bootprint 0.2.0 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4d4c97b0a32461ce90a144849e6fb9c1416682f0b682039cd5e89cfb2d2ca171
-  data.tar.gz: d228014f4dca8d75d8aa03eab9b343e8ee0a9449e5cc8e50220c91549a305803
+  metadata.gz: 84278443cdd38e08c4b03bdd0776b8a9b7fd32a623b5ebf2f2c3e1ddc29901c2
+  data.tar.gz: e51b0d1b314473e6acb15544ab81a9fbd09de46994f929eff9b5751769db3f80
 SHA512:
-  metadata.gz: ae4e15f6cd2655c988c3f7b845d417240e433b8e1384c5145b984bc0c243fbb0ad10c5fd09fb93cd8c38570b0682538a459e98db931a77c43c16686bf2963d71
-  data.tar.gz: 7070a15b2d7a82018cb526c9b0fad201ea8259f87a6daa63641ad5be745fe9eee899348c33f41d1f80879e2a103cb6f3a89444eb65b839ec70660e587b76cc5c
+  metadata.gz: e3be35d8bc8b7d970b4239b987fef35361677e8347fc24c200db57118515ebc2be83691c371f892b1d47a4fcf05cfd6b408c453282f117b5d3cec28ee1702c76
+  data.tar.gz: 1a99662465a2ef9d867b4e81016d4ce92c0c02ca949d2a6425e30c26ee223739a976f941e12162c432e53dca052f79be668f0ce29ca67a57abf329dba1d5a473

data/ARCHITECTURE.md

@@ -30,6 +30,8 @@ human / JSON / SARIF / Markdown / CI annotations
 - Formatters contain no detection logic.
 - Docker and security-audit code are lazy-loaded by their CLI commands.
 - Rails hooks load only when `Rails::Railtie` already exists; expensive profiling requires `BOOTPRINT_PROFILE_BOOT=1`.
+- The VS Code extension is a workspace-trusted process adapter. It spawns the same Ruby CLI without a shell and contains no duplicate diagnosis logic.
+- The public website is a dependency-free static surface under `site/`; it has no access to snapshots or application data and is deployed independently through GitHub Pages.
 
 ## Plugin contract
 

data/CHANGELOG.md

@@ -2,6 +2,40 @@
 
 All notable changes to Bootprint are documented here. The project follows Semantic Versioning before and after 1.0 where practical.
 
+## Unreleased
+
+## 0.5.0 - 2026-08-14
+
+### Added
+
+- Capture timezone, default encodings, and locale metadata on the operating-system fingerprint.
+- Built-in rules `timezone-drift`, `encoding-drift`, and `locale-drift` for those fields.
+
+## 0.4.0 - 2026-08-11
+
+### Added
+
+- `Bootprint::Advisories` for matching snapshot gem versions against offline JSON advisory bundles.
+- `Bootprint.advisories` and `Bootprint.advise` convenience APIs.
+- `bootprint advisories SNAPSHOT` CLI command with `--bundle` and `--format human|json` options.
+- Sample empty advisory bundle schema at `data/advisories/schema/empty.json`.
+
+## 0.3.0 - 2026-08-04
+
+### Added
+
+- `Bootprint::Matrix` for comparing two or more named snapshots at once.
+- Majority-based consensus values for multi-environment drift analysis.
+- Deterministic outlier identification and per-environment outlier counts.
+- Missing-value reporting for incomplete staging, CI, container, or production fingerprints.
+- `Bootprint.matrix` as the public convenience API.
+- Stable matrix JSON through `Matrix#to_h`.
+
+### Compatibility
+
+- Existing capture, diff, diagnosis, policy, report, CLI, Rails, and plugin APIs are unchanged.
+- Generated timestamps, environment labels, and capture metadata remain excluded from semantic comparisons.
+
 ## 0.2.0 - 2026-08-02
 
