rust-audit 0.2.3__py3-none-any.whl

rust_audit-0.2.3.data/data/share/rustaudit/resources/popular_crates.txt

@@ -0,0 +1,293 @@
+# Baseline of well-known crates used for:
+#   R20 potential typosquat detection (edit distance <= 2 from a popular name)
+#   R18c near-miss suggestions ("serdee" -> "serde")
+# Keep this list mainstream and well-known. Extend it with your org's stack.
+serde
+serde_json
+serde_derive
+serde_yaml
+tokio
+tokio-util
+tokio-stream
+async-trait
+async-std
+futures
+futures-util
+mio
+rand
+rand_core
+clap
+structopt
+anyhow
+thiserror
+eyre
+color-eyre
+regex
+log
+env_logger
+tracing
+tracing-subscriber
+tracing-core
+axum
+hyper
+reqwest
+tower
+tower-http
+tonic
+prost
+warp
+actix-web
+actix-rt
+rocket
+rocket_sync_db_pools
+sqlx
+diesel
+rusqlite
+sea-orm
+chrono
+time
+uuid
+once_cell
+lazy_static
+parking_lot
+dashmap
+indexmap
+hashbrown
+itertools
+rayon
+crossbeam
+crossbeam-channel
+bytes
+smallvec
+bitflags
+libc
+winapi
+windows
+socket2
+rustls
+native-tls
+openssl
+hyper-rustls
+cookie
+mime
+url
+percent-encoding
+semver
+toml
+toml_edit
+config
+dotenv
+dotenvy
+tempfile
+walkdir
+glob
+notify
+zip
+tar
+flate2
+brotli
+zstd
+sha2
+sha1
+md5
+hmac
+base64
+hex
+jsonwebtoken
+secrecy
+zeroize
+num-traits
+num-bigint
+ordered-float
+approx
+statrs
+nalgebra
+ndarray
+image
+plotters
+criterion
+proptest
+quickcheck
+rstest
+insta
+trybuild
+mockall
+wiremock
+httpmock
+pretty_assertions
+serial_test
+claim
+static_assertions
+paste
+proc-macro2
+quote
+syn
+heck
+derive_builder
+derive_more
+strum
+enum_dispatch
+inventory
+linkme
+ctor
+pin-project
+pin-project-lite
+scopeguard
+tap
+either
+unwrap_or
+failure
+error-chain
+snafu
+color-eyre-owo
+backtrace
+eyre-proptest
+cc
+cmake
+bindgen
+cxx
+pyo3
+neon
+napi
+wasm-bindgen
+web-sys
+js-sys
+gloo
+leptos
+yew
+dioxus
+sycamore
+maud
+askama
+tera
+handlebars
+maud-markup
+handlebars_misc
+rust-embed
+include_dir
+phf
+fluent-bundle
+unic-langid
+sys-locale
+console
+indicatif
+dialoguer
+inquire
+crossterm
+termcolor
+ansi_term
+colored
+comfy-table
+tabled
+prettytable-rust
+textwrap
+unicode-width
+unicode-segmentation
+petgraph
+graph-crate
+slotmap
+slab
+typed-arena
+bumpalo
+triomphe
+elsa
+multimap
+bitvec
+fixedbitset
+ roaring
+rustc-hash
+fxhash
+ahash
+seahash
+twox-hash
+crc32fast
+adler
+miniz_oxide
+byteorder
+bincode
+postcard
+rmp-serde
+cbor4ii
+flexbuffers
+flatbuffers
+capnp
+protobuf
+avro-rs
+arrow
+parquet
+datafusion
+polars
+duckdb
+rusoto_core
+aws-config
+aws-sdk-s3
+azure_core
+google-cloud-storage
+object_store
+s3-ext
+reqwest-middleware
+reqwest-retry
+tower-http-cors
+axum-extra
+axum-login
+axum-sessions
+actix-session
+actix-cors
+actix-files
+actix-multipart
+sea-actix
+rocket_cors
+jsonwebtoken-aws
+cookie_store
+reqwest-cookie-store
+hickory-resolver
+trust-dns-resolver
+trust-dns-proto
+pnet
+etherparse
+dns-lookup
+if-addrs
+macaddr
+serialport
+hidapi
+gilrs
+rodio
+cpal
+sdl2
+glutin
+winit
+wgpu
+glium
+gfx-hal
+nalgebra-glm
+glam
+vegafusion
+plotters-backend
+plotters-svg
+textplots
+csv
+calamine
+rust_xlsxwriter
+quick-xml
+quick-xml-serde
+roxmltree
+xmltree
+html5ever
+scraper
+select
+soup
+regex-lite
+fancy-regex
+onig
+pest
+nom
+winnow
+chumsky
+lalrpop
+logos
+ariadne
+codespan-reporting
+annotate-snippets
+miette
+thiserror-impl
+anyhow-proptest

