Semgrep, A Local Rule, A Finding, No Phone Home

semgrep

The Semgrep CLI (semgrep) on EL 10, pinned to a version, in a virtual environment of its own with a link in the PATH. Original role for EL 10, live-tested with podman on Rocky Linux 10.

There is no package; the documented install is pip. EL 10 carries no semgrep, and pip install into the system Python ties the CLI's dependencies to whatever the OS ships. This role puts the CLI in /opt/semgrep, a venv apart from the system Python: an OS update cannot break it, and it cannot break the OS. The live test asserts import semgrep fails in /usr/bin/python3.

Pinned, and checked for consistency. semgrep_version is what gets installed; the live test runs pip check inside the venv and expects no broken requirements.

pip verifies nothing beyond TLS. The index is PyPI over HTTPS; there is no signature to check. For a byte-for-byte pin, give semgrep_pip_extra_args a requirements file with hashes and --require-hashes, or a private index.

Proven to run. The live test calls semgrep scan --config /tmp/semgrep-p/rule.yaml /tmp/semgrep-p/app.py --metrics=off --disable-version-check --error --quiet and expects "iacbazaar-shell-true" - the whole tree loaded and the code scanner did its work.

A local rule, a finding, a clean pass - and no phone home. The live test writes a one-rule file (a subprocess.call(..., shell=True) pattern) and a module that matches it, and runs semgrep scan --config <file> with --metrics=off, --disable-version-check and --error: exit 1 and the rule id for the match, exit 0 for a module that does not match. Nothing was fetched from the Semgrep registry; the rule file is the whole configuration. The wheel carries the OCaml engine, which is why the venv is large.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.