rhada 0.0.1__tar.gz

rhada-0.0.1/.github/workflows/ci.yml

@@ -0,0 +1,39 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    name: Test (${{ matrix.os }}, Python ${{ matrix.python-version }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest]
+        python-version: ["3.11", "3.12", "3.13"]
+    env:
+      UV_PYTHON: ${{ matrix.python-version }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      - name: Set up Python ${{ matrix.python-version }}
+        run: uv python install ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: uv sync --frozen
+
+      - name: Run linter (ruff)
+        run: uv run ruff check src tests
+
+      - name: Run test suite (pytest)
+        run: uv run pytest -v

rhada-0.0.1/.github/workflows/publish.yml

@@ -0,0 +1,49 @@
+name: Publish to PyPI
+
+on:
+  release:
+    types: [published]
+  workflow_dispatch:
+
+jobs:
+  build:
+    name: Build distribution artefacts
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          enable-cache: true
+
+      - name: Build sdist and wheel
+        run: uv build
+
+      - name: Store distribution artefacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: python-package-distributions
+          path: dist/
+
+  pypi-publish:
+    name: Upload release to PyPI
+    needs: [build]
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/rhada
+    permissions:
+      id-token: write  # Mandatory for PyPI Trusted Publishing (OIDC)
+
+    steps:
+      - name: Download distribution artefacts
+        uses: actions/download-artifact@v4
+        with:
+          name: python-package-distributions
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/

rhada-0.0.1/.gitignore

@@ -0,0 +1,39 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+
+# Virtual environments
+.venv/
+venv/
+ENV/
+env/
+
+# Unit test / coverage / linter caches
+.coverage
+.coverage.*
+htmlcov/
+.pytest_cache/
+.ruff_cache/
+.mypy_cache/

