certinspect 2.2.0__tar.gz → 2.3.0__tar.gz

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (22) hide show
  1. {certinspect-2.2.0/src/certinspect.egg-info → certinspect-2.3.0}/PKG-INFO +103 -6
  2. {certinspect-2.2.0 → certinspect-2.3.0}/README.md +102 -5
  3. {certinspect-2.2.0 → certinspect-2.3.0}/pyproject.toml +1 -1
  4. {certinspect-2.2.0 → certinspect-2.3.0}/src/certinspect/__init__.py +1 -1
  5. {certinspect-2.2.0 → certinspect-2.3.0}/src/certinspect/cli.py +309 -39
  6. {certinspect-2.2.0 → certinspect-2.3.0/src/certinspect.egg-info}/PKG-INFO +103 -6
  7. {certinspect-2.2.0 → certinspect-2.3.0}/tests/test_cli.py +312 -1
  8. {certinspect-2.2.0 → certinspect-2.3.0}/LICENSE +0 -0
  9. {certinspect-2.2.0 → certinspect-2.3.0}/setup.cfg +0 -0
  10. {certinspect-2.2.0 → certinspect-2.3.0}/src/certinspect/discover.py +0 -0
  11. {certinspect-2.2.0 → certinspect-2.3.0}/src/certinspect/fetch.py +0 -0
  12. {certinspect-2.2.0 → certinspect-2.3.0}/src/certinspect/formatter.py +0 -0
  13. {certinspect-2.2.0 → certinspect-2.3.0}/src/certinspect/parser.py +0 -0
  14. {certinspect-2.2.0 → certinspect-2.3.0}/src/certinspect.egg-info/SOURCES.txt +0 -0
  15. {certinspect-2.2.0 → certinspect-2.3.0}/src/certinspect.egg-info/dependency_links.txt +0 -0
  16. {certinspect-2.2.0 → certinspect-2.3.0}/src/certinspect.egg-info/entry_points.txt +0 -0
  17. {certinspect-2.2.0 → certinspect-2.3.0}/src/certinspect.egg-info/requires.txt +0 -0
  18. {certinspect-2.2.0 → certinspect-2.3.0}/src/certinspect.egg-info/top_level.txt +0 -0
  19. {certinspect-2.2.0 → certinspect-2.3.0}/tests/test_discover.py +0 -0
  20. {certinspect-2.2.0 → certinspect-2.3.0}/tests/test_fetch.py +0 -0
  21. {certinspect-2.2.0 → certinspect-2.3.0}/tests/test_formatter.py +0 -0
  22. {certinspect-2.2.0 → certinspect-2.3.0}/tests/test_parser.py +0 -0
{certinspect-2.2.0/src/certinspect.egg-info → certinspect-2.3.0}/PKG-INFO RENAMED
@@ -1,6 +1,6 @@
1
1
  Metadata-Version: 2.4
2
2
  Name: certinspect
3
- Version: 2.2.0
3
+ Version: 2.3.0
4
4
  Summary: Command-line TLS certificate inspector
5
5
  Author-email: Michele Angrisano <michele.angrisano@gmail.com>
6
6
  License-Expression: MIT
@@ -133,6 +133,9 @@ $ echo $? # 0 = healthy, 3 = expiring, 4 = expired, 6 = revoked, ...
133
133
  - [`--concurrency`](#--concurrency-n)
134
134
  - [`--exporter`](#--exporter-nagiosprometheus)
135
135
  - [`--version`](#--version)
136
+ - [`--config`](#--config-path)
137
+ - [`--state-file` / `--only-changed`](#--state-file-path----only-changed)
138
+ - [`--print-completion`](#--print-completion-bashzsh)
136
139
  - [Monitoring](#monitoring)
137
140
  - [Exit codes](#exit-codes)
138
141
  - [Recipes](#recipes)
@@ -158,7 +161,7 @@ $ echo $? # 0 = healthy, 3 = expiring, 4 = expired, 6 = revoked, ...
158
161
  | Triage helpers | Only certs expiring within N days (`--max-days`), sort by host or soonest expiry (`--sort`), one-line tally (`--summary`), tighter CRITICAL threshold (`--critical-days`) |
159
162
  | Protocols | Direct TLS plus STARTTLS — SMTP, IMAP, POP3, FTP (`--starttls`) |
160
163
  | Connectivity | Mutual-TLS client certificates (`--client-cert`/`--client-key`) and HTTP CONNECT proxy tunnelling — explicit (`--proxy`) or from the environment (`HTTPS_PROXY`/`NO_PROXY`, like curl; `--no-proxy` to opt out) — for hosts behind a corporate/cloud egress proxy |
161
- | Automation | Meaningful exit codes for cron/CI (or force success with `--exit-zero`), no telemetry, single runtime dependency |
164
+ | Automation | Meaningful exit codes for cron/CI (or force success with `--exit-zero`), no telemetry, single runtime dependency, defaults from a `--config` file, low-noise recurring runs with `--state-file`/`--only-changed`, shell completion (`--print-completion`) |
162
165
 
