gitrupt 0.1.0__py3-none-any.whl

gitrupt/scanners/malware.py

@@ -0,0 +1,219 @@
+"""
+Native malware scanner.
+
+Runs three passes over each staged file:
+    1. YARA engine (if yara-python is installed)
+    2. Always-on ASCII signature set (EICAR + well-known strings)
+    3. Binary heuristics (PE/ELF/Mach-O in wrong extensions, packers, entropy)
+
+Never executes any file. Reads staged bytes only.
+
+The scanner does not block. The Risk Engine owns the decision.
+"""
+
+from __future__ import annotations
+
+import logging
+from typing import Callable
+
+from gitrupt.config import MalwareConfig
+from gitrupt.models import Finding, ScanTarget, Severity
+from gitrupt.scanners.base import Scanner
+from gitrupt.scanners.binaries import scan_binary_heuristics
+from gitrupt.scanners.yara_loader import is_available as yara_is_available
+from gitrupt.scanners.yara_loader import load_rules
+
+logger = logging.getLogger(__name__)
+
+ContentProvider = Callable[[str, str], bytes | None]
+
+
+# ── Always-on ASCII signatures ──────────────────────────────────────────────
+# These run even without yara-python. Byte-for-byte matches only.
+
+_EICAR_PARTS = [
+    "X5O!P%@AP[4\\",
+    "PZX54(P^)7CC)7}",
+    "$EICAR-STANDARD-",
+    "ANTIVIRUS-TEST-",
+    "FILE!$H+H*",
+]
+_EICAR_BYTES = ("".join(_EICAR_PARTS)).encode("ascii")
+
+
+_ASCII_SIGNATURES: tuple[tuple[bytes, str, str, Severity, float], ...] = (
+    (
+        _EICAR_BYTES,
+        "eicar-test-file",
+        "EICAR antivirus test file detected",
+        Severity.CRITICAL,
+        1.0,
+    ),
+)
+
+
+def _default_content_provider(repo_root: str, path: str) -> bytes | None:
+    """Read the staged bytes of a file via Git. Lazy import to avoid cycles."""
+    from gitrupt.git import GitAdapter
+
+    return GitAdapter.get_staged_file_bytes(repo_root, path)
+
+
+def _is_binary_like(data: bytes) -> bool:
+    """
+    True if the bytes look like a real binary file.
+
+    Uses the same NUL-byte heuristic Git itself uses (a NUL in the first
+    8 KB), plus executable magic bytes for edge cases (some packed
+    executables lack early NULs).
+    """
+    if not data:
+        return False
+    if b"\x00" in data[:8192]:
+        return True
+
+    from gitrupt.scanners.binaries import detect_executable_format
+    return detect_executable_format(data) is not None
+
+
+
+
+class NativeMalwareScanner(Scanner):
+    """
+    Detects known malware signatures and suspicious binary files.
+
+    Configuration (MalwareConfig):
+        use_yara:             try to load the YARA engine (default True)
+        max_file_size_mb:     skip files larger than this (default 50 MB)
+        custom_yara_dirs:     extra directories of *.yar files
+    """
+
+    def __init__(
+        self,
+        config: MalwareConfig | None = None,
+        content_provider: ContentProvider | None = None,
+    ) -> None:
+        self._config = config or MalwareConfig()
+        self._content_provider = content_provider or _default_content_provider
+        self._max_bytes = int(self._config.max_file_size_mb * 1024 * 1024)
+
+        self._yara_rules = None
+        if self._config.use_yara and yara_is_available():
+            self._yara_rules = load_rules(self._config.custom_yara_dirs)
+            if self._yara_rules is not None:
+                logger.debug("YARA engine loaded with built-in rules")
+
+    # ── Scanner interface ────────────────────────────────────────────────────
+
+    @property
+    def name(self) -> str:
+        return "malware"
+
+    @property
+    def description(self) -> str:
+        return "Detects known malware signatures and suspicious binaries."
+
+    def scan(self, target: ScanTarget) -> list[Finding]:
+        findings: list[Finding] = []
+
+        for staged in target.staged_files:
+            if staged.status == "D":
+                continue
+
+            data = self._content_provider(target.repo_root, staged.path)
+            if not data:
+                continue
+
+            if len(data) > self._max_bytes:
+                logger.info(
+                    "Skipping %s (%d bytes > %d limit)",
+                    staged.path,
+                    len(data),
+                    self._max_bytes,
+                )
+                continue
+
+            # Pass 1: always — ASCII signatures (EICAR etc.) are safe on
+            # any file because the strings are specific enough.
