software-intake-gatekeeper 0.2.2__tar.gz → 0.3.0__tar.gz

{software_intake_gatekeeper-0.2.2 → software_intake_gatekeeper-0.3.0}/.gitignore

@@ -13,3 +13,4 @@ examples/vulnerable-demo/bin/
 tests/.go-fixtures/
 reports/
 intake-gatekeeper.*
+examples/rust-demo/target/

{software_intake_gatekeeper-0.2.2 → software_intake_gatekeeper-0.3.0}/CHANGELOG.md

@@ -3,6 +3,28 @@
 All notable changes are recorded here. The project follows [Semantic Versioning](https://semver.org/);
 while the major version is 0, minor releases may change behaviour.
 
+## [0.3.0] - 2026-10-18
+
+### Added
+
+- Rust inventory from `cargo auditable` data (`.dep-v0` section) in ELF, PE and Mach-O, including
+  universal binaries, through a new bounded, dependency-free object-file reader. Build-only crates,
+  the root package and non-crates.io sources are listed but not sent to OSV.
+- Python inventory from `*.dist-info/METADATA` and `*.egg-info` metadata (`pkg:pypi`, PEP 503 names).
+- Maven inventory from `pom.properties` inside `.jar`, `.war` and `.ear` files, including nested
+  archives up to two levels (Spring Boot, WAR) read in memory with size and entry limits.
+- Authenticode signer (subject, issuer, SHA-1 thumbprint) for PE files, without verification.
+- Update check: removed signatures and a different signer on the same path need REVIEW; renewed
+  certificates from the same signer and newly signed files are listed only.
+- Real-artifact CI job on Linux, Windows and macOS: `cargo auditable` builds compared with
+  `rust-audit-info`, Maven Central and PyPI artifacts with live OSV, and Windows'
+  `Get-AuthenticodeSignature`.
+
+### Changed
+
+- The `nothing-recognized` gap now says how many binaries were fingerprinted without dependency data.
+- Files that start with `MZ` but have no PE header are treated as non-PE instead of malformed.
+
 ## [0.2.2] - 2026-10-15
 
 ### Fixed
@@ -63,6 +85,7 @@ First public release and first GitHub Marketplace listing.
 - No Rust `cargo auditable`, Python wheel, Java or native C/C++ inventories yet.
 - Electron code rules detect literal settings only.
 
+[0.3.0]: https://github.com/Sushant-Nemade/software-intake-gatekeeper/releases/tag/v0.3.0
 [0.2.2]: https://github.com/Sushant-Nemade/software-intake-gatekeeper/releases/tag/v0.2.2
 [0.2.1]: https://github.com/Sushant-Nemade/software-intake-gatekeeper/releases/tag/v0.2.1
 [0.2.0]: https://github.com/Sushant-Nemade/software-intake-gatekeeper/releases/tag/v0.2.0

{software_intake_gatekeeper-0.2.2 → software_intake_gatekeeper-0.3.0}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.5
 Name: software-intake-gatekeeper
-Version: 0.2.2
-Summary: Local, evidence-first intake checks for third-party apps and binaries: SBOM, known vulnerabilities and Electron hardening.
+Version: 0.3.0
+Summary: Local, evidence-first intake checks for third-party apps and binaries: SBOM (Go, Rust, npm, NuGet, Python, Maven), known vulnerabilities, Electron hardening and code-signing changes.
 Project-URL: Homepage, https://github.com/Sushant-Nemade/software-intake-gatekeeper
 Project-URL: Source, https://github.com/Sushant-Nemade/software-intake-gatekeeper
 Project-URL: Changelog, https://github.com/Sushant-Nemade/software-intake-gatekeeper/blob/main/CHANGELOG.md
@@ -10,7 +10,7 @@ Project-URL: GitHub Marketplace, https://github.com/marketplace/actions/software
 Author: Sushant Nemade
 License-Expression: MIT
 License-File: LICENSE
-Keywords: cyclonedx,electron,osv,sarif,sbom,security,supply-chain
+Keywords: authenticode,cargo-auditable,cyclonedx,electron,maven,osv,sarif,sbom,security,supply-chain
 Classifier: Development Status :: 3 - Alpha
 Classifier: Environment :: Console
 Classifier: Intended Audience :: Developers
@@ -28,6 +28,7 @@ Requires-Dist: httpx<1,>=0.28
 Requires-Dist: truststore>=0.10
 Provides-Extra: dev
 Requires-Dist: build>=1.2; extra == 'dev'
+Requires-Dist: cryptography>=44; extra == 'dev'
 Requires-Dist: cyclonedx-python-lib[json-validation]>=9; extra == 'dev'
 Requires-Dist: mypy>=1.13; extra == 'dev'
 Requires-Dist: pip-audit>=2.7; extra == 'dev'
@@ -45,28 +46,33 @@ Description-Content-Type: text/markdown
 
