leftblock 0.4.2__tar.gz → 0.4.3__tar.gz

{leftblock-0.4.2 → leftblock-0.4.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: leftblock
-Version: 0.4.2
+Version: 0.4.3
 Summary: LeftBlock: a pluggable inspection gate for Git commits
 License: MIT License
         
@@ -124,7 +124,7 @@ configures the integration; it does not install scanner binaries.
 In the intended Python environment:
 
 ```bash
-python -m pip install leftblock==0.4.2
+python -m pip install leftblock==0.4.3
 python -m leftblock.cli --help
 ```
 
@@ -397,7 +397,7 @@ PEM private keys, and other standard secret formats.
 
 | Rule | What it catches |
 |---|---|
-| `leftblock-personal-email` | Personal email addresses (infrastructure identities like `git@github.com`, `@users.noreply.github.com`, no-reply addresses and `@example.*` placeholders are allowlisted) |
+| `leftblock-personal-email` | Personal email addresses (infrastructure identities like `git@github.com`, `@users.noreply.github.com`, no-reply addresses, `@example.*` placeholders, `@example.edu` and any address on a `.test`, `.example`, `.invalid` or `.localhost` domain are allowlisted) |
 | `leftblock-home-path-posix` | Home-folder paths `/Users/<name>`, `/home/<name>` |
 | `leftblock-home-path-windows` | `C:\Users\<name>` and `\Users\<name>` |
 | `leftblock-session-uuid` | Potential session UUIDs (not flagged in Kanbus board data; example values and the `.kanbus.yml` `project_id` line are also allowed) |
@@ -409,7 +409,7 @@ PEM private keys, and other standard secret formats.
 | `leftblock-bip39-mnemonic` | BIP-39 seed phrases (12–24 words) in seed/mnemonic/recovery context |
 
 A blocked check prints a one-line hint after each rule's findings (once per
-rule): use a role or placeholder address for personal emails; a relative path,
+rule): use a role address or a reserved placeholder for personal emails; a relative path,
 `$HOME` or `~` for home paths; drop or describe session and actor identifiers;
 and for API, private and wallet keys, remove the value **and rotate the key**,
 since it may already be exposed. Findings in Kanbus board data

{leftblock-0.4.2 → leftblock-0.4.3}/README.md

@@ -91,7 +91,7 @@ configures the integration; it does not install scanner binaries.
 In the intended Python environment:
 
 ```bash
-python -m pip install leftblock==0.4.2
+python -m pip install leftblock==0.4.3
 python -m leftblock.cli --help
 ```
 
@@ -364,7 +364,7 @@ PEM private keys, and other standard secret formats.
 
 | Rule | What it catches |
 |---|---|
-| `leftblock-personal-email` | Personal email addresses (infrastructure identities like `git@github.com`, `@users.noreply.github.com`, no-reply addresses and `@example.*` placeholders are allowlisted) |
+| `leftblock-personal-email` | Personal email addresses (infrastructure identities like `git@github.com`, `@users.noreply.github.com`, no-reply addresses, `@example.*` placeholders, `@example.edu` and any address on a `.test`, `.example`, `.invalid` or `.localhost` domain are allowlisted) |
 | `leftblock-home-path-posix` | Home-folder paths `/Users/<name>`, `/home/<name>` |
 | `leftblock-home-path-windows` | `C:\Users\<name>` and `\Users\<name>` |
 | `leftblock-session-uuid` | Potential session UUIDs (not flagged in Kanbus board data; example values and the `.kanbus.yml` `project_id` line are also allowed) |
@@ -376,7 +376,7 @@ PEM private keys, and other standard secret formats.
 | `leftblock-bip39-mnemonic` | BIP-39 seed phrases (12–24 words) in seed/mnemonic/recovery context |
 
 A blocked check prints a one-line hint after each rule's findings (once per
-rule): use a role or placeholder address for personal emails; a relative path,
+rule): use a role address or a reserved placeholder for personal emails; a relative path,
 `$HOME` or `~` for home paths; drop or describe session and actor identifiers;
 and for API, private and wallet keys, remove the value **and rotate the key**,
 since it may already be exposed. Findings in Kanbus board data

{leftblock-0.4.2 → leftblock-0.4.3}/leftblock/cli.py

@@ -335,7 +335,7 @@ _REMOVE_AND_ROTATE = "Remove it AND rotate the key: it may already be exposed."
 _HOME_PATH = "Use a relative path, $HOME or ~ instead."
 _DESCRIBE_ID = "Drop the identifier or describe it instead."
 RULE_HINTS = {
-    "leftblock-personal-email": "Use a role or placeholder address, or describe it instead.",
+    "leftblock-personal-email": "Use a role address or a reserved placeholder (example.com/.org/.net, or any .test, .example or .invalid domain), or describe it instead.",
     "leftblock-home-path-posix": _HOME_PATH,
     "leftblock-home-path-windows": _HOME_PATH,
     "leftblock-session-uuid": _DESCRIBE_ID,

