embtrace-check 0.1.0__tar.gz

embtrace_check-0.1.0/.github/release-notes/v0.1.0.md

@@ -0,0 +1,34 @@
+First public release of the CRA Readiness Check collector.
+
+**What it does**
+
+Run one command in your project folder — within 24 hours you receive a
+report showing where your product stands with the EU Cyber Resilience Act:
+traffic-light readiness status, your full component inventory, and known
+vulnerabilities with severity.
+
+```bash
+pipx install embtrace-check
+embtrace-check . --code CHK-XXXX-YYYY
+```
+
+Get your free one-time code at https://embtrace.dev/check.
+
+**What leaves your machine — and what never does**
+
+Transmitted: dependency names, versions and ecosystems (from lockfiles and
+build files), the project folder name (hash it with `--anonymize`), scan
+statistics. **Never:** source code, file paths, file contents, credentials.
+Verify it yourself: `embtrace-check . --dry-run` prints the exact payload
+and uploads nothing — that is why this collector is open source.
+
+**Supported build systems**
+
+Conan, vcpkg, CMake (FetchContent/find_package), Cargo, npm/yarn/pnpm,
+Python (pip/Poetry/pyproject), Go, Maven, Gradle, Meson and more —
+deterministic parsers, no AI, no network access during the scan.
+
+**Assets**
+
+`embtrace-check-0.1.0-linux-x86_64` — standalone binary (no Python
+required, built on Ubuntu 22.04 for broad glibc compatibility) + SHA-256.

embtrace_check-0.1.0/.github/workflows/publish-placeholder.yml

@@ -0,0 +1,17 @@
+name: publish-placeholder
+on:
+  push:
+    tags: ["embtrace-placeholder-v*"]
+  workflow_dispatch:
+jobs:
+  pypi:
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions: { id-token: write }   # PyPI Trusted Publishing
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with: { python-version: "3.12" }
+      - run: pip install build && python -m build placeholder
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with: { packages-dir: placeholder/dist }

embtrace_check-0.1.0/.github/workflows/publish.yml

@@ -0,0 +1,33 @@
+name: publish
+on:
+  push:
+    tags: ["v*"]
+jobs:
+  pypi:
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions: { id-token: write }   # PyPI Trusted Publishing
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with: { python-version: "3.12" }
+      - run: pip install build && python -m build
+      - uses: pypa/gh-action-pypi-publish@release/v1
+  binary:
+    runs-on: ubuntu-22.04   # aeltere glibc = laeuft auf mehr Zielsystemen
+    permissions: { contents: write }
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with: { python-version: "3.12" }
+      - run: pip install . pyinstaller
+      - run: pyinstaller embtrace-check.spec --clean --noconfirm
+      - run: |
+          BIN=embtrace-check-${GITHUB_REF_NAME#v}-linux-x86_64
+          mv dist/embtrace-check "dist/$BIN"
+          ( cd dist && sha256sum "$BIN" > "$BIN.sha256" )
+      - uses: softprops/action-gh-release@v2
+        with:
+          name: embtrace-check ${{ github.ref_name }}
+          body_path: .github/release-notes/${{ github.ref_name }}.md
+          files: "dist/embtrace-check-*"

embtrace_check-0.1.0/.github/workflows/tests.yml

@@ -0,0 +1,16 @@
+name: tests
+on:
+  push: { branches: [main] }
+  pull_request:
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix: { python-version: ["3.11", "3.12"] }
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with: { python-version: "${{ matrix.python-version }}" }
+      - run: pip install -e ".[dev]"
+      - run: ruff check src tests
+      - run: pytest -q

embtrace_check-0.1.0/.gitignore

@@ -0,0 +1,9 @@
+__pycache__/
+*.pyc
+*.egg-info/
+dist/
+build/
+.venv/
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/

embtrace_check-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Innomatica GmbH
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

