# Technical documentation — codescanner

Evidence date: 2026-10-18. Revision: `master` `dc201f67859ee649a7f033194f116479c99aad00` (2021-07-14 14:08:34 +0200).

Remote: `git@bitbucket.org:overdrive/codescanner.git`. Only branch: `master`.

The scan-host path from the onboarding issue was not on this machine. This note is from a clone of that tip. Credential values and the private key body are omitted on purpose.

## Architecture

There is no application server, framework, or database in this repository. The moving parts are Windows batch launchers, a partial SonarScanner tree, two AWS CLI one-liners, and a text runbook.

```text
Operator PC
  snippets.txt
  sonar-scanner.bat  (copied into a target code root)
       SONAR_SCANNER_HOME = C:\sonar-scanner
       JAVA_HOME          = C:\sonar-scanner\jre
       java -cp C:\sonar-scanner\lib\sonar-scanner-cli-4.6.2.2472.jar
            org.sonarsource.scanner.cli.Main
            -Dscanner.home=C:\sonar-scanner
            -Dproject.home=<current directory>
            <operator arguments>

  start.cmd / stop.cmd
       aws ec2 start-instances|stop-instances --instance-ids i-009462d8c9b182d5a

SonarQube (not in this repo)
  UI check:  http://79.125.106.230/sessions/new
  Scan host: http://79.125.106.230
```

`sonar-scanner/bin/sonar-scanner.bat` is the same Java command with `SONAR_SCANNER_HOME` set from `%~dp0\..` instead of `C:\sonar-scanner`.

## Repository layout

Tracked paths outside the JRE legal and config dump:

| Path | Bytes (where it matters) | Role |
|---|---|---|
| `.gitignore` | 674 | Bitbucket sample ignore list from `f3e7458` |
| `readme.md` | 0 | Empty file added in `2f01cda` |
| `snippets.txt` | 1976 | Setup, server note, five scan commands, AWS notes |
| `sonar-scanner.bat` | 2558 | Launcher with hardcoded `C:\sonar-scanner` |
| `sonar-scanner/bin/sonar-scanner.bat` | 2549 | Upstream launcher, relative home |
| `sonar-scanner/bin/sonar-scanner-debug.bat` | 586 | Sets JDWP opts, calls the bin launcher |
| `sonar-scanner/conf/sonar-scanner.properties` | 9 lines | Commented defaults only |
| `sonar-scanner/jre/release` | | AdoptOpenJDK identity file |
| `sonar-scanner/jre/lib/modules` | 94053056 | JRE modules image. Present because it has no `.jar` suffix |
| `sonarqubekey.pem` | 1704 | RSA private key. Unreferenced |
| `start.cmd` | 60 | One AWS CLI start command |
| `stop.cmd` | 57 | One AWS CLI stop command |

The working tree at `dc201f6` has 238 files once `.git` is excluded. Most of those are under `sonar-scanner/jre/` (legal notices, security policy, `conf`). There is no `sonar-scanner/lib` directory and no `sonar-scanner/jre/bin` directory.

File types under `sonar-scanner/jre`: 170 files with no extension (licences and the `modules` image), plus small counts of `.md`, `.policy`, `.properties`, `.txt`, `.dat`, `.jfc`, and single config files. Count of `*.dll`: 0. Count of `*.jar` in the whole repo: 0. `java.exe`: absent.

## Languages and frameworks

| Item | Value | Evidence |
|---|---|---|
| Launcher language | Windows batch (`.bat`, `.cmd`) | the four script files |
| Application framework | none | no source tree |
| Scanner API | `org.sonarsource.scanner.cli.Main` | both `sonar-scanner.bat` files |
| Scanner build named in the classpath | `sonar-scanner-cli-4.6.2.2472` | same files. The jar itself is absent |
| Embedded Java | AdoptOpenJDK 11.0.11+9, Hotspot, JRE, Windows x86_64, built 2021-04-20 | `sonar-scanner/jre/release` |
| Package manager | none | no `package.json`, `composer.json`, `pom.xml`, `*.csproj` |
| Tests | none | no test directory, no test script |
| CI | none | no `bitbucket-pipelines.yml`, no workflow file |

`sonar-scanner/jre/legal/` carries the upstream OpenJDK licence notices for the embedded JRE. Those notices were not copied into Silicon Ark.

## Scanner process

Both full launchers follow the upstream SonarScanner 4.6 Windows script, with one local edit on the root copy.

1. `setlocal`, then resolve `SONAR_SCANNER_HOME`.
2. Root file: `SONAR_SCANNER_HOME=C:\sonar-scanner\bin\..`. Bin file: `SONAR_SCANNER_HOME=%scriptdir%\..`.
3. `use_embedded_jre=true`, so `JAVA_HOME` becomes `%SONAR_SCANNER_HOME%\jre`.
4. Require `%JAVA_HOME%\bin\java.exe`. On failure, print the `JAVA_HOME` error and `goto error`.
5. Set `PROJECT_HOME` to `%CD%` and remove one trailing `\`.
6. Run:

```text
java -Djava.awt.headless=true %SONAR_SCANNER_DEBUG_OPTS% %SONAR_SCANNER_OPTS%
  -cp "%SONAR_SCANNER_HOME%\lib\sonar-scanner-cli-4.6.2.2472.jar"
  -Dscanner.home=%SONAR_SCANNER_HOME%
  -Dproject.home=%PROJECT_HOME%
  org.sonarsource.scanner.cli.Main %*
```

7. `ERRORLEVEL` 1 sets exit code 1. The script returns that code with `exit /B`.

The debug bat does not parse arguments. It sets:

```text
SONAR_SCANNER_DEBUG_OPTS=-Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=8000
```

and calls `"%~dp0"sonar-scanner.bat` with the original arguments. The JVM suspends until a debugger connects to port 8000.