 ### Added

data/README.md

@@ -8,7 +8,9 @@
 
 <p align="center">
   <a href="https://github.com/theworker02/bootprint/actions/workflows/test.yml"><img alt="Test status" src="https://github.com/theworker02/bootprint/actions/workflows/test.yml/badge.svg"></a>
-  <img alt="Bootprint 0.2.0" src="https://img.shields.io/badge/version-0.2.0-CC342D">
+  <a href="https://rubygems.org/gems/bootprint"><img alt="Bootprint on RubyGems" src="https://img.shields.io/gem/v/bootprint?logo=rubygems&logoColor=white&color=CC342D"></a>
+  <a href="https://open-vsx.org/extension/theworker02/bootprint"><img alt="Bootprint on Open VSX" src="https://img.shields.io/open-vsx/v/theworker02/bootprint?label=Open%20VSX&color=6C4FBB"></a>
+  <a href="https://theworker02.github.io/bootprint/"><img alt="Bootprint website" src="https://img.shields.io/badge/website-GitHub%20Pages-3977F6?logo=githubpages&logoColor=white"></a>
   <img alt="Ruby 3.1 or newer" src="https://img.shields.io/badge/Ruby-%E2%89%A5%203.1-CC342D?logo=ruby&logoColor=white">
   <img alt="Snapshot schema version 2" src="https://img.shields.io/badge/snapshot_schema-v2-3977F6">
   <a href="LICENSE"><img alt="MIT license" src="https://img.shields.io/badge/license-MIT-171A21"></a>
@@ -16,6 +18,10 @@
 
 Bootprint is a local-first Ruby runtime fingerprint and compatibility diagnostic. It captures a sanitized description of an application environment, compares that description with CI, Docker, staging, or production, and turns raw drift into explanations, severity, evidence, remediation, and enforceable policy.
 
+Explore the project at [theworker02.github.io/bootprint](https://theworker02.github.io/bootprint/).
+
+Install the official [`bootprint` gem from RubyGems.org](https://rubygems.org/gems/bootprint):
+
 ```console
 gem install bootprint
 bootprint capture local
@@ -23,6 +29,8 @@ bootprint docker capture myapp:latest
 bootprint diagnose local myapp-latest
 ```
 
+The official editor extension is available from [Open VSX as `theworker02.bootprint`](https://open-vsx.org/extension/theworker02/bootprint).
+
 Bootprint 0.2 combines a dependency compatibility analyzer, Rails boot inspector, environment-drift detector, and CI policy engine. Ordinary capture performs no network requests, suggested commands never execute automatically, and environment-variable values are never recorded.
 
 ## Contents
@@ -40,6 +48,7 @@ Bootprint 0.2 combines a dependency compatibility analyzer, Rails boot inspector
 - [Rules and plugins](#rules-and-plugins)
 - [Privacy and security](#privacy-and-security)
 - [Platform support and performance](#platform-support-and-performance)
+- [VS Code extension](#vs-code-extension)
 - [Documentation](#documentation)
 - [Development](#development)
 
@@ -47,7 +56,7 @@ Bootprint 0.2 combines a dependency compatibility analyzer, Rails boot inspector
 
 `Gemfile.lock` captures dependency resolution, but not the complete runtime contract. Ruby engine and patch level, native clients, libc, CPU architecture, Rails adapters, required configuration, filesystem behavior, and initializer ordering can all change application behavior.
 
-Bootprint records those facts as deterministic schema-v2 JSON and evaluates them with 39 independently testable built-in rules. A finding answers four questions that a plain diff cannot:
+Bootprint records those facts as deterministic schema-v2 JSON and evaluates them with 42 independently testable built-in rules. A finding answers four questions that a plain diff cannot:
 
 1. What changed?
 2. How dangerous is it?
@@ -70,7 +79,7 @@ ERROR      Required environment variable is missing
 
 | Capability | Bootprint 0.2 |
 |---|---|
-| Diagnostic knowledge | 39 built-in rules across runtime, dependencies, native libraries, configuration, filesystem, and Rails boot |
+| Diagnostic knowledge | 42 built-in rules across runtime, dependencies, native libraries, configuration, filesystem, locale, and Rails boot |
 | Severity model | `info`, `warning`, `error`, `critical` |
 | Report formats | Human terminal output, JSON, SARIF 2.1, Markdown |
 | Snapshot contract | Deterministic schema v2 with in-memory v1 migration |
@@ -88,6 +97,7 @@ ERROR      Required environment variable is missing
 | Native libraries | OpenSSL, libyaml, SQLite, PostgreSQL, MySQL, libc, compiler and header availability when detectable |
 | Configuration | Environment-variable names and presence, Rails environment, adapters, framework settings |
 | Filesystem | Temporary/log path availability, writability, path separators, case sensitivity, symlink behavior |
+| Locale | Timezone name and UTC offset, default internal/external encodings, LANG / LC_ALL / charmap |
 | Rails boot | Framework configuration, autoload/eager-load paths, initializers, and opt-in initializer timings |
 | Docker | Image runtime, platforms, installed package metadata when available, workdir, entrypoint, command, permissions |
 
@@ -386,6 +396,34 @@ Bootprint is designed around these practical limits:
 
 Rails, Docker, SARIF, and plugin code are lazy-loaded so basic CLI use does not pay for integrations it does not invoke. Performance varies with Ruby, filesystem, dependency count, and host load.
 
