Skip to content

Commit 939da91

Browse files
hafgit99hafgit99
committed
Update aegis-3.0 project files
1 parent bb9d4cc commit 939da91

139 files changed

Lines changed: 58535 additions & 0 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎aegis-3.0/.github/workflows/build-linux.yml‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
name: Build Linux
2+
3+
on:
4+
push:
5+
branches: [ main ]
6+
tags:
7+
- 'v*'
8+
pull_request:
9+
branches: [ main ]
10+
workflow_dispatch:
11+
12+
jobs:
13+
build-linux:
14+
runs-on: ubuntu-22.04
15+
16+
steps:
17+
- name: Checkout code
18+
uses: actions/checkout@v4
19+
20+
- name: Setup Node.js
21+
uses: actions/setup-node@v4
22+
with:
23+
node-version: '20'
24+
cache: 'npm'
25+
26+
- name: Setup Rust
27+
uses: dtolnay/rust-toolchain@stable
28+
29+
- name: Install Linux dependencies
30+
run: |
31+
sudo apt-get update
32+
sudo apt-get install -y libgtk-3-dev libwebkit2gtk-4.1-dev libayatana-appindicator3-dev librsvg2-dev libssl-dev pkg-config
33+
34+
- name: Install Node dependencies
35+
run: npm ci
36+
37+
- name: Build Application
38+
run: npm run build
39+
40+
- name: Package for Linux
41+
run: npx electron-builder --linux
42+
env:
43+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
44+
45+
- name: Upload Linux Artifacts
46+
uses: actions/upload-artifact@v4
47+
with:
48+
name: linux-build
49+
path: |
50+
release/*.AppImage
51+
release/*.deb
52+
retention-days: 30

‎aegis-3.0/.github/workflows/build-macos.yml‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
name: Build macOS
2+
3+
on:
4+
push:
5+
branches: [ main ]
6+
tags:
7+
- 'v*'
8+
pull_request:
9+
branches: [ main ]
10+
workflow_dispatch:
11+
12+
jobs:
13+
build-macos:
14+
runs-on: macos-latest
15+
16+
steps:
17+
- name: Checkout code
18+
uses: actions/checkout@v4
19+
20+
- name: Setup Node.js
21+
uses: actions/setup-node@v4
22+
with:
23+
node-version: '20'
24+
cache: 'npm'
25+
26+
- name: Setup Rust
27+
uses: dtolnay/rust-toolchain@stable
28+
29+
- name: Install Node dependencies
30+
run: npm ci
31+
32+
- name: Build Application
33+
run: npm run build
34+
35+
- name: Package for macOS
36+
run: npx electron-builder --mac
37+
env:
38+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
39+
40+
- name: Upload macOS Artifacts
41+
uses: actions/upload-artifact@v4
42+
with:
43+
name: macos-build
44+
path: |
45+
release/*.dmg
46+
retention-days: 30

‎aegis-3.0/.github/workflows/security.yml‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
name: Security Pipeline
2+
3+
on:
4+
push:
5+
branches: [ main, develop ]
6+
pull_request:
7+
branches: [ main, develop ]
8+
schedule:
9+
- cron: '30 2 * * 1' # Weekly scan on Monday at 02:30
10+
11+
permissions:
12+
contents: read
13+
security-events: write
14+
15+
jobs:
16+
# 1. SAST - Semgrep
17+
semgrep-sast:
18+
name: Semgrep SAST
19+
runs-on: ubuntu-latest
20+
if: (github.actor != 'dependabot[bot]')
21+
steps:
22+
- uses: actions/checkout@v4
23+
- name: Setup Python
24+
uses: actions/setup-python@v5
25+
with:
26+
python-version: '3.11'
27+
- name: Install Semgrep
28+
run: python3 -m pip install semgrep
29+
- name: Semgrep Scan
30+
run: |
31+
semgrep scan --sarif --output=semgrep.sarif --config p/security-audit --config p/secrets --config p/typescript --config p/rust --config .semgrep.yml || true
32+
- name: Upload SARIF file
33+
uses: github/codeql-action/upload-sarif@v3
34+
with:
35+
sarif_file: semgrep.sarif
36+
if: always()
37+
38+
# 2. Dependency Audit & Vulnerability Scanning
39+
dependency-scan:
40+
name: Vulnerability Scan (NPM & Trivy)
41+
runs-on: ubuntu-latest
42+
steps:
43+
- uses: actions/checkout@v4
44+
45+
- name: Setup Node.js
46+
uses: actions/setup-node@v4
47+
with:
48+
node-version: '20'
49+
cache: 'npm'
50+
51+
- name: Install dependencies
52+
run: npm ci
53+
54+
- name: NPM Audit
55+
run: npm audit --audit-level=high
56+
continue-on-error: true
57+
58+
- name: Trivy FS Scan (Filesystem)
59+
uses: aquasecurity/trivy-action@master
60+
with:
61+
scan-type: 'fs'
62+
ignore-unfixed: true
63+
format: 'table'
64+
severity: 'CRITICAL,HIGH'
65+
exit-code: '1' # Fail on high/critical vulnerabilities
66+
67+
# 3. Rust Security Audit
68+
rust-audit:
69+
name: Rust Audit
70+
runs-on: ubuntu-latest
71+
steps:
72+
- uses: actions/checkout@v4
73+
- name: Install cargo-audit
74+
run: cargo install cargo-audit
75+
- name: Run Audit
76+
run: |
77+
cd native
78+
cargo audit
79+
80+
# 4. Secret Scanning (Gitleaks)
81+
gitleaks:
82+
name: Secret Scanning
83+
runs-on: ubuntu-latest
84+
steps:
85+
- uses: actions/checkout@v4
86+
with:
87+
fetch-depth: 0
88+
- name: Gitleaks Scan
89+
uses: gitleaks/gitleaks-action@v2
90+
env:
91+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
92+
93+
# 5. DAST Baseline Scan (OWASP ZAP)
94+
dast-scan:
95+
name: OWASP ZAP DAST Scan
96+
runs-on: ubuntu-latest
97+
needs: [dependency-scan]
98+
steps:
99+
- uses: actions/checkout@v4
100+
101+
- name: Setup Node
102+
uses: actions/setup-node@v4
103+
with:
104+
node-version: '20'
105+
106+
- name: Install & Build Renderer
107+
run: |
108+
npm ci
109+
npm run build:renderer
110+
# Start a local server to serve the built renderer for DAST
111+
npx http-server dist/renderer -p 8080 &
112+
sleep 10 # Wait for server to start
113+
114+
- name: ZAP Baseline Scan
115+
uses: zaproxy/action-baseline@v0.12.0
116+
with:
117+
token: ${{ secrets.GITHUB_TOKEN }}
118+
docker_name: 'ghcr.io/zaproxy/zaproxy:stable'
119+
target: 'http://localhost:8080'
120+
fail_action: false

