gitfluff 0.8.0__tar.gz → 0.9.0__tar.gz

{gitfluff-0.8.0 → gitfluff-0.9.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: gitfluff
-Version: 0.8.0
+Version: 0.9.0
 Summary: Commit message linter and formatter
 Author-email: Na'aman Hirschfeld <nhirschfeld@gmail.com>
 License: MIT
@@ -27,7 +27,7 @@ Requires-Dist: certifi>=2024.7.4
 
 Commit message linter with presets, custom formats, and cleanup automation. Fully compliant with [Conventional Commits 1.0.0](https://www.conventionalcommits.org/en/v1.0.0/). Skips linting while Git is creating a merge commit.
 
-This Python package distributes prebuilt `gitfluff` binaries. On first use, the correct release binary for your platform is downloaded and cached under `~/.cache/gitfluff`.
+This Python package distributes prebuilt `gitfluff` binaries. On first use, the correct release binary for your platform is downloaded and cached under `~/.cache/gitfluff`. The binary's SHA-256 checksum is verified against the release's published checksums manifest before extraction.
 
 ## Quick Start
 
@@ -83,6 +83,8 @@ gitfluff hook install commit-msg
 gitfluff hook install commit-msg --write
 ```
 
+Hook installation respects `core.hooksPath` (including relative paths) and works correctly in linked git worktrees.
+
 ### pre-commit Framework
 
 **Add to `.pre-commit-config.yaml`:**
@@ -94,7 +96,7 @@ default_install_hook_types:
 
 repos:
   - repo: https://github.com/Goldziher/gitfluff
-    rev: v0.8.0
+    rev: v0.9.0
     hooks:
       - id: gitfluff-lint
         stages: [commit-msg]
@@ -135,15 +137,16 @@ write = true
 
 [rules]
 no_emojis = true
+ai_cleanup = true  # set to false to disable AI attribution cleanup
 title_suffix = "\\(JIRA-[0-9]+\\)"
 exit_nonzero_on_rewrite = true
 ```
 
-Any setting can be left out; omit the file entirely to keep defaults.
+Any setting can be left out; omit the file entirely to keep defaults. Unknown config keys now trigger an error rather than being silently ignored.
 
 ## Advanced usage
 
-- Override rules per-invocation using CLI flags (e.g. `--preset`, `--msg-pattern`, `--cleanup-pattern`, `--exclude`, `--cleanup`, `--single-line`, `--no-emojis`, `--ascii-only`, `--title-prefix`, `--title-suffix`).
+- Override rules per-invocation using CLI flags (e.g. `--preset`, `--msg-pattern`, `--cleanup-pattern`, `--exclude`, `--cleanup`, `--single-line`, `--no-emojis`, `--ascii-only`, `--title-prefix`, `--title-suffix`, `--no-ai-cleanup`).
 - Set `GITFLUFF_BINARY` to point at a custom build when testing unpublished versions.
 - Clear the cache (`rm ~/.cache/gitfluff/gitfluff*`) to force a fresh download.
 

{gitfluff-0.8.0 → gitfluff-0.9.0}/README.md

@@ -2,7 +2,7 @@
 
 Commit message linter with presets, custom formats, and cleanup automation. Fully compliant with [Conventional Commits 1.0.0](https://www.conventionalcommits.org/en/v1.0.0/). Skips linting while Git is creating a merge commit.
 
-This Python package distributes prebuilt `gitfluff` binaries. On first use, the correct release binary for your platform is downloaded and cached under `~/.cache/gitfluff`.
+This Python package distributes prebuilt `gitfluff` binaries. On first use, the correct release binary for your platform is downloaded and cached under `~/.cache/gitfluff`. The binary's SHA-256 checksum is verified against the release's published checksums manifest before extraction.
 
 ## Quick Start
 
@@ -58,6 +58,8 @@ gitfluff hook install commit-msg
 gitfluff hook install commit-msg --write
 ```
 
+Hook installation respects `core.hooksPath` (including relative paths) and works correctly in linked git worktrees.
+
 ### pre-commit Framework
 
 **Add to `.pre-commit-config.yaml`:**
@@ -69,7 +71,7 @@ default_install_hook_types:
 
 repos:
   - repo: https://github.com/Goldziher/gitfluff
-    rev: v0.8.0
+    rev: v0.9.0
     hooks:
       - id: gitfluff-lint
         stages: [commit-msg]
@@ -110,15 +112,16 @@ write = true
 
 [rules]
 no_emojis = true
+ai_cleanup = true  # set to false to disable AI attribution cleanup
 title_suffix = "\\(JIRA-[0-9]+\\)"
 exit_nonzero_on_rewrite = true
 ```
 
-Any setting can be left out; omit the file entirely to keep defaults.
+Any setting can be left out; omit the file entirely to keep defaults. Unknown config keys now trigger an error rather than being silently ignored.
 