 **Before you install, approve or ship a third-party app, find out what is inside it.**
 
-Software Intake Gatekeeper reads an installed application, an Electron `.asar` archive or a
-compiled binary. It never runs or unpacks it. It produces:
+Software Intake Gatekeeper reads an installed application, an Electron `.asar` archive, a Java
+archive or a compiled binary. It never runs or unpacks it. It produces:
 
-- a **CycloneDX 1.6 SBOM** of the components that are actually bundled,
+- a **CycloneDX 1.6 SBOM** of the components that are actually bundled: Go, Rust, npm, NuGet,
+  Python and Maven packages, read from evidence inside the files,
 - **known vulnerabilities** for those exact versions from [OSV.dev](https://osv.dev) (only when you opt in),
 - **Electron hardening checks** for the fuse wire inside the executable and risky `BrowserWindow`
   settings in the app code,
+- the **Authenticode signer** of each Windows executable,
 - an **APPROVE / REVIEW / REJECT** decision from a versioned policy, with expiring waivers,
 - an **update check** that compares two versions and gates on what the update *adds*: new
-  vulnerabilities, weakened Electron fuses, new network endpoints, new native modules,
+  vulnerabilities, weakened Electron fuses, new network endpoints, new native modules, removed
+  signatures and a different publisher,
 - **SARIF** for GitHub code scanning, a **Markdown** summary for pull requests and a full **JSON** evidence report.
 
 Every finding names the file and, for scripts, the line, column and snippet that produced it.
 Anything the scanner could not verify is reported as a **coverage gap**. A blocking gap can
 never lead to APPROVE: an unknown result is not treated as safe.
 
-> Status: [v0.2.2](https://github.com/Sushant-Nemade/software-intake-gatekeeper/releases/tag/v0.2.2),
+> Status: [v0.3.0](https://github.com/Sushant-Nemade/software-intake-gatekeeper/releases/tag/v0.3.0),
 > an alpha release on [PyPI](https://pypi.org/project/software-intake-gatekeeper/) and the
-> [GitHub Marketplace](https://github.com/marketplace/actions/software-intake-gatekeeper). The CLI is
-> tested on Windows and Linux with real Go binaries in three object formats, an ASAR archive packed
-> by the official `@electron/asar` tool and the live OSV API; the action also runs on macOS. The
-> results are static, version-level evidence, not proof of exploitability.
+> [GitHub Marketplace](https://github.com/marketplace/actions/software-intake-gatekeeper). Every
+> parser is checked against real artifacts: Go binaries in three object formats, `cargo auditable`
+> builds compared with the official `rust-audit-info` decoder on Linux, Windows and macOS, JARs from
+> Maven Central, packages installed by pip, signed executables compared with Windows'
+> `Get-AuthenticodeSignature`, and the live OSV API. The results are static, version-level
+> evidence, not proof of exploitability.
 
 Part of a small **software trust toolkit** with
 [Privacy Flow Inspector](https://github.com/Sushant-Nemade/privacy-flow-inspector): this tool checks
@@ -79,6 +85,8 @@ what is **inside** an app; the inspector checks which personal data the app **se
 | Who | Situation | What they get |
 |---|---|---|
 | IT / security intake | An employee requests a desktop tool (an Electron or Go CLI) | An SBOM, known CVEs and Electron hardening issues before approval, with a decision a reviewer can sign off |
+| Platform and backend teams | A vendor ships a Spring Boot service, a Python tool or a Rust CLI | Maven coordinates from nested JARs (Log4Shell is found inside `BOOT-INF/lib`), Python package versions and Rust crates, each with advisories |
+| Patch management | A new version of an approved app arrives | An update check that flags a removed signature or a different publisher before the rollout |
 | Product teams shipping Electron | A release candidate is ready | A CI gate that fails when `contextIsolation` is off, `RunAsNode` is enabled or bundled packages have critical advisories |
 | Supply-chain / compliance (EU CRA, medical-device SBOM expectations) | A vendor delivers a binary without an SBOM | A CycloneDX SBOM built from evidence inside the binary, with occurrences pointing to the source files |
 | Procurement / vendor review | Comparing two vendor builds | Reproducible JSON and SBOM output that can be compared across versions |
@@ -94,9 +102,9 @@ python -m pip install software-intake-gatekeeper
 To verify build provenance first, install the wheel from the GitHub release instead:
 
 ```powershell
-gh release download v0.2.2 -R Sushant-Nemade/software-intake-gatekeeper -p "*.whl"
-gh attestation verify software_intake_gatekeeper-0.2.2-py3-none-any.whl -R Sushant-Nemade/software-intake-gatekeeper
-python -m pip install software_intake_gatekeeper-0.2.2-py3-none-any.whl
+gh release download v0.3.0 -R Sushant-Nemade/software-intake-gatekeeper -p "*.whl"
+gh attestation verify software_intake_gatekeeper-0.3.0-py3-none-any.whl -R Sushant-Nemade/software-intake-gatekeeper
+python -m pip install software_intake_gatekeeper-0.3.0-py3-none-any.whl
 ```
 