163
166
  ## Requirements
164
167
 
@@ -178,6 +181,20 @@ source .venv/bin/activate
178
181
  pip install -e ".[dev]"
179
182
  ```
180
183
 
184
+ ### Docker
185
+
186
+ ```bash
187
+ docker build -t certinspect .
188
+ docker run --rm certinspect example.com
189
+ ```
190
+
191
+ ### Shell completion
192
+
193
+ ```bash
194
+ certinspect --print-completion bash | sudo tee /etc/bash_completion.d/certinspect
195
+ certinspect --print-completion zsh > "${fpath[1]}/_certinspect" # then restart the shell
196
+ ```
197
+
181
198
  ## Usage
182
199
 
183
200
  ```bash
@@ -597,7 +614,8 @@ certinspect example.com --export ./example.com.pem
597
614
  | Option | Description |
598
615
  | ------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
599
616
  | `target...` | One or more domains, URLs or `host:port` to inspect. Omit when using `--file`. |
600
- | `--file PATH` | Inspect a local certificate (PEM or DER) instead of a host. Use `-` to read the certificate from standard input. |
617
+ | `--config PATH` | Load default option values from a TOML file (keys use the argparse destination name); an explicit flag always overrides it. Auto-discovered at `~/.config/certinspect/config.toml` when omitted. |
618
+ | `--file PATH` | Inspect a local certificate (PEM or DER) instead of a host. Use `-` to read from standard input. Repeatable to inspect several files in one run; cannot be combined with host targets. |
601
619
  | `--port N` | TCP port to connect to (default: 443). |
602
620
  | `--timeout N` | Connection timeout in seconds (default: 5). Used for both connect and read unless the two below are set. |
603
621
  | `--connect-timeout N` | TCP connect timeout in seconds (default: `--timeout`). |
@@ -630,7 +648,7 @@ certinspect example.com --export ./example.com.pem
630
648
  | `--min-tls-version VER` | Fail (exit 9) when the connection negotiates a TLS version older than `VER` (`TLSv1`, `TLSv1.1`, `TLSv1.2`, `TLSv1.3`). Host targets only; opt-in. |
631
649
  | `--profile {lenient,standard,strict}` | Apply a named bundle of the opt-in policy checks in one go (exit 9 on violation). Intensity ladder, not an official standard; explicit flags override it. See [Policy profiles](#policy-profiles). |
632
650
  | `--input PATH` | Read extra targets from a file, one per line ('-' for stdin). |
633
- | `--discover DOMAIN` | Discover hostnames from Certificate Transparency logs (crt.sh) for DOMAIN and inspect each one, surfacing forgotten or shadow certificates. Repeatable; host targets only. |
651
+ | `--discover DOMAIN` | Discover hostnames from Certificate Transparency logs (crt.sh) for DOMAIN and inspect each one, surfacing forgotten or shadow certificates. Repeatable (queried concurrently per `--concurrency`); host targets only. |
634
652
  | `--discover-only` | With `--discover`, list the CT inventory (expiry, issuer, hostnames, soonest expiry first, wildcards included) for the domain(s) without connecting, then exit. Good for a fast audit or spotting a certificate from an unexpected CA. Supports `--json`/`--csv`. |
635
653
  | `--expect-issuer SUBSTRING` | With `--discover-only`, flag any certificate whose issuer matches none of these substrings (case-insensitive) and exit 9 — a Certificate Transparency mis-issuance check. Repeatable. |
636
654
  | `--discover-timeout N` | Timeout in seconds for the `--discover` crt.sh query (default: 30), separate from `--timeout` since a log search can be slower than a handshake. |
@@ -644,7 +662,10 @@ certinspect example.com --export ./example.com.pem
644
662
  | `--export PATH` | Save the inspected certificate as a PEM file at PATH. |
645
663
  | `--starttls {smtp,imap,pop3,ftp}` | Upgrade a plaintext connection to TLS before inspecting (standard port unless `--port` is given). |
646
664
  | `--exporter {nagios,prometheus}` | Emit machine-readable monitoring output (ignores `--quiet`). |
647
- | `--concurrency N` | Inspect up to N hosts in parallel in batch mode (default: 1; order is preserved). |
665
+ | `--concurrency N` | Inspect up to N hosts in parallel in batch mode (default: 1; order is preserved). Also governs `--discover`'s per-domain concurrency. |
666
+ | `--state-file PATH` | Persist each host target's status across runs at PATH (JSON) and compare against the previous run. Host targets only. |
667
+ | `--only-changed` | Show only targets whose status differs from the previous `--state-file` run (a first-seen target counts as changed). Requires `--state-file`; display only. |
668
+ | `--print-completion {bash,zsh}` | Print a shell completion script for bash or zsh to stdout, then exit. Generated from the parser, so it always matches the installed flags. |
648
669
  | `--version` | Print the version and exit. |
649
670
 