embtrace_check-0.1.0/PKG-INFO

@@ -0,0 +1,123 @@
+Metadata-Version: 2.4
+Name: embtrace-check
+Version: 0.1.0
+Summary: CRA Readiness Check collector — scans your project's lockfiles and uploads dependency metadata only (never code, never paths). Open source so you can verify exactly what leaves your machine.
+Project-URL: Homepage, https://embtrace.dev/check
+Project-URL: Source, https://github.com/Innomatica-GmbH/embtrace-check
+Project-URL: Privacy, https://embtrace.dev/check-privacy
+Author-email: Innomatica GmbH <office@innomatica.de>
+License: MIT License
+        
+        Copyright (c) 2026 Innomatica GmbH
+        
+        Permission is hereby granted, free of charge, to any person obtaining a copy
+        of this software and associated documentation files (the "Software"), to deal
+        in the Software without restriction, including without limitation the rights
+        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+        copies of the Software, and to permit persons to whom the Software is
+        furnished to do so, subject to the following conditions:
+        
+        The above copyright notice and this permission notice shall be included in all
+        copies or substantial portions of the Software.
+        
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        SOFTWARE.
+License-File: LICENSE
+Keywords: compliance,cra,cyber-resilience-act,dependencies,embedded,sbom
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.11
+Requires-Dist: click>=8.1
+Requires-Dist: pydantic>=2.0
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: rich>=13.0
+Provides-Extra: dev
+Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff<0.17,>=0.16; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# embtrace-check
+
+**Free CRA Readiness Check collector** — one command in your project folder,
+and within 24 hours you receive a report showing where your product stands
+with the [EU Cyber Resilience Act](https://embtrace.dev/en/cra-nis2-guide.html):
+traffic-light readiness status, your full component inventory, and known
+vulnerabilities with severity.
+
+This collector is **open source for one reason: so you can verify exactly
+what leaves your machine.**
+
+## What it transmits — and what it never does
+
+Transmitted (JSON, ~a few kB):
+
+- names, versions and package ecosystems of your dependencies
+  (from lockfiles and build files: Conan, vcpkg, CMake, Cargo, npm/yarn/pnpm,
+  Python, Go, Maven/Gradle, Meson, and more),
+- the project folder name (hash it with `--anonymize`),
+- scan statistics (number of build files, tool version).
+
+**Never transmitted:** source code, file paths, file contents, configuration,
+credentials. See for yourself before sending anything:
+
+```bash
+embtrace-check . --dry-run     # prints the exact payload, uploads nothing
+```
+
+## Usage
+
+1. Get your free one-time code at **<https://embtrace.dev/check>**
+   (the report goes to the e-mail address you register there).
+2. Run the collector in your project folder:
+
+```bash
+pipx install embtrace-check         # or: pip install embtrace-check,
+                                    #     or download the standalone binary
+embtrace-check . --code CHK-XXXX-YYYY
+```
+
+3. Your report arrives within 24 hours. The code is valid for one check.
+
+More options: `embtrace-check --help` — including `--output payload.json`
+for air-gapped environments (send the file by mail) and `--with-tools` to
+additionally use native package-manager CLIs for higher-fidelity results.
+
+## Exit codes
+
+| Code | Meaning |
+|------|---------|
+| 0    | success |
+| 1    | error (network, invalid code, …) |
+| 2    | no components found — declare dependencies manually in `embtrace-deps.yaml` |
+
+## Privacy
+
+Data is processed exclusively on Innomatica's own servers in Germany and is
+never shared or sold. Full notes: <https://embtrace.dev/check-privacy>.
+
+## About
+
+`embtrace-check` is the free entry point to
+[embtrace](https://embtrace.dev) — the CRA/NIS2 compliance toolchain for
+embedded software teams by [Innomatica GmbH](https://embtrace.dev/impressum.html).
+The server side (enrichment, vulnerability monitoring, reports) is a
+commercial product; this repository contains the complete client.
+
+Maintained by Innomatica; the roadmap follows the product. Issues and PRs are
+welcome — please report security topics per [SECURITY.md](SECURITY.md).
+
+## License
+
+[MIT](LICENSE) © 2026 Innomatica GmbH