+## VS Code extension
+
+Bootprint includes an Open VSX-ready editor extension in [`editors/vscode`](editors/vscode), available from the official [`theworker02.bootprint` Open VSX listing](https://open-vsx.org/extension/theworker02/bootprint). It provides capture, diagnose, doctor, and verify commands, streams CLI output inside the editor, and adds snapshot diagnosis to the Explorer context menu.
+
+Install it from an Open VSX-compatible editor or with VSCodium:
+
+```console
+codium --install-extension theworker02.bootprint
+```
+
+The extension uses the workspace bundle by default:
+
+```ruby
+gem "bootprint", "~> 0.2"
+```
+
+Build and install the versioned VSIX locally:
+
+```console
+cd editors/vscode
+npm install
+npm run check
+npm run package:vsix
+code --install-extension ../../pkg/bootprint-vscode-0.2.1.vsix --force
+```
+
+See the [editor extension guide](editors/vscode/README.md) for commands, configuration, trust behavior, Open VSX setup, and direct-executable setup.
+
 ## Documentation
 
 - [Installation](docs/installation.md)
@@ -403,6 +441,8 @@ Rails, Docker, SARIF, and plugin code are lazy-loaded so basic CLI use does not
 - [Snapshot schema](docs/snapshot-schema.md)
 - [Troubleshooting](docs/troubleshooting.md)
 - [Maintainer setup](docs/maintainer-setup.md)
+- [VS Code extension](editors/vscode/README.md)
+- [Open VSX publishing](docs/open-vsx.md)
 
 ## Development
 

data/RELEASE.md

@@ -54,8 +54,8 @@ The tag starts `.github/workflows/release.yml`, which:
 2. runs tests and RuboCop;
 3. builds, installs, and smoke-tests a preflight `.gem` from the tagged source;
 4. pauses at the protected `release` environment;
-5. rebuilds and publishes through the official RubyGems OIDC action;
-6. prints the published package's SHA-256 digest; and
+5. prints the release package's SHA-256 digest;
+6. rebuilds and publishes through the official RubyGems OIDC action; and
 7. creates a GitHub release with that same package attached.
 
 For 0.2.0, use the release title `Bootprint 0.2 — From Environment Differences to Actionable Diagnoses` when editing the generated GitHub release notes.
@@ -71,6 +71,22 @@ gem owner bootprint
 
 Confirm the RubyGems page shows the correct links, MIT license, Ruby requirement, MFA requirement, checksum, owners, and trusted publisher. Confirm the GitHub release attachment has the same SHA-256 digest as the workflow output.
 
+## Build and publish the Open VSX package
+
+Keep `editors/vscode/package.json` aligned with the intended extension release version. The extension depends on the Ruby gem at runtime but is versioned and distributed independently.
+
+```console
+cd editors/vscode
+npm ci
+npm run check
+npm run package:vsix
+code --install-extension ../../pkg/bootprint-vscode-VERSION.vsix
+```
+
+Before distributing the VSIX, inspect its contents with `vsce ls`, verify the bundled license and logo, and smoke-test capture and doctor commands in both Bundler and direct-executable modes. Follow [docs/open-vsx.md](docs/open-vsx.md) for the one-time `theworker02` namespace and protected token setup.
+
+Use the manual **Open VSX** workflow to build an artifact without publishing. Set its `publish` input only for an intentional registry release from a reviewed ref. Open VSX versions are immutable, so increment the extension version before every subsequent publication.
+
 ## Emergency and manual release policy
 
 Prefer rerunning a failed trusted-publishing job. A manual `gem push` is an emergency fallback only and must use an MFA-protected, least-privilege RubyGems API key from an approved maintainer workstation. Never store that key, an OTP, or a signing private key in the repository, workflow variables, shell history, or issue attachments.

data/data/advisories/schema/empty.json

@@ -0,0 +1,5 @@
+{
+  "schema_version": 1,
+  "generated_at": "2026-08-11T00:00:00Z",
+  "advisories": []
+}

data/docs/maintainer-setup.md

@@ -5,10 +5,10 @@ This checklist covers settings that cannot be represented completely by committe
 ## Repository profile
 
 - Description: `Diagnose why Ruby environments work locally but fail in CI, Docker, staging, or production.`
-- Website: `https://rubygems.org/gems/bootprint`
+- Website: `https://theworker02.github.io/bootprint/`
 - Topics: `ruby`, `rails`, `bundler`, `rubygems`, `docker`, `ci`, `diagnostics`, `reproducibility`, `developer-tools`
 - Default branch: `main`
-- Social preview: `assets/branding/bootprint-logo-512.png`
+- Social preview: `site/assets/bootprint-social.png`
 - Enable Issues and Discussions; disable the wiki unless maintainers intend to support it.
 
