reg2es 2.2.1__tar.gz → 2.3.0__tar.gz

{reg2es-2.2.1 → reg2es-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: reg2es
-Version: 2.2.1
+Version: 2.3.0
 Summary: A fast library for parsing and importing Windows NT Registry(REGF) into Elasticsearch.
 Author-email: sumeshi <j15322sn@gmail.com>
 License-Expression: MIT
@@ -24,13 +24,9 @@ Description-Content-Type: text/markdown
 A command-line tool and Python library for extracting forensic artifacts from
 Windows NT Registry (REGF) hives and importing them into Elasticsearch.
 
-The original plugin set is based on
-[airbus-cert/regrippy](https://github.com/airbus-cert/regrippy); the package
-also includes reg2es-specific additions. The project also draws inspiration
-from [RegRipper](https://github.com/keydet89/RegRipper3.0). `reg2es` runs
-standalone and does not require the `regrippy` package at runtime. Both
-`reg2es` and `reg2json` use the same plugin runner and emit the same
-ECS-oriented documents.
+Includes Registry artifact plugins based on
+[regrippy](https://github.com/airbus-cert/regrippy) and inspired by
+[RegRipper](https://github.com/keydet89/RegRipper3.0).
 
 
 ## Usage
@@ -87,14 +83,14 @@ unrelated files are not treated as standalone hives.
   opt-in.
 - `--list-plugins`: print the 41 bundled plugins and exit.
 - `--size N`: set the generation and indexing chunk size (default: 500).
-- `--tags tag1,tag2`: add tags to every document.
+- `--tags tag1,tag2`: add custom tags to every document.
 - `--quiet`: suppress progress output.
 
 `reg2es` also accepts Elasticsearch connection options including
 `--host`, `--port`, `--index`, `--scheme`, `--pipeline`, `--login`, `--pwd`,
 `--ca-certs`, and `--no-verify-certs`. TLS verification is enabled by default;
 use `--ca-certs /path/to/ca.pem` for a private CA bundle. Run `reg2es --help`
-or `reg2json --help` for the full current interface.
+or `reg2json --help` for all options.
 
 
 ### Examples
@@ -134,9 +130,8 @@ reg2es SYSTEM --login elastic --pwd '******'
 reg2json NTUSER.DAT --plugin userassist -o artifacts.json
 ```
 
-`reg2json` also supports line-delimited output. `--format jsonl` (or `ndjson`)
-writes one record per line without holding the entire dataset in memory. When
-no output path is specified, the default extension is `.jsonl`:
+Use `--format jsonl` (or `ndjson`) to write one record per line.
+The default output extension is `.jsonl`:
 
 ```bash
 reg2json NTUSER.DAT --plugin userassist --format jsonl -o artifacts.jsonl
@@ -172,28 +167,13 @@ result: list[dict] = reg2json(
 
 ## Output Format Example
 
-Each plugin result becomes one document with `ecs.version` set to `8.17.0`.
-Standard `event`,
-`registry`, `log.file`, `tags`, and `@timestamp` fields describe the artifact.
-Lossless plugin-specific data and the original offline-hive location are kept
-under `reg2es`.
-
-When a plugin has a reliable artifact time, it uses that time for `@timestamp`.
-Otherwise it uses the registry key's LastWrite; if no valid time exists,
-`@timestamp` is omitted. Check `reg2es.timestamp.source` and
-`reg2es.timestamp.meaning` before treating a result as an activity time.
-Original values and fallback reasons remain in the document.
-
-The current ECS output changes `registry.data.bytes` from a byte count to
-Base64, uses `REG_*` names in `registry.data.type`, and includes the value
-name in `registry.path`. Existing Elasticsearch mappings may conflict with
-these fields; use a new index for the updated output.
-
 ```json
 {
-  "ecs": {"version": "8.17.0"},
-  "@timestamp": "2015-10-30T07:24:57.814133+00:00",
+  "@timestamp": "2015-10-30T07:24:57.814133Z",
   "event": {
+    "provider": "registry",
+    "module": "windows",
+    "dataset": "windows.registry",
     "kind": "event",
     "category": ["registry"],
     "type": ["info"],
@@ -203,8 +183,8 @@ these fields; use a new index for the updated output.
     "hive": "HKLM",
     "key": "SYSTEM\\ControlSet001\\Control\\ComputerName\\ComputerName",
     "path": "HKLM\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ComputerName\\ComputerName",
-      "value": "ComputerName",
-      "data": {
+    "value": "ComputerName",
+    "data": {
       "type": "REG_SZ",
       "strings": ["DESKTOP-EXAMPLE"]
     }
@@ -242,7 +222,7 @@ $ uv add reg2es
 
 ### From GitHub Releases
 
-Standalone binaries built with Nuitka are available from GitHub Releases for systems without a Python environment.
+Standalone binaries are available from GitHub Releases for systems without a Python environment.
 
