Skip to content

Commit 5beabf3

Browse files
cosdoncosdon
committed
version 1.0.0
0 parents  commit 5beabf3

276 files changed

Lines changed: 65906 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/build.yml‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
name: Build and package the NowSecure Platform CLI
2+
on:
3+
push:
4+
branches:
5+
- main
6+
tags:
7+
- 'v[0-9]+.[0-9]+.[0-9]+*'
8+
pull_request:
9+
branches:
10+
- main
11+
workflow_dispatch: {}
12+
13+
jobs:
14+
build-on-ubuntu:
15+
name: Build .deb files for arm & intel
16+
runs-on: ubuntu-22.04
17+
steps:
18+
- uses: actions/checkout@v3
19+
- name: Get Git History
20+
run: git fetch --unshallow --filter=blob:none --tags --force
21+
- name: Set Version
22+
id: set-version
23+
run: |
24+
TAG_REGEX="^refs/tags/(v(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(\\-[0-9A-Za-z-]+(\\.[0-9A-Za-z-]+)*)?(\\+[0-9A-Za-z-]+(\\.[0-9A-Za-z-]+)*)?)$"
25+
if [[ ${{ github.ref }} =~ $TAG_REGEX ]]; then
26+
echo "version=${BASH_REMATCH[1]}" >> $GITHUB_OUTPUT
27+
else
28+
echo "version=$(git describe --tags --long --match 'v*')" >> $GITHUB_OUTPUT
29+
fi
30+
- uses: actions/setup-node@v3
31+
with:
32+
node-version: '16'
33+
- run: |
34+
CLI_VERSION=${{ steps.set-version.outputs.version }} node cli/.ci/set-package-vars.js
35+
CI_CD_BUILD=1 cli/.ci/package.sh
36+
- name: Archive artifacts
37+
uses: actions/upload-artifact@v3
38+
with:
39+
name: Linux
40+
path: |
41+
cli/dist/deb
42+
43+
build-on-macos:
44+
name: Build, sign and notarize .pkg files for Mac
45+
runs-on: macos-12
46+
steps:
47+
- uses: actions/checkout@v3
48+
- name: Get Git History
49+
run: git fetch --unshallow --filter=blob:none --tags --force
50+
- name: Set Version
51+
id: set-version
52+
run: |
53+
TAG_REGEX="^refs/tags/(v(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(\\-[0-9A-Za-z-]+(\\.[0-9A-Za-z-]+)*)?(\\+[0-9A-Za-z-]+(\\.[0-9A-Za-z-]+)*)?)$"
54+
if [[ ${{ github.ref }} =~ $TAG_REGEX ]]; then
55+
echo "version=${BASH_REMATCH[1]}" >> $GITHUB_OUTPUT
56+
else
57+
echo "version=$(git describe --tags --long --match 'v*')" >> $GITHUB_OUTPUT
58+
fi
59+
- uses: actions/setup-node@v3
60+
with:
61+
node-version: '16'
62+
- name: Install the Apple certificate and provisioning profile
63+
env:
64+
BUILD_CERTIFICATE_BASE64: ${{ secrets.BUILD_CERTIFICATE_BASE64 }}
65+
P12_PASSWORD: ${{ secrets.P12_PASSWORD }}
66+
KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
67+
run: |
68+
# create variables
69+
CERTIFICATE_PATH=$RUNNER_TEMP/build_certificate.p12
70+
KEYCHAIN_PATH=$RUNNER_TEMP/app-signing.keychain-db
71+
72+
# import certificate from secrets
73+
echo -n "$BUILD_CERTIFICATE_BASE64" | base64 --decode -o $CERTIFICATE_PATH
74+
75+
# create temporary keychain
76+
security create-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
77+
security set-keychain-settings -lut 21600 $KEYCHAIN_PATH
78+
security unlock-keychain -p "$KEYCHAIN_PASSWORD" $KEYCHAIN_PATH
79+
80+
# import certificate to keychain
81+
security import $CERTIFICATE_PATH -P "$P12_PASSWORD" -A -t cert -f pkcs12 -k $KEYCHAIN_PATH
82+
security list-keychain -d user -s $KEYCHAIN_PATH
83+
84+
- name: Build, sign, and notarize the installer packages
85+
env:
86+
KEYCHAIN_PASSWORD: ${{ secrets.KEYCHAIN_PASSWORD }}
87+
APPLEID_PASSWORD: ${{ secrets.APPLEID_PASSWORD }}
88+
APPLEID: ${{ secrets.APPLEID }}
89+
APPLEID_TEAM: ${{ secrets.APPLEID_TEAM }}
90+
SIGNING_ID: ${{ secrets.SIGNING_ID }}
91+
92+
# Note: oclif requires the env var OSX_KEYCHAIN to know where the keychain is
93+
run: |
94+
CLI_VERSION=${{ steps.set-version.outputs.version }} node cli/.ci/set-package-vars.js
95+
96+
security unlock-keychain -p "$KEYCHAIN_PASSWORD" $OSX_KEYCHAIN
97+
OSX_KEYCHAIN=$RUNNER_TEMP/app-signing.keychain-db CI_CD_BUILD=1 cli/.ci/package.sh
98+
99+
node cli/.ci/notarize.js cli/dist/macos/*.pkg
100+
spctl --assess -vv --type install cli/dist/macos/*.pkg
101+
102+
- name: Clean up keychain
103+
if: ${{ always() }}
104+
run: |
105+
security delete-keychain $RUNNER_TEMP/app-signing.keychain-db
106+
107+
- name: Archive Artifacts
108+
uses: actions/upload-artifact@v3
109+
with:
110+
name: MacOS
111+
path: |
112+
cli/dist/macos
113+
114+
release:
115+
needs:
116+
- build-on-ubuntu
117+
- build-on-macos
118+
runs-on: ubuntu-22.04
119+
steps:
120+
- name: Check Tag
121+
id: check-tag
122+
run: |
123+
TAG_REGEX="^refs/tags/(v(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(\\-[0-9A-Za-z-]+(\\.[0-9A-Za-z-]+)*)?(\\+[0-9A-Za-z-]+(\\.[0-9A-Za-z-]+)*)?)$"
124+
if [[ ${{ github.ref }} =~ $TAG_REGEX ]]; then
125+
echo "version=${BASH_REMATCH[1]}" >> $GITHUB_OUTPUT
126+
echo "release=true" >> $GITHUB_OUTPUT
127+
else
128+
echo "release=false" >> $GITHUB_OUTPUT
129+
fi
130+
131+
- name: Download Release Artifacts
132+
if: ${{ steps.check-tag.outputs.release == 'true' }}
133+
uses: actions/download-artifact@v3
134+
with:
135+
path: artifacts
136+
137+
- name: Create Release
138+
if: ${{ steps.check-tag.outputs.release == 'true' }}
139+
uses: ncipollo/[email protected]
140+
with:
141+
artifacts: "artifacts/Linux/*.deb,artifacts/MacOS/*.pkg"
142+
tag: ${{ steps.check-tag.outputs.version }}
143+
144+
145+

