rust-audit 0.2.4__tar.gz → 0.2.6__tar.gz

{rust_audit-0.2.4 → rust_audit-0.2.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rust-audit
-Version: 0.2.4
+Version: 0.2.6
 Summary: Static auditor and auto-fixer for AI-generated Rust traps — stubs, fake tests, swallowed errors, panic/unsafe misuse, hallucinated or typosquatted crates
 Author-email: Antonio Cantallops Alba <contact@exyonq.org>
 License-Expression: Apache-2.0
@@ -52,13 +52,20 @@ Nothing is fetched or executed at install time, and
 the wheel carries the same `rust_audit.py` as the signed release asset — so the
 verify-before-use chain below still applies to the script you download.
 
+The wheel's digest is attested by the workflow that built it, so you can check
+where it came from before running it:
+
+```bash
+gh attestation verify rust_audit-*-py3-none-any.whl -R Doken-Tokuyama/Rust-Audit
+```
+
 ## Quick start
 
 ```bash
 # 0) verify before use — check the exact audited bytes before executing them
 #    (key pin -> SSH signature -> checksum -> tag identity) and proceed only
 #    on VERIFIED (exit 0); see SECURITY.md for the pinned key and the chain
-scripts/verify_release.sh v0.2.4 ./rust_audit.py
+scripts/verify_release.sh v0.2.6 ./rust_audit.py
 
 python3 scripts/rust_audit.py selftest
 python3 scripts/rust_audit.py scan  <rust-project> --format terminal,md,json,sarif --fail-on high
@@ -86,6 +93,18 @@ python3 -m venv .venv && .venv/bin/pip install pytest
 .venv/bin/python -m pytest tests/
 ```
 
+CI runs exactly that on every push to `main`, every `v*` release tag and every
+pull request (`.github/workflows/tests.yml`: Python 3.11 and 3.13, pytest as
+the only install), so a commit is verified without anyone remembering to type
+it. `tests/test_ci_workflows.py` keeps the job honest: it must exist, it must
+run this suite, it may not swallow a failure, and every action is pinned to
+one commit SHA across all workflows. A second job audits the **published
+artifact**: `python -m build`, install with `--no-index` into a clean venv,
+`rust-audit selftest`, then the golden scan from both the wheel and the
+checkout, which `scripts/check_wheel_parity.py` requires to agree. What the
+jobs prove — and what they do not, including why they cannot block a direct
+push to `main` — is in [docs/ci.md](docs/ci.md).
+
 See [SKILL.md](SKILL.md) for the rule catalog (R01–R21), the auto-fix policy,
 the CI templates and the honest limitations.
 

{rust_audit-0.2.4 → rust_audit-0.2.6}/README.md

@@ -22,13 +22,20 @@ Nothing is fetched or executed at install time, and
 the wheel carries the same `rust_audit.py` as the signed release asset — so the
 verify-before-use chain below still applies to the script you download.
 
+The wheel's digest is attested by the workflow that built it, so you can check
+where it came from before running it:
+
+```bash
+gh attestation verify rust_audit-*-py3-none-any.whl -R Doken-Tokuyama/Rust-Audit
+```
+
 ## Quick start
 
 ```bash
 # 0) verify before use — check the exact audited bytes before executing them
 #    (key pin -> SSH signature -> checksum -> tag identity) and proceed only
 #    on VERIFIED (exit 0); see SECURITY.md for the pinned key and the chain
-scripts/verify_release.sh v0.2.4 ./rust_audit.py
+scripts/verify_release.sh v0.2.6 ./rust_audit.py
 
 python3 scripts/rust_audit.py selftest
 python3 scripts/rust_audit.py scan  <rust-project> --format terminal,md,json,sarif --fail-on high
@@ -56,6 +63,18 @@ python3 -m venv .venv && .venv/bin/pip install pytest
 .venv/bin/python -m pytest tests/
 ```
 
+CI runs exactly that on every push to `main`, every `v*` release tag and every
+pull request (`.github/workflows/tests.yml`: Python 3.11 and 3.13, pytest as
+the only install), so a commit is verified without anyone remembering to type
+it. `tests/test_ci_workflows.py` keeps the job honest: it must exist, it must
+run this suite, it may not swallow a failure, and every action is pinned to
+one commit SHA across all workflows. A second job audits the **published
+artifact**: `python -m build`, install with `--no-index` into a clean venv,
+`rust-audit selftest`, then the golden scan from both the wheel and the
+checkout, which `scripts/check_wheel_parity.py` requires to agree. What the
+jobs prove — and what they do not, including why they cannot block a direct
+push to `main` — is in [docs/ci.md](docs/ci.md).
+
 See [SKILL.md](SKILL.md) for the rule catalog (R01–R21), the auto-fix policy,
 the CI templates and the honest limitations.
 

{rust_audit-0.2.4 → rust_audit-0.2.6}/scripts/rust_audit.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rust-audit
-Version: 0.2.4
+Version: 0.2.6
 Summary: Static auditor and auto-fixer for AI-generated Rust traps — stubs, fake tests, swallowed errors, panic/unsafe misuse, hallucinated or typosquatted crates
 Author-email: Antonio Cantallops Alba <contact@exyonq.org>
 License-Expression: Apache-2.0
@@ -52,13 +52,20 @@ Nothing is fetched or executed at install time, and
 the wheel carries the same `rust_audit.py` as the signed release asset — so the
 verify-before-use chain below still applies to the script you download.
 