 ```bash
 $ chmod +x ./reg2es

{reg2es-2.2.1 → reg2es-2.3.0}/README.md

@@ -8,13 +8,9 @@
 A command-line tool and Python library for extracting forensic artifacts from
 Windows NT Registry (REGF) hives and importing them into Elasticsearch.
 
-The original plugin set is based on
-[airbus-cert/regrippy](https://github.com/airbus-cert/regrippy); the package
-also includes reg2es-specific additions. The project also draws inspiration
-from [RegRipper](https://github.com/keydet89/RegRipper3.0). `reg2es` runs
-standalone and does not require the `regrippy` package at runtime. Both
-`reg2es` and `reg2json` use the same plugin runner and emit the same
-ECS-oriented documents.
+Includes Registry artifact plugins based on
+[regrippy](https://github.com/airbus-cert/regrippy) and inspired by
+[RegRipper](https://github.com/keydet89/RegRipper3.0).
 
 
 ## Usage
@@ -71,14 +67,14 @@ unrelated files are not treated as standalone hives.
   opt-in.
 - `--list-plugins`: print the 41 bundled plugins and exit.
 - `--size N`: set the generation and indexing chunk size (default: 500).
-- `--tags tag1,tag2`: add tags to every document.
+- `--tags tag1,tag2`: add custom tags to every document.
 - `--quiet`: suppress progress output.
 
 `reg2es` also accepts Elasticsearch connection options including
 `--host`, `--port`, `--index`, `--scheme`, `--pipeline`, `--login`, `--pwd`,
 `--ca-certs`, and `--no-verify-certs`. TLS verification is enabled by default;
 use `--ca-certs /path/to/ca.pem` for a private CA bundle. Run `reg2es --help`
-or `reg2json --help` for the full current interface.
+or `reg2json --help` for all options.
 
 
 ### Examples
@@ -118,9 +114,8 @@ reg2es SYSTEM --login elastic --pwd '******'
 reg2json NTUSER.DAT --plugin userassist -o artifacts.json
 ```
 
-`reg2json` also supports line-delimited output. `--format jsonl` (or `ndjson`)
-writes one record per line without holding the entire dataset in memory. When
-no output path is specified, the default extension is `.jsonl`:
+Use `--format jsonl` (or `ndjson`) to write one record per line.
+The default output extension is `.jsonl`:
 
 ```bash
 reg2json NTUSER.DAT --plugin userassist --format jsonl -o artifacts.jsonl
@@ -156,28 +151,13 @@ result: list[dict] = reg2json(
 
 ## Output Format Example
 
-Each plugin result becomes one document with `ecs.version` set to `8.17.0`.
-Standard `event`,
-`registry`, `log.file`, `tags`, and `@timestamp` fields describe the artifact.
-Lossless plugin-specific data and the original offline-hive location are kept
-under `reg2es`.
-
-When a plugin has a reliable artifact time, it uses that time for `@timestamp`.
-Otherwise it uses the registry key's LastWrite; if no valid time exists,
-`@timestamp` is omitted. Check `reg2es.timestamp.source` and
-`reg2es.timestamp.meaning` before treating a result as an activity time.
-Original values and fallback reasons remain in the document.
-
-The current ECS output changes `registry.data.bytes` from a byte count to
-Base64, uses `REG_*` names in `registry.data.type`, and includes the value
-name in `registry.path`. Existing Elasticsearch mappings may conflict with
-these fields; use a new index for the updated output.
-
 ```json
 {
-  "ecs": {"version": "8.17.0"},
-  "@timestamp": "2015-10-30T07:24:57.814133+00:00",
+  "@timestamp": "2015-10-30T07:24:57.814133Z",
   "event": {
+    "provider": "registry",
+    "module": "windows",
+    "dataset": "windows.registry",
     "kind": "event",
     "category": ["registry"],
     "type": ["info"],
@@ -187,8 +167,8 @@ these fields; use a new index for the updated output.
     "hive": "HKLM",
     "key": "SYSTEM\\ControlSet001\\Control\\ComputerName\\ComputerName",
     "path": "HKLM\\SYSTEM\\ControlSet001\\Control\\ComputerName\\ComputerName\\ComputerName",
-      "value": "ComputerName",
-      "data": {
+    "value": "ComputerName",
+    "data": {
       "type": "REG_SZ",
       "strings": ["DESKTOP-EXAMPLE"]
     }
@@ -226,7 +206,7 @@ $ uv add reg2es
 
 ### From GitHub Releases
 
-Standalone binaries built with Nuitka are available from GitHub Releases for systems without a Python environment.
+Standalone binaries are available from GitHub Releases for systems without a Python environment.
 
