gitrupt 0.1.0__py3-none-any.whl

gitrupt/__init__.py

@@ -0,0 +1,13 @@
+"""
+Gitrupt — A local Git security firewall.
+
+Prevents secrets, prohibited files, and threats from entering Git commits.
+"""
+
+__version__ = "0.1.0"
+__author__ = "Gitrupt Contributors"
+__license__ = "MIT"
+
+from gitrupt.models import Finding, PolicyDecision, ScanResult, Severity
+
+__all__ = ["Finding", "PolicyDecision", "ScanResult", "Severity", "__version__"]

gitrupt/cli.py

@@ -0,0 +1,546 @@
+"""
+Gitrupt CLI.
+
+Commands:
+    gitrupt init       — Install the pre-commit hook
+    gitrupt scan       — Scan staged or working-tree files
+    gitrupt status     — Show installation status
+    gitrupt config     — Show current configuration
+    gitrupt uninstall  — Remove the pre-commit hook
+"""
+
+from __future__ import annotations
+
+import logging
+import sys
+from pathlib import Path
+from typing import Optional
+
+import typer
+from typing_extensions import Annotated
+
+from gitrupt import __version__
+
+app = typer.Typer(
+    name="gitrupt",
+    help="Gitrupt -- A local Git security firewall.",
+    rich_markup_mode="rich",
+    no_args_is_help=True,
+    pretty_exceptions_show_locals=False,
+)
+
+
+def _setup_logging(verbose: bool) -> None:
+    level = logging.DEBUG if verbose else logging.WARNING
+    logging.basicConfig(
+        level=level,
+        format="%(levelname)s: %(name)s: %(message)s",
+    )
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Global options callback
+# ─────────────────────────────────────────────────────────────────────────────
+
+
+def version_callback(value: bool) -> None:
+    if value:
+        typer.echo(f"Gitrupt {__version__}")
+        raise typer.Exit()
+
+
+@app.callback()
+def main_callback(
+    version: Annotated[
+        Optional[bool],
+        typer.Option(
+            "--version",
+            "-V",
+            callback=version_callback,
+            is_eager=True,
+            help="Show version and exit.",
+        ),
+    ] = None,
+    verbose: Annotated[
+        bool,
+        typer.Option("--verbose", "-v", help="Enable verbose/debug output."),
+    ] = False,
+) -> None:
+    """Gitrupt -- A local Git security firewall."""
+    _setup_logging(verbose)
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Commands
+# ─────────────────────────────────────────────────────────────────────────────
+
+
+@app.command()
+def init(
+    path: Annotated[
+        Optional[str],
+        typer.Argument(help="Repository path (default: current directory)."),
+    ] = None,
+    force: Annotated[
+        bool,
+        typer.Option("--force", "-f", help="Reinstall even if already installed."),
+    ] = False,
+    with_push: Annotated[
+        bool,
+        typer.Option("--with-push", help="Also install the pre-push hook."),
+    ] = False,
+) -> None:
+    """
+    Install Gitrupt protection in a Git repository.
+
+    Installs a pre-commit hook that scans staged changes before every commit.
+    Existing hooks are preserved and chained.
+
+    Use --with-push to also install the pre-push firewall.
+    """
+    from gitrupt.config import find_config_path, load_config, ConfigurationError
+    from gitrupt.git import GitAdapter
+    from gitrupt.hooks.install import HookInstaller, HookInstallError
+    from gitrupt.reporting import print_error, print_init_result, console
+
+    start_path = path or "."
+
+    if not GitAdapter.is_git_available():
+        print_error("Git is not installed or not on PATH.")
+        raise typer.Exit(code=1)
+
+    repo_root = GitAdapter.find_repo_root(start_path)
+    if not repo_root:
+        print_error(f"No Git repository found at or above: {Path(start_path).resolve()}")
+        raise typer.Exit(code=1)
+
+    hooks_dir = GitAdapter.find_hooks_dir(repo_root)
+    if not hooks_dir:
+        print_error("Could not locate the Git hooks directory.")
+        raise typer.Exit(code=1)
+
+    # Load config to decide which hooks to install (CLI flag overrides).
+    try:
+        config = load_config(repo_root)
+    except ConfigurationError:
+        config = None
+
+    install_push = with_push or (config is not None and config.hooks.pre_push)
+
+    installer = HookInstaller(repo_root=repo_root, hooks_dir=hooks_dir)
+
+    any_installed = False
+    had_existing_any = False
+    paths: list[str] = []
+
+    if not installer.is_hook_installed("pre-commit") or force:
+        try:
+            ok, had, hpath = installer.install_hook("pre-commit")
+        except HookInstallError as e:
+            print_error(str(e))
+            raise typer.Exit(code=1) from e
+        if ok:
+            any_installed = True
+            had_existing_any = had_existing_any or had
+            paths.append(hpath)
+
+    if install_push:
+        if not installer.is_hook_installed("pre-push") or force:
+            try:
+                ok, had, hpath = installer.install_hook("pre-push")
+            except HookInstallError as e:
+                print_error(str(e))
+                raise typer.Exit(code=1) from e
+            if ok:
+                any_installed = True
+                had_existing_any = had_existing_any or had
+                paths.append(hpath)
+
+    if not any_installed and not force:
+        console.print()
+        console.print("[bold blue]🛡️  Gitrupt[/bold blue]")
+        console.print()
+        console.print("[green]✓[/green]  Gitrupt is already installed.")
+        console.print("[dim]Run with --force to reinstall.[/dim]")
+        return
+
+    config_path = find_config_path(repo_root)
+    print_init_result(
+        repo_root=repo_root,
+        hook_paths=paths,
+        was_existing_hook=had_existing_any,
+        config_exists=config_path is not None,
+    )
+
+
+@app.command()
+def scan(
+    staged: Annotated[
+        bool,
+        typer.Option("--staged", "-s", help="Scan only staged files (pre-commit behavior)."),
+    ] = False,
+    push: Annotated[
+        bool,
+        typer.Option("--push", help="Scan outgoing commits (pre-push behavior)."),
+    ] = False,
+    path: Annotated[
+        Optional[str],
+        typer.Argument(help="Repository path (default: current directory)."),
+    ] = None,
+    output_format: Annotated[
+        str,
+        typer.Option("--format", "-f", help="Output format: terminal, json, sarif."),
+    ] = "terminal",
+) -> None:
+    """
+    Scan repository files for security issues.
+
+    Default: staged files (matches the pre-commit hook).
+    --push: outgoing commits (matches the pre-push hook).
+    """
+    from gitrupt.config import ConfigurationError, load_config
+    from gitrupt.git import GitAdapter, GitError
+    from gitrupt.reporting import (
+        print_header, print_scanning, print_decision, print_scan_stats, print_error,
+    )
+    from gitrupt.risk import RiskEngine
+    from gitrupt.scanner import run_scan
+
+    start_path = path or "."
+
+    if not GitAdapter.is_git_available():
+        print_error("Git is not installed or not on PATH.")
+        raise typer.Exit(code=1)
+
+    repo_root = GitAdapter.find_repo_root(start_path)
+    if not repo_root:
+        print_error("Not inside a Git repository.")
+        raise typer.Exit(code=1)
+
+    try:
+        config = load_config(repo_root)
+    except ConfigurationError as e:
+        print_error(f"Configuration error: {e}")
+        raise typer.Exit(code=1) from e
+
+    try:
+        if push:
+            target = _build_push_target_interactive(repo_root)
+        else:
+            target = GitAdapter.build_scan_target(repo_root)
+    except GitError as e:
+        print_error(f"Git error: {e}")
+        raise typer.Exit(code=1) from e
+
+    if output_format in {"json", "sarif"}:
+        scan_result = run_scan(target, config)
+        if output_format == "json":
+            _output_json(scan_result)
+        else:
+            _output_sarif(scan_result)
+        return
+
+    print_header()
+    if not target.staged_files:
+        from gitrupt.reporting import console
+        console.print("[dim]No files to scan.[/dim]")
+        return
+
+    print_scanning(len(target.staged_files))
+    scan_result = run_scan(target, config)
+    engine = RiskEngine(config.policy, config.suppressions)
+    decision = engine.evaluate(scan_result)
+    print_decision(decision)
+    print_scan_stats(scan_result)
+    raise typer.Exit(code=decision.exit_code)
+
+
+def _build_push_target_interactive(repo_root: str):
+    """Build a push scan target for the current branch vs its upstream."""
+    import subprocess
+    from gitrupt.git import GitAdapter, GitError
+
+    # Try to find the upstream
+    try:
+        result = subprocess.run(
+            ["git", "rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"],
+            check=False, capture_output=True, text=True, cwd=repo_root, timeout=10,
+        )
+    except Exception as e:
+        raise GitError(f"Could not resolve upstream: {e}") from e
+
+    if result.returncode != 0:
+        raise GitError(
+            "No upstream branch set. Push with -u first, or use --staged."