‎.gitignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
**/node_modules
2+
lib/graphql.schema.json

‎README.md‎

Lines changed: 188 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,188 @@
1+
# NowSecure CLI
2+
3+
## Overview
4+
5+
The NowSecure CLI is a tool that allows users to interact with the NowSecure Platform. It is a command line interface that allows users to perform a variety of tasks, including:
6+
7+
* Uploading Applications to NowSecure Platform.
8+
* Accessing assessment data.
9+
* Managing your NowSecure Organization including sending invitations.
10+
11+
## User's Guide
12+
13+
### Getting Started
14+
15+
### Prerequisites
16+
17+
The following is needed to use the ns-cli:
18+
19+
* A valid NowSecure Platform account.
20+
* A valid NowSecure Platform API token. Instructions on how to acquire this can be found in the NowSecure support center document [Creating an API Bearer Token in Platform](https://support.nowsecure.com/hc/en-us/articles/7499657262093-Creating-an-API-Bearer-Token-in-Platform)
21+
* If you are using a single tenant deployment of NowSecure Platform, you will need to specify the URLs of your deployment during configuration. Please be sure to have the following URLs available:
22+
* The URL of your NowSecure Platform REST API. This is the URL that you will use to access the NowSecure Platform API. This URL will be in the format of `lab-api.<tenant>.nowsecure.com`.
23+
* The URL of your NowSecure Graph API. This is the URL that you will use to access the NowSecure Graph API. This URL will be in the format of `api.<tenant>.nowsecure.com`.
24+
* The URL of your NowSecure Platform UI. This is the URL that you will use to access the NowSecure Platform UI. This URL will be in the format of `app.<tenant>.nowsecure.com`.
25+
26+
### Install
27+
28+
1. Get binary from [Releases](https://github.com/nowsecure/nowsecure-platform-cli/releases)
29+
2. Right click the .pkg file and select `run`.
30+
31+
### Configure
32+
33+
1. After the `ns-cli` has been installed on your system, run `ns-cli configure` to configure the CLI with your NowSecure Platform Account.
34+
2. The first prompt will ask you to enter the profile you are using. Hit enter to select the default profile of `default`.
35+
36+
**Note:** Most users will only need to use the default profile.
37+
3. The next prompt will ask you to enter the Platform API token that you will be using. Paste this into the field provided and hit enter.
38+
4. The next prompt will ask you to enter the Graphql endpoint for the NowSecure Platform. You can just hit enter if you are using the CLI to interact with the default production instance of NowSecure Platform. If you are using a single tenant deployment of NowSecure Platform, you will need to enter the URL of your Graphql endpoint. This URL will be in the format of `api.<tenant>.nowsecure.com`.
39+
5. The next prompt will ask you to enter the REST endpoint for the NowSecure Platform. You can just hit enter if you are using the CLI to interact with the default production instance of NowSecure Platform. If you are using a single tenant deployment of NowSecure Platform, you will need to enter the URL of your REST endpoint. This URL will be in the format of `lab-api.<tenant>.nowsecure.com`.
40+
6. The next prompt and final will ask you to enter the UI Server for the NowSecure platform. You can just hit enter if you are using the CLI to interact with the default production instance of NowSecure Platform. If you are using a single tenant deployment of NowSecure Platform, you will need to enter the URL of your UI Server. This URL will be in the format of `app.<tenant>.nowsecure.com`.
41+
42+
Once done, verify that the CLI functions as expected by running `ns-cli app list`. A listing of the apps in your platform account will be displayed. If desired, you can run `ns-cli app list --json` to return the results in json format. Example:
43+
44+
```bash
45+
✗ ns-cli app list
46+
REF TITLE PLATFORM PACKAGE GROUP
47+
9fc8a97e-2044-11eb-80b5-snip "Business Suite" ios com.facebook.PageAdminApp "Auto Group"
48+
952801a2-2a96-11eb-80b5-snip Disney+ android com.disney.disneyplus "Auto Group"
49+
0f377a8a-2b51-11eb-b2b8-snip Strava ios com.strava.stravaride TriageGroup
50+
dcf30d7a-2c16-11eb-80b5-snip Facebook ios com.facebook.Facebook "Cool Group"
51+
9d691706-3181-11eb-80b5-snip Darksky ios com.jackadam.darksky "Auto Group"
52+
```
53+
54+
### Usage
55+
56+
Running `ns-cli help` will provide a top level list of the options that are available via the CLI:
57+
58+
```
59+
$ ns-cli help
60+
VERSION
61+
@nowsecure/cli/1.0.0-alpha.2 darwin-arm64 node-v16.19.1
62+
63+
USAGE
64+
$ ns-cli [COMMAND]
65+
66+
TOPICS
67+
app Commands to manipulate applications for analysis
68+
assessment Commands to retrieve assessment data
69+
organization Commands for the user's organization
70+
plugins List installed plugins.
71+
user Commands for users & accounts
72+
73+
COMMANDS
74+
app Commands to manipulate applications for analysis
75+
assessment Commands to retrieve assessment data
76+
autocomplete display autocomplete installation instructions
77+
configure
78+
help Display help for ns-cli.
79+
organization Commands for the user's organization
