software-intake-gatekeeper 0.2.1__tar.gz → 0.2.2__tar.gz

{software_intake_gatekeeper-0.2.1 → software_intake_gatekeeper-0.2.2}/CHANGELOG.md

@@ -3,6 +3,17 @@
 All notable changes are recorded here. The project follows [Semantic Versioning](https://semver.org/);
 while the major version is 0, minor releases may change behaviour.
 
+## [0.2.2] - 2026-10-15
+
+### Fixed
+
+- Update check: code findings in bundles whose file names carry a content hash
+  (`index-Cz8Eo_n9.js`, `main.3f2a1b9c.js`) are matched across versions instead of being reported
+  as new and resolved. Found on a real MarkText 0.21.1 to 0.21.2 comparison, where it removed 10
+  false new findings.
+- Network endpoints only count URLs that start a string literal. URLs in comments and license
+  headers are no longer reported; on the same comparison, new endpoints dropped from 44 to 1.
+
 ## [0.2.1] - 2026-10-15
 
 ### Added
@@ -52,6 +63,7 @@ First public release and first GitHub Marketplace listing.
 - No Rust `cargo auditable`, Python wheel, Java or native C/C++ inventories yet.
 - Electron code rules detect literal settings only.
 
+[0.2.2]: https://github.com/Sushant-Nemade/software-intake-gatekeeper/releases/tag/v0.2.2
 [0.2.1]: https://github.com/Sushant-Nemade/software-intake-gatekeeper/releases/tag/v0.2.1
 [0.2.0]: https://github.com/Sushant-Nemade/software-intake-gatekeeper/releases/tag/v0.2.0
 [0.1.0]: https://github.com/Sushant-Nemade/software-intake-gatekeeper/releases/tag/v0.1.0

{software_intake_gatekeeper-0.2.1 → software_intake_gatekeeper-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: software-intake-gatekeeper
-Version: 0.2.1
+Version: 0.2.2
 Summary: Local, evidence-first intake checks for third-party apps and binaries: SBOM, known vulnerabilities and Electron hardening.
 Project-URL: Homepage, https://github.com/Sushant-Nemade/software-intake-gatekeeper
 Project-URL: Source, https://github.com/Sushant-Nemade/software-intake-gatekeeper
@@ -61,7 +61,7 @@ Every finding names the file and, for scripts, the line, column and snippet that
 Anything the scanner could not verify is reported as a **coverage gap**. A blocking gap can
 never lead to APPROVE: an unknown result is not treated as safe.
 
-> Status: [v0.2.1](https://github.com/Sushant-Nemade/software-intake-gatekeeper/releases/tag/v0.2.1),
+> Status: [v0.2.2](https://github.com/Sushant-Nemade/software-intake-gatekeeper/releases/tag/v0.2.2),
 > an alpha release on [PyPI](https://pypi.org/project/software-intake-gatekeeper/) and the
 > [GitHub Marketplace](https://github.com/marketplace/actions/software-intake-gatekeeper). The CLI is
 > tested on Windows and Linux with real Go binaries in three object formats, an ASAR archive packed
@@ -94,9 +94,9 @@ python -m pip install software-intake-gatekeeper
 To verify build provenance first, install the wheel from the GitHub release instead:
 
 ```powershell
-gh release download v0.2.1 -R Sushant-Nemade/software-intake-gatekeeper -p "*.whl"
-gh attestation verify software_intake_gatekeeper-0.2.1-py3-none-any.whl -R Sushant-Nemade/software-intake-gatekeeper
-python -m pip install software_intake_gatekeeper-0.2.1-py3-none-any.whl
+gh release download v0.2.2 -R Sushant-Nemade/software-intake-gatekeeper -p "*.whl"
+gh attestation verify software_intake_gatekeeper-0.2.2-py3-none-any.whl -R Sushant-Nemade/software-intake-gatekeeper
+python -m pip install software_intake_gatekeeper-0.2.2-py3-none-any.whl
 ```
 