 ```bash
 $ chmod +x ./reg2es

reg2es-2.3.0/src/reg2es/__about__.py

@@ -0,0 +1 @@
+__version__ = "2.3.0"

{reg2es-2.2.1 → reg2es-2.3.0}/src/reg2es/models/Reg2es.py

@@ -373,7 +373,7 @@ def _normalize_value(value: Any) -> Any:
     if isinstance(value, (bytes, bytearray, memoryview)):
         return bytes(value).hex()
     if isinstance(value, datetime):
-        return value.isoformat()
+        return _datetime_to_iso(value)
     if isinstance(value, Path):
         return str(value)
     if isinstance(value, Enum):
@@ -409,8 +409,25 @@ def _normalize_value(value: Any) -> Any:
     )
 
 
+def _datetime_to_iso(value: datetime) -> str:
+    """Format a datetime consistently, using ``Z`` for UTC values."""
+    serialized = value.isoformat()
+    if value.tzinfo is not None and value.utcoffset() == timezone.utc.utcoffset(value):
+        if serialized.endswith("+00:00"):
+            return serialized[:-6] + "Z"
+    return serialized
+
+
+def _normalize_tags(tags: Optional[Union[str, Sequence[str]]]) -> List[str]:
+    """Normalize comma-delimited strings or tag sequences to clean strings."""
+    if tags is None:
+        return []
+    values = tags.split(",") if isinstance(tags, str) else tags
+    return [tag.strip() for tag in values if isinstance(tag, str) and tag.strip()]
+
+
 def _timestamp_to_iso(value: Any) -> Optional[str]:
-    """Convert an aware datetime or positive Unix timestamp to UTC ISO 8601."""
+    """Convert a valid timestamp to UTC ISO 8601 without changing its raw value."""
     if isinstance(value, datetime):
         if value.tzinfo is None or value.utcoffset() is None:
             return None
@@ -418,7 +435,7 @@ def _timestamp_to_iso(value: Any) -> Optional[str]:
             normalized = value.astimezone(timezone.utc)
             if normalized.timestamp() <= 0:
                 return None
-            return normalized.isoformat()
+            return _datetime_to_iso(normalized)
         except (OSError, OverflowError, ValueError):
             return None
     if isinstance(value, bool) or not isinstance(value, (int, float)):
@@ -426,7 +443,7 @@ def _timestamp_to_iso(value: Any) -> Optional[str]:
     try:
         if not math.isfinite(value) or value <= 0:
             return None
-        return datetime.fromtimestamp(value, tz=timezone.utc).isoformat()
+        return _datetime_to_iso(datetime.fromtimestamp(value, tz=timezone.utc))
     except (OSError, OverflowError, ValueError):
         return None
 
@@ -470,9 +487,6 @@ _ECS_REGISTRY_TYPES = {
     "RegQWord": "REG_QWORD",
 }
 
-_ECS_VERSION = "8.17.0"
-
-
 def _join_registry_path(*parts: Optional[str]) -> str:
     return "\\".join(part.strip("\\") for part in parts if part)
 
@@ -512,7 +526,7 @@ def plugin_result_to_document(
     plugin_name: str,
     hive_name: str,
     hive_path: str,
-    additional_tags: Optional[Sequence[str]] = None,
+    additional_tags: Optional[Union[str, Sequence[str]]] = None,
     recovery: Optional[dict] = None,
 ) -> dict:
     """Convert a single PluginResult to an ECS-compliant document.
@@ -572,8 +586,10 @@ def plugin_result_to_document(
     if result.value_name is not None:
         registry_path = _join_registry_path(registry_path, result.value_name)
     doc: dict = {
-        "ecs": {"version": _ECS_VERSION},
         "event": {
+            "provider": "registry",
+            "module": "windows",
+            "dataset": "windows.registry",
             "kind": "event",
             "category": ["registry"],
             "type": ["info"],
@@ -589,11 +605,7 @@ def plugin_result_to_document(
                 "path": (str(Path(hive_path).resolve()) if hive_path != "-" else "-"),
             },
         },
-        "tags": list(
-            dict.fromkeys(
-                ["registry", *(additional_tags or [])],
-            )
-        ),
+        "tags": list(dict.fromkeys(["registry", *_normalize_tags(additional_tags)])),
         "reg2es": {
             "plugin": {"name": plugin_name},
             "source": {"hive": hive_name, "key_path": result.path},
@@ -776,7 +788,7 @@ class Reg2es:
         plugin_names: Optional[Sequence[str]] = None,
         chunk_size: int = 500,
         error_policy: str = "continue",
-        additional_tags: Optional[Sequence[str]] = None,
+        additional_tags: Optional[Union[str, Sequence[str]]] = None,
     ) -> None:
         if error_policy not in ("continue", "raise"):
             raise ValueError(
@@ -790,9 +802,7 @@ class Reg2es:
             self.input_paths = [Path(path) for path in input_paths]
         self.chunk_size = chunk_size
         self.error_policy = error_policy
-        self.additional_tags = [
-            tag.strip() for tag in (additional_tags or []) if tag and tag.strip()
-        ]
+        self.additional_tags = _normalize_tags(additional_tags)
 
