skip-trace 0.1.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- skip_trace-0.1.0/.gitignore +218 -0
- skip_trace-0.1.0/LICENSE +21 -0
- skip_trace-0.1.0/PKG-INFO +125 -0
- skip_trace-0.1.0/README.md +86 -0
- skip_trace-0.1.0/pyproject.toml +152 -0
- skip_trace-0.1.0/skip_trace/__about__.py +19 -0
- skip_trace-0.1.0/skip_trace/__init__.py +6 -0
- skip_trace-0.1.0/skip_trace/__main__.py +9 -0
- skip_trace-0.1.0/skip_trace/analysis/__init__.py +4 -0
- skip_trace-0.1.0/skip_trace/analysis/evidence.py +312 -0
- skip_trace-0.1.0/skip_trace/analysis/ner.py +58 -0
- skip_trace-0.1.0/skip_trace/analysis/scoring.py +282 -0
- skip_trace-0.1.0/skip_trace/analysis/source_scanner.py +411 -0
- skip_trace-0.1.0/skip_trace/cli.py +177 -0
- skip_trace-0.1.0/skip_trace/collectors/__init__.py +4 -0
- skip_trace-0.1.0/skip_trace/collectors/github.py +241 -0
- skip_trace-0.1.0/skip_trace/collectors/package_files.py +150 -0
- skip_trace-0.1.0/skip_trace/collectors/pypi.py +158 -0
- skip_trace-0.1.0/skip_trace/collectors/whois.py +202 -0
- skip_trace-0.1.0/skip_trace/config.py +165 -0
- skip_trace-0.1.0/skip_trace/exceptions.py +22 -0
- skip_trace-0.1.0/skip_trace/main.py +269 -0
- skip_trace-0.1.0/skip_trace/py.typed.py +0 -0
- skip_trace-0.1.0/skip_trace/reporting/__init__.py +0 -0
- skip_trace-0.1.0/skip_trace/reporting/json_reporter.py +22 -0
- skip_trace-0.1.0/skip_trace/reporting/md_reporter.py +115 -0
- skip_trace-0.1.0/skip_trace/schemas.py +131 -0
- skip_trace-0.1.0/skip_trace/utils/__init__.py +4 -0
- skip_trace-0.1.0/skip_trace/utils/cache.py +77 -0
- skip_trace-0.1.0/skip_trace/utils/cli_suggestions.py +91 -0
- skip_trace-0.1.0/skip_trace/utils/http_client.py +45 -0
- skip_trace-0.1.0/skip_trace/utils/safe_targz.py +161 -0
- skip_trace-0.1.0/skip_trace/utils/validation.py +52 -0
- skip_trace-0.1.0/test/__init__.py +0 -0
- skip_trace-0.1.0/test/conftest.py +19 -0
- skip_trace-0.1.0/test/test_collectors/__init__.py +0 -0
- skip_trace-0.1.0/test/test_collectors/test_pypi.py +77 -0
|
@@ -0,0 +1,218 @@
|
|
|
1
|
+
# Byte-compiled / optimized / DLL files
|
|
2
|
+
__pycache__/
|
|
3
|
+
*.py[codz]
