securityagent-core 4.18.0__tar.gz → 4.24.0__tar.gz

{securityagent_core-4.18.0/src/securityagent_core.egg-info → securityagent_core-4.24.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: securityagent-core
-Version: 4.18.0
+Version: 4.24.0
 Summary: Local-first DLP engine and security layer for AI coding agents. Secures Copilot, Claude Code, Cursor, Windsurf, and any MCP-compatible agent.
 Author-email: SecureMind <founders@securemind.live>
 License: Proprietary
@@ -41,11 +41,13 @@ Provides-Extra: ocr
 Requires-Dist: PyMuPDF; extra == "ocr"
 Requires-Dist: pytesseract; extra == "ocr"
 Requires-Dist: Pillow; extra == "ocr"
+Provides-Extra: pdf
+Requires-Dist: fpdf2; extra == "pdf"
 Provides-Extra: dev
 Requires-Dist: pytest; extra == "dev"
 Requires-Dist: moto; extra == "dev"
 Provides-Extra: all
-Requires-Dist: securityagent-core[cloud,llm,ml,ocr]; extra == "all"
+Requires-Dist: securityagent-core[cloud,llm,ml,ocr,pdf]; extra == "all"
 Dynamic: license-file
 
 # securityagent-core

{securityagent_core-4.18.0 → securityagent_core-4.24.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "securityagent-core"
-version = "4.18.0"
+version = "4.24.0"
 description = "Local-first DLP engine and security layer for AI coding agents. Secures Copilot, Claude Code, Cursor, Windsurf, and any MCP-compatible agent."
 readme = "README.md"
 license = {text = "Proprietary"}
@@ -46,8 +46,9 @@ ml = ["sentence-transformers", "scikit-learn", "joblib", "numpy"]
 cloud = ["boto3", "PyJWT", "cryptography"]
 llm = ["ollama"]
 ocr = ["PyMuPDF", "pytesseract", "Pillow"]
+pdf = ["fpdf2"]
 dev = ["pytest", "moto"]
-all = ["securityagent-core[ml,cloud,llm,ocr]"]
+all = ["securityagent-core[ml,cloud,llm,ocr,pdf]"]
 
 [tool.setuptools.packages.find]
 where = ["src"]

{securityagent_core-4.18.0 → securityagent_core-4.24.0}/src/endpoint_agent/cli.py

@@ -294,6 +294,33 @@ def cmd_demo(args):
 
 def cmd_train(args):
     """Train/retrain the ML classifier."""
+    if args.auto:
+        # Active learning: check if retraining is needed
+        print(BANNER)
+        print("  \033[1mActive Learning Check\033[0m\n")
+        from endpoint_agent.scanners.active_learner import ActiveLearner
+        learner = ActiveLearner()
+        check = learner.should_retrain()
+        print(f"  New audit entries: {check['new_entries']}")
+        print(f"  Total entries:     {check['total_entries']}")
+        print(f"  Threshold:         {learner.retrain_threshold}")
+        print(f"  Decision:          {'RETRAIN' if check['should_retrain'] else 'SKIP'}")
+        print(f"  Reason:            {check['reason']}\n")
+
+        if check["should_retrain"]:
+            result = learner.check_and_retrain()
+            if result["action"] == "retrained":
+                print(f"  \033[92mRetrained successfully!\033[0m")
+                print(f"    Intent F1: {result['intent_f1']['old']:.3f} -> {result['intent_f1']['new']:.3f}")
+                print(f"    PII F1:    {result['pii_f1']['old']:.3f} -> {result['pii_f1']['new']:.3f}")
+            elif result["action"] == "rejected":
+                print(f"  \033[93mNew model rejected:\033[0m {result['reason']}")
+            else:
+                print(f"  \033[90m{result.get('reason', 'Unknown')}\033[0m")
+        else:
+            print(f"  \033[90mNo retraining needed.\033[0m")
+        return
+
     train_script = Path.home() / "AgnosticSecurity" / "scripts" / "train_enhanced_classifier.py"
 
     if not train_script.exists():
@@ -429,6 +456,7 @@ Examples:
     # train
     train_p = subparsers.add_parser("train", help="Train/retrain ML classifier")
     train_p.add_argument("--eval", action="store_true", help="Run eval after training")
+    train_p.add_argument("--auto", action="store_true", help="Active learning: auto-retrain if enough new data")
 
