apsa 1.0.3__py3-none-any.whl

apsa/__init__.py

@@ -0,0 +1,3 @@
+"""APSA (앱사): evidence-first security audits for Android and iOS."""
+
+from quaygate import __version__ as __version__

apsa/__main__.py

@@ -0,0 +1,3 @@
+from .cli import main
+
+raise SystemExit(main())

apsa/cli.py

@@ -0,0 +1,3 @@
+"""Canonical APSA entry point for the shared audit and legacy lint commands."""
+
+from quaygate.cli import main as main

apsa-1.0.3.dist-info/METADATA

@@ -0,0 +1,228 @@
+Metadata-Version: 2.5
+Name: apsa
+Version: 1.0.3
+Summary: APSA (앱사): evidence-first security audits for Android and iOS
+Project-URL: Homepage, https://github.com/ictechgy/apsa
+Project-URL: Repository, https://github.com/ictechgy/apsa
+Project-URL: Issues, https://github.com/ictechgy/apsa/issues
+Project-URL: Changelog, https://github.com/ictechgy/apsa/releases
+License-File: LICENSE
+Requires-Python: >=3.11
+Requires-Dist: androguard<5,>=4.1
+Requires-Dist: beautifulsoup4<5,>=4.13
+Requires-Dist: cvss<4,>=3.6
+Requires-Dist: defusedxml<1,>=0.7
+Requires-Dist: httpx<1,>=0.28
+Requires-Dist: loguru<1,>=0.7
+Requires-Dist: mcp<2,>=1.20
+Requires-Dist: packaging>=25
+Requires-Dist: psutil==7.2.2
+Requires-Dist: rich<15,>=14
+Requires-Dist: textual<9,>=6
+Requires-Dist: tree-sitter-java==0.23.5
+Requires-Dist: tree-sitter-json==0.24.8
+Requires-Dist: tree-sitter-kotlin==1.1.0
+Requires-Dist: tree-sitter-swift==0.7.4
+Requires-Dist: tree-sitter==0.25.2
+Provides-Extra: dev
+Requires-Dist: pyright>=1.1.400; extra == 'dev'
+Requires-Dist: pytest-asyncio>=1; extra == 'dev'
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff>=0.12; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# APSA
+
+**Evidence-first security audits for Android and iOS.**
+
+[English](https://github.com/ictechgy/apsa/blob/main/README.md) · [한국어](https://github.com/ictechgy/apsa/blob/main/README.ko.md)
+
+This English README is the source of truth. The Korean README follows it.
+
+APSA helps developers and security teams audit their own mobile apps. It inspects source code and APK/IPA builds, correlates public vulnerability information, and keeps evidence, coverage, and report history together. Use the CLI, terminal UI, or the same audit engine through MCP and reusable skills.
+
+Pronounced **“ap-sah”**; Korean name **앱사**. The name connects “app + audit” with **App Security Audit**. APSA combines the earlier Quaygate lint engine and Mobile Audit workflows in one package.
+
+## What it checks
+
+| Area | Available checks |
+| --- | --- |
+| Source code | Java/Kotlin/Swift AST analysis; WebView and deep-link patterns; Manifest, Info.plist, storage, and dependency inspection |
+| Android builds | DEX calls and constant flow; resources and network configuration; exported components/providers; signing-block and v1 certificate evidence; ELF hardening |
+| iOS builds | Mach-O headers; limited entitlement/configuration checks (embedded XML entitlements, ATS exceptions, provisioning indicators); PIE, canary, and string evidence |
+| Public intelligence | Apple/Android advisories, CVE, CISA KEV, OWASP guidance, and OSV dependency correlation |
+| Reports and CI | SQLite history, comparison and reassessment, JSON/Markdown/SARIF export, coverage requirements, and expiring waivers |
+| Runtime | Prepared scenarios for owned Android test apps and iOS simulator apps; physical iOS devices are unsupported |
+| Model integration | stdio MCP tools/resources and packaged skills, without a required model provider or LLM API key |
+
+Findings distinguish `candidate`, `configuration-confirmed`, `version-affected`, and `runtime-confirmed` evidence. `coverage` and warnings show what actually ran. A signing block does not prove signature authenticity, and an affected dependency version does not prove exploitability. A scan with no findings does not establish that the whole app is secure.
+