 ## Ruleset for `main`
@@ -24,6 +24,16 @@ This checklist covers settings that cannot be represented completely by committe
 
 CodeQL runs weekly or on explicit maintainer request rather than adding another check to every pull request.
 
+## GitHub Pages
+
+In **Settings → Pages**, set the publishing source to **GitHub Actions**. The focused `pages.yml` workflow deploys only the dependency-free files under `site/` when that directory changes or when a maintainer runs it manually.
+
+- Expected URL: `https://theworker02.github.io/bootprint/`
+- Deployment environment: `github-pages`
+- Allow deployments only from `main`.
+- Set the repository website field to the Pages URL after the first successful deployment.
+- Do not add a custom domain or `CNAME` until its DNS ownership is verified.
+
 ## Actions and security
 
 - Allow GitHub-authored actions plus `ruby/setup-ruby` and `rubygems/release-gem`.

data/docs/matrix.md

@@ -0,0 +1,28 @@
+# Multi-environment matrix
+
+Bootprint 0.3.0 can compare a fleet of named snapshots instead of only a local/target pair.
+
+```ruby
+matrix = Bootprint.matrix(
+  local: Bootprint::Snapshot.load("tmp/local.json"),
+  ci: Bootprint::Snapshot.load("tmp/ci.json"),
+  staging: Bootprint::Snapshot.load("tmp/staging.json"),
+  production: Bootprint::Snapshot.load("tmp/production.json")
+)
+
+matrix.entries.each do |entry|
+  puts "#{entry.path}: consensus=#{entry.consensus.inspect} outliers=#{entry.outliers.join(',')}"
+end
+```
+
+A matrix entry contains:
+
+- the deterministic dotted path;
+- values by environment;
+- environments where the path is missing;
+- a consensus value when a strict majority agrees;
+- the environments outside that consensus.
+
+`outlier_counts` ranks environments by the number of divergent paths. When no strict majority exists, every environment is reported as an outlier for that path instead of guessing which value is correct.
+
+Bootprint excludes the same non-semantic timestamps, labels, and capture metadata used by pairwise diffing.

data/docs/open-vsx.md

@@ -0,0 +1,45 @@
+# Open VSX publishing
+
+Bootprint's editor extension uses the Open VSX identifier [`theworker02.bootprint`](https://open-vsx.org/extension/theworker02/bootprint). Open VSX publication is separate from RubyGems and GitHub Releases.
+
+## One-time account setup
+
+1. Create an [Eclipse account](https://accounts.eclipse.org/user/register) and set its GitHub username to `theworker02`.
+2. Sign in to [Open VSX](https://open-vsx.org/) with that same GitHub account.
+3. From the Open VSX profile, connect the Eclipse account, read, and accept the Publisher Agreement.
+4. Generate a dedicated CI access token from [Open VSX Access Tokens](https://open-vsx.org/user-settings/tokens). Copy it immediately; Open VSX will not show it again.
+5. Load the token from a password manager into the trusted workstation's process environment as `OVSX_PAT`, then create the namespace once without placing the token in the command arguments:
+
+   ```console
+   npx ovsx create-namespace theworker02
+   ```
+
+6. Claim ownership of `theworker02` through the public process documented in the [Open VSX namespace guide](https://github.com/eclipse-openvsx/openvsx/wiki/Namespace-Access). Creating a namespace permits publishing, but claiming it is required for the registry's verified-owner indicator.
+
+Never commit, paste into an issue, or store the token in ordinary project configuration.
+
+## GitHub setup
+
+1. Create a GitHub environment named `open-vsx`.
+2. Add an environment secret named `OVSX_PAT` containing a dedicated Open VSX CI token.
+3. Add required reviewers to the environment so publication requires explicit approval.
+4. Restrict deployment branches or tags to reviewed release refs.
+
+The [Open VSX workflow](../.github/workflows/open-vsx.yml) is manual-only. Running it with `publish` disabled builds and retains a VSIX artifact for review. Running it with `publish` enabled enters the protected environment and uploads the already-tested package.
+
+## Local release gate
+
+```console
+cd editors/vscode
+npm ci
+npm run check
+npm run package:vsix
+```
+
+Inspect `pkg/bootprint-vscode-VERSION.vsix`, install it into an Open VSX-compatible editor, and test capture, diagnosis, doctor, and verify before publishing. For an intentional manual fallback, provide `OVSX_PAT` only through the process environment and run:
+
+```console
+npm run publish:openvsx
+```
+
+Do not publish the same version twice. Update `editors/vscode/package.json`, the lockfile, changelog, and documentation before publishing the next version.

