certifyclouds 1.3.6__tar.gz → 1.3.9__tar.gz

{certifyclouds-1.3.6 → certifyclouds-1.3.9}/.gitignore

@@ -5,6 +5,7 @@
 .dev.vars
 .release-env
 .release-env.*
+!.release-env.example
 *.pem
 *.key
 .mcp.json
@@ -40,6 +41,10 @@ dist/
 *.egg
 .venv/
 venv/
+# backend/venv is a symlink to the main repo venv in this worktree; `venv/` (above) only
+# matches directories, not the symlink, so it needs its own entry. (.gitignore has no
+# inline comments — the comment must be on its own line or it becomes part of the pattern.)
+backend/venv
 ENV/
 .pytest_cache/
 .ruff_cache/
@@ -72,7 +77,10 @@ pnpm-debug.log*
 
 # IDE
 .idea/
-.vscode/
+.vscode/*
+# share team format-on-save config; ignore personal IDE files
+!.vscode/settings.json
+!.vscode/extensions.json
 *.swp
 *.swo
 *~
@@ -121,6 +129,7 @@ claude-*.md
 
 # Frontend test coverage
 frontend/coverage/
+frontend/.fallow/
 
 # Backup files
 backups/
@@ -177,3 +186,23 @@ scripts/lab/.db-password-*.backup
 scripts/lab/.deploy-sso-secret
 scripts/lab/.cloud-creds/
 .preflight-venv/
+
+# Working-draft customer reply files (not committed)
+REPLY_TO_*.txt
+heartland-call-brief-*.md
+# Root-anchored: a bare `enterprise` also ignored docs-public/docs/enterprise/
+/enterprise
+
+# Script backups (build-once refactor + future)
+scripts/build/*.bak-*
+
+# Superpowers skill framework (local agent tooling, not project code)
+.superpowers/
+
+# Codex CLI per-repo artifacts (hooks.json etc) — dropped by /gpt runs
+.codex/
+
+# Graphify knowledge-graph output (generated, not project code)
+graphify-out/
+pre-bless-artifacts/
+stress-artifacts/

{certifyclouds-1.3.6 → certifyclouds-1.3.9}/PKG-INFO

@@ -1,10 +1,9 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: certifyclouds
-Version: 1.3.6
+Version: 1.3.9
 Summary: Scan Azure Key Vaults for expiring secrets, certificates, and keys
 Project-URL: Homepage, https://certifyclouds.com/scanner
 Project-URL: Documentation, https://docs.certifyclouds.com/scanner
-Project-URL: Repository, https://codeberg.org/hus/cc
 Author-email: CertifyClouds <hello@certifyclouds.com>
 License: Apache-2.0
 License-File: LICENSE
@@ -16,26 +15,29 @@ Classifier: Intended Audience :: System Administrators
 Classifier: License :: OSI Approved :: Apache Software License
 Classifier: Operating System :: OS Independent
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.9
-Classifier: Programming Language :: Python :: 3.10
 Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Topic :: Security
 Classifier: Topic :: System :: Systems Administration
-Requires-Python: >=3.9
+Requires-Python: >=3.11
 Requires-Dist: azure-core>=1.38.0
 Requires-Dist: azure-identity>=1.20
 Requires-Dist: azure-keyvault-certificates>=4.9
 Requires-Dist: azure-keyvault-keys>=4.10
 Requires-Dist: azure-keyvault-secrets>=4.9
 Requires-Dist: azure-mgmt-keyvault>=14.0.1
-Requires-Dist: azure-mgmt-resource>=24.0
-Requires-Dist: azure-mgmt-subscription>=3.1
+Requires-Dist: azure-mgmt-resource-subscriptions==1.0.0
 Requires-Dist: click>=8.0
+Requires-Dist: cryptography>=46.0.7
 Requires-Dist: httpx>=0.27
+Requires-Dist: idna>=3.15
+Requires-Dist: pygments>=2.20.0
+Requires-Dist: pyjwt>=2.13.0
+Requires-Dist: requests>=2.33.0
 Requires-Dist: rich>=15.0
 Requires-Dist: tenacity>=9.0
+Requires-Dist: urllib3>=2.7.0
 Provides-Extra: dev
 Requires-Dist: pytest-mock>=3.10; extra == 'dev'
 Requires-Dist: pytest>=9.0.3; extra == 'dev'
@@ -221,8 +223,6 @@ CertifyClouds Scanner sends **aggregate usage statistics** to improve the produc
 
 Use `--offline` to skip license server validation calls (key telemetry and version checks). Azure SDK calls are unaffected — the scanner still requires Azure connectivity to read Key Vault data.
 