80+
plugins List installed plugins.
81+
user Commands for users & accounts
82+
```
83+
Options are as follows
84+
85+
#### app
86+
87+
App commands provide steps that can be used to manipulate application binaries for analysis. The following commands are available:
88+
89+
* **app archive** Allows you to Archive or Unarchive an application that has been uploaded to NowSecure Platform.
90+
* **app config** Retrieve the analysis configuration for an application that has been uploaded to NowSecure Platform
91+
* **app create** Create an app resource without a binary
92+
* **app last-assessment**: Show the details and findings of an assessment based on platform (`ios` or `android`) and package name (`com.facebook.katana`). If the app exists in multiple groups, provide the group reference using the `-g` or `--group` option.
93+
* **app list** List available applications in your platform account.
94+
* **app process** Upload and analyze an application binary.
95+
* **app update** Update the application's analysis configuration.
96+
* **app upload** Upload an application binary.
97+
* **app vulnerabilities** Show application vulnerabilities
98+
99+
You can use the `--help` option to get more details on each of the options above.
100+
101+
102+
#### assessment
103+
104+
Assessment commands are used to interact with assessments created in in NowSecure Platform. The following commands are available:
105+
106+
* **assessment cancel** Cancel a running assessment
107+
* **assessment github-snapshot** Create a SARIF report from an assessment
108+
* **assessment list** List assessments in your NowSecure Platform account
109+
* **assessment raw** Get the raw data for an assessment
110+
* **assessment sarif** Create a SARIF report from an assessment
111+
* **assessment show** Show the details and findings of an assessment
112+
* **assessment start** Start an assessment
113+
114+
You can use the `--help` option to get more details on each of the options above.
115+
116+
#### autocomplete
117+
118+
Running `ns-cli autocomplete` will provide details on how to integrate the ns-cli into your `.zshrc` to perform autocomplete actions.
119+
120+
#### configure
121+
122+
Configure is described above in the [Configure](#configure) section.
123+
124+
#### help
125+
126+
Help provides help for the ns-cli.
127+
128+
#### organization
129+
130+
Organization commands provide steps that can be used to manipulate an organization within NowSecure Platform. The following commands are available:
131+
132+
* **organization groups** Returns the groups that have been configured in an NowSecure Platform organization.
133+
* **organization invitations** List invitations that have been created within your NowSecure Platform organization.
134+
* **organization invite** Create an invitiation to add someone to your NowSecure Platform organization.
135+
* **organization revoke-invitation** Revoke an invitation that has been created in your NowSecure Platform organization.
136+
* **organization users** List the users that exist in your NowSecure Platform organization.
137+
138+
You can use the `--help` option to get more details on each of the options above.
139+
140+
#### plugins
141+
142+
The Plugins options will list plugins that have been added to the ns-cli.
143+
144+
#### user
145+
146+
User commands provide steps that can be used to manipulate users within NowSecure Platform. The following commands are available:
147+
148+
* **user account** Get the user details from NowSecure Platform for the user account that was used to create the token that the ns-cli has been configured to use.
149+
* **user groups** Get the group membership from NowSecure Platform for the user account that was used to create the token that the ns-cli has been configured
150+
151+
You can use the `--help` option to get more details on each of the options above.
152+
153+
154+
155+
## Developer's Guide
156+
157+
This is a Monorepo containing the following items.
158+
- The [NowSecure Sarif Conversion Module](./sarif/README.md)
159+
- The [NowSecure GitHub Snapshot Module](./github-snapshot/README.md)
160+
- The [NowSecure REST and GQL API Library](./lib/README.md)
161+
- The [NowSecure CLI](./cli/README.md)
162+
163+
## Building
164+
165+
> Ensure you are using Node >= 16 and have `yarn` installed before proceeding.
166+
167+
If you are looking to build a specific library or tool, see
168+
[Building specific tools](#building-specific-tools).
169+
170+
Run the following to build everything:
171+
```sh
172+
yarn run build
173+
```
174+
175+
Run the following to clean up all build artifacts:
176+
```sh
177+
yarn run clean
178+
```
179+
180+
### Building specific tools
181+
182+
| Tool | Build Command | Clean Command |
183+
|:--|:--|:--|
184+
| [NowSecure REST and GQL API Library](./lib/README.md) | `yarn run build:lib` | `yarn run clean:lib` |
185+
| [NowSecure Sarif Conversion Module](./sarif/README.md) | `yarn run build:sarif` | `yarn run clean:sarif` |
186+
| [NowSecure GitHub Snapshot Module](./github-snapshot/README.md) | `yarn run build:github-snapshot` | `yarn run clean:github-snapshot` |
187+
| [NowSecure CLI](./cli/README.md) | `yarn run build:cli` | `yarn run clean:cli` |
188+

