cdklabs/cdk-ecr-deployment

Review signals: 1 connection review, 20 known vulnerability, 1 sensitive read. 21 static matches retained as context.

Reviewed as expected for a test run: attempted writes that failed, so nothing was written.

Repository processes attempted these non-loopback connections; proxies can hide the final hostname. 47 distinct locations. 5 attributed processes.

OSV reports a known vulnerability in this dependency version. 6 distinct locations. 20 findings.

A repository process attempted to read this sensitive path. Kind of file: saved web login. 2 attributed processes.

21 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• The README's documented cdk synth command renders an ECR deployment custom resource for the S3 archive example: Real input produced the expected result: Custom::CDKECRDeployment

  Source: Then synth or deploy any example:

  Input: npx cdk synth --app "npx ts-node examples/s3-archive.ts"

  Expected: CloudFormation template containing Custom::CDKECRDeployment

  Command: npx cdk synth --app 'npx ts-node examples/s3-archive.ts'

  Observed: …Custom::CDKECRDeployment Properties: ServiceToken: Fn::GetAtt: - CustomCDKECRDeploymentbd07c930edb94112a20f03f096f53666512MiB28EAD8E4 - Arn SrcImage: s3://my-bucket/nginx.tar:nginx:latest DestImage: Fn::Join: - "" - - docker:// - Fn::Select: - 4 - Fn::Split: - ":" - Fn::GetAtt: - TargetRepo95363C3C - Arn - .dkr.ecr. - Fn::Select: - 3

• The library supports copying an archive tarball image from S3 to ECR, shown by the s3-archive example synthesizing a deployment resource: Real input produced the expected result: Custom::CDKECRDeployment

  Source: Copy an archive tarball image from s3 to ECR/external registry

  Input: npx cdk synth --app "npx ts-node examples/s3-archive.ts"

  Expected: CloudFormation template containing Custom::CDKECRDeployment

  Command: npx cdk synth --app 'npx ts-node examples/s3-archive.ts'

  Observed: …Custom::CDKECRDeployment Properties: ServiceToken: Fn::GetAtt: - CustomCDKECRDeploymentbd07c930edb94112a20f03f096f53666512MiB28EAD8E4 - Arn SrcImage: s3://my-bucket/nginx.tar:nginx:latest DestImage: Fn::Join: - "" - - docker:// - Fn::Select: - 4 - Fn::Split: - ":" - Fn::GetAtt: - TargetRepo95363C3C - Arn - .dkr.ecr. - Fn::Select: - 3

Examples

• Synthesize the documented s3-archive example app with the README synth command: command completed successfully

  Source: README.md / examples/README.md (Running)

  Input: examples/s3-archive.ts

  Expected: CloudFormation template containing Custom::CDKECRDeployment

  Command: npx cdk synth --app 'npx ts-node examples/s3-archive.ts'

  Observed: - us-east-1 - Fn::Equals: - Ref: AWS::Region - us-east-2 - Fn::Equals: - Ref: AWS::Region - us-west-1 - Fn::Equals: - Ref: AWS::Region - us-west-2 Parameters: BootstrapVersion: Type: AWS::SSM::Parameter::Value<String> Default: /cdk-bootstrap/hnb659fds/version Description: Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip] 81 feature flags are not configured. Run 'cdk flags --unstable=flags' to learn more.

• Synthesize the documented specific-architecture example app: command completed successfully

  Source: examples/README.md (Running)

  Input: examples/specific-architecture.ts

  Expected: CloudFormation template containing Custom::CDKECRDeployment

  Command: npx cdk synth --app 'npx ts-node examples/specific-architecture.ts'

  Observed: - us-east-1 - Fn::Equals: - Ref: AWS::Region - us-east-2 - Fn::Equals: - Ref: AWS::Region - us-west-1 - Fn::Equals: - Ref: AWS::Region - us-west-2 Parameters: BootstrapVersion: Type: AWS::SSM::Parameter::Value<String> Default: /cdk-bootstrap/hnb659fds/version Description: Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip] 81 feature flags are not configured. Run 'cdk flags --unstable=flags' to learn more.