embtrace_check-0.1.0/README.md

@@ -0,0 +1,73 @@
+# embtrace-check
+
+**Free CRA Readiness Check collector** — one command in your project folder,
+and within 24 hours you receive a report showing where your product stands
+with the [EU Cyber Resilience Act](https://embtrace.dev/en/cra-nis2-guide.html):
+traffic-light readiness status, your full component inventory, and known
+vulnerabilities with severity.
+
+This collector is **open source for one reason: so you can verify exactly
+what leaves your machine.**
+
+## What it transmits — and what it never does
+
+Transmitted (JSON, ~a few kB):
+
+- names, versions and package ecosystems of your dependencies
+  (from lockfiles and build files: Conan, vcpkg, CMake, Cargo, npm/yarn/pnpm,
+  Python, Go, Maven/Gradle, Meson, and more),
+- the project folder name (hash it with `--anonymize`),
+- scan statistics (number of build files, tool version).
+
+**Never transmitted:** source code, file paths, file contents, configuration,
+credentials. See for yourself before sending anything:
+
+```bash
+embtrace-check . --dry-run     # prints the exact payload, uploads nothing
+```
+
+## Usage
+
+1. Get your free one-time code at **<https://embtrace.dev/check>**
+   (the report goes to the e-mail address you register there).
+2. Run the collector in your project folder:
+
+```bash
+pipx install embtrace-check         # or: pip install embtrace-check,
+                                    #     or download the standalone binary
+embtrace-check . --code CHK-XXXX-YYYY
+```
+
+3. Your report arrives within 24 hours. The code is valid for one check.
+
+More options: `embtrace-check --help` — including `--output payload.json`
+for air-gapped environments (send the file by mail) and `--with-tools` to
+additionally use native package-manager CLIs for higher-fidelity results.
+
+## Exit codes
+
+| Code | Meaning |
+|------|---------|
+| 0    | success |
+| 1    | error (network, invalid code, …) |
+| 2    | no components found — declare dependencies manually in `embtrace-deps.yaml` |
+
+## Privacy
+
+Data is processed exclusively on Innomatica's own servers in Germany and is
+never shared or sold. Full notes: <https://embtrace.dev/check-privacy>.
+
+## About
+
+`embtrace-check` is the free entry point to
+[embtrace](https://embtrace.dev) — the CRA/NIS2 compliance toolchain for
+embedded software teams by [Innomatica GmbH](https://embtrace.dev/impressum.html).
+The server side (enrichment, vulnerability monitoring, reports) is a
+commercial product; this repository contains the complete client.
+
+Maintained by Innomatica; the roadmap follows the product. Issues and PRs are
+welcome — please report security topics per [SECURITY.md](SECURITY.md).
+
+## License
+
+[MIT](LICENSE) © 2026 Innomatica GmbH

embtrace_check-0.1.0/SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+`embtrace-check` is designed around data minimization: it transmits only
+component names, versions and package ecosystems — never source code, file
+paths or file contents. Verify it yourself with `--dry-run`.
+
+## Reporting a vulnerability
+
+Please report security issues privately to **office@innomatica.de**
+(subject: `SECURITY embtrace-check`). We aim to respond within 48 hours.
+Please do not open public issues for security reports.