rhada-0.0.1/PKG-INFO

@@ -0,0 +1,160 @@
+Metadata-Version: 2.5
+Name: rhada
+Version: 0.0.1
+Summary: Legal compliance, SBOM generation, binary linkage verification, and security vulnerability auditor for Python source workspaces and compiled Nuitka/PyInstaller distributions.
+Project-URL: Homepage, https://github.com/dcollison/rhada
+Project-URL: Repository, https://github.com/dcollison/rhada
+Project-URL: Issues, https://github.com/dcollison/rhada/issues
+Author: Rhada DevSecOps Team
+License-Expression: Apache-2.0
+Keywords: compliance,cyclonedx,elf,nuitka,osv,pip-audit,pyinstaller,rhada,sbom,security,spdx,typer,uv,vulnerability
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: Legal Industry
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Build Tools
+Classifier: Topic :: System :: Software Distribution
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Requires-Dist: cvss>=3.6
+Requires-Dist: cyclonedx-python-lib>=11.12.0
+Requires-Dist: defusedxml>=0.7.1
+Requires-Dist: httpx>=0.27.0
+Requires-Dist: license-expression>=30.4.4
+Requires-Dist: packageurl-python>=0.17.6
+Requires-Dist: packaging>=24.0
+Requires-Dist: pip-audit>=2.10.1
+Requires-Dist: pyelftools>=0.31
+Requires-Dist: rich>=13.7.0
+Requires-Dist: typer>=0.27.3
+Description-Content-Type: text/markdown
+
+# Rhada
+
+Rhada is a compliance, Software Bill of Materials (SBOM), binary linkage, and security vulnerability auditor for Python source workspaces and compiled Linux distributions (Nuitka and PyInstaller).
+
+## Overview
+
+1. **Dual-Mode Operation**
+   - **Source Mode (default when `--dist` is omitted):** Inspects a `uv` workspace (`pyproject.toml`, `uv.lock`, and `.venv/lib/.../site-packages/*.dist-info`) to separate transitive runtime dependencies from development and build dependencies, extract SPDX licence metadata, and check for security advisories.
+   - **Compiled Distribution Mode (`--dist <path>`):** Audits Nuitka and PyInstaller artefacts, including standalone directories (`app.dist/`, `dist/app/`) and monolithic single-file binaries (`app.bin`). Identifies bundled Python modules (excluding build and test tools such as `pytest`, `ruff`, `mypy`, `nuitka`, and `pyinstaller`), inspects bundled native shared libraries (`.so`), and verifies ELF dynamic linkage.
+
+2. **Legal and Licence Compliance**
+   - Parses and normalises `METADATA` licence headers, PEP 639 `License-Expression` fields, Trove classifiers, and verbatim licence texts into canonical SPDX identifiers and compound expressions (`MIT OR Apache-2.0`, `GPL-2.0-only AND BSD-3-Clause`) using `license-expression`.
+   - Categorises licence risk (`permissive`, `public-domain`, `weak-copyleft`, `strong-copyleft`, `proprietary`, `unknown`) and evaluates redistribution rules:
+     - Flags strong copyleft (`GPL-*`, `AGPL-*`, `SSPL-1.0`) obligations (`LIC-COP-STRONG`, `LIC-COP-NETWORK`).
+     - Detects LGPL relinking issues (`LIC-LGPL-MONOLITHIC`) when weak-copyleft libraries are statically compiled or embedded into monolithic binaries without dynamic `.so` relinking support.
+   - Generates a `THIRD_PARTY_NOTICES` attribution file containing component inventory, copyright notices, `NOTICE` / `AUTHORS` files, and verbatim licence texts.
+
+3. **ELF Binary and Native Library Inspection**
+   - Parses 32-bit and 64-bit ELF executables and `.so` libraries via `pyelftools` with a `struct` fallback for stripped or header-truncated binaries.
+   - Extracts `DT_NEEDED`, `DT_SONAME`, `DT_RPATH`, `DT_RUNPATH`, `PT_INTERP`, exported symbols (`PyInit_*`, `modulecode_*`), and embedded library version strings (`OpenSSL`, `zlib`, `SQLite`, `libffi`, `gmp`, `readline`, etc.).
