still_active 3.0.0 → 3.2.0

data/lib/still_active/helpers/http_helper.rb

@@ -3,10 +3,11 @@
 require "net/http"
 require "openssl"
 require "json"
+require_relative "http_cache"
 
 module StillActive
   module HttpHelper
-    TRUSTED_HOSTS = ["github.com", "gitlab.com", "codeberg.org", "api.deps.dev", "api.osv.dev", "endoflife.date", "rubygems.pkg.github.com", "repos.ecosyste.ms", "packages.ecosyste.ms", "pypi.org"].freeze
+    TRUSTED_HOSTS = ["github.com", "gitlab.com", "codeberg.org", "api.deps.dev", "api.osv.dev", "endoflife.date", "rubygems.org", "rubygems.pkg.github.com", "repos.ecosyste.ms", "packages.ecosyste.ms", "pypi.org"].freeze
     # Transport-level failures ("host unreachable / connection broke", not an HTTP
     # error status). Every network entry point degrades to a safe empty result on
     # these rather than letting one escape and vanish a gem from the audit.
@@ -22,6 +23,11 @@ module StillActive
       EOFError
     ].freeze
     MAX_REDIRECTS = 3
+    # A 429 or 503 that says when to come back gets one retry, if that's soon.
+    MAX_RETRY_AFTER_SECONDS = 10
+    # Idle connections kept per host. The fan-out runs 10 at a time, so more than
+    # that would only ever sit idle.
+    MAX_IDLE_PER_HOST = 10
     # Ceiling on a single response body. These are metadata endpoints (version
     # lists, scorecards, advisories); legitimate responses are well under this.
     # A source URL is lockfile-derived and a `*.jfrog.io` host is attacker-
@@ -30,16 +36,33 @@ module StillActive
     # gem with thousands of versions while bounding worst-case memory.
     MAX_BODY_BYTES = 16 * 1024 * 1024
     JSON_PARSER = ->(body) { JSON.parse(body) }
+    # Raised in strict mode when the source couldn't answer: a transport error, a
+    # non-404 error status, a refused redirect, an oversized or garbled body. A 404
+    # is an answer ("no such record") and still returns nil. A caller that must not
+    # read a failure as "nothing there", like an advisory lookup, asks for strict.
+    Unavailable = Class.new(StandardError)
     IDENTITY = ->(body) { body }
 
     extend self
 
-    def get_json(base_uri, path, headers: {}, params: {})
+    # Close and forget every pooled connection. Specs call it between examples,
+    # since a pooled connection holds WebMock's fake socket.
+    def reset_connections!
+      pool.each_value { |idle| idle.each { close(_1) } }
+      @pool = nil
+    end
+
+    # `cache: false` skips the disk cache (a canary has to see the source as it is
+    # now); `cache_if` decides whether an answer is sound enough to keep, so a
+    # garbled one isn't reread for its whole TTL.
+    def get_json(base_uri, path, headers: {}, params: {}, strict: false, cache: true, cache_if: nil)
       uri = base_uri.dup
       uri.path = path
       uri.query = URI.encode_www_form(params) unless params.empty?
 
-      request_json(uri, headers) { |target| Net::HTTP::Get.new(target) }
+      cached(HttpCache.key("GET", uri), uri, headers, enabled: cache, cache_if: cache_if) do
+        request_json(uri, headers, strict: strict) { |target| Net::HTTP::Get.new(target) }
+      end
     end
 
     # As get_json, but for endpoints that answer in plain text (the RubyGems
@@ -52,11 +75,13 @@ module StillActive
       request_json(uri, headers, parse: IDENTITY) { |target| Net::HTTP::Get.new(target) }
     end
 
-    def post_json(base_uri, path, body:, headers: {})
+    # Never cached: the POSTs this tool makes (OSV's version query, deps.dev's
+    # batch, Artifactory's AQL) each have to be fresh, or aren't public.
+    def post_json(base_uri, path, body:, headers: {}, strict: false)
       uri = base_uri.dup
       uri.path = path
 