+OWASP mappings describe relevant checks; APSA does not certify MASVS compliance or implement every MASTG test. Public advisories cannot reveal undisclosed zero-days. App files alone cannot establish a device's OS patch state. See [OWASP coverage](https://github.com/ictechgy/apsa/blob/main/docs/OWASP_COVERAGE.md) and the [support matrix](https://github.com/ictechgy/apsa/blob/main/docs/SUPPORTED_MATRIX.md), both currently in Korean, for tested scope and limits.
+
+## Install and run
+
+Install **uv** on **macOS or Linux**. APSA targets **CPython 3.11 and 3.12**; not every host/Python combination has been tested (see the [support matrix](https://github.com/ictechgy/apsa/blob/main/docs/SUPPORTED_MATRIX.md)). The examples select Python 3.12, which uv can download if needed. Initial installation can use the network; scans can then use local inputs and cached intelligence.
+
+Install the published package from [PyPI](https://pypi.org/project/apsa/):
+
+```sh
+uv tool install --python 3.12 apsa==1.0.3
+apsa --version
+apsa doctor --json
+apsa demo --out ./apsa-demo
+```
+
+The package provides `apsa` and the compatibility aliases `quaygate` and `mobile-audit`. If the command is not found, run `uv tool update-shell` and open a new terminal. [GitHub Releases](https://github.com/ictechgy/apsa/releases) provides the wheel, source distribution, checksums, and a verified bundle with locked requirements, attribution, and the build manifest.
+
+For development or installation with the repository's locked dependencies, use a checkout:
+
+```sh
+git clone https://github.com/ictechgy/apsa.git
+cd apsa
+uv sync --locked --python 3.12
+uv run --locked apsa doctor --json
+uv run --locked apsa demo --out ./apsa-demo
+```
+
+`doctor` checks parsers, optional device tools, and offline readiness. `demo` writes an intentionally vulnerable example and scans it; choose a new output directory.
+
+To register the checkout's commands on your PATH:
+
+```sh
+uv tool install --editable . --force --python 3.12 --constraints requirements-release.txt
+apsa --version
+```
+
+This registers `apsa` and the compatibility aliases `quaygate` and `mobile-audit`. `--force` replaces existing tools with those command names. An editable installation depends on this checkout; keep it in place. If the command is not found, run `uv tool update-shell` and open a new terminal. The examples below assume `apsa` is on PATH. Without a global installation, prefix them with `uv run --locked` from the checkout.
+
+```sh
+apsa scan /path/to/owned/mobile-project
+apsa scan /path/to/owned/app.apk
+apsa scan /path/to/owned/app.ipa --sbom /path/to/build.cdx.json
+apsa tui
+```
+
+Use a CycloneDX JSON SBOM from the actual build to improve dependency correlation. `tui`, or `apsa` without arguments, opens the terminal interface. Run `apsa COMMAND --help` for options.
+
+## Public intelligence and network use
+
+A default `scan` reads local files and cached intelligence without uploading source code or builds. Public-feed collection and OSV queries use the network:
+
+| Command | Network behavior |
+| --- | --- |
+| `apsa scan TARGET` | Uses local inputs and cached intelligence |
+| `apsa intel sync` | Fetches public vulnerability sources |
+| `apsa intel watch` | Polls public sources and reassesses saved inventories; does not reread app files or implicitly query OSV |
+| `apsa scan TARGET --online` | Sends discovered dependency names and versions to OSV |
+| `apsa intel watch --online` | Also sends saved dependency names and versions to OSV |
+
+```sh
+apsa intel sync
+apsa intel status
+apsa intel watch --interval 900
+apsa scan /path/to/owned/app --online
+```
+
+Watch polls every 900 seconds by default, with a 60-second minimum; it is not a push stream. It runs until interrupted unless `--cycles` sets a finite number of polls. Reassessment saves a new snapshot when findings, coverage, or intelligence state changes. Inspect feed freshness, failures, and pending CVE processing with `intel status`. Fetching a CVE document and completing its processing are separate states. The default pending-item policy allows no backlog; use `intel_max_pending` to set an explicit allowance.