‎aegis-3.0/.gitignore‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
# Dependencies
2+
node_modules/
3+
.pnpm-store/
4+
5+
# Build outputs
6+
dist/
7+
release/
8+
*.node
9+
10+
# Native build
11+
native/target/
12+
13+
# IDE
14+
.idea/
15+
.vscode/
16+
*.swp
17+
*.swo
18+
19+
# Logs
20+
*.log
21+
npm-debug.log*
22+
23+
# OS files
24+
.DS_Store
25+
Thumbs.db
26+
27+
# Environment
28+
.env
29+
.env.local
30+
.env.*.local
31+
32+
# Test coverage
33+
coverage/
34+
35+
# Temporary files
36+
tmp/
37+
temp/
38+
*.tmp
39+
40+
# Electron cache
41+
.electron/
42+
43+
# Private licensing tools
44+
/tools/
45+
46+
# Debug and sensitive files
47+
*_debug.txt
48+
*_debug.log
49+
/aegis_main_debug.txt
50+
/aegis_bridge_debug.log
51+
52+
# Vault safety (in case they end up in root during dev)
53+
*.db
54+
*.hash
55+
*.recovery
56+
*.lockout
57+
*.attempts

‎aegis-3.0/.gitleaks.toml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
# Gitleaks configuration file
2+
# This file defines what to ignore during secret scanning
3+
4+
[allowlist]
5+
description = "Ignore false positives in Aegis Vault"
6+
paths = [
7+
'''src/main/resources/breach_db.json''', # Common passwords list for breach check
8+
'''tests/security/.*''', # Security tests with dummy data
9+
'''native/target/.*''', # Compiled Rust artifacts
10+
'''dist/.*''', # Compiled JS artifacts
11+
'''node_modules/.*''', # External dependencies
12+
'''browser-extension/dist/.*''', # Extension builds
13+
'''browser-extension-firefox/dist/.*''' # Extension builds (Firefox)
14+
]
15+
16+
# You can also ignore specific strings if they are caught frequently
17+
# stopwords = [
18+
# "AEGIS_E2EE_V1",
19+
# "aegis-sync-e2ee-v1"
20+
# ]

‎aegis-3.0/.semgrep.yml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
rules:
2+
- id: electron-node-integration
3+
pattern-either:
4+
- pattern: |
5+
new BrowserWindow({
6+
webPreferences: {
7+
nodeIntegration: true
8+
}
9+
})
10+
- pattern: |
11+
new BrowserWindow({
12+
webPreferences: {
13+
contextIsolation: false
14+
}
15+
})
16+
message: "Security Risk: Node Integration should be disabled and Context Isolation enabled."
17+
languages: [typescript, javascript]
18+
severity: ERROR
19+
20+
- id: insecure-pqc-usage
21+
patterns:
22+
- pattern: pqc_decrypt(...);
23+
- pattern-not: let $VAR = pqc_decrypt(...);
24+
- pattern-not-inside: match pqc_decrypt(...) { ... }
25+
- pattern-not-inside: if let ... = pqc_decrypt(...) { ... }
26+
message: "Ensure PQC decryption result is handled. Ignoring the Result can lead to security vulnerabilities or unhandled errors."
27+
languages: [rust]
28+
severity: WARNING

0 commit comments

Comments
 (0)