 ## Advanced usage
 
-- Override rules per-invocation using CLI flags (e.g. `--preset`, `--msg-pattern`, `--cleanup-pattern`, `--exclude`, `--cleanup`, `--single-line`, `--no-emojis`, `--ascii-only`, `--title-prefix`, `--title-suffix`).
+- Override rules per-invocation using CLI flags (e.g. `--preset`, `--msg-pattern`, `--cleanup-pattern`, `--exclude`, `--cleanup`, `--single-line`, `--no-emojis`, `--ascii-only`, `--title-prefix`, `--title-suffix`, `--no-ai-cleanup`).
 - Set `GITFLUFF_BINARY` to point at a custom build when testing unpublished versions.
 - Clear the cache (`rm ~/.cache/gitfluff/gitfluff*`) to force a fresh download.
 

{gitfluff-0.8.0 → gitfluff-0.9.0}/gitfluff/__init__.py

@@ -1,2 +1,2 @@
 __all__ = ["__version__"]
-__version__ = "0.8.0"
+__version__ = "0.9.0"

{gitfluff-0.8.0 → gitfluff-0.9.0}/gitfluff/downloader.py

@@ -2,20 +2,21 @@
 
 from __future__ import annotations
 
+import hashlib
 import os
 import platform
+import ssl
 import subprocess
 import sys
-import tempfile
 import tarfile
+import tempfile
 import zipfile
-import ssl
-
-import certifi
-from pathlib import Path
+from pathlib import Path, PurePosixPath
 from urllib.error import URLError
 from urllib.request import Request, urlopen
 
+import certifi
+
 
 def _platform_triple() -> str:
     system = platform.system().lower()
@@ -47,15 +48,18 @@ def _python_version_to_tag(version: str) -> str:
     return version
 
 
-def _asset(version: str) -> tuple[str, str]:
+def _asset(version: str) -> tuple[str, str, str]:
+    """Return the (url, ext, name) of the release archive for this platform.
+
+    `name` is returned rather than recomputed by the caller: it is the key the checksum manifest
+    is looked up by, and a name derived separately from the URL could drift out of step with it.
+    """
     tag = _python_version_to_tag(version)
     triple = _platform_triple()
     ext = "zip" if "windows" in triple else "tar.gz"
-    url = (
-        f"https://github.com/Goldziher/gitfluff/releases/download/"
-        f"v{tag}/gitfluff-{triple}.{ext}"
-    )
-    return url, ext
+    name = f"gitfluff-{triple}.{ext}"
+    url = f"https://github.com/Goldziher/gitfluff/releases/download/v{tag}/{name}"
+    return url, ext, name
 
 
 def _download(url: str, destination: Path) -> None:
@@ -81,15 +85,68 @@ def _extract(archive: Path, ext: str, destination: Path) -> None:
     else:
         with tarfile.open(archive, "r:gz") as tar:
             for member in tar.getmembers():
-                if member.name.endswith("gitfluff") or member.name.endswith(
-                    "gitfluff.exe"
-                ):
+                if member.name.endswith("gitfluff") or member.name.endswith("gitfluff.exe"):
                     with tar.extractfile(member) as src, destination.open("wb") as dst:
                         dst.write(src.read())
                     return
     raise RuntimeError("Binary not found in downloaded archive")
 
