gem-guardian 0.3.0 → 0.4.0

data/lib/gem/guardian.rb

@@ -7,6 +7,8 @@
 require_relative "guardian/version"
 require_relative "guardian/error"
 require_relative "guardian/checksum"
+require_relative "guardian/checksum_provider"
+require_relative "guardian/configuration"
 require_relative "guardian/dependency"
 require_relative "guardian/lockfile_parser"
 require_relative "guardian/rubygems_client"
@@ -16,5 +18,7 @@ require_relative "guardian/artifact_store"
 require_relative "guardian/verifier"
 require_relative "guardian/provenance_verifier"
 require_relative "guardian/report_builder"
+require_relative "guardian/registry"
+require_relative "guardian/registry_audit"
 require_relative "guardian/result_printer"
 require_relative "guardian/cli"

data/script/registry_provenance_audit.rb

@@ -0,0 +1,41 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+$LOAD_PATH.unshift(File.expand_path("../lib", __dir__))
+
+require "gem/guardian"
+
+limit = ENV.fetch("MAX_GEMS", nil)&.to_i
+source = ENV.fetch("REGISTRY_SOURCE", nil)
+sources = source ? [source] : Gem.sources
+
+registry = Gem::Guardian::Registry.new(sources:)
+audit = Gem::Guardian::RegistryAudit.new(registry:)
+result = audit.run(limit:)
+counts = result.counts
+
+puts "Registry provenance audit"
+puts
+puts "Sources:"
+Array(sources.respond_to?(:to_a) ? sources.to_a : sources).each do |configured_source|
+  uri = configured_source.respond_to?(:uri) ? configured_source.uri : configured_source
+  puts "- #{uri}"
+end
+puts
+puts "Latest gems scanned: #{result.total}"
+puts
+puts "Provenance:"
+puts "  verified:    #{counts.fetch(:verified, 0)}"
+puts "  unsupported: #{counts.fetch(:unsupported, 0)}"
+puts "  mismatch:    #{counts.fetch(:mismatch, 0)}"
+puts "  error:       #{counts.fetch(:error, 0)}"
+
+unless result.unsupported.empty?
+  puts
+  puts "Unsupported:"
+  result.unsupported.first(50).each do |entry_result|
+    dependency = entry_result.dependency
+    puts "- #{dependency.name} #{dependency.version} #{dependency.platform}"
+  end
+  puts "..." if result.unsupported.size > 50
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gem-guardian
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.4.0
 platform: ruby
 authors:
 - Kenneth Demanawa
@@ -9,10 +9,10 @@ bindir: exe
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies: []
-description: 'Audits Bundler checksum coverage and verifies Ruby gem artifacts against
-  RubyGems SHA256 checksums when needed.
-
-  '
+description: |
+  Verifies gem integrity using lockfile, registry, and artifact checksums,
+  audits Bundler checksum coverage, and reports supply-chain provenance
+  when available.
 email:
 - kenneth.c.demanawa@gmail.com
 executables:
@@ -20,7 +20,7 @@ executables:
 extensions: []
 extra_rdoc_files: []
 files:
-- ".github/workflows/main.yml"
+- ".github/workflows/ci.yml"
 - ".github/workflows/pages.yml"
 - ".github/workflows/release.yml"
 - ".gitignore"
@@ -40,34 +40,31 @@ files:
 - lib/gem/guardian.rb
 - lib/gem/guardian/artifact_store.rb
 - lib/gem/guardian/checksum.rb
+- lib/gem/guardian/checksum_provider.rb
 - lib/gem/guardian/cli.rb
+- lib/gem/guardian/configuration.rb
 - lib/gem/guardian/dependency.rb
 - lib/gem/guardian/error.rb
 - lib/gem/guardian/github_client.rb
 - lib/gem/guardian/github_release_verifier.rb
 - lib/gem/guardian/lockfile_parser.rb
+- lib/gem/guardian/progress.rb
 - lib/gem/guardian/provenance_verifier.rb
+- lib/gem/guardian/registry.rb
+- lib/gem/guardian/registry_audit.rb
 - lib/gem/guardian/report_builder.rb
 - lib/gem/guardian/result_printer.rb
 - lib/gem/guardian/rubygems_client.rb
 - lib/gem/guardian/verifier.rb
 - lib/gem/guardian/version.rb
 - mise.toml
-- sig/gem/guardian.rbs
-- sig/gem/guardian/artifact_store.rbs
-- sig/gem/guardian/checksum.rbs
-- sig/gem/guardian/cli.rbs
-- sig/gem/guardian/dependency.rbs
-- sig/gem/guardian/error.rbs
-- sig/gem/guardian/lockfile_parser.rbs
-- sig/gem/guardian/rubygems_client.rbs
-- sig/gem/guardian/verifier.rbs
-- sig/gem/guardian/version.rbs
-homepage: https://github.com/kanutocd/gem-guardian
+- script/registry_provenance_audit.rb
+homepage: https://kanutocd.github.io/gem-guardian
 licenses:
 - MIT
 metadata:
-  homepage_uri: https://github.com/kanutocd/gem-guardian
+  homepage_uri: https://kanutocd.github.io/gem-guardian
+  documentation_uri: https://kanutocd.github.io/gem-guardian
   source_code_uri: https://github.com/kanutocd/gem-guardian
   changelog_uri: https://github.com/kanutocd/gem-guardian/blob/main/CHANGELOG.md
   rubygems_mfa_required: 'true'
@@ -87,5 +84,5 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 rubygems_version: 3.6.9
 specification_version: 4
-summary: Consumer-side integrity verification for Ruby gems.
+summary: Gem integrity and supply-chain verification for Ruby.
 test_files: []