|
|
4
|
+
*$py.class
|
|
5
|
+
|
|
6
|
+
# C extensions
|
|
7
|
+
*.so
|
|
8
|
+
|
|
9
|
+
# Distribution / packaging
|
|
10
|
+
.Python
|
|
11
|
+
build/
|
|
12
|
+
develop-eggs/
|
|
13
|
+
dist/
|
|
14
|
+
downloads/
|
|
15
|
+
eggs/
|
|
16
|
+
.eggs/
|
|
17
|
+
lib/
|
|
18
|
+
lib64/
|
|
19
|
+
parts/
|
|
20
|
+
sdist/
|
|
21
|
+
var/
|
|
22
|
+
wheels/
|
|
23
|
+
share/python-wheels/
|
|
24
|
+
*.egg-info/
|
|
25
|
+
.installed.cfg
|
|
26
|
+
*.egg
|
|
27
|
+
MANIFEST
|
|
28
|
+
|
|
29
|
+
# PyInstaller
|
|
30
|
+
# Usually these files are written by a python script from a template
|
|
31
|
+
# before PyInstaller builds the exe, so as to inject date/other infos into it.
|
|
32
|
+
*.manifest
|
|
33
|
+
*.spec
|
|
34
|
+
|
|
35
|
+
# Installer logs
|
|
36
|
+
pip-log.txt
|
|
37
|
+
pip-delete-this-directory.txt
|
|
38
|
+
|
|
39
|
+
# Unit test / coverage reports
|
|
40
|
+
htmlcov/
|
|
41
|
+
.tox/
|
|
42
|
+
.nox/
|
|
43
|
+
.coverage
|
|
44
|
+
.coverage.*
|
|
45
|
+
.cache
|
|
46
|
+
nosetests.xml
|
|
47
|
+
coverage.xml
|
|
48
|
+
*.cover
|
|
49
|
+
*.py.cover
|
|
50
|
+
.hypothesis/
|
|
51
|
+
.pytest_cache/
|
|
52
|
+
cover/
|
|
53
|
+
|
|
54
|
+
# Translations
|
|
55
|
+
*.mo
|
|
56
|
+
*.pot
|
|
57
|
+
|
|
58
|
+
# Django stuff:
|
|
59
|
+
*.log
|
|
60
|
+
local_settings.py
|
|
61
|
+
db.sqlite3
|
|
62
|
+
db.sqlite3-journal
|
|
63
|
+
|
|
64
|
+
# Flask stuff:
|
|
65
|
+
instance/
|
|
66
|
+
.webassets-cache
|
|
67
|
+
|
|
68
|
+
# Scrapy stuff:
|
|
69
|
+
.scrapy
|
|
70
|
+
|
|
71
|
+
# Sphinx documentation
|
|
72
|
+
docs/_build/
|
|
73
|
+
|
|
74
|
+
# PyBuilder
|
|
75
|
+
.pybuilder/
|
|
76
|
+
target/
|
|
77
|
+
|
|
78
|
+
# Jupyter Notebook
|
|
79
|
+
.ipynb_checkpoints
|
|
80
|
+
|
|
81
|
+
# IPython
|
|
82
|
+
profile_default/
|
|
83
|
+
ipython_config.py
|
|
84
|
+
|
|
85
|
+
# pyenv
|
|
86
|
+
# For a library or package, you might want to ignore these files since the code is
|
|
87
|
+
# intended to run in multiple environments; otherwise, check them in:
|
|
88
|
+
# .python-version
|
|
89
|
+
|
|
90
|
+
# pipenv
|
|
91
|
+
# According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
|
|
92
|
+
# However, in case of collaboration, if having platform-specific dependencies or dependencies
|
|
93
|
+
# having no cross-platform support, pipenv may install dependencies that don't work, or not
|
|
94
|
+
# install all needed dependencies.
|
|
95
|
+
#Pipfile.lock
|
|
96
|
+
|
|
97
|
+
# UV
|
|
98
|
+
# Similar to Pipfile.lock, it is generally recommended to include uv.lock in version control.
|
|
99
|
+
# This is especially recommended for binary packages to ensure reproducibility, and is more
|
|
100
|
+
# commonly ignored for libraries.
|
|
101
|
+
#uv.lock
|
|
102
|
+
|
|
103
|
+
# poetry
|
|
104
|
+
# Similar to Pipfile.lock, it is generally recommended to include poetry.lock in version control.
|
|
105
|
+
# This is especially recommended for binary packages to ensure reproducibility, and is more
|
|
106
|
+
# commonly ignored for libraries.
|
|
107
|
+
# https://python-poetry.org/docs/basic-usage/#commit-your-poetrylock-file-to-version-control
|
|
108
|
+
#poetry.lock
|
|
109
|
+
#poetry.toml
|
|
110
|
+
|
|
111
|
+
# pdm
|
|
112
|
+
# Similar to Pipfile.lock, it is generally recommended to include pdm.lock in version control.
|
|
113
|
+
# pdm recommends including project-wide configuration in pdm.toml, but excluding .pdm-python.
|
|
114
|
+
# https://pdm-project.org/en/latest/usage/project/#working-with-version-control
|
|
115
|
+
#pdm.lock
|
|
116
|
+
#pdm.toml
|
|
117
|
+
.pdm-python
|
|
118
|
+
.pdm-build/
|
|
119
|
+
|
|
120
|
+
# pixi
|
|
121
|
+
# Similar to Pipfile.lock, it is generally recommended to include pixi.lock in version control.
|
|
122
|
+
#pixi.lock
|
|
123
|
+
# Pixi creates a virtual environment in the .pixi directory, just like venv module creates one
|
|
124
|
+
# in the .venv directory. It is recommended not to include this directory in version control.
|
|
125
|
+
.pixi
|
|
126
|
+
|
|
127
|
+