embtrace_check-0.1.0/embtrace-check.spec

@@ -0,0 +1,56 @@
+# -*- mode: python ; coding: utf-8 -*-
+"""PyInstaller spec for the standalone embtrace-check binary.
+
+Build with:
+    pyinstaller embtrace-check.spec --clean
+"""
+
+from PyInstaller.utils.hooks import collect_submodules
+
+a = Analysis(
+    ["src/embtrace_check/cli.py"],
+    pathex=["src"],
+    binaries=[],
+    datas=[],
+    hiddenimports=[
+        "embtrace_check.payload",
+        "embtrace_check.collector",
+        "embtrace_check.upload",
+        "embtrace_check.analyzer.pipeline.tier1_cli",
+        "embtrace_check.analyzer.pipeline.tier2_structured",
+        "embtrace_check.analyzer.pipeline.tier4_regex",
+        "embtrace_check.analyzer.pipeline.merge",
+        "embtrace_check.analyzer.scanner",
+        "embtrace_check.analyzer.normalize",
+        "embtrace_check.sbom.scanner",
+        "embtrace_check.core.exceptions",
+        *collect_submodules("embtrace_check.analyzer.parsers"),
+        "yaml",
+        "pydantic",
+        "click",
+        "rich",
+    ],
+    hookspath=[],
+    hooksconfig={},
+    runtime_hooks=[],
+    excludes=["pytest", "mypy", "ruff"],
+    noarchive=False,
+)
+
+pyz = PYZ(a.pure, a.zipped_data)
+
+exe = EXE(
+    pyz,
+    a.scripts,
+    a.binaries,
+    a.datas,
+    [],
+    name="embtrace-check",
+    debug=False,
+    bootloader_ignore_signals=False,
+    strip=False,
+    upx=True,
+    upx_exclude=[],
+    runtime_tmpdir=None,
+    console=True,
+)

embtrace_check-0.1.0/pyproject.toml

@@ -0,0 +1,64 @@
+[project]
+name = "embtrace-check"
+version = "0.1.0"
+description = "CRA Readiness Check collector — scans your project's lockfiles and uploads dependency metadata only (never code, never paths). Open source so you can verify exactly what leaves your machine."
+readme = "README.md"
+license = { file = "LICENSE" }
+requires-python = ">=3.11"
+authors = [{ name = "Innomatica GmbH", email = "office@innomatica.de" }]
+keywords = ["cra", "cyber-resilience-act", "sbom", "compliance", "embedded", "dependencies"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Operating System :: POSIX :: Linux",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Topic :: Security",
+    "Topic :: Software Development :: Quality Assurance",
+]
+dependencies = [
+    "click>=8.1",
+    "pydantic>=2.0",
+    "pyyaml>=6.0",
+    "rich>=13.0",
+]
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=8.0",
+    "ruff>=0.16,<0.17",
+    "mypy>=1.10",
+]
+
+[project.urls]
+Homepage = "https://embtrace.dev/check"
+Source = "https://github.com/Innomatica-GmbH/embtrace-check"
+Privacy = "https://embtrace.dev/check-privacy"
+
+[project.scripts]
+embtrace-check = "embtrace_check.cli:main"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/embtrace_check"]
+
+[tool.hatch.build.targets.sdist]
+exclude = ["placeholder/"]
+
+[tool.ruff]
+target-version = "py311"
+line-length = 100
+src = ["src"]
+
+[tool.ruff.lint]
+# Same rule set as the embtrace main repo — the vendored analyzer/sbom
+# modules must stay lint-clean under identical rules in both repos.
+select = ["E", "F", "I", "N", "W", "UP", "B", "A", "SIM", "TC"]
+ignore = ["TC003"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

embtrace_check-0.1.0/src/embtrace_check/__init__.py

@@ -0,0 +1,3 @@
+"""embtrace-check — standalone collector for the embtrace CRA Readiness Check."""
+
+__version__ = "0.1.0"

embtrace_check-0.1.0/src/embtrace_check/analyzer/__init__.py

@@ -0,0 +1 @@
+"""Vendored subset of the embtrace analyzer (deterministic tiers only)."""