+        )
+
+    upstream = result.stdout.strip()  # e.g. "origin/main"
+    remote_sha_res = subprocess.run(
+        ["git", "rev-parse", upstream],
+        check=False, capture_output=True, text=True, cwd=repo_root, timeout=10,
+    )
+    head_sha_res = subprocess.run(
+        ["git", "rev-parse", "HEAD"],
+        check=False, capture_output=True, text=True, cwd=repo_root, timeout=10,
+    )
+    if remote_sha_res.returncode != 0 or head_sha_res.returncode != 0:
+        raise GitError("Could not resolve upstream or HEAD.")
+
+    return GitAdapter.build_push_scan_target(
+        repo_root, remote_sha_res.stdout.strip(), head_sha_res.stdout.strip(),
+    )
+
+
+@app.command()
+def status(
+    path: Annotated[
+        Optional[str],
+        typer.Argument(help="Repository path (default: current directory)."),
+    ] = None,
+) -> None:
+    """
+    Show Gitrupt installation status.
+    """
+    from gitrupt.config import find_config_path
+    from gitrupt.git import GitAdapter
+    from gitrupt.hooks.install import HookInstaller
+    from gitrupt.reporting import print_status
+
+    start_path = path or "."
+
+    git_available = GitAdapter.is_git_available()
+    git_version = GitAdapter.get_git_version() if git_available else None
+    git_binary = GitAdapter.get_git_binary() if git_available else None
+    repo_root = GitAdapter.find_repo_root(start_path) if git_available else None
+
+    hook_installed = False
+    hook_path = None
+    hooks_dir = None
+    core_hooks_path = None
+
+    if repo_root:
+        hooks_dir = GitAdapter.find_hooks_dir(repo_root)
+        core_hooks_path = GitAdapter.get_core_hooks_path(repo_root)
+        if hooks_dir:
+            installer = HookInstaller(repo_root=repo_root, hooks_dir=hooks_dir)
+            hook_installed = installer.is_installed()
+            hook_path = installer.hook_path() if hook_installed else None
+
+    config_path = None
+    if repo_root:
+        cp = find_config_path(repo_root)
+        config_path = str(cp) if cp else None
+
+
+            # YARA availability (does not require an initialized engine)
+    from gitrupt.scanners.yara_loader import is_available as yara_is_available
+    yara_available = yara_is_available()
+
+    from gitrupt.scanners.ecosystems import supported_ecosystems
+    dependency_ecosystems = supported_ecosystems()
+
+
+
+    pre_push_installed = None
+    pre_push_path = None
+    if repo_root and hooks_dir:
+        installer = HookInstaller(repo_root=repo_root, hooks_dir=hooks_dir)
+        pre_push_installed = installer.is_hook_installed("pre-push")
+        pre_push_path = str(Path(hooks_dir) / "pre-push") if pre_push_installed else None
+
+
+
+        print_status(
+        repo_root=repo_root,
+        git_available=git_available,
+        hook_installed=hook_installed,
+        hook_path=hook_path,
+        config_path=config_path,
+        git_version=git_version,
+        git_binary=git_binary,
+        hooks_dir=hooks_dir,
+        core_hooks_path=core_hooks_path,
+        yara_available=yara_available,
+        dependency_ecosystems=dependency_ecosystems,
+        pre_push_installed=pre_push_installed,
+        pre_push_path=pre_push_path,
+    )
+
+
+@app.command()
+def uninstall(
+    path: Annotated[Optional[str], typer.Argument(help="Repository path.")] = None,
+    yes: Annotated[bool, typer.Option("--yes", "-y", help="Skip confirmation.")] = False,
+    with_push: Annotated[bool, typer.Option("--with-push", help="Also remove pre-push.")] = False,
+) -> None:
+    """Remove Gitrupt protection from a Git repository."""
+    from gitrupt.git import GitAdapter
+    from gitrupt.hooks.install import HookInstaller
+    from gitrupt.reporting import print_uninstall_result, print_error, console
+
+    start_path = path or "."
+    if not GitAdapter.is_git_available():
+        print_error("Git is not installed or not on PATH.")
+        raise typer.Exit(code=1)
+    repo_root = GitAdapter.find_repo_root(start_path)
+    if not repo_root:
+        print_error("Not inside a Git repository.")
+        raise typer.Exit(code=1)
+    hooks_dir = GitAdapter.find_hooks_dir(repo_root)
+    if not hooks_dir:
+        print_error("Could not locate the Git hooks directory.")