-Source code is open and auditable: [codeberg.org/hus/cc/scanner](https://codeberg.org/hus/cc)
-
 ## Troubleshooting
 
 **"No Azure credentials found"**
@@ -254,4 +254,3 @@ Apache 2.0. See [LICENSE](LICENSE).
 
 - [CertifyClouds](https://certifyclouds.com) - Automate secret rotation & compliance
 - [Documentation](https://docs.certifyclouds.com/scanner)
-- [Source Code](https://codeberg.org/hus/cc)

{certifyclouds-1.3.6 → certifyclouds-1.3.9}/README.md

@@ -178,8 +178,6 @@ CertifyClouds Scanner sends **aggregate usage statistics** to improve the produc
 
 Use `--offline` to skip license server validation calls (key telemetry and version checks). Azure SDK calls are unaffected — the scanner still requires Azure connectivity to read Key Vault data.
 
-Source code is open and auditable: [codeberg.org/hus/cc/scanner](https://codeberg.org/hus/cc)
-
 ## Troubleshooting
 
 **"No Azure credentials found"**
@@ -211,4 +209,3 @@ Apache 2.0. See [LICENSE](LICENSE).
 
 - [CertifyClouds](https://certifyclouds.com) - Automate secret rotation & compliance
 - [Documentation](https://docs.certifyclouds.com/scanner)
-- [Source Code](https://codeberg.org/hus/cc)

{certifyclouds-1.3.6 → certifyclouds-1.3.9}/pyproject.toml

@@ -1,10 +1,10 @@
 [project]
 name = "certifyclouds"
-version = "1.3.6"
+version = "1.3.9"
 description = "Scan Azure Key Vaults for expiring secrets, certificates, and keys"
 readme = "README.md"
 license = { text = "Apache-2.0" }
-requires-python = ">=3.9"
+requires-python = ">=3.11"
 authors = [{ name = "CertifyClouds", email = "hello@certifyclouds.com" }]
 keywords = ["azure", "keyvault", "secrets", "certificates", "security", "scanner", "expiry", "rotation"]
 classifiers = [
@@ -16,8 +16,6 @@ classifiers = [
     "Topic :: Security",
     "Topic :: System :: Systems Administration",
     "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.9",
-    "Programming Language :: Python :: 3.10",
     "Programming Language :: Python :: 3.11",
     "Programming Language :: Python :: 3.12",
     "Programming Language :: Python :: 3.13",
@@ -26,8 +24,7 @@ classifiers = [
 
 dependencies = [
     "azure-identity>=1.20",
-    "azure-mgmt-resource>=24.0",
-    "azure-mgmt-subscription>=3.1",
+    "azure-mgmt-resource-subscriptions==1.0.0",
     "azure-mgmt-keyvault>=14.0.1",
     "azure-keyvault-secrets>=4.9",
     "azure-keyvault-certificates>=4.9",
@@ -37,6 +34,15 @@ dependencies = [
     "click>=8.0",
     "rich>=15.0",
     "httpx>=0.27",
+    # Security floors on transitive deps (pip-audit 2026-06-04). Pinned here so a
+    # fresh `pip install certifyclouds` can't resolve a known-vulnerable version;
+    # drop a pin once the parent SDK requires the patched floor itself.
+    "pyjwt>=2.13.0",
+    "cryptography>=46.0.7",
+    "requests>=2.33.0",
+    "urllib3>=2.7.0",
+    "idna>=3.15",
+    "pygments>=2.20.0",
 ]
 
 [project.optional-dependencies]
@@ -51,7 +57,6 @@ cc-scan = "cc_scanner.cli:main"
 [project.urls]
 Homepage = "https://certifyclouds.com/scanner"
 Documentation = "https://docs.certifyclouds.com/scanner"
-Repository = "https://codeberg.org/hus/cc"
 
 [build-system]
 requires = ["hatchling"]

{certifyclouds-1.3.6 → certifyclouds-1.3.9}/src/cc_scanner/__init__.py

@@ -1,3 +1,3 @@
 """CertifyClouds Scanner — scan Azure Key Vaults for expiring secrets, certificates, and keys."""
 