 Or install from a clone (needed for the demo below):
@@ -187,10 +187,10 @@ Components changed: 2 | endpoints +1/-0 | binaries +1/-0/~0
 
 | The update check reports | How it is matched |
 |---|---|
-| New and resolved findings | Advisory id plus package name (so a version bump that keeps the bug counts as persisting), or rule plus file |
+| New and resolved findings | Advisory id plus package name (so a version bump that keeps the bug counts as persisting), or rule plus file. Content hashes in bundle names (`index-Cz8Eo_n9.js`, `main.3f2a1b9c.js`) are ignored, so a rebuilt bundle does not look new |
 | Component changes | Added, removed or changed versions per ecosystem and name |
 | Electron | Runtime version change and every fuse change; a fuse moving into its risky state is **weakened** |
-| Network endpoints | Hosts in `http(s)://` and `ws(s)://` URLs in app code (outside `node_modules`), without XML namespaces or local addresses |
+| Network endpoints | Hosts of `http(s)://` and `ws(s)://` URLs that start a string literal in app code (outside `node_modules`); URLs in comments and license headers, XML namespaces and local addresses are skipped |
 | Executables and native modules | Added, removed or changed (SHA-256) PE, ELF and Mach-O files, including `.node` modules |
 
 **REJECT** if a new finding reaches `reject_at`. **REVIEW** for new findings at `review_at`, weakened
@@ -359,6 +359,7 @@ and a `SHA256SUMS` file.
 | Output formats | CycloneDX validated with `cyclonedx-python-lib` against the 1.6 schema in tests. SARIF validated against the OASIS 2.1.0 schema during development |
 | OSV client | Mocked transport tests (batching, pagination, retries, alias grouping, withdrawn advisories) plus an opt-in live test (`INTAKE_LIVE_OSV=1`) |
 | Scale | Read-only scan of a locally installed VS Code: 3,243 files and 5,451 archive entries in about 19 s with a warm file cache |
+| Real update | Update check of the open-source editor MarkText 0.21.1 to 0.21.2 (official Windows zips, checksums verified; 20,072 ASAR entries, 505 npm packages, live OSV) in about 30 s. It showed 27 resolved advisories, 49 new packages and changed native modules. The first run also reported 10 new and 10 resolved code findings that were only a renamed bundle (`index-BBEVtY79.js` to `index-Cz8Eo_n9.js`), and 44 new endpoints taken from code comments; v0.2.2 fixed both, leaving 0 new findings and 1 new endpoint |
 | CI | Ubuntu (Python 3.11 and 3.13) and Windows (3.13): pytest, ruff, mypy `--strict`, build, twine, pip-audit. The action itself runs on Ubuntu, Windows and macOS against the demo with live OSV, plus fail-on, invalid-input and update-check (`compare-to`) runs |
 
 No third-party application files are committed. The local real-app checks are listed for

{software_intake_gatekeeper-0.2.1 → software_intake_gatekeeper-0.2.2}/README.md

@@ -23,7 +23,7 @@ Every finding names the file and, for scripts, the line, column and snippet that
 Anything the scanner could not verify is reported as a **coverage gap**. A blocking gap can
 never lead to APPROVE: an unknown result is not treated as safe.
 
-> Status: [v0.2.1](https://github.com/Sushant-Nemade/software-intake-gatekeeper/releases/tag/v0.2.1),
+> Status: [v0.2.2](https://github.com/Sushant-Nemade/software-intake-gatekeeper/releases/tag/v0.2.2),
 > an alpha release on [PyPI](https://pypi.org/project/software-intake-gatekeeper/) and the
 > [GitHub Marketplace](https://github.com/marketplace/actions/software-intake-gatekeeper). The CLI is
 > tested on Windows and Linux with real Go binaries in three object formats, an ASAR archive packed
@@ -56,9 +56,9 @@ python -m pip install software-intake-gatekeeper
 To verify build provenance first, install the wheel from the GitHub release instead:
 
 ```powershell
-gh release download v0.2.1 -R Sushant-Nemade/software-intake-gatekeeper -p "*.whl"
-gh attestation verify software_intake_gatekeeper-0.2.1-py3-none-any.whl -R Sushant-Nemade/software-intake-gatekeeper
-python -m pip install software_intake_gatekeeper-0.2.1-py3-none-any.whl
+gh release download v0.2.2 -R Sushant-Nemade/software-intake-gatekeeper -p "*.whl"
+gh attestation verify software_intake_gatekeeper-0.2.2-py3-none-any.whl -R Sushant-Nemade/software-intake-gatekeeper
+python -m pip install software_intake_gatekeeper-0.2.2-py3-none-any.whl
 ```
 