Local or hosted: local

Install dependencies and build cdk-ecr-deployment with yarn, then synthesize the S3-archive example via the README's cdk synth command

cd <guest-path> && ls -la && cat README.md | head -c 6000 && python3 --version && node --version 2>/dev/null; npm --version 2>/dev/null; echo done
cd <guest-path> && ls -la .coldpass && cat .yarnrc.yml && grep -n '"packageManager"\|"engines"' -A3 package.json; cat build-lambda.sh; ls lambda-bin lambda-src rosetta examples | head -50; which go yarn corepack; ls /inputs 2>/dev/null
cd <guest-path> && go version && grep '^go ' lambda-src/go.mod; (sudo -n corepack enable 2>&1 || corepack enable 2>&1); yarn --version 2>&1 | tail -2; echo rc=$?
cd <guest-path> && yarn install --immutable 2>&1 | tail -30; echo rc=${PIPESTATUS[0]}
cd <guest-path> && timeout 900 yarn build > /tmp/build.log 2>&1; echo rc=$?; tail -c 3000 /tmp/build.log
cd /tmp && curl -fsSL -o /tmp/go-dl.json "https://go.dev/dl/?mode=json" ; echo rc=$?; head -c 300 /tmp/go-dl.json; echo; grep -o '"version":"go1.26[^"]*"' /tmp/go-dl.json | head -3
cd /tmp && grep -o '"version": "go1.26[^"]*"' /tmp/go-dl.json | sort -u; grep -o '"filename": "go1.26[^"]*linux-amd64.tar.gz"' /tmp/go-dl.json | sort -u | head
cd /tmp && curl -fsSL -o /tmp/go1.26.10.linux-amd64.tar.gz https://go.dev/dl/go1.26.10.linux-amd64.tar.gz && sudo -n rm -rf /usr/local/go126 && sudo -n mkdir -p /usr/local/go126 && sudo -n tar -C /usr/local/go126 -xzf /tmp/go1.26.10.linux-amd64.tar.gz && /usr/local/go126/go/bin/go version; echo rc=$?
cd <guest-path> && export PATH=/usr/local/go126/go/bin:$PATH && go version && timeout 1500 yarn build > /tmp/build.log 2>&1; echo rc=$?; tail -c 2500 /tmp/build.log
cd <guest-path> && free -m | head -2; ls -la lambda-bin; ls node_modules/.bin | grep -E '^(cdk|ts-node)$'; ls lib 2>/dev/null | head; grep -n 'integ\|"build"' .projenrc.ts | head; cat examples/README.md | head -c 1500
cd <guest-path> && export PATH=/usr/local/go126/go/bin:$PATH && timeout 900 npx cdk synth --app "npx ts-node examples/s3-archive.ts" > /tmp/synth-s3.log 2>&1; echo rc=$?; tail -c 2500 /tmp/synth-s3.log; which docker
cd <guest-path> && timeout 900 npx cdk synth --app "npx ts-node examples/s3-archive.ts" 2>/dev/null > /tmp/s3-template.yaml; echo rc=$?; grep -n 'Type: Custom::\|Type: AWS::Lambda::Function\|SrcImageName\|DestImageName\|archive\|Type: AWS::IAM' /tmp/s3-template.yaml | head -20; grep -c . /tmp/s3-template.yaml
mkdir -p <guest-path> && cd <guest-path> && cat > probe.json <<'EOF'
{"kind":"cli","argv":["npx","cdk","synth","--app","npx ts-node examples/s3-archive.ts"],"cwd":"<guest-path>","env":{},"expected_text":"Custom::CDKECRDeployment"}
EOF
cat > claims.json <<'EOF'
[{"kind":"claim","claim":"The README's documented cdk synth command renders an ECR deployment custom resource for the S3 archive example","source":"Then synth or deploy any example:","input":"npx cdk synth --app \"npx ts-node examples/s3-archive.ts\"","expected":"CloudFormation template containing Custom::CDKECRDeployment","probe_kind":"cli","argv":["npx","cdk","synth","--app","npx ts-node examples/s3-archive.ts"],"expected_text":"Custom::CDKECRDeployment","cwd":"<guest-path>","env":{}},
{"kind":"claim","claim":"The library supports copying an archive tarball image from S3 to ECR, shown by the s3-archive example synthesizing a deployment resource","source":"Copy an archive tarball image from s3 to ECR/external registry","input":"npx cdk synth --app \"npx ts-node examples/s3-archive.ts\"","expected":"CloudFormation template containing Custom::CDKECRDeployment","probe_kind":"cli","argv":["npx","cdk","synth","--app","npx ts-node examples/s3-archive.ts"],"expected_text":"Custom::CDKECRDeployment","cwd":"<guest-path>","env":{}}]