{leftblock-0.4.2 → leftblock-0.4.3}/leftblock/data/gitleaks.toml

@@ -67,6 +67,12 @@ regexes = [
   '''(^|[^a-zA-Z0-9._%+\-'])no-?reply@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}''',
   '''git@github\.com''',
   '''@(example|github)\.(com|org|net|io|ai)''',
+  # Domains reserved for documentation and testing: the TLDs .test, .example,
+  # .invalid and .localhost (RFC 2606 section 2, RFC 6761 section 6) at any
+  # subdomain depth, and example.edu (RFC 2606 section 3). Anchored on the end
+  # of the address so look-alikes such as test.com or example.test.co still flag.
+  '''@(?:[a-zA-Z0-9\-]+\.)*(?:test|example|invalid|localhost)$''',
+  '''@example\.edu$''',
 ]
 
 [[rules]]

{leftblock-0.4.2 → leftblock-0.4.3}/leftblock.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: leftblock
-Version: 0.4.2
+Version: 0.4.3
 Summary: LeftBlock: a pluggable inspection gate for Git commits
 License: MIT License
         
@@ -124,7 +124,7 @@ configures the integration; it does not install scanner binaries.
 In the intended Python environment:
 
 ```bash
-python -m pip install leftblock==0.4.2
+python -m pip install leftblock==0.4.3
 python -m leftblock.cli --help
 ```
 
@@ -397,7 +397,7 @@ PEM private keys, and other standard secret formats.
 
 | Rule | What it catches |
 |---|---|
-| `leftblock-personal-email` | Personal email addresses (infrastructure identities like `git@github.com`, `@users.noreply.github.com`, no-reply addresses and `@example.*` placeholders are allowlisted) |
+| `leftblock-personal-email` | Personal email addresses (infrastructure identities like `git@github.com`, `@users.noreply.github.com`, no-reply addresses, `@example.*` placeholders, `@example.edu` and any address on a `.test`, `.example`, `.invalid` or `.localhost` domain are allowlisted) |
 | `leftblock-home-path-posix` | Home-folder paths `/Users/<name>`, `/home/<name>` |
 | `leftblock-home-path-windows` | `C:\Users\<name>` and `\Users\<name>` |
 | `leftblock-session-uuid` | Potential session UUIDs (not flagged in Kanbus board data; example values and the `.kanbus.yml` `project_id` line are also allowed) |
@@ -409,7 +409,7 @@ PEM private keys, and other standard secret formats.
 | `leftblock-bip39-mnemonic` | BIP-39 seed phrases (12–24 words) in seed/mnemonic/recovery context |
 
 A blocked check prints a one-line hint after each rule's findings (once per
-rule): use a role or placeholder address for personal emails; a relative path,
+rule): use a role address or a reserved placeholder for personal emails; a relative path,
 `$HOME` or `~` for home paths; drop or describe session and actor identifiers;
 and for API, private and wallet keys, remove the value **and rotate the key**,
 since it may already be exposed. Findings in Kanbus board data

{leftblock-0.4.2 → leftblock-0.4.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "leftblock"
-version = "0.4.2"
+version = "0.4.3"
 description = "LeftBlock: a pluggable inspection gate for Git commits"
 readme = "README.md"
 license = {file = "LICENSE"}

{leftblock-0.4.2 → leftblock-0.4.3}/tests/test_bypasses.py

@@ -10,7 +10,7 @@ from leftblock import bypass
 from test_commit_gate import GITLEAKS, RepositoryFixture
 
 MARKER = "gitleaks" + ":allow"
-EMAIL = "info" + "@" + "public-role.test"
+EMAIL = "info" + "@" + "public-role" + ".co"
 REASON = "Reviewed: documentation example, not a real finding"
 
 

{leftblock-0.4.2 → leftblock-0.4.3}/tests/test_kanbus_advice.py

@@ -24,7 +24,7 @@ class RuleHintTests(unittest.TestCase):
         for rule in ("openai-key", "anthropic-key", "eth-private-key", "wif-key", "bip39-mnemonic"):
             self.assertIn("rotate", cli.RULE_HINTS["leftblock-" + rule])
         self.assertIn("relative path", cli.RULE_HINTS["leftblock-home-path-posix"])
-        self.assertIn("role or placeholder", cli.RULE_HINTS["leftblock-personal-email"])
+        self.assertIn("reserved placeholder", cli.RULE_HINTS["leftblock-personal-email"])
 
 
 @unittest.skipUnless(GITLEAKS, "Gitleaks must be installed for actual scanner tests")