-      request_json(uri, headers) do |target|
+      request_json(uri, headers, strict: strict) do |target|
         request = Net::HTTP::Post.new(target)
         request.body = body
         request
@@ -65,6 +90,18 @@ module StillActive
 
     private
 
+    # A cached answer when there's a fresh one; otherwise asks, and caches a
+    # non-nil answer. nil is a 404 or a failure, neither of which is kept.
+    def cached(key, uri, headers, enabled:, cache_if: nil)
+      ttl = enabled && HttpCache.ttl(uri, headers)
+      return yield unless ttl
+
+      hit = HttpCache.read(key, ttl)
+      return hit unless hit == :miss
+
+      yield.tap { |body| HttpCache.write(key, body) if !body.nil? && (cache_if.nil? || cache_if.call(body)) }
+    end
+
     # Two URIs share an origin when scheme, host, and port all match. URI fills
     # in the default port (443 for https), so the bare and explicit forms of the
     # same origin compare equal.
@@ -76,40 +113,54 @@ module StillActive
     # and returns the parsed body (or nil), where `parse` decides JSON vs text.
     # The block is yielded each URI and returns the request object, so GET and
     # POST share the redirect/auth/cap logic.
-    def request_json(uri, headers, parse: JSON_PARSER)
-      MAX_REDIRECTS.times do
-        http = Net::HTTP.new(uri.host, uri.port)
-        http.use_ssl = true
-        http.open_timeout = 10
-        http.read_timeout = 10
-
+    def request_json(uri, headers, parse: JSON_PARSER, strict: false)
+      retried = false
+      # The Retry-After retry repeats a pass rather than spending one of these.
+      passes = 0
+      while (passes += 1) <= MAX_REDIRECTS
         request = yield(uri)
         headers.each { |key, value| request[key] = value }
 
-        outcome, payload = perform(http, request, uri, parse)
+        outcome, payload = with_connection(uri) { |http| perform(http, request, uri, parse) }
         case outcome
+        when :retry_after
+          if retried
+            warn("warning: #{uri.host}#{uri.path} is still rate limited after one retry")
+            return unavailable(strict, uri)
+          end
+          warn("warning: #{uri.host}#{uri.path} returned HTTP #{payload[:code]}, retrying in #{payload[:seconds]}s as it asked")
+          sleep(payload[:seconds])
+          retried = true
+          passes -= 1
+          next
         when :done
-          return payload
-        when :stop
+          # A 404 is how a source says "no record"; a 200 of `null` says nothing.
+          return payload unless payload.nil? && strict
+
+          warn("warning: #{uri.host}#{uri.path} returned an empty (null) body")
+          return unavailable(strict, uri)
+        when :not_found
           return
+        when :stop
+          return unavailable(strict, uri)
         when :redirect
           location = payload["Location"]
           if location.nil? || location.empty?
             warn("warning: #{uri.host}#{uri.path} returned HTTP #{payload.code} with no Location header")
-            return
+            return unavailable(strict, uri)
           end
 
           redirect_uri = uri + location
           unless TRUSTED_HOSTS.include?(redirect_uri.host)
             warn("warning: #{uri.host}#{uri.path} redirected to untrusted host #{redirect_uri.host}, skipping")
-            return
+            return unavailable(strict, uri)
           end
           # We dial every request over TLS (use_ssl = true). A redirect that
           # downgrades to http is either a misconfiguration or a downgrade
           # attempt; refuse it rather than silently dialing http-over-TLS.
           unless redirect_uri.scheme == "https"
             warn("warning: #{uri.host}#{uri.path} redirected to non-https #{redirect_uri.scheme} target, skipping")
-            return
+            return unavailable(strict, uri)
           end
           warn("warning: #{uri.host}#{uri.path} redirected to #{redirect_uri.host}#{redirect_uri.path} (stale metadata?)")
           # Auth is scoped to an origin (scheme + host + port), not just a host:
@@ -120,42 +171,111 @@ module StillActive
       end
 
       warn("warning: #{uri.host}#{uri.path} too many redirects")
-      nil
+      unavailable(strict, uri)
     rescue *TRANSPORT_ERRORS => e
       warn("warning: #{uri.host}#{uri.path} failed: #{e.class} (#{e.message})")
-      nil
+      unavailable(strict, uri)
     rescue JSON::ParserError => e
       warn("warning: #{uri.host}#{uri.path} returned invalid JSON: #{e.message}")
-      nil
+      unavailable(strict, uri)
     rescue URI::InvalidURIError => e
       warn("warning: #{uri.host}#{uri.path} returned an invalid redirect Location: #{e.message}")
-      nil
+      unavailable(strict, uri)
+    end
+
+    # Every failure has already warned; strict callers also get told.
+    def unavailable(strict, uri)
+      raise Unavailable, "#{uri.host}#{uri.path}" if strict
     end
 
