bonebed 0.1.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA256:
+  metadata.gz: 1b1a9dbb4f564259898f381389f21c8d4321c0f8e2f4cd7b35b4c08c8bf46db0
+  data.tar.gz: d175c95050c37077606b573d8d74517d951fcc368a0430666bb820a75b24e97c
+SHA512:
+  metadata.gz: 214234c1ff5aa7c66925864c081d35737b1d6348fcc41ea7c6f7ca76dca43467371cfca9793b780a0555f9949812b99f0519b80dfcf8d2e1d58e721041f0b8da
+  data.tar.gz: 64fdf0c3e20628da22a8a598bfc3e4fecf11bef329817a3339a0947528f4542ddb79eadd67b0e70b2399df8f8e259092a2bb52263bb49f84f03156fb60694b69

data/LICENSE.txt

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2026 Yudai Takada
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

data/README.md

@@ -0,0 +1,78 @@
+# Bonebed
+
+Bonebed observes the files, network addresses, and external commands touched while a Ruby gem is installed or required. It produces a capability manifest from Linux seccomp user notifications.
+
+Bonebed is an observation tool, not a security boundary. Pointer arguments can change between inspection and syscall continuation (TOCTOU), so its output describes what was observed rather than guaranteeing what happened.
+
+## Requirements
+
+- Linux 5.5 or newer on x86_64 or aarch64
+- Ruby 3.2 or newer
+- Permission to install a seccomp user-notification filter
+
+Docker users must run with `--security-opt seccomp=unconfined`. Bonebed does not support macOS directly; use the development container below.
+
+## Installation
+
+Bonebed is not published yet. Build and install the current checkout with:
+
+```bash
+gem build bonebed.gemspec
+gem install ./bonebed-0.1.0.gem
+```
+
+## Diagnose the environment
+
+```bash
+bonebed doctor
+```
+
+## Observe a gem
+
+Run Bonebed inside the development container so third-party code is not executed directly on the host:
+
+```bash
+bin/dev bundle exec exe/bonebed dig json
+bin/dev bundle exec exe/bonebed dig json --phase install
+```
+
+Manifests are written to `results/`. The first run records a Ruby/Bundler baseline in `.bonebed/baselines`; refresh it after environment changes with:
+
+```bash
+bin/dev bundle exec exe/bonebed baseline --refresh
+```
+
+Use `--offline` to return `ENETUNREACH` for every observed connection. This is a compatibility check, not a security sandbox.
+
+## Survey and report
+
+Survey RubyGems.org's all-time download ranking, a newline-separated gem list, or a lockfile. Existing result files are skipped so interrupted surveys can resume.
+
+```bash
+bin/dev bundle exec exe/bonebed survey --top 100
+bin/dev bundle exec exe/bonebed survey --gemfile Gemfile.lock --phase require
+bin/dev bundle exec exe/bonebed report results --format md
+```
+
+Top surveys default to the install phase because those gems need not already be installed. A list file accepts `NAME` or `NAME VERSION` on each line.
+
+## Development
+
+Build the Linux development image once, install dependencies, and run the checks inside it:
+
+```bash
+docker build -f Dockerfile.dev -t bonebed-dev .
+bin/dev bundle install
+bin/dev bundle exec rake
+bin/dev bundle exec exe/bonebed doctor
+```
+
+The image includes `strace` for cross-checking noteworthy observations.
+
+## Contributing
+
+Bug reports and pull requests are welcome on GitHub at https://github.com/ydah/bonebed.
+
+## License
+
+The gem is available as open source under the terms of the [MIT License](https://opensource.org/licenses/MIT).

data/exe/bonebed

@@ -0,0 +1,6 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require "bonebed/cli"
+
+exit Bonebed::CLI.start