+
+```sh
+apsa reports reassess latest
+apsa reports compare audit_BEFORE audit_AFTER
+apsa reports export latest --format sarif --out audit.sarif
+apsa reports verify
+```
+
+Reassessment applies current intelligence to a saved inventory; run `scan` again for changed files or new static checks. If connected to an AI client, that client may send report metadata to its model provider. APSA's MCP context excludes source excerpts, full source files, and screenshot bytes; client-side data handling still depends on the client.
+
+## CI and background jobs
+
+```sh
+apsa policy init --out apsa.toml
+apsa scan /path/to/owned/app --policy apsa.toml --out audit.json
+apsa scan /path/to/owned/app --fail-on high --include-candidates
+apsa scan /path/to/owned/app --background --json
+apsa jobs status JOB_ID --json
+```
+
+Severity gates exclude `candidate` findings by default. Opt in with `--include-candidates` or the policy's `allowed_statuses`. Required rules accept only `checked` or `not-applicable` coverage; partial execution and missing required checks do not pass. Waivers need a finding ID, a reason, and an expiry date. A background job being `completed` means it finished; check its `audit_incomplete` flag and report before treating the audit as complete.
+
+| Exit code | Meaning for the unified CLI |
+| --- | --- |
+| `0` | Command completed or policy passed |
+| `1` | Execution error |
+| `2` | Invalid arguments |
+| `3` | Incomplete audit or policy, failed report verification, or failed or partial intelligence synchronization |
+| `4` | Findings exceeded the configured CI threshold |
+| `130` | Interrupted |
+
+`--json` emits an envelope containing `ok`, `data` or `error`, and `exit_code`; watch emits one JSON envelope per cycle (NDJSON). `ok` is `true` for codes `0` and `4`; code `4` means evaluation succeeded but the CI threshold was exceeded. CI must check `exit_code` and the policy result. Reports may still be produced for codes `3` and `4`. See the [CI example](https://github.com/ictechgy/apsa/blob/main/docs/ci-example.yml) and [operations guide](https://github.com/ictechgy/apsa/blob/main/docs/OPERATIONS.md) (Korean) for policies, backup, limits, and troubleshooting.
+
+## MCP and skills
+
+```sh
+apsa integrations --root /absolute/path/to/owned-apps
+apsa mcp --root /absolute/path/to/owned-apps
+apsa skill install
+apsa context --report latest --json
+```
+
+Use `integrations` to generate a configuration with the installed executable path, or a `python -m apsa` fallback when no `apsa` executable is found. The shape below is illustrative; replace both absolute paths:
+
+```json
+{
+  "mcpServers": {
+    "apsa": {
+      "command": "/absolute/path/to/apsa",
+      "args": ["mcp", "--root", "/absolute/path/to/owned-apps"]
+    }
+  }
+}
+```
+
+MCP uses stdio and requires an explicit `--root`; repeat it for multiple roots. `integrations` defaults to the current directory when no root is supplied. Roots restrict audited targets and access to their reports and jobs. `--allow-any-root` explicitly removes that restriction. APSA does not change model-client configuration automatically; client authentication belongs to the client.
+
+| Purpose | MCP tools |
+| --- | --- |
+| Audits | `capabilities`, `audit_scan`, `audit_start`, `audit_reassess` |
+| Jobs | `jobs_list`, `jobs_status`, `jobs_cancel` |
+| Reports | `reports_list`, `reports_get`, `reports_compare` |
+| Intelligence | `intelligence_sync`, `intelligence_search`, `intelligence_get`, `dependency_check` |
+| Policy | `policy_evaluate` |
+| Runtime planning | `runtime_plan`, `runtime_devices` |
+