# PEP 582; used by e.g. github.com/David-OConnor/pyflow and github.com/pdm-project/pdm
|
|
128
|
+
__pypackages__/
|
|
129
|
+
|
|
130
|
+
# Celery stuff
|
|
131
|
+
celerybeat-schedule
|
|
132
|
+
celerybeat.pid
|
|
133
|
+
|
|
134
|
+
# SageMath parsed files
|
|
135
|
+
*.sage.py
|
|
136
|
+
|
|
137
|
+
# Environments
|
|
138
|
+
.env
|
|
139
|
+
.envrc
|
|
140
|
+
.venv
|
|
141
|
+
env/
|
|
142
|
+
venv/
|
|
143
|
+
ENV/
|
|
144
|
+
env.bak/
|
|
145
|
+
venv.bak/
|
|
146
|
+
|
|
147
|
+
# Spyder project settings
|
|
148
|
+
.spyderproject
|
|
149
|
+
.spyproject
|
|
150
|
+
|
|
151
|
+
# Rope project settings
|
|
152
|
+
.ropeproject
|
|
153
|
+
|
|
154
|
+
# mkdocs documentation
|
|
155
|
+
/site
|
|
156
|
+
|
|
157
|
+
# mypy
|
|
158
|
+
.mypy_cache/
|
|
159
|
+
.dmypy.json
|
|
160
|
+
dmypy.json
|
|
161
|
+
|
|
162
|
+
# Pyre type checker
|
|
163
|
+
.pyre/
|
|
164
|
+
|
|
165
|
+
# pytype static type analyzer
|
|
166
|
+
.pytype/
|
|
167
|
+
|
|
168
|
+
# Cython debug symbols
|
|
169
|
+
cython_debug/
|
|
170
|
+
|
|
171
|
+
# PyCharm
|
|
172
|
+
# JetBrains specific template is maintained in a separate JetBrains.gitignore that can
|
|
173
|
+
# be found at https://github.com/github/gitignore/blob/main/Global/JetBrains.gitignore
|
|
174
|
+
# and can be added to the global gitignore or merged into this file. For a more nuclear
|
|
175
|
+
# option (not recommended) you can uncomment the following to ignore the entire idea folder.
|
|
176
|
+
#.idea/
|
|
177
|
+
|
|
178
|
+
# Abstra
|
|
179
|
+
# Abstra is an AI-powered process automation framework.
|
|
180
|
+
# Ignore directories containing user credentials, local state, and settings.
|
|
181
|
+
# Learn more at https://abstra.io/docs
|
|
182
|
+
.abstra/
|
|
183
|
+
|
|
184
|
+
# Visual Studio Code
|
|
185
|
+
# Visual Studio Code specific template is maintained in a separate VisualStudioCode.gitignore
|
|
186
|
+
# that can be found at https://github.com/github/gitignore/blob/main/Global/VisualStudioCode.gitignore
|
|
187
|
+
# and can be added to the global gitignore or merged into this file. However, if you prefer,
|
|
188
|
+
# you could uncomment the following to ignore the entire vscode folder
|
|
189
|
+
# .vscode/
|
|
190
|
+
|
|
191
|
+
# Ruff stuff:
|
|
192
|
+
.ruff_cache/
|
|
193
|
+
|
|
194
|
+
# PyPI configuration file
|
|
195
|
+
.pypirc
|
|
196
|
+
|
|
197
|
+
# Cursor
|
|
198
|
+
# Cursor is an AI-powered code editor. `.cursorignore` specifies files/directories to
|
|
199
|
+
# exclude from AI features like autocomplete and code analysis. Recommended for sensitive data
|
|
200
|
+
# refer to https://docs.cursor.com/context/ignore-files
|
|
201
|
+
.cursorignore
|
|
202
|
+
.cursorindexingignore
|
|
203
|
+
|
|
204
|
+
# Marimo
|
|
205
|
+
marimo/_static/
|
|
206
|
+
marimo/_lsp/
|
|
207
|
+
__marimo__/
|
|
208
|
+
/.idea/copilot.data.migration.agent.xml
|
|
209
|
+
/.idea/copilot.data.migration.ask.xml
|
|
210
|
+
/.idea/copilot.data.migration.ask2agent.xml
|
|
211
|
+
/.idea/copilot.data.migration.edit.xml
|
|
212
|
+
/junit.xml
|
|
213
|
+
/.idea/misc.xml
|
|
214
|
+
/.idea/modules.xml
|
|
215
|
+
/.idea/inspectionProfiles/profiles_settings.xml
|
|
216
|
+
/.idea/inspectionProfiles/Project_Default.xml
|
|
217
|
+
/.idea/skip_trace.iml
|
|
218
|
+
/.idea/vcs.xml
|
skip_trace-0.1.0/LICENSE
ADDED
|
@@ -0,0 +1,21 @@
|
|
|
1
|
+
MIT License
|
|
2
|
+
|
|
3
|
+
Copyright (c) 2025 Matthew Martin
|
|
4
|
+
|
|
5
|
+
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
6
|
+
of this software and associated documentation files (the "Software"), to deal
|
|
7
|
+
in the Software without restriction, including without limitation the rights
|
|
8
|
+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
9
|
+
copies of the Software, and to permit persons to whom the Software is
|
|
10
|
+
furnished to do so, subject to the following conditions:
|
|
11
|
+
|
|
12
|
+
The above copyright notice and this permission notice shall be included in all
|
|
13
|
+
copies or substantial portions of the Software.