+The wheel's digest is attested by the workflow that built it, so you can check
+where it came from before running it:
+
+```bash
+gh attestation verify rust_audit-*-py3-none-any.whl -R Doken-Tokuyama/Rust-Audit
+```
+
 ## Quick start
 
 ```bash
 # 0) verify before use — check the exact audited bytes before executing them
 #    (key pin -> SSH signature -> checksum -> tag identity) and proceed only
 #    on VERIFIED (exit 0); see SECURITY.md for the pinned key and the chain
-scripts/verify_release.sh v0.2.4 ./rust_audit.py
+scripts/verify_release.sh v0.2.6 ./rust_audit.py
 
 python3 scripts/rust_audit.py selftest
 python3 scripts/rust_audit.py scan  <rust-project> --format terminal,md,json,sarif --fail-on high
@@ -86,6 +93,18 @@ python3 -m venv .venv && .venv/bin/pip install pytest
 .venv/bin/python -m pytest tests/
 ```
 
+CI runs exactly that on every push to `main`, every `v*` release tag and every
+pull request (`.github/workflows/tests.yml`: Python 3.11 and 3.13, pytest as
+the only install), so a commit is verified without anyone remembering to type
+it. `tests/test_ci_workflows.py` keeps the job honest: it must exist, it must
+run this suite, it may not swallow a failure, and every action is pinned to
+one commit SHA across all workflows. A second job audits the **published
+artifact**: `python -m build`, install with `--no-index` into a clean venv,
+`rust-audit selftest`, then the golden scan from both the wheel and the
+checkout, which `scripts/check_wheel_parity.py` requires to agree. What the
+jobs prove — and what they do not, including why they cannot block a direct
+push to `main` — is in [docs/ci.md](docs/ci.md).
+
 See [SKILL.md](SKILL.md) for the rule catalog (R01–R21), the auto-fix policy,
 the CI templates and the honest limitations.
 

{rust_audit-0.2.4 → rust_audit-0.2.6}/scripts/rust_audit.egg-info/SOURCES.txt

@@ -12,8 +12,12 @@ scripts/rust_audit.egg-info/requires.txt
 scripts/rust_audit.egg-info/top_level.txt
 templates/deny.toml
 tests/test_check_skill_sync.py
+tests/test_check_wheel_parity.py
+tests/test_ci_workflows.py
 tests/test_interpreter_guard.py
 tests/test_packaging.py
 tests/test_production_e2e.py
+tests/test_report_identity.py
 tests/test_skill_wrapper_cli.py
+tests/test_sync_installed_copies.py
 tests/test_verify_release.py

{rust_audit-0.2.4 → rust_audit-0.2.6}/scripts/rust_audit.py

@@ -48,9 +48,29 @@ import urllib.request
 from dataclasses import dataclass, field
 from pathlib import Path
 
-VERSION = "0.2.4"
+VERSION = "0.2.6"
 TOOL_NAME = "Rust Audit"
 
+# Identity of the file that is actually running. Two copies of this auditor
+# print the same shapes and the same version string, so a report that does not
+# carry the digest cannot say which engine produced it — the 0.1.0 copy left in
+# a skill tree and the released wheel would look identical.
+_ENGINE_IDENTITY: dict[str, str] | None = None
+
+
+def engine_identity() -> dict[str, str]:
+    """`{version, path, sha256}` of the running module, computed once."""
+    global _ENGINE_IDENTITY
+    if _ENGINE_IDENTITY is None:
+        path = Path(__file__).resolve()
+        try:
+            digest = hashlib.sha256(path.read_bytes()).hexdigest()
+        except OSError:
+            digest = "unavailable"
+        _ENGINE_IDENTITY = {"version": VERSION, "path": str(path),
+                           "sha256": digest}
+    return _ENGINE_IDENTITY
+
 SEVERITY_RANK = {"critical": 4, "high": 3, "medium": 2, "low": 1, "info": 0}
 SEVERITY_ORDER = ["critical", "high", "medium", "low", "info"]
 
@@ -1776,7 +1796,8 @@ def render_terminal(findings: list[Finding], online_table: list[dict],
                     evidence: list[EvidenceRun], limit: int = 25) -> str:
     lines: list[str] = []
     summary = summarize(findings)
-    lines.append(f"{TOOL_NAME} v{VERSION} — summary: {summary['total']} finding(s)")
+    lines.append(f"{TOOL_NAME} v{VERSION} (sha256 {engine_identity()['sha256'][:12]}…)"
+                 f" — summary: {summary['total']} finding(s)")
     for sev in SEVERITY_ORDER:
         if summary["by_severity"].get(sev):
             lines.append(f"  {sev.upper():8s} {summary['by_severity'][sev]}")
@@ -1810,6 +1831,7 @@ def render_markdown(findings: list[Finding], online_table: list[dict],
         f"# {TOOL_NAME} report — `{target}`",
         "",
         f"Generated: {time.strftime('%Y-%m-%d %H:%M:%S')} — tool version {VERSION}",
+        f"Engine: `{engine_identity()['path']}` — sha256 `{engine_identity()['sha256']}`",
         "",
         "## Summary",
         "",
@@ -1876,6 +1898,7 @@ def render_json(findings: list[Finding], online_table: list[dict],
     payload = {
         "tool": TOOL_NAME,
         "version": VERSION,
+        "engine": engine_identity(),
         "generated_at": time.strftime("%Y-%m-%dT%H:%M:%S"),
         "target": target,
         "summary": summarize(findings),
@@ -1919,6 +1942,8 @@ def render_sarif(findings: list[Finding]) -> str:
             "name": TOOL_NAME,
             "version": VERSION,
             "informationUri": "https://github.com/rust-secure-code/",
+            "properties": {"rustAuditSha256": engine_identity()["sha256"],
+                           "rustAuditPath": engine_identity()["path"]},
             "rules": rules,
         }}, "results": results}],
     }, indent=2)
@@ -2604,7 +2629,8 @@ def write_gap_report(out_dir: Path, cmd: str, target: str,
     lines = [
         f"# {TOOL_NAME} — NOT-EXECUTED checks report ({date})",
         "",
-        f"Generated: {time.strftime('%Y-%m-%d %H:%M:%S')} — tool {VERSION} — command: `{cmd}` — target: `{target}`",
+        f"Generated: {time.strftime('%Y-%m-%d %H:%M:%S')} — tool {VERSION} "
+        f"(sha256 {engine_identity()['sha256']}) — command: `{cmd}` — target: `{target}`",
         "",
         "This file lists every check that could **not** be executed in this run",
         "(missing tool, network not used, or feature not requested) together with",
@@ -2670,7 +2696,8 @@ def write_gap_report(out_dir: Path, cmd: str, target: str,
         "", "## Environment", "",
         f"- python: {sys.version.split()[0]} ({sys.platform})",
         f"- cargo: {cargo_ver if cargo_ok else 'NOT INSTALLED'}",
-        f"- {TOOL_NAME}: {VERSION}",
+        f"- {TOOL_NAME}: {VERSION} (sha256 {engine_identity()['sha256']})",
+        f"- engine: {engine_identity()['path']}",
     ]
     path.write_text("\n".join(lines) + "\n", encoding="utf-8")
     return path

{rust_audit-0.2.4 → rust_audit-0.2.6}/tests/test_check_skill_sync.py

@@ -19,6 +19,7 @@ import pytest
 
 REPO = Path(__file__).resolve().parent.parent
 TOOL = REPO / "scripts" / "check_skill_sync.py"
+ENGINE = REPO / "scripts" / "rust_audit.py"
 ACCOUNT = "a" * 64
 SKILL = b"---\nname: demo\n---\n\nBody of the skill.\n"
 FAMILY = b"---\nname: other\n---\n\nOther body.\n"
@@ -34,6 +35,12 @@ def run(root, *extra):
                           timeout=120)
 
 
+def terminal(root, *extra):
+    """The rendered model, for the output contract."""
+    return subprocess.run([sys.executable, str(TOOL), str(root), *extra],
+                          capture_output=True, text=True, timeout=120)
+
+
 def model(root, *extra):
     result = run(root, *extra)
     return result, json.loads(result.stdout)
@@ -197,14 +204,14 @@ def test_repo_cross_check_flags_a_stale_canonical(tmp_path):
 def test_terminal_output_renders_the_model_without_json(tmp_path):
     root = tmp_path / "account-skills"
     write_registry(root / ACCOUNT, {"demo": SKILL})
-    result = subprocess.run([sys.executable, str(TOOL), str(root)],
-                            capture_output=True, text=True, timeout=120)
+    result = terminal(root)
     assert result.returncode == 0, result.stderr
     text = result.stdout
     assert "revision 2" in text
     assert "live snapshot" in text and "name == sha256(current.json)" in text
     assert "rollback snapshot" in text
     assert "VERDICT consistent" in text
+    assert "engines — canonical" in text and "none found" in text
 
 
 def test_bad_json_and_missing_root_are_execution_errors(tmp_path):
@@ -238,4 +245,82 @@ def test_this_machine_is_consistent():
                          "account-skills")
     assert result.returncode == 0, json.dumps(data["findings"], indent=2)
     assert data["accounts"], "no account inspected"
+
+
+# --------------------------------------------------------------- engine copies
+# The skills half and the engine half are one verdict: instructions that name
+# a rule are useless next to an engine that predates it. These fixtures plant
+# copies of the auditor inside the scanned tree, so the machine's own copies
+# (Cursor's store, an installed wheel) can never decide the result.
+
+def plant_engine(root, *parts, engine=None):
+    """A copy of the auditor at <root>/<parts>/scripts/rust_audit.py."""
+    scripts = root.joinpath(*parts, "scripts")
+    scripts.mkdir(parents=True, exist_ok=True)
+    (scripts / "rust_audit.py").write_bytes(
+        engine if engine is not None else ENGINE.read_bytes())
+    return scripts.parent
+
+
+def test_engine_copy_under_the_root_is_reported_current(tmp_path):
+    root = tmp_path / "account-skills"
+    write_registry(root / ACCOUNT, {"demo": SKILL})
+    plant_engine(root, "bare")          # no SKILL.md: engine bytes only
+    result, data = model(root)
+    assert result.returncode == 0, result.stdout + result.stderr
+    assert data["engines"]["canonical"]["path"] == str(ENGINE.resolve())
+    assert [c["status"] for c in data["engines"]["copies"]] == ["current"]
+    text = terminal(root)
+    assert text.returncode == 0, text.stderr
+    assert "engines — canonical" in text.stdout
+    assert "current" in text.stdout
+
+
+def test_stale_engine_is_a_finding_and_names_the_version(tmp_path):
+    root = tmp_path / "account-skills"
+    write_registry(root / ACCOUNT, {"demo": SKILL})
+    plant_engine(root, "bare", engine=b'VERSION = "0.0.1"\n')
+    result, data = model(root)
+    assert result.returncode == 1, result.stdout + result.stderr
+    assert kinds(data) == ["engine-stale"]
+    assert "0.0.1" in data["findings"][0]["detail"]
+    assert data["engines"]["copies"][0]["version"] == "0.0.1"
+
+
+def test_engine_without_current_instructions_is_a_finding(tmp_path):
+    """A current engine next to stale prose is still not up to date."""
+    root = tmp_path / "account-skills"
+    write_registry(root / ACCOUNT, {"demo": SKILL})
+    tree = plant_engine(root, "skill", "rust-audit")
+    (tree / "SKILL.md").write_bytes(SKILL)
+    result, data = model(root)
+    assert result.returncode == 1, result.stdout + result.stderr
+    assert data["engines"]["copies"][0]["status"] == "current"
+    assert "engine-docs" in kinds(data)
+    assert "README.md (missing)" in data["engines"]["copies"][0]["docs"]
+
+
+def test_engines_can_be_left_out(tmp_path):
+    root = tmp_path / "account-skills"
+    write_registry(root / ACCOUNT, {"demo": SKILL})
+    plant_engine(root, "bare", engine=b'VERSION = "0.0.1"\n')
+    result, data = model(root, "--no-engines")
+    assert result.returncode == 0, result.stdout + result.stderr
+    assert "engines" not in data
+    assert data["findings"] == []
+
+
+def test_extra_engine_root_is_scanned_and_must_exist(tmp_path):
+    root = tmp_path / "account-skills"
+    write_registry(root / ACCOUNT, {"demo": SKILL})
+    elsewhere = tmp_path / "elsewhere"
+    plant_engine(elsewhere, "bare")
+    result, data = model(root, "--engine-root", str(elsewhere))
+    assert result.returncode == 0, result.stdout + result.stderr
+    assert [c["status"] for c in data["engines"]["copies"]] == ["current"]
+    assert str(elsewhere) in data["engines"]["roots"]
+    missing = run(root, "--engine-root", str(tmp_path / "nope"))
+    assert missing.returncode == 2
+    assert "no such directory" in missing.stderr
+
     assert data["accounts"][0]["live"]["materialized"] is True