+            findings.extend(self._ascii_signature_pass(staged.path, data))
+
+            # Passes 2 and 3: only for real binaries.
+            # A .py file containing the literal b"UPX0" is documentation,
+            # not malware. Git's own is_binary flag is the primary signal;
+            # magic-byte detection is the fallback.
+            if staged.is_binary or _is_binary_like(data):
+                if self._yara_rules is not None:
+                    findings.extend(self._yara_pass(staged.path, data))
+                findings.extend(scan_binary_heuristics(staged.path, data))
+
+        return findings
+
+    # ── Passes ───────────────────────────────────────────────────────────────
+
+    def _ascii_signature_pass(self, path: str, data: bytes) -> list[Finding]:
+        findings: list[Finding] = []
+        for sig, rule_id, message, severity, confidence in _ASCII_SIGNATURES:
+            if sig in data:
+                findings.append(
+                    Finding(
+                        scanner="malware",
+                        rule_id=rule_id,
+                        severity=severity,
+                        confidence=confidence,
+                        file=path,
+                        line=None,
+                        message=message,
+                        description="File matches a known antivirus test / malware signature.",
+                        evidence="<signature redacted>",
+                        recommendation="Remove this file from the commit.",
+                        can_override=False,
+                    )
+                )
+        return findings
+
+    def _yara_pass(self, path: str, data: bytes) -> list[Finding]:
+        findings: list[Finding] = []
+        try:
+            matches = self._yara_rules.match(data=data)
+        except Exception as e:
+            logger.warning("YARA match failed on %s: %s", path, e)
+            return findings
+
+        for match in matches:
+            rule_name = match.rule
+            severity, confidence, description = self._yara_metadata(match)
+            findings.append(
+                Finding(
+                    scanner="malware",
+                    rule_id=f"yara-{rule_name}",
+                    severity=severity,
+                    confidence=confidence,
+                    file=path,
+                    line=None,
+                    message=f"YARA rule matched: {rule_name}",
+                    description=description,
+                    evidence=f"rule={rule_name}",
+                    recommendation="Inspect the file; do not commit untrusted content.",
+                    can_override=False,
+                )
+            )
+        return findings
+
+    @staticmethod
+    def _yara_metadata(match) -> tuple[Severity, float, str]:
+        """Read severity/description from YARA rule meta with sane defaults."""
+        meta = getattr(match, "meta", {}) or {}
+        raw_severity = str(meta.get("severity", "high")).lower()
+        severity = {
+            "low": Severity.LOW,
+            "medium": Severity.MEDIUM,
+            "high": Severity.HIGH,
+            "critical": Severity.CRITICAL,
+        }.get(raw_severity, Severity.HIGH)
+
+        confidence = 0.85
+        if raw_severity == "critical":
+            confidence = 0.95
+
+        description = str(meta.get("description", "YARA rule matched."))
+        return severity, confidence, description

gitrupt/scanners/osv_client.py

@@ -0,0 +1,221 @@
+"""
+OSV vulnerability client.
+
+Talks to https://api.osv.dev/v1/querybatch using stdlib urllib only.
+Caches responses on disk keyed by SHA-256 of (ecosystem, name, version).
+
+Never raises. On any error, returns an empty result and logs a warning —
+a network failure must never block a commit.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import logging
+import time
+import urllib.error
+import urllib.request
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any, Callable
+
+from gitrupt.scanners.ecosystems.base import Dependency
+
+logger = logging.getLogger(__name__)
+
+OSV_URL = "https://api.osv.dev/v1/querybatch"
+
+# Transport contract: (url, body_bytes, timeout_seconds) -> (status, response_bytes)
+Transport = Callable[[str, bytes, float], tuple[int, bytes]]
+
+
+def _default_transport(url: str, body: bytes, timeout: float) -> tuple[int, bytes]:
+    req = urllib.request.Request(
+        url,
+        data=body,
+        headers={
+            "Content-Type": "application/json",
+            "User-Agent": "Gitrupt/1.0",
+        },
+        method="POST",
+    )
+    with urllib.request.urlopen(req, timeout=timeout) as resp:
+        return resp.status, resp.read()
+
+
+@dataclass(frozen=True)
+class _CacheKey:
+    ecosystem: str
+    name: str
+    version: str
+
+    @property
+    def digest(self) -> str:
+        raw = f"{self.ecosystem}|{self.name}|{self.version}".encode("utf-8")
+        return hashlib.sha256(raw).hexdigest()
+
+
+class OSVClient:
+    """
+    Batch-query OSV for vulnerabilities affecting a set of dependencies.
+
+    Usage:
+        client = OSVClient(timeout=10.0, cache_ttl_hours=24)
+        vulns = client.query_batch(deps)
+        # vulns: dict[(ecosystem, name, version)] -> list[dict]
+    """
+
+    def __init__(
+        self,
+        timeout: float = 10.0,
+        cache_ttl_hours: int = 24,
+        cache_dir: Path | None = None,
+        transport: Transport | None = None,
+    ) -> None:
+        self._timeout = timeout
+        self._cache_ttl_seconds = max(0, cache_ttl_hours) * 3600
+        self._cache_dir = cache_dir or (Path.home() / ".gitrupt" / "cache")
+        self._transport = transport or _default_transport
+        self._cache: dict[str, dict[str, Any]] = self._load_cache()
+
+    # ── Public ──────────────────────────────────────────────────────────────
+
+    def query_batch(
+        self, deps: list[Dependency]
+    ) -> dict[tuple[str, str, str], list[dict]]:
+        """
+        Return a mapping of (ecosystem, name, version) -> list of vuln dicts.
+
+        Cache hits are used without network. Cache misses are queried in one
+        HTTP call. If the call fails, misses simply return no vulns.
+        """
+        result: dict[tuple[str, str, str], list[dict]] = {}
+        misses: list[Dependency] = []
+
+        for dep in deps:
+            key = (dep.osv_ecosystem, dep.name, dep.version)
+            if key in result:
+                continue
+            cached = self._cache_lookup(dep)
+            if cached is not None:
+                result[key] = cached
+            else:
+                misses.append(dep)
+
+        if misses:
+            fetched = self._query_remote(misses)
+            for dep in misses:
+                key = (dep.osv_ecosystem, dep.name, dep.version)
+                result[key] = fetched.get(key, [])
+
+            self._save_cache()
+
+        return result
+
+    # ── Cache ───────────────────────────────────────────────────────────────
+
+    def _cache_path(self) -> Path:
+        return self._cache_dir / "osv-cache.json"
+
+    def _load_cache(self) -> dict[str, dict[str, Any]]:
+        path = self._cache_path()
+        if not path.is_file():
+            return {}
+        try:
+            data = json.loads(path.read_text(encoding="utf-8"))
+        except (OSError, json.JSONDecodeError):
+            return {}
+
+        if not isinstance(data, dict) or data.get("version") != 1:
+            return {}
+
+        now = time.time()
+        ttl = self._cache_ttl_seconds
+        fresh: dict[str, dict[str, Any]] = {}
+        for digest, entry in (data.get("entries") or {}).items():
+            if not isinstance(entry, dict):
+                continue
+            ts = entry.get("ts")
+            if not isinstance(ts, (int, float)):
+                continue
+            if ttl and (now - ts) > ttl:
+                continue
+            fresh[digest] = entry
+        return fresh
+
+    def _save_cache(self) -> None:
+        try:
+            self._cache_dir.mkdir(parents=True, exist_ok=True)
+            payload = {
+                "version": 1,
+                "entries": self._cache,
+            }
+            tmp = self._cache_path().with_suffix(".tmp")
+            tmp.write_text(json.dumps(payload), encoding="utf-8")
+            tmp.replace(self._cache_path())
+        except OSError as e:
+            logger.debug("Could not persist OSV cache: %s", e)
+
+    def _cache_lookup(self, dep: Dependency) -> list[dict] | None:
+        digest = _CacheKey(dep.osv_ecosystem, dep.name, dep.version).digest
+        entry = self._cache.get(digest)
+        if entry is None:
+            return None
+        vulns = entry.get("vulns")
+        if not isinstance(vulns, list):
+            return None
+        return vulns
+
+    def _cache_store(self, dep: Dependency, vulns: list[dict]) -> None:
+        digest = _CacheKey(dep.osv_ecosystem, dep.name, dep.version).digest
+        self._cache[digest] = {"ts": time.time(), "vulns": vulns}
+
+    # ── Remote ──────────────────────────────────────────────────────────────
+
+    def _query_remote(
+        self, deps: list[Dependency]
+    ) -> dict[tuple[str, str, str], list[dict]]:
+        if not deps:
+            return {}
+
+        payload = {
+            "queries": [
+                {
+                    "package": {"name": d.name, "ecosystem": d.osv_ecosystem},
+                    "version": d.version,
+                }
+                for d in deps
+            ]
+        }
+        body = json.dumps(payload).encode("utf-8")
+
+        try:
+            status, response = self._transport(OSV_URL, body, self._timeout)
+        except (urllib.error.URLError, TimeoutError, OSError) as e:
+            logger.warning("OSV query failed (%s); continuing without vuln data", e)
+            return {}
+        except Exception as e:  # defensive: transport may raise anything
+            logger.warning("OSV query raised unexpected error: %s", e)
+            return {}
+
+        if status != 200:
+            logger.warning("OSV returned HTTP %d; continuing without vuln data", status)
+            return {}
+
+        try:
+            data = json.loads(response)
+        except json.JSONDecodeError as e:
+            logger.warning("OSV returned invalid JSON: %s", e)
+            return {}
+
+        results = data.get("results") or []
+        out: dict[tuple[str, str, str], list[dict]] = {}
+
+        for dep, entry in zip(deps, results):
+            vulns = (entry or {}).get("vulns") or []
+            key = (dep.osv_ecosystem, dep.name, dep.version)
+            out[key] = vulns
+            self._cache_store(dep, vulns)
+
+        return out

gitrupt/scanners/registry.py

@@ -0,0 +1,66 @@
+"""Scanner registry and health tracking for Gitrupt."""
+
+from __future__ import annotations
+
+from gitrupt.scanners.base import Scanner, ScannerHealth, ScannerStatus
+
+
+class ScannerRegistry:
+    """Tracks scanner availability, enablement, and health."""
+
+    def __init__(self) -> None:
+        self._scanners: list[tuple[Scanner, bool, bool]] = []
+
+    def register_adapter(self, scanner: Scanner, required: bool = False, enabled: bool = True) -> None:
+        """Register a scanner or adapter instance."""
+        self.register(scanner, required=required, enabled=enabled)
+
+    def register(self, scanner: Scanner, required: bool = False, enabled: bool = True) -> None:
+        """Register a scanner and its requirement flags."""
+        self._scanners.append((scanner, required, enabled))
+
+    def disable(self, scanner_name: str) -> None:
+        """Disable a registered scanner by name."""
+        for index, (scanner, required, enabled) in enumerate(self._scanners):
+            if scanner.name == scanner_name:
+                self._scanners[index] = (scanner, required, False)
+                return
+
+    def enable(self, scanner_name: str) -> None:
+        """Enable a registered scanner by name."""
+        for index, (scanner, required, enabled) in enumerate(self._scanners):
+            if scanner.name == scanner_name:
+                self._scanners[index] = (scanner, required, True)
+                return
+
+    @property
+    def health(self) -> list[ScannerHealth]:
+        """Return the health view for all registered scanners."""
+        health: list[ScannerHealth] = []
+        for scanner, required, enabled in self._scanners:
+            status = ScannerStatus.DISABLED if not enabled else (
+                ScannerStatus.AVAILABLE if scanner.is_available() else ScannerStatus.UNAVAILABLE
+            )
+            health.append(
+                ScannerHealth(
+                    name=scanner.name,
+                    status=status,
+                    required=required,
+                    available=scanner.is_available(),
+                )
+            )
+        return health
+
+    @property
+    def enabled_scanners(self) -> list[Scanner]:
+        """Return scanners that are enabled and available."""
+        scanners: list[Scanner] = []
+        for scanner, required, enabled in self._scanners:
+            if enabled and scanner.is_available():
+                scanners.append(scanner)
+        return scanners
+
+    @property
+    def scanners(self) -> list[Scanner]:
+        """Return all registered scanners."""
+        return [scanner for scanner, _, _ in self._scanners]