coretrace-python-analyzer 0.1.0__tar.gz

coretrace_python_analyzer-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,57 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: python -m pip install -e ".[dev]"
+      - run: python -m mypy
+      - run: python -m ruff check .
+      - run: python -m pytest
+
+  regression:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - uses: actions/cache@v4
+        with:
+          path: .regression
+          key: regression-${{ hashFiles('tests/regression/repositories.toml') }}
+      - run: python -m pip install -e ".[dev]"
+      - run: python -m pytest -m regression
+
+  package:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: python -m pip install build twine
+      - run: python -m build
+      - run: python -m twine check dist/*
+      - name: Install the wheel in a clean environment and run a check
+        run: |
+          python -m venv /tmp/smoke
+          /tmp/smoke/bin/pip install dist/*.whl
+          printf 'def run(code):\n    eval(code)\n' > /tmp/sample.py
+          /tmp/smoke/bin/coretrace-python-analyzer --check /tmp/sample.py --format json > /tmp/report.json || test $? -eq 1
+          grep -q '"rule_id": "dangerous-eval"' /tmp/report.json
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/

coretrace_python_analyzer-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,43 @@
+name: Release
+
+# Publishes the package to PyPI when a version tag is pushed (``v0.1.0``). The tag must
+# match the version in pyproject.toml. Publication uses PyPI trusted publishing: the
+# ``pypi`` environment and the trusted publisher for this repository and workflow must be
+# configured on pypi.org once; no token is stored.
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Check that the tag matches the package version
+        run: |
+          version=$(python -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")
+          test "v$version" = "${GITHUB_REF_NAME}"
+      - run: python -m pip install build twine
+      - run: python -m build
+      - run: python -m twine check dist/*
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  publish:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1

coretrace_python_analyzer-0.1.0/.gitignore

@@ -0,0 +1,11 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+.pytest_cache/
+.ruff_cache/
+.venv/
+build/
+dist/
+
+.DS_Store
+.regression/

coretrace_python_analyzer-0.1.0/PKG-INFO

@@ -0,0 +1,74 @@
+Metadata-Version: 2.5
+Name: coretrace-python-analyzer
+Version: 0.1.0
+Summary: Static security analysis infrastructure for Python code
+Project-URL: Homepage, https://github.com/CoreTrace/coretrace-python-analyzer
+Project-URL: Repository, https://github.com/CoreTrace/coretrace-python-analyzer
+Project-URL: Issues, https://github.com/CoreTrace/coretrace-python-analyzer/issues
+Author: CoreTrace
+License: Apache-2.0
+Keywords: python,sast,security,static-analysis,taint
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.11
+Provides-Extra: dev
+Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: mypy>=1.15; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff>=0.9; extra == 'dev'
+Requires-Dist: twine>=5.0; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# CoreTrace Python Analyzer
+
+A standalone static security analyzer for Python. It finds injection vulnerabilities by
+following attacker-controlled data through the program, across functions, files, objects
+and closures, and judges each flow against the guards on its path; it reports dangerous
+API usage, secrets committed in sources and configuration, and vulnerable or forbidden
+dependencies, correlated with the code that reaches them. It runs offline, on a file or a
+whole project, with no runtime dependency.
+
+```bash
+pip install coretrace-python-analyzer
+coretrace-python-analyzer --check src/ --format sarif > report.sarif
+```
+
+- [Usage guide](docs/usage.md): command line, rules, report formats, dependencies and
+  advisories, cache and parallelism, continuous integration.
+- [Writing a plugin](docs/plugins.md): models for another framework, detectors for
+  another rule, secret patterns and project-wide checks.
+- [Architecture](docs/architecture.md): the engine's design and its migration plan.
+
+The pipeline: source manager, parser-independent high-level representation (PyHIR),
+semantic resolution of imports and scopes, lowering to a small intermediate
+representation (PyIR), control-flow graphs, SSA, data-flow and abstract interpretation,
+interprocedural summaries, taint and refutation, then plugins and reporters.
+
+## Development
+
+```bash
+python -m venv .venv
+python -m pip install -e ".[dev]"
+python -m mypy
+python -m pytest
+python -m ruff check .
+```
+
+The non-regression suite analyses the public repositories pinned in
+[`tests/regression/repositories.toml`](tests/regression/repositories.toml) and compares
+findings and coverage with the snapshots in `tests/regression/expected/`. It clones on
+first use, needs the network and runs in its own CI job:
+
+```bash
+python -m pytest -m regression
+CORETRACE_REGRESSION_UPDATE=1 python -m pytest -m regression   # record an intended change
+```
+

coretrace_python_analyzer-0.1.0/README.md

@@ -0,0 +1,45 @@
+# CoreTrace Python Analyzer
+
+A standalone static security analyzer for Python. It finds injection vulnerabilities by
+following attacker-controlled data through the program, across functions, files, objects
+and closures, and judges each flow against the guards on its path; it reports dangerous
+API usage, secrets committed in sources and configuration, and vulnerable or forbidden
+dependencies, correlated with the code that reaches them. It runs offline, on a file or a
+whole project, with no runtime dependency.
+
+```bash
+pip install coretrace-python-analyzer
+coretrace-python-analyzer --check src/ --format sarif > report.sarif
+```
+
+- [Usage guide](docs/usage.md): command line, rules, report formats, dependencies and
+  advisories, cache and parallelism, continuous integration.
+- [Writing a plugin](docs/plugins.md): models for another framework, detectors for
+  another rule, secret patterns and project-wide checks.
+- [Architecture](docs/architecture.md): the engine's design and its migration plan.
+
+The pipeline: source manager, parser-independent high-level representation (PyHIR),
+semantic resolution of imports and scopes, lowering to a small intermediate
+representation (PyIR), control-flow graphs, SSA, data-flow and abstract interpretation,
+interprocedural summaries, taint and refutation, then plugins and reporters.
+
+## Development
+
+```bash
+python -m venv .venv
+python -m pip install -e ".[dev]"
+python -m mypy
+python -m pytest
+python -m ruff check .
+```
+
+The non-regression suite analyses the public repositories pinned in
+[`tests/regression/repositories.toml`](tests/regression/repositories.toml) and compares
+findings and coverage with the snapshots in `tests/regression/expected/`. It clones on
+first use, needs the network and runs in its own CI job:
+
+```bash
+python -m pytest -m regression
+CORETRACE_REGRESSION_UPDATE=1 python -m pytest -m regression   # record an intended change
+```
+