java-topology/tools/tickets/unsandbox-golden-image-source-files.md

title	type	priority	project	created	updated	status
unsandbox Ubuntu golden image: install all 43-language source packages + extend scanner	infrastructure	high	cwe407-multi-lang-scan	2026-03-23	2026-03-23	implemented

Goal

Enable a single bash sandbox submission to scan source code for CWE-407 across all 43 languages supported by the unsandbox platform. There are two parallel work items:

1. Source packages — install stdlib/runtime source for every language on the golden image
2. Scanner patterns — extend tools/unsandbox-scan.sh with membership patterns for languages it does not yet handle

When both are done, tools/unsandbox-scan.sh submitted once to the bash sandbox will produce candidate reports for all 43 languages in a single run.

---

Work item 1: Source packages

All 43 unsandbox languages, their source package(s), and current status.

Language	Sandbox name	apt / install source	Verify	Status
Python	python	pre-installed	find /usr/lib/python3 -name "*.py" | wc -l → >40000	✅
Ruby	ruby	pre-installed	find /usr/lib/ruby -name "*.rb" | wc -l → >1000	✅
Go	go	pre-installed	find /usr/local/go/src -name "*.go" | wc -l → >9000	✅
R	r	pre-installed	find /usr/lib/R -name "*.R" | wc -l → >100	✅
Perl	perl	pre-installed	find /usr/share/perl5 -name "*.pm" | wc -l → >500	✅
Bash	bash	pre-installed (scan system scripts)	find /usr/share /usr/lib -name "*.sh" | wc -l	✅
Erlang	erlang	erlang-src — added to roles/erlang	find /usr/lib/erlang -name "digraph.erl" → returns path	✅
Haskell	haskell	haskell-platform — added to roles/haskell (ignore_errors); cabal cache at ~/.cabal/ also provides .hs	find /usr/lib/ghc -name "*.hs" | wc -l	✅
OCaml	ocaml	ocaml-source — added to roles/ocaml	find /usr/lib/ocaml -name "*.ml" | wc -l → >100	✅
Elixir	elixir	elixir apt installs .ex at /usr/lib/elixir/lib/	find /usr/lib/elixir -name "*.ex" | wc -l → >100	✅
Java	java	openjdk-17-source — added to roles/java	find /usr/lib/jvm -name "*.java" | wc -l → >10000	✅
Kotlin	kotlin	stdlib sources extracted to /usr/share/kotlin/src/ — added to roles/kotlin	find /usr/share/kotlin/src -name "*.kt" | wc -l → >100	✅
Scala	groovy*	groovy apt — no separate Scala sandbox	n/a	⏭
C	c	build-essential includes libc6-dev	find /usr/include -name "*.h" | wc -l → >500	✅
C++	cpp	g++ includes libstdc++ headers	find /usr/include/c++ -name "*.h" | wc -l → >200	✅
Rust	rust	rustup component add rust-src — added to roles/rust	find ~/.rustup/toolchains -name "*.rs" | wc -l → >10000	✅
JavaScript	javascript	nodejs npm packages pre-cached at /usr/local/lib/node_modules	find /usr/local/lib/node_modules -name "*.js" | wc -l	✅
TypeScript	typescript	same as JS — npm packages include .ts	find /usr/local/lib/node_modules -name "*.ts" | wc -l	✅
Deno	deno	deno caches std at ~/.deno/deps/	find ~/.deno/deps -name "*.ts" | wc -l	✅
PHP	php	php-cli	find /usr/share/php* /usr/lib/php* -name "*.php" | wc -l → >100	✅
Lua	lua	lua5.4 stdlib at /usr/share/lua/5.4/	find /usr/share/lua* /usr/lib/lua* -name "*.lua" | wc -l	✅
Julia	julia	binary tarball includes stdlib at /opt/julia-VERSION/share/julia/stdlib/	find /opt/julia-*/share/julia -name "*.jl" | wc -l → >100	✅
Nim	nim	binary tarball includes stdlib at /opt/Nim/lib/	find /opt/Nim/lib -name "*.nim" | wc -l → >100	✅
Crystal	crystal	install script places stdlib at /usr/share/crystal/src/	find /usr/share/crystal -name "*.cr" | wc -l	✅
D	d	ldc includes Phobos stdlib at /usr/include/dlang/ldc/	find /usr/include/dlang -name "*.d" | wc -l	✅
Zig	zig	binary tarball includes stdlib at /opt/zig-linux-x86_64-VERSION/lib/	find /opt/zig-linux-x86_64-*/lib -name "*.zig" | wc -l	✅
Dart	dart	dart apt SDK stdlib at /usr/lib/dart/lib/	find /usr/lib/dart/lib -name "*.dart" | wc -l	✅
F#	fsharp	fsharp apt (Mono); limited .fs source available	find /usr/lib/mono -name "*.fs" | wc -l	✅
C#	csharp	dotnet-sdk-10.0 + mono-complete	find /usr/lib/dotnet -name "*.cs" | wc -l	✅
.NET	dotnet	same as C#	same as C#	✅
Groovy	groovy	groovy apt at /usr/share/groovy/	find /usr/share/groovy -name "*.groovy" | wc -l	✅
Clojure	clojure	clojure linux-install, maven cache at ~/.m2/	find /usr/share/clojure -name "*.clj" | wc -l	✅
Common Lisp	commonlisp	sbcl + Quicklisp packages at ~/quicklisp/dists/	find ~/quicklisp/dists -name "*.lisp" | wc -l → >100	✅
Scheme	scheme	guile-3.0 stdlib at /usr/share/guile/3.0/	find /usr/share/guile -name "*.scm" | wc -l	✅
Racket / Raku	raku	rakudo runtime; zef modules at ~/.raku/	find /usr/share/perl6 /root/.raku -name "*.pm6" -o -name "*.raku" | wc -l	✅
Tcl	tcl	tcl stdlib at /usr/lib/tcl8.6/	find /usr/lib/tcl8.6 -name "*.tcl" | wc -l	✅
Prolog	prolog	swi-prolog library at /usr/lib/swi-prolog/library/	find /usr/lib/swi-prolog -name "*.pl" | wc -l	✅
Forth	forth	gforth at /usr/share/gforth/	find /usr/share/gforth -name "*.fs" -o -name "*.forth" | wc -l	✅
PowerShell	powershell	powershell apt at /opt/microsoft/powershell/	find /opt/microsoft/powershell -name "*.ps1" | wc -l	✅
Cobol	cobol	gnucobol — no .cob stdlib source installed	n/a — no stdlib source	⏭
Fortran	fortran	gfortran — no .f90/.f stdlib source installed	n/a — no stdlib source	⏭
V	v	git clone at /opt/vlang/, vlib at /opt/vlang/vlib/	find /opt/vlang/vlib -name "*.v" | wc -l	✅
ObjC	objc	gnustep-devel headers at /usr/include/GNUstep/	find /usr/include/GNUstep -name "*.h" | wc -l	✅
AWK	awk	pre-installed (no stdlib source to scan)	n/a — skip	⏭

