rust-audit 0.2.4__tar.gz → 0.2.5__tar.gz

{rust_audit-0.2.4/scripts/rust_audit.egg-info → rust_audit-0.2.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rust-audit
-Version: 0.2.4
+Version: 0.2.5
 Summary: Static auditor and auto-fixer for AI-generated Rust traps — stubs, fake tests, swallowed errors, panic/unsafe misuse, hallucinated or typosquatted crates
 Author-email: Antonio Cantallops Alba <contact@exyonq.org>
 License-Expression: Apache-2.0
@@ -52,13 +52,20 @@ Nothing is fetched or executed at install time, and
 the wheel carries the same `rust_audit.py` as the signed release asset — so the
 verify-before-use chain below still applies to the script you download.
 
+The wheel's digest is attested by the workflow that built it, so you can check
+where it came from before running it:
+
+```bash
+gh attestation verify rust_audit-*-py3-none-any.whl -R Doken-Tokuyama/Rust-Audit
+```
+
 ## Quick start
 
 ```bash
 # 0) verify before use — check the exact audited bytes before executing them
 #    (key pin -> SSH signature -> checksum -> tag identity) and proceed only
 #    on VERIFIED (exit 0); see SECURITY.md for the pinned key and the chain
-scripts/verify_release.sh v0.2.4 ./rust_audit.py
+scripts/verify_release.sh v0.2.5 ./rust_audit.py
 
 python3 scripts/rust_audit.py selftest
 python3 scripts/rust_audit.py scan  <rust-project> --format terminal,md,json,sarif --fail-on high

{rust_audit-0.2.4 → rust_audit-0.2.5}/README.md

@@ -22,13 +22,20 @@ Nothing is fetched or executed at install time, and
 the wheel carries the same `rust_audit.py` as the signed release asset — so the
 verify-before-use chain below still applies to the script you download.
 
+The wheel's digest is attested by the workflow that built it, so you can check
+where it came from before running it:
+
+```bash
+gh attestation verify rust_audit-*-py3-none-any.whl -R Doken-Tokuyama/Rust-Audit
+```
+
 ## Quick start
 
 ```bash
 # 0) verify before use — check the exact audited bytes before executing them
 #    (key pin -> SSH signature -> checksum -> tag identity) and proceed only
 #    on VERIFIED (exit 0); see SECURITY.md for the pinned key and the chain
-scripts/verify_release.sh v0.2.4 ./rust_audit.py
+scripts/verify_release.sh v0.2.5 ./rust_audit.py
 
 python3 scripts/rust_audit.py selftest
 python3 scripts/rust_audit.py scan  <rust-project> --format terminal,md,json,sarif --fail-on high

{rust_audit-0.2.4 → rust_audit-0.2.5/scripts/rust_audit.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rust-audit
-Version: 0.2.4
+Version: 0.2.5
 Summary: Static auditor and auto-fixer for AI-generated Rust traps — stubs, fake tests, swallowed errors, panic/unsafe misuse, hallucinated or typosquatted crates
 Author-email: Antonio Cantallops Alba <contact@exyonq.org>
 License-Expression: Apache-2.0
@@ -52,13 +52,20 @@ Nothing is fetched or executed at install time, and
 the wheel carries the same `rust_audit.py` as the signed release asset — so the
 verify-before-use chain below still applies to the script you download.
 
+The wheel's digest is attested by the workflow that built it, so you can check
+where it came from before running it:
+
+```bash
+gh attestation verify rust_audit-*-py3-none-any.whl -R Doken-Tokuyama/Rust-Audit
+```
+
 ## Quick start
 
 ```bash
 # 0) verify before use — check the exact audited bytes before executing them
 #    (key pin -> SSH signature -> checksum -> tag identity) and proceed only
 #    on VERIFIED (exit 0); see SECURITY.md for the pinned key and the chain
-scripts/verify_release.sh v0.2.4 ./rust_audit.py
+scripts/verify_release.sh v0.2.5 ./rust_audit.py
 
 python3 scripts/rust_audit.py selftest
 python3 scripts/rust_audit.py scan  <rust-project> --format terminal,md,json,sarif --fail-on high

{rust_audit-0.2.4 → rust_audit-0.2.5}/scripts/rust_audit.py

@@ -48,7 +48,7 @@ import urllib.request
 from dataclasses import dataclass, field
 from pathlib import Path
 
-VERSION = "0.2.4"
+VERSION = "0.2.5"
 TOOL_NAME = "Rust Audit"
 
 SEVERITY_RANK = {"critical": 4, "high": 3, "medium": 2, "low": 1, "info": 0}

{rust_audit-0.2.4 → rust_audit-0.2.5}/tests/test_packaging.py

@@ -17,6 +17,9 @@ REPO = Path(__file__).resolve().parent.parent
 TOOL = REPO / "scripts" / "rust_audit.py"
 PYPROJECT = REPO / "pyproject.toml"
 PUBLISH_WORKFLOW = REPO / ".github" / "workflows" / "publish.yml"
+ATTEST_WORKFLOW = REPO / ".github" / "workflows" / "attest-release.yml"
+# actions/attest-build-provenance v4.2.2, pinned by commit: a tag can move.
+ATTEST_SHA = "4d101475d8b20a2381f78447822ac1eab6504dd8"
 
 
 def load_module(path=TOOL, name="rust_audit_probe"):
@@ -72,6 +75,47 @@ def test_only_one_distribution_is_published():
         "an alias distribution reappeared under packaging/")
 
 
+def test_provenance_attestations_are_wired_in():
+    """Both channels attest a digest, from the workflow that can sign it.
+
+    `gh attestation verify` only answers for a digest some workflow run
+    signed with the repository's OIDC identity, so deleting either step
+    would silently downgrade the channel to "trust the uploader".
+    """
+    publish = PUBLISH_WORKFLOW.read_text()
+    attest = ATTEST_WORKFLOW.read_text()
+    for name, workflow in (("publish.yml", publish),
+                           ("attest-release.yml", attest)):
+        assert "id-token: write" in workflow, f"{name}: nothing to sign with"
+        assert "attestations: write" in workflow, (
+            f"{name}: the attestation would have nowhere to go")
+        assert ATTEST_SHA in workflow, (
+            f"{name}: actions/attest-build-provenance is not pinned to "
+            f"{ATTEST_SHA} — a moving tag can be retargeted")
+    assert "subject-path: dist/main/*" in publish, (
+        "the wheel and sdist are not attested where they are built")
+    assert "subject-path: assets/*" in attest, (
+        "the uploaded release assets are not attested")
+    assert "release:" in attest and "published" in attest, (
+        "release assets only exist after `release: published`")
+    assert "gh release download" in attest, (
+        "the job must attest the bytes that were actually uploaded")
+
+
+def test_security_says_what_each_channel_proves():
+    security = (REPO / "SECURITY.md").read_text()
+    assert "gh attestation verify" in security, (
+        "the attestations exist but SECURITY.md never tells anyone how to "
+        "check them")
+    assert "not wired in yet" not in security, (
+        "SECURITY.md still says attestations are missing")
+    rows = [line for line in security.splitlines()
+            if line.startswith("| GitHub release asset |")
+            or line.startswith("| PyPI wheel")]
+    assert len(rows) == 2, (
+        "the channel table must cover the release asset and the wheel")
+
+
 def test_declared_data_files_exist():
     project = tomllib.loads(PYPROJECT.read_text())
     declared = project["tool"]["setuptools"]["data-files"]