+Resources include `apsa://rules` and `apsa://reports/{report_id}`. The previous `quaygate://` and `mobile-audit://` resource schemes remain compatible.
+
+The default server exposes runtime planning. `runtime_execute` and `runtime_start` are registered only with `--allow-runtime` at server startup. Both preview a scenario by default; `execute=true` runs it. `runtime_start` starts a cancellable background device job. Runtime tests need an authorized, prepared test app; the default audit does not boot devices or install apps. See the [operations guide](https://github.com/ictechgy/apsa/blob/main/docs/OPERATIONS.md) (Korean) before running a scenario.
+
+`skill install` copies the packaged [APSA skill](https://github.com/ictechgy/apsa/blob/main/.agents/skills/apsa/SKILL.md) to `~/.codex/skills/apsa`. To install directly into another model runtime's skill directory:
+
+```sh
+apsa skill install --name apsa --dest /path/to/runtime/skills/apsa
+```
+
+Use `--name quaygate` or `--name mobile-audit` to update a skill installed under an older default name; custom edits are preserved unless `--force` is supplied. `integrations` reports skill status. For clients without MCP, `context` provides report context that excludes source excerpts, full source files, and screenshot bytes.
+
+## Compatibility and stored data
+
+`quaygate` and `mobile-audit` invoke the same unified CLI. Python entry points `python -m apsa`, `python -m quaygate`, and `python -m mobile_audit` remain available. Existing reports and `QG-*` rule IDs retain their identity.
+
+Data is stored by default in `~/.local/share/mobile-audit`. Path precedence is `--home` → `APSA_HOME` → `QUAYGATE_HOME` → `MOBILE_AUDIT_HOME` → that default. Renaming does not copy the database or move history. Existing MCP configurations must include an authorized `--root`.
+
+The legacy `apk`, `ipa`, and `device` subcommands retain quick lint output and exit codes `0/1/2`; they do not save unified audit history or correlate vulnerability intelligence. Use `scan` for the full workflow. Older cached OSV records without severity need a fresh `scan --online` or `intel watch --online`; reassessment alone cannot recover missing scores.
+
+## Development, validation, and licensing
+
+```sh
+uv sync --locked --extra dev --python 3.12
+make test benchmark
+make export-release
+make release RELEASE_OUT=dist/apsa-local-release
+```
+
+Choose a new or empty release directory. Release verification requires uv **0.12.1** and builds wheel/sdist twice, compares their hashes, and checks a clean installation outside the checkout with offline source/APK scans, MCP, and skill installation. It writes hashes, an SBOM, dependency notices, and a release manifest without publishing. Initial dependency preparation can use the network. The same-host repeat check does not claim byte-identical builds across platforms.
+
+Tagged releases use GitHub Actions to publish the verified distributions to PyPI after the supported CI matrix passes. See [release publishing](https://github.com/ictechgy/apsa/blob/main/docs/PUBLISHING.md) for the workflow and download contents.
+
+Recorded product validation is in [RELEASE_READINESS.md](https://github.com/ictechgy/apsa/blob/main/RELEASE_READINESS.md). The [curated benchmark](https://github.com/ictechgy/apsa/blob/main/benchmarks/README.md) is a regression corpus, not a measure of production detection rates. [Integration boundaries](https://github.com/ictechgy/apsa/blob/main/docs/INTEGRATION.md) and the [threat model](https://github.com/ictechgy/apsa/blob/main/docs/THREAT_MODEL.md) are currently in Korean. Historical reviews remain tied to their original snapshots.
+
+The source is publicly available on [GitHub](https://github.com/ictechgy/apsa). [LICENSE](https://github.com/ictechgy/apsa/blob/main/LICENSE) preserves the original Quaygate MIT notice. This publication does not declare an additional license for the combined product.

