securewithtrace 0.38.0 → 0.40.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +40 -1
- package/dist/index.js +1416 -143
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -10,7 +10,7 @@
|
|
|
10
10
|
|
|
11
11
|
`tracecli` is the official CLI for Trace.
|
|
12
12
|
|
|
13
|
-
Use it to authenticate, browse and filter connected repositories, clone repositories, and inspect vulnerabilities directly from the command line.
|
|
13
|
+
Use it to authenticate, browse and filter connected repositories, upload source archives, clone repositories, and inspect vulnerabilities directly from the command line.
|
|
14
14
|
|
|
15
15
|
## Install
|
|
16
16
|
|
|
@@ -56,6 +56,7 @@ tracecli vulnerabilities list --severity HIGH
|
|
|
56
56
|
- **Find repositories by dependency** with optional version filtering (`repo list --dependency`)
|
|
57
57
|
- **Clone repositories** with secure token handling (`repo clone`)
|
|
58
58
|
- **Provision and read Trace-hosted email inboxes** for pentest test accounts (`inbox create/list/emails/email/delete`)
|
|
59
|
+
- **Upload source ZIPs** for pentest when the app is not on GitHub, or attach an APK/IPA to an existing app (`upload create`, `upload build --app`)
|
|
59
60
|
- **Filter vulnerabilities** by repo, severity, and status (`vulnerabilities list`)
|
|
60
61
|
- **Export results as JSON or TSV** for automation (`vulnerabilities list --output json`)
|
|
61
62
|
- **Upgrade easily** with built-in update checks and `upgrade` command (`upgrade`, `self-update`)
|
|
@@ -125,6 +126,44 @@ tracecli repo clone securewithtrace/trace
|
|
|
125
126
|
tracecli repo clone securewithtrace/trace --branch main --depth 1
|
|
126
127
|
```
|
|
127
128
|
|
|
129
|
+
### Source uploads
|
|
130
|
+
|
|
131
|
+
`upload create` is a source ZIP (a code upload). `upload build --app` attaches an APK or IPA to an existing application. Requires `tracecli auth login` on a pentest-enabled organization; API keys are rejected.
|
|
132
|
+
|
|
133
|
+
```bash
|
|
134
|
+
# Upload a source archive and wait until it is ready
|
|
135
|
+
tracecli upload create ./checkout.zip --name "Checkout" --wait
|
|
136
|
+
|
|
137
|
+
# List uploads
|
|
138
|
+
tracecli upload list
|
|
139
|
+
|
|
140
|
+
# Resume an interrupted transfer with the same file
|
|
141
|
+
tracecli upload resume <codeUploadId> ./checkout.zip
|
|
142
|
+
|
|
143
|
+
# Link a ready source ZIP to an application
|
|
144
|
+
tracecli upload link --app <applicationId> --upload <codeUploadId>
|
|
145
|
+
|
|
146
|
+
# Attach an Android build to an existing application
|
|
147
|
+
tracecli upload build ./app-release.apk --app <applicationId>
|
|
148
|
+
```
|
|
149
|
+
|
|
150
|
+
Flags for `upload create`:
|
|
151
|
+
|
|
152
|
+
| Flag | Description |
|
|
153
|
+
|------|-------------|
|
|
154
|
+
| `--name <displayName>` | Display name (defaults to the filename without extension) |
|
|
155
|
+
| `--wait` | Wait until malware scanning finishes |
|
|
156
|
+
| `--output <format>` | `table` (default), `json`, `tsv` |
|
|
157
|
+
|
|
158
|
+
Flags for `upload build`:
|
|
159
|
+
|
|
160
|
+
| Flag | Description |
|
|
161
|
+
|------|-------------|
|
|
162
|
+
| `--app <applicationId>` | Application that owns this build (required) |
|
|
163
|
+
| `--name <displayName>` | Display name (defaults to the filename without extension) |
|
|
164
|
+
| `--wait` | Wait until malware scanning finishes |
|
|
165
|
+
| `--output <format>` | `table` (default), `json`, `tsv` |
|
|
166
|
+
|
|
128
167
|
### Vulnerabilities
|
|
129
168
|
|
|
130
169
|
```bash
|