data/lib/bonebed/baseline.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+require "digest"
+require "fileutils"
+require "json"
+require "rbconfig"
+require_relative "path_normalizer"
+require_relative "session"
+
+module Bonebed
+  class Baseline
+    Result = Struct.new(:id, :observation, keyword_init: true)
+
+    def initialize(cache_dir: ".bonebed/baselines", timeout: 30)
+      @cache_dir = cache_dir
+      @timeout = timeout
+    end
+
+    def capture(refresh: false)
+      return load unless refresh || !File.file?(path)
+
+      collector = Session.new([RbConfig.ruby, "-e", ""], timeout: @timeout).run
+      observation = collector.snapshot(PathNormalizer.new)
+      raise Error, observation[:errors].join("; ") unless observation[:errors].empty?
+
+      FileUtils.mkdir_p(@cache_dir)
+      File.write(path, "#{JSON.pretty_generate(encode(observation))}\n")
+      Result.new(id:, observation:)
+    end
+
+    private
+
+    def id
+      bundle = ENV["BUNDLE_GEMFILE"] ? "bundler" : "nobundler"
+        gems = Gem.loaded_specs.values.map { |specification| "#{specification.name}-#{specification.version}" }.sort
+        local_files = %w[Gemfile.lock bonebed.gemspec].filter_map { |path| File.read(path) if File.file?(path) }
+        digest = Digest::SHA256.hexdigest([*gems, *local_files].join("\0"))[0, 8]
+      "ruby-#{RUBY_VERSION}-#{bundle}-#{RbConfig::CONFIG.fetch("host_cpu")}-#{digest}"
+    end
+
+    def path
+      File.join(@cache_dir, "#{id}.json")
+    end
+
+    def load
+      Result.new(id:, observation: decode(JSON.parse(File.read(path))))
+    end
+
+    def encode(observation)
+      observation.merge(
+        network: entries(observation.fetch(:network)),
+        exec: entries(observation.fetch(:exec))
+      )
+    end
+
+    def entries(values)
+      values.map { |event, count| {event:, count:} }
+    end
+
+    def decode(observation)
+      {
+        files: observation.fetch("files").to_h { |mode, values| [mode.to_sym, values] },
+        network: decode_entries(observation.fetch("network")),
+        exec: decode_entries(observation.fetch("exec")),
+        stats: observation.fetch("stats").transform_keys(&:to_sym),
+        errors: observation.fetch("errors")
+      }
+    end
+
+    def decode_entries(entries)
+      entries.to_h do |entry|
+        [entry.fetch("event").transform_keys(&:to_sym), entry.fetch("count")]
+      end
+    end
+  end
+end

data/lib/bonebed/cli.rb

@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+require "bonebed"
+require "optparse"
+
+module Bonebed
+  class CLI
+    def self.start(arguments = ARGV)
+      case arguments.shift
+      when "doctor"
+        Doctor.new.run ? 0 : 1
+      when "baseline"
+        baseline(arguments)
+      when "dig"
+        dig(arguments)
+      when "survey"
+        survey(arguments)
+      when "report"
+        report(arguments)
+      when nil, "help", "--help", "-h"
+        puts <<~HELP
+          Usage:
+            bonebed doctor
+            bonebed baseline [--refresh]
+            bonebed dig GEM [--phase require|install] [--version VERSION] [--offline]
+            bonebed dig --gemfile Gemfile.lock [--phase require|install]
+            bonebed survey (--top N | --file FILE | --gemfile FILE) [--phase require|install]
+            bonebed report RESULTS_DIR [--format md]
+        HELP
+        0
+      else
+        warn "Unknown command. Run `bonebed help` for usage."
+        1
+      end
+    rescue OptionParser::ParseError, ArgumentError, Gem::LoadError => error
+      warn error.message
+      1
+    end
+
+    def self.dig(arguments)
+      options = {phase: "require", results_dir: "results", timeout: 30, offline: false, gemfile: nil}
+      OptionParser.new do |parser|
+        parser.on("--phase PHASE") { |value| options[:phase] = value }
+        parser.on("--version VERSION") { |value| options[:version] = value }
+        parser.on("--results DIR") { |value| options[:results_dir] = value }
+        parser.on("--timeout SECONDS", Integer) { |value| options[:timeout] = value }
+        parser.on("--offline") { options[:offline] = true }
+        parser.on("--gemfile FILE") { |value| options[:gemfile] = value }
+      end.parse!(arguments)
+      name = arguments.shift
+      raise ArgumentError, "unexpected arguments: #{arguments.join(" ")}" unless arguments.empty?
+
+      dig = Dig.new(**options.slice(:results_dir, :timeout, :offline))
+      if options[:gemfile]
+        raise ArgumentError, "GEM cannot be combined with --gemfile" if name
+
+        Survey.new(dig:).run(Survey.lockfile(options[:gemfile]), phase: options[:phase])
+      else
+        puts dig.run(name, phase: options[:phase], version: options[:version])
+      end
+      0
+    end
+
+    def self.survey(arguments)
+      options = {phase: "install", results_dir: "results", timeout: 30, offline: false}
+      OptionParser.new do |parser|
+        parser.on("--top N", Integer) { |value| options[:top] = value }
+        parser.on("--file FILE") { |value| options[:file] = value }
+        parser.on("--gemfile FILE") { |value| options[:gemfile] = value }
+        parser.on("--phase PHASE") { |value| options[:phase] = value }
+        parser.on("--results DIR") { |value| options[:results_dir] = value }
+        parser.on("--timeout SECONDS", Integer) { |value| options[:timeout] = value }
+        parser.on("--offline") { options[:offline] = true }
+      end.parse!(arguments)
+      raise ArgumentError, "unexpected arguments: #{arguments.join(" ")}" unless arguments.empty?
+      raise ArgumentError, "choose exactly one of --top, --file, or --gemfile" unless options.values_at(:top, :file, :gemfile).compact.one?
+      raise ArgumentError, "phase must be require or install" unless Dig::PHASES.include?(options[:phase])
+
+      entries = options[:top] ? Survey.top(options[:top]) : options[:file] ? Survey.file(options[:file]) : Survey.lockfile(options[:gemfile])
+      dig = Dig.new(**options.slice(:results_dir, :timeout, :offline))
+      Survey.new(dig:).run(entries, phase: options[:phase])
+      0
+    end
+
+    def self.report(arguments)
+      format = "md"
+      OptionParser.new { |parser| parser.on("--format FORMAT") { |value| format = value } }.parse!(arguments)
+      raise ArgumentError, "format must be md" unless format == "md"
+      raise ArgumentError, "results directory is required" unless arguments.one?
+
+      puts Report.new(arguments.first).markdown
+      0
+    end
+
+    def self.baseline(arguments)
+      refresh = false
+      OptionParser.new { |parser| parser.on("--refresh") { refresh = true } }.parse!(arguments)
+      raise ArgumentError, "unexpected arguments: #{arguments.join(" ")}" unless arguments.empty?
+
+      puts Baseline.new.capture(refresh:).id
+      0
+    end
+  end
+end

