reconkit 0.1.0__tar.gz → 0.2.1__tar.gz

reconkit-0.2.1/.github/workflows/publish.yml

@@ -0,0 +1,50 @@
+name: Publish to PyPI
+
+on:
+  push:
+    tags:
+      - "v*"
+
+permissions:
+  contents: read
+
+jobs:
+  publish:
+    name: Build and publish
+    runs-on: ubuntu-latest
+    environment: pypi
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install release tools
+        run: python -m pip install --upgrade build twine
+
+      - name: Confirm the tag matches the package version
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          python - <<'PY'
+          import os
+          import tomllib
+          from pathlib import Path
+
+          version = tomllib.loads(Path("pyproject.toml").read_text())["project"]["version"]
+          expected = f"v{version}"
+          if os.environ["RELEASE_TAG"] != expected:
+              raise SystemExit(f"Tag {os.environ['RELEASE_TAG']} does not match {expected}.")
+          PY
+
+      - name: Build distributions
+        run: python -m build
+
+      - name: Validate distributions
+        run: twine check dist/*
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          password: ${{ secrets.PYPI_API_TOKEN }}

{reconkit-0.1.0 → reconkit-0.2.1}/.gitignore

@@ -1,30 +1,30 @@
-# Byte-compiled / optimized / DLL files
-__pycache__/
-*.py[cod]
-*$py.class
-
-# C extensions
-*.so
-
-# Distribution / packaging
-build/
-dist/
-*.egg-info/
-.eggs/
-
-# Virtual environments
-.venv/
-venv/
-ENV/
-
-# Test / tooling caches
-.pytest_cache/
-.mypy_cache/
-.ruff_cache/
-.coverage
-htmlcov/
-
-# OS / editor
-.DS_Store
-Thumbs.db
-.vscode/
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+build/
+dist/
+*.egg-info/
+.eggs/
+
+# Virtual environments
+.venv/
+venv/
+ENV/
+
+# Test / tooling caches
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+
+# OS / editor
+.DS_Store
+Thumbs.db
+.vscode/

{reconkit-0.1.0 → reconkit-0.2.1}/CHANGELOG.md

@@ -1,21 +1,37 @@
-# Changelog
-
-All notable changes to this project will be documented in this file.
-
-Format: loosely based on *Keep a Changelog*. Versioning: SemVer where practical.
-
-## [0.1.0] - 2026-02-09
-
-### Added
-- Noir Stack public primitives: `EvidenceArtifact`, `EvidenceBundle`, `ProvenanceRecord`, `VerificationResult`.
-- Domain-specific errors that describe trust boundaries and provenance constraints.
-- Audit-grade CLI vocabulary: `evidence`, `boundary`, `verify`.
-- Structured JSON outputs include: `decision_basis`, `verification_status`, `provenance_confidence`.
-- `robots.txt` compliance (default) and rate limiting for web acquisition.
-
-### Changed
-- Public-facing surface and CLI terminology refactored to evidence/verification framing.
-
-### Notes
-- This release is intentionally conservative.
-- The system is capable of refusing to speculate. This is a feature.
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+Format: loosely based on *Keep a Changelog*. Versioning: SemVer where practical.
+
+## [0.2.1] - 2026-11-04
+
+### Changed
+- Replaced the MIT license with Noir Stack LLC's Proprietary Software License — Free Use, No Modification.
+
+## [0.2.0] - 2026-11-04
+
+### Added
+- WARC 1.1 and WACZ 1.2 exports with an index, page list, SHA-256 fixity, and data-package digest.
+- Hash-linked chain-of-custody ledgers and Ed25519-signed manifests.
+- DFIR-IRIS v2 evidence-registration adapter.
+- Redirect-chain recording and conservative public-destination checks for web capture.
+
+### Changed
+- Robots rules are checked at every redirect destination and fail closed by default.
+
+## [0.1.0] - 2026-02-09
+
+### Added
+- Noir Stack public primitives: `EvidenceArtifact`, `EvidenceBundle`, `ProvenanceRecord`, `VerificationResult`.
+- Domain-specific errors that describe trust boundaries and provenance constraints.
+- Audit-grade CLI vocabulary: `evidence`, `boundary`, `verify`.
+- Structured JSON outputs include: `decision_basis`, `verification_status`, `provenance_confidence`.
+- `robots.txt` compliance (default) and rate limiting for web acquisition.
+
+### Changed
+- Public-facing surface and CLI terminology refactored to evidence/verification framing.
+
+### Notes
+- This release is intentionally conservative.
+- The system is capable of refusing to speculate. This is a feature.

