aisbom-cli 0.4.1__tar.gz → 0.4.2__tar.gz

{aisbom_cli-0.4.1 → aisbom_cli-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: aisbom-cli
-Version: 0.4.1
+Version: 0.4.2
 Summary: An AI Supply Chain security tool that that detects Pickle bombs and generates CycloneDX SBOMs for Machine Learning models.
 License-File: LICENSE
 Author: Ajoy L
@@ -13,6 +13,7 @@ Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
 Requires-Dist: click (<8.2.0)
 Requires-Dist: cyclonedx-python-lib (>=8.5.0,<9.0.0)
+Requires-Dist: packaging (>=24.0,<25.0)
 Requires-Dist: pip-requirements-parser (>=32.0.1,<33.0.0)
 Requires-Dist: requests (>=2.32.3,<3.0.0)
 Requires-Dist: rich (>=13.7.1,<15.0.0)

{aisbom_cli-0.4.1 → aisbom_cli-0.4.2}/aisbom/cli.py

@@ -17,9 +17,40 @@ import importlib.metadata
 from .scanner import DeepScanner
 from .diff import SBOMDiff
 
+import threading
+from .version_check import check_latest_version
+
 app = typer.Typer()
 console = Console()
 
+# Thread-safe storage for update checks
+update_result = {"version": None}
+
+def run_version_check_wrapper():
+    """Wrapper to run version check and store result."""
+    update_result["version"] = check_latest_version()
+
+def _check_update_status():
+    """Checks if update thread finished and prints message if needed."""
+    # We join with a tiny timeout to see if it's done without blocking
+    # Since we call this at the END of the command, the network request likely finished.
+    # If it's still hung, we skip showing the message to avoid delay.
+    # Note: Threads in Python are daemon by default? No, we need to set daemon=True
+    # so it doesn't block exit if network hangs. But here we just want to check results.
+    if update_result["version"]:
+        ver = update_result["version"]
+        try:
+             curr = importlib.metadata.version("aisbom-cli")
+        except:
+             curr = "unknown"
+             
+        console.print(Panel(
+            f"💡 [bold yellow]Update Available:[/bold yellow] You are on v{curr}. v{ver} is available.\n"
+            f"Run [bold white]pip install --upgrade aisbom-cli[/bold white] to update.",
+            border_style="yellow",
+            expand=False
+        ))
+
 class OutputFormat(str, Enum):
     JSON = "json"
     MARKDOWN = "markdown"
@@ -71,6 +102,10 @@ def scan(
     """
     Deep Introspection Scan: Analyzes binary headers and dependency manifests.
     """
+    # Start background check
+    t = threading.Thread(target=run_version_check_wrapper, daemon=True)
+    t.start()
+
     console.print(Panel.fit(f"🚀 [bold cyan]AIsbom[/bold cyan] Scanning: [underline]{target}[/underline]"))
 
     # 1. Run the Logic
@@ -220,6 +255,9 @@ def scan(
     elif exit_code == 1:
         console.print("[bold yellow]Errors encountered during scan.[/bold yellow] Exiting with code 1.")
 
+    # Check update status before exiting
+    _check_update_status()
+
     # Non-zero exit codes for CI/CD when high risk or errors are present
     raise typer.Exit(code=exit_code)
 
@@ -293,6 +331,10 @@ def diff(
     """
     Compare two SBOM files (CycloneDX JSON) and detect drift in risks, licenses, dependencies, or model hashes.
     """
+    # Start background check
+    t = threading.Thread(target=run_version_check_wrapper, daemon=True)
+    t.start()
+
     path_old = Path(old_file)
     path_new = Path(new_file)
 
@@ -388,6 +430,8 @@ def diff(
         raise typer.Exit(code=1)
     
     console.print("\n[bold green]Success: No critical regression detected.[/bold green]")
+    
+    _check_update_status()
 
 if __name__ == "__main__":
     app()

aisbom_cli-0.4.2/aisbom/version_check.py

@@ -0,0 +1,50 @@
+import os
+import platform
+import importlib.metadata
+import requests
+from packaging.version import parse as parse_version
+
+API_URL = "https://api.aisbom.io/v1/version"
+
+def check_latest_version() -> str | None:
+    """
+    Checks for the latest version of aisbom-cli.
+    Returns the latest version string if an update is available, otherwise None.
+    Respects AISBOM_NO_TELEMETRY env var.
+    """
+    # 1. Privacy Check
+    if os.getenv("AISBOM_NO_TELEMETRY"):
+        return None
+
+    try:
+        # 2. Get Current Version & Context
+        current_version = importlib.metadata.version("aisbom-cli")
+        system = platform.system()
+        py_ver = platform.python_version()
+        is_ci = "true" if (os.getenv("GITHUB_ACTIONS") or os.getenv("CI")) else "false"
+        
+        user_agent = f"aisbom-cli/{current_version} ({system}; python {py_ver}; ci={is_ci})"
+
+        # 3. Request
+        response = requests.get(
+            API_URL, 
+            headers={"User-Agent": user_agent},
+            timeout=1.0 # Strict timeout
+        )
+        response.raise_for_status()
+        
+        data = response.json()
+        latest_version = data.get("latest")
+
+        if not latest_version:
+            return None
+
+        # 4. Compare
+        if parse_version(latest_version) > parse_version(current_version):
+            return latest_version
+
+    except Exception:
+        # Fail silently for any network/parsing issue
+        return None
+        
+    return None

{aisbom_cli-0.4.1 → aisbom_cli-0.4.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "aisbom-cli"
-version = "0.4.1"
+version = "0.4.2"
 description = "An AI Supply Chain security tool that that detects Pickle bombs and generates CycloneDX SBOMs for Machine Learning models."
 authors = ["Ajoy L <lab700xdev@gmail.com>"]
 readme = "README.md"
@@ -15,6 +15,7 @@ cyclonedx-python-lib = "^8.5.0"
 pip-requirements-parser = "^32.0.1"
 click = "<8.2.0"
 spdx-tools = "^0.8.3"
+packaging = "^24.0"
 
 [tool.poetry.dependencies.requests]
 version = "^2.32.3"