 
+def _download_text(url: str) -> str:
+    request = Request(url, headers={"User-Agent": "gitfluff-python-wrapper"})
+    context = ssl.create_default_context(cafile=certifi.where())
+    try:
+        with urlopen(request, timeout=30, context=context) as response:
+            if response.status != 200:
+                raise RuntimeError(f"HTTP {response.status}: {response.reason}")
+            return response.read().decode("utf-8")
+    except URLError as exc:
+        raise RuntimeError(f"Failed to download: {exc}") from exc
+
+
+def _sha256_file(path: Path) -> str:
+    sha256_hash = hashlib.sha256()
+    with path.open("rb") as f:
+        for byte_block in iter(lambda: f.read(4096), b""):
+            sha256_hash.update(byte_block)
+    return sha256_hash.hexdigest()
+
+
+def _verify_checksum(archive_path: Path, archive_name: str, version: str) -> None:
+    # The manifest is named after the release TAG, not the PyPI version string -- for a release
+    # candidate those differ (0.8.0rc1 vs 0.8.0-rc.1), and naming it after the version would
+    # request a file that does not exist.
+    tag = _python_version_to_tag(version)
+    checksum_url = f"https://github.com/Goldziher/gitfluff/releases/download/v{tag}/gitfluff_{tag}_checksums.txt"
+
+    print("Downloading checksums manifest...", file=sys.stderr)
+    checksum_text = _download_text(checksum_url)
+
+    # sha256sum format is "<hash>  <name>". Match the name field exactly rather than with a
+    # substring test, so a manifest entry such as "<name>.sig" can never satisfy the lookup.
+    entry = next(
+        (
+            fields
+            for fields in (line.strip().split() for line in checksum_text.splitlines())
+            if len(fields) >= 2 and PurePosixPath(fields[-1]).name == archive_name
+        ),
+        None,
+    )
+
+    if entry is None:
+        raise RuntimeError(f"Checksum not found for {archive_name} in manifest")
+
+    expected_hash = entry[0]
+
+    print("Verifying archive checksum...", file=sys.stderr)
+    actual_hash = _sha256_file(archive_path)
+
+    if actual_hash != expected_hash:
+        raise RuntimeError(f"Checksum mismatch for {archive_name}\nExpected: {expected_hash}\nActual: {actual_hash}")
+
+    print("Checksum verified successfully.", file=sys.stderr)
+
+
 def _cache_path(version: str) -> Path:
     """
     Return a versioned cache path so upgrades download matching binaries.
@@ -103,7 +160,6 @@ def _cache_path(version: str) -> Path:
 def ensure_binary() -> str:
     from . import __version__
 
-    # Allow override via environment for power users/tests
     override = os.getenv("GITFLUFF_BINARY")
     if override:
         return override
@@ -112,12 +168,13 @@ def ensure_binary() -> str:
     if binary_path.exists() and os.access(binary_path, os.X_OK):
         return str(binary_path)
 
-    url, ext = _asset(__version__)
+    url, ext, archive_name = _asset(__version__)
     print(f"Downloading gitfluff binary v{__version__}...", file=sys.stderr)
 
     with tempfile.TemporaryDirectory() as tmpdir:
-        archive_path = Path(tmpdir) / "gitfluff.tar.gz"
+        archive_path = Path(tmpdir) / f"gitfluff.{ext}"
         _download(url, archive_path)
+        _verify_checksum(archive_path, archive_name, __version__)
         _extract(archive_path, ext, binary_path)
 
     if platform.system().lower() != "windows":

{gitfluff-0.8.0 → gitfluff-0.9.0}/gitfluff.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: gitfluff
-Version: 0.8.0
+Version: 0.9.0
 Summary: Commit message linter and formatter
 Author-email: Na'aman Hirschfeld <nhirschfeld@gmail.com>
 License: MIT
@@ -27,7 +27,7 @@ Requires-Dist: certifi>=2024.7.4
 
 Commit message linter with presets, custom formats, and cleanup automation. Fully compliant with [Conventional Commits 1.0.0](https://www.conventionalcommits.org/en/v1.0.0/). Skips linting while Git is creating a merge commit.
 
-This Python package distributes prebuilt `gitfluff` binaries. On first use, the correct release binary for your platform is downloaded and cached under `~/.cache/gitfluff`.
+This Python package distributes prebuilt `gitfluff` binaries. On first use, the correct release binary for your platform is downloaded and cached under `~/.cache/gitfluff`. The binary's SHA-256 checksum is verified against the release's published checksums manifest before extraction.
 