650
671
  ## Options in action
@@ -708,6 +729,23 @@ root — for example a PEM exported from a PKCS#12), `--verify` validates that
708
729
  chain **offline** and `--chain` lists every certificate in it (see
709
730
  [`--verify`](#--verify----cafile-path----capath-dir) and [`--chain`](#--chain)).
710
731
 
732
+ Repeat `--file` to inspect several local certificates in one run; each result
733
+ is then labelled with its path (like a host target's `=== host ===` header) so
734
+ you can tell them apart. `--file` cannot be combined with host targets.
735
+
736
+ ```console
737
+ $ certinspect --file leaf.pem --file expired.pem --no-verify
738
+ === leaf.pem ===
739
+ Subject: CN=example.com
740
+ Status: VALID
741
+ ...
742
+
743
+ === expired.pem ===
744
+ Subject: CN=old.example.com
745
+ Status: EXPIRED
746
+ ...
747
+ ```
748
+
711
749
  ### `--port N` / `--timeout N` — connection tuning
712
750
 
713
751
  The report is identical to a plain inspection; only how/where certinspect
@@ -1361,6 +1399,65 @@ $ certinspect --version
1361
1399
  certinspect 1.0.1
1362
1400
  ```
1363
1401
 
1402
+ ### `--config PATH`
1403
+
1404
+ Set defaults for a repeated invocation instead of a long, repeated command
1405
+ line. Keys use the argparse destination name (a flag's name with `-`
1406
+ replaced by `_`, e.g. `not-after-max` → `not_after_max`); an explicit
1407
+ command-line flag always overrides the config value.
1408
+
1409
+ ```console
1410
+ $ cat certinspect.toml
1411
+ days = 14
1412
+ verify = false
1413
+
1414
+ $ certinspect example.com --config certinspect.toml
1415
+ # same as: certinspect example.com --days 14 --no-verify
1416
+
1417
+ $ certinspect example.com --config certinspect.toml --days 30
1418
+ # --days 30 on the command line wins over the config's --days 14
1419
+ ```
1420
+
1421
+ Without `--config`, `~/.config/certinspect/config.toml` is loaded
1422
+ automatically if it exists — handy for a machine-wide default (e.g. a house
1423
+ `--profile` or `--cafile`) without wrapping the binary in a shell alias. A key
1424
+ that is not a real option, or that collides with another inside the same
1425
+ mutually exclusive group (e.g. setting both `json` and `csv`), is rejected at
1426
+ startup rather than silently ignored.
1427
+
1428
+ A commented [`certinspect.example.toml`](certinspect.example.toml) ships in
1429
+ the repository with the most commonly-set options — copy the ones you want.
1430
+
1431
+ ### `--state-file PATH` / `--only-changed`
1432
+
1433
+ For a recurring job (cron, CI) where you only care when something *changes* —
1434
+ not being reminded every run that a certificate is still fine. `--state-file`
1435
+ records each host's status in a small JSON file; `--only-changed` then limits
1436
+ the report to targets whose status differs from the previous run (a target
1437
+ seen for the first time counts as changed). The exit code still reflects
1438
+ every target, `--only-changed` affects the display only.
1439
+
1440
+ ```console
1441
+ $ certinspect example.com other.com --state-file /var/lib/certinspect/state.json --only-changed
1442
+ === other.com ===
1443
+ Status: EXPIRING
1444
+ ...
1445
