On npm, PyPI and GitHub

cobolwork 0.9.0 is the release candidate. The build gate gains its errors and truncation sets, an in-stream finding is labelled by running its job, the flow walk reaches every source of the largest repositories it had cut short, and IBM's own published listings witness the parser's layouts.

• build reports a file, Db2 or CICS status the program sets and never tests, and input a STRING, a MOVE, an arithmetic statement or a selector drops without an abend: three status rules and eighteen truncation rules, each warning until its rate is recorded.
• A jcl-instream finding is labelled by running its job through the finding's step, with the in-stream data as marker records and the repository's data sets as z/OS records; a run that cannot reach the step says why.
• The flow walk examines only a call's own return edge from a subprogram many places call, and its bounds rise to 79 million edges a walk and 2.1 billion in all: ACAS walks every source and reports 185 findings for 120.
• Twenty-four Enterprise COBOL Data Division Maps published beside their sources agree with the parser on every one of 8,595 sizes and offsets, once a pointer holds 4 bytes under the IBM standard; 322 IBM-compiled units and ironwork accept and refuse alike.

Limit: Negatives from coverage and two-model labels ship unmeasured, as decision D-11 allows, and move to 1.1. The twenty-one new rules warn until their firing rates are recorded. Unieuro's flow walk still stops at the total bound.

A scan names the programs Enterprise COBOL will not compile because they use the COBOL Communication feature, and the build gate tells such a program from one ironwork does not run yet.

• compile-communication-feature reports each program with a COMMUNICATION SECTION, a CD entry, or an ENABLE, DISABLE, RECEIVE, SEND, PURGE or ACCEPT MESSAGE COUNT statement, with an inventory of its CDs, queues and statements to size the move to CICS or IBM MQ.
• The build gate reads an ironwork message's id before its wording: a refusal of what Enterprise COBOL refuses fails the program, and only ironwork's own gaps leave it undecided.
• What EXEC CICS ASSIGN and INQUIRE say about the region and its resources is reported when it reaches a web response or header.
• A label names the ironwork assumptions its runs rested on, where ironwork's journal lists them.

Limit: No program in the 500 corpus uses the Communication feature outside copies of NIST's CCVS85 routines, so the rule is measured on those alone. The two CICS rules warn until their precision is measured.

A scan reads three more kinds of mainframe source beside COBOL, JCL and assembler: PL/I programs, IMS definitions with the DL/I calls that use them, and Db2 DDL.

• PL/I programs join the data-flow graph, so input reaching a sink through PL/I is reported as it is in COBOL; 98.8% of hand-written PL/I statements parse on the development corpus and 99.8% on each held-out one.
• A PSB that grants an option its programs' DL/I calls never use is high, and a GRANT to PUBLIC, WITH GRANT OPTION or of a system authority is reported from Db2 DDL.
• A CICS queue item, the data a START passes and a web request's form fields are input: 16 cics-queue-to-* rules, which added 161 findings over the 72 corpus repositories holding EXEC CICS.
• build --precompile checks that each program with EXEC SQL or EXEC CICS compiles under cobc or gcobol once translated, before the compiler command runs.
• scan, diff and build read a PDS export that holds TSO TRANSMIT files and IEBCOPY unloads, naming members as DATA.SET/MEMBER.
• Assembler reads MVS 3.8 macro operands and every program of a batch file, and reports a MODESET switch to any system key.
• Every document cobolwork writes or reads has a JSON Schema and a version, and STABILITY.md lists what a release keeps.

Limit: PL/I has no compiler that may grade the reader, and a pointer, an entry variable or the preprocessor takes PL/I's flow out of sight; those are listed, not followed. DL/I ISRT and REPL are not sinks yet.

Findings witnessed by a run: abends from fuzzing, measured over 500 repositories.