     # Issues the request in streaming form so the body is read against a size
     # cap rather than buffered whole. Returns one of:
     #   [:redirect, response]  a 3xx, for the caller to follow
-    #   [:stop, nil]           non-success (warns unless 404), or body over cap
+    #   [:not_found, nil]      a 404, which is an answer, not a failure
+    #   [:stop, nil]           any other non-success (warns), or body over cap
     #   [:done, parsed]        a 2xx with the parsed body (JSON or text)
-    # Redirect and non-success bodies are never read: returning from the block
-    # unwinds through Net::HTTP, which closes the connection without draining
-    # the body, so a huge error/redirect body can't OOM us either.
+    # Redirect and error bodies are never read: returning from the block unwinds
+    # through Net::HTTP without draining the body, so a huge one can't OOM us, and
+    # with_connection closes that connection. A success or a 404 is read to the end
+    # and the block finishes normally, so Net::HTTP does its end-of-request
+    # bookkeeping: it honours Connection: close and records the time for its idle
+    # check, which is what makes the connection safe to pool. Returning from inside
+    # skipped both, and a POST on a connection the server had closed then failed.
     def perform(http, request, uri, parse)
+      body = nil
       http.request(request) do |response|
         return [:redirect, response] if response.is_a?(Net::HTTPRedirection)
 
+        if response.is_a?(Net::HTTPNotFound)
+          return [:stop, nil] if read_capped_body(response, uri).nil?
+
+          next
+        end
+
+        if (seconds = retry_after(response))
+          return [:retry_after, {code: response.code, seconds: seconds}]
+        end
+
         unless response.is_a?(Net::HTTPSuccess)
-          warn("warning: #{uri.host}#{uri.path} returned HTTP #{response.code}") unless response.is_a?(Net::HTTPNotFound)
+          warn("warning: #{uri.host}#{uri.path} returned HTTP #{response.code}")
           return [:stop, nil]
         end
 
         body = read_capped_body(response, uri)
         return [:stop, nil] if body.nil?
+      end
+      body.nil? ? [:not_found, nil] : [:done, parse.call(body)]
+    end
+
+    # The seconds a 429 or 503 asks us to wait, when it gives a number of them and
+    # the wait is short enough to be worth it; nil otherwise. The HTTP-date form is
+    # read as "not soon", since the sources we call send seconds.
+    def retry_after(response)
+      return unless response.code == "429" || response.code == "503"
+
+      value = response["Retry-After"].to_s.strip
+      return unless value.match?(/\A\d+\z/)
+
+      value.to_i if value.to_i <= MAX_RETRY_AFTER_SECONDS
+    end
 
-        return [:done, parse.call(body)]
+    # One started connection per host, reused across requests. Only a success or a
+    # 404, read to the end with Net::HTTP's request finished normally, goes back
+    # (see perform); anything else may have unread bytes and is closed. On reuse,
+    # Net::HTTP reconnects a connection the server closed or that sat idle past
+    # its keep-alive timeout.
+    def with_connection(uri)
+      http = pool[[uri.host, uri.port]].pop || open_connection(uri)
+      outcome = nil
+      begin
+        outcome = yield(http)
+      ensure
+        if [:done, :not_found].include?(outcome&.first) && pool[[uri.host, uri.port]].size < MAX_IDLE_PER_HOST
+          pool[[uri.host, uri.port]] << http
+        else
+          close(http)
+        end
       end
     end
 
+    def open_connection(uri)
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.use_ssl = true
+      http.open_timeout = 10
+      http.read_timeout = 10
+      http.start
+    end
+
+    def close(http)
+      http.finish if http.started?
+    rescue IOError
+      nil
+    end
+
+    def pool
+      @pool ||= Hash.new { |hash, key| hash[key] = [] }
+    end
+
     # Reads the body in chunks, abandoning the read (returns nil) as soon as it
     # exceeds MAX_BODY_BYTES so an oversized body is never fully materialized.
     def read_capped_body(response, uri)

data/lib/still_active/helpers/markdown_helper.rb

@@ -294,7 +294,7 @@ module StillActive
 
     def format_vulns(data)
       count = data[:vulnerability_count]
-      return StillActive.config.unsure_emoji if count.nil?
+      return StillActive.config.unsure_emoji if count.nil? || (count.zero? && data[:vulnerabilities_checked] == false)
       return StillActive.config.success_emoji if count.zero?
 