-__version__ = "1.3.6"
+__version__ = "1.3.9"

{certifyclouds-1.3.6 → certifyclouds-1.3.9}/src/cc_scanner/auth.py

@@ -42,7 +42,12 @@ def validate_key(key: str, stats: dict[str, Any] | None = None) -> ValidationRes
     Returns:
         ValidationResult with valid/invalid/offline status
     """
-    # Check if we can skip validation (cached grace period)
+    # Check if we can skip validation (cached grace period).
+    # CAUTION: this cached path never sees a server-side revocation — a
+    # revoked key stays valid=True for up to the 7-day grace window. The CLI
+    # always passes stats (cli.py builds them before calling), so this branch
+    # is only reachable from future callers/tests that omit stats — keep it
+    # that way, or revocation enforcement silently degrades.
     if stats is None and cfg.is_validation_fresh():
         logger.debug("Skipping validation — last validated within grace period")
         return ValidationResult(valid=True, offline=False)

{certifyclouds-1.3.6 → certifyclouds-1.3.9}/src/cc_scanner/cli.py

@@ -123,6 +123,23 @@ def _setup_logging(verbosity: int) -> None:
         logging.getLogger(name).setLevel(logging.WARNING)
 
 
+
+def _exit_now(code: int) -> None:
+    """Exit without waiting for in-flight scan threads.
+
+    ``scan()`` returns at the timeout deadline (pool shut down with
+    ``wait=False``), but the interpreter still joins non-daemon pool threads at
+    exit — ``threading._shutdown`` waits for them, and ThreadPoolExecutor has
+    not allowed daemon threads since Python 3.9. So a plain ``sys.exit`` here
+    holds the command open until the abandoned Azure call finishes, which is
+    exactly what --timeout promises not to do. ``os._exit`` after flushing
+    skips the join. Only used on the timed-out paths, where the lingering
+    thread is abandoned by design; normal exits keep ``sys.exit``.
+    """
+    sys.stdout.flush()
+    sys.stderr.flush()
+    os._exit(code)
+
 @click.command()
 @click.option("--format", "fmt", type=click.Choice(["table", "json", "csv", "html"]),
               default=None, help="Output format (default: table)")
@@ -249,6 +266,8 @@ def main(
                 console.print("  AZURE_TENANT_ID")
         elif fmt == "json":
             get_formatter("json")(results, [], output_file)
+        if results.get("timed_out"):
+            _exit_now(2)
         sys.exit(2)
 
     if results.get("timed_out"):
@@ -319,7 +338,7 @@ def main(
 
     # Exit code
     if results.get("timed_out"):
-        sys.exit(2)
+        _exit_now(2)
     if has_critical_or_high(findings):
         sys.exit(1)
     sys.exit(0)

certifyclouds-1.3.9/src/cc_scanner/formatters/csv_fmt.py

@@ -0,0 +1,77 @@
+"""CSV formatter for scan results."""
+from __future__ import annotations
+
+import csv
+import io
+from datetime import datetime, timezone
+from typing import Any
+
+
+def format_csv(
+    results: dict[str, Any],
+    findings: list[dict[str, Any]],
+    output_file: str | None = None,
+) -> str | None:
+    """Format scan results as flat CSV (one row per asset).
+
+    Args:
+        results: Scan results dict
+        findings: Security findings list (not included in CSV — use JSON for that)
+        output_file: If set, write to file
+    """
+    def _write(output) -> None:
+        writer = csv.writer(output)
+        writer.writerow([
+            "subscription", "vault", "type", "name", "enabled", "expires",
+            "days_until_expiry", "content_type", "version", "tags",
+        ])
+
+        now = datetime.now(timezone.utc)
+
+        for sub in results.get("subscriptions", []):
+            sub_name = sub.get("name", sub.get("id", ""))
+            for vault in sub.get("vaults", []):
+                vault_name = vault.get("name", "")
+                for item_type, items in [
+                    ("secret", vault.get("secrets", [])),
+                    ("certificate", vault.get("certificates", [])),
+                    ("key", vault.get("keys", [])),
+                ]:
+                    for item in items:
+                        days_left = ""
+                        expires_on = item.get("expiresOn")
+                        if expires_on:
+                            try:
+                                expiry = datetime.fromisoformat(expires_on.replace("Z", "+00:00"))
+                                if expiry.tzinfo is None:
+                                    expiry = expiry.replace(tzinfo=timezone.utc)
+                                days_left = str((expiry - now).days)
+                            except (ValueError, TypeError):
+                                pass
+
+                        tags = item.get("tags", {})
+                        tags_str = "; ".join(f"{k}={v}" for k, v in tags.items()) if tags else ""
+
+                        writer.writerow([
+                            sub_name,
+                            vault_name,
+                            item_type,
+                            item.get("name", ""),
+                            item.get("enabled", ""),
+                            expires_on or "",
+                            days_left,
+                            item.get("contentType", ""),
+                            item.get("version", ""),
+                            tags_str,
+                        ])
+
+    # Context manager guarantees the handle closes even if writing raises.
+    if output_file:
+        with open(output_file, "w", newline="", encoding="utf-8") as output:
+            _write(output)
+    else:
+        output = io.StringIO()
+        _write(output)
+        print(output.getvalue(), end="")
+
+    return None