data/lib/bonebed/collector.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+module Bonebed
+  class Collector
+    attr_reader :errors, :wall_ms, :status
+
+    def initialize
+      @files = {read: Hash.new(0), write: Hash.new(0)}
+      @network = Hash.new(0)
+      @executions = Hash.new(0)
+      @errors = []
+      @roundtrips = 0
+    end
+
+    def record_open(event)
+      @files.fetch(event.fetch(:mode))[event.fetch(:path)] += 1
+    end
+
+    def record_network(event)
+      @network[event.freeze] += 1
+    end
+
+    def record_exec(event)
+      @executions[[event.fetch(:path), event.fetch(:argv).freeze].freeze] += 1
+    end
+
+    def record_notification
+      @roundtrips += 1
+    end
+
+    def record_error(context, error)
+      @errors << "#{context}: #{error.class}: #{error.message}"
+    end
+
+    def finish(started_at, status)
+      @wall_ms = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - started_at) * 1000).round
+      @status = status
+      return if status&.success?
+
+      @errors << if status&.signaled?
+        "target terminated by signal #{status.termsig}"
+      else
+        "target exited with status #{status&.exitstatus || "unknown"}"
+      end
+    end
+
+    def snapshot(normalizer)
+      {
+        files: @files.transform_values { |entries| normalize_counts(entries, normalizer) },
+        network: normalize_network(normalizer),
+        exec: normalize_exec(normalizer),
+        stats: {openat_total: @files.values.sum { |entries| entries.values.sum }, notify_roundtrips: @roundtrips, wall_ms: @wall_ms},
+        errors: @errors.dup
+      }
+    end
+
+    private
+
+    def normalize_counts(entries, normalizer)
+      entries.each_with_object(Hash.new(0)) { |(path, count), result| result[normalizer.call(path)] += count }
+    end
+
+    def normalize_network(normalizer)
+      @network.each_with_object(Hash.new(0)) do |(event, count), result|
+        normalized = event[:family] == "unix" ? event.merge(path: normalizer.call(event[:path])) : event
+        result[normalized] += count
+      end
+    end
+
+    def normalize_exec(normalizer)
+      @executions.each_with_object(Hash.new(0)) do |((path, argv), count), result|
+        result[{path: normalizer.call(path), argv:}] += count
+      end
+    end
+  end
+end