data/lib/bootprint/advisories.rb

@@ -0,0 +1,118 @@
+# frozen_string_literal: true
+
+require "json"
+require_relative "advisory_bundle_matcher"
+
+module Bootprint
+  # Matches snapshot gem versions against an offline advisory bundle.
+  class Advisories
+    DEFAULT_BUNDLE = File.expand_path("../../data/advisories/schema/empty.json", __dir__).freeze
+
+    Advisory = Struct.new(:id, :gem, :title, :severity, :affected_versions, :url, :cve, keyword_init: true) do
+      def to_h
+        {
+          "id" => id,
+          "gem" => gem,
+          "title" => title,
+          "severity" => severity,
+          "affected_versions" => affected_versions,
+          "url" => url,
+          "cve" => cve
+        }.compact
+      end
+    end
+
+    Match = Struct.new(:gem, :version, :advisory, keyword_init: true) do
+      def to_h
+        {
+          "gem" => gem,
+          "version" => version,
+          "advisory" => advisory.to_h
+        }
+      end
+    end
+
+    attr_reader :bundle
+
+    def self.load(path = DEFAULT_BUNDLE)
+      parsed = JSON.parse(File.read(path, encoding: "UTF-8"))
+      new(parsed, path:)
+    rescue JSON::ParserError => error
+      raise InvalidSnapshotError, "#{File.expand_path(path)} is not valid advisory JSON: #{error.message}"
+    rescue Errno::ENOENT
+      raise InvalidSnapshotError, "Advisory bundle not found: #{File.expand_path(path)}"
+    end
+
+    def self.match(snapshot, bundle: DEFAULT_BUNDLE)
+      advisories(bundle).matches(snapshot)
+    end
+
+    def self.advisories(bundle = DEFAULT_BUNDLE)
+      case bundle
+      when Advisories then bundle
+      when Hash then new(bundle)
+      else load(bundle)
+      end
+    end
+
+    def initialize(bundle, path: nil)
+      @bundle = normalize_bundle(bundle)
+      @path = path
+    end
+
+    def matches(snapshot)
+      gems = extract_gems(snapshot)
+      bundle_advisories.flat_map do |advisory|
+        installed = gems[advisory.gem]
+        next [] unless installed
+
+        version = installed.is_a?(Hash) ? installed["version"] : installed
+        next [] unless version && AdvisoryBundleMatcher.version_satisfies?(version, advisory.affected_versions)
+
+        Match.new(gem: advisory.gem, version: version.to_s, advisory:)
+      end
+    end
+
+    def clean?(snapshot) = matches(snapshot).empty?
+
+    def to_h(snapshot = nil)
+      matches = snapshot ? matches(snapshot) : []
+      {
+        "schema_version" => bundle.fetch("schema_version", 1),
+        "bundle" => @path || "inline",
+        "clean" => matches.empty?,
+        "matches" => matches.map(&:to_h)
+      }
+    end
+
+    private
+
+    def bundle_advisories
+      Array(bundle["advisories"]).map do |entry|
+        Advisory.new(
+          id: entry.fetch("id"),
+          gem: entry.fetch("gem"),
+          title: entry["title"] || entry.fetch("id"),
+          severity: entry["severity"] || "unknown",
+          affected_versions: AdvisoryBundleMatcher.normalize_versions(entry["affected_versions"] || entry["versions"]),
+          url: entry["url"],
+          cve: entry["cve"]
+        )
+      end
+    end
+
+    def extract_gems(snapshot)
+      data = snapshot.is_a?(Snapshot) ? snapshot.data : snapshot
+      gems = data.dig("environment", "dependencies", "gems") || {}
+      gems.transform_keys(&:to_s)
+    end
+
+    def normalize_bundle(bundle)
+      case bundle
+      when Hash then bundle.transform_keys(&:to_s)
+      when String then self.class.load(bundle).bundle
+      else raise ArgumentError, "bundle must be a Hash or path"
+      end
+    end
+  end
+end