     # mcp
     mcp_p = subparsers.add_parser("mcp", help="Start MCP security server")

securityagent_core-4.24.0/src/endpoint_agent/scanners/active_learner.py

@@ -0,0 +1,251 @@
+"""Active learning pipeline — auto-retrain ML classifiers from new audit data.
+
+Monitors hook_audit.jsonl for new entries since last training, retrains
+when sufficient new data accumulates, and validates before promoting.
+
+Usage:
+    from endpoint_agent.scanners.active_learner import ActiveLearner
+    learner = ActiveLearner()
+    learner.check_and_retrain()  # Called periodically or via secagent train --auto
+
+Flow:
+    1. Load last training timestamp from model metadata
+    2. Count new audit entries since then
+    3. If >= threshold (default 200), trigger retrain
+    4. Train on full dataset (old + new)
+    5. Validate: new model must beat old model's CV F1
+    6. If passes, promote; if not, keep old model
+"""
+
+import json
+import logging
+import os
+import time
+from pathlib import Path
+from typing import Dict, Optional
+
+logger = logging.getLogger(__name__)
+
+_MODEL_DIR = os.environ.get(
+    "EA_ML_MODEL_DIR",
+    os.path.join(os.path.expanduser("~"), ".agnosticsecurity", "models"),
+)
+_METADATA_PATH = os.path.join(_MODEL_DIR, "training_metadata.json")
+_INTENT_MODEL_PATH = os.path.join(_MODEL_DIR, "intent_classifier_v2.joblib")
+_PII_MODEL_PATH = os.path.join(_MODEL_DIR, "pii_context_classifier_v2.joblib")
+
+# Default audit log locations
+_AUDIT_PATHS = [
+    os.path.join(os.path.expanduser("~"), "AgnosticSecurity", "logs", "hook_audit.jsonl"),
+    os.path.join(os.path.expanduser("~"), ".securityagent", "skills_audit.jsonl"),
+]
+
+# Minimum new entries before retraining
+_RETRAIN_THRESHOLD = int(os.environ.get("EA_RETRAIN_THRESHOLD", "200"))
+# Minimum F1 improvement required to promote new model
+_MIN_F1_IMPROVEMENT = float(os.environ.get("EA_MIN_F1_IMPROVEMENT", "-0.02"))
+
+
+def _load_metadata() -> Dict:
+    """Load training metadata (last train time, metrics)."""
+    if os.path.exists(_METADATA_PATH):
+        try:
+            with open(_METADATA_PATH) as f:
+                return json.load(f)
+        except (json.JSONDecodeError, IOError):
+            pass
+    return {"last_trained_at": 0, "last_entry_count": 0, "intent_f1": 0.0, "pii_f1": 0.0}
+
+
+def _save_metadata(metadata: Dict):
+    """Save training metadata."""
+    os.makedirs(os.path.dirname(_METADATA_PATH), exist_ok=True)
+    with open(_METADATA_PATH, "w") as f:
+        json.dump(metadata, f, indent=2)
+
+
+def _count_entries_since(paths: list, since_ts: float) -> int:
+    """Count audit log entries newer than since_ts."""
+    count = 0
+    for path in paths:
+        if not os.path.exists(path):
+            continue
+        with open(path) as f:
+            for line in f:
+                try:
+                    entry = json.loads(line)
+                    ts = entry.get("ts", "")
+                    # Parse ISO timestamp to epoch
+                    if isinstance(ts, str) and ts:
+                        import datetime
+                        try:
+                            dt = datetime.datetime.fromisoformat(ts)
+                            if dt.timestamp() > since_ts:
+                                count += 1
+                        except (ValueError, TypeError):
+                            count += 1  # Can't parse = assume new
+                    elif isinstance(ts, (int, float)) and ts > since_ts:
+                        count += 1
+                except (json.JSONDecodeError, TypeError):
+                    continue
+    return count
+
+
+def _total_entries(paths: list) -> int:
+    """Count total audit entries across all paths."""
+    count = 0
+    for path in paths:
+        if not os.path.exists(path):
+            continue
+        with open(path) as f:
+            for _ in f:
+                count += 1
+    return count
+
+
+class ActiveLearner:
+    """Auto-retrain ML classifiers when new audit data accumulates."""
+
+    def __init__(
+        self,
+        audit_paths: Optional[list] = None,
+        retrain_threshold: int = _RETRAIN_THRESHOLD,
+        min_f1_improvement: float = _MIN_F1_IMPROVEMENT,
+    ):
+        self.audit_paths = audit_paths or _AUDIT_PATHS
+        self.retrain_threshold = retrain_threshold
+        self.min_f1_improvement = min_f1_improvement
+
+    def should_retrain(self) -> Dict:
+        """Check if retraining is needed.
+
+        Returns:
+            {"should_retrain": bool, "new_entries": int, "total_entries": int,
+             "reason": str}
+        """
+        metadata = _load_metadata()
+        last_trained = metadata.get("last_trained_at", 0)
+        new_entries = _count_entries_since(self.audit_paths, last_trained)