rust_audit-0.2.6/tests/test_check_wheel_parity.py

@@ -0,0 +1,109 @@
+"""The wheel/checkout parity check must fail for the right reasons.
+
+`scripts/check_wheel_parity.py` is the only thing standing between "the
+installed artifact audits like the code we tested" and a CI step that compares
+two reports and always says OK. These tests feed it synthetic reports so each
+refusal is exercised: a different findings summary, a different version, a
+wheel that does not ship the audited bytes, a comparison that never installed
+anything (same engine path), and an empty audit that would otherwise agree
+with itself.
+"""
+import json
+import subprocess
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+SCRIPT = REPO / "scripts" / "check_wheel_parity.py"
+
+SUMMARY = {
+    "total": 3,
+    "by_severity": {"high": 2, "low": 1},
+    "by_rule": {"R01": 2, "R09": 1},
+}
+
+
+def report(directory: Path, *, summary=None, version="0.2.5",
+           sha="a" * 64, path="/site-packages/rust_audit.py") -> Path:
+    directory.mkdir(parents=True, exist_ok=True)
+    payload = {
+        "tool": "Rust Audit",
+        "version": version,
+        "engine": {"version": version, "path": path, "sha256": sha},
+        "summary": SUMMARY if summary is None else summary,
+        "findings": [],
+    }
+    (directory / "rust-audit-2026-10-20.json").write_text(json.dumps(payload))
+    (directory / "not-executed-2026-10-20.md").write_text("# gaps\n")
+    return directory
+
+
+def run(*args) -> subprocess.CompletedProcess:
+    return subprocess.run([sys.executable, str(SCRIPT), *map(str, args)],
+                          capture_output=True, text=True, timeout=60)
+
+
+def pair(tmp_path, **installed):
+    return (report(tmp_path / "installed", path="/venv/lib/rust_audit.py",
+                   **installed),
+            report(tmp_path / "checkout", path="/src/scripts/rust_audit.py"))
+
+
+def test_identical_reports_agree(tmp_path):
+    proc = run(*pair(tmp_path))
+    assert proc.returncode == 0, proc.stdout + proc.stderr
+    assert "PARITY OK" in proc.stdout and "3 findings" in proc.stdout
+
+
+def test_a_different_findings_summary_disagrees(tmp_path):
+    other = {"total": 4, "by_severity": {"high": 3, "low": 1},
+             "by_rule": {"R01": 3, "R09": 1}}
+    proc = run(*pair(tmp_path, summary=other))
+    assert proc.returncode == 1, proc.stdout
+    assert "DISAGREE" in proc.stderr
+    assert "installed total 4 vs checkout total 3" in proc.stderr
+
+
+def test_a_different_version_disagrees(tmp_path):
+    proc = run(*pair(tmp_path, version="0.2.4"))
+    assert proc.returncode == 1
+    assert "'0.2.4' installed vs '0.2.5'" in proc.stderr
+
+
+def test_a_wheel_that_transforms_the_module_disagrees(tmp_path):
+    proc = run(*pair(tmp_path, sha="b" * 64))
+    assert proc.returncode == 1
+    assert "does not ship the audited bytes" in proc.stderr
+
+
+def test_two_runs_of_the_same_engine_prove_nothing(tmp_path):
+    """The failure mode of a step that never installed anything."""
+    same = tmp_path / "installed"
+    report(same, path="/src/scripts/rust_audit.py")
+    checkout = report(tmp_path / "checkout", path="/src/scripts/rust_audit.py")
+    proc = run(same, checkout)
+    assert proc.returncode == 1
+    assert "nothing was installed" in proc.stderr
+
+
+def test_an_empty_audit_cannot_show_agreement(tmp_path):
+    empty = {"total": 0, "by_severity": {}, "by_rule": {}}
+    installed, checkout = pair(tmp_path)
+    report(installed, summary=empty)
+    report(checkout, summary=empty)
+    proc = run(installed, checkout)
+    assert proc.returncode == 1
+    assert "cannot show agreement" in proc.stderr
+
+
+def test_usage_and_missing_reports_exit_2(tmp_path):
+    assert run().returncode == 2
+    assert run(tmp_path / "installed").returncode == 2
+    assert run(tmp_path / "nope", tmp_path / "elsewhere").returncode == 2
+
+
+def test_the_job_in_ci_actually_calls_it():
+    """A helper nobody runs guards nothing."""
+    workflow = (REPO / ".github" / "workflows" / "tests.yml").read_text()
+    assert "scripts/check_wheel_parity.py" in workflow, (
+        "tests.yml never compares the installed wheel with the checkout")

