134 lines
3 KiB
Nix
134 lines
3 KiB
Nix
{ lib
|
|
, fetchFromGitHub
|
|
, python3
|
|
}:
|
|
let
|
|
py = python3.override {
|
|
packageOverrides = self: super: {
|
|
|
|
boto3 = super.boto3.overridePythonAttrs (oldAttrs: rec {
|
|
version = "1.17.112";
|
|
src = oldAttrs.src.override {
|
|
inherit version;
|
|
sha256 = "1byqrffbgpp1mq62gnn3w3hnm54dfar0cwgvmkl7mrgbwz5xmdh8";
|
|
};
|
|
});
|
|
|
|
botocore = super.botocore.overridePythonAttrs (oldAttrs: rec {
|
|
version = "1.20.112";
|
|
src = oldAttrs.src.override {
|
|
inherit version;
|
|
sha256 = "1ksdjh3mwbzgqgfj58vyrhann23b9gqam8id2svmpdmmdq5vgffh";
|
|
};
|
|
});
|
|
|
|
s3transfer = super.s3transfer.overridePythonAttrs (oldAttrs: rec {
|
|
version = "0.4.2";
|
|
src = oldAttrs.src.override {
|
|
inherit version;
|
|
sha256 = "1cp169vz9rvng7dwbn33fgdbl3b014zpsdqsnfxxw7jm2r5jy0nb";
|
|
};
|
|
});
|
|
|
|
dpath = super.dpath.overridePythonAttrs (oldAttrs: rec {
|
|
version = "1.5.0";
|
|
src = oldAttrs.src.override {
|
|
inherit version;
|
|
sha256 = "06rn91n2izw7czncgql71w7acsa8wwni51njw0c6s8w4xas1arj9";
|
|
};
|
|
doCheck = false;
|
|
});
|
|
|
|
};
|
|
};
|
|
in
|
|
with py.pkgs;
|
|
|
|
buildPythonApplication rec {
|
|
pname = "checkov";
|
|
version = "2.0.702";
|
|
|
|
src = fetchFromGitHub {
|
|
owner = "bridgecrewio";
|
|
repo = pname;
|
|
rev = version;
|
|
sha256 = "sha256-6FaJkGQpjTNW73D39KD9qMw97znt9B1vzdlJPvqI7Vo=";
|
|
};
|
|
|
|
nativeBuildInputs = with py.pkgs; [
|
|
setuptools-scm
|
|
];
|
|
|
|
propagatedBuildInputs = with py.pkgs; [
|
|
aiodns
|
|
aiohttp
|
|
aiomultiprocess
|
|
argcomplete
|
|
bc-python-hcl2
|
|
boto3
|
|
cachetools
|
|
cloudsplaining
|
|
colorama
|
|
configargparse
|
|
cyclonedx-python-lib
|
|
deep_merge
|
|
detect-secrets
|
|
docker
|
|
dockerfile-parse
|
|
dpath
|
|
GitPython
|
|
jmespath
|
|
junit-xml
|
|
networkx
|
|
packaging
|
|
policyuniverse
|
|
pyyaml
|
|
semantic-version
|
|
tabulate
|
|
termcolor
|
|
tqdm
|
|
typing-extensions
|
|
update_checker
|
|
];
|
|
|
|
checkInputs = with py.pkgs; [
|
|
aioresponses
|
|
jsonschema
|
|
mock
|
|
pytest-asyncio
|
|
pytest-mock
|
|
pytest-xdist
|
|
pytestCheckHook
|
|
];
|
|
|
|
disabledTests = [
|
|
# No API key available
|
|
"api_key"
|
|
# Requires network access
|
|
"TestSarifReport"
|
|
];
|
|
|
|
disabledTestPaths = [
|
|
# Tests are pulling from external sources
|
|
# https://github.com/bridgecrewio/checkov/blob/f03a4204d291cf47e3753a02a9b8c8d805bbd1be/.github/workflows/build.yml
|
|
"integration_tests/"
|
|
"tests/terraform/"
|
|
# Performance tests have no value for us
|
|
"performance_tests/test_checkov_performance.py"
|
|
];
|
|
|
|
pythonImportsCheck = [
|
|
"checkov"
|
|
];
|
|
|
|
meta = with lib; {
|
|
description = "Static code analysis tool for infrastructure-as-code";
|
|
homepage = "https://github.com/bridgecrewio/checkov";
|
|
longDescription = ''
|
|
Prevent cloud misconfigurations during build-time for Terraform, Cloudformation,
|
|
Kubernetes, Serverless framework and other infrastructure-as-code-languages.
|
|
'';
|
|
license = licenses.asl20;
|
|
maintainers = with maintainers; [ anhdle14 fab ];
|
|
};
|
|
}
|