rust_audit-0.2.3.data/data/share/rustaudit/resources/suspicious_names.txt

@@ -0,0 +1,57 @@
+# Seed corpus of crate names with the generic "too plausible to be real"
+# patterns that LLMs invent (arxiv 2606.08444, USENIX Sec 2025 package
+# hallucination study) and that attackers register (slopsquatting).
+# Extend with your organization's private list via `corpus = "..."` in
+# rust-audit.toml. Also matched by pattern in the engine:
+#   ^(rust|async|simple|easy|smart|fast)[-_].*   and   .*[-_](utils?|helpers?|extensions?|extra|lite|lib|core)$
+rust-http-client
+rust-database
+rust-db
+rust-utils
+rust-helpers
+rust-orm
+rust-file-utils
+rust-json-utils
+rust-web-utils
+rust-auth-utils
+async-utils
+async-helpers
+async-utils-extra
+async-database-pool
+async-http-client
+async-helpers-rs
+file-utils
+file-helpers
+json-utils
+string-utils
+text-utils
+io-utils
+net-utils
+db-utils
+test-utils-extra
+tokio-utils-extra
+tokio-helpers
+serde-helpers
+serde-extensions
+axum-extensions
+axum-helpers
+hyper-extensions
+easy-utils
+easy-crud
+simple-crud
+simple-cache
+smart-cache
+fast-json
+fast-cache
+smart-utils
+universal-utils
+common-utils
+misc-utils
+util-rs
+helper-rs
+extra-utils
+pro-utils
+plus-utils
+mini-utils
+light-utils
+ultra-utils

rust_audit-0.2.3.data/data/share/rustaudit/templates/deny.toml

@@ -0,0 +1,27 @@
+# cargo-deny policy for AI-generated / third-party dependency control.
+# Install: cargo install cargo-deny   ·   Check: cargo deny check
+[advisories]
+vulnerability = "deny"
+unmaintained = "warn"
+yanked = "deny"
+
+[licenses]
+unlicensed = "deny"
+allow = ["MIT", "Apache-2.0", "Apache-2.0 WITH LLVM-exception", "BSD-2-Clause",
+         "BSD-3-Clause", "ISC", "Unicode-DFS-2016", "Unicode-3.0", "Zlib", "MPL-2.0"]
+
+[bans]
+multiple-versions = "warn"
+wildcards = "deny"
+
+# Block names that appear in the slopsquatting corpus or that you removed after
+# an audit. Example:
+# [[bans.deny]]
+# name = "rust-http-client"
+# reason = "Generic name matching AI-hallucination patterns; verified nonexistent"
+
+[sources]
+# Only the official crates.io registry is allowed.
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]

