gitrupt 0.1.0__tar.gz → 0.2.0__tar.gz

gitrupt-0.2.0/.gitrupt.yml

@@ -0,0 +1,74 @@
+version: 1
+
+# Gitrupt self-protection configuration
+# This repository is protected by Gitrupt
+
+mode: strict
+
+scan:
+  secrets: true
+  threats: true
+  suspicious_code: false
+  dependencies: false
+
+rules:
+  forbidden_paths:
+    - ".env"
+    - ".env.*"
+    - "*.pem"
+    - "*.key"
+    - "*.p12"
+    - "*.pfx"
+    - "credentials.json"
+    - "service-account.json"
+    - "*.secret"
+  forbidden_extensions:
+    - ".scr"
+    - ".exe"
+  max_file_size_mb: 50.0
+
+allow:
+  paths:
+    - ".env.example"
+    - "tests/fixtures/**"
+    - "docs/**"
+
+suppressions:
+  rules: []
+  files: []
+  paths: []
+
+entropy:
+  enabled: true
+  threshold: 4.5
+  min_length: 20
+
+suspicious_code:
+  min_confidence: 0.6
+  languages:
+    - python
+    - javascript
+    - shell
+    - powershell
+    - php
+    - ruby
+    - go
+
+malware:
+  use_yara: true
+  max_file_size_mb: 50.0
+  custom_yara_dirs: []
+
+dependencies:
+  ecosystems:
+    - python
+    - node
+  offline: false
+  timeout_seconds: 10.0
+  cache_ttl_hours: 24
+
+policy:
+  low: allow
+  medium: warn
+  high: block
+  critical: block

gitrupt-0.2.0/CHANGELOG.md

@@ -0,0 +1,73 @@
+# Changelog
+
+All notable changes to Gitrupt will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+---
+
+## [Unreleased]
+
+---
+
+## [0.2.0] - 2026-09-16
+
+### Added
+
+- **`gitrupt ci` command** — scans a diff range (`--base <ref> --head <ref>`) instead of the index. Designed for GitHub Actions, GitLab CI, and any runner that can call a Python CLI. Closes the `git commit --no-verify` and `git push --no-verify` bypass gap.
+- **`--base-sha` and `--head-sha` flags** on `gitrupt ci` — accepts a resolved SHA directly, useful when the CI runner already knows the exact commit.
+- **`--format json` and `--format sarif`** on `gitrupt ci` — SARIF 2.1.0 output uploads to GitHub's Security tab; JSON output feeds custom dashboards.
+- **`--output <file>`** on `gitrupt ci` — writes findings to a file for CI artifacts.
+- **GitHub Actions workflow template** — `docs/templates/github-actions/gitrupt.yml`. Copy to `.github/workflows/gitrupt.yml`.
+- **GitLab CI template** — `docs/templates/gitlab-ci/gitrupt.yml`. Copy to `.gitlab-ci.yml`.
+- **Generic Dockerfile runner** — `docs/templates/docker/Dockerfile.gitrupt` for any CI that supports containers.
+- **`docs/ci-setup.md`** — full setup guide including branch protection, CODEOWNERS, and supply-chain hardening notes.
+- **Unit tests for `gitrupt ci`** — covers clean diff, blocked diff, `.env` blocking, new-branch (empty-tree) scans.
+
+### Fixed
+
+- **Pre-push hook** now passes `text_provider` and `byte_provider` to `build_scanners()`, so pre-push scans read file content from the outgoing commit instead of the index. Previously the hook failed open due to a signature mismatch.
+- **Binary detection** only runs on files that look like real binaries. `*.py` and `*.md` files containing strings like `UPX0` in rule definitions or docs no longer trip the packer-signature check.
+- **Entropy allowlist** now covers identifier-shaped strings (`SCREAMING_SNAKE_CASE`, `identifier=identifier` assignments, trailing punctuation) to reduce false positives on source code.
+- **Twilio API key rule** no longer requires a context word — the `SK` + 32 hex shape is specific enough on its own.
+
+### Security
+
+- CI enforcement is **server-side** and cannot be bypassed by local flags, hook deletion, or `gitrupt uninstall`.
+- SARIF findings persist in the GitHub Security tab as an audit trail.
+- Templates use `fetch-depth: 0` so the full base..head range is available.
+- `docs/ci-setup.md` documents SHA-pinning actions and CODEOWNERS to prevent guardrail tampering.
+
+---
+
+## [0.1.0] - 2026-09-09
+
+### Added
+
+- Initial MVP release
+- Python package with `pyproject.toml`
+- CLI with `init`, `scan`, `status`, `config`, `uninstall` commands
+- Git repository detection and staged-file discovery
+- Forbidden file scanner with default rules (`.env`, `*.pem`, `*.key`, etc.)
+- Secret scanner with native patterns:
+  - AWS access keys
+  - GitHub personal access tokens and fine-grained tokens
+  - Generic API keys (high-entropy)
+  - Private keys (RSA, EC, OpenSSH, PGP)
+  - Database connection URLs with embedded passwords
+  - JWT tokens
+  - Generic bearer tokens
+- Risk engine with severity scoring (LOW/MEDIUM/HIGH/CRITICAL)
+- Policy engine reading `.gitrupt.yml` configuration
+- Terminal reporter with colored output and redacted secrets
+- Pre-commit hook installer (preserves existing hooks)
+- Unit tests and integration tests
+- Documentation (README, SECURITY, CONTRIBUTING, architecture, roadmap, plan)
+
+### Security
+
+- Secrets are never logged in full — always redacted
+- No repository content leaves the machine by default
+- All Git operations use subprocess argument arrays (no shell interpolation)
+- Existing Git hooks are preserved and chained, never overwritten