rust_audit-0.2.6/tests/test_ci_workflows.py

@@ -0,0 +1,127 @@
+"""The CI that runs this suite must exist, keep running it, and stay pinned.
+
+A workflow is the only thing that runs the suite without a human remembering
+to, so three failure modes get a test of their own: the job disappearing or
+being narrowed to a manual trigger, the job being allowed to pass on failure
+(`|| true`, `continue-on-error`, a non-failing pytest invocation), and an
+action reference left on a moving tag — which turns "green on this commit"
+into "green on whatever upstream shipped this morning".
+
+The last test ties the matrix to the floor `pyproject.toml` declares, so a
+version bump cannot leave CI testing a Python the package no longer claims.
+"""
+import re
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+WORKFLOWS = REPO / ".github" / "workflows"
+SUITE = WORKFLOWS / "tests.yml"
+PYPROJECT = REPO / "pyproject.toml"
+USE = re.compile(r"^\s*(?:-\s+)?uses:\s*(\S+)(?:\s+#\s*(\S.*))?$")
+SHA = re.compile(r"[0-9a-f]{40}")
+
+
+def workflows():
+    return sorted(WORKFLOWS.glob("*.yml"))
+
+
+def behaviour(path):
+    """The workflow's lines, minus whole-line comments: a comment runs nothing."""
+    return "\n".join(line for line in path.read_text(encoding="utf-8").splitlines()
+                     if not line.lstrip().startswith("#"))
+
+
+def test_the_suite_runs_on_push_and_on_pull_requests():
+    text = SUITE.read_text(encoding="utf-8")
+    assert "python -m pytest" in text, "the CI job does not run the suite"
+    assert re.search(r"^on:$", text, re.M), "tests.yml has no trigger block"
+    assert "branches: [main]" in text, "pushes to main must run the suite"
+    assert "pull_request:" in text, "pull requests must run the suite"
+    assert "workflow_dispatch:" in text, "a maintainer must be able to run it"
+
+
+def test_no_workflow_can_pass_a_failing_suite():
+    for path in workflows():
+        text = behaviour(path)
+        assert "continue-on-error" not in text, f"{path.name} ignores failures"
+        assert "|| true" not in text, f"{path.name} swallows an exit status"
+        assert "--continue-on-collection-errors" not in text, (
+            f"{path.name} would hide a collection error")
+
+
+def test_every_action_is_pinned_to_a_commit():
+    """A tag or branch can move; a 40-hex commit cannot."""
+    for path in workflows():
+        for number, line in enumerate(path.read_text(encoding="utf-8").splitlines(), 1):
+            match = USE.match(line)
+            if match is None:
+                continue
+            ref, comment = match.group(1), match.group(2)
+            where = f"{path.name}:{number}"
+            assert "@" in ref, f"{where} has no version: {ref}"
+            sha = ref.rsplit("@", 1)[1]
+            assert SHA.fullmatch(sha), f"{where} {ref} is not pinned to a commit"
+            assert comment and re.match(r"(v\d|release/)", comment), (
+                f"{where} {ref} carries no readable version comment")
+
+
+def test_the_suite_also_runs_on_release_tags():
+    """A tag is what gets signed and published; the suite must cover it."""
+    text = SUITE.read_text(encoding="utf-8")
+    assert re.search(r'^\s+tags:\s*\["v\*"\]', text, re.M), (
+        "release tags do not run the suite: the signed bytes would be untested")
+
+
+def test_each_action_is_pinned_to_one_commit_everywhere():
+    """Two majors of the same action is drift nobody decided; one is policy."""
+    found = {}
+    for path in workflows():
+        for number, line in enumerate(path.read_text(encoding="utf-8").splitlines(), 1):
+            match = USE.match(line)
+            if match is None:
+                continue
+            action, _, sha = match.group(1).partition("@")
+            found.setdefault(action, []).append(
+                (sha, (match.group(2) or "").strip(), f"{path.name}:{number}"))
+    for action, uses in found.items():
+        commits = {sha for sha, _, _ in uses}
+        assert len(commits) == 1, (
+            f"{action} is pinned to {len(commits)} commits: {uses}")
+        versions = {version for _, version, _ in uses}
+        assert len(versions) == 1, (
+            f"{action} is described with {len(versions)} versions: {uses}")
+
+
+def test_the_published_artifact_is_built_installed_and_audited():
+    """AGENTS.md §6b: the wheel is a path of its own, so CI must walk it.
+
+    The job is not a second copy of the goldens: it runs the same engine and
+    the installed one over the same pinned workspace and requires the two to
+    agree, so a wheel that lost a data file, shipped other bytes or was never
+    installed (both scans naming the checkout) fails here.
+    """
+    _, sep, wheel = SUITE.read_text(encoding="utf-8").partition("\n  wheel:")
+    assert sep, "tests.yml has no job that checks the published wheel"
+    required = {
+        "python -m build": "the distribution is never built",
+        "--no-index --find-links dist":
+            "the install is allowed to fetch something else",
+        "share/rustaudit/":
+            "the job never checks where the wheel put its data files",
+        "selftest": "the installed command's selftest never runs",
+        "report/installed": "the installed engine never scans",
+        "report/checkout": "there is nothing to compare against",
+        "check_wheel_parity.py": "the two engines are never compared",
+        "needs: pytest":
+            "the wheel job inherits the goldens from the pytest job; without "
+            "`needs` a red suite no longer stops it",
+    }
+    missing = [why for needle, why in required.items() if needle not in wheel]
+    assert not missing, " / ".join(missing)
+
+
+def test_the_matrix_covers_the_declared_python_floor():
+    floor = re.search(r'^requires-python\s*=\s*">=([0-9.]+)"',
+                      PYPROJECT.read_text(encoding="utf-8"), re.M).group(1)
+    assert f'"{floor}"' in SUITE.read_text(encoding="utf-8"), (
+        f"pyproject.toml requires >= {floor} and CI never runs it")

{rust_audit-0.2.4 → rust_audit-0.2.6}/tests/test_packaging.py

@@ -17,6 +17,9 @@ REPO = Path(__file__).resolve().parent.parent
 TOOL = REPO / "scripts" / "rust_audit.py"
 PYPROJECT = REPO / "pyproject.toml"
 PUBLISH_WORKFLOW = REPO / ".github" / "workflows" / "publish.yml"
+ATTEST_WORKFLOW = REPO / ".github" / "workflows" / "attest-release.yml"
+# actions/attest-build-provenance v4.2.2, pinned by commit: a tag can move.
+ATTEST_SHA = "4d101475d8b20a2381f78447822ac1eab6504dd8"
 
 
 def load_module(path=TOOL, name="rust_audit_probe"):
@@ -72,6 +75,47 @@ def test_only_one_distribution_is_published():
         "an alias distribution reappeared under packaging/")
 