reconkit-0.2.1/LICENSE

@@ -0,0 +1,38 @@
+Proprietary Software License — Free Use, No Modification
+
+Copyright (c) 2026 Noir Stack LLC. All rights reserved.
+
+## 1. Grant of License
+
+The copyright holder grants users a non-exclusive, worldwide, royalty-free license to download, install, and use this software for personal, educational, research, and commercial purposes, subject to the conditions below.
+
+## 2. Restrictions
+
+Users may not, without prior written permission from the copyright holder:
+
+- Modify, adapt, translate, or create derivative works based on the software.
+- Redistribute, publish, sell, sublicense, or repackage the software.
+- Remove or alter copyright, attribution, or license notices.
+- Claim ownership or authorship of the software.
+
+## 3. Ownership
+
+All rights, title, and interest in the software, including its source code and associated intellectual property, remain with the copyright holder.
+
+No ownership rights are transferred under this license.
+
+## 4. No Warranty
+
+The software is provided "AS IS", without warranty of any kind, express or implied, to the extent permitted by applicable law.
+
+## 5. Limitation of Liability
+
+To the extent permitted by applicable law, the copyright holder shall not be liable for damages arising from the use or inability to use the software.
+
+## 6. Termination
+
+Permission to use the software terminates upon a material violation of this license, subject to applicable law.
+
+## 7. Additional Permissions
+
+Any permissions not expressly granted must be obtained in writing from the copyright holder.

