leakferret 0.1.5 → 0.1.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 76c68f883d5148243bbbc769400108fd4acab2dbedfbe4356bc62ffb1ddbd2c7
-  data.tar.gz: e9452a82c26c262c521b7810ff7f4db37194c2b6dccfab3536ca602a32795c06
+  metadata.gz: 7fba83cf9b4ccc55a232bc59b8937e8875fda59bee9aee7cf539320bd2564eb9
+  data.tar.gz: b1be035279b9ea2b98e44034b90f72b7060f7c45ffaa278f939d0a9bbfd97b82
 SHA512:
-  metadata.gz: 5f01616255b47c496492a3103d58ea290741996ac5554dfd1e9865312d13b1ef733e4ec0a0638fcf0d4b0d690331cb759cf0d1a4ecfcc855f6a0f21c7e40c6e6
-  data.tar.gz: 52ae9da0cfcfa2532963ade79b5eb63ecd665f37129a0dbe7824a47e83c7b3c8ecdccb347043c5a76083cd20a931b1b3216fb5f4cc8208b24695930f1af96982
+  metadata.gz: 286c4d9e360a9d5fc64195ffe7ee7c77583423a28442dfb53f8b6c8679b5955ce5696a80a4418a64eadea8fcdd8028d15846e808ab1d20fc41ffaf19f184f70e
+  data.tar.gz: 24143ca2b7e8d4f39863c21edc5cb69521ff61d145d6305674e3e1dd61d70ff4de797957bed37f70e0e2e8ee6fc792898fba79e5add9ef46fd992d3f1848fa6e

data/README.md

@@ -6,6 +6,10 @@
 
 > MCP-native secret scanner — verified findings, agent-applied rewrites.
 
+<p align="center">
+  <img src="https://raw.githubusercontent.com/leakferrethq/leakferret/master/brand/demo.gif" alt="leakferret finds, verifies, and rewrites a leaked secret" width="760">
+</p>
+
 Ruby gem wrapper around the native [`leakferret`](https://github.com/leakferrethq/leakferret)
 binary. This gem ships no scanning logic of its own: it installs a tiny Ruby
 shim plus a small executable, and downloads the prebuilt, statically-linked

data/lib/leakferret/binary.rb

@@ -18,6 +18,20 @@ module Leakferret
     # A binary vendored inside the gem, if one was shipped (normally empty).
     BUNDLED_DIR = Pathname.new(__dir__).join('bin').freeze
 
+    # SHA256 of each release tarball, pinned to BINARY_VERSION. The download is
+    # verified against these before the archive is ever unpacked, so a tampered
+    # or corrupted release asset is rejected instead of being executed. Because
+    # the digests live in the gem source, auditing the published gem tells you
+    # exactly which binary bytes it will run. Regenerate on every binary bump
+    # from the release's `*.tar.gz.sha256` files.
+    CHECKSUMS = {
+      'aarch64-apple-darwin'     => '30539f730e84ec410d5adda34d0c0427002661e65706f5daa6b6739a10422ce0',
+      'aarch64-pc-windows-msvc'  => 'ce1edb57bdeed1889a4c848b462432a8e888bdba7a7c7f4698dd62b1242697e4',
+      'x86_64-apple-darwin'      => '50318959c66843b5cd2f1968aae58ae53f53890265374f9e70540d3b1f5710f6',
+      'x86_64-pc-windows-msvc'   => '56b31c441b2f92ff4c708104dbfdb1bae65e25440cd95d2aeaaa08535a15a863',
+      'x86_64-unknown-linux-gnu' => 'bcb6ed3098379e794631c38d35037dc55c0d50e5645461faea574439cc477586'
+    }.freeze
+
     module_function
 
     # Absolute path to the native binary, downloading it on first use if
@@ -77,23 +91,44 @@ module Leakferret
       require 'fileutils'
       require 'open-uri'
       require 'zlib'
+      require 'digest'
+      require 'stringio'
       require 'rubygems/package'
 
+      expected = CHECKSUMS[Platform.triple]
+      if expected.nil?
+        raise BinaryNotFoundError,
+              "no pinned checksum for platform #{Platform.triple}; refusing to run an " \
+              'unverified binary. Build from source and set LEAKFERRET_BIN instead.'
+      end
+
       FileUtils.mkdir_p(dest.dirname)
-      # Stream download -> gunzip -> untar in pure Ruby (no external `tar`,
-      # which on Windows mis-reads `C:\` as a remote host). The archive nests
-      # everything under leakferret-<version>-<triple>/, so match by basename.
+
+      # Download the whole tarball, verify its SHA256 against the pinned value,
+      # and only then unpack. Nothing is written to the cache (let alone marked
+      # executable) until the bytes match, so a tampered or truncated release
+      # asset is rejected rather than run.
+      tarball = URI.open(download_url, &:read) # rubocop:disable Security/Open
+      actual = Digest::SHA256.hexdigest(tarball)
+      unless actual.casecmp?(expected)
+        raise BinaryNotFoundError,
+              "checksum mismatch for #{download_url}\n" \
+              "  expected #{expected}\n  got      #{actual}\n" \
+              'Refusing to install a binary that does not match the pinned hash.'
+      end
+
+      # Unpack in pure Ruby (no external `tar`, which on Windows mis-reads `C:\`
+      # as a remote host). The archive nests everything under
+      # leakferret-<version>-<triple>/, so match by basename.
       found = false
-      URI.open(download_url) do |io| # rubocop:disable Security/Open
-        Zlib::GzipReader.wrap(io) do |gz|
-          Gem::Package::TarReader.new(gz) do |tar|
-            tar.each do |entry|
-              next unless entry.file?
-              next unless File.basename(entry.full_name) == Platform.binary_name
-
-              File.binwrite(dest, entry.read)
-              found = true
-            end
+      Zlib::GzipReader.wrap(StringIO.new(tarball)) do |gz|
+        Gem::Package::TarReader.new(gz) do |tar|
+          tar.each do |entry|
+            next unless entry.file?
+            next unless File.basename(entry.full_name) == Platform.binary_name
+
+            File.binwrite(dest, entry.read)
+            found = true
           end
         end
       end

data/lib/leakferret/version.rb

@@ -2,10 +2,10 @@
 
 module Leakferret
   # The gem's own version.
-  VERSION = '0.1.5'
+  VERSION = '0.1.7'
 
   # The native binary release this gem downloads. Tracks the leakferret
   # core release, which may move independently of the gem's own version
   # (e.g. a gem-only bugfix).
-  BINARY_VERSION = '0.1.3'
+  BINARY_VERSION = '0.1.4'
 end

metadata

@@ -1,13 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: leakferret
 version: !ruby/object:Gem::Version
-  version: 0.1.5
+  version: 0.1.7
 platform: ruby
 authors:
 - Maria Khan
+autorequire:
 bindir: exe
 cert_chain: []
-date: 1980-01-02 00:00:00.000000000 Z
+date: 2026-06-01 00:00:00.000000000 Z
 dependencies: []
 description: |
   Context-aware secret scanning for Ruby projects. A thin wrapper around the
@@ -44,6 +45,7 @@ metadata:
   source_code_uri: https://github.com/leakferrethq/leakferret-ruby
   changelog_uri: https://github.com/leakferrethq/leakferret-ruby/blob/main/CHANGELOG.md
   rubygems_mfa_required: 'true'
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -58,7 +60,8 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 3.5.22
+signing_key:
 specification_version: 4
 summary: Context-aware secret detection (Ruby wrapper for the leakferret binary).
 test_files: []