EOF
python3 -m json.tool probe.json >/dev/null && python3 -m json.tool claims.json >/dev/null && echo ok; cd <guest-path> && python3 -c "import json;print(json.load(open('package.json'))['scripts'].get('test'))"
cd <guest-path> && cat > examples.json <<'EOF'
[{"kind":"example","claim":"Synthesize the documented s3-archive example app with the README synth command","source":"README.md / examples/README.md (Running)","input":"examples/s3-archive.ts","expected":"CloudFormation template containing Custom::CDKECRDeployment","argv":["npx","cdk","synth","--app","npx ts-node examples/s3-archive.ts"],"cwd":"<guest-path>","env":{},"expected_text":"Custom::CDKECRDeployment"},
{"kind":"example","claim":"Synthesize the documented specific-architecture example app","source":"examples/README.md (Running)","input":"examples/specific-architecture.ts","expected":"CloudFormation template containing Custom::CDKECRDeployment","argv":["npx","cdk","synth","--app","npx ts-node examples/specific-architecture.ts"],"cwd":"<guest-path>","env":{},"expected_text":"Custom::CDKECRDeployment"}]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"checks":[],"reason":"Inspected README.md and examples/README.md: cdk-ecr-deployment is a CDK construct library with no cron, loop, webhook, --once or --now scheduler; the only runnable flows are one-shot cdk synth/deploy commands."}
EOF
python3 -m json.tool examples.json >/dev/null && python3 -m json.tool cycles.json >/dev/null && echo ok && cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay > /tmp/check1.log 2>&1; echo rc=$?; tail -c 4000 /tmp/check1.log
cd /tmp && python3 -c "
import re,sys
t=open('/tmp/check1.log').read()
print(len(t))
for k in ['valid','\"ok\"','errors','error','verdict']:
    for m in re.finditer(k,t):
        print(k, '->', t[max(0,m.start()-120):m.start()+160].replace('\n',' '))
        break
print(t[:1500])
"
cd <guest-path> && cat > report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Install dependencies and build cdk-ecr-deployment with yarn, then synthesize the S3-archive example via the README's cdk synth command","operation_scope":"Linux x86_64 guest, Node v22.23.4, yarn 4.13.0 via corepack, Python 3.12.3, Go 1.26.10 (go.mod requires go 1.26). No Docker, no AWS credentials; synth only, no deploy.","steps":["corepack enable (yarn 4.13.0)","yarn install --immutable","yarn build (after installing Go 1.26.10 from go.dev to /usr/local/go126 and prepending it to PATH)","npx cdk synth --app \"npx ts-node examples/s3-archive.ts\""],"deviations":["Default Go 1.22.2 in guest could not build lambda-src (go.mod requires 1.26; auto toolchain download unavailable). Installed go1.26.10 from https://go.dev/dl/go1.26.10.linux-amd64.tar.gz and reran yarn build.","yarn build: compile, unit tests (10/10 passed), lambda bootstrap build and docgen succeeded. The integ-runner step failed for integ.multi-arch-index with 'Subprocess exited with error 137 (Killed)', likely out-of-memory on this 3.9 GB guest; the other three integ tests were UNCHANGED.","docker-image-asset.ts example not run: Docker is not installed in the guest (DockerImageAsset needs it). Used s3-archive.ts and specific-architecture.ts instead for synth.","Synth does not contact AWS for the s3-archive example beyond the default bootstrap-version lookup; deploy was not attempted.","cdk.out was created in the workspace by cdk synth."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"Lower-memory guests may need more RAM or a serial integ run for integ.multi-arch-index; the README should note the required Go version (1.26) for the lambda build."}
EOF
python3 -m json.tool report.json >/dev/null && echo ok && cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | head -c 300