+ # example.com is still VALID since the last run, so it is left out here.
1446
+ ```
1447
+
1448
+ The state file is always brought up to date, whether or not `--only-changed`
1449
+ is given, so the next run has a fresh baseline to compare against.
1450
+
1451
+ ### `--print-completion {bash,zsh}`
1452
+
1453
+ Generated straight from the argument parser, so it always matches the
1454
+ installed version's flags.
1455
+
1456
+ ```console
1457
+ $ certinspect --print-completion bash | sudo tee /etc/bash_completion.d/certinspect
1458
+ $ certinspect --print-completion zsh > "${fpath[1]}/_certinspect"
1459
+ ```
1460
+
1364
1461
  ### Fetch error (`exit 1`)
1365
1462
 
1366
1463
  An unreachable target prints an `error:` line to stderr and yields exit code 1;
@@ -1456,7 +1553,7 @@ worst code across all targets is returned.
1456
1553
  | 6 | Chain not trusted or revoked (`--verify`) |
1457
1554
  | 7 | Fingerprint does not match `--pin` |
1458
1555
  | 8 | Expected SAN missing (`--expect-san`) |
1459
- | 9 | Policy violation (`--not-after-max`/`--cab-forum`, `--min-key-size`, `--fail-weak`, `--require-sct`, `--require-must-staple`, `--min-tls-version`) |
1556
+ | 9 | Policy violation (`--not-after-max`/`--cab-forum`, `--min-key-size`, `--fail-weak`, `--require-sct`, `--require-must-staple`, `--require-revocation-check`, `--min-tls-version`) |
1460
1557
 
1461
1558
  Example in a script:
1462
1559
 
{certinspect-2.2.0 → certinspect-2.3.0}/README.md RENAMED
@@ -107,6 +107,9 @@ $ echo $? # 0 = healthy, 3 = expiring, 4 = expired, 6 = revoked, ...
107
107
  - [`--concurrency`](#--concurrency-n)
108
108
  - [`--exporter`](#--exporter-nagiosprometheus)
109
109
  - [`--version`](#--version)
110
+ - [`--config`](#--config-path)
111
+ - [`--state-file` / `--only-changed`](#--state-file-path----only-changed)
112
+ - [`--print-completion`](#--print-completion-bashzsh)
110
113
  - [Monitoring](#monitoring)
111
114
  - [Exit codes](#exit-codes)
112
115
  - [Recipes](#recipes)
@@ -132,7 +135,7 @@ $ echo $? # 0 = healthy, 3 = expiring, 4 = expired, 6 = revoked, ...
132
135
  | Triage helpers | Only certs expiring within N days (`--max-days`), sort by host or soonest expiry (`--sort`), one-line tally (`--summary`), tighter CRITICAL threshold (`--critical-days`) |
133
136
  | Protocols | Direct TLS plus STARTTLS — SMTP, IMAP, POP3, FTP (`--starttls`) |
134
137
  | Connectivity | Mutual-TLS client certificates (`--client-cert`/`--client-key`) and HTTP CONNECT proxy tunnelling — explicit (`--proxy`) or from the environment (`HTTPS_PROXY`/`NO_PROXY`, like curl; `--no-proxy` to opt out) — for hosts behind a corporate/cloud egress proxy |
135
- | Automation | Meaningful exit codes for cron/CI (or force success with `--exit-zero`), no telemetry, single runtime dependency |
138
+ | Automation | Meaningful exit codes for cron/CI (or force success with `--exit-zero`), no telemetry, single runtime dependency, defaults from a `--config` file, low-noise recurring runs with `--state-file`/`--only-changed`, shell completion (`--print-completion`) |
136
139
 
137
140
  ## Requirements
138
141
 
@@ -152,6 +155,20 @@ source .venv/bin/activate
152
155
  pip install -e ".[dev]"
153
156
  ```
154
157
 