 
+def test_provenance_attestations_are_wired_in():
+    """Both channels attest a digest, from the workflow that can sign it.
+
+    `gh attestation verify` only answers for a digest some workflow run
+    signed with the repository's OIDC identity, so deleting either step
+    would silently downgrade the channel to "trust the uploader".
+    """
+    publish = PUBLISH_WORKFLOW.read_text()
+    attest = ATTEST_WORKFLOW.read_text()
+    for name, workflow in (("publish.yml", publish),
+                           ("attest-release.yml", attest)):
+        assert "id-token: write" in workflow, f"{name}: nothing to sign with"
+        assert "attestations: write" in workflow, (
+            f"{name}: the attestation would have nowhere to go")
+        assert ATTEST_SHA in workflow, (
+            f"{name}: actions/attest-build-provenance is not pinned to "
+            f"{ATTEST_SHA} — a moving tag can be retargeted")
+    assert "subject-path: dist/main/*" in publish, (
+        "the wheel and sdist are not attested where they are built")
+    assert "subject-path: assets/*" in attest, (
+        "the uploaded release assets are not attested")
+    assert "release:" in attest and "published" in attest, (
+        "release assets only exist after `release: published`")
+    assert "gh release download" in attest, (
+        "the job must attest the bytes that were actually uploaded")
+
+
+def test_security_says_what_each_channel_proves():
+    security = (REPO / "SECURITY.md").read_text()
+    assert "gh attestation verify" in security, (
+        "the attestations exist but SECURITY.md never tells anyone how to "
+        "check them")
+    assert "not wired in yet" not in security, (
+        "SECURITY.md still says attestations are missing")
+    rows = [line for line in security.splitlines()
+            if line.startswith("| GitHub release asset |")
+            or line.startswith("| PyPI wheel")]
+    assert len(rows) == 2, (
+        "the channel table must cover the release asset and the wheel")
+
+
 def test_declared_data_files_exist():
     project = tomllib.loads(PYPROJECT.read_text())
     declared = project["tool"]["setuptools"]["data-files"]

rust_audit-0.2.6/tests/test_report_identity.py

@@ -0,0 +1,102 @@
+"""Every audit report must say which engine produced it.
+
+A 0.1.0 copy sitting in a skill tree and the released wheel print the same
+shapes and the same version string; without a digest a report cannot be tied
+to the bytes that produced it, so "this audit was clean" cannot be checked
+against the engine someone actually ran. Each report format must carry the
+version, the path and the sha256 of the file that executed — and the digest
+must come from the running file, not from a constant.
+"""
+import hashlib
+import json
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+TOOL = REPO / "scripts" / "rust_audit.py"
+
+LIB_RS = "pub fn demo() -> u32 {\n    todo!()\n}\n"
+
+
+def tool_version() -> str:
+    return re.search(r'^VERSION = "([^"]+)"', TOOL.read_text(), re.M).group(1)
+
+
+def sha256(path: Path) -> str:
+    return hashlib.sha256(path.read_bytes()).hexdigest()
+
+
+def workspace(root: Path) -> Path:
+    crate = root / "ws"
+    (crate / "src").mkdir(parents=True)
+    (crate / "Cargo.toml").write_text(
+        '[package]\nname = "demo"\nversion = "0.1.0"\nedition = "2021"\n')
+    (crate / "src" / "lib.rs").write_text(LIB_RS)
+    return crate
+
+
+def scan(engine: Path, crate: Path, out: Path):
+    return subprocess.run(
+        [sys.executable, str(engine), "scan", str(crate),
+         "--format", "terminal,md,json,sarif", "--out", str(out)],
+        capture_output=True, text=True, timeout=300)
+
+
+def reports(out: Path) -> dict[str, Path]:
+    """The `rust-audit-*` artefacts by suffix (not the not-executed report)."""
+    found = {}
+    for path in sorted(out.iterdir()):
+        if path.name.startswith("rust-audit-"):
+            found[path.suffix] = path
+    return found
+
+
+def test_every_report_format_carries_the_engine_identity(tmp_path):
+    result = scan(TOOL, workspace(tmp_path), tmp_path / "report")
+    assert result.returncode in (0, 1), result.stdout + result.stderr
+    paths = reports(tmp_path / "report")
+    identity = {"version": tool_version(), "path": str(TOOL.resolve()),
+                "sha256": sha256(TOOL)}
+
+    payload = json.loads(paths[".json"].read_text())
+    assert payload["engine"] == identity
+    assert payload["version"] == identity["version"]
+
+    markdown = paths[".md"].read_text()
+    assert identity["sha256"] in markdown
+    assert f"tool version {identity['version']}" in markdown
+    assert str(TOOL.resolve()) in markdown
+
+    sarif = json.loads(paths[".sarif"].read_text())
+    driver = sarif["runs"][0]["tool"]["driver"]
+    assert driver["version"] == identity["version"]
+    assert driver["properties"]["rustAuditSha256"] == identity["sha256"]
+
+    gap = next(p for p in (tmp_path / "report").iterdir()
+               if p.name.startswith("not-executed-"))
+    gap_text = gap.read_text()
+    assert identity["sha256"] in gap_text, (
+        "the not-executed report is part of the verdict and must identify "
+        "the engine that produced it")
+
+
+def test_the_digest_is_the_running_file_not_a_constant(tmp_path):
+    """A modified copy must report its own digest, not the repository's."""
+    copy = tmp_path / "engine" / "rust_audit.py"
+    copy.parent.mkdir()
+    copy.write_bytes(TOOL.read_bytes() + b"\n# local patch\n")
+    result = scan(copy, workspace(tmp_path), tmp_path / "report")
+    assert result.returncode in (0, 1), result.stderr
+    payload = json.loads(reports(tmp_path / "report")[".json"].read_text())
+    assert payload["engine"]["sha256"] == sha256(copy)
+    assert payload["engine"]["sha256"] != sha256(TOOL)
+    assert payload["engine"]["path"] == str(copy.resolve())
+
+
+def test_the_terminal_summary_shows_the_digest(tmp_path):
+    result = scan(TOOL, workspace(tmp_path), tmp_path / "report")
+    first = result.stdout.splitlines()[0]
+    assert first.startswith("Rust Audit v" + tool_version())
+    assert sha256(TOOL)[:12] in first, first