gitrupt-0.2.0/CONTRIBUTING.md

@@ -0,0 +1,76 @@
+# Contributing to Gitrupt
+
+Thank you for your interest in contributing to Gitrupt!
+
+## Development Setup
+
+```bash
+git clone https://github.com/gitrupt/gitrupt
+cd gitrupt
+
+python -m venv .venv
+# Windows
+.venv\Scripts\Activate.ps1
+# Linux/macOS
+source .venv/bin/activate
+
+pip install -e ".[dev]"
+```
+
+## Running Tests
+
+```bash
+pytest
+pytest tests/unit/
+pytest tests/integration/
+pytest --cov=gitrupt tests/
+```
+
+## Code Style
+
+We use `ruff` for linting and formatting:
+
+```bash
+ruff check src/ tests/
+ruff format src/ tests/
+```
+
+## Type Checking
+
+```bash
+mypy src/gitrupt/
+```
+
+## Pull Request Guidelines
+
+1. Fork the repository
+2. Create a feature branch: `git checkout -b feat/my-feature`
+3. Write tests for your changes
+4. Ensure all tests pass
+5. Ensure `ruff` and `mypy` pass
+6. Submit a pull request with a clear description
+
+## Commit Convention
+
+Use conventional commits:
+
+```
+feat: add new scanner
+fix: correct secret redaction
+docs: update README
+test: add integration tests
+chore: update dependencies
+```
+
+## Security
+
+If you find a security vulnerability, please see [SECURITY.md](SECURITY.md) before opening a public issue.
+
+## Areas for Contribution
+
+- Additional secret patterns
+- New scanner integrations (Gitleaks, Semgrep, ClamAV)
+- Performance improvements
+- Platform-specific testing (Windows, Linux, macOS)
+- Documentation improvements
+- VS Code extension (Phase 9)

gitrupt-0.2.0/MANIFEST.in

@@ -0,0 +1,13 @@
+include README.md
+include CHANGELOG.md
+include LICENSE
+include SECURITY.md
+include CONTRIBUTING.md
+include .gitrupt.yml
+
+recursive-include docs *.md *.yml *.yaml *.txt Dockerfile.*
+
+recursive-exclude tests *
+recursive-exclude * __pycache__
+recursive-exclude * *.py[co]
+recursive-exclude * .DS_Store

{gitrupt-0.1.0/src/gitrupt.egg-info → gitrupt-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: gitrupt
-Version: 0.1.0
+Version: 0.2.0
 Summary: A local Git security firewall for secrets, suspicious code, malware heuristics, and dependency vulnerability checks
 License: MIT License
         
@@ -26,11 +26,12 @@ License: MIT License
         OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
         SOFTWARE.
         
