gitrupt 0.1.0__py3-none-any.whl

gitrupt-0.1.0.dist-info/METADATA

@@ -0,0 +1,342 @@
+Metadata-Version: 2.4
+Name: gitrupt
+Version: 0.1.0
+Summary: A local Git security firewall for secrets, suspicious code, malware heuristics, and dependency vulnerability checks
+License: MIT License
+        
+        Gitrupt is released under the MIT License.
+        
+        Copyright (c) 2026 Gitrupt Contributors
+        
+        Permission is hereby granted, free of charge, to any person obtaining a copy
+        of this software and associated documentation files (the "Software"), to deal
+        in the Software without restriction, including without limitation the rights
+        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+        copies of the Software, and to permit persons to whom the Software is
+        furnished to do so, subject to the following conditions:
+        
+        The above copyright notice and this permission notice shall be included in all
+        copies or substantial portions of the Software.
+        
+        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+        SOFTWARE.
+        
+Project-URL: Homepage, https://github.com/gitrupt/gitrupt
+Project-URL: Repository, https://github.com/gitrupt/gitrupt
+Project-URL: Issues, https://github.com/gitrupt/gitrupt/issues
+Project-URL: Documentation, https://github.com/gitrupt/gitrupt/blob/main/docs/architecture.md
+Keywords: git,security,secrets,pre-commit,pre-push,malware,suspicious-code,dependency-scanning,firewall
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Version Control :: Git
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: typer>=0.12.0
+Requires-Dist: pydantic>=2.0.0
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: rich>=13.0.0
+Provides-Extra: malware
+Requires-Dist: yara-python>=4.3.0; extra == "malware"
+Provides-Extra: all
+Requires-Dist: yara-python>=4.3.0; extra == "all"
+Provides-Extra: dev
+Requires-Dist: pytest>=7.4.0; extra == "dev"
+Requires-Dist: pytest-cov>=4.1.0; extra == "dev"
+Requires-Dist: ruff>=0.1.0; extra == "dev"
+Requires-Dist: mypy>=1.5.0; extra == "dev"
+Requires-Dist: types-PyYAML>=6.0; extra == "dev"
+Requires-Dist: yara-python>=4.3.0; extra == "dev"
+Dynamic: license-file
+
+# Gitrupt 🛡️
+
+Gitrupt is a local Git security firewall that protects repositories from secrets, suspicious code, malware-style binaries, and vulnerable dependencies before they reach a commit or push.
+
+It runs at the Git hook boundary and evaluates staged or outgoing content against a policy you control in a repository-level `.gitrupt.yml` file.
+
+---
+
+## Features
+
+- 🔒 **Forbidden file blocking** — `.env`, `.env.*`, `*.pem`, `*.key`, `credentials.json`, and more
+- 🔑 **Secret detection** — AWS keys, GitHub tokens, private keys, API keys, database URLs, JWTs, and more
+- 📊 **Entropy-based detection** — calibrated Shannon entropy checks for likely secret material
+- 🧠 **Suspicious code heuristics** — flags dangerous patterns in added lines across common languages
+- 🦠 **Native malware checks** — EICAR signatures, binary heuristics, packer markers, and optional YARA matching
+- 📦 **Dependency scanning** — OSV-backed vulnerability checks for Python and Node manifests when enabled
+- 🪝 **Hook coverage** — pre-commit is installed by default; pre-push is available as an optional extra layer
+- 🔐 **Local-first privacy** — default execution stays on the machine; networked checks are opt-in
+
+---
+
+## Quick Start
+
+```bash
+pip install gitrupt
+
+cd your-repository
+gitrupt init
+
+# Protect staged commits
+git commit -m "feat: my change"
+```
+
+Optional push-time protection:
+
+```bash
+gitrupt init --with-push
+```
+
+---
+
+## Installation
+
+Requires Python 3.11+ and Git.
+
+```bash
+pip install gitrupt
+```
+
+---
+
+## Usage
+
+### Initialize protection
+
+```bash
+gitrupt init
+```
+
+Installs the Gitrupt pre-commit hook in the current Git repository.
+
+### Install push firewall
+
+```bash
+gitrupt init --with-push
+```
+
+Adds a pre-push hook that scans outgoing commits before they leave the machine.
+
+### Check status