{rust_audit-0.2.4 → rust_audit-0.2.6}/tests/test_skill_wrapper_cli.py

@@ -113,6 +113,11 @@ def test_live_copies_serve_the_repo_instructions():
         + "\n".join(f"  {f['kind']} {f.get('skill', '')}: {f['detail']}"
                     for f in model["findings"]))
     assert code == 0, model["verdict"]
+    # The engine half ran too: a model without it would call a machine with a
+    # stale copy of the auditor "up to date". Canonical must be this checkout.
+    engines = model["engines"]
+    assert Path(engines["canonical"]["path"]) == CHECK_SYNC.parent / "rust_audit.py", \
+        engines["canonical"]
     # Non-vacuous: the wrappers were actually compared with the live surfaces.
     rows = [row for acc in model["accounts"] for row in acc["skills"]]
     for name in SKILLS:

rust_audit-0.2.6/tests/test_sync_installed_copies.py

@@ -0,0 +1,260 @@
+"""Contract of scripts/sync_installed_copies.py.
+
+An agent that ships the auditor (Freebuff account skill, Cursor's agent
+store, a vendored copy) runs *its own* `scripts/rust_audit.py`. The command
+exists to make a stale engine visible and to refresh it, so its exit codes
+must mean something: 0 nothing stale · 1 stale/drift found · 2 execution
+error. These tests drive the CLI — report, `--fix`, `--force`, the error
+paths — and assert the bytes that end up on disk, because "it printed fixed"
+without the file changing would be the bug worth catching.
+"""
+import json
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+
+REPO = Path(__file__).resolve().parent.parent
+TOOL = REPO / "scripts" / "sync_installed_copies.py"
+
+ENGINE = b'VERSION = "2.0.0"\nprint("current engine")\n'
+OLD_ENGINE = b'VERSION = "1.0.0"\nprint("old engine")\n'
+CRATES = b"serde\ntokio\n"
+OLD_CRATES = b"serde\n"
+DENY = b"[advisories]\nyanked = \"deny\"\n"
+
+
+def make_tree(root, version_engine=ENGINE):
+    """A canonical checkout plus copies, laid out like a real install."""
+    canonical = root / "repo" / "scripts" / "rust_audit.py"
+    canonical.parent.mkdir(parents=True)
+    canonical.write_bytes(version_engine)
+    for rel, data in (("resources/popular_crates.txt", CRATES),
+                      ("resources/suspicious_names.txt", CRATES),
+                      ("templates/deny.toml", DENY)):
+        path = root / "repo" / rel
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_bytes(data)
+
+    def copy(name, engine, crates=CRATES, deny=DENY):
+        base = root / "agents" / name
+        (base / "scripts").mkdir(parents=True)
+        (base / "scripts" / "rust_audit.py").write_bytes(engine)
+        for rel, data in (("resources/popular_crates.txt", crates),
+                          ("resources/suspicious_names.txt", crates),
+                          ("templates/deny.toml", deny)):
+            path = base / rel
+            path.parent.mkdir(parents=True, exist_ok=True)
+            path.write_bytes(data)
+        return base
+
+    copy("ok", ENGINE)
+    copy("old", OLD_ENGINE, OLD_CRATES, b"[advisories]\n")
+    copy("drift", ENGINE.replace(b"current engine", b"patched engine"))
+    copy("ahead", b'VERSION = "3.0.0"\nprint("newer engine")\n')
+    return canonical
+
+
+def run(*args):
+    return subprocess.run([sys.executable, str(TOOL), *args],
+                          capture_output=True, text=True, timeout=120)
+
+
+def report(root, *extra):
+    result = run("--canonical", str(root / "repo" / "scripts" / "rust_audit.py"),
+                 "--root", str(root / "agents"), "--json", *extra)
+    return result, json.loads(result.stdout) if result.stdout else None
+
+
+def statuses(model):
+    return {Path(row["path"]).parent.parent.name: row["status"]
+            for row in model["copies"]}
+
+
+def test_report_names_every_copy_and_its_state(tmp_path):
+    make_tree(tmp_path)
+    result, model = report(tmp_path)
+    assert result.returncode == 1, result.stderr
+    assert model["canonical"]["version"] == "2.0.0"
+    assert statuses(model) == {"ok": "current", "old": "stale",
+                               "drift": "drift", "ahead": "newer"}
+    human = run("--canonical", str(tmp_path / "repo" / "scripts" / "rust_audit.py"),
+                "--root", str(tmp_path / "agents"))
+    assert human.returncode == 1
+    assert "rerun with --fix" in human.stdout
+
+
+def test_fix_refreshes_the_engine_and_the_runtime_data(tmp_path):
+    root = tmp_path
+    make_tree(root)
+    # Only the stale copy is present, so a clean run can exit 0.
+    for name in ("drift", "ahead"):
+        shutil.rmtree(root / "agents" / name)
+
+    result, model = report(root, "--fix")
+    assert result.returncode == 0, result.stderr + result.stdout
+    assert statuses(model) == {"ok": "current", "old": "fixed"}
+    old = root / "agents" / "old"
+    assert (old / "scripts" / "rust_audit.py").read_bytes() == ENGINE
+    assert (old / "resources" / "popular_crates.txt").read_bytes() == CRATES
+    assert (old / "templates" / "deny.toml").read_bytes() == DENY
+
+
+def test_drift_is_reported_and_never_overwritten_without_force(tmp_path):
+    make_tree(tmp_path)
+    patched = (tmp_path / "agents" / "drift" / "scripts" / "rust_audit.py").read_bytes()
+    result, model = report(tmp_path, "--fix")
+    assert result.returncode == 1
+    assert statuses(model)["drift"] == "drift"
+    assert (tmp_path / "agents" / "drift" / "scripts" / "rust_audit.py").read_bytes() == patched
+
+    forced, model = report(tmp_path, "--fix", "--force")
+    assert forced.returncode == 0, forced.stderr
+    assert statuses(model)["drift"] == "fixed"
+    assert (tmp_path / "agents" / "drift" / "scripts" / "rust_audit.py").read_bytes() == ENGINE
+
+
+def test_the_canonical_engine_is_never_touched(tmp_path):
+    root = tmp_path
+    canonical = make_tree(root)
+    before = canonical.read_bytes()
+    result, model = report(root, "--fix")
+    # exit 1 because the drift copy is left alone on purpose.
