mirror of
https://github.com/ruvnet/RuView
synced 2026-08-09 20:21:43 +00:00
feat: vendor midstream and sublinear-time-solver libraries
Add ruvnet/midstream (AIMDS real-time inference) and ruvnet/sublinear-time-solver (sublinear optimization algorithms) as vendored dependencies under vendor/. Co-Authored-By: claude-flow <ruv@ruv.net>
This commit is contained in:
ruv
@@ -0,0 +1,260 @@
|
||||
#!/bin/bash
|
||||
# AIMDS Security Verification Script
|
||||
# Run this after applying security fixes to verify compliance
|
||||
|
||||
set -e
|
||||
|
||||
echo "================================================================================"
|
||||
echo "AIMDS Security Verification"
|
||||
echo "================================================================================"
|
||||
echo ""
|
||||
|
||||
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
||||
PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
|
||||
cd "$PROJECT_DIR"
|
||||
|
||||
PASSED=0
|
||||
FAILED=0
|
||||
WARNINGS=0
|
||||
|
||||
# Colors
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
check_pass() {
|
||||
echo -e "${GREEN}✅ PASS${NC}: $1"
|
||||
((PASSED++))
|
||||
}
|
||||
|
||||
check_fail() {
|
||||
echo -e "${RED}❌ FAIL${NC}: $1"
|
||||
((FAILED++))
|
||||
}
|
||||
|
||||
check_warn() {
|
||||
echo -e "${YELLOW}⚠️ WARN${NC}: $1"
|
||||
((WARNINGS++))
|
||||
}
|
||||
|
||||
echo "================================================================================"
|
||||
echo "1. CHECKING FOR HARDCODED SECRETS"
|
||||
echo "================================================================================"
|
||||
echo ""
|
||||
|
||||
# Check if .env exists
|
||||
if [ -f ".env" ]; then
|
||||
check_warn ".env file exists (should not be in git)"
|
||||
|
||||
# Check if .env contains real secrets
|
||||
if grep -q "sk-" .env 2>/dev/null; then
|
||||
check_fail "Found API keys in .env file"
|
||||
else
|
||||
check_pass "No obvious API keys in .env"
|
||||
fi
|
||||
else
|
||||
check_pass ".env file not found (good)"
|
||||
fi
|
||||
|
||||
# Check git status
|
||||
if git ls-files --error-unmatch .env 2>/dev/null; then
|
||||
check_fail ".env is tracked in git - MUST REMOVE"
|
||||
else
|
||||
check_pass ".env is not tracked in git"
|
||||
fi
|
||||
|
||||
# Check .gitignore
|
||||
if grep -q "^\.env$" .gitignore 2>/dev/null; then
|
||||
check_pass ".env is in .gitignore"
|
||||
else
|
||||
check_fail ".env NOT in .gitignore"
|
||||
fi
|
||||
|
||||
# Check for hardcoded secrets in source code
|
||||
echo ""
|
||||
echo "Checking source code for hardcoded secrets..."
|
||||
SECRET_PATTERNS="sk-|AKIA|ghp_|xox[baprs]-|AIza"
|
||||
if grep -rn "$SECRET_PATTERNS" src/ crates/ 2>/dev/null | grep -v ".md:" | grep -v "test" | grep -v "example"; then
|
||||
check_fail "Found potential secrets in source code"
|
||||
else
|
||||
check_pass "No obvious secrets in source code"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "================================================================================"
|
||||
echo "2. CHECKING COMPILATION"
|
||||
echo "================================================================================"
|
||||
echo ""
|
||||
|
||||
# Check Rust compilation
|
||||
echo "Compiling Rust crates..."
|
||||
if cargo build --release --quiet 2>&1 | grep -q "error"; then
|
||||
check_fail "Rust compilation failed"
|
||||
cargo build 2>&1 | grep "error" | head -5
|
||||
else
|
||||
check_pass "Rust compilation successful"
|
||||
fi
|
||||
|
||||
# Check for clippy warnings
|
||||
echo ""
|
||||
echo "Running clippy..."
|
||||
CLIPPY_OUTPUT=$(cargo clippy --all-targets --all-features -- -D warnings 2>&1)
|
||||
if echo "$CLIPPY_OUTPUT" | grep -q "error"; then
|
||||
check_fail "Clippy found errors"
|
||||
echo "$CLIPPY_OUTPUT" | grep "error" | head -5
|
||||
else
|
||||
check_pass "Clippy check passed"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "================================================================================"
|
||||
echo "3. CHECKING DEPENDENCIES"
|
||||
echo "================================================================================"
|
||||
echo ""
|
||||
|
||||
# NPM audit
|
||||
echo "Running npm audit..."
|
||||
if [ -f "package.json" ]; then
|
||||
NPM_AUDIT=$(npm audit --json 2>/dev/null || echo "{}")
|
||||
VULNERABILITIES=$(echo "$NPM_AUDIT" | jq -r '.metadata.vulnerabilities.total // 0' 2>/dev/null || echo "0")
|
||||
CRITICAL=$(echo "$NPM_AUDIT" | jq -r '.metadata.vulnerabilities.critical // 0' 2>/dev/null || echo "0")
|
||||
HIGH=$(echo "$NPM_AUDIT" | jq -r '.metadata.vulnerabilities.high // 0' 2>/dev/null || echo "0")
|
||||
|
||||
if [ "$CRITICAL" -gt 0 ] || [ "$HIGH" -gt 0 ]; then
|
||||
check_fail "Found $CRITICAL critical, $HIGH high vulnerabilities"
|
||||
elif [ "$VULNERABILITIES" -gt 0 ]; then
|
||||
check_warn "Found $VULNERABILITIES moderate/low vulnerabilities"
|
||||
else
|
||||
check_pass "No npm vulnerabilities found"
|
||||
fi
|
||||
fi
|
||||
|
||||
# Cargo audit (if installed)
|
||||
echo ""
|
||||
echo "Checking cargo dependencies..."
