Initial commit

scripts/verify-security-pins.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# Verify phase-1/2 minimum security gem/package versions in lockfiles.
+set -euo pipefail
+
+semver_ge() {
+  printf '%s\n%s\n' "$2" "$1" | sort -V | head -1 | grep -qx "$2"
+}
+
+check_gemfile_lock() {
+  local file=$1 name min
+  echo "Checking ${file}..."
+  while read -r name min; do
+    [[ -z "$name" ]] && continue
+    local ver
+    ver=$(grep -E "^    ${name} \(" "$file" | head -1 | sed -E 's/.*\(([0-9][0-9.a-z-]*).*/\1/' || true)
+    if [[ -z "$ver" ]]; then
+      echo "FAIL: ${name} not found in ${file}"
+      exit 1
+    fi
+    if ! semver_ge "$ver" "$min"; then
+      echo "FAIL: ${name} ${ver} < required ${min} in ${file}"
+      exit 1
+    fi
+    echo "  OK ${name} ${ver} (>= ${min})"
+  done <<'GEMS'
+rack 2.2.13
+nokogiri 1.13.10
+rexml 3.3.9
+tzinfo 1.2.10
+rails-html-sanitizer 1.4.4
+GEMS
+  if grep -qE '^    sidekiq \(' "$file"; then
+    local sidekiq_ver
+    sidekiq_ver=$(grep -E '^    sidekiq \(' "$file" | head -1 | sed -E 's/.*\(([0-9][0-9.a-z-]*).*/\1/')
+    if ! semver_ge "$sidekiq_ver" "6.4.0"; then
+      echo "FAIL: sidekiq ${sidekiq_ver} < required 6.4.0 in ${file}"
+      exit 1
+    fi
+    echo "  OK sidekiq ${sidekiq_ver} (>= 6.4.0)"
+  fi
+}
+
+check_yarn_lock() {
+  local file=$1
+  echo "Checking ${file}..."
+  local axios ws
+  axios=$(grep -A1 '^axios@\^0\.32' "$file" | grep 'version "' | head -1 | sed -E 's/.*version "([^"]+)".*/\1/')
+  ws=$(grep -A1 '^ws@\^7\.5' "$file" | grep 'version "' | head -1 | sed -E 's/.*version "([^"]+)".*/\1/')
+  if [[ -z "$axios" ]] || ! semver_ge "$axios" "0.32.0"; then
+    echo "FAIL: axios ${axios:-missing} < 0.32.0"
+    exit 1
+  fi
+  echo "  OK axios ${axios} (>= 0.32.0)"
+  if [[ -z "$ws" ]] || ! semver_ge "$ws" "7.5.10"; then
+    echo "FAIL: ws ${ws:-missing} < 7.5.10"
+    exit 1
+  fi
+  echo "  OK ws ${ws} (>= 7.5.10)"
+}
+
+case "${1:-}" in
+  ruby)
+    check_gemfile_lock "${2:-Gemfile.lock}"
+    ;;
+  yarn)
+    check_yarn_lock "${2:-yarn.lock}"
+    ;;
+  *)
+    echo "Usage: $0 ruby [Gemfile.lock] | yarn [yarn.lock]"
+    exit 1
+    ;;
+esac
+
+echo "Security pin verification passed."