data/lib/bootprint/advisory_bundle_matcher.rb

@@ -0,0 +1,39 @@
+# frozen_string_literal: true
+
+require "rubygems"
+
+module Bootprint
+  module AdvisoryBundleMatcher
+    module_function
+
+    def normalize_versions(value)
+      case value
+      when nil then []
+      when Array then value.map(&:to_s)
+      else [value.to_s]
+      end
+    end
+
+    def version_satisfies?(version, constraints)
+      constraints = normalize_versions(constraints)
+      return true if constraints.empty?
+
+      gem_version = Gem::Version.new(version.to_s)
+      Gem::Requirement.new(constraints).satisfied_by?(gem_version)
+    rescue ArgumentError
+      false
+    end
+
+    def value_in_set?(value, allowed)
+      case allowed
+      when nil then true
+      when Array then allowed.any? { |item| values_equal?(value, item) }
+      else values_equal?(value, allowed)
+      end
+    end
+
+    def values_equal?(left, right)
+      left == right || left.to_s == right.to_s
+    end
+  end
+end

data/lib/bootprint/cli.rb

@@ -37,6 +37,7 @@ module Bootprint
       when "docker" then docker_command
       when "ci" then ci_command
       when "security" then security_command
+      when "advisories" then advisories_command
       when "version", "--version", "-v" then version
       when "help", "--help", "-h", nil then help(EXIT_OK)
       else
@@ -294,6 +295,34 @@ module Bootprint
       issues.empty? ? EXIT_OK : EXIT_POLICY
     end
 
+    def advisories_command
+      options = { format: "human", bundle: Bootprint::Advisories::DEFAULT_BUNDLE }
+      parser = OptionParser.new do |opts|
+        opts.banner = "Usage: bootprint advisories SNAPSHOT [--bundle PATH] [--format human|json]"
+        opts.on("--bundle PATH", "Offline advisory bundle JSON") { |value| options[:bundle] = value }
+        opts.on("--format FORMAT", %w[human json]) { |value| options[:format] = value }
+      end
+      return EXIT_OK unless parse_options(parser)
+
+      reference = @argv.shift or raise OptionParser::MissingArgument, "SNAPSHOT is required"
+      reject_extra_arguments!
+      snapshot = load_snapshot(reference)
+      bundle = Bootprint::Advisories.load(options[:bundle])
+      matches = bundle.matches(snapshot)
+      if options[:format] == "json"
+        @out.puts JSON.pretty_generate(bundle.to_h(snapshot))
+      elsif matches.empty?
+        @out.puts "Advisory check passed: no known vulnerabilities in bundled advisories."
+      else
+        @out.puts "Advisory check found #{matches.length} affected gem(s):"
+        matches.each do |match|
+          advisory = match.advisory
+          @out.puts "#{advisory.severity.to_s.upcase} #{match.gem} #{match.version}: #{advisory.title} (#{advisory.id})"
+        end
+      end
+      matches.empty? ? EXIT_OK : EXIT_POLICY
+    end
+
     def report_options
       { format: "human", allows: [], policy: default_policy_path, only: nil, minimum: nil }
     end
@@ -407,7 +436,7 @@ module Bootprint
       raise OptionParser::InvalidArgument, "NAME may contain only letters, numbers, dots, underscores, and hyphens" unless valid
     end
 
-    def safe_name(value) = value.to_s.gsub(/[^a-zA-Z0-9_.-]+/, "-").gsub(/\A-+|-+\z/, "")
+    def safe_name(value) = value.to_s.gsub(/[^a-zA-Z0-9_.-]+/, "-").gsub(/\A-++|-++\z/, "")
 
     def reject_extra_arguments!
       raise OptionParser::ParseError, "unexpected arguments: #{@argv.join(' ')}" unless @argv.empty?
@@ -449,6 +478,7 @@ module Bootprint
           docker COMMAND          Capture, compare, or diagnose a local Docker image
           ci verify               Verify with CI-native annotations
           security audit          Audit a snapshot for sensitive data
+          advisories SNAPSHOT     Match gems against offline advisories
 
         Run `bootprint COMMAND --help` for command-specific options.
       HELP

data/lib/bootprint/collectors/operating_system.rb

@@ -19,7 +19,10 @@ module Bootprint
           "processors" => Etc.nprocessors,
           "capabilities" => TOOLS.to_h { |tool| [tool, executable?(tool)] },
           "ruby_headers" => header_state,
-          "ci" => ci_provider
+          "ci" => ci_provider,
+          "timezone" => timezone_state,
+          "encoding" => encoding_state,
+          "locale" => locale_state
         }
       end
 