+
+```bash
+gitrupt status
+```
+
+Shows whether Gitrupt is installed and active.
+
+### Manual scan
+
+```bash
+gitrupt scan --staged    # scan staged changes (pre-commit behavior)
+gitrupt scan --push      # scan outgoing commits (pre-push behavior)
+gitrupt scan             # scan the working tree
+```
+
+### Show configuration
+
+```bash
+gitrupt config
+```
+
+### Remove protection
+
+```bash
+gitrupt uninstall
+```
+
+---
+
+## Configuration
+
+Gitrupt reads a repository-level `.gitrupt.yml` file. The current schema supports the scanner toggles, denial rules, allowlists, entropy tuning, suspicious-code tuning, malware settings, dependency settings, and policy overrides.
+
+```yaml
+version: 1
+mode: strict
+
+scan:
+  secrets: true
+  threats: true
+  suspicious_code: false
+  dependencies: false
+
+rules:
+  forbidden_paths:
+    - ".env"
+    - ".env.*"
+    - "*.pem"
+    - "*.key"
+    - "*.p12"
+    - "*.pfx"
+    - "credentials.json"
+    - "service-account.json"
+    - "*.secret"
+  forbidden_extensions:
+    - ".scr"
+    - ".exe"
+  max_file_size_mb: 50.0
+
+allow:
+  paths:
+    - ".env.example"
+    - "tests/fixtures/**"
+    - "docs/**"
+
+suppressions:
+  rules: []
+  files: []
+  paths: []
+
+entropy:
+  enabled: true
+  threshold: 4.5
+  min_length: 20
+
+suspicious_code:
+  min_confidence: 0.6
+  languages:
+    - python
+    - javascript
+    - shell
+    - powershell
+    - php
+    - ruby
+    - go
+
+malware:
+  use_yara: true
+  max_file_size_mb: 50.0
+  custom_yara_dirs: []
+
+dependencies:
+  ecosystems:
+    - python
+    - node
+  offline: false
+  timeout_seconds: 10.0
+  cache_ttl_hours: 24
+
+policy:
+  low: allow
+  medium: warn
+  high: block
+  critical: block
+```
+
+Valid modes are `strict`, `permissive`, and `warn-only`.
+
+---
+
+## How It Works
+
+```text
+Developer
+  ↓
+Git commit / git push
+  ↓
+Git hook (pre-commit and optional pre-push)
+  ↓
+Gitrupt scanner pipeline
+  ↓
+Forbidden file checks + secret scans + entropy checks
+  ↓
+Suspicious code checks + malware heuristics + dependency OSV scans
+  ↓
+Risk engine + policy decision
+  ↓
+ALLOW / WARN / BLOCK
+```
+
+---
+
+## Security Report Example
+
+When a commit is blocked, Gitrupt reports the file, severity, detector, and guidance:
+
+```text
+🛡️ Gitrupt
+
+COMMIT BLOCKED
+
+CRITICAL  .env
+          Environment file is prohibited.
+          Remove this file from staging: git restore --staged .env
+
+HIGH      backend/config.py:18
+          Possible AWS credential detected.
+          Move credentials to environment variables.
+
+Fix the findings above and try again.
+To override (not recommended): git commit --no-verify
+```
+
+---
+
+## Hook Safety
+
+Gitrupt never silently destroys existing Git hooks.
+
+If a hook already exists, Gitrupt preserves it and wraps it so your original behavior still runs after Gitrupt completes.
+
+---
+
+## Privacy
+
+By default, Gitrupt runs locally. Repository content stays on the machine unless you explicitly enable networked checks.
+
+- Native scanning runs locally
+- Dependency OSV queries are only used when the dependency scanner is enabled and `offline` is `false`
+- Third-party adapters remain optional and are only used when configured
+- Secret findings are redacted before reporting
+
+---
+
+## Limitations
+
+Git allows bypassing client-side hooks:
+
+```bash
+git commit --no-verify
+```
+
+Gitrupt logs this but cannot prevent it at the client level alone. For organizational enforcement, use CI/CD controls and repository-level policy enforcement.
+
+---
+
+## Roadmap
+
+Gitrupt continues to expand beyond the initial MVP scope with optional integrations and workflow hardening.
+
+- Native suspicious-code detection
+- Malware heuristics and YARA support
+- Dependency vulnerability scanning with OSV
+- Optional pre-push firewall protection
+- Additional external adapters and reporting formats
+
+---
+
+## Contributing
+
+See [CONTRIBUTING.md](CONTRIBUTING.md).
+
+## Security
+
+See [SECURITY.md](SECURITY.md) for vulnerability reporting.
+
+## License
+
+MIT License — see [LICENSE](LICENSE).