         # Discover and validate plugins once.
         all_plugins = discover_plugins()

{reg2es-2.2.1 → reg2es-2.3.0}/tests/test_model.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 
 import base64
 import logging
-from datetime import datetime, timezone
+from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from types import SimpleNamespace
 from unittest.mock import MagicMock, patch
@@ -20,6 +20,7 @@ from reg2es.models.Reg2es import (
     _build_hive_dataset,
     _close_parsers,
     _normalize_value,
+    _timestamp_to_iso,
     _prepare_registry_hive,
     detect_hive_type,
     discover_plugins,
@@ -352,7 +353,7 @@ def test_normalize_nested_plugin_data_without_stringifying_objects() -> None:
     }
     normalized = _normalize_value(value)
     assert normalized["binary"] == "dead"
-    assert normalized["when"] == "2024-01-01T00:00:00+00:00"
+    assert normalized["when"] == "2024-01-01T00:00:00Z"
     assert normalized["action"] == {"runas": "SYSTEM", "cmd": "cmd.exe"}
     assert normalized["items"] == ["01", {"ok": True}]
 
@@ -377,6 +378,13 @@ def test_plugin_result_conversion_is_ecs_shaped_and_lossless() -> None:
     )
 
     assert document["event"]["action"] == "example"
+    assert document["event"]["provider"] == "registry"
+    assert document["event"]["module"] == "windows"
+    assert document["event"]["dataset"] == "windows.registry"
+    assert document["event"]["kind"] == "event"
+    assert document["event"]["category"] == ["registry"]
+    assert document["event"]["type"] == ["info"]
+    assert document["tags"] == ["registry"]
     assert document["registry"]["hive"] == "HKLM"
     assert document["registry"]["key"] == "SYSTEM\\Control\\Test"
     assert document["registry"]["path"] == "HKLM\\SYSTEM\\Control\\Test\\Payload"
@@ -386,7 +394,6 @@ def test_plugin_result_conversion_is_ecs_shaped_and_lossless() -> None:
         "bytes": "3q0=",
     }
     assert base64.b64decode(document["registry"]["data"]["bytes"]) == b"\xde\xad"
-    assert document["ecs"]["version"] == "8.17.0"
     assert document["registry"]["path"] == "HKLM\\SYSTEM\\Control\\Test\\Payload"
     assert document["reg2es"]["value_type"] == result.value_type
     assert document["reg2es"]["value_size"] == 2
@@ -402,6 +409,80 @@ def test_plugin_result_conversion_is_ecs_shaped_and_lossless() -> None:
     }
 