reconkit-0.2.1/PKG-INFO

@@ -0,0 +1,136 @@
+Metadata-Version: 2.5
+Name: reconkit
+Version: 0.2.1
+Summary: Evidence collection, provenance, and preservation utilities for authorized investigations.
+Author: reconkit
+License: Proprietary Software License — Free Use, No Modification
+License-File: LICENSE
+Keywords: forensics,osint,scraping,triage
+Requires-Python: >=3.10
+Requires-Dist: beautifulsoup4>=4.12
+Requires-Dist: cryptography>=42
+Requires-Dist: dnspython>=2.6
+Requires-Dist: exifread>=3.0
+Requires-Dist: filetype>=1.2
+Requires-Dist: httpx>=0.27
+Requires-Dist: ipwhois>=1.2
+Requires-Dist: lxml>=5.1
+Requires-Dist: python-whois>=0.9
+Requires-Dist: rich>=13.7
+Requires-Dist: typer>=0.12
+Provides-Extra: dev
+Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff>=0.4; extra == 'dev'
+Requires-Dist: twine>=5.1; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# ReconKit
+
+ReconKit is a small Python toolkit for preserving authorized web observations and local file findings as reviewable evidence records. It is a collection layer, not a scanner, case-management system, or source of truth.
+
+It complements reconnaissance tools such as SpiderFoot and BBOT, web archiving tools such as Webrecorder, and case-management platforms such as DFIR-IRIS. ReconKit focuses on the handoff between collection and review: what was collected, where it came from, what redirects occurred, what limits apply, and whether exported files have changed.
+
+## What it provides
+
+- Public-web capture with bounded size, rate limiting, redirect-chain recording, robots checks at every destination, and blocking of private, loopback, and reserved destinations by default.
+- Standards-oriented WARC 1.1 and WACZ 1.2 exports. WACZ files contain a WARC, CDXJ index, page list, file-fixity manifest, and data-package digest.
+- Append-only, hash-linked chain-of-custody ledgers.
+- Ed25519-signed manifests that can be verified offline.
+- A DFIR-IRIS v2 adapter that registers an exported evidence file with an existing case.
+- Local file hashes, magic-byte identification, EXIF extraction, printable-string extraction, and small DNS/WHOIS/RDAP observations.
+
+## What it does not claim
+
+ReconKit records a transport observation. It does not prove the identity of a publisher, the truth of content, legal chain of custody, or attribution. A SHA-256 digest proves that bytes have not changed relative to the recorded digest; it does not prove where they originated.
+
+Web collection is only for systems and data you own or are authorized to assess. The default public-destination restriction helps prevent accidental collection from local or private infrastructure; it is not a substitute for operational authorization.
+
+## Install
+
+```bash
+python -m pip install reconkit
+```
+
+For development:
+
+```bash
+python -m pip install -e ".[dev]"
+```
+
+## Capture and preserve a page
+
+```bash
+reconkit evidence archive-warc "https://example.com" --output evidence/example.warc
+reconkit evidence archive-wacz "https://example.com" --output evidence/example.wacz --title "Example capture"
+```
+
+The WACZ export follows the [WACZ 1.2 layout](https://specs.webrecorder.net/wacz/1.2.0/), so it can be validated and replayed with compatible web-archive tooling.
+Robots rules are respected by default; use `--no-obey-robots` only when you have clear authorization for the capture.
+
+## Sign a manifest and record custody
+
+```python
+from pathlib import Path
+from reconkit.evidence import CustodyLedger, ManifestSigner, verify_manifest, write_manifest
+
+evidence = Path("evidence/example.wacz")
+ledger = CustodyLedger("evidence/custody.jsonl")
+ledger.append(action="acquired", actor="analyst@example.org", artifact_path=evidence)
+ledger.append(action="exported", actor="analyst@example.org", artifact_path=evidence)
+assert ledger.verify()
+
+signer = ManifestSigner.generate()
+Path("keys/evidence-signing-key.pem").write_bytes(signer.private_pem())
+manifest = write_manifest([evidence], "evidence/manifest.json", signer, custody_ledger=ledger.path)
+assert verify_manifest(manifest)
+```
+
+Keep the private key outside the evidence directory and protect it with your organization’s key-management practices. The manifest embeds the corresponding public key so a reviewer can verify it without the private key.
+
+## Register exported evidence in DFIR-IRIS
+
+```python
+from reconkit.evidence import DFIRIRISAdapter
+
+iris = DFIRIRISAdapter("https://iris.example.org", api_key="your-api-key")
+iris.register(
+    case_identifier=42,
+    evidence_path="evidence/example.wacz",
+    description="Public web capture; signature and custody ledger stored alongside export.",
+)
+```
+
+The adapter registers file metadata, digest, and description through DFIR-IRIS’s documented v2 evidence endpoint. Upload and retention of the evidence bytes remain controlled by the case system’s own workflow.
+
+## Existing local commands
+
+```bash
+reconkit evidence acquire-web "https://example.com" --trust-boundary public-internet
+reconkit evidence derive-links "https://example.com"
+reconkit boundary dns example.com
+reconkit verify file-hash .\sample.bin --algo sha256
+```
+
+## Development
+
+```bash
+pytest
+python -m build
+twine check dist/*
+```
+
+## Releases
+
+PyPI publication is automated by GitHub Actions. After updating the version in
+`pyproject.toml` and the changelog, push the matching annotated tag (for example,
+`v0.3.0`). The workflow verifies that the tag and package version match, builds
+the distributions, validates them with Twine, and publishes using the repository's
+`PYPI_API_TOKEN` Actions secret. Ordinary branch pushes never publish a release.
+
+## License
+
+Copyright © 2026 Noir Stack LLC. Licensed under the
+[Proprietary Software License — Free Use, No Modification](LICENSE).