-Project-URL: Homepage, https://github.com/gitrupt/gitrupt
-Project-URL: Repository, https://github.com/gitrupt/gitrupt
-Project-URL: Issues, https://github.com/gitrupt/gitrupt/issues
-Project-URL: Documentation, https://github.com/gitrupt/gitrupt/blob/main/docs/architecture.md
-Keywords: git,security,secrets,pre-commit,pre-push,malware,suspicious-code,dependency-scanning,firewall
+Project-URL: Homepage, https://github.com/MuhammadFakharKhan/gitrupt
+Project-URL: Repository, https://github.com/MuhammadFakharKhan/gitrupt
+Project-URL: Issues, https://github.com/MuhammadFakharKhan/gitrupt/issues
+Project-URL: Documentation, https://github.com/MuhammadFakharKhan/gitrupt/blob/main/docs/architecture.md
+Project-URL: Changelog, https://github.com/MuhammadFakharKhan/gitrupt/blob/main/CHANGELOG.md
+Keywords: git,security,secrets,pre-commit,pre-push,malware,suspicious-code,dependency-scanning,firewall,ci-cd,sarif,github-actions
 Classifier: Development Status :: 3 - Alpha
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
@@ -294,6 +295,15 @@ If a hook already exists, Gitrupt preserves it and wraps it so your original beh
 
 ---
 
+## CI/CD Enforcement
+
+Local hooks are advisory — `git commit --no-verify` skips them. To enforce Gitrupt on every PR and every push, run it in CI.
+
+```bash
+gitrupt ci --base origin/main --head HEAD --format sarif --output gitrupt.sarif
+
+
+
 ## Privacy
 
 By default, Gitrupt runs locally. Repository content stays on the machine unless you explicitly enable networked checks.

{gitrupt-0.1.0 → gitrupt-0.2.0}/README.md

@@ -231,6 +231,15 @@ If a hook already exists, Gitrupt preserves it and wraps it so your original beh
 
 ---
 
+## CI/CD Enforcement
+
+Local hooks are advisory — `git commit --no-verify` skips them. To enforce Gitrupt on every PR and every push, run it in CI.
+
+```bash
+gitrupt ci --base origin/main --head HEAD --format sarif --output gitrupt.sarif
+
+
+
 ## Privacy
 
 By default, Gitrupt runs locally. Repository content stays on the machine unless you explicitly enable networked checks.

gitrupt-0.2.0/SECURITY.md

@@ -0,0 +1,56 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported |
+|---------|-----------|
+| 0.1.x   | ✅ Current |
+
+## Reporting a Vulnerability
+
+**Please do not open a public GitHub issue for security vulnerabilities.**
+
+To report a security issue:
+
+1. Email the maintainers directly (see project contacts)
+2. Or use GitHub's private vulnerability reporting if available
+
+Include:
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- Any suggested fix (optional)
+
+You will receive a response within 72 hours.
+
+## Security Design Principles
+
+Gitrupt follows these principles:
+
+1. **Fail closed** — critical findings block commits by default
+2. **No secret exposure** — detected secrets are always redacted in reports
+3. **Local by default** — repository content stays on the machine unless explicit networked checks are enabled
+4. **Opt-in network** — dependency OSV and external integrations are opt-in or intentionally gated
+5. **No execution** — Gitrupt never executes files it is analyzing
+6. **Deterministic policy** — security decisions are rule-based, not probabilistic
+7. **Hook safety** — existing Git hooks are preserved and never silently overwritten
+
+## Scope
+
+Gitrupt is a **local security firewall** for Git repositories. It protects against:
+
+- Accidental secret commits
+- Prohibited file patterns and unsafe file extensions
+- High-entropy secret material and credential-like values
+- Suspicious code in added lines across common languages
+- Malware-style binary indicators and optional YARA matches
+- Known vulnerable dependencies via OSV lookups when enabled
+- Push-time leaks when the pre-push hook is installed
+
+Gitrupt does **not** claim to:
+
+- Detect all malware or all malicious code patterns
+- Guarantee security if `git commit --no-verify` or `git push --no-verify` is used
+- Prevent determined attackers with repository access
+
+For organizational security, combine Gitrupt with CI/CD enforcement and developer policy controls.