46 lines
2.4 KiB
Markdown
46 lines
2.4 KiB
Markdown
# PHPGuard 1.2 — Phase 3
|
|
|
|
Native macOS SwiftUI PHP inventory and CVE research tool.
|
|
|
|
## Included
|
|
- Phase 2 SSH inventory, APT update listing, Docker PHP inventory, JSON reports.
|
|
- Phase 3 **CVE research** screen using the public NVD 2.0 API, with published dates, descriptions, and CVSS metadata.
|
|
- NVD records are keyword-search **candidates only**, NOT confirmed vulnerabilities on your servers.
|
|
- No Ubuntu package revision/backport matching is performed; no server is marked secure.
|
|
- `Scripts/build.sh` for unsigned local Debug builds and optional launch.
|
|
- `Scripts/release.sh` for Release build, Developer ID signing, DMG, notarization and stapling.
|
|
|
|
## Build
|
|
```bash
|
|
./Scripts/build.sh
|
|
LAUNCH_AFTER_BUILD=0 CONFIGURATION=Release ./Scripts/build.sh
|
|
```
|
|
|
|
## Release
|
|
Configure a notarytool keychain profile on your Mac, then run:
|
|
```bash
|
|
NOTARY_PROFILE=your-profile ./Scripts/release.sh
|
|
```
|
|
The script auto-detects a Developer ID Application identity, or use `SIGNING_IDENTITY`.
|
|
Release artifacts go to `dist/`. No automatic upload or publication.
|
|
|
|
## Security
|
|
SSH requires existing known_hosts entries and key-based authentication. Scans are read-only. NVD results are for research, not a substitute for vendor-specific package advisories.
|
|
|
|
## Known limitations
|
|
Not built/tested with Xcode in this environment. CVE discovery is broad keyword search and may include unrelated products or omit relevant vulnerabilities. NVD may rate-limit requests. Automatic backport assessment is a future phase.
|
|
|
|
|
|
## Version 1.4 security investigation
|
|
The SSH audit collects at most 40 recently modified PHP paths from `/var/www` and up to 30 matching Nginx error lines when accessible. It never modifies remote files. Access may be limited by permissions. The scan is not a compromise determination.
|
|
|
|
## Branding
|
|
The app icon is compiled from `PHPGuard/Assets.xcassets/AppIcon.appiconset`. The DMG includes a branded image at `.background/PHPGuard-Installer.png`; this is an included asset, not a custom Finder DMG window background layout.
|
|
|
|
## Phase 1.5
|
|
Import JSON scans using the dashboard button. Re-scan servers to collect structured Docker evidence. A missing PHP binary inside a container is not a vulnerability. Package version comparisons do not verify vendor CVE fixes.
|
|
|
|
|
|
## 1.7 security triage
|
|
New scans include securityTriage and dockerCoverage fields in exported JSON. These are advisory inventory notes, not CVE confirmation.
|