gitrupt-0.1.0.dist-info/RECORD

@@ -0,0 +1,48 @@
+gitrupt/__init__.py,sha256=0x6czyiVEOntoLs5EqO4b8F1d2NDPOt6RAgtkyRy0ao,362
+gitrupt/cli.py,sha256=AnmdLBadewBOp-Qh9KkfyeDDSGuT74yi1HFMmbtZR6E,18703
+gitrupt/config.py,sha256=IE3I0FtoqqxIT0u3JH-juUDho7AWJNSCRlDmb9J4yk0,7403
+gitrupt/git.py,sha256=3hIeU4IrChADl0IDtdDTfhoBh2RntWx8YJKPshmOSGk,18651
+gitrupt/models.py,sha256=6gkkRraCSbviWNH_nBHFsXCSLeKpTTDbtjkYdk7bzv4,5230
+gitrupt/policy.py,sha256=dab45sjYDnC2A0Fr4vUWaRiX4UUS4nnyoFxOC2zwmrQ,1152
+gitrupt/reporting.py,sha256=KUKHoudsQZ22b_AtBbmVu8OzupeG3qRLiGp5kQFreiw,9904
+gitrupt/risk.py,sha256=4CTc5A_NL3X9rpCuDUVXHKy3Ru6j1ymx0ravFk0wQdU,6409
+gitrupt/scanner.py,sha256=uEdpmRcbIg83CivIiMiLTDNNSKRR6cikqGNsFXJGmMI,3725
+gitrupt/hooks/__init__.py,sha256=xhpnRhd9Su2EugqDGVaqe_NpBQJveQKqfgu4l10xky8,113
+gitrupt/hooks/install.py,sha256=jX4x9_uMc_NioOAqU5larpuOrDSIF_VmcYfX7-ieVE8,8232
+gitrupt/hooks/pre_commit.py,sha256=9cSRbh9lNl_hwaTpEK9YZ4LJYn9-bL-scbczLMlqG4A,2645
+gitrupt/hooks/pre_push.py,sha256=kMOCoqZ7CusVpB8GZzLRTYOoY4RJME7ZW8oskP81PAo,4855
+gitrupt/scanners/__init__.py,sha256=JDvyu64vSYdXb1ocq505WnegodFfQ6zK_OcitOe2FtA,428
+gitrupt/scanners/adapters.py,sha256=ND56dA-noX72HnFGM28OY3iaHkycxOUbTJOr5ivFmWo,6454
+gitrupt/scanners/base.py,sha256=KQrZd1nfuOiDWLeGN3SvwjKpNJD0BzJnaoxTSorecks,2869
+gitrupt/scanners/binaries.py,sha256=ml0appYly1VCot0_YbMKJ0XlNch5jdgjVCZZMcXZvVw,6557
+gitrupt/scanners/dependencies.py,sha256=hAFKdXfp_irDBf__eJNR9tdVvtHP97pjbg3HQ8O76EE,8509
+gitrupt/scanners/entropy.py,sha256=BRhutv3lnpzxmpvwz5ZzKk0ZYhYGllPTPUkolfUQKd8,3759
+gitrupt/scanners/forbidden_files.py,sha256=KWej6HBbPeBf3H5qCtYfeQVIStX0LaXcc-kXq_1MZdI,7284
+gitrupt/scanners/malware.py,sha256=EKAdB1nbY5L4QRtBHYxSNR0SwXWchJnoSrmrl9pcLF4,7918
+gitrupt/scanners/osv_client.py,sha256=w24c5zOr4N9RIRLYOBk2UPME7sa9vo5LwjkC7cgpfrg,7476
+gitrupt/scanners/registry.py,sha256=lzb4XsgReShfvnxs2kNqHs6913v5mtnK2jrCw9ioST4,2601
+gitrupt/scanners/secret_rules.py,sha256=9ycwEmicStsfAjlruV4Q642IEBlC98ccEfDqn_mPjWc,15441
+gitrupt/scanners/secrets.py,sha256=cqIxciBfuQB2g2BQ7U3I6XJU3liOv7LPTcojwpV_tSA,22140
+gitrupt/scanners/suspicious_code.py,sha256=m2zLYVU_T4etbyICbQjF6GWH11w-EGUWo9_IatX7904,6369
+gitrupt/scanners/yara_loader.py,sha256=FeaYNkDtxf8a7wbcSC19rQGirt6cZcQSOXTBnRCKghw,2018