`conf/sonar-scanner.properties` contains only comments. The active host, project key, sources, and token come from the command line in `snippets.txt`.

## Why a clone does not run

`.gitignore` was committed in `f3e7458`, before the scanner, and includes:

- `*.jar`
- `*.exe`
- `*.class`

`2f01cda` added the scanner scripts and the JRE config and `modules` file. It did not add `java.exe`, native libraries, or `sonar-scanner-cli-4.6.2.2472.jar`. Those names do not appear in `git ls-tree` for `HEAD`.

Consequence: following setup step 2 with a git checkout produces a `C:\sonar-scanner` that fails FR-001's Java check, and would also fail on the missing jar if `java.exe` were supplied alone.

Whether operator machines hold a complete scanner directory that was never committed is **Unknown / Requires Confirmation**.

## AWS commands

`start.cmd` is a single line:

```text
aws ec2 start-instances --instance-ids i-009462d8c9b182d5a
```

`stop.cmd` is:

```text
aws ec2 stop-instances --instance-ids i-009462d8c9b182d5a
```

No `--region`, `--profile`, `--output`, or `errorlevel` check.

The notes in `snippets.txt` also contain, as text rather than a script:

```text
aws ec2 run-instances --image-id ami-005ec3d100c64ab37 --instance-type t3a.medium --region eu-west-1 --profile unity
```

That line does not set a key pair, security group, subnet, or tag. It is not referenced by `start.cmd`. Using it would call `RunInstances`, which requests a new instance. Provenance: **Documented** text.

| AWS fact | Where it is set | Where it is not set |
|---|---|---|
| Instance `i-009462d8c9b182d5a` | `start.cmd`, `stop.cmd` | the `run-instances` example |
| Region `eu-west-1` | `run-instances` example | `start.cmd`, `stop.cmd` |
| Profile `unity` | `run-instances` example | `start.cmd`, `stop.cmd` |
| AMI `ami-005ec3d100c64ab37` | `run-instances` example | nowhere else |
| Type `t3a.medium` | `run-instances` example | nowhere else |

No Terraform, CloudFormation, AMI build script, or user-data file is in the repo. The public IPv4 `79.125.106.230` is only in `snippets.txt`. Nothing in git binds that address to the instance id. That binding is **Inferred** from the two facts sitting in one runbook. **Unknown / Requires Confirmation** if the address is still attached, or was an ephemeral public IP.

## SonarQube endpoint

| Item | Value | Provenance |
|---|---|---|
| Liveness URL | `http://79.125.106.230/sessions/new` | **Documented** |
| Scanner `sonar.host.url` | `http://79.125.106.230` | **Documented** on all five commands |
| Scheme | HTTP, no port | **Documented** |
| UI account name | `admin` | **Documented**. Password omitted |
| Analysis auth | `-Dsonar.login=<token>` per command | **Documented**. Tokens omitted |

Project keys recorded in the runbook: `TMTFrontend`, `TMTBackend`, `MyPassRegistration`, `MyPassPWA`, `1fortheroadPWA`.

No `sonar-project.properties` is in the commit. The onboarding file list from 2026-09-28 named that file and `sonarqube_scan.bat`. Both are absent here.

## Authentication and secrets

| Material | Location | Used by code? | Handling in Silicon Ark |
|---|---|---|---|
| SonarQube admin password | `snippets.txt` Server Details | No. It is notes for a human | Not copied |
| Five `sonar.login` tokens | `snippets.txt` saved commands | Passed through `%*` if an operator runs those lines | Not copied |
| RSA private key | `sonarqubekey.pem`, committed in `2f01cda` | No reference in any script or in `snippets.txt` | Not copied. Header is `BEGIN RSA PRIVATE KEY` |

The PEM file is world-readable in git (`100644`). No `.gitattributes` or ignore rule covers `*.pem`.

Rotation, removal from history, and the key's purpose are **Unknown / Requires Confirmation**. See business rule BR-SECRETS.

## What this repo does not contain

Looked for, and not present on `dc201f6`:

- Application source, routes, controllers, or a frontend.
- A database, migration, or seed.
- Environment files (`.env`), Docker, compose, or a web server config.
- A queue, worker, cron, or scheduled task. `start.cmd` is manual.
- Monitoring, metrics, or a health endpoint owned by this repo.
- Tests and a documented test process.
- HTTPS configuration, a reverse proxy, or a certificate for `79.125.106.230`.
- A reference to `sonarqubekey.pem`.

## Development process

The only process written down is the operator setup in `snippets.txt`:

1. Clone and read `snippets.txt`.
2. Copy `sonar-scanner` to `C:\sonar-scanner`.
3. Copy `sonar-scanner.bat` into the code root to be scanned.
4. Create a SonarQube project and copy its CLI command.
5. Run that command in the code root.
6. If `http://79.125.106.230/sessions/new` is not alive, ask Jaco to start the instance.

Git history shows that process was recorded on 2021-07-14 and not updated again. There is no branch model beyond `master`, no review checklist, and no pipeline.

`readme.md` does not describe a build or a test command. There is nothing to build.

## Security notes from the tree

These are observations, not a pentest.

- Analysis tokens and an admin password are in a committed text file. They also remain in the diff of `dc201f6` and in `2f01cda`.
- Tokens are supplied as process arguments (`-Dsonar.login=...`), so they are visible to local process listings when a scan runs.
- The SonarQube base URL is HTTP.
- An unused RSA private key is in the repository root.
- `start.cmd` and `stop.cmd` will act on a fixed instance id for any caller whose AWS CLI can.
- The debug launcher suspends and listens on TCP 8000.

No finding above was verified against the live host. The host was not contacted during this onboarding.