data/lib/bonebed/decoder/connect.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+require "ipaddr"
+
+module Bonebed
+  module Decoder
+    module Connect
+      MAX_LENGTH = 128
+
+      module_function
+
+      def call(bytes)
+        raise ArgumentError, "sockaddr length must be between 2 and #{MAX_LENGTH}" unless (2..MAX_LENGTH).cover?(bytes.bytesize)
+
+        case bytes.unpack1("S<")
+        when 0 then nil
+        when 1 then {family: "unix", path: unix_path(bytes.byteslice(2..))}
+        when 2 then internet_address("inet", bytes, 4)
+        when 10 then internet_address("inet6", bytes, 8)
+        else raise ArgumentError, "unsupported sockaddr family #{bytes.unpack1("S<")}"
+        end
+      end
+
+      def internet_address(family, bytes, address_offset)
+        length = family == "inet" ? 4 : 16
+        minimum = family == "inet" ? 16 : 28
+        raise ArgumentError, "short AF_#{family.upcase} sockaddr" if bytes.bytesize < minimum
+
+        address = IPAddr.new_ntoh(bytes.byteslice(address_offset, length)).to_s
+        scope = bytes.unpack1("@24L<") if family == "inet6"
+        address = "#{address}%#{scope}" if scope&.positive?
+        {family:, addr: address, port: bytes.unpack1("@2n")}
+      end
+      private_class_method :internet_address
+
+      def unix_path(bytes)
+        bytes.start_with?("\0") ? bytes.sub(/\0+\z/, "") : bytes.split("\0", 2).first
+      end
+      private_class_method :unix_path
+    end
+  end
+end

data/lib/bonebed/decoder/execve.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Bonebed
+  module Decoder
+    module Execve
+      POINTER_FORMAT = "J"
+      POINTER_SIZE = [0].pack(POINTER_FORMAT).bytesize
+
+      module_function
+
+      def call(request, limit: 64)
+        {
+          path: request.read_string(request.args.fetch(0)),
+          argv: read_argv(request, request.args.fetch(1), limit:)
+        }
+      end
+
+      def read_argv(request, address, limit:)
+        arguments = []
+        limit.times do |index|
+          pointer = request.read(address + (index * POINTER_SIZE), POINTER_SIZE).unpack1(POINTER_FORMAT)
+          break if pointer.zero?
+
+          arguments << request.read_string(pointer)
+        end
+        arguments
+      end
+      private_class_method :read_argv
+    end
+  end
+end

data/lib/bonebed/decoder/openat.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Bonebed
+  module Decoder
+    module Openat
+      module_function
+
+      def call(request, syscall: request.syscall)
+        path_argument, flags_argument = syscall == :open ? [0, 1] : [1, 2]
+        {
+          path: request.read_string(request.args.fetch(path_argument)),
+          mode: (request.args.fetch(flags_argument) & (File::WRONLY | File::RDWR)).zero? ? :read : :write
+        }
+      end
+    end
+  end
+end

data/lib/bonebed/difference.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Bonebed
+  module Difference
+    module_function
+
+    def call(observed, baseline)
+      files = observed.fetch(:files).to_h do |mode, entries|
+        [mode, subtract(entries, baseline.dig(:files, mode) || {})]
+      end
+      {
+        files:,
+        network: subtract(observed.fetch(:network), baseline.fetch(:network, {})),
+        exec: subtract(observed.fetch(:exec), baseline.fetch(:exec, {})),
+        stats: observed.fetch(:stats).merge(openat_after_baseline: files.values.sum { |entries| entries.values.sum }),
+        errors: observed.fetch(:errors)
+      }
+    end
+
+    def subtract(observed, baseline)
+      observed.each_with_object({}) do |(event, count), result|
+        remaining = count - baseline.fetch(event, 0)
+        result[event] = remaining if remaining.positive?
+      end
+    end
+    private_class_method :subtract
+  end
+end