+   - Verifies whether each `DT_NEEDED` shared library is resolved within the distribution, satisfied by the baseline Linux/glibc ABI, or missing as an unbundled external dependency, and flags insecure RPATH/RUNPATH tokens.
+
+4. **Security Vulnerability Auditing**
+   - Integrates `pip-audit` (`OsvService` and `ResolvedDependency`) alongside the OSV.dev batch API (`/v1/querybatch`) and advisory endpoints (`/v1/vulns/{id}`) for discovered Python packages and versioned native libraries.
+   - Calculates CVSS v3.0/v3.1 base scores using `cvss` and summarises findings by severity (`CRITICAL`, `HIGH`, `MEDIUM`, `LOW`) with fixed version recommendations.
+
+5. **Standards-Compliant SBOMs and CLI Exit Codes**
+   - Generates **CycloneDX 1.5 JSON** (via `cyclonedx-python-lib` and `packageurl-python`) and **SPDX 2.3 JSON** SBOMs.
+   - Provides a typed CLI built with `typer` and deterministic exit codes for CI/CD enforcement.
+
+## Installation
+
+Manage and install with [`uv`](https://docs.astral.sh/uv/):
+
+```bash
+# Install dependencies and synchronise virtual environment
+uv sync
+
+# Run via uv
+uv run rhada --help
+```
+
+## CLI Usage
+
+### 1. Audit a Python / `uv` Source Workspace
+
+```bash
+uv run rhada --project . \
+  --sbom sbom.cdx.json \
+  --notices THIRD_PARTY_NOTICES
+```
+
+### 2. Audit a Compiled Nuitka or PyInstaller Distribution
+
+```bash
+# Standalone directory (Nuitka .dist or PyInstaller folder)
+uv run rhada --project . --dist ./build/app.dist \
+  --sbom dist-sbom.json \
+  --sbom-format cyclonedx \
+  --notices dist/THIRD_PARTY_NOTICES \
+  --fail-on-linkage
+
+# Monolithic single-file binary (PyInstaller onefile or Nuitka onefile)
+uv run rhada --project . --dist ./dist/app-linux-x86_64 \
+  --sbom dist-sbom.spdx.json \
+  --sbom-format spdx \
+  --notices dist/THIRD_PARTY_NOTICES
+```
+
+### 3. Subcommands
+
+```bash
+# Generate SBOM to stdout or file
+uv run rhada sbom --project . --format spdx --output sbom.spdx.json
+
+# Generate THIRD_PARTY_NOTICES
+uv run rhada notices --project . --dist ./build/app.dist --output THIRD_PARTY_NOTICES
+
+# Inspect ELF binaries and DT_NEEDED linkage directly
+uv run rhada inspect-elf ./build/app.dist
+```
+
+## Exit Codes
+
+| Exit Code | Enum Name | Meaning |
+| :---: | :--- | :--- |
+| `0` | `OK` | Audit passed all security, licence, and binary linkage policies. |
+| `1` | `VULNERABILITY_FAILURE` | One or more vulnerabilities met or exceeded `--fail-on-severity` (default: `high`). |
+| `2` | `LICENSE_FAILURE` | One or more licence compliance findings met or exceeded `--fail-on-licence` / `--fail-on-license` (default: `high`). |
+| `3` | `COMBINED_POLICY_FAILURE` | Both vulnerability and licence compliance thresholds were breached. |
+| `4` | `LINKAGE_FAILURE` | `--fail-on-linkage` was set and unbundled external `DT_NEEDED` libraries or insecure RPATHs were found. |
+| `5` | `USAGE_OR_IO_ERROR` | Invalid CLI arguments or unreadable target paths. |
+
+### GitHub Actions CI Example
+
+```yaml
+jobs:
+  compliance-and-security-gate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v4
+      - name: Run Rhada Audit and Generate Release Artefacts
+        run: |
+          uv run rhada audit \
+            --project . \
+            --dist ./dist/my-service.dist \
+            --sbom ./dist/sbom.cdx.json \
+            --notices ./dist/THIRD_PARTY_NOTICES \
+            --report-json ./dist/rhada-report.json \
+            --fail-on-severity high \
+            --fail-on-licence high \
+            --fail-on-linkage
+```
+
+## Running Tests
+
+```bash
+uv run pytest -v
+```