|
||||
if command -v cargo-audit &> /dev/null; then
|
||||
if cargo audit 2>&1 | grep -q "error"; then
|
||||
check_fail "Cargo audit found vulnerabilities"
|
||||
else
|
||||
check_pass "No cargo vulnerabilities found"
|
||||
fi
|
||||
else
|
||||
check_warn "cargo-audit not installed (run: cargo install cargo-audit)"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "================================================================================"
|
||||
echo "4. CHECKING SECURITY CONFIGURATION"
|
||||
echo "================================================================================"
|
||||
echo ""
|
||||
|
||||
# Check for TLS configuration
|
||||
if grep -q "https.createServer" src/gateway/server.ts; then
|
||||
check_pass "HTTPS configuration found"
|
||||
else
|
||||
check_fail "No HTTPS configuration found"
|
||||
fi
|
||||
|
||||
# Check for authentication middleware
|
||||
if grep -q "authMiddleware\|authenticate\|verifyApiKey" src/gateway/server.ts; then
|
||||
check_pass "Authentication middleware found"
|
||||
else
|
||||
check_fail "No authentication middleware found"
|
||||
fi
|
||||
|
||||
# Check for proper CORS config
|
||||
if grep -q "cors({" src/gateway/server.ts; then
|
||||
check_pass "CORS configuration found"
|
||||
else
|
||||
check_warn "CORS not configured (using defaults)"
|
||||
fi
|
||||
|
||||
# Check for rate limiting
|
||||
if grep -q "rateLimit" src/gateway/server.ts; then
|
||||
check_pass "Rate limiting configured"
|
||||
else
|
||||
check_fail "Rate limiting not found"
|
||||
fi
|
||||
|
||||
# Check for helmet
|
||||
if grep -q "helmet" src/gateway/server.ts; then
|
||||
check_pass "Helmet security headers enabled"
|
||||
else
|
||||
check_fail "Helmet not configured"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "================================================================================"
|
||||
echo "5. RUNNING TESTS"
|
||||
echo "================================================================================"
|
||||
echo ""
|
||||
|
||||
# Rust tests
|
||||
echo "Running Rust tests..."
|
||||
if cargo test --quiet 2>&1 | grep -q "FAILED"; then
|
||||
check_fail "Rust tests failed"
|
||||
else
|
||||
check_pass "Rust tests passed"
|
||||
fi
|
||||
|
||||
# TypeScript tests
|
||||
echo ""
|
||||
echo "Running TypeScript tests..."
|
||||
if [ -f "package.json" ]; then
|
||||
if npm test 2>&1 | grep -q "FAIL"; then
|
||||
check_fail "TypeScript tests failed"
|
||||
else
|
||||
check_pass "TypeScript tests passed"
|
||||
fi
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "================================================================================"
|
||||
echo "6. CHECKING CODE QUALITY"
|
||||
echo "================================================================================"
|
||||
echo ""
|
||||
|
||||
# Check for mock implementations
|
||||
if grep -rn "Hash-based embedding for demo\|TODO:\|FIXME:\|HACK:" src/ crates/ | grep -v ".md:"; then
|
||||
check_warn "Found TODOs/FIXMEs or mock implementations"
|
||||
else
|
||||
check_pass "No obvious mock implementations or TODOs"
|
||||
fi
|
||||
|
||||
# Check for proper error handling
|
||||
if grep -q "\.expect(\|\.unwrap(" crates/*/src/*.rs; then
|
||||
check_warn "Found .expect()/.unwrap() calls (consider proper error handling)"
|
||||
else
|
||||
check_pass "No .expect()/.unwrap() calls found"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "================================================================================"
|
||||
echo "FINAL SCORE"
|
||||
echo "================================================================================"
|
||||
echo ""
|
||||
|
||||
TOTAL=$((PASSED + FAILED + WARNINGS))
|
||||
SCORE=$(( (PASSED * 100) / TOTAL ))
|
||||
|
||||
echo -e "Passed: ${GREEN}$PASSED${NC}"
|
||||
echo -e "Failed: ${RED}$FAILED${NC}"
|
||||
echo -e "Warnings: ${YELLOW}$WARNINGS${NC}"
|
||||
echo ""
|
||||
echo -e "Security Score: ${SCORE}/100"
|
||||
echo ""
|
||||
|
||||
if [ $FAILED -eq 0 ] && [ $SCORE -ge 80 ]; then
|
||||
echo -e "${GREEN}✅ READY FOR PRODUCTION DEPLOYMENT${NC}"
|
||||
exit 0
|
||||
elif [ $FAILED -eq 0 ]; then
|
||||
echo -e "${YELLOW}⚠️ ACCEPTABLE - Some improvements needed${NC}"
|
||||
exit 0
|
||||
else
|
||||
echo -e "${RED}❌ NOT READY - Critical issues must be fixed${NC}"
|
||||
echo ""
|
||||
echo "See SECURITY_AUDIT_REPORT.md for detailed findings"
|
||||
echo "See CRITICAL_FIXES_REQUIRED.md for fix instructions"
|
||||
exit 1
|
||||
fi
|
||||
Reference in New Issue
Block a user