+gitrupt/scanners/yara_rules_builtin.py,sha256=3cfuDm2lcPvo4h_2qM2PizFS-7WQ_y5Y3uV03Tsac9A,4026
+gitrupt/scanners/code_rules/__init__.py,sha256=3d1EzYPPQ5tGlBq1TMrtTukQDhNhbYg1xJduaZ_u6x4,1205
+gitrupt/scanners/code_rules/base.py,sha256=iCsfOPgXWNOTWFhIAPvy3900wIQRBdhld4yVgK8c4tE,764
+gitrupt/scanners/code_rules/go.py,sha256=T7ZUrGL9_mqUoXRfR1KQaGgxnwWtJTEj24qQ-Ks4O4Y,2181
+gitrupt/scanners/code_rules/javascript.py,sha256=aXEvLRXAzleaNrrNlm72s7l8_7KwKQvMzQ-jWhPG5Bo,3708
+gitrupt/scanners/code_rules/php.py,sha256=4WmGmxfRZSWK7g21lW5CO_4Lo0JBcfv6cFZlhhqrcLI,2138
+gitrupt/scanners/code_rules/powershell.py,sha256=E1NodB--N7ZTBzuNcJ_ouSHeHs2snmOLEC6jWva7lCE,2768
+gitrupt/scanners/code_rules/python.py,sha256=angf7a5Yz-VGEmWZJ7mAkGbYCjoDcdQNxXMmZk21LkE,5447
+gitrupt/scanners/code_rules/ruby.py,sha256=zhYsT-fnGVaCRQkpIQPMbVz1o01q2-kbLiZDVwqE3ig,2371
+gitrupt/scanners/code_rules/rust.py,sha256=pCI8EgN-td2H9Kuwlr_1oVHZromzGb_hT97No3OOZPE,1338
+gitrupt/scanners/code_rules/shell.py,sha256=G1Y9rHiYKTQ2KNZ23XuPNfC8RI-_UvzuRFMbQa7oWG4,3679
+gitrupt/scanners/ecosystems/__init__.py,sha256=NhsVkiE78Ay6UeKDpKqivPR4NVHjYN4bp0pOWqsNT84,833
+gitrupt/scanners/ecosystems/base.py,sha256=IkZyC4S490qm7sdI9WSswGuJw-B2_p8NV6rJQwxoQEU,1926
+gitrupt/scanners/ecosystems/node.py,sha256=f7nycMhMErIJTsv3pV3nkRPCzzZaYPPZYSiqKnhj-ms,4717
+gitrupt/scanners/ecosystems/python.py,sha256=s-jlTrhIK7gSHKrilEfJ3Ly2tGXw-MBQxa-X-amDmC0,5743
+gitrupt-0.1.0.dist-info/licenses/LICENSE,sha256=c8BbamcuUdinBGzwrPzUde4RiD0QggyPYmGDZEOqG4Y,1121
+gitrupt-0.1.0.dist-info/METADATA,sha256=KlcEywaCD7frUOpSOCvC7g_B0qhUBtY79JuGZcIVgxA,8774
+gitrupt-0.1.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+gitrupt-0.1.0.dist-info/entry_points.txt,sha256=M_4RZPlOyF5SYwLl-CvdpTywp9YDzMrXcxpTVmerviU,44
+gitrupt-0.1.0.dist-info/top_level.txt,sha256=rK-b2Uh1SvA9vQ9oO3K1T3Kiwfq7-j5fU3d2f14Fbjs,8
+gitrupt-0.1.0.dist-info/RECORD,,

gitrupt-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

gitrupt-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+gitrupt = gitrupt.cli:app

gitrupt-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,23 @@
+MIT License
+
+Gitrupt is released under the MIT License.
+
+Copyright (c) 2026 Gitrupt Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

gitrupt-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+gitrupt