 Or install from a clone (needed for the demo below):
@@ -192,23 +200,29 @@ Components changed: 2 | endpoints +1/-0 | binaries +1/-0/~0
 | Electron | Runtime version change and every fuse change; a fuse moving into its risky state is **weakened** |
 | Network endpoints | Hosts of `http(s)://` and `ws(s)://` URLs that start a string literal in app code (outside `node_modules`); URLs in comments and license headers, XML namespaces and local addresses are skipped |
 | Executables and native modules | Added, removed or changed (SHA-256) PE, ELF and Mach-O files, including `.node` modules |
+| Code signing | For the same file path: signature **removed**, **signer-changed** (different subject), `certificate-renewed` (same subject, new certificate) or `added` |
 
 **REJECT** if a new finding reaches `reject_at`. **REVIEW** for new findings at `review_at`, weakened
-fuses, new endpoints, new binaries, new components or blocking gaps in the new version.
-**APPROVE** otherwise. The SARIF output contains only the new findings.
+fuses, new endpoints, new binaries, new components, removed signatures, a different signer or
+blocking gaps in the new version. **APPROVE** otherwise. The SARIF output contains only the new
+findings.
 
 ## What it inspects
 
 | Evidence | Source inside the target | Output |
 |---|---|---|
 | Go modules and toolchain | Build info embedded by the Go linker (Go 1.18+) in PE, ELF and Mach-O executables | `pkg:golang/...` components, including `stdlib` and `replace` directives |
+| Rust crates | The zlib-compressed `.dep-v0` section that [`cargo auditable`](https://github.com/rust-secure-code/cargo-auditable) embeds in ELF, PE and Mach-O (including universal) binaries | `pkg:cargo/...` components; build-only crates and non-crates.io sources are listed but not queried |
+| Python packages | `*.dist-info/METADATA` and `*.egg-info` (`PKG-INFO`) on disk, for example a bundled `site-packages` | `pkg:pypi/...` components with PEP 503 names |
+| Maven artifacts | `META-INF/maven/**/pom.properties` in `.jar`, `.war` and `.ear` files, including nested archives such as Spring Boot `BOOT-INF/lib` and `WEB-INF/lib` (two levels, read in memory) | `pkg:maven/...` components, also for shaded dependencies |
 | npm packages | `node_modules/**/package.json` on disk and inside `.asar` archives | `pkg:npm/...` components; the app's own manifest is recorded but not queried |
 | NuGet packages | `*.deps.json` (`package` and self-contained `runtimepack` entries) | `pkg:nuget/...` components |
 | .NET shared framework | `*.runtimeconfig.json` | Minimum framework version, plus a note that the host runtime decides the patch level |
 | Electron runtime | The fuse sentinel and `Electron/x.y.z` string in the executable | Electron version (queried as npm `electron`) and the fuse states |
 | Electron app code | `.js/.cjs/.mjs/.ts` files outside `node_modules`, on disk or in `.asar` | `webPreferences` rule findings with line, column and snippet |
 | Network endpoints | `http(s)://` and `ws(s)://` hosts referenced by that app code | Host list with up to three source files each (used by the update check) |
-| Executables and native modules | PE, ELF and Mach-O files, including `.node` add-ons | Path, size, SHA-256 and kind (Go, Electron, native) |
+| Executables and native modules | PE, ELF and Mach-O files, including `.node` add-ons | Path, size, SHA-256 and kind (Go, Rust, Electron, native) |
+| Code signing | The Authenticode certificate table of PE files | Claimed signer subject, issuer and SHA-1 thumbprint (the value Windows shows); not cryptographically verified |
 