reconkit-0.2.1/README.md

@@ -0,0 +1,107 @@
+# ReconKit
+
+ReconKit is a small Python toolkit for preserving authorized web observations and local file findings as reviewable evidence records. It is a collection layer, not a scanner, case-management system, or source of truth.
+
+It complements reconnaissance tools such as SpiderFoot and BBOT, web archiving tools such as Webrecorder, and case-management platforms such as DFIR-IRIS. ReconKit focuses on the handoff between collection and review: what was collected, where it came from, what redirects occurred, what limits apply, and whether exported files have changed.
+
+## What it provides
+
+- Public-web capture with bounded size, rate limiting, redirect-chain recording, robots checks at every destination, and blocking of private, loopback, and reserved destinations by default.
+- Standards-oriented WARC 1.1 and WACZ 1.2 exports. WACZ files contain a WARC, CDXJ index, page list, file-fixity manifest, and data-package digest.
+- Append-only, hash-linked chain-of-custody ledgers.
+- Ed25519-signed manifests that can be verified offline.
+- A DFIR-IRIS v2 adapter that registers an exported evidence file with an existing case.
+- Local file hashes, magic-byte identification, EXIF extraction, printable-string extraction, and small DNS/WHOIS/RDAP observations.
+
+## What it does not claim
+
+ReconKit records a transport observation. It does not prove the identity of a publisher, the truth of content, legal chain of custody, or attribution. A SHA-256 digest proves that bytes have not changed relative to the recorded digest; it does not prove where they originated.
+
+Web collection is only for systems and data you own or are authorized to assess. The default public-destination restriction helps prevent accidental collection from local or private infrastructure; it is not a substitute for operational authorization.
+
+## Install
+
+```bash
+python -m pip install reconkit
+```
+
+For development:
+
+```bash
+python -m pip install -e ".[dev]"
+```
+
+## Capture and preserve a page
+
+```bash
+reconkit evidence archive-warc "https://example.com" --output evidence/example.warc
+reconkit evidence archive-wacz "https://example.com" --output evidence/example.wacz --title "Example capture"
+```
+
+The WACZ export follows the [WACZ 1.2 layout](https://specs.webrecorder.net/wacz/1.2.0/), so it can be validated and replayed with compatible web-archive tooling.
+Robots rules are respected by default; use `--no-obey-robots` only when you have clear authorization for the capture.
+
+## Sign a manifest and record custody
+
+```python
+from pathlib import Path
+from reconkit.evidence import CustodyLedger, ManifestSigner, verify_manifest, write_manifest
+
+evidence = Path("evidence/example.wacz")
+ledger = CustodyLedger("evidence/custody.jsonl")
+ledger.append(action="acquired", actor="analyst@example.org", artifact_path=evidence)
+ledger.append(action="exported", actor="analyst@example.org", artifact_path=evidence)
+assert ledger.verify()
+
+signer = ManifestSigner.generate()
+Path("keys/evidence-signing-key.pem").write_bytes(signer.private_pem())
+manifest = write_manifest([evidence], "evidence/manifest.json", signer, custody_ledger=ledger.path)
+assert verify_manifest(manifest)
+```
+
+Keep the private key outside the evidence directory and protect it with your organization’s key-management practices. The manifest embeds the corresponding public key so a reviewer can verify it without the private key.
+
+## Register exported evidence in DFIR-IRIS
+
+```python
+from reconkit.evidence import DFIRIRISAdapter
+
+iris = DFIRIRISAdapter("https://iris.example.org", api_key="your-api-key")
+iris.register(
+    case_identifier=42,
+    evidence_path="evidence/example.wacz",
+    description="Public web capture; signature and custody ledger stored alongside export.",
+)
+```
+
+The adapter registers file metadata, digest, and description through DFIR-IRIS’s documented v2 evidence endpoint. Upload and retention of the evidence bytes remain controlled by the case system’s own workflow.
+
+## Existing local commands
+
+```bash
+reconkit evidence acquire-web "https://example.com" --trust-boundary public-internet
+reconkit evidence derive-links "https://example.com"
+reconkit boundary dns example.com
+reconkit verify file-hash .\sample.bin --algo sha256
+```
+
+## Development
+
+```bash
+pytest
+python -m build
+twine check dist/*
+```
+
+## Releases
+
+PyPI publication is automated by GitHub Actions. After updating the version in
+`pyproject.toml` and the changelog, push the matching annotated tag (for example,
+`v0.3.0`). The workflow verifies that the tag and package version match, builds
+the distributions, validates them with Twine, and publishes using the repository's
+`PYPI_API_TOKEN` Actions secret. Ordinary branch pushes never publish a release.
+
+## License
+
+Copyright © 2026 Noir Stack LLC. Licensed under the
+[Proprietary Software License — Free Use, No Modification](LICENSE).