@@ -45,6 +48,30 @@ module Bootprint
 
         nil
       end
+
+      def timezone_state
+        now = Time.now
+        {
+          "name" => now.zone,
+          "utc_offset" => now.utc_offset,
+          "tz" => ENV.fetch("TZ", nil)
+        }
+      end
+
+      def encoding_state
+        {
+          "external" => Encoding.default_external.name,
+          "internal" => Encoding.default_internal&.name
+        }
+      end
+
+      def locale_state
+        {
+          "lang" => ENV.fetch("LANG", nil),
+          "lc_all" => ENV.fetch("LC_ALL", nil),
+          "charmap" => Encoding.locale_charmap
+        }
+      end
     end
   end
 end

data/lib/bootprint/matrix.rb

@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+module Bootprint
+  # Compares two or more snapshots to find consensus values and outlier environments.
+  class Matrix
+    # :values is the matrix cell payload; the name mirrors the JSON "values" key.
+    Entry = Struct.new(:path, :values, :missing, :consensus, :outliers, keyword_init: true) do # rubocop:disable Lint/StructNewOverride
+      def consensus?
+        !consensus.nil?
+      end
+
+      def to_h
+        {
+          "path" => path,
+          "values" => values,
+          "missing" => missing,
+          "consensus" => consensus,
+          "outliers" => outliers
+        }
+      end
+    end
+
+    attr_reader :snapshots
+
+    def initialize(snapshots)
+      @snapshots = snapshots.to_h.transform_keys(&:to_s).transform_values do |snapshot|
+        snapshot.is_a?(Snapshot) ? snapshot.semantic_data : snapshot
+      end.freeze
+      raise ArgumentError, "matrix requires at least two named snapshots" if @snapshots.length < 2
+    end
+
+    def entries
+      @entries ||= begin
+        flattened = snapshots.transform_values { |data| flatten(data) }
+        paths = flattened.values.flat_map(&:keys).uniq.sort.reject { |path| ignored?(path) }
+        paths.filter_map do |path|
+          values = {}
+          missing = []
+          flattened.each do |name, data|
+            data.key?(path) ? values[name] = data[path] : missing << name
+          end
+          distinct = values.values.map { |value| canonical(value) }.uniq.length
+          next if distinct <= 1 && missing.empty?
+
+          consensus = consensus_value(values, snapshots.length)
+          outliers = if consensus.nil?
+                       snapshots.keys.sort
+                     else
+                       (values.filter_map { |name, value| name unless value == consensus } + missing).sort
+                     end
+          Entry.new(path:, values: values.sort.to_h, missing: missing.sort, consensus:, outliers:)
+        end
+      end
+    end
+
+    def clean?
+      entries.empty?
+    end
+
+    def outlier_counts
+      counts = snapshots.keys.to_h { |name| [name, 0] }
+      entries.each { |entry| entry.outliers.each { |name| counts[name] += 1 } }
+      counts.sort.to_h
+    end
+
+    def to_h
+      {
+        "schema" => 1,
+        "environments" => snapshots.keys.sort,
+        "clean" => clean?,
+        "outlier_counts" => outlier_counts,
+        "entries" => entries.map(&:to_h)
+      }
+    end
+
+    private
+
+    def flatten(value, prefix = nil, output = {})
+      if value.is_a?(Hash)
+        value.keys.sort_by(&:to_s).each do |original_key|
+          key = original_key.to_s
+          path = [prefix, key].compact.join(".")
+          flatten(value.fetch(original_key), path, output)
+        end
+      else
+        output[prefix] = value
+      end
+      output
+    end
+
+    def ignored?(path)
+      Diff::IGNORED_PATHS.include?(path) || path == "capture" || path.start_with?("capture.")
+    end
+
+    def consensus_value(values, total)
+      groups = values.values.group_by { |value| canonical(value) }
+      winner = groups.max_by { |key, grouped| [grouped.length, key] }
+      return nil unless winner && winner.last.length > total / 2
+
+      winner.last.first
+    end
+
+    def canonical(value)
+      Marshal.dump(value)
+    rescue TypeError
+      value.inspect
+    end
+  end
+end