 ## Quick Start
 
@@ -83,6 +83,8 @@ gitfluff hook install commit-msg
 gitfluff hook install commit-msg --write
 ```
 
+Hook installation respects `core.hooksPath` (including relative paths) and works correctly in linked git worktrees.
+
 ### pre-commit Framework
 
 **Add to `.pre-commit-config.yaml`:**
@@ -94,7 +96,7 @@ default_install_hook_types:
 
 repos:
   - repo: https://github.com/Goldziher/gitfluff
-    rev: v0.8.0
+    rev: v0.9.0
     hooks:
       - id: gitfluff-lint
         stages: [commit-msg]
@@ -135,15 +137,16 @@ write = true
 
 [rules]
 no_emojis = true
+ai_cleanup = true  # set to false to disable AI attribution cleanup
 title_suffix = "\\(JIRA-[0-9]+\\)"
 exit_nonzero_on_rewrite = true
 ```
 
-Any setting can be left out; omit the file entirely to keep defaults.
+Any setting can be left out; omit the file entirely to keep defaults. Unknown config keys now trigger an error rather than being silently ignored.
 
 ## Advanced usage
 
-- Override rules per-invocation using CLI flags (e.g. `--preset`, `--msg-pattern`, `--cleanup-pattern`, `--exclude`, `--cleanup`, `--single-line`, `--no-emojis`, `--ascii-only`, `--title-prefix`, `--title-suffix`).
+- Override rules per-invocation using CLI flags (e.g. `--preset`, `--msg-pattern`, `--cleanup-pattern`, `--exclude`, `--cleanup`, `--single-line`, `--no-emojis`, `--ascii-only`, `--title-prefix`, `--title-suffix`, `--no-ai-cleanup`).
 - Set `GITFLUFF_BINARY` to point at a custom build when testing unpublished versions.
 - Clear the cache (`rm ~/.cache/gitfluff/gitfluff*`) to force a fresh download.
 

gitfluff-0.9.0/pyproject.toml

@@ -0,0 +1,38 @@
+[build-system]
+requires = ["setuptools>=61.0", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "gitfluff"
+version = "0.9.0"
+description = "Commit message linter and formatter"
+readme = "README.md"
+license = { text = "MIT" }
+authors = [{ name = "Na'aman Hirschfeld", email = "nhirschfeld@gmail.com" }]
+classifiers = [
+  "Development Status :: 3 - Alpha",
+  "Intended Audience :: Developers",
+  "License :: OSI Approved :: MIT License",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.8",
+  "Programming Language :: Python :: 3.9",
+  "Programming Language :: Python :: 3.10",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Topic :: Software Development :: Build Tools",
+  "Environment :: Console",
+]
+keywords = ["git", "commit", "lint", "conventional", "format"]
+requires-python = ">=3.8"
+dependencies = ["certifi>=2024.7.4"]
+
+[project.urls]
+Homepage = "https://github.com/Goldziher/gitfluff"
+Repository = "https://github.com/Goldziher/gitfluff.git"
+Issues = "https://github.com/Goldziher/gitfluff/issues"
+
+[project.scripts]
+gitfluff = "gitfluff.cli:main"
+
+[tool.setuptools]
+packages = ["gitfluff"]

gitfluff-0.8.0/pyproject.toml

@@ -1,42 +0,0 @@
-[build-system]
-requires = ["setuptools>=61.0", "wheel"]
-build-backend = "setuptools.build_meta"
-
-[project]
-name = "gitfluff"
-version = "0.8.0"
-description = "Commit message linter and formatter"
-readme = "README.md"
-license = {text = "MIT"}
-authors = [
-    {name = "Na'aman Hirschfeld", email = "nhirschfeld@gmail.com"}
-]
-classifiers = [
-    "Development Status :: 3 - Alpha",
-    "Intended Audience :: Developers",
-    "License :: OSI Approved :: MIT License",
-    "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.8",
-    "Programming Language :: Python :: 3.9",
-    "Programming Language :: Python :: 3.10",
-    "Programming Language :: Python :: 3.11",
-    "Programming Language :: Python :: 3.12",
-    "Topic :: Software Development :: Build Tools",
-    "Environment :: Console"
-]
-keywords = ["git", "commit", "lint", "conventional", "format"]
-requires-python = ">=3.8"
-dependencies = [
-    "certifi>=2024.7.4"
-]
-
-[project.urls]
-Homepage = "https://github.com/Goldziher/gitfluff"
-Repository = "https://github.com/Goldziher/gitfluff.git"
-Issues = "https://github.com/Goldziher/gitfluff/issues"
-
-[project.scripts]
-gitfluff = "gitfluff.cli:main"
-
-[tool.setuptools]
-packages = ["gitfluff"]