 
+@pytest.mark.parametrize(
+    ("tags", "expected"),
+    [
+        (None, ["registry"]),
+        ("host-01, registry, case-42", ["registry", "host-01", "case-42"]),
+        (["host-01", "registry", "host-01"], ["registry", "host-01"]),
+        ((" host-01 ", "", "case-42"), ["registry", "host-01", "case-42"]),
+    ],
+)
+def test_registry_tags_normalize_and_deduplicate(tags, expected) -> None:
+    document = plugin_result_to_document(
+        PluginResult(), "example", "SYSTEM", "/host/SYSTEM", tags
+    )
+    assert document["tags"] == expected
+
+
+def test_datetime_normalization_uses_z_for_utc_and_preserves_other_offsets() -> None:
+    utc = datetime(2015, 10, 30, 7, 24, 57, 814133, tzinfo=timezone.utc)
+    assert _normalize_value(utc) == "2015-10-30T07:24:57.814133Z"
+    assert _timestamp_to_iso(utc) == "2015-10-30T07:24:57.814133Z"
+    assert _timestamp_to_iso(utc.timestamp()) == "2015-10-30T07:24:57.814133Z"
+    naive = datetime(2015, 10, 30, 7, 24, 57, 814133)
+    assert _normalize_value(naive) == "2015-10-30T07:24:57.814133"
+    assert _timestamp_to_iso(naive) is None
+    plus_nine = datetime(2026, 10, 2, 13, tzinfo=timezone(timedelta(hours=9)))
+    assert _normalize_value(plus_nine) == "2026-10-02T13:00:00+09:00"
+    assert _timestamp_to_iso(plus_nine) == "2026-10-02T04:00:00Z"
+    result = PluginResult()
+    result.set_event_time(plus_nine, source="test", meaning="test")
+    document = plugin_result_to_document(result, "example", "SYSTEM", "-")
+    assert document["@timestamp"] == "2026-10-02T04:00:00Z"
+    assert document["reg2es"]["timestamp"]["raw"] == "2026-10-02T13:00:00+09:00"
+    assert result.event_time == plus_nine
+
+
+@pytest.mark.parametrize(
+    ("original", "expected"),
+    [
+        (
+            datetime(2026, 10, 2, 0, 30, 0, 814133, tzinfo=timezone(timedelta(hours=9))),
+            "2026-10-01T15:30:00.814133Z",
+        ),
+        (
+            datetime(2026, 10, 2, 23, 30, 0, 814133, tzinfo=timezone(timedelta(hours=-5))),
+            "2026-10-03T04:30:00.814133Z",
+        ),
+    ],
+)
+def test_event_timestamp_is_utc_while_original_offset_and_precision_are_preserved(
+    original, expected
+) -> None:
+    result = PluginResult()
+    result.mtime = 100.25
+    result.custom = {"original_event_time": original}
+    result.set_event_time(
+        original, source="artifact", meaning="execution", precision="microseconds"
+    )
+    document = plugin_result_to_document(result, "example", "SYSTEM", "-")
+    assert document["@timestamp"] == expected
+    assert document["reg2es"]["timestamp"] == {
+        "source": "artifact",
+        "meaning": "execution",
+        "precision": "microseconds",
+        "fallback_reason": None,
+        "raw": original.isoformat(),
+    }
+    assert document["reg2es"]["custom"]["original_event_time"] == original.isoformat()
+    assert document["reg2es"]["timestamps"]["modified"] == 100.25
+    assert document["reg2es"]["timestamp_iso"]["modified"] == (
+        "1970-01-01T00:01:40.250000Z"
+    )
+    assert result.event_time == original
+
+
 def test_recentdocs_promotes_decoded_name_to_ecs_file_field() -> None:
     result = PluginResult()
     result.path = "ROOT\\Software\\Microsoft\\Windows\\RecentDocs"
@@ -487,7 +568,7 @@ def test_artifact_timestamp_precedes_last_write_and_preserves_both() -> None:
 
     document = plugin_result_to_document(result, "example", "SYSTEM", "/host/SYSTEM")
 
-    assert document["@timestamp"] == "2020-01-02T03:04:05.123456+00:00"
+    assert document["@timestamp"] == "2020-01-02T03:04:05.123456Z"
     assert document["reg2es"]["timestamp"] == {
         "source": "ShutdownTime",
         "meaning": "shutdown",
@@ -496,12 +577,13 @@ def test_artifact_timestamp_precedes_last_write_and_preserves_both() -> None:
         "raw": "132223214451234560",
     }
     assert document["reg2es"]["timestamps"]["modified"] == result.mtime
-    assert document["reg2es"]["timestamp_iso"]["modified"].endswith("+00:00")
+    assert document["reg2es"]["timestamp_iso"]["modified"].endswith("Z")
 
 
 def test_invalid_artifact_time_falls_back_with_reason() -> None:
     key = RegistryKeyMock.build("Control\\Test")
     result = PluginResult(key=key)
+    result.mtime = 145.25
     result.set_event_time(
         datetime(2020, 1, 2, 3, 4, 5),
         source="TypedURLsTime",
@@ -514,8 +596,10 @@ def test_invalid_artifact_time_falls_back_with_reason() -> None:
         result, "typedurls", "NTUSER.DAT", "/host/NTUSER.DAT"
     )
 
-    assert document["@timestamp"]
+    assert document["@timestamp"] == "1970-01-01T00:02:25.250000Z"
     assert document["reg2es"]["timestamp"]["source"] == "key.last_write"
+    assert document["reg2es"]["timestamp"]["meaning"] == "registry_key_modified"
+    assert document["reg2es"]["timestamp"]["precision"] == "subsecond"
     assert (
         document["reg2es"]["timestamp"]["fallback_reason"] == "invalid_typedurls_time"
     )
@@ -527,7 +611,7 @@ def test_invalid_artifact_time_is_rejected_without_plugin_hint(value) -> None:
     result.mtime = 100
     result.set_event_time(value, source="test", meaning="test")
     document = plugin_result_to_document(result, "example", "SYSTEM", "-")
-    assert document["@timestamp"] == "1970-01-01T00:01:40+00:00"
+    assert document["@timestamp"] == "1970-01-01T00:01:40Z"
     assert document["reg2es"]["timestamp"]["fallback_reason"] == "invalid_event_time"
 