rhada-0.0.1/README.md

@@ -0,0 +1,120 @@
+# Rhada
+
+Rhada is a compliance, Software Bill of Materials (SBOM), binary linkage, and security vulnerability auditor for Python source workspaces and compiled Linux distributions (Nuitka and PyInstaller).
+
+## Overview
+
+1. **Dual-Mode Operation**
+   - **Source Mode (default when `--dist` is omitted):** Inspects a `uv` workspace (`pyproject.toml`, `uv.lock`, and `.venv/lib/.../site-packages/*.dist-info`) to separate transitive runtime dependencies from development and build dependencies, extract SPDX licence metadata, and check for security advisories.
+   - **Compiled Distribution Mode (`--dist <path>`):** Audits Nuitka and PyInstaller artefacts, including standalone directories (`app.dist/`, `dist/app/`) and monolithic single-file binaries (`app.bin`). Identifies bundled Python modules (excluding build and test tools such as `pytest`, `ruff`, `mypy`, `nuitka`, and `pyinstaller`), inspects bundled native shared libraries (`.so`), and verifies ELF dynamic linkage.
+
+2. **Legal and Licence Compliance**
+   - Parses and normalises `METADATA` licence headers, PEP 639 `License-Expression` fields, Trove classifiers, and verbatim licence texts into canonical SPDX identifiers and compound expressions (`MIT OR Apache-2.0`, `GPL-2.0-only AND BSD-3-Clause`) using `license-expression`.
+   - Categorises licence risk (`permissive`, `public-domain`, `weak-copyleft`, `strong-copyleft`, `proprietary`, `unknown`) and evaluates redistribution rules:
+     - Flags strong copyleft (`GPL-*`, `AGPL-*`, `SSPL-1.0`) obligations (`LIC-COP-STRONG`, `LIC-COP-NETWORK`).
+     - Detects LGPL relinking issues (`LIC-LGPL-MONOLITHIC`) when weak-copyleft libraries are statically compiled or embedded into monolithic binaries without dynamic `.so` relinking support.
+   - Generates a `THIRD_PARTY_NOTICES` attribution file containing component inventory, copyright notices, `NOTICE` / `AUTHORS` files, and verbatim licence texts.
+
+3. **ELF Binary and Native Library Inspection**
+   - Parses 32-bit and 64-bit ELF executables and `.so` libraries via `pyelftools` with a `struct` fallback for stripped or header-truncated binaries.
+   - Extracts `DT_NEEDED`, `DT_SONAME`, `DT_RPATH`, `DT_RUNPATH`, `PT_INTERP`, exported symbols (`PyInit_*`, `modulecode_*`), and embedded library version strings (`OpenSSL`, `zlib`, `SQLite`, `libffi`, `gmp`, `readline`, etc.).
+   - Verifies whether each `DT_NEEDED` shared library is resolved within the distribution, satisfied by the baseline Linux/glibc ABI, or missing as an unbundled external dependency, and flags insecure RPATH/RUNPATH tokens.
+
+4. **Security Vulnerability Auditing**
+   - Integrates `pip-audit` (`OsvService` and `ResolvedDependency`) alongside the OSV.dev batch API (`/v1/querybatch`) and advisory endpoints (`/v1/vulns/{id}`) for discovered Python packages and versioned native libraries.
+   - Calculates CVSS v3.0/v3.1 base scores using `cvss` and summarises findings by severity (`CRITICAL`, `HIGH`, `MEDIUM`, `LOW`) with fixed version recommendations.
+
+5. **Standards-Compliant SBOMs and CLI Exit Codes**
+   - Generates **CycloneDX 1.5 JSON** (via `cyclonedx-python-lib` and `packageurl-python`) and **SPDX 2.3 JSON** SBOMs.
+   - Provides a typed CLI built with `typer` and deterministic exit codes for CI/CD enforcement.
+
+## Installation
+
+Manage and install with [`uv`](https://docs.astral.sh/uv/):
+
+```bash
+# Install dependencies and synchronise virtual environment
+uv sync
+
+# Run via uv
+uv run rhada --help
+```
+
+## CLI Usage
+
+### 1. Audit a Python / `uv` Source Workspace
+
+```bash
+uv run rhada --project . \
+  --sbom sbom.cdx.json \
+  --notices THIRD_PARTY_NOTICES
+```
+
+### 2. Audit a Compiled Nuitka or PyInstaller Distribution
+
+```bash
+# Standalone directory (Nuitka .dist or PyInstaller folder)
+uv run rhada --project . --dist ./build/app.dist \
+  --sbom dist-sbom.json \
+  --sbom-format cyclonedx \
+  --notices dist/THIRD_PARTY_NOTICES \
+  --fail-on-linkage
+
+# Monolithic single-file binary (PyInstaller onefile or Nuitka onefile)
+uv run rhada --project . --dist ./dist/app-linux-x86_64 \
+  --sbom dist-sbom.spdx.json \
+  --sbom-format spdx \
+  --notices dist/THIRD_PARTY_NOTICES
+```
+
+### 3. Subcommands
+
+```bash
+# Generate SBOM to stdout or file
+uv run rhada sbom --project . --format spdx --output sbom.spdx.json
+
+# Generate THIRD_PARTY_NOTICES
+uv run rhada notices --project . --dist ./build/app.dist --output THIRD_PARTY_NOTICES
+
+# Inspect ELF binaries and DT_NEEDED linkage directly
+uv run rhada inspect-elf ./build/app.dist
+```
+
+## Exit Codes
+
+| Exit Code | Enum Name | Meaning |
+| :---: | :--- | :--- |
+| `0` | `OK` | Audit passed all security, licence, and binary linkage policies. |
+| `1` | `VULNERABILITY_FAILURE` | One or more vulnerabilities met or exceeded `--fail-on-severity` (default: `high`). |
+| `2` | `LICENSE_FAILURE` | One or more licence compliance findings met or exceeded `--fail-on-licence` / `--fail-on-license` (default: `high`). |
+| `3` | `COMBINED_POLICY_FAILURE` | Both vulnerability and licence compliance thresholds were breached. |
+| `4` | `LINKAGE_FAILURE` | `--fail-on-linkage` was set and unbundled external `DT_NEEDED` libraries or insecure RPATHs were found. |
+| `5` | `USAGE_OR_IO_ERROR` | Invalid CLI arguments or unreadable target paths. |
+
+### GitHub Actions CI Example
+
+```yaml
+jobs:
+  compliance-and-security-gate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v4
+      - name: Run Rhada Audit and Generate Release Artefacts
+        run: |
+          uv run rhada audit \
+            --project . \
+            --dist ./dist/my-service.dist \
+            --sbom ./dist/sbom.cdx.json \
+            --notices ./dist/THIRD_PARTY_NOTICES \
+            --report-json ./dist/rhada-report.json \
+            --fail-on-severity high \
+            --fail-on-licence high \
+            --fail-on-linkage
+```
+
+## Running Tests
+
+```bash
+uv run pytest -v
+```