embtrace_check-0.1.0/src/embtrace_check/analyzer/models.py

@@ -0,0 +1,148 @@
+"""Pydantic models for AI project analyzer.
+
+Covers LLM analysis output, reconciliation results, and the decisions.yaml
+persistence format.
+"""
+
+from __future__ import annotations
+
+from pydantic import BaseModel
+
+# ---------------------------------------------------------------------------
+# LLM output models
+# ---------------------------------------------------------------------------
+
+class BuildFileDependency(BaseModel):
+    """A dependency detected by LLM analysis of build files."""
+
+    name: str
+    version: str = ""
+    ecosystem: str = ""
+    source_file: str = ""
+    source_line: int = 0
+    context: str = ""          # LLM context, e.g. "inside if(USE_LIBRESSL)"
+    confidence: float = 1.0
+    tier: int = 0              # 0=LLM, 1-5=Pipeline tier
+    detection_method: str = "" # e.g. "cargo-metadata", "regex-cmake", "treesitter-meson"
+
+
+class BuildFileArtifact(BaseModel):
+    """An artifact (binary, library, etc.) detected in build files."""
+
+    path: str
+    artifact_type: str = "binary"  # binary | library | config | script
+    source_file: str = ""
+    source_line: int = 0
+
+
+class BuildFileInternalDep(BaseModel):
+    """An internal project dependency detected in build files."""
+
+    project: str
+    source_file: str = ""
+    source_line: int = 0
+    context: str = ""
+
+
+class LLMAnalysisResult(BaseModel):
+    """Result of analyzing a single build file with the LLM."""
+
+    file_path: str
+    dependencies: list[BuildFileDependency] = []
+    artifacts: list[BuildFileArtifact] = []
+    internal_deps: list[BuildFileInternalDep] = []
+
+
+# ---------------------------------------------------------------------------
+# Reconciliation result models
+# ---------------------------------------------------------------------------
+
+class ConfirmedEntry(BaseModel):
+    """Both lockfile scanner and build-file analysis agree on this dependency."""
+
+    name: str
+    version: str
+    ecosystem: str = ""
+    source_file: str = ""
+
+
+class LockfileOnlyEntry(BaseModel):
+    """Dependency found only in the lockfile scanner output."""
+
+    name: str
+    version: str
+    ecosystem: str = ""
+    accept: bool | None = None
+
+
+class BuildFileOnlyEntry(BaseModel):
+    """Dependency found only in LLM build-file analysis."""
+
+    name: str
+    version: str = ""
+    ecosystem: str = ""
+    source_file: str = ""
+    confidence: float = 1.0
+    context: str = ""
+    accept: bool | None = None
+
+
+class ConflictEntry(BaseModel):
+    """Version mismatch between lockfile and build-file analysis."""
+
+    name: str
+    lockfile_version: str
+    build_file_version: str
+    ecosystem: str = ""
+    source_file: str = ""
+    accept: bool | None = None
+    use_version: str = ""
+
+
+class ArtifactEntry(BaseModel):
+    """A produced artifact detected in build files."""
+
+    path: str
+    artifact_type: str = "binary"
+    source_file: str = ""
+
+
+class InternalDepEntry(BaseModel):
+    """An internal dependency detected in build files."""
+
+    project: str
+    source_file: str = ""
+    context: str = ""
+    accept: bool | None = None
+
+
+# ---------------------------------------------------------------------------
+# decisions.yaml root model
+# ---------------------------------------------------------------------------
+
+class DecisionsFile(BaseModel):
+    """Root model for .embtrace/proposal/decisions.yaml."""
+
+    scan_date: str
+    model: str = ""
+    confirmed: list[ConfirmedEntry] = []
+    lockfile_only: list[LockfileOnlyEntry] = []
+    build_file_only: list[BuildFileOnlyEntry] = []
+    conflicts: list[ConflictEntry] = []
+    artifacts: list[ArtifactEntry] = []
+    internal_dependencies: list[InternalDepEntry] = []
+
+
+# ---------------------------------------------------------------------------
+# Reconciliation container
+# ---------------------------------------------------------------------------
+
+class ReconciliationResult(BaseModel):
+    """Container for reconciliation output — input to proposal generation."""
+
+    confirmed: list[ConfirmedEntry] = []
+    lockfile_only: list[LockfileOnlyEntry] = []
+    build_file_only: list[BuildFileOnlyEntry] = []
+    conflicts: list[ConflictEntry] = []
+    artifacts: list[ArtifactEntry] = []
+    internal_dependencies: list[InternalDepEntry] = []