ptrepo 0.0.2__tar.gz

ptrepo-0.0.2/CHANGELOG.md

@@ -0,0 +1,38 @@
+# Changelog
+
+## 0.0.2
+
+- Added default history summaries during `--download`: Git commit counts and SVN observed revision counts are reported even without detailed `--commits` output.
+- Added standalone `--commits` mode using temporary metadata recovery without keeping recovered files in the output directory.
+- Added `--commit-limit` to keep detailed commit/revision terminal output bounded while still reporting the total count.
+- Added native `--secrets` scanning for recovered Git commit patches and recovered Git/SVN files with built-in provider/generic rules, redacted output, stable fingerprints, and coverage reporting.
+- Added `--secrets-mode` (`auto`, `files`, `history`) and bounded recovered-file secret scanning with `--max-secret-file-size`; SVN history-aware scanning is reported as unsupported in this MVP slice.
+- Added JSON custom secret rules through `--secrets-rules`, JSON allowlists through `--allowlist`, and entropy control through `--entropy`/`--no-entropy`.
+- Added `--secrets-baseline` fingerprint suppression, rule-level custom allowlists, keyword-required custom rules, custom regex size limits, and binary-file detection based on control-byte ratio.
+- Hardened native secret scanning after review by checking NUL bytes across the full recovered file, tightening short-secret redaction, validating custom entropy thresholds, limiting allowlist regex length, and no longer suppressing single-brace custom-rule matches.
+- Hardened secret scanning output by redacting all detected secrets in shared evidence lines, disabling Git textconv during patch scans, and marking commit-limited scans as partial coverage.
+- Hardened runtime structure after review: package-aware imports, immutable SVN entries metadata, deque-based Git object traversal, explicit unsupported Git index version warnings, JWT entropy filtering, full-file NUL binary detection, and deduplicated HTTP request exception handling.
+- Expanded native secret coverage for AWS STS access keys, additional GitLab token prefixes, Slack webhooks, Stripe restricted/test/webhook keys, Google OAuth client secrets, database URL variants, URLs with embedded credentials, generic credentials with common special characters, template placeholder suppression, `.git/config` metadata scanning, and cross-source finding deduplication.
+- Expanded Git history secret scanning to inspect deleted diff lines, commit message subject/body text, conservative base64/hex decoded credential assignments, and Google service-account JSON while preserving redaction for JSON-escaped private key material.
+- Added `requests>=2.31,<3` as an explicit runtime dependency.
+- Added unit tests for commit/revision counting, bounded history output, temporary history recovery, native secret rules, redaction, allowlists, baselines, custom rules, and coverage reporting.
+
+## 0.0.1
+
+- Initial PTREPO discovery MVP.
+- Added Penterep package scaffold, CLI contract, packaging metadata, release workflow, and GPLv3 license.
+- Added URL normalization for HTTP/HTTPS targets while preserving path-scoped URLs.
+- Added repository candidate generation for `.git`, `.svn`, `_svn`, `.bzr`, `.hg`, and `cgi-bin/cvsweb.cgi`.
+- Added support for additional validated repository path candidates from `--wordlist`.
+- Added bounded GET-based HTTP discovery client with streaming byte limits, response samples, elapsed timing, and auth/rate-limit/WAF/network hints.
+- Added discovery classification for directory redirects, forbidden directories, accessible sentinels, blocked states, soft-404 responses, and network/TLS/timeout errors.
+- Added Git confirmation through valid `.git/HEAD` and secondary Git evidence from `.git/config`, `.git/index`, and `.git/objects/info/packs`.
+- Added SVN confirmation through `.svn/entries`, `.svn/wc.db`, and `_svn` variants.
+- Added directory listing detection from `Index of` page titles.
+- Added Penterep-style human output and JSON output with evidence and vulnerability entries for confirmed exposed repository metadata and accessible directory listings.
+- Added safe `--download` recovery workflow with quarantine output, stream-to-file limits, path traversal protection, partial recovery reporting, and recovered file summaries.
+- Added Git recovery for metadata seed files, branch/tag refs, reflogs, loose objects, pack files listed in `objects/info/packs`, locally reconstructed pack indexes, files recoverable from `.git/index`, and files exportable from recovered Git commit trees.
+- Added defensive low-level Git command isolation for recovered repository validation, reachable commit listing, and dangling commit fallback.
+- Added SVN recovery for `.svn` and `_svn` metadata, recursive old `entries`/`text-base` working copies, new `wc.db`/`pristine` working copies, observed revision reporting, and recovered file contents.
+- Added explicit planned-option handling for future cache and redirect functionality.
+- Added unit tests for URL handling, candidate generation, HTTP client behavior, discovery states, soft-404 detection, CLI contract, human output, JSON vulnerability reporting, Git command isolation, and Git/SVN recovery.