{certifyclouds-1.3.6 → certifyclouds-1.3.9}/src/cc_scanner/formatters/table.py

@@ -35,14 +35,27 @@ def format_table(
     Returns:
         None (prints to console) or string if output_file is set
     """
-    console = Console(file=open(output_file, "w") if output_file else None, force_terminal=output_file is None)
+    # Manage the file handle with a context manager so it always closes, even if
+    # Rich rendering raises mid-write (e.g. a malformed finding dict) — a bare
+    # open() passed to Console leaked the handle on any exception.
+    if output_file:
+        with open(output_file, "w") as fh:
+            _render_table(Console(file=fh, force_terminal=False), results, findings)
+    else:
+        _render_table(Console(force_terminal=True), results, findings)
+    return None
 
+
+def _render_table(
+    console: Console,
+    results: dict[str, Any],
+    findings: list[dict[str, Any]],
+) -> None:
+    """Render the full scan table (tree + summary + findings) to a console."""
     # Check for scan error
     if results.get("error"):
         console.print(f"[red]Error: {results['error']}[/red]")
-        if output_file:
-            console.file.close()
-        return None
+        return
 
     # Subscription tree
     for sub in results.get("subscriptions", []):
@@ -135,11 +148,6 @@ def format_table(
             console.print(f"  [dim]... and {remaining} more findings[/dim]")
         console.print()
 
-    if output_file:
-        console.file.close()
-
-    return None
-
 
 def format_table_security_only(
     results: dict[str, Any],
@@ -147,12 +155,18 @@ def format_table_security_only(
     output_file: str | None = None,
 ) -> None:
     """Show only security findings summary (--security flag)."""
-    console = Console(file=open(output_file, "w") if output_file else None, force_terminal=output_file is None)
+    # Context manager guarantees the handle closes even if rendering raises.
+    if output_file:
+        with open(output_file, "w") as fh:
+            _render_security_table(Console(file=fh, force_terminal=False), findings)
+    else:
+        _render_security_table(Console(force_terminal=True), findings)
 
+
+def _render_security_table(console: Console, findings: list[dict[str, Any]]) -> None:
+    """Render the security-only findings summary to a console."""
     if not findings:
         console.print("[green]No security findings.[/green]")
-        if output_file:
-            console.file.close()
         return
 
     counts = count_by_severity(findings)
@@ -185,9 +199,6 @@ def format_table_security_only(
     console.print(table)
     console.print()
 
-    if output_file:
-        console.file.close()
-
 
 def _print_expiry_line(console: Console, label: str, counts: dict[str, int], style: str) -> None:
     """Print an expiry summary line if there are any items in this bucket."""

{certifyclouds-1.3.6 → certifyclouds-1.3.9}/src/cc_scanner/scanner.py

@@ -24,7 +24,7 @@ try:
     from azure.keyvault.keys import KeyClient  # type: ignore
     from azure.keyvault.secrets import SecretClient  # type: ignore
     from azure.mgmt.keyvault import KeyVaultManagementClient  # type: ignore
-    from azure.mgmt.subscription import SubscriptionClient  # type: ignore
+    from azure.mgmt.resource.subscriptions import SubscriptionClient  # type: ignore
 
     AZURE_SDK_AVAILABLE = True
 except ImportError:
@@ -524,28 +524,47 @@ def scan(
         # Execute subscription scans in parallel
         worker_count = min(max_workers, len(subs_to_scan)) if subs_to_scan else 1
 
+        # NB: deliberately NOT a `with` block. ThreadPoolExecutor.__exit__ calls
+        # shutdown(wait=True), which blocks until every in-flight subscription
+        # scan finishes — so `timeout` bounded only when we stopped COLLECTING
+        # results, not when the caller got control back. A --timeout 30 on a
+        # ten-minute scan still returned after ten minutes, making the flag inert.
+        # Shut down without waiting instead, cancelling anything not yet started.
+        executor = concurrent.futures.ThreadPoolExecutor(max_workers=worker_count)
         try:
-            with concurrent.futures.ThreadPoolExecutor(max_workers=worker_count) as executor:
-                future_to_sub = {executor.submit(scan_subscription, sub): sub for sub in subs_to_scan}
+            future_to_sub = {executor.submit(scan_subscription, sub): sub for sub in subs_to_scan}
 