data/lib/bootprint/rules/builtin.rb

@@ -58,6 +58,24 @@ module Bootprint
              fix: "Use a standard release build for production.") do |_source, target|
           dig(target, "runtime.debug_build") == true && { "description" => dig(target, "runtime.description") }
         end
+        rule("timezone-drift", "Timezone mismatch", :runtime, :warning,
+             cause: "The environments select different timezones.",
+             impact: "Time.now, cron, and timestamp formatting can disagree across machines.",
+             fix: "Set TZ consistently in local, container, and CI environments.") do |source, target|
+          difference(source, target, "operating_system.timezone")
+        end
+        rule("encoding-drift", "Default encoding mismatch", :runtime, :warning,
+             cause: "Ruby default encodings differ between environments.",
+             impact: "String transcoding, file IO, and JSON payloads can fail only in one environment.",
+             fix: "Align Encoding.default_external (and LANG/LC_ALL) with the deployment runtime.") do |source, target|
+          difference(source, target, "operating_system.encoding")
+        end
+        rule("locale-drift", "Locale mismatch", :runtime, :info,
+             cause: "LANG / LC_ALL / locale charmap differ between environments.",
+             impact: "Sort order, number formatting, and encoding defaults can change.",
+             fix: "Export the same LANG and LC_ALL in every environment.") do |source, target|
+          difference(source, target, "operating_system.locale")
+        end
       end
 
       def dependency_rules

data/lib/bootprint/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bootprint
-  VERSION = "0.2.0"
+  VERSION = "0.5.0"
 end

data/lib/bootprint.rb

@@ -8,6 +8,8 @@ require_relative "bootprint/schema"
 require_relative "bootprint/plugins"
 require_relative "bootprint/snapshot"
 require_relative "bootprint/diff"
+require_relative "bootprint/matrix"
+require_relative "bootprint/advisories"
 require_relative "bootprint/doctor"
 require_relative "bootprint/policy"
 
@@ -28,6 +30,19 @@ module Bootprint
     def capture(label: nil, **options)
       Snapshot.capture(label:, **options)
     end
+
+    # Compares named snapshots and identifies consensus values and outliers.
+    def matrix(snapshots)
+      Matrix.new(snapshots)
+    end
+
+    def advisories(snapshot, bundle: Advisories::DEFAULT_BUNDLE)
+      Advisories.advisories(bundle).matches(snapshot)
+    end
+
+    def advise(snapshot, bundle: Advisories::DEFAULT_BUNDLE)
+      advisories(snapshot, bundle:)
+    end
   end
 end
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bootprint
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.5.0
 platform: ruby
 authors:
 - Magnexis
@@ -34,6 +34,7 @@ files:
 - assets/branding/bootprint-logo-512.png
 - assets/branding/bootprint-logo-64.png
 - assets/branding/bootprint-logo.png
+- data/advisories/schema/empty.json
 - docs/capturing.md
 - docs/ci.md
 - docs/comparing.md
@@ -42,6 +43,8 @@ files:
 - docs/findings.md
 - docs/installation.md
 - docs/maintainer-setup.md
+- docs/matrix.md
+- docs/open-vsx.md
 - docs/plugins.md
 - docs/policy.md
 - docs/privacy.md
@@ -51,6 +54,8 @@ files:
 - docs/troubleshooting.md
 - exe/bootprint
 - lib/bootprint.rb
+- lib/bootprint/advisories.rb
+- lib/bootprint/advisory_bundle_matcher.rb
 - lib/bootprint/analysis.rb
 - lib/bootprint/cli.rb
 - lib/bootprint/collectors/environment.rb
@@ -73,6 +78,7 @@ files:
 - lib/bootprint/formatters/markdown.rb
 - lib/bootprint/formatters/sarif.rb
 - lib/bootprint/initializer_profiler.rb
+- lib/bootprint/matrix.rb
 - lib/bootprint/plugins.rb
 - lib/bootprint/policy.rb
 - lib/bootprint/rails_state.rb
@@ -88,12 +94,12 @@ files:
 - lib/bootprint/snapshot.rb
 - lib/bootprint/version.rb
 - lib/tasks/bootprint.rake
-homepage: https://github.com/theworker02/bootprint
+homepage: https://theworker02.github.io/bootprint/
 licenses:
 - MIT
 metadata:
   source_code_uri: https://github.com/theworker02/bootprint/tree/main
-  homepage_uri: https://github.com/theworker02/bootprint
+  homepage_uri: https://theworker02.github.io/bootprint/
   documentation_uri: https://github.com/theworker02/bootprint/tree/main/docs
   changelog_uri: https://github.com/theworker02/bootprint/blob/main/CHANGELOG.md
   bug_tracker_uri: https://github.com/theworker02/bootprint/issues