rust-audit 0.2.3__tar.gz → 0.2.5__tar.gz

{rust_audit-0.2.3/scripts/rust_audit.egg-info → rust_audit-0.2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rust-audit
-Version: 0.2.3
+Version: 0.2.5
 Summary: Static auditor and auto-fixer for AI-generated Rust traps — stubs, fake tests, swallowed errors, panic/unsafe misuse, hallucinated or typosquatted crates
 Author-email: Antonio Cantallops Alba <contact@exyonq.org>
 License-Expression: Apache-2.0
@@ -44,19 +44,28 @@ pipx install rust-audit      # or: pip install rust-audit
 rust-audit selftest          # prints `selftest PASS`
 ```
 
-From PyPI as **`rust-audit`**; the one-word alias **`rustaudit`** is the same
-package under a name that resolves to it, and both `rust-audit` and `rustaudit`
-run from either install. Nothing is fetched or executed at install time, and
+From PyPI as **`rust-audit`**, whose wheel installs both commands: `rust-audit`
+and `rustaudit` run the same module. There is no separate one-word project on
+PyPI — it answers "This project name is too similar to an existing project" —
+so the spelling is served by this package's own entry point.
+Nothing is fetched or executed at install time, and
 the wheel carries the same `rust_audit.py` as the signed release asset — so the
 verify-before-use chain below still applies to the script you download.
 
+The wheel's digest is attested by the workflow that built it, so you can check
+where it came from before running it:
+
+```bash
+gh attestation verify rust_audit-*-py3-none-any.whl -R Doken-Tokuyama/Rust-Audit
+```
+
 ## Quick start
 
 ```bash
 # 0) verify before use — check the exact audited bytes before executing them
 #    (key pin -> SSH signature -> checksum -> tag identity) and proceed only
 #    on VERIFIED (exit 0); see SECURITY.md for the pinned key and the chain
-scripts/verify_release.sh v0.2.3 ./rust_audit.py
+scripts/verify_release.sh v0.2.5 ./rust_audit.py
 
 python3 scripts/rust_audit.py selftest
 python3 scripts/rust_audit.py scan  <rust-project> --format terminal,md,json,sarif --fail-on high

{rust_audit-0.2.3 → rust_audit-0.2.5}/README.md

@@ -14,19 +14,28 @@ pipx install rust-audit      # or: pip install rust-audit
 rust-audit selftest          # prints `selftest PASS`
 ```
 
-From PyPI as **`rust-audit`**; the one-word alias **`rustaudit`** is the same
-package under a name that resolves to it, and both `rust-audit` and `rustaudit`
-run from either install. Nothing is fetched or executed at install time, and
+From PyPI as **`rust-audit`**, whose wheel installs both commands: `rust-audit`
+and `rustaudit` run the same module. There is no separate one-word project on
+PyPI — it answers "This project name is too similar to an existing project" —
+so the spelling is served by this package's own entry point.
+Nothing is fetched or executed at install time, and
 the wheel carries the same `rust_audit.py` as the signed release asset — so the
 verify-before-use chain below still applies to the script you download.
 
+The wheel's digest is attested by the workflow that built it, so you can check
+where it came from before running it:
+
+```bash
+gh attestation verify rust_audit-*-py3-none-any.whl -R Doken-Tokuyama/Rust-Audit
+```
+
 ## Quick start
 
 ```bash
 # 0) verify before use — check the exact audited bytes before executing them
 #    (key pin -> SSH signature -> checksum -> tag identity) and proceed only
 #    on VERIFIED (exit 0); see SECURITY.md for the pinned key and the chain
-scripts/verify_release.sh v0.2.3 ./rust_audit.py
+scripts/verify_release.sh v0.2.5 ./rust_audit.py
 
 python3 scripts/rust_audit.py selftest
 python3 scripts/rust_audit.py scan  <rust-project> --format terminal,md,json,sarif --fail-on high

{rust_audit-0.2.3 → rust_audit-0.2.5}/pyproject.toml

@@ -42,9 +42,9 @@ dev = ["pytest>=7.4.0"]
 
 [project.scripts]
 rust-audit = "rust_audit:main"
-# Same entry point under the one-word spelling; the `rustaudit` distribution on
-# PyPI is an alias that pulls this one in, so either name on the prompt runs
-# the same code once this package is installed.
+# Same entry point under the one-word spelling. There is no `rustaudit`
+# distribution on PyPI: it is refused as "too similar to an existing project"
+# next to `rust-audit`, so this wheel is the only place that name comes from.
 rustaudit = "rust_audit:main"
 
