rage.fail

gcp-ar-build-depends-package-repo

explicit gcp emits ContainsResourceReference

match (record)

{ "field": "steps[].args | substitutions | artifacts | source", "resource_type": "google.cloudbuild.Build" }

where

build step or artifact reference resolves to an Artifact Registry package repository URL (e.g. https://<region>-python.pkg.dev/<project>/<repo>) repo format is in [MAVEN, NPM, PYTHON, APT, YUM, GENERIC, GO, RUST, CONDA, GOOGET]

emit

source type	`BuildWorker`
target type	`ArtifactRepository`
source	`<Cloud Build worker / build job node>`
target	`<ArtifactRepository node>`

Narrative

Cloud Build job {build.name} fetches packages from Artifact Registry repository {repo.name} at build time; a principal who can push a higher-version or same-version malicious package to {repo.name} poisons this build's output and the build worker's subsequent actions.

Raw rule rules/explicit/gcp-artifactregistry.yaml

id: gcp-ar-build-depends-package-repo
emits: ContainsResourceReference
applies_to:
- gcp
match_record:
  resource_type: google.cloudbuild.Build
  field: steps[].args | substitutions | artifacts | source
where:
- build step or artifact reference resolves to an Artifact Registry package repository URL (e.g. https://<region>-python.pkg.dev/<project>/<repo>)
- repo format is in [MAVEN, NPM, PYTHON, APT, YUM, GENERIC, GO, RUST, CONDA, GOOGET]
emit:
  source_type: BuildWorker
  target_type: ArtifactRepository
  source: <Cloud Build worker / build job node>
  target: <ArtifactRepository node>
  api_source: cloudbuild.projects.builds.list + build step args / substitutions
  evidence_field: step args or .npmrc / pip.conf reference URL
  properties:
    reference_kind: runs_image
    image_mutable: 'true'
  narrative: Cloud Build job {build.name} fetches packages from Artifact Registry repository {repo.name}
    at build time; a principal who can push a higher-version or same-version malicious package to {repo.name}
    poisons this build's output and the build worker's subsequent actions.