 

reg2es-2.3.0/tests/test_output_contract.py

@@ -0,0 +1,174 @@
+"""Focused contracts for bounded exports and safe output paths."""
+import importlib
+import json
+from pathlib import Path
+import sys
+
+import pytest
+
+from reg2es.presenters.Reg2jsonPresenter import Reg2jsonPresenter
+from reg2es.models.Reg2es import plugin_result_to_document
+from reg2es.plugins.base import PluginResult
+from datetime import datetime, timezone
+
+
+@pytest.mark.parametrize("output_format", ["jsonl", "ndjson"])
+def test_cli_default_output_uses_line_format_suffix(tmp_path, monkeypatch, output_format):
+    module = importlib.import_module("reg2es.views.Reg2jsonView")
+    source = tmp_path / "SYSTEM"
+    source.write_bytes(b"regf")
+    captured = {}
+
+    class Presenter:
+        def __init__(self, **kwargs):
+            captured.update(kwargs)
+
+        def export_json(self):
+            pass
+
+    monkeypatch.setattr(module, "Reg2jsonPresenter", Presenter)
+    monkeypatch.chdir(tmp_path)
+    monkeypatch.setattr(
+        sys,
+        "argv",
+        ["reg2json", str(source), "--format", output_format],
+    )
+    module.Reg2jsonView().run()
+    assert Path(captured["output_path"]).name == "SYSTEM.jsonl"
+
+
+@pytest.mark.parametrize("output_format", ["jsonl", "ndjson"])
+@pytest.mark.parametrize("records", [[], [{"text": "端末\nnext"}, {"n": 2}]])
+def test_jsonl_streams_chunks_without_list_api(tmp_path, monkeypatch, output_format, records):
+    module = importlib.import_module("reg2es.presenters.Reg2jsonPresenter")
+    state = []
+
+    class Runner:
+        def __init__(self, **kwargs):
+            pass
+
+        def gen_records(self):
+            try:
+                for record in records:
+                    yield [record]
+            finally:
+                state.append("generator closed")
+
+        def close(self):
+            state.append("parser closed")
+
+    monkeypatch.setattr(module, "Reg2es", Runner)
+    monkeypatch.chdir(tmp_path)
+    presenter = Reg2jsonPresenter("SYSTEM", is_quiet=True, output_format=output_format)
+    monkeypatch.setattr(presenter, "reg2json", lambda: pytest.fail("materialized records"))
+    paths = presenter.export_json()
+    assert paths == [tmp_path / "SYSTEM.jsonl"]
+    payload = paths[0].read_bytes()
+    assert payload == b"".join((json.dumps(r, ensure_ascii=False, separators=(",", ":")) + "\n").encode() for r in records)
+    assert state == ["generator closed", "parser closed"]
+
+
+@pytest.mark.parametrize("offset", [0, 9, -5])
+def test_json_and_jsonl_preserve_the_same_generated_record_schema(
+    tmp_path, monkeypatch, offset
+):
+    from datetime import timedelta
+
+    result = PluginResult()
+    result.mtime = 100
+    original = datetime(2015, 10, 30, 7, 24, 57, 814133, tzinfo=timezone.utc).astimezone(
+        timezone(timedelta(hours=offset))
+    )
+    result.custom = {"original_event_time": original}
+    result.set_event_time(
+        original,
+        source="test.artifact_time",
+        meaning="test_event",
+        precision="microseconds",
+        raw="raw-time",
+    )
+    record = plugin_result_to_document(
+        result,
+        "example",
+        "SYSTEM",
+        "/evidence/SYSTEM",
+        ["registry", "host-01"],
+    )
+
+    class Runner:
+        def __init__(self, **kwargs):
+            pass
+
+        def gen_records(self):
+            yield [record]
+
+        def close(self):
+            pass
+
+    module = importlib.import_module("reg2es.presenters.Reg2jsonPresenter")
+    monkeypatch.setattr(module, "Reg2es", Runner)
+    exported = {}
+    for output_format in ("json", "jsonl"):
+        output = tmp_path / f"records.{output_format}"
+        presenter = Reg2jsonPresenter(
+            "SYSTEM",
+            output_path=str(output),
+            is_quiet=True,
+            output_format=output_format,
+            additional_tags=["registry", "host-01"],
+        )
+        payload = presenter.export_json()[0].read_bytes()
+        parsed = json.loads(payload)
+        exported[output_format] = parsed[0] if output_format == "json" else parsed
+
+    assert exported["json"] == exported["jsonl"] == record
+    assert exported["json"]["event"] == {
+        "provider": "registry",
+        "module": "windows",
+        "dataset": "windows.registry",
+        "kind": "event",
+        "category": ["registry"],
+        "type": ["info"],
+        "action": "example",
+    }
+    assert exported["json"]["tags"] == ["registry", "host-01"]
+    assert exported["json"]["@timestamp"] == "2015-10-30T07:24:57.814133Z"
+    assert exported["json"]["reg2es"]["custom"]["original_event_time"] == (
+        original.isoformat().replace("+00:00", "Z")
+    )
+    assert exported["json"]["reg2es"]["timestamp"] == {
+        "source": "test.artifact_time",
+        "meaning": "test_event",
+        "fallback_reason": None,
+        "precision": "microseconds",
+        "raw": "raw-time",
+    }
+
+
+@pytest.mark.parametrize("command", ["Reg2json", "Reg2es"])
+def test_cli_tags_are_parsed_and_forwarded(monkeypatch, tmp_path, command):
+    module = importlib.import_module(f"reg2es.views.{command}View")
+    source = tmp_path / "SYSTEM"
+    source.write_bytes(b"regf")
+    captured = {}
+
+    class Presenter:
+        def __init__(self, **kwargs):
+            captured.update(kwargs)
+
+        def export_json(self):
+            pass
+
+        def bulk_import(self):
+            pass
+
+    attribute = "Reg2jsonPresenter" if command == "Reg2json" else "Reg2esPresenter"
+    monkeypatch.setattr(module, attribute, Presenter)
+    monkeypatch.setattr(
+        sys,
+        "argv",
+        [command.lower(), str(source), "--tags", "registry, host-01,,case-42,host-01"],
+    )
+    getattr(module, command + "View")().run()
+
+    assert captured["additional_tags"] == ["registry", "host-01", "case-42", "host-01"]