       vulnerabilities = data[:vulnerabilities] || []

data/lib/still_active/helpers/repository_check.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+require_relative "../assessment"
+
+module StillActive
+  # Reading a dependency's repository_check the same way everywhere: "answered",
+  # "failed" or "unknowable" (see RepositorySignals), or "not_applicable" for the
+  # Go toolchain, which is the language, not a package with a repository. A hash
+  # without the key never had its repository looked at, which is not an answer.
+  module RepositoryCheck
+    extend self
+
+    VALUES = Assessment::REPOSITORY_CHECKS
+    SETTLED = ["answered", "not_applicable"].freeze
+
+    def unanswered?(data) = !SETTLED.include?(data[:repository_check])
+
+    # A missing or unrecognised check means the repository step never ran (an
+    # assessment that raised part-way), so it counts as failed, as in tally.
+    def failed?(data) = !VALUES.include?(data[:repository_check]) || data[:repository_check] == "failed"
+
+    # {answered:, failed:, unknowable:} across dependencies.
+    def tally(dependencies)
+      counts = VALUES.to_h { [_1.to_sym, 0] }
+      dependencies.each { counts[(data_check(_1) || "failed").to_sym] += 1 }
+      counts
+    end
+
+    private
+
+    def data_check(data) = VALUES.include?(data[:repository_check]) ? data[:repository_check] : nil
+  end
+end

data/lib/still_active/helpers/status_helper.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require_relative "activity_helper"
+require_relative "repository_check"
 
 module StillActive
   # Collapses a gem's several maintenance signals into one categorical verdict,
@@ -28,6 +29,16 @@ module StillActive
     # Returns :dead, :vulnerable, :deprecated, :archived, :legacy, :stale, :ok,
     # or :unknown.
     def gem_status(gem_data)
+      status = lifecycle_status(gem_data)
+      # Advisories a source couldn't answer for are not "none", and a repository
+      # no source could read isn't "not archived", so a verdict that claims clean
+      # (:ok, and :legacy's "dormant but clean") reads :unknown. Verdicts that
+      # found a problem stand, since it's true either way.
+      unanswered = gem_data[:vulnerabilities_checked] == false || RepositoryCheck.unanswered?(gem_data)
+      ([:ok, :legacy].include?(status) && unanswered) ? :unknown : status
+    end
+
+    def lifecycle_status(gem_data)
       vulnerable = gem_data[:vulnerability_count].to_i.positive?
 
       # A pinned version the registry can't resolve (yanked, typo, or nonexistent)

data/lib/still_active/helpers/summary_helper.rb

@@ -2,6 +2,7 @@
 
 require_relative "activity_helper"
 require_relative "status_helper"
+require_relative "repository_check"
 
 module StillActive
   # Builds the JSON output's summary{} digest: the headline posture of the audit
@@ -16,7 +17,8 @@ module StillActive
 
     def summarize(result, ruby_info: nil)
       activity = ACTIVITY_LEVELS.to_h { |level| [level, 0] }
-      archived = up_to_date = outdated = vulnerable_gems = vulnerabilities = direct = 0
+      archived = up_to_date = outdated = vulnerable_gems = vulnerabilities = unchecked = direct = 0
+      repository_checks = RepositoryCheck.tally(result.values)
 
       result.each_value do |data|
         activity[ActivityHelper.activity_level(data)] += 1
@@ -24,6 +26,7 @@ module StillActive
         archived += 1 if data[:archived]
         up_to_date += 1 if data[:up_to_date] == true
         outdated += 1 if data[:up_to_date] == false
+        unchecked += 1 if data[:vulnerabilities_checked] == false
         count = data[:vulnerability_count].to_i
         next unless count.positive?
 