 Or install from a clone (needed for the demo below):
@@ -149,10 +149,10 @@ Components changed: 2 | endpoints +1/-0 | binaries +1/-0/~0
 
 | The update check reports | How it is matched |
 |---|---|
-| New and resolved findings | Advisory id plus package name (so a version bump that keeps the bug counts as persisting), or rule plus file |
+| New and resolved findings | Advisory id plus package name (so a version bump that keeps the bug counts as persisting), or rule plus file. Content hashes in bundle names (`index-Cz8Eo_n9.js`, `main.3f2a1b9c.js`) are ignored, so a rebuilt bundle does not look new |
 | Component changes | Added, removed or changed versions per ecosystem and name |
 | Electron | Runtime version change and every fuse change; a fuse moving into its risky state is **weakened** |
-| Network endpoints | Hosts in `http(s)://` and `ws(s)://` URLs in app code (outside `node_modules`), without XML namespaces or local addresses |
+| Network endpoints | Hosts of `http(s)://` and `ws(s)://` URLs that start a string literal in app code (outside `node_modules`); URLs in comments and license headers, XML namespaces and local addresses are skipped |
 | Executables and native modules | Added, removed or changed (SHA-256) PE, ELF and Mach-O files, including `.node` modules |
 
 **REJECT** if a new finding reaches `reject_at`. **REVIEW** for new findings at `review_at`, weakened
@@ -321,6 +321,7 @@ and a `SHA256SUMS` file.
 | Output formats | CycloneDX validated with `cyclonedx-python-lib` against the 1.6 schema in tests. SARIF validated against the OASIS 2.1.0 schema during development |
 | OSV client | Mocked transport tests (batching, pagination, retries, alias grouping, withdrawn advisories) plus an opt-in live test (`INTAKE_LIVE_OSV=1`) |
 | Scale | Read-only scan of a locally installed VS Code: 3,243 files and 5,451 archive entries in about 19 s with a warm file cache |
+| Real update | Update check of the open-source editor MarkText 0.21.1 to 0.21.2 (official Windows zips, checksums verified; 20,072 ASAR entries, 505 npm packages, live OSV) in about 30 s. It showed 27 resolved advisories, 49 new packages and changed native modules. The first run also reported 10 new and 10 resolved code findings that were only a renamed bundle (`index-BBEVtY79.js` to `index-Cz8Eo_n9.js`), and 44 new endpoints taken from code comments; v0.2.2 fixed both, leaving 0 new findings and 1 new endpoint |
 | CI | Ubuntu (Python 3.11 and 3.13) and Windows (3.13): pytest, ruff, mypy `--strict`, build, twine, pip-audit. The action itself runs on Ubuntu, Windows and macOS against the demo with live OSV, plus fail-on, invalid-input and update-check (`compare-to`) runs |
 
 No third-party application files are committed. The local real-app checks are listed for

{software_intake_gatekeeper-0.2.1 → software_intake_gatekeeper-0.2.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "software-intake-gatekeeper"
-version = "0.2.1"
+version = "0.2.2"
 description = "Local, evidence-first intake checks for third-party apps and binaries: SBOM, known vulnerabilities and Electron hardening."
 readme = "README.md"
 license = "MIT"

{software_intake_gatekeeper-0.2.1 → software_intake_gatekeeper-0.2.2}/src/intake_gatekeeper/__init__.py

@@ -1,3 +1,3 @@
 """Software Intake Gatekeeper: evidence-first intake checks for third-party software."""
 
-__version__ = "0.2.1"
+__version__ = "0.2.2"

{software_intake_gatekeeper-0.2.1 → software_intake_gatekeeper-0.2.2}/src/intake_gatekeeper/diff.py

@@ -2,6 +2,7 @@
 
 from __future__ import annotations
 
+import re
 from dataclasses import dataclass, field
 
 from intake_gatekeeper.electron import FUSE_RULES
@@ -53,10 +54,19 @@ class UpdateDiff:
     reasons: list[str] = field(default_factory=list)
 