 ### Electron rules
 
@@ -354,23 +368,32 @@ and a `SHA256SUMS` file.
 | Check | How |
 |---|---|
 | Go build info decoding | Compared with `go version -m` on real binaries built in CI for Windows PE, Linux ELF and macOS Mach-O |
+| Rust `cargo auditable` | CI builds a fixture with `cargo auditable` 0.7.7 on Linux, Windows and macOS and requires the same crates as the official `rust-audit-info` 0.5.4 decoder, then finds RUSTSEC-2021-0003 through live OSV. Locally, Alpine Linux's official `ripgrep` 14.1.1 binary decoded to 42 crates, every one matching ripgrep's `Cargo.lock` |
+| Maven and Python | CI downloads `log4j-core` 2.14.1 from Maven Central (SHA-1 checked), nests it in a Spring Boot style JAR and requires Log4Shell (CVE-2021-44228); pip installs `requests` 2.25.0 and CVE-2023-32681 must be found. Locally, `jackson-databind` 2.9.10 nested in a fat JAR returned 49 advisories |
+| Authenticode | CI compares signer and thumbprint with Windows' `Get-AuthenticodeSignature` for a signed executable. Locally identical for VS Code, Node.js, Git and uv; catalog-signed and unsigned files report no embedded signature |
 | ASAR parsing | Fixture packed by `@electron/asar` 4.3.1; listing matches the official tool |
 | Fuse decoding | Wire layout taken from `@electron/fuses`. A read-only local check on an installed Electron app (VS Code) matched `npx @electron/fuses read` for all 9 fuses |
 | Output formats | CycloneDX validated with `cyclonedx-python-lib` against the 1.6 schema in tests. SARIF validated against the OASIS 2.1.0 schema during development |
 | OSV client | Mocked transport tests (batching, pagination, retries, alias grouping, withdrawn advisories) plus an opt-in live test (`INTAKE_LIVE_OSV=1`) |
 | Scale | Read-only scan of a locally installed VS Code: 3,243 files and 5,451 archive entries in about 19 s with a warm file cache |
 | Real update | Update check of the open-source editor MarkText 0.21.1 to 0.21.2 (official Windows zips, checksums verified; 20,072 ASAR entries, 505 npm packages, live OSV) in about 30 s. It showed 27 resolved advisories, 49 new packages and changed native modules. The first run also reported 10 new and 10 resolved code findings that were only a renamed bundle (`index-BBEVtY79.js` to `index-Cz8Eo_n9.js`), and 44 new endpoints taken from code comments; v0.2.2 fixed both, leaving 0 new findings and 1 new endpoint |
-| CI | Ubuntu (Python 3.11 and 3.13) and Windows (3.13): pytest, ruff, mypy `--strict`, build, twine, pip-audit. The action itself runs on Ubuntu, Windows and macOS against the demo with live OSV, plus fail-on, invalid-input and update-check (`compare-to`) runs |
+| CI | Ubuntu (Python 3.11 and 3.13) and Windows (3.13): pytest, ruff, mypy `--strict`, build, twine, pip-audit. A real-artifact job on Ubuntu, Windows and macOS. The action itself runs on Ubuntu, Windows and macOS against the demo with live OSV, plus fail-on, invalid-input and update-check (`compare-to`) runs |
 
-No third-party application files are committed. The local real-app checks are listed for
-transparency only.
+No third-party application files are committed. Unit tests build minimal ELF, PE and Mach-O files
+and sign them with throwaway certificates; real artifacts are downloaded and checked in CI.
 
 ## Limitations
 
 - Version matching is not reachability. A vulnerable function may never be called; use waivers
   with reasons when you have checked this.
-- It reads Go build info only for Go 1.18+ (older binaries are reported as gaps). It does not yet
-  read Rust `cargo auditable` sections, Python wheels, Java JARs or native C/C++ libraries.
+- It reads Go build info only for Go 1.18+ (older binaries are reported as gaps) and Rust crates
+  only from binaries built with `cargo auditable`. Native C/C++ libraries are fingerprinted but not
+  identified.
+- Python packages are read from installed metadata folders, not from wheels, eggs or
+  PyInstaller/zipapp bundles. JARs without `pom.properties` are counted as a coverage note.
+- The Authenticode check reports who a signature *claims* to be from. It does not verify the
+  signature, the certificate chain or revocation; use `Get-AuthenticodeSignature` or `signtool
+  verify` for that. Catalog signatures and macOS code signatures are not read.
 - Electron code rules are pattern-based. They catch literal settings, including minified ones,
   but not values computed at runtime.
 - Installers (`.exe`/`.msi`/`.dmg`) must be extracted or installed first. The tool does not unpack
@@ -380,12 +403,13 @@ transparency only.
 