|
|
14
|
+
|
|
15
|
+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
16
|
+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
17
|
+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
18
|
+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
19
|
+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
20
|
+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
21
|
+
SOFTWARE.
|
|
@@ -0,0 +1,125 @@
|
|
|
1
|
+
Metadata-Version: 2.4
|
|
2
|
+
Name: skip-trace
|
|
3
|
+
Version: 0.1.0
|
|
4
|
+
Summary: Ownership Attribution for Python Packages
|
|
5
|
+
Project-URL: Homepage, https://github.com/matthewdeanmartin/skip-trace
|
|
6
|
+
Project-URL: Issues, https://github.com/matthewdeanmartin/skip-trace/issues
|
|
7
|
+
Author-email: Matthew Dean Martin <matthewdeanmartin@gmail.com>
|
|
8
|
+
License-File: LICENSE
|
|
9
|
+
Classifier: Development Status :: 1 - Planning
|
|
10
|
+
Classifier: Operating System :: OS Independent
|
|
11
|
+
Classifier: Programming Language :: Python :: 3
|
|
12
|
+
Classifier: Programming Language :: Python :: 3.9
|
|
13
|
+
Classifier: Programming Language :: Python :: 3.10
|
|
14
|
+
Classifier: Programming Language :: Python :: 3.11
|
|
15
|
+
Classifier: Programming Language :: Python :: 3.12
|
|
16
|
+
Classifier: Programming Language :: Python :: 3.13
|
|
17
|
+
Classifier: Topic :: Security
|
|
18
|
+
Classifier: Topic :: Software Development :: Quality Assurance
|
|
19
|
+
Requires-Python: >=3.8
|
|
20
|
+
Requires-Dist: beautifulsoup4>=4.12.0
|
|
21
|
+
Requires-Dist: email-validator>=2.0.0
|
|
22
|
+
Requires-Dist: en-core-web-sm
|
|
23
|
+
Requires-Dist: httpx[http2]>=0.25.0
|
|
24
|
+
Requires-Dist: openai>=1.3.0
|
|
25
|
+
Requires-Dist: pip>=20
|
|
26
|
+
Requires-Dist: pygithub>=1.59.0
|
|
27
|
+
Requires-Dist: python-dotenv
|
|
28
|
+
Requires-Dist: python-dotenv>=1.0.0
|
|
29
|
+
Requires-Dist: python-whois>=0.8.0
|
|
30
|
+
Requires-Dist: rich-argparse
|
|
31
|
+
Requires-Dist: rich>=13.0.0
|
|
32
|
+
Requires-Dist: sigstore>=1.0.0
|
|
33
|
+
Requires-Dist: spacy>=3.0.0
|
|
34
|
+
Requires-Dist: tldextract
|
|
35
|
+
Requires-Dist: tldextract>=5.0.0
|
|
36
|
+
Requires-Dist: tomli; python_version < '3.11'
|
|
37
|
+
Requires-Dist: whoisit>=1.2
|
|
38
|
+
Description-Content-Type: text/markdown
|
|
39
|
+
|
|
40
|
+
# skip_trace
|
|
41
|
+
|
|
42
|
+
Who owns your dependencies
|
|
43
|
+
|
|
44
|
+
- Can they be linked to a real person or company in the real world
|
|
45
|
+
- Can they be contacted
|
|
46
|
+
|
|
47
|
+
Of course all packages have a pypi user. The list of users isn't academic, you care about them because you want to
|
|
48
|
+
communicate with them.
|
|
49
|
+
|
|
50
|
+
[
|
|
51
|
+
](https://github.com/matthewdeanmartin/skip_trace/actions/workflows/tests.yml)
|
|
52
|
+
[
|
|
53
|
+
](https://results.pre-commit.ci/latest/github/matthewdeanmartin/skip_trace/main)
|
|
54
|
+
[](https://pypistats.org/packages/skip-trace)
|
|
55
|
+
[
|
|
56
|
+
|
|
57
|
+
](https://pypi.org/project/skip-trace/)
|
|
58
|
+
|
|
59
|
+
|
|
60
|
+
## Installation
|
|
61
|
+
|
|
62
|
+
**Requires**
|
|
63
|
+
|
|
64
|
+
- Github key
|
|
65
|
+
- Initializing `spacy`
|
|
66
|
+
- `git clone`, `uv sync`
|
|
67
|
+
- OR `python -m spacy download en_core_web_sm`
|
|
68
|
+
- OR `python -c 'import spacy.cli; spacy.cli.download("en_core_web_sm")'`
|
|
69
|
+
- (Not implemented yet) Openrouter/OpenAI key
|
|
70
|
+
|
|
71
|
+
## Usage
|
|
72
|
+
|
|
73
|
+
```bash
|
|
74
|
+
skip-trace who-owns requests
|
|
75
|
+
```
|
|
76
|
+
|
|
77
|
+
What you will see is the owner table and the maintainer tables.