+    assert result.returncode == 1, result.stderr
+    assert canonical.read_bytes() == before
+    assert all(Path(row["path"]) != canonical for row in model["copies"])
+
+
+FRONTMATTER = ("---\nname: rust-audit\ndescription: demo\n"
+               "metadata:\n  source: Rust-Audit-main.zip\n---\n")
+SKILL_BODY = "# Rust Audit\n\nCurrent instructions.\n"
+OLD_SKILL_BODY = "# Rust Audit\n\nOld instructions. 0.1.0 era.\n"
+
+
+def add_instructions(root, name, body=OLD_SKILL_BODY, readme="old readme\n"):
+    base = root / "agents" / name
+    (base / "SKILL.md").write_text(FRONTMATTER + "\n" + body)
+    (base / "README.md").write_text(readme)
+    (base / "docs" / "adr").mkdir(parents=True, exist_ok=True)
+    (base / "docs" / "adr" / "0001-a.md").write_text("old adr\n")
+    return base
+
+
+def add_repo_docs(root, body=SKILL_BODY):
+    repo = root / "repo"
+    (repo / "SKILL.md").write_text(body)
+    (repo / "README.md").write_text("current readme\n")
+    (repo / "CONTEXT.md").write_text("current context\n")
+    (repo / "SECURITY.md").write_text("current security\n")
+    (repo / "docs" / "adr").mkdir(parents=True, exist_ok=True)
+    (repo / "docs" / "adr" / "0001-a.md").write_text("current adr\n")
+
+
+def docs_tree(root):
+    """A copy at the current engine whose *instructions* are from 0.1.0."""
+    make_tree(root)
+    add_repo_docs(root)
+    shutil.rmtree(root / "agents" / "drift")   # isolate the docs behaviour
+    shutil.rmtree(root / "agents" / "ahead")
+    return add_instructions(root, "ok")
+
+
+def test_instruction_drift_is_a_finding_even_with_a_current_engine(tmp_path):
+    root = tmp_path
+    docs_tree(root)
+    result, model = report(root)
+    row = {Path(r["path"]).parent.parent.name: r for r in model["copies"]}["ok"]
+    assert result.returncode == 1, result.stdout
+    assert row["status"] == "current"
+    assert row["docs"] == ["SKILL.md", "README.md", "CONTEXT.md (missing)",
+                           "SECURITY.md (missing)", "docs/adr/0001-a.md"]
+
+
+def test_fix_aligns_the_instructions_and_keeps_the_frontmatter(tmp_path):
+    root = tmp_path
+    base = docs_tree(root)
+    result, model = report(root, "--fix")
+    assert result.returncode == 0, result.stderr + result.stdout
+    text = (base / "SKILL.md").read_text()
+    assert text.startswith(FRONTMATTER), "the target's identity was overwritten"
+    assert text.endswith(SKILL_BODY), text[-120:]
+    assert (base / "README.md").read_text() == "current readme\n"
+    assert (base / "SECURITY.md").read_text() == "current security\n"
+    assert (base / "docs" / "adr" / "0001-a.md").read_text() == "current adr\n"
+    rows = {Path(r["path"]).parent.parent.name: r for r in model["copies"]}
+    assert rows["ok"]["status"] == "fixed"
+    assert rows["ok"]["docs"] == []
+
+
+def test_a_document_the_readme_links_to_is_shipped_too(tmp_path):
+    root = tmp_path
+    base = docs_tree(root)
+    (root / "repo" / "docs" / "extra.md").write_text("extra doc\n")
+    readme = root / "repo" / "README.md"
+    readme.write_text(readme.read_text() + "See [extra](docs/extra.md).\n")
+
+    _, model = report(root)
+    row = {Path(r["path"]).parent.parent.name: r for r in model["copies"]}["ok"]
+    assert "docs/extra.md (missing)" in row["docs"], row["docs"]
+
+    result, model = report(root, "--fix")
+    assert result.returncode == 0, result.stderr
+    assert (base / "docs" / "extra.md").read_text() == "extra doc\n"
+    row = {Path(r["path"]).parent.parent.name: r for r in model["copies"]}["ok"]
+    assert row["docs"] == []
+
+
+def test_the_verify_script_the_instructions_run_is_shipped(tmp_path):
+    root = tmp_path
+    base = docs_tree(root)
+    script = root / "repo" / "scripts" / "verify_release.sh"
+    script.write_text("#!/bin/sh\necho verifying\n")
+    script.chmod(0o755)
+
+    _, model = report(root)
+    row = {Path(r["path"]).parent.parent.name: r for r in model["copies"]}["ok"]
+    assert "scripts/verify_release.sh (missing)" in row["docs"], row["docs"]
+
+    result, model = report(root, "--fix")
+    assert result.returncode == 0, result.stderr
+    shipped = base / "scripts" / "verify_release.sh"
+    assert shipped.read_text() == "#!/bin/sh\necho verifying\n"
+    assert shipped.stat().st_mode & 0o111, "the verify step is invoked directly"
+
+
+def test_a_bare_vendored_copy_reads_no_docs(tmp_path):
+    root = tmp_path
+    make_tree(root)
+    add_repo_docs(root)
+    # No SKILL.md in these trees: missing docs are not a finding, and no
+    # documentation is invented for a tree that never shipped any.
+    result, model = report(root, "--fix")
+    assert result.returncode == 1  # the drift copy is still left alone
+    assert all(not row["docs"] for row in model["copies"])
+    assert not (root / "agents" / "ok" / "README.md").exists()
+    assert not (root / "agents" / "old" / "SECURITY.md").exists()
+
+
+def test_scan_skips_vcs_directories(tmp_path):
+    make_tree(tmp_path)
+    buried = tmp_path / "agents" / ".git" / "scripts"
+    buried.mkdir(parents=True)
+    (buried / "rust_audit.py").write_bytes(OLD_ENGINE)
+    result, model = report(tmp_path)
+    assert result.returncode == 1
+    assert all(".git" not in row["path"] for row in model["copies"])
+
+
+def test_bad_inputs_are_execution_errors(tmp_path):
+    make_tree(tmp_path)
+    missing_canonical = run("--canonical", str(tmp_path / "nope.py"),
+                            "--root", str(tmp_path), "--json")
+    assert missing_canonical.returncode == 2
+    missing_root = run("--canonical",
+                       str(tmp_path / "repo" / "scripts" / "rust_audit.py"),
+                       "--root", str(tmp_path / "nope"), "--json")
+    assert missing_root.returncode == 2
+    blank = tmp_path / "blank.py"
+    blank.write_text("print('no version here')\n")
+    unversioned = run("--canonical", str(blank), "--root", str(tmp_path), "--json")
+    assert unversioned.returncode == 2