 [project.urls]

{rust_audit-0.2.3 → rust_audit-0.2.5/scripts/rust_audit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rust-audit
-Version: 0.2.3
+Version: 0.2.5
 Summary: Static auditor and auto-fixer for AI-generated Rust traps — stubs, fake tests, swallowed errors, panic/unsafe misuse, hallucinated or typosquatted crates
 Author-email: Antonio Cantallops Alba <contact@exyonq.org>
 License-Expression: Apache-2.0
@@ -44,19 +44,28 @@ pipx install rust-audit      # or: pip install rust-audit
 rust-audit selftest          # prints `selftest PASS`
 ```
 
-From PyPI as **`rust-audit`**; the one-word alias **`rustaudit`** is the same
-package under a name that resolves to it, and both `rust-audit` and `rustaudit`
-run from either install. Nothing is fetched or executed at install time, and
+From PyPI as **`rust-audit`**, whose wheel installs both commands: `rust-audit`
+and `rustaudit` run the same module. There is no separate one-word project on
+PyPI — it answers "This project name is too similar to an existing project" —
+so the spelling is served by this package's own entry point.
+Nothing is fetched or executed at install time, and
 the wheel carries the same `rust_audit.py` as the signed release asset — so the
 verify-before-use chain below still applies to the script you download.
 
+The wheel's digest is attested by the workflow that built it, so you can check
+where it came from before running it:
+
+```bash
+gh attestation verify rust_audit-*-py3-none-any.whl -R Doken-Tokuyama/Rust-Audit
+```
+
 ## Quick start
 
 ```bash
 # 0) verify before use — check the exact audited bytes before executing them
 #    (key pin -> SSH signature -> checksum -> tag identity) and proceed only
 #    on VERIFIED (exit 0); see SECURITY.md for the pinned key and the chain
-scripts/verify_release.sh v0.2.3 ./rust_audit.py
+scripts/verify_release.sh v0.2.5 ./rust_audit.py
 
 python3 scripts/rust_audit.py selftest
 python3 scripts/rust_audit.py scan  <rust-project> --format terminal,md,json,sarif --fail-on high

{rust_audit-0.2.3 → rust_audit-0.2.5}/scripts/rust_audit.py

@@ -48,7 +48,7 @@ import urllib.request
 from dataclasses import dataclass, field
 from pathlib import Path
 
-VERSION = "0.2.3"
+VERSION = "0.2.5"
 TOOL_NAME = "Rust Audit"
 
 SEVERITY_RANK = {"critical": 4, "high": 3, "medium": 2, "low": 1, "info": 0}

{rust_audit-0.2.3 → rust_audit-0.2.5}/tests/test_packaging.py

@@ -16,7 +16,10 @@ from pathlib import Path
 REPO = Path(__file__).resolve().parent.parent
 TOOL = REPO / "scripts" / "rust_audit.py"
 PYPROJECT = REPO / "pyproject.toml"
-ALIAS = REPO / "packaging" / "rustaudit-alias" / "pyproject.toml"
+PUBLISH_WORKFLOW = REPO / ".github" / "workflows" / "publish.yml"
+ATTEST_WORKFLOW = REPO / ".github" / "workflows" / "attest-release.yml"
+# actions/attest-build-provenance v4.2.2, pinned by commit: a tag can move.
+ATTEST_SHA = "4d101475d8b20a2381f78447822ac1eab6504dd8"
 
 
 def load_module(path=TOOL, name="rust_audit_probe"):
@@ -54,16 +57,63 @@ def test_both_commands_run_the_same_entry_point():
         "the entry point names a function the module does not define")
 