@@ -41,6 +44,8 @@ module StillActive
         outdated: outdated,
         vulnerable_gems: vulnerable_gems,
         vulnerabilities: vulnerabilities,
+        vulnerabilities_unchecked: unchecked,
+        repository_checks: repository_checks,
         # The single worst per-gem verdict (plus EOL Ruby), so a consumer reads
         # one project-level posture without scanning every gem's status.
         status: StatusHelper.project_status(result, ruby_info: ruby_info)

data/lib/still_active/helpers/terminal_helper.rb

@@ -8,6 +8,7 @@ require_relative "summary_helper"
 require_relative "libyear_helper"
 require_relative "version_helper"
 require_relative "vulnerability_helper"
+require_relative "repository_check"
 
 module StillActive
   module TerminalHelper
@@ -90,7 +91,8 @@ module StillActive
     def format_activity(data)
       case ActivityHelper.activity_level(data)
       when :archived then AnsiHelper.red("archived")
-      when :ok then AnsiHelper.green("ok")
+      # Recent releases, but the repository couldn't be read: it may be archived.
+      when :ok then RepositoryCheck.unanswered?(data) ? AnsiHelper.yellow("?") : AnsiHelper.green("ok")
       when :stale then AnsiHelper.yellow("stale")
       when :critical then AnsiHelper.red("critical")
       when :unknown then AnsiHelper.dim("-")
@@ -113,6 +115,8 @@ module StillActive
     def format_vulns(data)
       count = data[:vulnerability_count]
       return AnsiHelper.dim("-") if count.nil?
+      # No source answered, so a 0 here would read as clean.
+      return AnsiHelper.yellow("?") if count.zero? && data[:vulnerabilities_checked] == false
       return AnsiHelper.green("0") if count.zero?
 
       severity = VulnerabilityHelper.highest_severity(data[:vulnerabilities])
@@ -353,6 +357,10 @@ module StillActive
       activity << ", #{archived} archived" if archived > 0
       parts << activity
       parts << "#{summary[:vulnerabilities]} vulnerabilities"
+      parts.last << " (#{summary[:vulnerabilities_unchecked]} unchecked)" if summary[:vulnerabilities_unchecked] > 0
+      checks = summary[:repository_checks]
+      unchecked = checks[:failed] + checks[:unknowable]
+      parts << "#{unchecked} #{(unchecked == 1) ? "repository" : "repositories"} unchecked#{" (#{checks[:failed]} failed)" if checks[:failed] > 0}" if unchecked > 0
       poison_tiers = result.each_value.select { |data| data[:poison] }.map { |data| data[:poison_severity] }
       poison_part = tier_summary_part(poison_tiers, "#{poison_tiers.size} poison-#{(poison_tiers.size == 1) ? "pill" : "pills"}")
       parts << poison_part if poison_part

data/lib/still_active/helpers/vulnerability_helper.rb

@@ -23,11 +23,10 @@ module StillActive
     # One advisory's severity label ("low".."critical"), or nil when genuinely unscored.
     # The authoritative GHSA/OSV label is a FLOOR: a real CVSS number sharpens precision
     # and can RAISE the band, but never lowers it below the label. This matters because
-    # the OSV-derived score is cvss-suite's overall_score, which folds in any
-    # threat/environmental metrics a vector carries (and can diverge from GHSA at a band
-    # edge) -- on a fail-closed, no-false-positive tool a computed number must not
-    # silently demote a GHSA-HIGH finding out of a severity gate. With only one of the
-    # two present, that one stands.
+    # GHSA labels are assigned by people and can sit off the FIRST band edge of the
+    # computed base score -- on a fail-closed, no-false-positive tool a computed
+    # number must not silently demote a GHSA-HIGH finding out of a severity gate.
+    # With only one of the two present, that one stands.
     def advisory_severity(vulnerability)
       from_score = (score = effective_score(vulnerability)) ? severity_label(score) : nil
       from_label = OSV_LABELS[vulnerability[:osv_severity].to_s.downcase]

data/lib/still_active/options.rb

@@ -21,6 +21,7 @@ module StillActive
         add_output_options(opts)
         add_token_options(opts)
         add_parallelism_options(opts)
+        add_cache_option(opts)
         add_range_options(opts)
         add_exit_options(opts)
         add_emoji_options(opts)
@@ -120,6 +121,12 @@ module StillActive
       end
     end
 
+    def add_cache_option(opts)
+      opts.on("--no-cache", "Skip the on-disk cache of public sources' answers (advisories are kept at most an hour)") do
+        StillActive.config { |config| config.http_cache = false }
+      end
+    end
+
     def add_parallelism_options(opts)
       opts.on("--simultaneous-requests=QTY", Integer, "Number of simultaneous requests made") do |value|
         StillActive.config { |config| config.parallelism = value }

data/lib/still_active/osv_client.rb

@@ -81,6 +81,45 @@ module StillActive
       body = HttpHelper.get_json(BASE_URI, "/v1/vulns/#{encode(advisory_id)}")
       return unless body.is_a?(Hash)
 