+        total = _total_entries(self.audit_paths)
+
+        if new_entries >= self.retrain_threshold:
+            return {
+                "should_retrain": True,
+                "new_entries": new_entries,
+                "total_entries": total,
+                "reason": f"{new_entries} new entries >= threshold {self.retrain_threshold}",
+            }
+
+        return {
+            "should_retrain": False,
+            "new_entries": new_entries,
+            "total_entries": total,
+            "reason": f"{new_entries} new entries < threshold {self.retrain_threshold}",
+        }
+
+    def check_and_retrain(self) -> Dict:
+        """Check if retraining is needed and do it if so.
+
+        Returns training results or skip reason.
+        """
+        check = self.should_retrain()
+        if not check["should_retrain"]:
+            logger.info("Active learner: skip — %s", check["reason"])
+            return {"action": "skipped", **check}
+
+        logger.info("Active learner: retraining — %s", check["reason"])
+        return self._retrain(check)
+
+    def _retrain(self, check: Dict) -> Dict:
+        """Execute retraining with validation gate."""
+        metadata = _load_metadata()
+        old_intent_f1 = metadata.get("intent_f1", 0.0)
+        old_pii_f1 = metadata.get("pii_f1", 0.0)
+
+        # Import training functions
+        try:
+            import sys
+            # Try AgnosticSecurity training script
+            train_script = os.path.join(
+                os.path.expanduser("~"), "AgnosticSecurity", "scripts"
+            )
+            if train_script not in sys.path:
+                sys.path.insert(0, train_script)
+
+            from train_enhanced_classifier import (
+                load_audit_log,
+                load_red_team_evals,
+                generate_synthetic_benign,
+                generate_pii_training_data,
+                train_intent_model,
+                train_pii_model,
+                AUDIT_LOG,
+                EVALS_DIR,
+            )
+        except ImportError as e:
+            return {
+                "action": "error",
+                "reason": f"Training script not found: {e}",
+                **check,
+            }
+
+        # Load data
+        audit_samples = load_audit_log(AUDIT_LOG)
+        red_team_samples = load_red_team_evals(EVALS_DIR)
+        synthetic = generate_synthetic_benign()
+        pii_samples = generate_pii_training_data()
+
+        intent_data = audit_samples + red_team_samples + synthetic
+        if len(intent_data) < 100:
+            return {
+                "action": "skipped",
+                "reason": f"Not enough training data ({len(intent_data)} samples)",
+                **check,
+            }
+
+        # Train new models
+        intent_result = train_intent_model(intent_data)
+        pii_result = train_pii_model(pii_samples)
+
+        new_intent_f1 = intent_result.get("cv_f1_macro", 0.0)
+        new_pii_f1 = pii_result.get("cv_f1_macro", 0.0)
+
+        # Validation gate: new model must not be significantly worse
+        intent_ok = new_intent_f1 >= (old_intent_f1 + self.min_f1_improvement)
+        pii_ok = new_pii_f1 >= (old_pii_f1 + self.min_f1_improvement)
+
+        if intent_ok and pii_ok:
+            # Promote: save metadata
+            _save_metadata({
+                "last_trained_at": time.time(),
+                "last_entry_count": check["total_entries"],
+                "intent_f1": new_intent_f1,
+                "pii_f1": new_pii_f1,
+                "intent_samples": intent_result.get("samples", 0),
+                "pii_samples": pii_result.get("samples", 0),
+                "trained_by": "active_learner",
+            })
+
+            return {
+                "action": "retrained",
+                "intent_f1": {"old": old_intent_f1, "new": new_intent_f1},
+                "pii_f1": {"old": old_pii_f1, "new": new_pii_f1},
+                "intent_samples": intent_result.get("samples", 0),
+                "pii_samples": pii_result.get("samples", 0),
+                **check,
+            }
+        else:
+            # Reject: new model is worse
+            reasons = []
+            if not intent_ok:
+                reasons.append(f"intent F1 dropped: {old_intent_f1:.3f} -> {new_intent_f1:.3f}")
+            if not pii_ok:
+                reasons.append(f"PII F1 dropped: {old_pii_f1:.3f} -> {new_pii_f1:.3f}")
+
+            return {
+                "action": "rejected",
+                "reason": "; ".join(reasons),
+                "intent_f1": {"old": old_intent_f1, "new": new_intent_f1},
+                "pii_f1": {"old": old_pii_f1, "new": new_pii_f1},
+                **check,
+            }