rhada-0.0.1/pyproject.toml

@@ -0,0 +1,112 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "rhada"
+version = "0.0.1"
+description = "Legal compliance, SBOM generation, binary linkage verification, and security vulnerability auditor for Python source workspaces and compiled Nuitka/PyInstaller distributions."
+readme = "README.md"
+requires-python = ">=3.11"
+license = "Apache-2.0"
+authors = [
+    { name = "Rhada DevSecOps Team" }
+]
+keywords = [
+    "rhada",
+    "sbom",
+    "compliance",
+    "security",
+    "vulnerability",
+    "osv",
+    "pip-audit",
+    "cyclonedx",
+    "spdx",
+    "nuitka",
+    "pyinstaller",
+    "elf",
+    "typer",
+    "uv",
+]
+classifiers = [
+    "Development Status :: 5 - Production/Stable",
+    "Environment :: Console",
+    "Intended Audience :: Developers",
+    "Intended Audience :: Information Technology",
+    "Intended Audience :: Legal Industry",
+    "License :: OSI Approved :: Apache Software License",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Topic :: Security",
+    "Topic :: Software Development :: Build Tools",
+    "Topic :: System :: Software Distribution",
+    "Typing :: Typed",
+]
+dependencies = [
+    "cvss>=3.6",
+    "cyclonedx-python-lib>=11.12.0",
+    "defusedxml>=0.7.1",
+    "httpx>=0.27.0",
+    "license-expression>=30.4.4",
+    "packageurl-python>=0.17.6",
+    "packaging>=24.0",
+    "pip-audit>=2.10.1",
+    "pyelftools>=0.31",
+    "rich>=13.7.0",
+    "typer>=0.27.3",
+]
+
+[project.scripts]
+rhada = "rhada.cli:main"
+
+[project.urls]
+Homepage = "https://github.com/dcollison/rhada"
+Repository = "https://github.com/dcollison/rhada"
+Issues = "https://github.com/dcollison/rhada/issues"
+
+[dependency-groups]
+dev = [
+    "pytest>=8.0.0",
+    "pytest-cov>=5.0.0",
+    "ruff>=0.17.2",
+]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/rhada"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src", "."]
+addopts = "-q"
+
+[tool.ruff]
+target-version = "py311"
+line-length = 120
+
+[tool.ruff.lint]
+select = [
+    "E",
+    "F",
+    "W",
+    "I",
+    "UP",
+    "B",
+    "SIM",
+    "RUF",
+    "PERF",
+    "FURB",
+    "PIE",
+    "BLE",
+    "S",
+]
+ignore = [
+    "E501",
+    "S101",
+    "S108",
+]
+
+

rhada-0.0.1/src/rhada/__init__.py

@@ -0,0 +1,58 @@
+"""Rhada: Legal compliance, SBOM generation, and security auditor for Python and compiled distributions."""
+
+__version__ = "0.0.1"
+
+from rhada.auditor import compute_exit_code, run_audit
+from rhada.elf import is_pe_file, parse_pe_binary
+from rhada.models import (
+    AuditConfig,
+    AuditMode,
+    AuditReport,
+    BinaryInfo,
+    BinaryLinkageReport,
+    BundlerType,
+    ComplianceFinding,
+    Component,
+    ComponentScope,
+    ComponentType,
+    ConsoleFormat,
+    DistributionLayout,
+    ElfBinaryInfo,
+    ExitCode,
+    LicenseInfo,
+    LicenseRiskCategory,
+    LinkageIssue,
+    LinkageStatus,
+    SbomFormat,
+    Severity,
+    Vulnerability,
+)
+
+__all__ = [
+    "AuditConfig",
+    "AuditMode",
+    "AuditReport",
+    "BinaryInfo",
+    "BinaryLinkageReport",
+    "BundlerType",
+    "ComplianceFinding",
+    "Component",
+    "ComponentScope",
+    "ComponentType",
+    "ConsoleFormat",
+    "DistributionLayout",
+    "ElfBinaryInfo",
+    "ExitCode",
+    "LicenseInfo",
+    "LicenseRiskCategory",
+    "LinkageIssue",
+    "LinkageStatus",
+    "SbomFormat",
+    "Severity",
+    "Vulnerability",
+    "__version__",
+    "compute_exit_code",
+    "is_pe_file",
+    "parse_pe_binary",
+    "run_audit",
+]