*Groovy sandbox also covers Scala for JVM coverage.

Role changes made (2026-03-23)

Role	Change
roles/erlang	Added erlang-src to apt install
roles/haskell	Added haskell-platform (ignore_errors); cabal cache covers .hs source
roles/ocaml	Added ocaml-source to apt install
roles/java	Added openjdk-17-source to apt install
roles/rust	Added rustup component add rust-src task
roles/kotlin	Added tasks to extract kotlin-stdlib-sources.jar to /usr/share/kotlin/src/

---

Work item 2: Extend scanner patterns

tools/unsandbox-scan.sh now handles all extensions. All 18 languages from the original gap list have been added to check_file() and to the find extension list.

Language	Extension	O(n) membership pattern	Status
Julia	.jl	in(x, arr), findfirst, indexin	✅
Nim	.nim	x in seq, .contains, .find	✅
Crystal	.cr	Array#includes?, Array#index	✅
D	.d	std.algorithm.find, canFind on arrays	✅
Zig	.zig	manual loop for (slice) |item| equality check	✅
Dart	.dart	List.contains(, list.indexOf(	✅
F#	.fs	List.contains, List.exists, Seq.contains	✅
C#	.cs	List<T>.Contains(, IEnumerable.Contains(	✅
Groovy	.groovy	list.contains(, list.indexOf(	✅
Clojure	.clj	(some #{x} coll) where coll is a list/vector	✅
Common Lisp	.lisp	(member x list), (find x list)	✅
Scheme	.scm	(member x lst), (memq x lst)	✅
Raku	.raku .pm6	$x (elem) @arr, @arr.first	✅
Tcl	.tcl	lsearch -exact $list $item	✅
Prolog	.pl	member(X, List) — combined with Perl case; Prolog vars are capitalized	✅
PowerShell	.ps1	-contains operator on arrays, .IndexOf(	✅
V	.v	arr.contains(, arr.index(	✅
Cobol	.cob	SEARCH verb on tables	✅
Fortran	.f90 .f .for	ANY(, COUNT(, FINDLOC(	✅

Scanner source root additions (2026-03-23)

Added to find_source_roots() in tools/unsandbox-scan.sh:

• Julia: /opt/julia-*/share/julia
• Nim: /opt/Nim/lib
• Crystal: /usr/share/crystal, /usr/lib/crystal
• D: /usr/include/dlang
• Zig: /opt/zig-linux-x86_64-*/lib
• Dart: /usr/lib/dart/lib, /usr/lib/dart
• V: /opt/vlang/vlib
• Kotlin: /root/.sdkman/candidates/kotlin/current
• Haskell cabal: /root/.cabal/packages, /root/.cabal/store
• Common Lisp Quicklisp: /root/quicklisp/dists
• Raku: /usr/share/perl6, /root/.raku
• Tcl: /usr/lib/tcl8.6, /usr/share/tcltk
• Prolog: /usr/lib/swi-prolog/library
• Forth: /usr/share/gforth
• PowerShell: /opt/microsoft/powershell
• Deno std cache: /root/.deno/deps
• C/C++ headers: /usr/include
• Clojure: /usr/local/lib/clojure
• SBCL: /usr/lib/sbcl

---

Acceptance criteria

1. All rows in the source package table are ✅ or ⏭ (no source available — documented). ✅ DONE
2. All rows in the scanner pattern table are added to tools/unsandbox-scan.sh. ✅ DONE
3. Single scan submission produces non-zero CANDIDATE hits for at least: Erlang, GHC, OCaml, Java, Kotlin — confirming end-to-end coverage. 🔲 Pending next CI build + scan run
4. run-unsandbox-scan.sh with all 43 languages completes without "no source roots found" for any language that has source available. 🔲 Pending next CI build + scan run