apsa-1.0.3.dist-info/RECORD

@@ -0,0 +1,62 @@
+apsa/__init__.py,sha256=LkhWhbHT-0QkessgaipnwaroP_hpI1GH9msjzp-xQIg,122
+apsa/__main__.py,sha256=k1ocEWawweo1qCJWNFAAvyxz3tcY13dzvCenHszij30,48
+apsa/cli.py,sha256=nn9B7UEjIJTXduuArAs8cJMjT7Atd4j8t2w21T0oqAM,119
+quaygate/__init__.py,sha256=C_uzOFT-RUKkyZHZ3-VPAaES39WApbprM_VmvrJX24w,104
+quaygate/__main__.py,sha256=E6Gls0DNz8GQK2K-kOUIx8cYhgANW_CH54VKrfCfs14,52
+quaygate/adb.py,sha256=TCUAQE0otx9gVMm6w8pPUV0NLWsNq6F2Q69pBS0jRqo,2140
+quaygate/apk.py,sha256=zv90IBb38kc8oBuwoL9kyyKG4eGJzkBvqxsdOmpM8Cg,5193
+quaygate/appchecks.py,sha256=SF_o3wWtkc61m6STVvs8WCuG5GLZsjVnBGkc1O-cEcU,39157
+quaygate/apps.py,sha256=2ZwVRRPZ1S3QlErvoKtzE36f3QuVzAx_QOAtYQYqtSQ,6266
+quaygate/arsc.py,sha256=4oOH61MqnkFaZDilErSf9WpZDDAOUoLZX75iY9ZMUpw,6666
+quaygate/axml.py,sha256=NeES60Ma5FGoUdoTmCYJ-b3B-k6M-rqWOh6jsIuZZqY,6418
+quaygate/cert.py,sha256=PoDXQxdo6HBQBkv3coX7YyGtHTuxwkfCSS73Tg205kE,3803
+quaygate/checks.py,sha256=_i1AaGTlzqFng1-8-0YuA4wa1P7oI_i5LXnoxBifpHY,13205
+quaygate/cli.py,sha256=bdpr_rmwFta9_FF--EcCNvqN30RVPV_Sy2en0TGzUrk,541
+quaygate/dex.py,sha256=OHk4FEkqFxprfTdduyG0WuoOZ1_1IxDBRlxrPYfpaeE,1330
+quaygate/dexcode.py,sha256=zLikYSt_KKZ1Ou_t9-59sMxJcAxoeNhctkjXoO2M1dQ,11087
+quaygate/elf.py,sha256=xodI04O-eMXGf0J2WF5kVfNutNaIbm1Zb7XtI9-cZ1E,3517
+quaygate/indicators.py,sha256=n_rLQ1wb4RgWR6B3_f_cGa2t-B71AtMNf25xNt1D3fk,7286
+quaygate/ipa.py,sha256=0S3HSbdNwCS5a1E2dGgC8GWDzSK2diIpaLdG6NkG8gQ,17810
+quaygate/legacy_cli.py,sha256=Tgl9larDg6TWLrK-5uAguIyIqoDsLMgAQtWPFoQCSTQ,6325
+quaygate/network_security.py,sha256=62OBN7UyoNt519Kng8VNzeKp6473E7PYjTo5HV0LYqU,6224
+quaygate/report.py,sha256=HB-LQedJY32ygHiHm_8Zj5ZNjA97zzpSQE2En0hnR8o,4768
+mobile_audit/__init__.py,sha256=hU-Du9fv2240GJc1ZYlNFMSaqPEzn_-ZUYdjy43Pk4s,117
+mobile_audit/__main__.py,sha256=k1ocEWawweo1qCJWNFAAvyxz3tcY13dzvCenHszij30,48
+mobile_audit/_job_worker.py,sha256=X_G4Z8-hJzTlwgEs82sNBgO6tkniT0O2vBEQOr_xV8A,2130
+mobile_audit/_parser_worker.py,sha256=qoVAGkqUbjLYKkvrImqS86tPr2_eqgtkkShd3bE4230,5095
+mobile_audit/audit.py,sha256=jSwMe81eNSE9LNL-5a0e8XlYmxgdXVaZm0eOlY9wCHQ,16343
+mobile_audit/binary_analysis.py,sha256=wi1atK6h8cLjHic5CzYKaEEr00mslcacWjCcp_RquHQ,39124
+mobile_audit/cli.py,sha256=S0RsnYs61f8wqw3hdy7Wa4urWIZJUmuSPpEmGUP_42w,23737
+mobile_audit/core.py,sha256=65Ot8JrMNeLpy4QJwJ7llO48NDNWFdriQs6Vdk2c1uY,8298
+mobile_audit/engine.py,sha256=f-zQHoF4u0ceQcwa1RFTiLOobA8yFR1JTcvTfifcZ4M,2418
+mobile_audit/inputs.py,sha256=DCWrcq6xK5CNsj8xDVBHtcT88sUarpqLlnTBHfOUPAo,24532
