77 lines
2 KiB
Nix
77 lines
2 KiB
Nix
{ pkgs, lib, python3, fetchFromGitHub }:
|
|
|
|
let
|
|
pname = "checkov";
|
|
version = "1.0.674";
|
|
src = fetchFromGitHub {
|
|
owner = "bridgecrewio";
|
|
repo = pname;
|
|
rev = version;
|
|
sha256 = "/S8ic5ZVxA2vd/rjRPX5gslbmnULL7BSx34vgWIsheQ=";
|
|
};
|
|
|
|
disabled = pkgs.python3Packages.pythonOlder "3.7";
|
|
|
|
# CheckOV only work with `dpath 1.5.0`
|
|
dpath = pkgs.python3Packages.buildPythonPackage rec {
|
|
pname = "dpath";
|
|
version = "1.5.0";
|
|
|
|
src = pkgs.python3Packages.fetchPypi {
|
|
inherit pname version;
|
|
sha256 = "SWYVtOqEI20Y4NKGEi3nSGmmDg+H4sfsZ4f/KGxINhs=";
|
|
};
|
|
|
|
doCheck = false;
|
|
};
|
|
in
|
|
python3.pkgs.buildPythonPackage rec {
|
|
inherit pname version disabled src;
|
|
|
|
nativeBuildInputs = with python3.pkgs; [ setuptools_scm ];
|
|
|
|
propagatedBuildInputs = with python3.pkgs; [
|
|
pytest
|
|
coverage
|
|
bandit
|
|
bc-python-hcl2
|
|
deep_merge
|
|
tabulate
|
|
colorama
|
|
termcolor
|
|
junit-xml
|
|
dpath
|
|
pyyaml
|
|
boto3
|
|
GitPython
|
|
six
|
|
jmespath
|
|
tqdm
|
|
update_checker
|
|
semantic-version
|
|
packaging
|
|
];
|
|
|
|
# Both of these tests are pulling from external srouces (https://github.com/bridgecrewio/checkov/blob/f03a4204d291cf47e3753a02a9b8c8d805bbd1be/.github/workflows/build.yml)
|
|
preCheck = ''
|
|
rm -rf integration_tests/*
|
|
rm -rf tests/terraform/*
|
|
'';
|
|
|
|
# Wrap the executable so that the python packages are available
|
|
# it's just a shebang script which calls `python -m checkov "$@"`
|
|
postFixup = ''
|
|
wrapProgram $out/bin/checkov \
|
|
--set PYTHONPATH $PYTHONPATH
|
|
'';
|
|
|
|
meta = with lib; {
|
|
homepage = "https://github.com/bridgecrewio/checkov";
|
|
description = "Static code analysis tool for infrastructure-as-code";
|
|
longDescription = ''
|
|
Prevent cloud misconfigurations during build-time for Terraform, Cloudformation, Kubernetes, Serverless framework and other infrastructure-as-code-languages with Checkov by Bridgecrew.
|
|
'';
|
|
license = licenses.asl20;
|
|
maintainers = with maintainers; [ anhdle14 ];
|
|
};
|
|
}
|