieve application metadata from manifest
#
#===============================================================================
get_app_metadata() {
if [[ ! -f "${APP_DIR}/${APP_MANIFEST}" ]]; then
echo "/!\ No ${APP_MANIFEST} manifest detected in App directory ${APP_DIR}!"
echo "This file is mandatory, please add it on your repository"
echo "Documentation here: https://github.com/LedgerHQ/ledgered/blob/master/doc/utils/manifest.md"
exit 1;
fi
cedelavergne-ledger marked this conversation as resolved.
Show resolved Hide resolved

# 'ledger_app.toml' exists
echo "Manifest detected."
# checking the manifest with the repo
ledger-manifest --check "${APP_DIR}" "${APP_DIR}/${APP_MANIFEST}"

# build directory
if [[ -z "${BUILD_DIR}" ]]; then
BUILD_DIR=$(ledger-manifest --output-build-directory "${APP_DIR}/${APP_MANIFEST}")
fi

# SDK language
[[ "$(ledger-manifest --output-sdk "${APP_DIR}/${APP_MANIFEST}")" == "rust" ]] && IS_RUST=true
}

#===============================================================================
#
# Main
#
#===============================================================================

get_app_metadata

if [[ -z "${WORKFLOW_DIR}" ]]; then
# Clone the Worflows repository
WORKFLOW_DIR="/tmp/ledger-app-workflows"
if [[ ! -d "${WORKFLOW_DIR}" ]]; then
git clone "${verbose_mode[@]}" https://github.com/LedgerHQ/ledger-app-workflows.git "${GIT_REF[@]}" "${WORKFLOW_DIR}"
fi
fi

# Formatting the parameters
parameters=()
[[ -n "${REQUESTED_CHECK}" ]] && parameters+=(-c "${REQUESTED_CHECK}")
[[ -n "${DATABASE_DIR}" ]] && parameters+=(-D "${DATABASE_DIR}")
[[ -n "${APP_DIR}" ]] && parameters+=(-a "${APP_DIR}")
[[ -n "${BUILD_DIR}" ]] && parameters+=(-b "${BUILD_DIR}")
[[ -n "${TARGET}" ]] && parameters+=(-t "${TARGET}")
[[ "${IS_RUST}" == true ]] && parameters+=(-r)
[[ "${VERBOSE}" == true ]] && parameters+=(-v)

# Calling the workflow script with same parameters
"${WORKFLOW_DIR}"/scripts/check_all.sh "${parameters[@]}"