Laravel Supply-Chain Defense

```yaml policy_version: "1.0" allowlist_vendors: - laravel - illuminate - symfony - guzzlehttp - nesbot - doctrine - league - ramsey denylist_vendors: - malware-corp - suspicious-vendor thresholds: warn_score: 60 fail_score: 40 scoring: vendor: allowlist: 25 reputable: 15 unknown: 5 activity: active: 20 # < 1 year semi_active: 15 # < 3 years old: 10 # 3-5 years very_old: 5 # > 5 years unknown: 0 popularity: million: 15 hundred_k: 10 ten_k: 5 low: 0 tiny: -10 version: stable: 15 rc: 10 dev: 0 scripts: none: 15 benign: 10 risky: -15 additional: has_binaries: -10 ```

```python #!/usr/bin/env python3 import json import argparse import datetime import sys import yaml from pathlib import Path try: import requests except ImportError: requests = None def load_json(path: Path): with path.open("r", encoding="utf-8") as f: return json.load(f) def load_yaml(path: Path): with path.open("r", encoding="utf-8") as f: return yaml.safe_load(f) def parse_time(ts: str): try: return datetime.datetime.fromisoformat(ts.replace("Z", "+00:00")) except Exception: return None def classify_vendor(name, policy): vendor = name.split("/")[0] if vendor in policy["denylist_vendors"]: return "deny" if vendor in policy["allowlist_vendors"]: return "allow" return "unknown" def classify_popularity(downloads, scoring): if downloads is None: return "unknown" if downloads > 1_000_000: return "million" if downloads > 100_000: return "hundred_k" if downloads > 10_000: return "ten_k" if downloads > 1_000: return "low" return "tiny" def get_packagist_meta(pkg): if not requests: return None url = f"https://repo.packagist.org/p2/{pkg}.json" try: r = requests.get(url, timeout=5) if r.status_code != 200: return None data = r.json().get("packages", {}).get(pkg, []) if not data: return None latest = data[-1] return { "time": latest.get("time"), "downloads": latest.get("downloads", {}).get("total", None), } except Exception: return None def analyze_scripts(scripts): if not scripts: return "none" risky_keywords = ["exec", "system", "shell", "wget", "curl", "php ", "artisan "] benign = ["post-autoload-dump", "package:discover"] script_text = str(scripts) if any(kw in script_text for kw in risky_keywords): return "risky" if any(b in script_text.lower() for b in benign): return "benign" return "unclear" def detect_binaries(pkg_dir): suspicious_exts = (".phar", ".so", ".dll") if not pkg_dir.exists(): return False for file in pkg_dir.rglob("*"): if file.suffix.lower() in suspicious_exts: return True return False def compute_score(pkg, meta, scripts, policy, project_root): scoring = policy["scoring"] total = 0 reasons = [] name = pkg.get("name") version = pkg.get("version") vendor_class = classify_vendor(name, policy) # Vendor if vendor_class == "deny": return 0, ["Vendor in denylist"] if vendor_class == "allow": total += scoring["vendor"]["allowlist"] elif vendor_class == "unknown": total += scoring["vendor"]["unknown"] reasons.append("Unknown Vendor") else: total += scoring["vendor"]["reputable"] # Activity last = parse_time(pkg.get("time", "")) if not last and meta and meta.get("time"): last = parse_time(meta["time"]) if last: years = (datetime.datetime.now(datetime.timezone.utc) - last).days / 365 if years < 1: total += scoring["activity"]["active"] elif years < 3: total += scoring["activity"]["semi_active"] elif years < 5: total += scoring["activity"]["old"] else: total += scoring["activity"]["very_old"] reasons.append(f"Inactive for {years:.1f} years") else: total += scoring["activity"]["unknown"] reasons.append("No activity metadata") # Popularity pop = classify_popularity(meta.get("downloads") if meta else None, scoring) total += scoring["popularity"].get(pop, 0) if pop == "tiny": reasons.append("Very low popularity") # Version if version.startswith("dev-"): total += scoring["version"]["dev"] reasons.append("Dev version") elif "RC" in version or "beta" in version.lower(): total += scoring["version"]["rc"] reasons.append("Unstable version") else: total += scoring["version"]["stable"] # Scripts script_class = analyze_scripts(scripts) total += scoring["scripts"].get(script_class, 0) if script_class == "risky": reasons.append("Risky Composer scripts") # Binaries vendor, pkg_name = name.split("/") pkg_path = project_root / "vendor" / vendor / pkg_name if detect_binaries(pkg_path): total += scoring["additional"]["has_binaries"] reasons.append("Contains binaries (.so/.dll/.phar)") return max(0, min(100, total)), reasons def main(): parser = argparse.ArgumentParser() parser.add_argument("--composer-lock", default="composer.lock") parser.add_argument("--composer-json", default="composer.json") parser.add_argument("--policy", default="tools/supply_chain_policy.yaml") parser.add_argument("--json-output", default=None, help="Generate JSON report") args = parser.parse_args() lock = load_json(Path(args.composer_lock)) composer = load_json(Path(args.composer_json)) policy = load_yaml(Path(args.policy)) packages = lock.get("packages", []) + lock.get("packages-dev", []) project_root = Path(".").resolve() warn_score = policy["thresholds"]["warn_score"] fail_score = policy["thresholds"]["fail_score"] print("🔒 LiveySupplyChain Defense Scanner 2.0\n") bad = [] report_data = { "generated_at": datetime.datetime.now(datetime.timezone.utc).isoformat(), "warn_threshold": warn_score, "fail_threshold": fail_score, "packages": [] } for pkg in packages: name = pkg["name"] scripts = composer.get("scripts", ) meta = get_packagist_meta(name) score, reasons = compute_score(pkg, meta, scripts, policy, project_root) status = "OK" if score < fail_score: status = "FAIL" elif score < warn_score: status = "WARN" print(f"📦 {name} | v{pkg.get('version')} | Score: {score}/100 [{status}]") if reasons: for r in reasons: print(f" - {r}") print("") if status != "OK": bad.append((name, score, status)) report_data["packages"].append({ "name": name, "version": pkg.get("version"), "score": score, "status": status, "reasons": reasons }) if args.json_output: with open(args.json_output, "w", encoding="utf-8") as f: json.dump(report_data, f, indent=2) print(f"📄 JSON report generated: {args.json_output}") if any(x[2] == "FAIL" for x in bad): print("❌ BLOCKED: packages below fail threshold.") sys.exit(1) if any(x[2] == "WARN" for x in bad): print("⚠️ WARNINGS present. Review required.") print("✅ Supply Chain Scan completed.") sys.exit(0) if __name__ == "__main__": main() ```

```yaml name: Laravel Supply-Chain Defense on: [pull_request, push] jobs: supply-chain-defense: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: shivammathur/setup-php@v2 with: { php-version: '8.3' } - name: Validate Structure run: composer validate --strict - name: Install Dependencies run: composer install --no-interaction --no-scripts --no-progress - name: Native Audit run: composer audit || echo "Composer audit found issues" - name: Setup Scanner uses: actions/setup-python@v5 with: { python-version: '3.12' } - run: pip install requests pyyaml - name: Run LiveyScore™ Scanner run: python tools/livey_supply_chain_scan.py --policy tools/supply_chain_policy.yaml --json-output reports/livey_supply_report.json - name: Upload Report if: always() uses: actions/upload-artifact@v4 with: name: supply-chain-report path: reports/livey_supply_report.json ```

```xml ```