{reconkit-0.1.0 → reconkit-0.2.1}/pyproject.toml

@@ -1,56 +1,57 @@
-[build-system]
-requires = ["hatchling>=1.25"]
-build-backend = "hatchling.build"
-
-[project]
-name = "reconkit"
-version = "0.1.0"
-description = "A small, safe-by-default toolkit for scraping, OSINT, and file triage."
-readme = "README.md"
-requires-python = ">=3.10"
-license = { text = "MIT" }
-authors = [{ name = "reconkit" }]
-keywords = ["osint", "forensics", "scraping", "triage"]
-dependencies = [
-  "httpx>=0.27",
-  "typer>=0.12",
-  "rich>=13.7",
-  "beautifulsoup4>=4.12",
-  "lxml>=5.1",
-  "dnspython>=2.6",
-  "python-whois>=0.9",
-  "ipwhois>=1.2",
-  "exifread>=3.0",
-  "filetype>=1.2",
-]
-
-[project.optional-dependencies]
-dev = [
-  "build>=1.2",
-  "twine>=5.1",
-  "pytest>=8.0",
-  "pytest-asyncio>=0.23",
-  "ruff>=0.4",
-  "mypy>=1.10",
-]
-
-[project.scripts]
-reconkit = "reconkit.cli:app"
-
-[tool.hatch.build.targets.wheel]
-packages = ["src/reconkit"]
-
-[tool.pytest.ini_options]
-addopts = "-q"
-asyncio_mode = "auto"
-
-[tool.ruff]
-line-length = 100
-
-[tool.mypy]
-python_version = "3.10"
-warn_return_any = true
-warn_unused_ignores = true
-no_implicit_optional = true
-strict_optional = true
-ignore_missing_imports = true
+[build-system]
+requires = ["hatchling>=1.25"]
+build-backend = "hatchling.build"
+
+[project]
+name = "reconkit"
+version = "0.2.1"
+description = "Evidence collection, provenance, and preservation utilities for authorized investigations."
+readme = "README.md"
+requires-python = ">=3.10"
+license = { text = "Proprietary Software License — Free Use, No Modification" }
+authors = [{ name = "reconkit" }]
+keywords = ["osint", "forensics", "scraping", "triage"]
+dependencies = [
+  "httpx>=0.27",
+  "typer>=0.12",
+  "rich>=13.7",
+  "beautifulsoup4>=4.12",
+  "lxml>=5.1",
+  "dnspython>=2.6",
+  "python-whois>=0.9",
+  "ipwhois>=1.2",
+  "exifread>=3.0",
+  "filetype>=1.2",
+  "cryptography>=42",
+]
+
+[project.optional-dependencies]
+dev = [
+  "build>=1.2",
+  "twine>=5.1",
+  "pytest>=8.0",
+  "pytest-asyncio>=0.23",
+  "ruff>=0.4",
+  "mypy>=1.10",
+]
+
+[project.scripts]
+reconkit = "reconkit.cli:app"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/reconkit"]
+
+[tool.pytest.ini_options]
+addopts = "-q"
+testpaths = ["tests"]
+
+[tool.ruff]
+line-length = 100
+
+[tool.mypy]
+python_version = "3.10"
+warn_return_any = true
+warn_unused_ignores = true
+no_implicit_optional = true
+strict_optional = true
+ignore_missing_imports = true

{reconkit-0.1.0 → reconkit-0.2.1}/src/reconkit/__init__.py

@@ -1,22 +1,22 @@
-"""reconkit.
-
-Public API: Noir Stack / Hexarch / Judicium surface lives under `reconkit.noir`.
-Internal modules remain available but are not the supported public interface.
-"""
-
-__version__ = "0.1.0"
-
-from reconkit.noir.primitives import (  # noqa: E402
-    EvidenceArtifact,
-    EvidenceBundle,
-    ProvenanceRecord,
-    VerificationResult,
-)
-
-__all__ = [
-    "__version__",
-    "EvidenceArtifact",
-    "EvidenceBundle",
-    "ProvenanceRecord",
-    "VerificationResult",
-]
+"""reconkit.
+
+Public API: Noir Stack / Hexarch / Judicium surface lives under `reconkit.noir`.
+Internal modules remain available but are not the supported public interface.
+"""
+
+__version__ = "0.2.1"
+
+from reconkit.noir.primitives import (  # noqa: E402
+    EvidenceArtifact,
+    EvidenceBundle,
+    ProvenanceRecord,
+    VerificationResult,
+)
+
+__all__ = [
+    "__version__",
+    "EvidenceArtifact",
+    "EvidenceBundle",
+    "ProvenanceRecord",
+    "VerificationResult",
+]