{leftblock-0.4.2 → leftblock-0.4.3}/tests/test_recorded_overrides.py

@@ -12,8 +12,8 @@ from test_commit_gate import GITLEAKS, RepositoryFixture
 
 # Flagged by the shipped personal-email rule; the rule allowlists only
 # example.* and GitHub identities.
-EMAIL = "info" + "@" + "public-role.test"
-OTHER_EMAIL = "help" + "@" + "public-role.test"
+EMAIL = "info" + "@" + "public-role" + ".co"
+OTHER_EMAIL = "help" + "@" + "public-role" + ".co"
 PAGE = "page.tsx"
 REASON = "Public role address for the site"
 
@@ -100,7 +100,7 @@ class RecordedOverrideTests(RepositoryFixture):
         detail = [l for l in proc.stderr.splitlines() if l.startswith("      ")]
         self.assertEqual(detail, [
             f"      {PAGE}:2: leftblock-personal-email [id {ident}] (Personal email address)",
-            "      Hint: Use a role or placeholder address, or describe it instead.",
+            "      Hint: Use a role address or a reserved placeholder (example.com/.org/.net, or any .test, .example or .invalid domain), or describe it instead.",
         ])
         self.assertIn(f"leftblock-personal-email in {PAGE}:2 [id {ident}]", proc.stderr.splitlines()[-1])
         self.assertNotIn(EMAIL, proc.stdout + proc.stderr)

{leftblock-0.4.2 → leftblock-0.4.3}/tests/test_sensitive_rules.py

@@ -109,7 +109,7 @@ class SensitiveFixtureTests(unittest.TestCase):
         # Synthetic personal values are assembled at test time so this
         # test source is itself clean under the shipped ruleset.
         user = "jd" + "oe"
-        email = "jane." + "doe@" + "example-corp." + "t" + "est"
+        email = "jane." + "doe@" + "example-corp" + ".co"
         findings = scan_and_rule_ids({
             "issues/one.json": (
                 '{"assignee_email": "%s", "session_id": "%s",'
@@ -225,14 +225,31 @@ class NegativeTests(unittest.TestCase):
     def test_no_reply_addresses_pass_but_lookalikes_still_flag(self):
         at = "@"
         self.assertEqual(scan_and_rule_ids({"CHANGELOG.md": "\n".join([
-            "Co-Authored-By: Bot <noreply" + at + "vendor.test>",
-            "From: no-reply" + at + "vendor.test",
+            "Co-Authored-By: Bot <noreply" + at + "vendor" + ".co" + ">",
+            "From: no-reply" + at + "vendor" + ".co",
         ]) + "\n"}), [])
-        self.assertEqual(scan_and_rule_ids({"notes.md": "mail jo" + at + "vendor.test\n"}),
+        self.assertEqual(scan_and_rule_ids({"notes.md": "mail jo" + at + "vendor" + ".co\n"}),
                          ["leftblock-personal-email"])
-        self.assertEqual(scan_and_rule_ids({"notes.md": "mail notnoreply" + at + "vendor.test\n"}),
+        self.assertEqual(scan_and_rule_ids({"notes.md": "mail notnoreply" + at + "vendor" + ".co\n"}),
                          ["leftblock-personal-email"])
 
+    def test_reserved_placeholder_domains_pass_but_lookalikes_still_flag(self):
+        at = "@"
+        passing = [
+            "person" + at + "example.invalid",
+            "a" + at + "mail.acme.test",
+            "b" + at + "deep.sub.host.example",
+            "c" + at + "app.localhost",
+            "d" + at + "example.edu",
+            "e" + at + "x.test",
+        ]
+        self.assertEqual(scan_and_rule_ids({"notes.md": "\n".join("mail " + a for a in passing) + "\n"}), [])
+        for domain in ["test" + ".com", "invalid" + ".org", "example.test" + ".co", "mytest" + ".dev",
+                       "example" + ".edu.co", "notexample" + ".edu"]:
+            with self.subTest(domain=domain):
+                self.assertEqual(scan_and_rule_ids({"notes.md": "mail jo" + at + domain + "\n"}),
+                                 ["leftblock-personal-email"])
+
     def test_public_wallet_addresses_and_hashes_not_flagged(self):
         rng = _rng()
         findings = scan_and_rule_ids({
@@ -466,7 +483,7 @@ class KanbusBoardAllowlistTests(unittest.TestCase):
                                   scan_and_rule_ids({path: content}))
 
     def test_personal_email_home_path_and_key_still_flagged_in_board_files(self):
-        email = "jane." + "doe@" + "example-corp." + "t" + "est"
+        email = "jane." + "doe@" + "example-corp" + ".co"
         user = "jd" + "oe"
         cases = {
             "leftblock-personal-email": json.dumps(