158
+ ### Docker
159
+
160
+ ```bash
161
+ docker build -t certinspect .
162
+ docker run --rm certinspect example.com
163
+ ```
164
+
165
+ ### Shell completion
166
+
167
+ ```bash
168
+ certinspect --print-completion bash | sudo tee /etc/bash_completion.d/certinspect
169
+ certinspect --print-completion zsh > "${fpath[1]}/_certinspect" # then restart the shell
170
+ ```
171
+
155
172
  ## Usage
156
173
 
157
174
  ```bash
@@ -571,7 +588,8 @@ certinspect example.com --export ./example.com.pem
571
588
  | Option | Description |
572
589
  | ------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
573
590
  | `target...` | One or more domains, URLs or `host:port` to inspect. Omit when using `--file`. |
574
- | `--file PATH` | Inspect a local certificate (PEM or DER) instead of a host. Use `-` to read the certificate from standard input. |
591
+ | `--config PATH` | Load default option values from a TOML file (keys use the argparse destination name); an explicit flag always overrides it. Auto-discovered at `~/.config/certinspect/config.toml` when omitted. |
592
+ | `--file PATH` | Inspect a local certificate (PEM or DER) instead of a host. Use `-` to read from standard input. Repeatable to inspect several files in one run; cannot be combined with host targets. |
575
593
  | `--port N` | TCP port to connect to (default: 443). |
576
594
  | `--timeout N` | Connection timeout in seconds (default: 5). Used for both connect and read unless the two below are set. |
577
595
  | `--connect-timeout N` | TCP connect timeout in seconds (default: `--timeout`). |
@@ -604,7 +622,7 @@ certinspect example.com --export ./example.com.pem
604
622
  | `--min-tls-version VER` | Fail (exit 9) when the connection negotiates a TLS version older than `VER` (`TLSv1`, `TLSv1.1`, `TLSv1.2`, `TLSv1.3`). Host targets only; opt-in. |
605
623
  | `--profile {lenient,standard,strict}` | Apply a named bundle of the opt-in policy checks in one go (exit 9 on violation). Intensity ladder, not an official standard; explicit flags override it. See [Policy profiles](#policy-profiles). |
606
624
  | `--input PATH` | Read extra targets from a file, one per line ('-' for stdin). |
607
- | `--discover DOMAIN` | Discover hostnames from Certificate Transparency logs (crt.sh) for DOMAIN and inspect each one, surfacing forgotten or shadow certificates. Repeatable; host targets only. |
625
+ | `--discover DOMAIN` | Discover hostnames from Certificate Transparency logs (crt.sh) for DOMAIN and inspect each one, surfacing forgotten or shadow certificates. Repeatable (queried concurrently per `--concurrency`); host targets only. |
608
626
  | `--discover-only` | With `--discover`, list the CT inventory (expiry, issuer, hostnames, soonest expiry first, wildcards included) for the domain(s) without connecting, then exit. Good for a fast audit or spotting a certificate from an unexpected CA. Supports `--json`/`--csv`. |
