repovet 0.1.0__py3-none-any.whl

repovet/__init__.py

@@ -0,0 +1,3 @@
+"""repovet: static check of an untrusted Git repository before anything from it runs."""
+
+__version__ = "0.1.0"

repovet/__main__.py

@@ -0,0 +1,6 @@
+"""Entry point for ``python -m repovet``."""
+
+from repovet.cli import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())

repovet/analyzers/__init__.py

@@ -0,0 +1,56 @@
+"""Analyzers, one module per area. Contract: ``analyze(ctx) -> AreaResult``."""
+
+from collections.abc import Callable
+
+from repovet.analyzers import (
+    agents,
+    autorun,
+    binaries,
+    dependencies,
+    download_exec,
+    obfuscation,
+    provenance,
+    trust,
+)
+from repovet.engine.context import ScanContext
+from repovet.engine.runner import prepare_file_rules, run_rules
+from repovet.models import AREAS, AreaResult, CoverageStatus
+
+type Analyzer = Callable[[ScanContext], AreaResult]
+
+ANALYZERS: dict[str, Analyzer] = {
+    autorun.AREA: autorun.analyze,
+    agents.AREA: agents.analyze,
+    obfuscation.AREA: obfuscation.analyze,
+    download_exec.AREA: download_exec.analyze,
+    binaries.AREA: binaries.analyze,
+    dependencies.AREA: dependencies.analyze,
+    provenance.AREA: provenance.analyze,
+    trust.AREA: trust.analyze,
+}
+
+
+def run_all(ctx: ScanContext) -> list[AreaResult]:
+    """Run every implemented area; record the others as not implemented.
+
+    Rules from ``--rules`` folders for an area without its own module still run
+    through the engine.
+    """
+    results: list[AreaResult] = []
+    # One pass over the files for the file rules of every area and the profile.
+    prepare_file_rules(ctx.rules.active(), ctx, [provenance.start_observing(ctx)])
+    for name, info in AREAS.items():
+        analyzer = ANALYZERS.get(name)
+        if analyzer is not None:
+            result = analyzer(ctx)
+            ctx.facts.update(result.facts)
+            results.append(result)
+            continue
+        ctx.coverage.add(
+            f"area:{name}",
+            CoverageStatus.NOT_IMPLEMENTED,
+            f"{name} ({info.label}): not implemented yet (milestone {info.milestone})",
+        )
+        if ctx.rules.active(name):
+            results.append(AreaResult(name, run_rules(ctx.rules.active(name), ctx)))
+    return results

repovet/analyzers/agents.py

@@ -0,0 +1,11 @@
+"""Area ``agents``: instructions and configuration for AI coding agents."""
+
+from repovet.engine.context import ScanContext
+from repovet.engine.runner import run_rules
+from repovet.models import AreaResult
+
+AREA = "agents"
+
+
+def analyze(ctx: ScanContext) -> AreaResult:
+    return AreaResult(AREA, run_rules(ctx.rules.active(AREA), ctx))

repovet/analyzers/autorun.py

@@ -0,0 +1,14 @@
+"""Area ``autorun``: code that tools run automatically (install, build, IDE, Git, shell)."""
+
+from repovet.engine.context import ScanContext
+from repovet.engine.runner import record_unsupported, run_rules
+from repovet.models import AreaResult
+
+AREA = "autorun"
+
+
+def analyze(ctx: ScanContext) -> AreaResult:
+    findings = run_rules(ctx.rules.active(AREA), ctx)
+    # Auto-run surfaces that repovet recognizes but does not analyze (_unsupported.yaml).
+    record_unsupported(ctx)
+    return AreaResult(AREA, findings)

repovet/analyzers/binaries.py

@@ -0,0 +1,11 @@
+"""Area ``binaries``: executables, archives, macros and file-system tricks."""
+
+from repovet.engine.context import ScanContext
+from repovet.engine.runner import run_rules
+from repovet.models import AreaResult
+
+AREA = "binaries"
+
+
+def analyze(ctx: ScanContext) -> AreaResult:
+    return AreaResult(AREA, run_rules(ctx.rules.active(AREA), ctx))

repovet/analyzers/dependencies.py

@@ -0,0 +1,11 @@
+"""Area ``dependencies``: lookalike names, foreign sources and package indexes."""
+
+from repovet.engine.context import ScanContext
+from repovet.engine.runner import run_rules
+from repovet.models import AreaResult
+
+AREA = "dependencies"
+
+
+def analyze(ctx: ScanContext) -> AreaResult:
+    return AreaResult(AREA, run_rules(ctx.rules.active(AREA), ctx))

repovet/analyzers/download_exec.py

@@ -0,0 +1,11 @@
+"""Area ``download_exec``: code that downloads something and runs it."""
+
+from repovet.engine.context import ScanContext
+from repovet.engine.runner import run_rules
+from repovet.models import AreaResult
+
+AREA = "download_exec"
+
+
+def analyze(ctx: ScanContext) -> AreaResult:
+    return AreaResult(AREA, run_rules(ctx.rules.active(AREA), ctx))

repovet/analyzers/obfuscation.py

@@ -0,0 +1,11 @@
+"""Area ``obfuscation``: code that hides what it does (encoded blobs, packers, invisible text)."""
+
+from repovet.engine.context import ScanContext
+from repovet.engine.runner import run_rules
+from repovet.models import AreaResult
+
+AREA = "obfuscation"
+
+
+def analyze(ctx: ScanContext) -> AreaResult:
+    return AreaResult(AREA, run_rules(ctx.rules.active(AREA), ctx))