 
+# Content hashes that bundlers put in file names (index-Cz8Eo_n9.js, main.3f2a1b9c.js) change every build.
+_CONTENT_HASH = re.compile(r"([.-])(?=[A-Za-z_-]*\d)[A-Za-z0-9_-]{8,}(?=\.(?:m?js|cjs|css)$)")
+
+
+def stable_path(path: str) -> str:
+    head, slash, name = path.rpartition("/")
+    return head + slash + _CONTENT_HASH.sub(r"\1*", name)
+
+
 def _finding_key(finding: Finding) -> tuple[str, str]:
     if finding.component_purl:
         return finding.rule_id, finding.component_purl.rsplit("@", 1)[0]
-    return finding.rule_id, finding.location.path if finding.location else ""
+    return finding.rule_id, stable_path(finding.location.path) if finding.location else ""
 
 
 def _versions(report: Report) -> dict[tuple[str, str], set[str]]:

{software_intake_gatekeeper-0.2.1 → software_intake_gatekeeper-0.2.2}/src/intake_gatekeeper/electron.py

@@ -130,7 +130,10 @@ def find_electron_versions(data: Bytes) -> list[str]:
     return sorted(versions)
 
 
-_URL_HOST = re.compile(r"(?:https?|wss?)://([A-Za-z0-9-]{1,63}(?:\.[A-Za-z0-9-]{1,63})+)(?![A-Za-z0-9-])")
+# Only URLs that start a string literal: code calls those, while comments and license headers do not.
+_URL_HOST = re.compile(
+    r"[\"'`](?:https?|wss?)://([A-Za-z0-9-]{1,63}(?:\.[A-Za-z0-9-]{1,63})+)(?![A-Za-z0-9-])"
+)
 # Namespace and spec URLs that appear in almost every bundle but are not network endpoints.
 _NOT_ENDPOINTS = {
     "www.w3.org",

{software_intake_gatekeeper-0.2.1 → software_intake_gatekeeper-0.2.2}/tests/test_diff.py

@@ -159,3 +159,49 @@ def test_endpoints_ignore_namespaces_and_local_hosts() -> None:
         'c="http://127.0.0.1/" d="wss://socket.vendor.example" e="https://cdn.vendor.example."'
     )
     assert find_endpoints(text) == {"api.vendor.example", "socket.vendor.example", "cdn.vendor.example"}
+
+
+def test_endpoints_skip_urls_in_comments_and_prose() -> None:
+    from intake_gatekeeper.electron import find_endpoints
+
+    text = (
+        "/*! lib v1 | (c) https://license-host.example */\n"
+        "// see https://docs.example/issue\n"
+        'throw new Error("Read https://help.example/x");\n'
+        "fetch('https://api.vendor.example/v1'); new WebSocket(`wss://live.vendor.example/s`);\n"
+    )
+    assert find_endpoints(text) == {"api.vendor.example", "live.vendor.example"}
+
+
+@pytest.mark.parametrize(
+    ("path", "expected"),
+    [
+        (
+            "resources/app.asar!/out/renderer/assets/index-Cz8Eo_n9.js",
+            "resources/app.asar!/out/renderer/assets/index-*.js",
+        ),
+        ("dist/main.3f2a1b9c.js", "dist/main.*.js"),
+        ("dist/vendors-chunk.0a1b2c3d4e5f.css", "dist/vendors-chunk.*.css"),
+        ("resources/app/main.js", "resources/app/main.js"),
+        ("out/index-renderer.js", "out/index-renderer.js"),
+        ("out/polyfills-es2015.js", "out/polyfills-es2015.js"),
+        ("index-Cz8Eo_n9.js", "index-*.js"),
+    ],
+)
+def test_stable_path_ignores_content_hashes(path: str, expected: str) -> None:
+    from intake_gatekeeper.diff import stable_path
+
+    assert stable_path(path) == expected
+
+
+def test_renamed_bundle_keeps_findings_persisting(tmp_path: Path) -> None:
+    code = "new BrowserWindow({ webPreferences: { nodeIntegration: true } });\n"
+    old, new = tmp_path / "old" / "assets", tmp_path / "new" / "assets"
+    old.mkdir(parents=True)
+    new.mkdir(parents=True)
+    (old / "index-BBEVtY79.js").write_text(code, encoding="utf-8")
+    (new / "index-Cz8Eo_n9.js").write_text(code, encoding="utf-8")
+    diff = compare(_scan(old.parent), _scan(new.parent), OFFLINE)
+    assert diff.new_findings == [] and diff.resolved_findings == []
+    assert diff.persisting_findings == 1
+    assert diff.decision is Decision.APPROVE