+      parse_record(body)
+    end
+
+    # Every advisory OSV lists for this exact version, carrying the same OSV fields
+    # enrich adds, or nil when OSV could not answer completely. This is the discovery
+    # source for a package deps.dev can't serve per version (the Go toolchain), so
+    # nil must stay distinct from [] here too: the caller reads nil as "unknown",
+    # never as clean. The query returns whole records, so nothing is fetched per id.
+    def advisories(ecosystem:, name:, version:)
+      osv_ecosystem = ECOSYSTEM_NAMES[ecosystem]
+      return if osv_ecosystem.nil?
+
+      query = {version: version, package: {name: name, ecosystem: osv_ecosystem}}
+      body = HttpHelper.post_json(BASE_URI, "/v1/query", body: JSON.generate(query))
+      return unless body.is_a?(Hash) && identifiers_from(body)
+
+      Array(body["vulns"]).map do |vuln|
+        record = parse_record(vuln)
+        {
+          id: vuln["id"],
+          aliases: Array(vuln["aliases"]).grep(String),
+          title: vuln["summary"],
+          url: "https://osv.dev/vulnerability/#{vuln["id"]}",
+          source: "osv",
+          osv_severity: record[:severity_label],
+          osv_cvss_score: record[:cvss_score],
+          cvss_version: record[:cvss_version],
+          cvss_vector: record[:cvss_vector],
+          fixed_versions: fixed_versions(record, ecosystem: ecosystem, name: name)
+        }
+      end
+    rescue => e
+      warn("warning: OSV advisory lookup for #{name}@#{version} failed: #{e.class} (#{e.message})")
+      nil
+    end
+
+    private
+
+    def parse_record(body)
       cvss = best_cvss(body)
       {
         # OSV's own identity for the advisory, unioned into the match against a query
@@ -96,8 +135,6 @@ module StillActive
       }
     end
 
-    private
-
     # Applies one OSV record to one advisory, in place. Returns OSV's identifiers for
     # the advisory when it is eligible for the version confirmation below (only OSV
     # data may overrule OSV-derived data), or nil when it is not and must be kept