|
|
78
|
+
|
|
79
|
+
The owner table is pretty close to all the names, email addresses and custom domains I can find.
|
|
80
|
+
|
|
81
|
+
|
|
82
|
+
## Use Cases
|
|
83
|
+
|
|
84
|
+
- You are worried about supply chain attacks and are concerned that a package is actually maintained by North Korean
|
|
85
|
+
government backed hackers
|
|
86
|
+
- You need to file a bug report and there isn't an issue link
|
|
87
|
+
- You want to hire, buy something from the maintainer, or charitably donate money
|
|
88
|
+
- You want to do a [PEP 541 take over](https://peps.python.org/pep-0541/)
|
|
89
|
+
- You want to volunteer to take over an abandoned package instead of forking it
|
|
90
|
+
- You want to find out if your project is now unreachable. If you are conscientious enough to run this on your own
|
|
91
|
+
packages, you probably are not the person to rigorously avoid adding contact information.
|
|
92
|
+
- You are trying to publish anonymously and want to check to see if the package is actually anonymous
|
|
93
|
+
|
|
94
|
+
## Unreachable
|
|
95
|
+
|
|
96
|
+
See [PEP 541](https://peps.python.org/pep-0541/) for exact text
|
|
97
|
+
|
|
98
|
+
- Do you have a real email address in your metadata
|
|
99
|
+
- Do you have a link to a page with your real email address or other means to reach you
|
|
100
|
+
|
|
101
|
+
## Name Squatting
|
|
102
|
+
|
|
103
|
+
If a package has take a good name but the user has published nothing to it, that is Name Squatting
|
|
104
|
+
|
|
105
|
+
## Prior Art
|
|
106
|
+
|
|
107
|
+
Nothing I could find.
|
|
108
|
+
|
|
109
|
+
|
|
110
|
+
|
|
111
|
+
## Project Health & Info
|
|
112
|
+
|
|
113
|
+
| Metric | Health | Metric | Info |
|
|
114
|
+
|:------------------|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:----------------|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
|
115
|
+
| Tests | [](https://github.com/matthewdeanmartin/skip_trace/actions/workflows/build.yml) | License | [](https://github.com/matthewdeanmartin/skip_trace/blob/main/LICENSE.md) |
|
|
116
|
+
| Coverage | [](https://codecov.io/gh/matthewdeanmartin/skip_trace) | PyPI | [](https://pypi.org/project/skip-trace/) |
|
|
117
|
+
| Lint / Pre-commit | [](https://results.pre-commit.ci/latest/github/matthewdeanmartin/skip_trace/main) | Python Versions | [](https://pypi.org/project/skip_trace/) |
|
|
118
|
+
| Quality Gate | [](https://sonarcloud.io/summary/new_code?id=matthewdeanmartin_skip_trace) | Docs | [](https://skip_trace.readthedocs.io/en/latest/) |
|
|
119
|
+
| CI Build | [](https://github.com/matthewdeanmartin/skip_trace/actions/workflows/build.yml) | Downloads | [](https://pepy.tech/project/skip_trace) |
|
|
120
|
+
| Maintainability | [](https://sonarcloud.io/summary/new_code?id=matthewdeanmartin_skip_trace) | Last Commit |  |
|
|
121
|
+
|
|
122
|
+
| Category | Health
|
|
123
|
+
|-------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------|
|
|
124
|
+
| **Open Issues** |  |
|
|
125
|
+
| **Stars** |  |
|
|
@@ -0,0 +1,86 @@
|
|
|
1
|
+
# skip_trace
|
|
2
|
+
|
|
3
|
+
Who owns your dependencies
|
|
4
|
+
|
|
5
|
+
- Can they be linked to a real person or company in the real world
|
|
6
|
+
- Can they be contacted
|
|
7
|
+
|
|
8
|
+
Of course all packages have a pypi user. The list of users isn't academic, you care about them because you want to
|
|
9
|
+
communicate with them.
|
|
10
|
+
|
|
11
|
+
[
|
|
12
|
+
](https://github.com/matthewdeanmartin/skip_trace/actions/workflows/tests.yml)
|
|
13
|
+
[
|
|
14
|
+
](https://results.pre-commit.ci/latest/github/matthewdeanmartin/skip_trace/main)
|
|
15
|
+
[](https://pypistats.org/packages/skip-trace)
|
|
16
|
+
[
|
|
17
|
+
|
|
18
|
+
](https://pypi.org/project/skip-trace/)
|
|
19
|
+
|
|
20
|
+
|
|
21
|
+
## Installation
|
|
22
|
+
|
|
23
|
+
**Requires**
|
|
24
|
+
|
|
25
|
+
- Github key
|
|
26
|
+
- Initializing `spacy`
|
|
27
|
+
- `git clone`, `uv sync`
|
|
28
|
+
- OR `python -m spacy download en_core_web_sm`
|
|
29
|
+
- OR `python -c 'import spacy.cli; spacy.cli.download("en_core_web_sm")'`
|
|
30
|
+
- (Not implemented yet) Openrouter/OpenAI key
|
|
31
|
+
|
|
32
|
+
## Usage
|
|
33
|
+
|
|
34
|
+
```bash
|
|
35
|
+
skip-trace who-owns requests
|
|
36
|
+
```
|
|
37
|
+
|
|
38
|
+
What you will see is the owner table and the maintainer tables.