‎cli/.ci/notarize.js‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
#!/usr/bin/env node
2+
3+
const fs = require("fs");
4+
const path = require("path");
5+
const { notarize } = require("@electron/notarize");
6+
7+
const APPLEID = process.env.APPLEID;
8+
const APPLEID_TEAM = process.env.APPLEID_TEAM;
9+
const APPLEID_PASSWORD = process.env.APPLEID_PASSWORD;
10+
11+
async function processOne(fileName) {
12+
const fullPath = path.normalize(path.resolve(fileName));
13+
console.log(`Notarizing ${fullPath}`);
14+
await notarize({
15+
tool: "notarytool",
16+
appPath: fullPath,
17+
appleId: APPLEID,
18+
appleIdPassword: APPLEID_PASSWORD,
19+
teamId: APPLEID_TEAM,
20+
});
21+
console.log(`${fullPath} completed`);
22+
}
23+
24+
async function processAll() {
25+
const files = process.argv.slice(2);
26+
27+
if (!APPLEID) {
28+
console.log("No Apple ID specified, skipping");
29+
return;
30+
}
31+
32+
if (!(APPLEID_PASSWORD && APPLEID_TEAM)) {
33+
console.error("APPLEID_PASSWORD and APPLEID_TEAM are required");
34+
process.exit(1);
35+
}
36+
37+
const promises = [];
38+
for (const file of files) {
39+
const stat = fs.statSync(file);
40+
if (stat.isFile()) {
41+
promises.push(processOne(file));
42+
}
43+
}
44+
45+
if (promises.length === 0) {
46+
console.log("No files found");
47+
} else {
48+
await Promise.all(promises);
49+
}
50+
}
51+
52+
Promise.resolve().then(processAll);

0 commit comments

Comments
 (0)