{securityagent_core-4.18.0 → securityagent_core-4.24.0/src/securityagent_core.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: securityagent-core
-Version: 4.18.0
+Version: 4.24.0
 Summary: Local-first DLP engine and security layer for AI coding agents. Secures Copilot, Claude Code, Cursor, Windsurf, and any MCP-compatible agent.
 Author-email: SecureMind <founders@securemind.live>
 License: Proprietary
@@ -41,11 +41,13 @@ Provides-Extra: ocr
 Requires-Dist: PyMuPDF; extra == "ocr"
 Requires-Dist: pytesseract; extra == "ocr"
 Requires-Dist: Pillow; extra == "ocr"
+Provides-Extra: pdf
+Requires-Dist: fpdf2; extra == "pdf"
 Provides-Extra: dev
 Requires-Dist: pytest; extra == "dev"
 Requires-Dist: moto; extra == "dev"
 Provides-Extra: all
-Requires-Dist: securityagent-core[cloud,llm,ml,ocr]; extra == "all"
+Requires-Dist: securityagent-core[cloud,llm,ml,ocr,pdf]; extra == "all"
 Dynamic: license-file
 
 # securityagent-core

{securityagent_core-4.18.0 → securityagent_core-4.24.0}/src/securityagent_core.egg-info/SOURCES.txt

@@ -26,6 +26,7 @@ src/endpoint_agent/monitors/honeypot_monitor.py
 src/endpoint_agent/monitors/privilege_monitor.py
 src/endpoint_agent/monitors/process_monitor.py
 src/endpoint_agent/scanners/__init__.py
+src/endpoint_agent/scanners/active_learner.py
 src/endpoint_agent/scanners/code_fingerprint.py
 src/endpoint_agent/scanners/content_analyzer.py
 src/endpoint_agent/scanners/credential_scanner.py

{securityagent_core-4.18.0 → securityagent_core-4.24.0}/src/securityagent_core.egg-info/requires.txt

@@ -7,7 +7,7 @@ python-docx
 pyyaml
 
 [all]
-securityagent-core[cloud,llm,ml,ocr]
+securityagent-core[cloud,llm,ml,ocr,pdf]
 
 [cloud]
 boto3
@@ -31,3 +31,6 @@ numpy
 PyMuPDF
 pytesseract
 Pillow
+
+[pdf]
+fpdf2

{securityagent_core-4.18.0 → securityagent_core-4.24.0}/src/skills/implementations/compliance_report.py

@@ -199,10 +199,15 @@ class ComplianceReportSkill(BaseSkill):
                 },
                 "format": {
                     "type": "string",
-                    "enum": ["json", "markdown"],
-                    "description": "Output format",
+                    "enum": ["json", "markdown", "pdf"],
+                    "description": "Output format (pdf saves to ~/.securityagent/reports/)",
                     "default": "json",
                 },
+                "company_name": {
+                    "type": "string",
+                    "description": "Company name for PDF report header",
+                    "default": "SecureMind",
+                },
             },
         }
 