|
|
39
|
+
|
|
40
|
+
The owner table is pretty close to all the names, email addresses and custom domains I can find.
|
|
41
|
+
|
|
42
|
+
|
|
43
|
+
## Use Cases
|
|
44
|
+
|
|
45
|
+
- You are worried about supply chain attacks and are concerned that a package is actually maintained by North Korean
|
|
46
|
+
government backed hackers
|
|
47
|
+
- You need to file a bug report and there isn't an issue link
|
|
48
|
+
- You want to hire, buy something from the maintainer, or charitably donate money
|
|
49
|
+
- You want to do a [PEP 541 take over](https://peps.python.org/pep-0541/)
|
|
50
|
+
- You want to volunteer to take over an abandoned package instead of forking it
|
|
51
|
+
- You want to find out if your project is now unreachable. If you are conscientious enough to run this on your own
|
|
52
|
+
packages, you probably are not the person to rigorously avoid adding contact information.
|
|
53
|
+
- You are trying to publish anonymously and want to check to see if the package is actually anonymous
|
|
54
|
+
|
|
55
|
+
## Unreachable
|
|
56
|
+
|
|
57
|
+
See [PEP 541](https://peps.python.org/pep-0541/) for exact text
|
|
58
|
+
|
|
59
|
+
- Do you have a real email address in your metadata
|
|
60
|
+
- Do you have a link to a page with your real email address or other means to reach you
|
|
61
|
+
|
|
62
|
+
## Name Squatting
|
|
63
|
+
|
|
64
|
+
If a package has take a good name but the user has published nothing to it, that is Name Squatting
|
|
65
|
+
|
|
66
|
+
## Prior Art
|
|
67
|
+
|
|
68
|
+
Nothing I could find.
|
|
69
|
+
|
|
70
|
+
|
|
71
|
+
|
|
72
|
+
## Project Health & Info
|
|
73
|
+
|
|
74
|
+
| Metric | Health | Metric | Info |
|
|
75
|
+
|:------------------|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:----------------|:--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
|
76
|
+
| Tests | [](https://github.com/matthewdeanmartin/skip_trace/actions/workflows/build.yml) | License | [](https://github.com/matthewdeanmartin/skip_trace/blob/main/LICENSE.md) |
|
|
77
|
+
| Coverage | [](https://codecov.io/gh/matthewdeanmartin/skip_trace) | PyPI | [](https://pypi.org/project/skip-trace/) |
|
|
78
|
+
| Lint / Pre-commit | [](https://results.pre-commit.ci/latest/github/matthewdeanmartin/skip_trace/main) | Python Versions | [](https://pypi.org/project/skip_trace/) |
|
|
79
|
+
| Quality Gate | [](https://sonarcloud.io/summary/new_code?id=matthewdeanmartin_skip_trace) | Docs | [](https://skip_trace.readthedocs.io/en/latest/) |
|
|
80
|
+
| CI Build | [](https://github.com/matthewdeanmartin/skip_trace/actions/workflows/build.yml) | Downloads | [](https://pepy.tech/project/skip_trace) |
|
|
81
|
+
| Maintainability | [](https://sonarcloud.io/summary/new_code?id=matthewdeanmartin_skip_trace) | Last Commit |  |
|
|
82
|
+
|
|
83
|
+
| Category | Health
|
|
84
|
+
|-------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------|
|
|
85
|
+
| **Open Issues** |  |
|
|
86
|
+
| **Stars** |  |
|
|
@@ -0,0 +1,152 @@
|
|
|
1
|
+
# pyproject.toml
|
|
2
|
+
|
|
3
|
+
|
|
4
|
+
[project]
|
|
5
|
+
name = "skip-trace"
|
|
6
|
+
version = "0.1.0"
|
|
7
|
+
description = "Ownership Attribution for Python Packages"
|
|
8
|
+
readme = "README.md"
|
|
9
|
+
authors = [
|
|
10
|
+
{ name = "Matthew Dean Martin", email = "matthewdeanmartin@gmail.com" },
|
|
11
|
+
]
|
|
12
|
+
requires-python = ">=3.8"
|
|
13
|
+
classifiers = [
|
|
14
|
+
"Programming Language :: Python :: 3",
|
|
15
|
+
"Programming Language :: Python :: 3.9",
|
|
16
|
+
"Programming Language :: Python :: 3.10",
|
|
17
|
+
"Programming Language :: Python :: 3.11",
|
|
18
|
+
"Programming Language :: Python :: 3.12",
|
|
19
|
+
"Programming Language :: Python :: 3.13",
