sandbox-cli 0.3.2__tar.gz → 0.3.3__tar.gz

{sandbox_cli-0.3.2 → sandbox_cli-0.3.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: sandbox-cli
-Version: 0.3.2
+Version: 0.3.3
 Summary: Command line tool for interaction with sandboxes
 Project-URL: Homepage, https://github.com/Security-Experts-Community/sandbox-cli
 Project-URL: Documentation, https://security-experts-community.github.io/sandbox-cli
@@ -15,7 +15,7 @@ Requires-Dist: aiofiles>=25.1.0
 Requires-Dist: asyncssh>=2.24.0
 Requires-Dist: colorama>=0.4.6
 Requires-Dist: cryptography>=50.0.0
-Requires-Dist: cyclopts>=4.23.3
+Requires-Dist: cyclopts>=4.25.0
 Requires-Dist: docker>=7.2.0
 Requires-Dist: ptsandbox>=5.1.5
 Requires-Dist: rich>=15.0.0

{sandbox_cli-0.3.2 → sandbox_cli-0.3.3}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "sandbox-cli"
-version = "0.3.2"
+version = "0.3.3"
 description = "Command line tool for interaction with sandboxes"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -12,7 +12,7 @@ dependencies = [
   "asyncssh>=2.24.0",
   "colorama>=0.4.6",
   "cryptography>=50.0.0",
-  "cyclopts>=4.23.3",
+  "cyclopts>=4.25.0",
   "docker>=7.2.0",
   "ptsandbox>=5.1.5",
   "rich>=15.0.0",

{sandbox_cli-0.3.2 → sandbox_cli-0.3.3}/sandbox_cli/cli/download/artifacts.py

@@ -229,6 +229,15 @@ async def download_command(
             group="Download options",
         ),
     ] = False,
+    sample: Annotated[
+        bool,
+        Parameter(
+            name=["--sample", "-s"],
+            help="Download the original sample submitted for analysis",
+            negative="",
+            group="Download options",
+        ),
+    ] = False,
     query: Annotated[
         str | None,
         Parameter(
@@ -281,6 +290,7 @@ async def download_command(
         video=video,
         amsi=amsi,
         dex=dex,
+        sample=sample,
         logs=logs,
         decompress=decompress,
     )

{sandbox_cli-0.3.2 → sandbox_cli-0.3.3}/sandbox_cli/services/downloader.py

@@ -52,6 +52,7 @@ class DownloadOptions:
     video: bool = False
     amsi: bool = False
     dex: bool = False
+    sample: bool = False
 
 
 # At first glance, it's counter-intuitive, but ArtifactType can contain not only predefined fields in it, but also newly added.
@@ -348,6 +349,15 @@ async def download(
             )
         )
 
+    if options.sample:
+        for artifact in report.artifacts:
+            fi = artifact.file_info
+            if fi is None or not fi.file_uri:
+                continue
+
+            name = Path(fi.file_path).name or fi.sha256
+            add_task(out_dir, f"{name}.bin", fi.file_uri)
+
     for artifact in report.artifacts:
         for sandbox_result in artifact.get_sandbox_results():
             if sandbox_result is None or sandbox_result.details is None or sandbox_result.details.sandbox is None: