cobraphp 0.1.0.dev1__tar.gz → 0.1.0.dev2__tar.gz

{cobraphp-0.1.0.dev1/src/cobraphp.egg-info → cobraphp-0.1.0.dev2}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: cobraphp
-Version: 0.1.0.dev1
-Summary: Placeholder for the Python interface of CobraPHP, a static taint analyzer for PHP projects, and a pure-Python static analysis over php-parser-py and Semgrep.
+Version: 0.1.0.dev2
+Summary: Placeholder for the Python interface of CobraPHP, a static taint analyzer for PHP projects.
 License-Expression: GPL-2.0-only
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -18,9 +18,9 @@ Python interface of [CobraPHP](https://github.com/jhu-seclab-cobra/CobraPHP), th
 
 ## Status
 
-**Placeholder.** This package is a placeholder for the CobraPHP Python interface. The jar interface is not implemented, and `cobraphp.analysis` is an interim pure-Python implementation that the CobraPHP implementation will replace in a later version. Interfaces and results may change between versions.
+**Placeholder.** The Python binding is not fully implemented. Interfaces and results may change between versions.
 
-Two parts. The jar interface is declared only: its types, functions and errors are typed, and every entry raises `NotImplementedError` ("implementation waits for the CobraPHP jar"). The implementation will run the CobraPHP jar in the Python process through JPype; JPype is planned and not yet a dependency. The subpackage `cobraphp.analysis` is implemented: a pure-Python static analysis over [php-parser-py](https://pypi.org/project/php-parser-py/) and [Semgrep](https://semgrep.dev) that builds a call graph and Semgrep-seeded data flow from a parsed PHP project. The version is a pre-release, `0.1.0.dev1`. The name follows the pattern `bindings-<language>-<analyzer>`.
+The subpackage `cobraphp.analysis` builds a call graph and a data flow from a PHP project parsed with [php-parser-py](https://pypi.org/project/php-parser-py/). The version is a pre-release. The name follows the pattern `bindings-<language>-<analyzer>`.
 
 ## Install
 
@@ -30,7 +30,7 @@ From a checkout, with [uv](https://docs.astral.sh/uv/):
 uv sync
 ```
 
-`uv sync` installs the package, its dependencies at the versions of `uv.lock` and the check tools. `cobraphp.analysis` runs the `semgrep` program, which the Semgrep dependency installs into the environment; it must be on `PATH`, for example by running commands through `uv run`. The subpackage's Semgrep run sends no version-check request.
+`uv sync` installs the package, its dependencies at the versions of `uv.lock` and the check tools. Run commands through `uv run` so that the programs the dependencies install are on `PATH`.
 
 The planned release wheel will bundle the CobraPHP jar. Which Java runtime it uses is undecided ([open gaps](docs/design.md#open-gaps)). Python 3.11 or later.
 
@@ -98,7 +98,7 @@ python -m pytest
 python -m mypy
 ```
 
-Run them inside the environment, for example as `uv run python -m pytest`. The tests marked `integration` run the `semgrep` program; `python -m pytest -m "not integration"` skips them.
+Run them inside the environment, for example as `uv run python -m pytest`. The tests marked `integration` run an external program; `python -m pytest -m "not integration"` skips them.
 
 ## License
 

{cobraphp-0.1.0.dev1 → cobraphp-0.1.0.dev2}/README.md

@@ -4,9 +4,9 @@ Python interface of [CobraPHP](https://github.com/jhu-seclab-cobra/CobraPHP), th
 
 ## Status
 
-**Placeholder.** This package is a placeholder for the CobraPHP Python interface. The jar interface is not implemented, and `cobraphp.analysis` is an interim pure-Python implementation that the CobraPHP implementation will replace in a later version. Interfaces and results may change between versions.
+**Placeholder.** The Python binding is not fully implemented. Interfaces and results may change between versions.
 
-Two parts. The jar interface is declared only: its types, functions and errors are typed, and every entry raises `NotImplementedError` ("implementation waits for the CobraPHP jar"). The implementation will run the CobraPHP jar in the Python process through JPype; JPype is planned and not yet a dependency. The subpackage `cobraphp.analysis` is implemented: a pure-Python static analysis over [php-parser-py](https://pypi.org/project/php-parser-py/) and [Semgrep](https://semgrep.dev) that builds a call graph and Semgrep-seeded data flow from a parsed PHP project. The version is a pre-release, `0.1.0.dev1`. The name follows the pattern `bindings-<language>-<analyzer>`.
+The subpackage `cobraphp.analysis` builds a call graph and a data flow from a PHP project parsed with [php-parser-py](https://pypi.org/project/php-parser-py/). The version is a pre-release. The name follows the pattern `bindings-<language>-<analyzer>`.
 
 ## Install
 
@@ -16,7 +16,7 @@ From a checkout, with [uv](https://docs.astral.sh/uv/):
 uv sync
 ```
 
-`uv sync` installs the package, its dependencies at the versions of `uv.lock` and the check tools. `cobraphp.analysis` runs the `semgrep` program, which the Semgrep dependency installs into the environment; it must be on `PATH`, for example by running commands through `uv run`. The subpackage's Semgrep run sends no version-check request.
+`uv sync` installs the package, its dependencies at the versions of `uv.lock` and the check tools. Run commands through `uv run` so that the programs the dependencies install are on `PATH`.
 
 The planned release wheel will bundle the CobraPHP jar. Which Java runtime it uses is undecided ([open gaps](docs/design.md#open-gaps)). Python 3.11 or later.
 
@@ -84,7 +84,7 @@ python -m pytest
 python -m mypy
 ```
 
-Run them inside the environment, for example as `uv run python -m pytest`. The tests marked `integration` run the `semgrep` program; `python -m pytest -m "not integration"` skips them.
+Run them inside the environment, for example as `uv run python -m pytest`. The tests marked `integration` run an external program; `python -m pytest -m "not integration"` skips them.
 
 ## License
 

{cobraphp-0.1.0.dev1 → cobraphp-0.1.0.dev2}/pyproject.toml

@@ -5,8 +5,8 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "cobraphp"
-version = "0.1.0.dev1"
-description = "Placeholder for the Python interface of CobraPHP, a static taint analyzer for PHP projects, and a pure-Python static analysis over php-parser-py and Semgrep."
+version = "0.1.0.dev2"
+description = "Placeholder for the Python interface of CobraPHP, a static taint analyzer for PHP projects."
 readme = "README.md"
 license = "GPL-2.0-only"
 license-files = ["LICENSE"]

{cobraphp-0.1.0.dev1 → cobraphp-0.1.0.dev2/src/cobraphp.egg-info}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: cobraphp
-Version: 0.1.0.dev1
-Summary: Placeholder for the Python interface of CobraPHP, a static taint analyzer for PHP projects, and a pure-Python static analysis over php-parser-py and Semgrep.
+Version: 0.1.0.dev2
+Summary: Placeholder for the Python interface of CobraPHP, a static taint analyzer for PHP projects.
 License-Expression: GPL-2.0-only
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -18,9 +18,9 @@ Python interface of [CobraPHP](https://github.com/jhu-seclab-cobra/CobraPHP), th
 
 ## Status
 
-**Placeholder.** This package is a placeholder for the CobraPHP Python interface. The jar interface is not implemented, and `cobraphp.analysis` is an interim pure-Python implementation that the CobraPHP implementation will replace in a later version. Interfaces and results may change between versions.
+**Placeholder.** The Python binding is not fully implemented. Interfaces and results may change between versions.
 
-Two parts. The jar interface is declared only: its types, functions and errors are typed, and every entry raises `NotImplementedError` ("implementation waits for the CobraPHP jar"). The implementation will run the CobraPHP jar in the Python process through JPype; JPype is planned and not yet a dependency. The subpackage `cobraphp.analysis` is implemented: a pure-Python static analysis over [php-parser-py](https://pypi.org/project/php-parser-py/) and [Semgrep](https://semgrep.dev) that builds a call graph and Semgrep-seeded data flow from a parsed PHP project. The version is a pre-release, `0.1.0.dev1`. The name follows the pattern `bindings-<language>-<analyzer>`.
+The subpackage `cobraphp.analysis` builds a call graph and a data flow from a PHP project parsed with [php-parser-py](https://pypi.org/project/php-parser-py/). The version is a pre-release. The name follows the pattern `bindings-<language>-<analyzer>`.
 
 ## Install
 
@@ -30,7 +30,7 @@ From a checkout, with [uv](https://docs.astral.sh/uv/):
 uv sync
 ```
 
-`uv sync` installs the package, its dependencies at the versions of `uv.lock` and the check tools. `cobraphp.analysis` runs the `semgrep` program, which the Semgrep dependency installs into the environment; it must be on `PATH`, for example by running commands through `uv run`. The subpackage's Semgrep run sends no version-check request.
+`uv sync` installs the package, its dependencies at the versions of `uv.lock` and the check tools. Run commands through `uv run` so that the programs the dependencies install are on `PATH`.
 
 The planned release wheel will bundle the CobraPHP jar. Which Java runtime it uses is undecided ([open gaps](docs/design.md#open-gaps)). Python 3.11 or later.
 
@@ -98,7 +98,7 @@ python -m pytest
 python -m mypy
 ```
 
-Run them inside the environment, for example as `uv run python -m pytest`. The tests marked `integration` run the `semgrep` program; `python -m pytest -m "not integration"` skips them.
+Run them inside the environment, for example as `uv run python -m pytest`. The tests marked `integration` run an external program; `python -m pytest -m "not integration"` skips them.
 
 ## License