-                for future in concurrent.futures.as_completed(future_to_sub, timeout=timeout):
-                    try:
-                        sub_entry = future.result()
-                        results["subscriptions"].append(sub_entry)
-                        results["totalVaults"] += len(sub_entry["vaults"])
-                        for vault in sub_entry["vaults"]:
-                            results["totalSecrets"] += len(vault.get("secrets", []))
-                            results["totalCertificates"] += len(vault.get("certificates", []))
-                            results["totalKeys"] += len(vault.get("keys", []))
-                            if vault.get("error"):
-                                results["vaultsWithErrors"] += 1
-                    except Exception as exc:
-                        sub = future_to_sub[future]
-                        logger.error("Scan failed for subscription %s: %s", getattr(sub, "display_name", sub.subscription_id), exc)
+            for future in concurrent.futures.as_completed(future_to_sub, timeout=timeout):
+                try:
+                    sub_entry = future.result()
+                    results["subscriptions"].append(sub_entry)
+                    results["totalVaults"] += len(sub_entry["vaults"])
+                    for vault in sub_entry["vaults"]:
+                        results["totalSecrets"] += len(vault.get("secrets", []))
+                        results["totalCertificates"] += len(vault.get("certificates", []))
+                        results["totalKeys"] += len(vault.get("keys", []))
+                        if vault.get("error"):
+                            results["vaultsWithErrors"] += 1
+                except Exception as exc:
+                    sub = future_to_sub[future]
+                    logger.error("Scan failed for subscription %s: %s", getattr(sub, "display_name", sub.subscription_id), exc)
         except concurrent.futures.TimeoutError:
-            logger.error("Scan timed out after %s seconds; returning partial results", timeout)
+            completed = len(results["subscriptions"])
+            logger.error(
+                "Scan timed out after %s seconds; returning partial results (%s of %s subscription(s) completed)",
+                timeout,
+                completed,
+                len(subs_to_scan),
+            )
             results["timed_out"] = True
             results["error"] = f"Scan timed out after {timeout} seconds"
+            # Subscriptions still queued are cancelled outright. One already
+            # running cannot be interrupted mid-Azure-call — Python cannot kill a
+            # thread — but it no longer holds up the caller, and each SDK call
+            # carries its own request timeout.
+            executor.shutdown(wait=False, cancel_futures=True)
+        else:
+            executor.shutdown(wait=True)
 
         return results
 

certifyclouds-1.3.6/src/cc_scanner/formatters/csv_fmt.py

@@ -1,74 +0,0 @@
-"""CSV formatter for scan results."""
-from __future__ import annotations
-
-import csv
-import io
-from datetime import datetime, timezone
-from typing import Any
-
-
-def format_csv(
-    results: dict[str, Any],
-    findings: list[dict[str, Any]],
-    output_file: str | None = None,
-) -> str | None:
-    """Format scan results as flat CSV (one row per asset).
-
-    Args:
-        results: Scan results dict
-        findings: Security findings list (not included in CSV — use JSON for that)
-        output_file: If set, write to file
-    """
-    output = io.StringIO() if not output_file else open(output_file, "w", newline="", encoding="utf-8")
-
-    writer = csv.writer(output)
-    writer.writerow([
-        "subscription", "vault", "type", "name", "enabled", "expires",
-        "days_until_expiry", "content_type", "version", "tags",
-    ])
-
-    now = datetime.now(timezone.utc)
-
-    for sub in results.get("subscriptions", []):
-        sub_name = sub.get("name", sub.get("id", ""))
-        for vault in sub.get("vaults", []):
-            vault_name = vault.get("name", "")
-            for item_type, items in [
-                ("secret", vault.get("secrets", [])),
-                ("certificate", vault.get("certificates", [])),
-                ("key", vault.get("keys", [])),
-            ]:
-                for item in items:
-                    days_left = ""
-                    expires_on = item.get("expiresOn")
-                    if expires_on:
-                        try:
-                            expiry = datetime.fromisoformat(expires_on.replace("Z", "+00:00"))
-                            if expiry.tzinfo is None:
-                                expiry = expiry.replace(tzinfo=timezone.utc)
-                            days_left = str((expiry - now).days)
-                        except (ValueError, TypeError):
-                            pass
-
-                    tags = item.get("tags", {})
-                    tags_str = "; ".join(f"{k}={v}" for k, v in tags.items()) if tags else ""
-
-                    writer.writerow([
-                        sub_name,
-                        vault_name,
-                        item_type,
-                        item.get("name", ""),
-                        item.get("enabled", ""),
-                        expires_on or "",
-                        days_left,
-                        item.get("contentType", ""),
-                        item.get("version", ""),
-                        tags_str,
-                    ])
-
-    if output_file:
-        output.close()
-    else:
-        print(output.getvalue(), end="")
-
-    return None