{reg2es-2.2.1 → reg2es-2.3.0}/tests/test_timestamp_review.py

@@ -43,7 +43,7 @@ def test_userassist_filetime_submicrosecond_uses_shared_integer_conversion(
         UserAssistPlugin(registry, logging.getLogger(__name__), "NTUSER.DAT", "-").run()
     )
     doc = document(results[0], "userassist", "NTUSER.DAT")
-    assert doc["@timestamp"] == "2024-01-01T00:00:00.123456+00:00"
+    assert doc["@timestamp"] == "2024-01-01T00:00:00.123456Z"
     assert doc["reg2es"]["timestamp"]["raw"] == str(FILETIME + 7)
 
 
@@ -76,7 +76,7 @@ def test_typedurls_uses_sibling_key_case_insensitive_value_matching():
     )
     assert len(results) == 1
     doc = document(results[0], "typedurls", "NTUSER.DAT")
-    assert doc["@timestamp"] == "2024-01-01T00:00:00.123456+00:00"
+    assert doc["@timestamp"] == "2024-01-01T00:00:00.123456Z"
     assert doc["reg2es"]["value_data"] == "https://example.org"
     orjson.dumps(doc)
 
@@ -108,7 +108,7 @@ def test_sam_rid_is_value_type_and_expiry_sentinel_does_not_drop_user():
     results = sam_results(sam_f_data())
     assert len(results) == 1
     doc = document(results[0], "localusers", "SAM")
-    assert doc["@timestamp"] == "2024-01-01T00:00:00.123456+00:00"
+    assert doc["@timestamp"] == "2024-01-01T00:00:00.123456Z"
     orjson.dumps(doc)
 
 
@@ -201,7 +201,7 @@ def test_office_uses_enabled_time_not_document_creation_time():
     )
     assert len(results) == 1
     doc = document(results[0], "office_macros", "NTUSER.DAT")
-    assert doc["@timestamp"] == "2024-04-23T22:03:00+00:00"
+    assert doc["@timestamp"] == "2024-04-23T22:03:00Z"
     assert doc["reg2es"]["value_data"] == raw.hex()
 