609
627
  | `--expect-issuer SUBSTRING` | With `--discover-only`, flag any certificate whose issuer matches none of these substrings (case-insensitive) and exit 9 — a Certificate Transparency mis-issuance check. Repeatable. |
610
628
  | `--discover-timeout N` | Timeout in seconds for the `--discover` crt.sh query (default: 30), separate from `--timeout` since a log search can be slower than a handshake. |
@@ -618,7 +636,10 @@ certinspect example.com --export ./example.com.pem
618
636
  | `--export PATH` | Save the inspected certificate as a PEM file at PATH. |
619
637
  | `--starttls {smtp,imap,pop3,ftp}` | Upgrade a plaintext connection to TLS before inspecting (standard port unless `--port` is given). |
620
638
  | `--exporter {nagios,prometheus}` | Emit machine-readable monitoring output (ignores `--quiet`). |
621
- | `--concurrency N` | Inspect up to N hosts in parallel in batch mode (default: 1; order is preserved). |
639
+ | `--concurrency N` | Inspect up to N hosts in parallel in batch mode (default: 1; order is preserved). Also governs `--discover`'s per-domain concurrency. |
640
+ | `--state-file PATH` | Persist each host target's status across runs at PATH (JSON) and compare against the previous run. Host targets only. |
641
+ | `--only-changed` | Show only targets whose status differs from the previous `--state-file` run (a first-seen target counts as changed). Requires `--state-file`; display only. |
642
+ | `--print-completion {bash,zsh}` | Print a shell completion script for bash or zsh to stdout, then exit. Generated from the parser, so it always matches the installed flags. |
622
643
  | `--version` | Print the version and exit. |
623
644
 
624
645
  ## Options in action
@@ -682,6 +703,23 @@ root — for example a PEM exported from a PKCS#12), `--verify` validates that
682
703
  chain **offline** and `--chain` lists every certificate in it (see
683
704
  [`--verify`](#--verify----cafile-path----capath-dir) and [`--chain`](#--chain)).
684
705
 
706
+ Repeat `--file` to inspect several local certificates in one run; each result
707
+ is then labelled with its path (like a host target's `=== host ===` header) so
708
+ you can tell them apart. `--file` cannot be combined with host targets.
709
+
710
+ ```console
711
+ $ certinspect --file leaf.pem --file expired.pem --no-verify
712
+ === leaf.pem ===
713
+ Subject: CN=example.com
714
+ Status: VALID
715
+ ...
716
+
717
+ === expired.pem ===
718
+ Subject: CN=old.example.com
719
+ Status: EXPIRED
720
+ ...
721
+ ```
722
+
685
723
  ### `--port N` / `--timeout N` — connection tuning
686
724
 
687
725
  The report is identical to a plain inspection; only how/where certinspect
@@ -1335,6 +1373,65 @@ $ certinspect --version
1335
1373
  certinspect 1.0.1
1336
1374
  ```
1337
1375
 