@@ -258,6 +263,10 @@ class ComplianceReportSkill(BaseSkill):
 
         if fmt == "markdown":
             result_data["markdown"] = self._to_markdown(reports, stats)
+        elif fmt == "pdf":
+            company = params.get("company_name", "SecureMind")
+            pdf_path = self._to_pdf(reports, stats, company)
+            result_data["pdf_path"] = pdf_path
 
         return SkillResult(
             status=SkillStatus.ALLOWED,
@@ -294,3 +303,169 @@ class ComplianceReportSkill(BaseSkill):
             lines.append("")
 
         return "\n".join(lines)
+
+    def _to_pdf(self, reports: Dict, stats: Dict, company: str) -> str:
+        """Generate PDF compliance report.
+
+        Uses fpdf2 if available, otherwise falls back to a plain-text PDF
+        built with minimal PDF spec (no external deps).
+        """
+        report_dir = os.path.join(os.path.expanduser("~"), ".securityagent", "reports")
+        os.makedirs(report_dir, exist_ok=True)
+        timestamp = time.strftime("%Y%m%d_%H%M%S")
+        pdf_path = os.path.join(report_dir, f"compliance_report_{timestamp}.pdf")
+
+        try:
+            from fpdf import FPDF
+            return self._pdf_with_fpdf(reports, stats, company, pdf_path)
+        except ImportError:
+            return self._pdf_fallback(reports, stats, company, pdf_path)
+
+    @staticmethod
+    def _sanitize(text: str) -> str:
+        """Replace unicode chars that Helvetica/latin-1 can't render."""
+        return text.encode("ascii", errors="replace").decode("ascii")
+
+    def _pdf_with_fpdf(self, reports: Dict, stats: Dict, company: str, path: str) -> str:
+        """Generate styled PDF using fpdf2."""
+        from fpdf import FPDF
+
+        pdf = FPDF()
+        pdf.set_auto_page_break(auto=True, margin=15)
+
+        # Title page
+        pdf.add_page()
+        pdf.set_font("Helvetica", "B", 24)
+        pdf.cell(0, 20, f"{company}", new_x="LMARGIN", new_y="NEXT", align="C")
+        pdf.set_font("Helvetica", "", 16)
+        pdf.cell(0, 10, "AI Agent Security Compliance Report", new_x="LMARGIN", new_y="NEXT", align="C")
+        pdf.ln(5)
+        pdf.set_font("Helvetica", "", 11)
+        pdf.cell(0, 8, f"Generated: {time.strftime('%Y-%m-%d %H:%M:%S')}", new_x="LMARGIN", new_y="NEXT", align="C")
+        pdf.cell(0, 8, f"Audit entries analyzed: {stats['total']:,}", new_x="LMARGIN", new_y="NEXT", align="C")
+        pdf.cell(0, 8, f"Actions blocked: {stats['blocked']:,}", new_x="LMARGIN", new_y="NEXT", align="C")
+
+        # Summary scores
+        pdf.ln(10)
+        pdf.set_font("Helvetica", "B", 14)
+        pdf.cell(0, 10, "Executive Summary", new_x="LMARGIN", new_y="NEXT")
+        pdf.set_font("Helvetica", "", 11)
+
+        for key, report in reports.items():
+            passed = report["controls_passed"]
+            total = report["controls_total"]
+            score = report["score"]
+            status = "PASS" if report["pass"] else "FAIL"
+            pdf.cell(0, 7, f"  {report['framework']}: {passed}/{total} ({score}%) - {status}",
+                     new_x="LMARGIN", new_y="NEXT")
+
+        # Detailed results per framework
+        for key, report in reports.items():
+            pdf.add_page()
+            pdf.set_font("Helvetica", "B", 16)
+            pdf.cell(0, 12, report["framework"], new_x="LMARGIN", new_y="NEXT")
+
+            passed = report["controls_passed"]
+            total = report["controls_total"]
+            score = report["score"]
+            pdf.set_font("Helvetica", "", 11)
+            pdf.cell(0, 8, f"Score: {passed}/{total} ({score}%)", new_x="LMARGIN", new_y="NEXT")
+            pdf.ln(3)
+
+            # Table header
+            pdf.set_font("Helvetica", "B", 9)
+            pdf.cell(25, 7, "Control", border=1)
+            pdf.cell(40, 7, "Name", border=1)
+            pdf.cell(15, 7, "Status", border=1)
+            pdf.cell(0, 7, "Evidence", border=1, new_x="LMARGIN", new_y="NEXT")
+
+            # Table rows
+            pdf.set_font("Helvetica", "", 8)
+            for ctrl in report["results"]:
+                pdf.cell(25, 6, ctrl["id"], border=1)
+                pdf.cell(40, 6, ctrl["name"][:25], border=1)