|
|
20
|
+
"Operating System :: OS Independent",
|
|
21
|
+
"Topic :: Security",
|
|
22
|
+
"Topic :: Software Development :: Quality Assurance",
|
|
23
|
+
"Development Status :: 1 - Planning"
|
|
24
|
+
]
|
|
25
|
+
dependencies = [
|
|
26
|
+
"httpx[http2]>=0.25.0",
|
|
27
|
+
"rich>=13.0.0",
|
|
28
|
+
"tldextract>=5.0.0",
|
|
29
|
+
"python-dotenv>=1.0.0",
|
|
30
|
+
"tomli; python_version < '3.11'", # For reading pyproject.toml
|
|
31
|
+
"python-dotenv",
|
|
32
|
+
"tldextract",
|
|
33
|
+
"beautifulsoup4>=4.12.0", # Added for HTML scraping
|
|
34
|
+
"PyGithub>=1.59.0", # NEW: For GitHub API interaction
|
|
35
|
+
"openai>=1.3.0",
|
|
36
|
+
"sigstore>=1.0.0",
|
|
37
|
+
# "socials", is for regexing
|
|
38
|
+
# custom domains
|
|
39
|
+
"python-whois>=0.8.0",
|
|
40
|
+
"whoisit>=1.2",
|
|
41
|
+
"spacy>=3.0.0",
|
|
42
|
+
"pip>=20", # spacy expects this in same repo
|
|
43
|
+
"email-validator>=2.0.0", # For robust email validation
|
|
44
|
+
# "en_core_web_sm"
|
|
45
|
+
"rich-argparse",
|
|
46
|
+
"en-core-web-sm",
|
|
47
|
+
]
|
|
48
|
+
|
|
49
|
+
|
|
50
|
+
[dependency-groups]
|
|
51
|
+
dev = [
|
|
52
|
+
"jiggle-version>=2.0.1",
|
|
53
|
+
"maturin>=1.9.6; python_version >= '3.14'",
|
|
54
|
+
"pydantic>=2.12.0; python_version >= '3.14'",
|
|
55
|
+
"troml-dev-status>=0.4.1; python_version >= '3.9'",
|
|
56
|
+
"git2md; python_version >= '3.10'",
|
|
57
|
+
"pyclean; python_version >= '3.12'",
|
|
58
|
+
"strip-docs>=1.0; python_version >= '3.12'",
|
|
59
|
+
"gha-update; python_version >= '3.12'",
|
|
60
|
+
"mkdocstrings[python]",
|
|
61
|
+
"mkdocs; python_version >= '3.12'",
|
|
62
|
+
"mdformat",
|
|
63
|
+
# plugin finder
|
|
64
|
+
"packaging; python_version >= '3.8'",
|
|
65
|
+
# mpy
|
|
66
|
+
"mypy; python_version >= '3.8'",
|
|
67
|
+
"types-toml; python_version >= '3.8'",
|
|
68
|
+
"types-jsonschema; python_version >= '3.8'",
|
|
69
|
+
# reports
|
|
70
|
+
|
|
71
|
+
# build
|
|
72
|
+
"vermin; python_version >= '3.8'",
|
|
73
|
+
"metametameta>=0.1.3; python_version >= '3.9'",
|
|
74
|
+
"hatchling; python_version >= '3.8'",
|
|
75
|
+
"ruff>=0.12.0; python_version >= '3.8'",
|
|
76
|
+
"pylint; python_version >= '3.8'",
|
|
77
|
+
"bandit; python_version >= '3.8'",
|
|
78
|
+
"pre-commit; python_version >= '3.8'",
|
|
79
|
+
# testing tools
|
|
80
|
+
"pytest; python_version >= '3.8'",
|
|
81
|
+
"pytest-cov; python_version >= '3.8'",
|
|
82
|
+
"pytest-xdist>=3.5.0; python_version >= '3.8'",
|
|
83
|
+
# broken if numpy installed
|
|
84
|
+
# "pytest-randomly>=3.15.0; python_version >= '3.8'",
|
|
85
|
+
"pytest-sugar>=0.9.7; python_version >= '3.8'",
|
|
86
|
+
"pytest-mock; python_version >= '3.8'",
|
|
87
|
+
"pytest-unused-fixtures; python_version >= '3.10'",
|
|
88
|
+
"hypothesis[cli]; python_version >= '3.8'",
|
|
89
|
+
"detect-test-pollution",
|
|
90
|
+
"pytest-timeout>=2.4.0",
|
|
91
|
+
# docs
|
|
92
|
+
"interrogate>=1.5.0; python_version >= '3.8'",
|
|
93
|
+
"pydoctest==0.2.1; python_version >= '3.8'",
|
|
94
|
+
"pdoc3>=0.5.0; python_version >= '3.8'",
|
|
95
|
+
"mdformat>=0.5.0; python_version >= '3.8'",
|
|
96
|
+
"linkcheckmd>=1.4.0; python_version >= '3.8'",
|
|
97
|
+
"codespell>=2.2.6; python_version >= '3.8'",
|
|
98
|
+
"pyenchant>=3.2.2; python_version >= '3.8'",
|
|
99
|
+
]
|
|
100
|
+
|
|
101
|
+
[project.urls]
|
|
102
|
+
Homepage = "https://github.com/matthewdeanmartin/skip-trace"
|
|
103
|
+
Issues = "https://github.com/matthewdeanmartin/skip-trace/issues"
|
|
104
|
+
|
|
105
|
+
[build-system]
|
|
106
|
+
requires = ["hatchling"]
|
|
107
|
+
build-backend = "hatchling.build"
|
|
108
|
+
|
|
109
|
+
#[tool.hatch.build.targets.wheel.sources]
|
|
110
|
+
#"something..." = "skip_trace/..."