 
-def test_alias_reserves_the_one_word_name():
-    alias = tomllib.loads(ALIAS.read_text())
-    version = tool_version()
-    assert alias["project"]["name"] == "rustaudit"
-    assert alias["project"]["version"] == version
-    assert alias["project"]["dependencies"] == [f"rust-audit>={version}"]
-    assert alias["tool"]["setuptools"]["packages"] == []
-    assert "scripts" not in alias["project"], (
-        "the alias must install no commands of its own, or it could shadow the "
-        "real package's entry points")
+def test_only_one_distribution_is_published():
+    """`rustaudit` cannot be a PyPI project next to `rust-audit`.
+
+    PyPI answers a pending publisher for the one-word name with "This project
+    name is too similar to an existing project" (checked against the live API
+    on 2026-10-20), so a second distribution would fail on every release. The
+    one-word command ships from this wheel's own entry points instead; the
+    workflow must not build or upload a second project.
+    """
+    workflow = PUBLISH_WORKFLOW.read_text()
+    assert "python -m build --outdir dist/main" in workflow
+    assert "packaging/" not in workflow, (
+        "the workflow builds a second distribution, which PyPI refuses as "
+        "too similar to rust-audit")
+    assert not (REPO / "packaging").exists(), (
+        "an alias distribution reappeared under packaging/")
+
+
+def test_provenance_attestations_are_wired_in():
+    """Both channels attest a digest, from the workflow that can sign it.
+
+    `gh attestation verify` only answers for a digest some workflow run
+    signed with the repository's OIDC identity, so deleting either step
+    would silently downgrade the channel to "trust the uploader".
+    """
+    publish = PUBLISH_WORKFLOW.read_text()
+    attest = ATTEST_WORKFLOW.read_text()
+    for name, workflow in (("publish.yml", publish),
+                           ("attest-release.yml", attest)):
+        assert "id-token: write" in workflow, f"{name}: nothing to sign with"
+        assert "attestations: write" in workflow, (
+            f"{name}: the attestation would have nowhere to go")
+        assert ATTEST_SHA in workflow, (
+            f"{name}: actions/attest-build-provenance is not pinned to "
+            f"{ATTEST_SHA} — a moving tag can be retargeted")
+    assert "subject-path: dist/main/*" in publish, (
+        "the wheel and sdist are not attested where they are built")
+    assert "subject-path: assets/*" in attest, (
+        "the uploaded release assets are not attested")
+    assert "release:" in attest and "published" in attest, (
+        "release assets only exist after `release: published`")
+    assert "gh release download" in attest, (
+        "the job must attest the bytes that were actually uploaded")
+
+
+def test_security_says_what_each_channel_proves():
+    security = (REPO / "SECURITY.md").read_text()
+    assert "gh attestation verify" in security, (
+        "the attestations exist but SECURITY.md never tells anyone how to "
+        "check them")
+    assert "not wired in yet" not in security, (
+        "SECURITY.md still says attestations are missing")
+    rows = [line for line in security.splitlines()
+            if line.startswith("| GitHub release asset |")
+            or line.startswith("| PyPI wheel")]
+    assert len(rows) == 2, (
+        "the channel table must cover the release asset and the wheel")
 
 
 def test_declared_data_files_exist():

{rust_audit-0.2.3 → rust_audit-0.2.5}/tests/test_verify_release.py

@@ -515,12 +515,6 @@ def make_cut_repo(path, keytype, keydata):
         "```bash\nscripts/verify_release.sh v0.2.0 ./rust_audit.py\n```\n")
     (path / "SKILL.md").write_text(
         "scripts/verify_release.sh v0.2.0 ./rust_audit.py\n")
-    # --cut cuts both PyPI distributions, so the alias metadata is part of its
-    # surface: without it here the version bump has nothing to edit.
-    (path / "packaging" / "rustaudit-alias").mkdir(parents=True)
-    (path / "packaging" / "rustaudit-alias" / "pyproject.toml").write_text(
-        '[project]\nname = "rustaudit"\nversion = "0.2.0"\n'
-        'dependencies = ["rust-audit>=0.2.0"]\n')
     (path / "SECURITY.md").write_text(
         f'release@rust-audit namespaces="file" {keytype} {keydata}\n')
     cmd("git", "init", "-q", path)
@@ -547,11 +541,6 @@ def test_cut_releases_in_one_command(release, tmp_path):
                     RA_REPO_ROOT=str(repo))
     assert r.returncode == 0, r.stdout + r.stderr
     assert 'VERSION = "9.9.9"' in (repo / "scripts" / "rust_audit.py").read_text()
-    alias = (repo / "packaging" / "rustaudit-alias" / "pyproject.toml").read_text()
-    assert 'version = "9.9.9"' in alias
-    assert 'rust-audit>=9.9.9' in alias, (
-        "the alias dependency floor must follow the tag, or pip installs an "
-        "older rust-audit behind the alias")
     for doc in ("README.md", "SKILL.md"):
         assert "verify_release.sh v9.9.9" in (repo / doc).read_text()
     assert cmd("git", "-C", origin, "rev-parse", "v9.9.9").returncode == 0