data/lib/bonebed/dig.rb

@@ -0,0 +1,128 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "json"
+require "rbconfig"
+require "tmpdir"
+require "bundler"
+require_relative "baseline"
+require_relative "difference"
+require_relative "path_normalizer"
+require_relative "session"
+
+module Bonebed
+  class Dig
+    PHASES = %w[require install].freeze
+    attr_reader :results_dir
+
+    def initialize(results_dir: "results", timeout: 30, offline: false, baseline: Baseline.new(timeout:))
+      raise ArgumentError, "timeout must be positive" unless timeout.positive?
+
+      @results_dir = results_dir
+      @timeout = timeout
+      @offline = offline
+      @baseline = baseline
+    end
+
+    def run(name, phase: "require", version: nil)
+      validate!(name, phase, version)
+      manifest = if phase == "install"
+        Bundler.with_unbundled_env { install(name, version, @baseline.capture) }
+      else
+        require_gem(name, version, @baseline.capture)
+      end
+      FileUtils.mkdir_p(@results_dir)
+      path = File.join(@results_dir, "#{name}-#{safe_component(manifest.dig("gem", "version"))}-#{phase}.json")
+      File.write(path, "#{JSON.pretty_generate(manifest)}\n")
+      path
+    end
+
+    def write_failure(name, phase:, version:, error:)
+      validate!(name, phase)
+      FileUtils.mkdir_p(@results_dir)
+      path = File.join(@results_dir, "#{name}-#{safe_component(version)}-#{phase}.json")
+      data = manifest(name, version, phase, empty_observation(error), Baseline::Result.new(id: nil, observation: empty_observation))
+      File.write(path, "#{JSON.pretty_generate(data)}\n")
+      path
+    end
+
+    def result_exists?(name, phase:, version: nil)
+      validate!(name, phase, version)
+      suffix = version ? safe_component(version) : "*"
+      !Dir[File.join(@results_dir, "#{name}-#{suffix}-#{phase}.json")].empty?
+    end
+
+    private
+
+    def validate!(name, phase, version = nil)
+      raise ArgumentError, "gem name is required" unless name&.match?(/\A[a-zA-Z0-9_-]+\z/)
+      raise ArgumentError, "phase must be require or install" unless PHASES.include?(phase)
+      raise ArgumentError, "invalid gem version" if version && !Gem::Version.correct?(version)
+    end
+
+    def require_gem(name, version, baseline)
+      specification = Gem::Specification.find_by_name(name, version ? "=#{version}" : Gem::Requirement.default)
+      code = 'gem ARGV[0], "=#{ARGV[1]}"; require ARGV[0]'
+      collector = Session.new([RbConfig.ruby, "-e", code, name, specification.version.to_s], timeout: @timeout, offline: @offline).run
+      normalizer = PathNormalizer.new
+      manifest(name, specification.version.to_s, "require", collector.snapshot(normalizer), baseline)
+    end
+
+    def install(name, version, baseline)
+      Dir.mktmpdir("bonebed-install-") do |root|
+        gem_home = File.join(root, "gems")
+        home = File.join(root, "home")
+        FileUtils.mkdir_p(home)
+        requested = version ? "#{name}:#{version}" : name
+        command = [RbConfig.ruby, "-S", "gem", "install", requested, "--no-document", "--install-dir", gem_home]
+        env = {"GEM_HOME" => gem_home, "GEM_PATH" => gem_home, "HOME" => home}
+        collector = Session.new(command, env:, timeout: @timeout, offline: @offline).run
+        installed_version = installed_version(gem_home, name) || version || "unknown"
+        normalizer = PathNormalizer.new(home:, gem_paths: [gem_home, *Gem.path], tmpdir: root)
+        manifest(name, installed_version, "install", collector.snapshot(normalizer), baseline)
+      end
+    end
+
+    def installed_version(gem_home, name)
+      path = Dir[File.join(gem_home, "specifications", "#{name}-*.gemspec")].max
+      File.basename(path, ".gemspec").delete_prefix("#{name}-") if path
+    end
+
+    def manifest(name, version, phase, observation, baseline)
+      observation = Difference.call(observation, baseline.observation)
+      files = observation.fetch(:files).transform_values { |entries| entries.keys.sort }
+      files[:notable] = (files[:read].grep(/\A\$HOME\//) + files[:write].grep(/\A(?:\$HOME|\$TMPDIR)\//)).uniq.sort
+      {
+        "schema_version" => 1,
+        "gem" => {"name" => name, "version" => version},
+        "phase" => phase,
+        "environment" => {"ruby" => RUBY_VERSION, "arch" => RbConfig::CONFIG.fetch("host_cpu"), "kernel" => `uname -r`.strip, "baseline_id" => baseline.id},
+        "files" => stringify_keys(files),
+        "network" => counted_entries(observation.fetch(:network)),
+        "exec" => counted_entries(observation.fetch(:exec)),
+        "stats" => stringify_keys(observation.fetch(:stats)),
+        "errors" => observation.fetch(:errors)
+      }
+    end
+
+    def counted_entries(entries)
+      entries.map { |event, count| stringify_keys(event).merge("count" => count) }.sort_by(&:to_s)
+    end
+
+    def stringify_keys(hash)
+      hash.to_h { |key, value| [key.to_s, value] }
+    end
+
+    def empty_observation(error = nil)
+      {
+        files: {read: {}, write: {}}, network: {}, exec: {},
+        stats: {openat_total: 0, notify_roundtrips: 0, wall_ms: 0},
+        errors: error ? ["#{error.class}: #{error.message}"] : []
+      }
+    end
+
+    def safe_component(value)
+      value.to_s.gsub(/[^0-9A-Za-z._-]/, "_")
+    end
+  end
+end