+mobile_audit/intel.py,sha256=tMhiUlO9eLZypqKC_PKQP_-3hcHvx_wAHWmkdCybd10,36106
+mobile_audit/jobs.py,sha256=zsFpkb64w8GhJCXSCBvpUubmUQXYIQaCZhuNeKkPEoI,7369
+mobile_audit/mcp_server.py,sha256=SWt8Tkbz_t0Mzad3Af_8fbfwa0uayWT-i5bsSCzlYR4,15089
+mobile_audit/output.py,sha256=3ssS6n0z5G2L3JCYpyWDUfoGwXNAZUy32WOdbTJx3w8,7064
+mobile_audit/policy.py,sha256=H79Ssz2S_HshI2jFht9QLTzpyMgpyywvLtQq61WpkWo,18438
+mobile_audit/processes.py,sha256=gQUv8qqasME9rWkXZZB8fNAMYRC7zSwl-oVLLA-omOw,3213
+mobile_audit/quaygate_analysis.py,sha256=0dJNwQR7MbtCtmoaBd2IlCATU0OjrW7oMqyr0dTeoe0,8165
+mobile_audit/rules.py,sha256=yt9igIEU1cB2-KwYQc0VNCC4qNMBi82x7p_jKsaj4Po,6533
+mobile_audit/runtime.py,sha256=JBRq1_zfkodADq3zkgAnKQ8WgWKHENoJPtI0BMSV5aM,36988
+mobile_audit/skills.py,sha256=EdKb8AIRAlLB7pO_DNrFdBGTDAUXSievP69xb2ftAJQ,2576
+mobile_audit/source_analysis.py,sha256=Bb6x8w2mx9vHpXRFM6zpyNRjjmK9JDvONmWMD5G5MuA,42962
+mobile_audit/store.py,sha256=J6771B1-BMKgKygUmjCwBD2S8nsCg1JAre_gECtWXi8,23191
+mobile_audit/tools.py,sha256=kEvOPLH7zMAlmM_IR85QAVR1gAgY0rO1l-YsTzfA9yc,1422
+mobile_audit/tui.py,sha256=EdYG73naxvLetLPbf8hp2T7Z7qHaxtBN8Jv8ovakZH4,20680
+mobile_audit/watch.py,sha256=mPhM9DNpqqz7CDDJHfRUpp9MBhYI2otygv0r2p4ECfE,1781
+mobile_audit/data/rules.json,sha256=lYWSL8FMY6D3dpfLqTdHeyF1zs9GsPAnB9tEghmHMrA,5782
+mobile_audit/data/structural-rules.json,sha256=B5-rpkQMPpRoLBSV28CznioLwI6tF9WriyWa0HnlSp0,9854
+mobile_audit/data/demo/AndroidManifest.xml,sha256=yeJpWxeJklNaqWv57LyOqn5pzH0f0GdqXz6kMbCs_OU,708
+mobile_audit/data/demo/Demo.swift,sha256=0TY5nE7mmbW3yD9xUtN4ewWcqxrnyybEyD0j_2JeK8Q,111
+mobile_audit/data/demo/Info.plist,sha256=QoY6NtXNV64cT2Bab_GH8ttBKmVNlb27-H5-NVnHYQQ,473
+mobile_audit/data/demo/MainActivity.kt,sha256=t8UsoU33k95OCt6sYcxNLxGKWIhwlb_fHQBRG56bWVg,519
+mobile_audit/data/demo/build.gradle.kts,sha256=ybi0Oi22aHafcOoHCFjkaYMyLnkUpWl9d5S4pxmpkgM,74
+mobile_audit/data/skills/apsa/SKILL.md,sha256=p6rjMpabqYrI2kgxsFohCSs0JXjitLLGyL0nDJyT6Bs,6221
+mobile_audit/data/skills/mobile-audit/SKILL.md,sha256=W90CuC9uceGJEwhR17hRqhNNcneR5Zbad1VFcoyHk2s,6237
+mobile_audit/data/skills/quaygate/SKILL.md,sha256=YcWk3zR4FUJSUXfz_IaOKbzw_-fydX85we8iX4uGswU,6229
+apsa-1.0.3.dist-info/METADATA,sha256=Z66mhiNwwfW2eUKeK00QoyzFFP4ABBCbNKhFJqplkvE,14957
+apsa-1.0.3.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+apsa-1.0.3.dist-info/entry_points.txt,sha256=swEsVU_KobfUKISAtkD18lqmElkdJpqG1G5ATp1nrXY,101
+apsa-1.0.3.dist-info/licenses/LICENSE,sha256=FbogplrPYWjwJZIGJWxqsWT94pNcZ_qrfEGi_edg_XI,1078
+apsa-1.0.3.dist-info/RECORD,,

