Codeql not recognising IAC code

[akhiloscar]

What happened?

I tried to initialise database for an iac code but it is not recognising the files eventhough there are .tf files within the directory

Version

0.1.0

Relevant log output

oscar@DESKTOP:~/test3$ gh codeql database create testdb12 --language=iac --source-root=/home/oscar/test3/
Initializing database at /home/oscar/test3/testdb12.
Running build command: []
Finalizing database at /home/oscar/test3/testdb12.
CodeQL did not detect any code written in languages supported by CodeQL. This can occur if the specified build commands failed to compile or process any code.
 - Confirm that there is some source code for the specified language in the project.
 - For codebases written in Go, JavaScript, TypeScript, and Python, do not specify
   an explicit --command.
 - For other languages, the --command must specify a "clean" build which compiles
   all the source code files without reusing existing build artefacts.

[GeekMasher]

@akhiloscar To be able to use the CodeQL IaC Extractor, you will need to download the release archive, unzip it, and either do the following:

• Install in the same place as CodeQL
  • Run gh codeql version --format json and find the unpackedLocation
• Install it anywhere on the system and use --search-path with every command

# same place
gh codeql resolve languages
# different place
gh codeql resolve languages --search-path ~/path/to/unzipped/archive

You should see iac in the list.

I might need to write up better docs on this subject.

[akhiloscar]

@GeekMasher , iac is showing up while resolving language

[akhiloscar]

@GeekMasher , If possible can you share the repo for advanced-security/iac-queries

[GeekMasher]

They are CodeQL Packs (they are public)

https://github.com/orgs/advanced-security/packages?repo_name=codeql-extractor-iac

You can install them using the following:

gh codeql pack download advanced-security/iac-queries

[akhiloscar]

Thanks @GeekMasher , but getting cert error when downloading it

[GeekMasher]

Oh very interesting. That might be an issue with the GITHUB_TOKEN or GH_TOKEN being passed to CodeQL via the gh-cli.

You might have to login to github.com using gh auth login.

[akhiloscar]

@GeekMasher , Tried re-authenticating but facing the same error

[GeekMasher]

@akhiloscar Even more interesting. If you are using a Proxy, you might need to add your CA to the CodeQL's Java certificate store.

If this fails, try cloning the repository and running the following:

gh codeql pack install ./ql/src

This will install the pack manually from the source code (will compile so might take 1-2mins).

You might need to checkout a particular tag as I seem to have broken main in the latest commit 🤔

[akhiloscar]

@GeekMasher , Installed advanced queries/iac using "gh codeql pack install ./ql/src" but it seems like missing linux64/extractor directory when tried to initialise database

root@test-linux-01-IAC-POC:/home/adminuser/iac-codeql# gh codeql database create db1 --language=iac --source-root=/home/adminuser/iac-codeql

Initializing database at /home/adminuser/iac-codeql/db1.
Running build command: []
[2024-03-24 07:18:59] [build-stderr] /root/.local/share/gh/extensions/gh-codeql/dist/release/v2.16.5/codeql-extractor-iac/tools/autobuild.sh: 3: exec: /root/.local/share/gh/extensions/gh-codeql/dist/release/v2.16.5/codeql-extractor-iac/tools/linux64/extractor: not found
[2024-03-24 07:18:59] [ERROR] Spawned process exited abnormally (code 127; tried to run: [/root/.local/share/gh/extensions/gh-codeql/dist/release/v2.16.5/codeql-extractor-iac/tools/autobuild.sh])
A fatal error occurred: Exit status 127 from command: [/root/.local/share/gh/extensions/gh-codeql/dist/release/v2.16.5/codeql-extractor-iac/tools/autobuild.sh]

root@test-linux-01-IAC-POC:/home/adminuser/iac-codeql# cd /root/.local/share/gh/extensions/gh-codeql/dist/release/v2.16.5/codeql-extractor-iac/tools/

root@test-linux-01-IAC-POC:~/.local/share/gh/extensions/gh-codeql/dist/release/v2.16.5/codeql-extractor-iac/tools# ls
autobuild.cmd autobuild.sh index-files.cmd index-files.sh pre-finalize.cmd pre-finalize.sh qltest.cmd qltest.sh

[GeekMasher]

@akhiloscar Sorry for the delay. I found out what the issue is.

When scanning configuration files, the extractor expects at least 1 HCL file (this is the main language supported). You can fix this but running a touch random.tf file before running the extractor but I plan on fixing this. I'll be raising an issue and trying to fix this tomorrow.

[leonsparrowJM]

Is this why IaC is getting no hits when ran though a workflow? Because the iac-querys are returning a 404?
As in the CLI step for installing IaC-querys on this page: https://github.com/advanced-security/codeql-extractor-iac/blob/main/docs/workflows.md does not work.