data/lib/bonebed/doctor.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require "rbconfig"
+
+module Bonebed
+  class Doctor
+    SUPPORTED_ARCHES = %w[x86_64 aarch64].freeze
+
+    def initialize(output: $stdout)
+      @output = output
+    end
+
+    def run
+      features = seccomp_features
+      checks = [
+        ["kernel", kernel_release, linux? && kernel_supported?],
+        ["arch", arch, linux? && SUPPORTED_ARCHES.include?(arch)],
+        ["CONFIG_SECCOMP_FILTER", config_status(features), features[:user_notif]],
+        ["SECCOMP_RET_USER_NOTIF", enabled(features[:user_notif]), features[:user_notif]],
+        ["continue (5.5+)", enabled(features[:continue]), features[:continue]],
+        ["addfd (5.9+)", enabled(features[:addfd]), features[:addfd]],
+        ["container seccomp profile", container_status, true]
+      ]
+      checks.each { |name, value, ok| @output.puts(format("%-30s %-24s %s", name, value, ok ? "OK" : "NG")) }
+      checks.first(6).all?(&:last)
+    end
+
+    private
+
+    def linux?
+      RUBY_PLATFORM.include?("linux")
+    end
+
+    def kernel_release
+      `uname -r`.strip
+    end
+
+    def kernel_supported?
+      Gem::Version.new(kernel_release[/\A\d+(?:\.\d+)+/] || "0") >= Gem::Version.new("5.5")
+    end
+
+    def arch
+      RbConfig::CONFIG.fetch("host_cpu").sub("arm64", "aarch64")
+    end
+
+    def seccomp_features
+      return {} unless linux?
+
+      require "seccomp/notify"
+      Seccomp::Notify.features
+    rescue LoadError, StandardError
+      {}
+    end
+
+    def enabled(value)
+      value ? "available" : "unavailable"
+    end
+
+    def config_status(features)
+      return "enabled" if features[:user_notif]
+
+      linux? ? "unavailable" : "Linux only"
+    end
+
+    def container_status
+      return "not Linux" unless linux?
+
+      mode = File.read("/proc/self/status")[/^Seccomp:\s+(\d+)/, 1]
+      mode == "0" ? "unconfined" : "filter active"
+    rescue Errno::ENOENT
+      "unknown"
+    end
+  end
+end

data/lib/bonebed/path_normalizer.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+require "tmpdir"
+
+module Bonebed
+  class PathNormalizer
+    def initialize(home: Dir.home, gem_paths: Gem.path, tmpdir: Dir.tmpdir)
+      @home = clean(home)
+      @gem_paths = gem_paths.map { |path| clean(path) }.sort_by { |path| -path.length }
+      @tmpdir = clean(tmpdir)
+    end
+
+    def call(path)
+      gem_path = @gem_paths.find { |root| inside?(path, root) }
+      return replace(path, gem_path, "$GEM_HOME") if gem_path
+      return replace(path, @home, "$HOME") if inside?(path, @home)
+      return path == @tmpdir ? "$TMPDIR" : "$TMPDIR/<random>" if inside?(path, @tmpdir)
+
+      path.sub(%r{\A/proc/\d+(?=/|\z)}, "/proc/<pid>")
+    end
+
+    private
+
+    def clean(path)
+      path.to_s.sub(%r{/+\z}, "")
+    end
+
+    def inside?(path, root)
+      !root.empty? && (path == root || path.start_with?("#{root}/"))
+    end
+
+    def replace(path, root, marker)
+      "#{marker}#{path.delete_prefix(root)}"
+    end
+  end
+end

data/lib/bonebed/report.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+require "json"
+
+module Bonebed
+  class Report
+    def initialize(directory)
+      raise ArgumentError, "results directory does not exist: #{directory}" unless Dir.exist?(directory)
+
+      @manifests = Dir[File.join(directory, "*.json")].map { |path| JSON.parse(File.read(path)) }
+    end
+
+    def markdown
+      successful = @manifests.count { |manifest| manifest.fetch("errors", []).empty? }
+      lines = [
+        "# Bonebed survey",
+        "",
+        "- Manifests: #{@manifests.size}",
+        "- Successful: #{successful}",
+        "- With errors: #{@manifests.size - successful}",
+        "- Require phase with network: #{network_count("require")}",
+        "- Install phase with network: #{network_count("install")}",
+        "",
+        ranking("Home files read", home_reads),
+        ranking("Commands observed", commands),
+        openat_ranking
+      ]
+      lines.join("\n").rstrip << "\n"
+    end
+
+    private
+
+    def network_count(phase)
+      @manifests.count { |manifest| manifest["phase"] == phase && !manifest.fetch("network", []).empty? }
+    end
+
+    def home_reads
+      counts = Hash.new(0)
+      @manifests.each { |manifest| manifest.dig("files", "read")&.grep(/\A\$HOME\//)&.each { |path| counts[path] += 1 } }
+      counts
+    end
+
+    def commands
+      @manifests.each_with_object(Hash.new(0)) do |manifest, counts|
+        manifest.fetch("exec", []).each { |entry| counts[entry.fetch("path")] += entry.fetch("count", 1) }
+      end
+    end
+
+    def ranking(title, counts)
+      rows = counts.sort_by { |name, count| [-count, name] }.first(10)
+      return "## #{title}\n\nNone observed.\n" if rows.empty?
+
+      "## #{title}\n\n| Item | Count |\n| --- | ---: |\n#{rows.map { |name, count| "| `#{name}` | #{count} |" }.join("\n")}\n"
+    end
+
+    def openat_ranking
+      rows = @manifests.sort_by { |manifest| -manifest.dig("stats", "openat_after_baseline").to_i }.first(10)
+      ranking("Open calls after baseline", rows.to_h { |manifest| [label(manifest), manifest.dig("stats", "openat_after_baseline").to_i] })
+    end
+
+    def label(manifest)
+      "#{manifest.dig("gem", "name")} #{manifest.dig("gem", "version")} (#{manifest["phase"]})"
+    end
+  end
+end