apsa-1.0.3.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.4
+Root-Is-Purelib: true
+Tag: py3-none-any

apsa-1.0.3.dist-info/entry_points.txt

@@ -0,0 +1,4 @@
+[console_scripts]
+apsa = apsa.cli:main
+mobile-audit = quaygate.cli:main
+quaygate = quaygate.cli:main

apsa-1.0.3.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 quaygate contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

mobile_audit/__init__.py

@@ -0,0 +1,3 @@
+"""Shared audit engine bundled in the unified APSA distribution."""
+
+from quaygate import __version__ as __version__

mobile_audit/__main__.py

@@ -0,0 +1,3 @@
+from .cli import main
+
+raise SystemExit(main())

mobile_audit/_job_worker.py

@@ -0,0 +1,72 @@
+from __future__ import annotations
+
+import os
+import signal
+import sys
+from pathlib import Path
+
+import psutil
+
+from . import jobs
+from .audit import scan
+from .core import redact
+from .runtime import run
+from .store import Store
+
+
+def interrupted(_signum, _frame):
+    raise KeyboardInterrupt
+
+
+def main() -> None:
+    store = Store(Path(sys.argv[1]))
+    identifier = sys.argv[2]
+    signal.signal(signal.SIGTERM, interrupted)
+    try:
+        row = jobs.get(store, identifier, private=True)
+        if row["state"] in jobs.TERMINAL:
+            return
+        jobs.update(
+            store,
+            identifier,
+            state="running",
+            pid=os.getpid(),
+            process_started=psutil.Process().create_time(),
+        )
+        payload = row["payload"]
+        if payload["kind"] == "scan":
+
+            def progress(stage, percent):
+                jobs.update(store, identifier, stage=stage, progress=percent)
+
+            report = scan(
+                store,
+                Path(payload["target"]),
+                online=payload.get("online", False),
+                sbom=Path(payload["sbom"]) if payload.get("sbom") else None,
+                environment=payload.get("environment"),
+                progress=progress,
+                expected_target=Path(row["target"]),
+            )
+        else:
+            jobs.update(store, identifier, stage="device-scenario", progress=10)
+            report = run(
+                store,
+                Path(payload["scenario"]),
+                payload["report_id"],
+                screenshots=payload.get("screenshots", False),
+                scenario=payload.get("scenario_value"),
+            )
+        jobs.update(
+            store, identifier, state="completed", progress=100, stage="completed", report_id=report["id"]
+        )
+    except KeyboardInterrupt:
+        jobs.update(store, identifier, state="cancelled", stage="cancelled")
+    except Exception as error:
+        jobs.update(store, identifier, state="failed", stage="failed", error=redact(str(error))[:800])
+    finally:
+        store.close()
+
+
+if __name__ == "__main__":
+    main()