rust_audit-0.2.3.dist-info/METADATA

@@ -0,0 +1,109 @@
+Metadata-Version: 2.4
+Name: rust-audit
+Version: 0.2.3
+Summary: Static auditor and auto-fixer for AI-generated Rust traps — stubs, fake tests, swallowed errors, panic/unsafe misuse, hallucinated or typosquatted crates
+Author-email: Antonio Cantallops Alba <contact@exyonq.org>
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://github.com/Doken-Tokuyama/Rust-Audit
+Project-URL: Source, https://github.com/Doken-Tokuyama/Rust-Audit
+Project-URL: Issues, https://github.com/Doken-Tokuyama/Rust-Audit/issues
+Project-URL: Documentation, https://github.com/Doken-Tokuyama/Rust-Audit/blob/main/SKILL.md
+Keywords: rust,audit,linter,static-analysis,ai-generated-code,supply-chain,typosquatting,agent-skills
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: dev
+Requires-Dist: pytest>=7.4.0; extra == "dev"
+Dynamic: license-file
+
+# Rust Audit
+
+Auditor and auto-fixer for **AI-generated Rust code**: stubs, demo code, fake
+tests, fakes/mocks leaking into production, panic/unsafe misuse, swallowed
+errors, async pitfalls, and fake / hallucinated / typosquatted dependencies
+(slopsquatting).
+
+Python 3.11+ stdlib only — no dependencies. English output.
+
+## Install
+
+```bash
+pipx install rust-audit      # or: pip install rust-audit
+rust-audit selftest          # prints `selftest PASS`
+```
+
+From PyPI as **`rust-audit`**; the one-word alias **`rustaudit`** is the same
+package under a name that resolves to it, and both `rust-audit` and `rustaudit`
+run from either install. Nothing is fetched or executed at install time, and
+the wheel carries the same `rust_audit.py` as the signed release asset — so the
+verify-before-use chain below still applies to the script you download.
+
+## Quick start
+
+```bash
+# 0) verify before use — check the exact audited bytes before executing them
+#    (key pin -> SSH signature -> checksum -> tag identity) and proceed only
+#    on VERIFIED (exit 0); see SECURITY.md for the pinned key and the chain
+scripts/verify_release.sh v0.2.3 ./rust_audit.py
+
+python3 scripts/rust_audit.py selftest
+python3 scripts/rust_audit.py scan  <rust-project> --format terminal,md,json,sarif --fail-on high
+python3 scripts/rust_audit.py fix   <rust-project> --dry-run
+python3 scripts/rust_audit.py cargo <rust-project> --deep --supply-chain
+```
+
+Exit codes: `0` clean · `1` findings at/above `--fail-on` · `2` execution error.
+Every run writes a **not-executed report** (`report/not-executed-<date>.md`)
+listing the checks that could not run and how to enable them — read it before
+calling an audit complete.
+
+As a Freebuff agent skill: install `rust-audit` into Freebuff on any machine
+by following [docs/freebuff-skill-install.md](docs/freebuff-skill-install.md).
+
+## Tests
+
+Production E2E suite: the real CLI audited against real Rust workspaces
+(`BurntSushi/ripgrep` and `tokio-rs/tokio`, each pinned by commit — no demo
+fixtures), with per-project goldens. Needs network to fetch the pinned
+workspaces, Python 3.11+ and pytest in a venv:
+
+```bash
+python3 -m venv .venv && .venv/bin/pip install pytest
+.venv/bin/python -m pytest tests/
+```
+
+See [SKILL.md](SKILL.md) for the rule catalog (R01–R21), the auto-fix policy,
+the CI templates and the honest limitations.
+
+## Security
+
+The trust model is explicit: what executes (literal `cargo` argv, no shell),
+what leaves the machine (opt-in `--online` registry/OSV lookups only) and
+what writes to disk (transactional `fix`). See [SECURITY.md](SECURITY.md) —
+including the notes for static skill auditors.
+
+Release assets are **SSH-signed**: an install can verify it has the exact
+audited `rust_audit.py` with preinstalled `ssh-keygen` alone — commands and
+the pinned signing key live in [SECURITY.md](SECURITY.md#release-attestation-v020--verify-the-exact-audited-bytes).
+
+Hardened scanners can enforce the static-only contract in code: every
+subcommand accepts **`--no-exec`**, under which process creation is
+impossible (one guarded entry point refuses every spawn) and each check that
+would have executed is recorded as *skipped* in the not-executed report.
+
+## License
+
+Apache License 2.0 — see [LICENSE](LICENSE).
+Copyright (c) 2026 Antonio Cantallops Alba · contact@exyonq.org

rust_audit-0.2.3.dist-info/RECORD

@@ -0,0 +1,10 @@
+rust_audit.py,sha256=uviqZOfFKxQM3_2UdhxRoRHr0_sJp3sdbhSSUoyZ22g,136659
+rust_audit-0.2.3.data/data/share/rustaudit/resources/popular_crates.txt,sha256=sn4G4W4awe9JQX9SLLDwLIj-gRVo7fbY75r4B8h-8TE,2931
+rust_audit-0.2.3.data/data/share/rustaudit/resources/suspicious_names.txt,sha256=2JQIMWlO4XSCaT9M0d9kHSazkpzP2w0dqS3X3MuFbOI,1117
+rust_audit-0.2.3.data/data/share/rustaudit/templates/deny.toml,sha256=CIFgbr46NOEMDu0AtD9AN0Ijb9xqtD9DTze6bMpng0s,868
+rust_audit-0.2.3.dist-info/licenses/LICENSE,sha256=22J8RMtJruc-H-1IL3Tn73oc1K9m9bbg7ULWcy9W4LE,11511
+rust_audit-0.2.3.dist-info/METADATA,sha256=lW8mhxWFgicrw-6iU-3MAIbHc6Wl3daLeYFrEwkCPmA,4772
+rust_audit-0.2.3.dist-info/WHEEL,sha256=a-udL2m4V_6Yn8b-uKzWb12RjRxwwMo6ohYFM24tpaY,91
+rust_audit-0.2.3.dist-info/entry_points.txt,sha256=Em93nrEhOiF82Z7JgWPKjzKCnpbkdHij9lBxGSohWXI,75
+rust_audit-0.2.3.dist-info/top_level.txt,sha256=j1zJbd8JcYlOufL7AMO0_Rjg2wLCOthWAAf2d9wqNzA,11
+rust_audit-0.2.3.dist-info/RECORD,,

rust_audit-0.2.3.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.2.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

rust_audit-0.2.3.dist-info/entry_points.txt

@@ -0,0 +1,3 @@
+[console_scripts]
+rust-audit = rust_audit:main
+rustaudit = rust_audit:main