fix: make Checkov work on Intel Mac; harden tool install exits

Upstream Darwin Checkov zip is arm64 despite the X86_64 name — use
pip on Intel Macs, fix arch assertions in macOS smoke, and exit non-zero
when tool install/update fails.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 2 people

.github/workflows/macos-local-smoke.yml

@@ -88,31 +88,37 @@ jobs:
         run: |
           set -euo pipefail
           TOOLS="${HOME}/.local/bin/accuknox"
+          ARCH="${{ matrix.arch }}"
           ls -la "$TOOLS" "$TOOLS/sast" "$TOOLS/sq-sast/bin" || true
 
-          assert_arch () {
+          assert_native_arch () {
             local bin="$1"
-            local expect_x86="$2"   # yes|no — whether this binary is expected x86_64
             echo "--- file $bin"
             file "$bin"
             test -x "$bin"
-            if [[ "$expect_x86" == "yes" ]]; then
-              file "$bin" | grep -Eiq 'x86_64|x86-64|Intel'
+            if [[ "$ARCH" == "arm64" ]]; then
+              file "$bin" | grep -Eiq 'arm64|aarch64'
             else
-              if [[ "${{ matrix.arch }}" == "arm64" ]]; then
-                file "$bin" | grep -Eiq 'arm64|aarch64'
-              else
-                file "$bin" | grep -Eiq 'x86_64|x86-64|Intel'
-              fi
+              file "$bin" | grep -Eiq 'x86_64|x86-64'
             fi
           }
 
-          # Checkov is Intel-only even on Apple Silicon (Rosetta).
-          assert_arch "$TOOLS/iac" yes
-          assert_arch "$TOOLS/sast/sast" no
-          assert_arch "$TOOLS/secret" no
-          assert_arch "$TOOLS/container" no
-          assert_arch "$TOOLS/gitleaks" no
+          # Checkov: Apple Silicon uses mislabeled standalone (arm64 Mach-O);
+          # Intel Mac uses a pip-venv shell wrapper (script text).
+          echo "--- iac"
+          file "$TOOLS/iac"
+          test -x "$TOOLS/iac"
+          if [[ "$ARCH" == "arm64" ]]; then
+            file "$TOOLS/iac" | grep -Eiq 'arm64|aarch64'
+          else
+            file "$TOOLS/iac" | grep -Eiq 'script|text|shell'
+            test -x "$TOOLS/iac-venv/bin/checkov"
+          fi
+
+          assert_native_arch "$TOOLS/sast/sast"
+          assert_native_arch "$TOOLS/secret"
+          assert_native_arch "$TOOLS/container"
+          assert_native_arch "$TOOLS/gitleaks"
           test -x "$TOOLS/sq-sast/bin/sonar-scanner"
           test -d "$TOOLS/sast/rules"
 

README.md

@@ -86,7 +86,7 @@ Notes:
 
 - **Apple Silicon** = `arm64` / M-series; **Intel Mac** = `x86_64`. The CLI detects the CPU and installs the matching binary.
 - **Windows** local install currently targets **x64** upstream binaries (standard for these scanners).
-- **IaC (Checkov)** on Apple Silicon currently uses Checkov’s Intel build (needs [Rosetta 2](https://support.apple.com/en-us/102527)). Other Phase-1 tools use native arm64 or x86_64 builds.
+- **IaC (Checkov):** Apple Silicon uses Checkov’s Darwin standalone zip (the asset is named `X86_64` but the binary is arm64). Intel Mac installs Checkov via a dedicated pip venv (no usable x86_64 standalone zip). Other Phase-1 tools use native arm64 or x86_64 builds.
 
 ## Get Help
 

aspm_cli/commands/tool_command.py

@@ -49,19 +49,22 @@ def execute(self, args):
         overwrite = args.mode == "update"
         action_message = {"install": "installed", "update": "updated"}
         action_message_present = {"install": "Installing", "update": "Updating"}
+        failures = []
 
         if validated.all:
             for tool in ALLOWED_TOOL_TYPES:
                 spinner = Spinner(message=f"{action_message_present[args.mode]} tool for: {tool}")
                 spinner.start()
-                downloaded = downloader.download_tool(tool, overwrite)  # <-- FIXED HERE
+                downloaded = downloader.download_tool(tool, overwrite)
                 spinner.stop()
                 if downloaded:
                     Logger.log_with_color(
                         'INFO',
                         f"{tool} {action_message[args.mode]} successfully.",
                         Fore.GREEN
                     )
+                else:
+                    failures.append(tool)
         else:
             spinner = Spinner(message=f"{action_message_present[args.mode]} tool for: {validated.tooltype}")
             spinner.start()
@@ -72,4 +75,9 @@ def execute(self, args):
                     'INFO',
                     f"{validated.tooltype} {action_message[args.mode]} successfully.",
                     Fore.GREEN
-                )
+                )
+            else:
+                failures.append(validated.tooltype)
+
+        if failures:
+            sys.exit(1)

aspm_cli/tool/download.py

@@ -1,6 +1,8 @@
 import os
 import platform
 import shutil
+import subprocess
+import sys
 import tarfile
 import tempfile
 import urllib.request
@@ -189,13 +191,51 @@ def _chmod_x(self, path: Path):
         path.chmod(path.stat().st_mode | 0o111)
 
     def _install_darwin_iac(self, arch: str) -> bool:
-        # Checkov currently publishes only darwin_X86_64; Apple Silicon runs it via Rosetta.
-        zip_name = "checkov_darwin_X86_64.zip"
-        if arch == "arm64":
+        """
+        Install Checkov as ``iac``.
+
+        Bridgecrew's published ``checkov_darwin_X86_64.zip`` is mislabeled — the binary
+        inside is arm64. Use that zip on Apple Silicon. On Intel macOS, install Checkov
+        into a dedicated venv via pip (no usable x86_64 standalone zip).
+        """
+        dest = self.install_dir / "iac"
+        venv_dir = self.install_dir / "iac-venv"
+
+        if arch == "x86_64":
             Logger.get_logger().info(
-                "Checkov has no native Apple Silicon binary; installing the Intel (x86_64) "
-                "build (requires Rosetta 2 on M-series Macs)."
+                "Checkov's published Darwin standalone zip is arm64-only; "
+                f"installing Checkov {CHECKOV_VERSION} via pip for Intel Mac."
+            )
+            if venv_dir.exists():
+                shutil.rmtree(venv_dir)
+            subprocess.run([sys.executable, "-m", "venv", str(venv_dir)], check=True)
+            pip = venv_dir / "bin" / "pip"
+            subprocess.run(
+                [str(pip), "install", "--upgrade", "pip"],
+                check=True,
+                capture_output=True,
+            )
+            subprocess.run(
+                [str(pip), "install", f"checkov=={CHECKOV_VERSION}"],
+                check=True,
+            )
+            checkov_bin = venv_dir / "bin" / "checkov"
+            if not checkov_bin.exists():
+                raise FileNotFoundError(f"checkov not found after pip install at {checkov_bin}")
+            dest.write_text(
+                "#!/bin/sh\n"
+                f'exec "{checkov_bin}" "$@"\n',
+                encoding="utf-8",
             )
+            self._chmod_x(dest)
+            return True
+
+        # Apple Silicon: use the mislabeled standalone zip (contains arm64 Mach-O).
+        zip_name = "checkov_darwin_X86_64.zip"
+        Logger.get_logger().info(
+            "Installing Checkov Darwin standalone build "
+            f"(asset name {zip_name}; binary is arm64)."
+        )
         url = (
             f"https://github.com/bridgecrewio/checkov/releases/download/"
             f"{CHECKOV_VERSION}/{zip_name}"
@@ -205,15 +245,12 @@ def _install_darwin_iac(self, arch: str) -> bool:
             self._download_file(url, zip_path)
             with zipfile.ZipFile(zip_path, "r") as zf:
                 zf.extractall(tmp)
-            # Official zip lays out dist/checkov
             src = Path(tmp) / "dist" / "checkov"
             if not src.exists():
-                # fallback: find any executable named checkov
                 candidates = list(Path(tmp).rglob("checkov"))
                 if not candidates:
                     raise FileNotFoundError("checkov binary not found in archive")
                 src = candidates[0]
-            dest = self.install_dir / "iac"
             shutil.copy2(src, dest)
             self._chmod_x(dest)
         return True

utils/prepare-aspm-scanners-darwin.sh

@@ -25,14 +25,19 @@ package_for_arch() {
   echo "=== Packaging Darwin ${ARCH} ==="
 
   # --- iac (Checkov) ---
-  # Upstream only ships darwin_X86_64; Apple Silicon uses Rosetta.
-  curl -fsSL -o checkov.zip \
-    "https://github.com/bridgecrewio/checkov/releases/download/${CHECKOV_VERSION}/checkov_darwin_X86_64.zip"
-  unzip -o -q checkov.zip
-  cp dist/checkov iac
-  chmod +x iac
-  tar -czf "${OUT_DIR}/iac-darwin-${ARCH}.tar.gz" iac
-  echo "✅ iac-darwin-${ARCH}.tar.gz"
+  # Upstream asset checkov_darwin_X86_64.zip is mislabeled and contains an arm64 Mach-O.
+  # Only package it for arm64. Intel Mac local install uses pip (see ToolDownloader).
+  if [[ "$ARCH" == "arm64" ]]; then
+    curl -fsSL -o checkov.zip \
+      "https://github.com/bridgecrewio/checkov/releases/download/${CHECKOV_VERSION}/checkov_darwin_X86_64.zip"
+    unzip -o -q checkov.zip
+    cp dist/checkov iac
+    chmod +x iac
+    tar -czf "${OUT_DIR}/iac-darwin-${ARCH}.tar.gz" iac
+    echo "✅ iac-darwin-${ARCH}.tar.gz"
+  else
+    echo "⚠️  Skipping iac-darwin-${ARCH}.tar.gz (no usable Checkov standalone for Intel; CLI uses pip)"
+  fi
 
   # --- secret (TruffleHog) ---
   local HOG_ARCH="arm64"