data/sig/gem/guardian/artifact_store.rbs

@@ -1,22 +0,0 @@
-module Gem
-  module Guardian
-    class ArtifactStore
-      @client: untyped
-
-      @cache_dir: untyped
-
-      def initialize: (client: untyped, ?cache_dir: untyped) -> void
-
-      def path_for: (untyped dependency) -> untyped
-    end
-  end
-end
-module Gem
-  module Guardian
-    class ArtifactStore
-      def initialize: (client: RubygemsClient, ?cache_dir: String) -> void
-
-      def path_for: (Dependency dependency) -> String
-    end
-  end
-end

data/sig/gem/guardian/checksum.rbs

@@ -1,14 +0,0 @@
-module Gem
-  module Guardian
-    module Checksum
-      def self?.sha256_file: (untyped path) -> untyped
-    end
-  end
-end
-module Gem
-  module Guardian
-    module Checksum
-      def self.sha256_file: (String path) -> String
-    end
-  end
-end

data/sig/gem/guardian/cli.rbs

@@ -1,60 +0,0 @@
-module Gem
-  module Guardian
-    class CLI
-      @argv: untyped
-
-      @stdout: untyped
-
-      @stderr: untyped
-
-      def self.start: (untyped argv) -> untyped
-
-      def initialize: (untyped argv, ?stdout: untyped, ?stderr: untyped) -> void
-
-      def run: () -> untyped
-
-      private
-
-      def verify: () -> untyped
-
-      def parse_gem_spec: (untyped spec) -> untyped
-
-      def option_value: (untyped name) -> (nil | untyped)
-
-      def print_results: (untyped results) -> untyped
-
-      def usage: (?untyped io) -> untyped
-    end
-  end
-end
-module Gem
-  module Guardian
-    class CLI
-      @argv: untyped
-
-      @stdout: untyped
-
-      @stderr: untyped
-
-      def self.start: (untyped argv) -> untyped
-
-      def initialize: (untyped argv, ?stdout: untyped, ?stderr: untyped, ?verifier_class: untyped, ?lockfile_parser_class: untyped) -> void
-
-      def run: () -> untyped
-
-      private
-
-      def verify: () -> untyped
-
-      def parse_gem_spec: (String spec) -> Dependency
-
-      def option_value: (String name) -> (String?)
-
-      def print_results: (untyped results, lockfile_mode: bool) -> void
-
-      def print_lockfile_coverage: (untyped lockfile_data) -> void
-
-      def usage: (?untyped io) -> void
-    end
-  end
-end

data/sig/gem/guardian/dependency.rbs

@@ -1,18 +0,0 @@
-module Gem
-  module Guardian
-    Dependency: untyped
-  end
-end
-module Gem
-  module Guardian
-    class Dependency
-      attr_reader name: String
-
-      attr_reader version: String
-
-      attr_reader platform: String?
-
-      def gem_filename: () -> String
-    end
-  end
-end

data/sig/gem/guardian/error.rbs

@@ -1,26 +0,0 @@
-module Gem
-  module Guardian
-    Error: untyped
-
-    ChecksumNotFound: untyped
-
-    ArtifactFetchError: untyped
-
-    LockfileError: untyped
-  end
-end
-module Gem
-  module Guardian
-    class Error < StandardError
-    end
-
-    class ChecksumNotFound < Error
-    end
-
-    class ArtifactFetchError < Error
-    end
-
-    class LockfileError < Error
-    end
-  end
-end