• ironwork's fuzzing found 1,372 abends that an input causes, in 105 of 500 held-out repositories, each reported with the input that caused it.
• An input that keeps a loop running past a limit, or chooses the program a CALL loads, is a finding of its own.
• A subprogram fuzzed at its interface reports what a caller passing those arguments would cause, gated by its own policy key.
• A scan reports credentials written into COBOL source without gitleaks installed, and the credential rules read the quoted, phrase and hexadecimal forms IBM documents.
• HLASM statements are parsed by kind and placed as the assembler places them, with no location differing from z390's.
• A full scan reads and parses each program once for all its rule sets, and the flow set reads every program of a 3,263-program repository within memory.

Limit: reading a subprogram fuzzed at its interface needs ironwork after 0.4.1, which writes that format.

Precision per rule, measured by labels a machine made.

• Running each finding’s verification plan in ironwork confirmed 34 findings over 500 held-out repositories and refuted none, so cics-terminal-to-log is 12.6% to 100% and every other rule labelled by execution is 0% to 100%.
• Seven rules reported all 275 flaws planted into real programs and none of the 325 near-misses.
• --all-routes lists every route of a path finding, not only the shortest.
• HLASM is read, and its privileged operations are reported.
• Cleartext CICS web clients, oversized web receives and weak ICSF cryptography are reported.
• The credential rules report fewer things that are not credentials, and four more forms that are.
• Control analysis takes about half the time on large programs.

A fixing tool can call the gate, and findings can come from runs.

• commitwork’s cobolwork-remediate drafts a fix, gates it with cobolwork gate --head, and stops after three attempts.
• A patch that deletes the flagged statement or its source fails the gate, because a fix keeps what the program does.
• explain quotes every line of a statement, and a patch that stops a program compiling gives the gate up to three of the compiler’s error lines.
• A value a CALL writes back returns only to the call it came in by, so path findings fell from 3,659 to 1,950 on 500 random repositories.
• Abends ironwork’s fuzzing kept are findings, with the input that caused them.
• A COPY of a mapset held only as BMS source reads the symbolic map.
• Crafted input cannot slow a scan.

Fewer false positives on reference modification and loop counters.

• A reference modification with a varying start and length is judged on the last byte the two name together, so X(J:K) with each part checked on its own is reported, and a length computed as the end less its start is cleared.
• A counter a performed paragraph raises only under a test that leaves room stays in its table.
• A directory a drive fails to list is retried, then counted unread.

Limit: Node 22 is now the floor.

Scans PDS downloads, and compares git revisions without a checkout.

• scan --pds-export reads a directory of PDS members.
• diff reads both revisions out of git without writing them.
• Every rule maps to a COBIT 2019 practice by identifier.
• A finding says whether the estate’s runs entered its paragraph.
• An index bounded through another field’s interval is credited.

Fewer false positives, and an SBOM that follows each job to its programs.

• Two classes of HIGH false positive are fixed.
• The SBOM links the programs a job runs through TSO, IMS and procedures, CICS XCTL and LINK, and each program outside the estate.
• A reference modification is judged on its last byte, so X(I:3) needs I at most the size less two.
• UNSTRING writes the fields its DELIMITER IN, COUNT IN and TALLYING IN phrases name, which finds counts taken from input.
• A backward scan under a not-blank test stops at 1 or more.
• Code past column 72 among column-7 comments is read as variable format.
• IDCAMS PRINT and ALTER NEWNAME move data, and a TSO batch step’s ALLOCATE, CALL and DSN RUN are read.
• IBM’s reserved words come by column.

Every path finding says whether an attacker can use it.

• explain carries a verification plan for each path finding.
• The build gate compiles IBM estates with ironwork check, reads gcobol’s options as it reads cobc’s, and can require an ironwork equivalence statement for each program a change edits.
• cobolwork sbom writes a CycloneDX bill of materials, and build --provenance-format slsa an SLSA provenance statement.
• New rules: the three from ironwork’s model, and those the z/OS advisories justify.
• A GitHub Action for the build gate, sealed evidence of a run, and tighter subscript bounds.

Installs from PyPI.

The Python package runs the same files with the Node.js on your PATH.

Installs from npm, as @portll/cobolwork.

The package carries LICENSING.md and THIRD-PARTY-NOTICES.md.

• The check model reads conditions, flags, tallies and dead code.
• Build scripts are read command by command, as a shell reads them.

The first release from the public repository.