+                pdf.cell(15, 6, ctrl["status"], border=1)
+                evidence = self._sanitize(ctrl["evidence"][:80])
+                pdf.cell(0, 6, evidence, border=1, new_x="LMARGIN", new_y="NEXT")
+
+        # Footer
+        pdf.add_page()
+        pdf.set_font("Helvetica", "B", 14)
+        pdf.cell(0, 10, "About This Report", new_x="LMARGIN", new_y="NEXT")
+        pdf.set_font("Helvetica", "", 10)
+        pdf.multi_cell(0, 6, self._sanitize(
+            f"This report was automatically generated by {company}'s AI Agent Security Platform. "
+            "Controls are evaluated against real audit trail data from production hook enforcement. "
+            "Each control status is determined by verifying that the corresponding security mechanism "
+            "is active and has processed real events.\n\n"
+            f"Platform: SecureMind v4.18.0\n"
+            f"Engine: securityagent-core (21,092 lines)\n"
+            f"Frameworks: NIST 800-53, SOC 2 Type II, HIPAA, PCI-DSS v4.0\n"
+            f"Contact: founders@securemind.live\n"
+            f"Website: https://securemind.live"
+        ))
+
+        pdf.output(path)
+        return path
+
+    def _pdf_fallback(self, reports: Dict, stats: Dict, company: str, path: str) -> str:
+        """Generate minimal PDF without external dependencies."""
+        lines = []
+        lines.append(f"{company} - AI Agent Security Compliance Report")
+        lines.append(f"Generated: {time.strftime('%Y-%m-%d %H:%M:%S')}")
+        lines.append(f"Audit entries: {stats['total']:,}  |  Blocked: {stats['blocked']:,}")
+        lines.append("")
+
+        for key, report in reports.items():
+            passed = report["controls_passed"]
+            total = report["controls_total"]
+            score = report["score"]
+            status = "PASS" if report["pass"] else "FAIL"
+            lines.append(f"{'='*60}")
+            lines.append(f"{report['framework']}: {passed}/{total} ({score}%) - {status}")
+            lines.append(f"{'='*60}")
+            for ctrl in report["results"]:
+                lines.append(f"  [{ctrl['status']}] {ctrl['id']} - {ctrl['name']}")
+                lines.append(f"         Evidence: {ctrl['evidence']}")
+            lines.append("")
+
+        text = "\n".join(lines)
+
+        # Minimal valid PDF
+        with open(path, "wb") as f:
+            objects = []
+            # Object 1: Catalog
+            objects.append(b"1 0 obj\n<< /Type /Catalog /Pages 2 0 R >>\nendobj\n")
+            # Object 2: Pages
+            objects.append(b"2 0 obj\n<< /Type /Pages /Kids [3 0 R] /Count 1 >>\nendobj\n")
+            # Object 4: Font
+            objects.append(b"4 0 obj\n<< /Type /Font /Subtype /Type1 /BaseFont /Courier >>\nendobj\n")
+            # Object 5: Stream content
+            content_lines = text.encode("ascii", errors="replace")
+            stream = b"BT\n/F1 8 Tf\n36 756 Td\n10 TL\n"
+            for line in text.split("\n")[:90]:  # Fit one page
+                safe = line.replace("\\", "\\\\").replace("(", "\\(").replace(")", "\\)")
+                stream += f"({safe}) '\n".encode()
+            stream += b"ET\n"
+            objects.append(f"5 0 obj\n<< /Length {len(stream)} >>\nstream\n".encode() + stream + b"endstream\nendobj\n")
+            # Object 3: Page
+            objects.append(b"3 0 obj\n<< /Type /Page /Parent 2 0 R /MediaBox [0 0 612 792] /Contents 5 0 R /Resources << /Font << /F1 4 0 R >> >> >>\nendobj\n")
+
+            f.write(b"%PDF-1.4\n")
+            offsets = []
+            for obj in objects:
+                offsets.append(f.tell())
+                f.write(obj)
+            xref_offset = f.tell()
+            f.write(b"xref\n")
+            f.write(f"0 {len(objects)+1}\n".encode())
+            f.write(b"0000000000 65535 f \n")
+            for off in offsets:
+                f.write(f"{off:010d} 00000 n \n".encode())
+            f.write(b"trailer\n")
+            f.write(f"<< /Size {len(objects)+1} /Root 1 0 R >>\n".encode())
+            f.write(b"startxref\n")
+            f.write(f"{xref_offset}\n".encode())
+            f.write(b"%%EOF\n")
+
+        return path