1376
+ ### `--config PATH`
1377
+
1378
+ Set defaults for a repeated invocation instead of a long, repeated command
1379
+ line. Keys use the argparse destination name (a flag's name with `-`
1380
+ replaced by `_`, e.g. `not-after-max` → `not_after_max`); an explicit
1381
+ command-line flag always overrides the config value.
1382
+
1383
+ ```console
1384
+ $ cat certinspect.toml
1385
+ days = 14
1386
+ verify = false
1387
+
1388
+ $ certinspect example.com --config certinspect.toml
1389
+ # same as: certinspect example.com --days 14 --no-verify
1390
+
1391
+ $ certinspect example.com --config certinspect.toml --days 30
1392
+ # --days 30 on the command line wins over the config's --days 14
1393
+ ```
1394
+
1395
+ Without `--config`, `~/.config/certinspect/config.toml` is loaded
1396
+ automatically if it exists — handy for a machine-wide default (e.g. a house
1397
+ `--profile` or `--cafile`) without wrapping the binary in a shell alias. A key
1398
+ that is not a real option, or that collides with another inside the same
1399
+ mutually exclusive group (e.g. setting both `json` and `csv`), is rejected at
1400
+ startup rather than silently ignored.
1401
+
1402
+ A commented [`certinspect.example.toml`](certinspect.example.toml) ships in
1403
+ the repository with the most commonly-set options — copy the ones you want.
1404
+
1405
+ ### `--state-file PATH` / `--only-changed`
1406
+
1407
+ For a recurring job (cron, CI) where you only care when something *changes* —
1408
+ not being reminded every run that a certificate is still fine. `--state-file`
1409
+ records each host's status in a small JSON file; `--only-changed` then limits
1410
+ the report to targets whose status differs from the previous run (a target
1411
+ seen for the first time counts as changed). The exit code still reflects
1412
+ every target, `--only-changed` affects the display only.
1413
+
1414
+ ```console
1415
+ $ certinspect example.com other.com --state-file /var/lib/certinspect/state.json --only-changed
1416
+ === other.com ===
1417
+ Status: EXPIRING
1418
+ ...
1419
+ # example.com is still VALID since the last run, so it is left out here.
1420
+ ```
1421
+
1422
+ The state file is always brought up to date, whether or not `--only-changed`
1423
+ is given, so the next run has a fresh baseline to compare against.
1424
+
1425
+ ### `--print-completion {bash,zsh}`
1426
+
1427
+ Generated straight from the argument parser, so it always matches the
1428
+ installed version's flags.
1429
+
1430
+ ```console
1431
+ $ certinspect --print-completion bash | sudo tee /etc/bash_completion.d/certinspect
1432
+ $ certinspect --print-completion zsh > "${fpath[1]}/_certinspect"
1433
+ ```
1434
+
1338
1435
  ### Fetch error (`exit 1`)
1339
1436
 
1340
1437
  An unreachable target prints an `error:` line to stderr and yields exit code 1;
@@ -1430,7 +1527,7 @@ worst code across all targets is returned.
1430
1527
  | 6 | Chain not trusted or revoked (`--verify`) |
1431
1528
  | 7 | Fingerprint does not match `--pin` |
1432
1529
  | 8 | Expected SAN missing (`--expect-san`) |
1433
- | 9 | Policy violation (`--not-after-max`/`--cab-forum`, `--min-key-size`, `--fail-weak`, `--require-sct`, `--require-must-staple`, `--min-tls-version`) |
1530
+ | 9 | Policy violation (`--not-after-max`/`--cab-forum`, `--min-key-size`, `--fail-weak`, `--require-sct`, `--require-must-staple`, `--require-revocation-check`, `--min-tls-version`) |
1434
1531
 
1435
1532
  Example in a script:
1436
1533
 
{certinspect-2.2.0 → certinspect-2.3.0}/pyproject.toml RENAMED
@@ -1,6 +1,6 @@
1
1
  [project]
2
2
  name = "certinspect"
3
- version = "2.2.0"
3
+ version = "2.3.0"
4
4
  description = "Command-line TLS certificate inspector"
5
5
  readme = "README.md"
6
6
  requires-python = ">=3.12"
{certinspect-2.2.0 → certinspect-2.3.0}/src/certinspect/__init__.py RENAMED
@@ -1,3 +1,3 @@
1
1
  """certinspect — command-line TLS certificate inspector."""
2
2
 
3
- __version__ = "2.2.0"
3
+ __version__ = "2.3.0"