leakferret 0.1.4 → 0.1.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 201cda08594a8bc6101f6b37f456693eaebd794b7fe6df3b6f2b2bc7cafc2834
-  data.tar.gz: 5487023f2a3d58a2e663a045feb2b1b6dcedfb35217b499c69ac7dcda869ed27
+  metadata.gz: 9be1f2733f2b3a412f0c2511948949d402256ad0ecb3dc2f064d986c4cfb9ba0
+  data.tar.gz: aafb9746aef318b1134bafa91f070560e03a3fe742e7a6f6a0dfa4a6ebe6f3f8
 SHA512:
-  metadata.gz: 7b4a92c0e4b2a7ee135fb3dc03e846e6ce60fb9cc5211227188b7745af012c18b56062fbe26e288380529cd71eaa26c1aa6e8af5a398ff4cb8b041c9c5293563
-  data.tar.gz: 9478d9afba4e65e4fa0c9c15c943685f78eee187a073681662fbd408e4f23cedaced29fb979bef722349d06f080dd39bb11ce0808438f83cdedf39f64f3fd06b
+  metadata.gz: 3ef7e9118364341afce01bd53bc7f3063edffc4a9a5fba0538612f99221567239bf7493b23fb44d8b0f683899af058b3c6f7ab6025fbeb26f06ed0f059b25fd2
+  data.tar.gz: b889e172c85d72cc5a077e89b522f359ad8bb1bc801f4a2ddb2850885942055e32667eec7923c45802486bc6540e54e6b94ee604756e6eae7a5ef60fbc3d9822

data/README.md

@@ -6,6 +6,10 @@
 
 > MCP-native secret scanner — verified findings, agent-applied rewrites.
 
+<p align="center">
+  <img src="https://raw.githubusercontent.com/leakferrethq/leakferret/master/brand/demo.gif" alt="leakferret finds, verifies, and rewrites a leaked secret" width="760">
+</p>
+
 Ruby gem wrapper around the native [`leakferret`](https://github.com/leakferrethq/leakferret)
 binary. This gem ships no scanning logic of its own: it installs a tiny Ruby
 shim plus a small executable, and downloads the prebuilt, statically-linked

data/lib/leakferret/binary.rb

@@ -18,6 +18,20 @@ module Leakferret
     # A binary vendored inside the gem, if one was shipped (normally empty).
     BUNDLED_DIR = Pathname.new(__dir__).join('bin').freeze
 
+    # SHA256 of each release tarball, pinned to BINARY_VERSION. The download is
+    # verified against these before the archive is ever unpacked, so a tampered
+    # or corrupted release asset is rejected instead of being executed. Because
+    # the digests live in the gem source, auditing the published gem tells you
+    # exactly which binary bytes it will run. Regenerate on every binary bump
+    # from the release's `*.tar.gz.sha256` files.
+    CHECKSUMS = {
+      'aarch64-apple-darwin'     => '62d7152954e3e2e50d8423c8a1e792ba1783123b8a9d8c5fbc2a71013e890992',
+      'aarch64-pc-windows-msvc'  => '6ad3eb20a661579c11857259159f8fb55b26f72608c75ecc206fff5f9da9c800',
+      'x86_64-apple-darwin'      => 'd8b28edf427b975412458007069a848e16cea45825e43dff3652bdcd3fd3f1d3',
+      'x86_64-pc-windows-msvc'   => 'f447424f148a6874dc2ead208eb460a9f6b20d6ddbce6f74ca9b2d47655e1b2b',
+      'x86_64-unknown-linux-gnu' => 'bf24746f1188d14b2b420e760ebd374a4f88a68ea1b718e7977d8c7309a9f1da'
+    }.freeze
+
     module_function
 
     # Absolute path to the native binary, downloading it on first use if
@@ -77,23 +91,44 @@ module Leakferret
       require 'fileutils'
       require 'open-uri'
       require 'zlib'
+      require 'digest'
+      require 'stringio'
       require 'rubygems/package'
 
+      expected = CHECKSUMS[Platform.triple]
+      if expected.nil?
+        raise BinaryNotFoundError,
+              "no pinned checksum for platform #{Platform.triple}; refusing to run an " \
+              'unverified binary. Build from source and set LEAKFERRET_BIN instead.'
+      end
+
       FileUtils.mkdir_p(dest.dirname)
-      # Stream download -> gunzip -> untar in pure Ruby (no external `tar`,
-      # which on Windows mis-reads `C:\` as a remote host). The archive nests
-      # everything under leakferret-<version>-<triple>/, so match by basename.
+
+      # Download the whole tarball, verify its SHA256 against the pinned value,
+      # and only then unpack. Nothing is written to the cache (let alone marked
+      # executable) until the bytes match, so a tampered or truncated release
+      # asset is rejected rather than run.
+      tarball = URI.open(download_url, &:read) # rubocop:disable Security/Open
+      actual = Digest::SHA256.hexdigest(tarball)
+      unless actual.casecmp?(expected)
+        raise BinaryNotFoundError,
+              "checksum mismatch for #{download_url}\n" \
+              "  expected #{expected}\n  got      #{actual}\n" \
+              'Refusing to install a binary that does not match the pinned hash.'
+      end
+
+      # Unpack in pure Ruby (no external `tar`, which on Windows mis-reads `C:\`
+      # as a remote host). The archive nests everything under
+      # leakferret-<version>-<triple>/, so match by basename.
       found = false
-      URI.open(download_url) do |io| # rubocop:disable Security/Open
-        Zlib::GzipReader.wrap(io) do |gz|
-          Gem::Package::TarReader.new(gz) do |tar|
-            tar.each do |entry|
-              next unless entry.file?
-              next unless File.basename(entry.full_name) == Platform.binary_name
-
-              File.binwrite(dest, entry.read)
-              found = true
-            end
+      Zlib::GzipReader.wrap(StringIO.new(tarball)) do |gz|
+        Gem::Package::TarReader.new(gz) do |tar|
+          tar.each do |entry|
+            next unless entry.file?
+            next unless File.basename(entry.full_name) == Platform.binary_name
+
+            File.binwrite(dest, entry.read)
+            found = true
           end
         end
       end

data/lib/leakferret/version.rb

@@ -2,10 +2,10 @@
 
 module Leakferret
   # The gem's own version.
-  VERSION = '0.1.4'
+  VERSION = '0.1.6'
 
   # The native binary release this gem downloads. Tracks the leakferret
   # core release, which may move independently of the gem's own version
   # (e.g. a gem-only bugfix).
-  BINARY_VERSION = '0.1.2'
+  BINARY_VERSION = '0.1.3'
 end

metadata

@@ -1,13 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: leakferret
 version: !ruby/object:Gem::Version
-  version: 0.1.4
+  version: 0.1.6
 platform: ruby
 authors:
 - Maria Khan
+autorequire:
 bindir: exe
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-06-01 00:00:00.000000000 Z
 dependencies: []
 description: |
   Context-aware secret scanning for Ruby projects. A thin wrapper around the
@@ -44,6 +45,7 @@ metadata:
   source_code_uri: https://github.com/leakferrethq/leakferret-ruby
   changelog_uri: https://github.com/leakferrethq/leakferret-ruby/blob/main/CHANGELOG.md
   rubygems_mfa_required: 'true'
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -58,7 +60,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 3.5.22
+signing_key:
 specification_version: 4
 summary: Context-aware secret detection (Ruby wrapper for the leakferret binary).
 test_files: []