data/sig/gem/guardian/lockfile_parser.rbs

@@ -1,55 +0,0 @@
-module Gem
-  module Guardian
-    class LockfileParser
-      @path: untyped
-
-      GEM_LINE: ::Regexp
-
-      def initialize: (?::String path) -> void
-
-      def dependencies: () -> untyped
-
-      private
-
-      # Bundler renders native platforms as `1.2.3-x86_64-linux` in the spec line.
-      # Ruby versions remain plain, for example `1.2.3`.
-      def split_version_and_platform: (untyped value) -> ::Array[untyped]
-    end
-  end
-end
-module Gem
-  module Guardian
-    class LockfileParser
-      GEM_LINE: ::Regexp
-      CHECKSUM_LINE: ::Regexp
-
-      class LockfileData
-        attr_reader dependencies: ::Array[Dependency]
-
-        attr_reader checksums: ::Hash[Dependency, ::Hash[String, String]]
-
-        attr_reader checksums_section_present: bool
-
-        def checksum_for: (Dependency dependency, ?String algorithm) -> String?
-
-        def sha256_checksums: () -> ::Hash[Dependency, String]
-
-        def missing_checksum_dependencies: () -> ::Array[Dependency]
-
-        def checksums_present?: () -> bool
-      end
-
-      def initialize: (?String path) -> void
-
-      def parse: () -> LockfileData
-
-      def dependencies: () -> ::Array[Dependency]
-
-      def checksums: () -> ::Hash[Dependency, ::Hash[String, String]]
-
-      private
-
-      def split_version_and_platform: (String value) -> ::Array[String]
-    end
-  end
-end

data/sig/gem/guardian/rubygems_client.rbs

@@ -1,46 +0,0 @@
-module Gem
-  module Guardian
-    class RubygemsClient
-      @host: untyped
-
-      @http: untyped
-
-      DEFAULT_HOST: "https://rubygems.org"
-
-      def initialize: (?host: untyped, ?http: untyped) -> void
-
-      def expected_sha256: (untyped dependency) -> untyped
-
-      def download_gem: (untyped dependency, untyped destination) -> untyped
-
-      private
-
-      def get: (untyped path) -> untyped
-
-      def platform_matches?: (untyped remote_platform, untyped wanted_platform) -> untyped
-
-      def blank?: (untyped value) -> untyped
-    end
-  end
-end
-module Gem
-  module Guardian
-    class RubygemsClient
-      DEFAULT_HOST: String
-
-      def initialize: (?host: String, ?http: untyped) -> void
-
-      def expected_sha256: (Dependency dependency) -> String
-
-      def download_gem: (Dependency dependency, String destination) -> String
-
-      private
-
-      def get: (String path) -> String
-
-      def platform_matches?: (untyped remote_platform, untyped wanted_platform) -> bool
-
-      def blank?: (untyped value) -> bool
-    end
-  end
-end

data/sig/gem/guardian/verifier.rbs

@@ -1,40 +0,0 @@
-module Gem
-  module Guardian
-    VerificationResult: untyped
-
-    class Verifier
-      @client: untyped
-
-      @artifact_store: untyped
-
-      def initialize: (?client: untyped, ?artifact_store: untyped?) -> void
-
-      def verify: (untyped dependency) -> untyped
-
-      def verify_all: (untyped dependencies) -> untyped
-
-      private
-
-      def secure_compare: (untyped left, untyped right) -> (false | untyped)
-    end
-  end
-end
-module Gem
-  module Guardian
-    VerificationResult: untyped
-
-    class Verifier
-      def initialize: (?client: RubygemsClient, ?artifact_store: ArtifactStore?, ?expected_checksums: ::Hash[Dependency, String]) -> void
-
-      def verify: (Dependency dependency) -> untyped
-
-      def verify_all: (::Array[Dependency] dependencies) -> ::Array[untyped]
-
-      private
-
-      def secure_compare: (String left, String right) -> bool
-
-      def expected_sha256_for: (Dependency dependency) -> ::Array[untyped]
-    end
-  end
-end

data/sig/gem/guardian/version.rbs

@@ -1,10 +0,0 @@
-module Gem
-  module Guardian
-    VERSION: "0.1.0"
-  end
-end
-module Gem
-  module Guardian
-    VERSION: String
-  end
-end

data/sig/gem/guardian.rbs

@@ -1,4 +0,0 @@
-module Gem
-  module Guardian
-  end
-end