data/lib/still_active/repository_signals.rb

@@ -0,0 +1,113 @@
+# frozen_string_literal: true
+
+require_relative "errors"
+require_relative "github_client"
+require_relative "gitlab_client"
+require_relative "forgejo_client"
+require_relative "ecosystems_client"
+
+module StillActive
+  # One answer to "is this repository archived, and when was it last pushed?"
+  # for both audit paths, from whichever service can give it. The clients only
+  # report what their service said; which services to ask, in what order, and
+  # when to stop, is decided here once.
+  #
+  # Returns a hash whose :check says what came of it, always one of:
+  #   "answered"    a service said; :archived, :last_commit_date and :source
+  #                 (which service) come with it
+  #   "failed"      a service couldn't answer (a rate limit, an error, a refused
+  #                 token) and none other said; a rerun may help, so the activity
+  #                 gates fail closed on it
+  #   "unknowable"  no service can say: the host has no archived state we can
+  #                 read, there's no repository to ask about, or every service
+  #                 asked didn't know it (ecosyste.ms hasn't crawled it, the forge
+  #                 404s a private or deleted repository). A rerun won't change
+  #                 it, so it reads unknown without failing the gates.
+  #
+  # "Don't know" is never an answer: a 404 or an answer without the archived
+  # state moves on to the next service.
+  #
+  # A GitHub repository is asked of GitHub and of ecosyste.ms, which mirrors the
+  # same two fields: GitHub first with a token (freshest, 5000/hr), ecosyste.ms
+  # first without one (GitHub allows 60 anonymous requests an hour), each the
+  # other's fallback. ecosyste.ms sees the repository's name, so it is asked only
+  # when the dependency came from a public registry (`public:`), which is the
+  # privacy guard; after GitHub refused the token outright (401/403: a bad token,
+  # SSO, a suspended account) the chain also stops rather than guess.
+  module RepositorySignals
+    extend self
+
+    # A service in a chain: its label for `source`, and how to ask it.
+    Service = Data.define(:label, :ask)
+
+    def for(host:, owner:, name:, public:)
+      services = (host && owner && name) ? chain(host.downcase, public) : []
+      return {check: "unknowable"} if services.empty?
+
+      failed = false
+      services.each do |service|
+        signals = service.ask.call(owner, name)
+        next unless signals.key?(:archived)
+
+        return signals.merge(source: service.label, check: "answered")
+      rescue RepoAccessDenied
+        failed = true
+        break
+      rescue RepoSignalsUnavailable
+        failed = true
+      end
+
+      if failed
+        warn("warning: #{owner}/#{name}: no repository source could answer; archived status unknown")
+        {check: "failed"}
+      else
+        {check: "unknowable"}
+      end
+    end
+
+    # For a deps.dev project id (host/owner/name, host/group/.../name on
+    # GitLab). gopkg.in is a redirector with a fixed mapping onto GitHub
+    # (gopkg.in/pkg.v3 is github.com/go-pkg/pkg, gopkg.in/user/pkg.v3 is
+    # github.com/user/pkg), so it is asked about as that GitHub repository.
+    def for_project(project_id, public:)
+      host, *path = project_id.to_s.split("/")
+      host, path = gopkg_in(path) if host&.downcase == "gopkg.in"
+      return {check: "unknowable"} if host.nil? || path.size < 2
+
+      self.for(host: host, owner: path[0..-2].join("/"), name: path.last, public: public)
+    end
+
+    private
+
+    GOPKG_VERSIONED = /\A(?<name>.+)\.v\d+(?:-unstable)?\z/
+
+    # The version suffix marks the module: gopkg.in/pkg.vN[/sub...] or
+    # gopkg.in/user/pkg.vN[/sub...]; anything after it is a subpackage.
+    def gopkg_in(path)
+      if (match = path[0]&.match(GOPKG_VERSIONED))
+        ["github.com", ["go-#{match[:name]}", match[:name]]]
+      elsif (match = path[1]&.match(GOPKG_VERSIONED))
+        ["github.com", [path[0], match[:name]]]
+      else
+        [nil, []]
+      end
+    end
+
+    def chain(host, public)
+      case host
+      when "github.com" then github_chain(public)
+      when "gitlab.com" then [Service.new("gitlab", ->(owner, name) { GitlabClient.repo_signals(owner: owner, name: name) })]
+      when "codeberg.org" then [Service.new("codeberg", ->(owner, name) { ForgejoClient.repo_signals(owner: owner, name: name, host: host) })]
+      else []
+      end
+    end
+
+    def github_chain(public)
+      github = Service.new("github", ->(owner, name) { GithubClient.repo_signals(owner: owner, name: name) })
+      mirror = Service.new("ecosyste.ms", ->(owner, name) { EcosystemsClient.repo_signals(owner: owner, name: name) })
+      return [github] unless public
+
+      StillActive.config.github_oauth_token ? [github, mirror] : [mirror, github]
+    end
+  end
+end

data/lib/still_active/rubygems_client.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+require_relative "helpers/http_helper"
+
+module StillActive
+  # The RubyGems JSON API this tool reads, through HttpHelper so it gets the same
+  # timeouts, body cap and redirect rules as every other source. rubygems.org by
+  # default; Artifactory serves the same API under a repo path, with its own
+  # credentials, via `base:` and `headers:`.
+  module RubygemsClient
+    extend self
+
+    BASE_URI = URI("https://rubygems.org/")
+
+    # Every published version, newest first, as rubygems.org serves them; [] when
+    # the gem doesn't exist or the lookup failed (HttpHelper has warned).
+    def versions(gem_name, base: BASE_URI, headers: {})
+      body = HttpHelper.get_json(base, "#{base.path.chomp("/")}/api/v1/versions/#{encode(gem_name)}.json", headers: headers)
+      body.is_a?(Array) ? body : []
+    end
+
+    # The gem's metadata (homepage_uri, source_code_uri, downloads, ...), or nil.
+    def info(gem_name)
+      body = HttpHelper.get_json(BASE_URI, "/api/v1/gems/#{encode(gem_name)}.json")
+      body if body.is_a?(Hash)
+    end
+
+    private
+
+    def encode(value)
+      URI.encode_www_form_component(value.to_s)
+    end
+  end
+end