mobile_audit/_parser_worker.py

@@ -0,0 +1,125 @@
+"""Internal parser boundary. This process never accesses the report database or network."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+import tempfile
+from contextlib import contextmanager, nullcontext
+from pathlib import Path
+
+
+def limits() -> None:
+    if sys.platform == "win32":
+        return
+    import resource
+
+    resource.setrlimit(resource.RLIMIT_CPU, (45, 46))
+    resource.setrlimit(resource.RLIMIT_FSIZE, (512 * 1024 * 1024, 512 * 1024 * 1024))
+    resource.setrlimit(resource.RLIMIT_NOFILE, (128, 128))
+    if sys.platform.startswith("linux"):
+        resource.setrlimit(resource.RLIMIT_AS, (2 * 1024**3, 2 * 1024**3))
+
+
+@contextmanager
+def stable_input(target: Path, scratch: Path | None = None):
+    from .core import MAX_ARCHIVE_TOTAL, open_file
+
+    if target.is_dir():
+        yield target
+        return
+    fd = open_file(target)
+    directory_context = (
+        nullcontext(str(scratch)) if scratch else tempfile.TemporaryDirectory(prefix="mobile-audit-parser-")
+    )
+    with os.fdopen(fd, "rb") as source, directory_context as directory:
+        import stat
+
+        before = os.fstat(source.fileno())
+        if not stat.S_ISREG(before.st_mode) or before.st_size > MAX_ARCHIVE_TOTAL:
+            raise ValueError("Archive is not a regular input within the size limit")
+        snapshot = Path(directory) / ("input" + target.suffix)
+        total = 0
+        with snapshot.open("wb") as output:
+            snapshot.chmod(0o600)
+            while chunk := source.read(1024 * 1024):
+                total += len(chunk)
+                if total > MAX_ARCHIVE_TOTAL:
+                    raise ValueError("Archive grew beyond the input size limit")
+                output.write(chunk)
+        after = os.fstat(source.fileno())
+        if (before.st_size, before.st_mtime_ns) != (after.st_size, after.st_mtime_ns):
+            raise ValueError("Archive changed during inspection; rerun with a stable build")
+        yield snapshot
+
+
+def analyze(target: Path, sbom: Path | None) -> dict:
+    from .inputs import inspect_target
+    from .rules import static_checks
+
+    inventory, sources = inspect_target(target, sbom)
+    findings, coverage = static_checks(inventory, sources)
+    from .source_analysis import analyze_sources
+
+    structural = analyze_sources(sources)
+    findings.extend(structural["findings"])
+    coverage.extend(structural["coverage"])
+    inventory["warnings"].extend(structural["warnings"])
+    if target.suffix.lower() in {".apk", ".ipa"}:
+        from .binary_analysis import analyze_binary
+
+        binary = analyze_binary(target, inventory)
+        findings.extend(binary["findings"])
+        coverage.extend(binary["coverage"])
+        inventory["warnings"].extend(binary["warnings"])
+        inventory["binary"] = binary["metadata"]
+        inventory["features"] = sorted(
+            set(inventory["features"])
+            | {feature for dex in binary["metadata"].get("dex", []) for feature in dex.get("features", [])}
+        )
+        from .quaygate_analysis import analyze as analyze_lint
+        from .quaygate_analysis import merge
+
+        lint = analyze_lint(target)
+        findings = merge(findings, lint["findings"])
+        coverage.extend(lint["coverage"])
+        inventory["warnings"].extend(lint["warnings"])
+        inventory["quaygate"] = lint["metadata"]
+        if not lint["metadata"]["complete"]:
+            inventory["partial"] = True
+    inventory["engines"] = ["mobile-audit"] + (["quaygate-lint"] if "quaygate" in inventory else [])
+    if not inventory["fingerprint_complete"]:
+        inventory["partial"] = True
+        for check in coverage:
+            if check["state"] == "checked":
+                check["state"] = "partial"
+        inventory["warnings"].append(
+            "Input coverage is incomplete; the fingerprint identifies inspected source files only."
+        )
+    return {"inventory": inventory, "findings": findings, "coverage": coverage}
+
+
+def main() -> None:
+    limits()
+
+    try:
+        target = Path(sys.argv[1])
+        if not target.exists():
+            raise ValueError(f"Input not found: {target}")
+        if not target.is_dir() and target.suffix.lower() not in {".apk", ".ipa", ".zip", ".aab"}:
+            raise ValueError("Use a source folder, APK, IPA, simulator .app folder, or supported app ZIP")
+        expected = Path(sys.argv[3]) if len(sys.argv) > 3 and sys.argv[3] else target
+        if target.resolve() != expected:
+            raise ValueError("Authorized input moved or became a symlink; audit refused")
+        scratch = Path(sys.argv[4]) if len(sys.argv) > 4 else None
+        with stable_input(target, scratch) as snapshot:
+            result = analyze(snapshot, Path(sys.argv[2]) if len(sys.argv) > 2 and sys.argv[2] else None)
+            result["inventory"]["target"] = str(target)
+    except (ValueError, OSError, TypeError, KeyError) as error:
+        result = {"error": f"Input analysis failed ({type(error).__name__}): {error}"}
+    sys.stdout.write(json.dumps(result, ensure_ascii=False))
+
+
+if __name__ == "__main__":
+    main()