data/lib/bonebed/session.rb

@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+require "timeout"
+require_relative "collector"
+require_relative "decoder/openat"
+require_relative "decoder/connect"
+require_relative "decoder/execve"
+
+module Bonebed
+  class Session
+    def initialize(command, env: {}, timeout: 30, offline: false, collector: Collector.new)
+      @command = command
+      @env = env
+      @timeout = timeout
+      @offline = offline
+      @collector = collector
+      @bootstrap_exec = true
+    end
+
+    def run
+      started_at = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      supervisor = build_supervisor
+      status = Timeout.timeout(@timeout) { supervisor.run }
+      @collector.finish(started_at, status)
+      @collector
+    rescue Timeout::Error
+      terminate(supervisor&.target_pid)
+      @collector.record_error("session", Timeout::Error.new("timed out after #{@timeout} seconds"))
+      @collector.finish(started_at, nil)
+      @collector
+    end
+
+    private
+
+    def build_supervisor
+      require "seccomp/notify"
+      open_syscalls = RUBY_PLATFORM.include?("x86_64") ? %i[open openat] : %i[openat]
+      policy = Seccomp::Notify::Policy.new { notify(*open_syscalls, :connect, :execve) }
+      supervisor = Seccomp::Notify.spawn(policy) { exec(@env, *@command) }
+      open_syscalls.each { |syscall| supervisor.on(syscall) { |request| handle_open(request, syscall) } }
+      supervisor.on(:connect) { |request| handle_connect(request) }
+      supervisor.on(:execve) { |request| handle_execve(request) }
+      supervisor.on_error { |error, request| @collector.record_error(request&.syscall || "supervisor", error) }
+      supervisor
+    end
+
+    def handle_open(request, syscall)
+      @collector.record_notification
+      @collector.record_open(Decoder::Openat.call(request, syscall:))
+    rescue StandardError => error
+      @collector.record_error(syscall, error)
+    ensure
+      request.continue!(unsafe: true) unless request.responded?
+    end
+
+    def handle_connect(request)
+      @collector.record_notification
+      bytes = request.read(request.args.fetch(1), request.args.fetch(2))
+      event = Decoder::Connect.call(bytes)
+      @collector.record_network(event) if event
+    rescue StandardError => error
+      @collector.record_error(:connect, error)
+    ensure
+      unless request.responded?
+        @offline ? request.error!(Errno::ENETUNREACH) : request.continue!(unsafe: true)
+      end
+    end
+
+    def handle_execve(request)
+      @collector.record_notification
+      if @bootstrap_exec
+        @bootstrap_exec = false
+      else
+        event = Decoder::Execve.call(request)
+        # ponytail: same-mount check filters failed PATH lookups; retain attempts if targets gain separate mounts.
+        @collector.record_exec(event) if File.executable?(event[:path])
+      end
+    rescue StandardError => error
+      @collector.record_error(:execve, error)
+    ensure
+      request.continue!(unsafe: true) unless request.responded?
+    end
+
+    def terminate(pid)
+      return unless pid
+
+      Process.kill("KILL", pid)
+      Process.waitpid(pid)
+    rescue Errno::ECHILD, Errno::ESRCH
+      nil
+    end
+  end
+end