 
@@ -239,7 +239,7 @@ def test_tasks_selects_one_representative_time_and_keeps_others_in_custom():
     )
     assert len(results) == 1
     doc = document(results[0], "tasks", "SOFTWARE")
-    assert doc["@timestamp"] == "2024-01-01T00:00:00.123456+00:00"
+    assert doc["@timestamp"] == "2024-01-01T00:00:00.123456Z"
     assert doc["reg2es"]["timestamp"]["source"] == "TaskCache.DynamicInfo.last_start"
     # The non-representative candidate stays in custom, not in a second document.
     assert (
@@ -281,7 +281,7 @@ def test_naive_registry_lastwrite_is_utc_regardless_of_host_timezone(monkeypatch
             monkeypatch.setenv("TZ", zone)
             time.tzset()
             doc = document(PluginResult(key=key), "regtime", "SYSTEM")
-            assert doc["@timestamp"] == "2024-01-01T00:00:00.123456+00:00"
+            assert doc["@timestamp"] == "2024-01-01T00:00:00.123456Z"
     finally:
         if original is None:
             monkeypatch.delenv("TZ", raising=False)
@@ -377,7 +377,7 @@ def test_systeminfo_mixes_time_bearing_and_plain_rows():
     assert hostname_doc["@timestamp"] != shutdown_doc["@timestamp"]
     assert hostname_doc["reg2es"]["timestamp"]["source"] == "key.last_write"
     assert shutdown_doc["reg2es"]["timestamp"]["source"] == "ShutdownTime"
-    assert shutdown_doc["@timestamp"] == "2024-01-01T00:00:00.123456+00:00"
+    assert shutdown_doc["@timestamp"] == "2024-01-01T00:00:00.123456Z"
     orjson.dumps(by_value)
 
 
@@ -401,7 +401,7 @@ def test_document_count_and_custom_fields_preserved_with_artifact_time():
     )
     assert len(results) == 3
     docs = [document(result, "kb", "SOFTWARE") for result in results]
-    assert all(doc["@timestamp"] == "2024-01-01T00:00:00.123456+00:00" for doc in docs)
+    assert all(doc["@timestamp"] == "2024-01-01T00:00:00.123456Z" for doc in docs)
     assert sorted(doc["reg2es"]["custom"]["kb"] for doc in docs) == [
         "KB0",
         "KB1",

reg2es-2.2.1/src/reg2es/__about__.py

@@ -1 +0,0 @@
-__version__ = "2.2.1"

reg2es-2.2.1/tests/test_output_contract.py

@@ -1,65 +0,0 @@
-"""Focused contracts for bounded exports and safe output paths."""
-import importlib
-import json
-from pathlib import Path
-import sys
-
-import pytest
-
-from reg2es.presenters.Reg2jsonPresenter import Reg2jsonPresenter
-
-
-@pytest.mark.parametrize("output_format", ["jsonl", "ndjson"])
-def test_cli_default_output_uses_line_format_suffix(tmp_path, monkeypatch, output_format):
-    module = importlib.import_module("reg2es.views.Reg2jsonView")
-    source = tmp_path / "SYSTEM"
-    source.write_bytes(b"regf")
-    captured = {}
-
-    class Presenter:
-        def __init__(self, **kwargs):
-            captured.update(kwargs)
-
-        def export_json(self):
-            pass
-
-    monkeypatch.setattr(module, "Reg2jsonPresenter", Presenter)
-    monkeypatch.chdir(tmp_path)
-    monkeypatch.setattr(
-        sys,
-        "argv",
-        ["reg2json", str(source), "--format", output_format],
-    )
-    module.Reg2jsonView().run()
-    assert Path(captured["output_path"]).name == "SYSTEM.jsonl"
-
-
-@pytest.mark.parametrize("output_format", ["jsonl", "ndjson"])
-@pytest.mark.parametrize("records", [[], [{"text": "端末\nnext"}, {"n": 2}]])
-def test_jsonl_streams_chunks_without_list_api(tmp_path, monkeypatch, output_format, records):
-    module = importlib.import_module("reg2es.presenters.Reg2jsonPresenter")
-    state = []
-
-    class Runner:
-        def __init__(self, **kwargs):
-            pass
-
-        def gen_records(self):
-            try:
-                for record in records:
-                    yield [record]
-            finally:
-                state.append("generator closed")
-
-        def close(self):
-            state.append("parser closed")
-
-    monkeypatch.setattr(module, "Reg2es", Runner)
-    monkeypatch.chdir(tmp_path)
-    presenter = Reg2jsonPresenter("SYSTEM", is_quiet=True, output_format=output_format)
-    monkeypatch.setattr(presenter, "reg2json", lambda: pytest.fail("materialized records"))
-    paths = presenter.export_json()
-    assert paths == [tmp_path / "SYSTEM.jsonl"]
-    payload = paths[0].read_bytes()
-    assert payload == b"".join((json.dumps(r, ensure_ascii=False, separators=(",", ":")) + "\n").encode() for r in records)
-    assert state == ["generator closed", "parser closed"]