+        raise typer.Exit(code=1)
+
+    installer = HookInstaller(repo_root=repo_root, hooks_dir=hooks_dir)
+
+    if not yes:
+        confirm = typer.confirm("Remove Gitrupt protection?")
+        if not confirm:
+            typer.echo("Cancelled.")
+            return
+
+    results: list[tuple[str, bool]] = []
+    if installer.is_hook_installed("pre-commit"):
+        ok, p = installer.uninstall_hook("pre-commit")
+        results.append((p, ok))
+    if with_push and installer.is_hook_installed("pre-push"):
+        ok, p = installer.uninstall_hook("pre-push")
+        results.append((p, ok))
+
+    if not results:
+        console.print("[yellow]No Gitrupt hooks found to remove.[/yellow]")
+        return
+
+    for p, ok in results:
+        print_uninstall_result(p, ok)
+
+
+@app.command(name="config")
+def show_config(
+    path: Annotated[
+        Optional[str],
+        typer.Argument(help="Repository path (default: current directory)."),
+    ] = None,
+) -> None:
+    """
+    Show the current Gitrupt configuration.
+    """
+    from gitrupt.config import ConfigurationError, load_config
+    from gitrupt.git import GitAdapter
+    from gitrupt.reporting import print_config, print_error
+
+    start_path = path or "."
+
+    repo_root = GitAdapter.find_repo_root(start_path)
+
+    try:
+        config = load_config(repo_root or start_path)
+    except ConfigurationError as e:
+        print_error(f"Configuration error: {e}")
+        raise typer.Exit(code=1) from e
+
+    print_config(config.model_dump(mode="json"))
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# Helpers
+# ─────────────────────────────────────────────────────────────────────────────
+
+
+def _output_json(scan_result: object) -> None:
+    """Output scan results as JSON."""
+    import json
+    from gitrupt.models import ScanResult
+
+    if isinstance(scan_result, ScanResult):
+        data = {
+            "files_scanned": scan_result.files_scanned,
+            "scan_duration_ms": scan_result.scan_duration_ms,
+            "scanners_run": scan_result.scanners_run,
+            "findings": [
+                {
+                    "id": f.id,
+                    "scanner": f.scanner,
+                    "rule_id": f.rule_id,
+                    "severity": f.severity.value,
+                    "confidence": f.confidence,
+                    "file": f.file,
+                    "line": f.line,
+                    "message": f.message,
+                    "description": f.description,
+                    "evidence": f.evidence,
+                    "recommendation": f.recommendation,
+                    "can_override": f.can_override,
+                }
+                for f in scan_result.findings
+            ],
+        }
+        typer.echo(json.dumps(data, indent=2))
+
+
+def _output_sarif(scan_result: object) -> None:
+    """Output scan results in SARIF JSON format."""
+    import json
+    from gitrupt.models import ScanResult
+
+    if not isinstance(scan_result, ScanResult):
+        return
+
+    sarif = {
+        "$schema": "https://schemastore.azurewebsites.net/schemas/json/sarif-2.1.0.json",
+        "version": "2.1.0",
+        "runs": [
+            {
+                "tool": {
+                    "driver": {
+                        "name": "Gitrupt",
+                        "informationUri": "https://github.com/gitrupt/gitrupt",
+                        "rules": [
+                            {
+                                "id": finding.rule_id,
+                                "name": finding.message,
+                                "shortDescription": {"text": finding.description or finding.message},
+                                "properties": {
+                                    "severity": finding.severity.value,
+                                    "scanner": finding.scanner,
+                                },
+                            }
+                            for finding in scan_result.findings
+                        ],
+                    }
+                },
+                "results": [
+                    {
+                        "ruleId": finding.rule_id,
+                        "level": "error" if finding.severity.value in {"critical", "high"} else "warning",
+                        "message": {"text": finding.message},
+                        "locations": [
+                            {
+                                "physicalLocation": {
+                                    "artifactLocation": {"uri": finding.file},
+                                    "region": {"startLine": finding.line or 1},
+                                }
+                            }
+                        ],
+                        "properties": {
+                            "scanner": finding.scanner,
+                            "confidence": finding.confidence,
+                            "recommendation": finding.recommendation,
+                        },
+                    }
+                    for finding in scan_result.findings
+                ],
+            }
+        ],
+    }
+
+    typer.echo(json.dumps(sarif, indent=2))
+
+
+def app_main() -> None:
+    """Entry point for the console script."""
+    app()
+
+
+if __name__ == "__main__":
+    app_main()