|
|
111
|
+
|
|
112
|
+
[tool.hatch.build.targets.wheel]
|
|
113
|
+
packages = ["skip_trace"]
|
|
114
|
+
include = [
|
|
115
|
+
"skip_trace/**/*.py",
|
|
116
|
+
"skip_trace/py.typed",
|
|
117
|
+
"/README.md", "LICENSE",
|
|
118
|
+
]
|
|
119
|
+
|
|
120
|
+
[tool.hatch.build.targets.sdist]
|
|
121
|
+
include = ["/README.md", "LICENSE", "/skip_trace", "/test"]
|
|
122
|
+
|
|
123
|
+
#
|
|
124
|
+
#[project.optional-dependencies]
|
|
125
|
+
#llm = ["openai>=1.3.0"]
|
|
126
|
+
#sigstore = ["sigstore>=1.0.0"]
|
|
127
|
+
|
|
128
|
+
[project.scripts]
|
|
129
|
+
skip-trace = "skip_trace.cli:main"
|
|
130
|
+
|
|
131
|
+
|
|
132
|
+
[tool.uv.sources]
|
|
133
|
+
en-core-web-sm = { url = "https://github.com/explosion/spacy-models/releases/download/en_core_web_sm-3.8.0/en_core_web_sm-3.8.0-py3-none-any.whl" }
|
|
134
|
+
|
|
135
|
+
|
|
136
|
+
# --- Skip-Trace Application Configuration ---
|
|
137
|
+
[tool.skip-trace]
|
|
138
|
+
# Initial scoring weights, tunable as per the PEP
|
|
139
|
+
default_min_score = 0.70
|
|
140
|
+
default_fail_under = 0.50
|
|
141
|
+
entity_resolution_llm = false # As requested, disabled by default
|
|
142
|
+
|
|
143
|
+
[tool.skip-trace.weights]
|
|
144
|
+
"verified_release_signature" = 0.50
|
|
145
|
+
"repo_org_matches_email_domain" = 0.35
|
|
146
|
+
"codeowners_org_team" = 0.25
|
|
147
|
+
"pypi_maintainer_corporate_domain" = 0.20
|
|
148
|
+
"local_copyright_header_org" = 0.25
|
|
149
|
+
"governance_doc_org" = 0.20
|
|
150
|
+
"llm_ner_claim" = 0.20 # Max weight for an LLM-only claim
|
|
151
|
+
"conflict" = -0.15
|
|
152
|
+
|
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
"""Metadata for skip_trace."""
|
|
2
|
+
|
|
3
|
+
__all__ = [
|
|
4
|
+
"__title__",
|
|
5
|
+
"__version__",
|
|
6
|
+
"__description__",
|
|
7
|
+
"__readme__",
|
|
8
|
+
"__credits__",
|
|
9
|
+
"__requires_python__",
|
|
10
|
+
"__status__",
|
|
11
|
+
]
|
|
12
|
+
|
|
13
|
+
__title__ = "skip-trace"
|
|
14
|
+
__version__ = "0.1.0"
|
|
15
|
+
__description__ = "Ownership Attribution for Python Packages"
|
|
16
|
+
__readme__ = "README.md"
|
|
17
|
+
__credits__ = [{"name": "Matthew Dean Martin", "email": "matthewdeanmartin@gmail.com"}]
|
|
18
|
+
__requires_python__ = ">=3.8"
|
|
19
|
+
__status__ = "1 - Planning"
|