data/lib/bonebed/survey.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+require "bundler"
+require "json"
+require "net/http"
+require "uri"
+
+module Bonebed
+  class Survey
+    STATS_URL = "https://rubygems.org/stats"
+
+    def initialize(dig:, output: $stdout)
+      @dig = dig
+      @output = output
+    end
+
+    def run(entries, phase:)
+      entries.each_with_index do |entry, index|
+        name, version = entry.values_at(:name, :version)
+        if @dig.result_exists?(name, phase:, version:)
+          @output.puts "[#{index + 1}/#{entries.size}] skip #{name}"
+          next
+        end
+
+        @output.puts "[#{index + 1}/#{entries.size}] #{phase} #{name}"
+        @dig.run(name, phase:, version:)
+      rescue StandardError => error
+        @output.puts "  failed: #{error.message}"
+        write_failure(name, version, phase, error)
+      end
+    end
+
+    def self.top(limit)
+      raise ArgumentError, "top must be between 1 and 100" unless (1..100).cover?(limit)
+
+      names = (1..(limit / 10.0).ceil).flat_map { |page| names_from(fetch_page(page)) }.uniq
+      raise Error, "RubyGems stats returned only #{names.size} gem names" if names.size < limit
+
+      names.first(limit).map { |name| {name:, version: nil} }
+    end
+
+    def self.file(path)
+      File.readlines(path, chomp: true).filter_map do |line|
+        name, version = line.sub(/#.*/, "").split
+        {name:, version:} if name
+      end
+    end
+
+    def self.lockfile(path)
+      parser = Bundler::LockfileParser.new(Bundler.read_file(path))
+      parser.specs.group_by(&:name).map do |name, specifications|
+        {name:, version: specifications.max_by(&:version).version.to_s}
+      end.sort_by { |entry| entry[:name] }
+    end
+
+    def self.names_from(html)
+      html.scan(%r{href="/gems/([^"?]+)}).flatten.map { |name| URI::DEFAULT_PARSER.unescape(name) }
+    end
+    private_class_method :names_from
+
+    def self.fetch_page(page)
+      uri = URI("#{STATS_URL}?page=#{page}")
+      Net::HTTP.start(uri.host, uri.port, use_ssl: true, open_timeout: 10, read_timeout: 10) do |http|
+        response = http.get(uri.request_uri)
+        raise Error, "RubyGems stats returned HTTP #{response.code}" unless response.is_a?(Net::HTTPSuccess)
+
+        response.body
+      end
+    end
+    private_class_method :fetch_page
+
+    private
+
+    def write_failure(name, version, phase, error)
+      @dig.write_failure(name, phase:, version: version || "unknown", error:)
+    rescue ArgumentError
+      nil
+    end
+  end
+end

data/lib/bonebed/version.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+module Bonebed
+  VERSION = "0.1.0"
+end

data/lib/bonebed.rb

@@ -0,0 +1,12 @@
+# frozen_string_literal: true
+
+require_relative "bonebed/version"
+
+module Bonebed
+  class Error < StandardError; end
+end
+
+require_relative "bonebed/doctor"
+require_relative "bonebed/dig"
+require_relative "bonebed/survey"
+require_relative "bonebed/report"

metadata

@@ -0,0 +1,77 @@
+--- !ruby/object:Gem::Specification
+name: bonebed
+version: !ruby/object:Gem::Version
+  version: 0.1.0
+platform: ruby
+authors:
+- Yudai Takada
+bindir: exe
+cert_chain: []
+date: 1980-01-02 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: seccomp-notify
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.3'
+description: Profiles file, network, and process syscalls made while installing or
+  requiring Ruby gems.
+email:
+- t.yudai92@gmail.com
+executables:
+- bonebed
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE.txt
+- README.md
+- exe/bonebed
+- lib/bonebed.rb
+- lib/bonebed/baseline.rb
+- lib/bonebed/cli.rb
+- lib/bonebed/collector.rb
+- lib/bonebed/decoder/connect.rb
+- lib/bonebed/decoder/execve.rb
+- lib/bonebed/decoder/openat.rb
+- lib/bonebed/difference.rb
+- lib/bonebed/dig.rb
+- lib/bonebed/doctor.rb
+- lib/bonebed/path_normalizer.rb
+- lib/bonebed/report.rb
+- lib/bonebed/session.rb
+- lib/bonebed/survey.rb
+- lib/bonebed/version.rb
+homepage: https://github.com/ydah/bonebed
+licenses:
+- MIT
+metadata:
+  allowed_push_host: https://rubygems.org
+  source_code_uri: https://github.com/ydah/bonebed
+  rubygems_mfa_required: 'true'
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: 3.2.0
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubygems_version: 4.0.19
+specification_version: 4
+summary: Observe the runtime capabilities of Ruby gems
+test_files: []