 ## Roadmap
 
-1. Rust `cargo auditable`, Python `*.dist-info` and Java `pom.properties` inventories.
-2. Signature and publisher changes (Authenticode, code signing) in the update check.
+1. macOS code signatures (Team ID) in the update check.
+2. Python wheels and PyInstaller bundles; Gradle and `MANIFEST.MF`-only JARs.
 3. An optional adapter for reverse-engineering evidence tools behind an approval gate.
 
-Shipped from earlier roadmap items: the version-to-version update check (v0.2.0) and the
-PII-in-HAR inspector, released as the separate
+Shipped from earlier roadmap items: Rust, Python and Maven inventories with Authenticode signer
+changes (v0.3.0), the version-to-version update check (v0.2.0) and the PII-in-HAR inspector,
+released as the separate
 [Privacy Flow Inspector](https://github.com/Sushant-Nemade/privacy-flow-inspector).
 
 ## Development

{software_intake_gatekeeper-0.2.2 → software_intake_gatekeeper-0.3.0}/README.md

@@ -7,28 +7,33 @@
 
 **Before you install, approve or ship a third-party app, find out what is inside it.**
 
-Software Intake Gatekeeper reads an installed application, an Electron `.asar` archive or a
-compiled binary. It never runs or unpacks it. It produces:
+Software Intake Gatekeeper reads an installed application, an Electron `.asar` archive, a Java
+archive or a compiled binary. It never runs or unpacks it. It produces:
 
-- a **CycloneDX 1.6 SBOM** of the components that are actually bundled,
+- a **CycloneDX 1.6 SBOM** of the components that are actually bundled: Go, Rust, npm, NuGet,
+  Python and Maven packages, read from evidence inside the files,
 - **known vulnerabilities** for those exact versions from [OSV.dev](https://osv.dev) (only when you opt in),
 - **Electron hardening checks** for the fuse wire inside the executable and risky `BrowserWindow`
   settings in the app code,
+- the **Authenticode signer** of each Windows executable,
 - an **APPROVE / REVIEW / REJECT** decision from a versioned policy, with expiring waivers,
 - an **update check** that compares two versions and gates on what the update *adds*: new
-  vulnerabilities, weakened Electron fuses, new network endpoints, new native modules,
+  vulnerabilities, weakened Electron fuses, new network endpoints, new native modules, removed
+  signatures and a different publisher,
 - **SARIF** for GitHub code scanning, a **Markdown** summary for pull requests and a full **JSON** evidence report.
 
 Every finding names the file and, for scripts, the line, column and snippet that produced it.
 Anything the scanner could not verify is reported as a **coverage gap**. A blocking gap can
 never lead to APPROVE: an unknown result is not treated as safe.
 
-> Status: [v0.2.2](https://github.com/Sushant-Nemade/software-intake-gatekeeper/releases/tag/v0.2.2),
+> Status: [v0.3.0](https://github.com/Sushant-Nemade/software-intake-gatekeeper/releases/tag/v0.3.0),
 > an alpha release on [PyPI](https://pypi.org/project/software-intake-gatekeeper/) and the
-> [GitHub Marketplace](https://github.com/marketplace/actions/software-intake-gatekeeper). The CLI is
-> tested on Windows and Linux with real Go binaries in three object formats, an ASAR archive packed
-> by the official `@electron/asar` tool and the live OSV API; the action also runs on macOS. The
-> results are static, version-level evidence, not proof of exploitability.
+> [GitHub Marketplace](https://github.com/marketplace/actions/software-intake-gatekeeper). Every
+> parser is checked against real artifacts: Go binaries in three object formats, `cargo auditable`
+> builds compared with the official `rust-audit-info` decoder on Linux, Windows and macOS, JARs from
+> Maven Central, packages installed by pip, signed executables compared with Windows'
+> `Get-AuthenticodeSignature`, and the live OSV API. The results are static, version-level
+> evidence, not proof of exploitability.
 
 Part of a small **software trust toolkit** with
 [Privacy Flow Inspector](https://github.com/Sushant-Nemade/privacy-flow-inspector): this tool checks
@@ -41,6 +46,8 @@ what is **inside** an app; the inspector checks which personal data the app **se
 | Who | Situation | What they get |
 |---|---|---|
 | IT / security intake | An employee requests a desktop tool (an Electron or Go CLI) | An SBOM, known CVEs and Electron hardening issues before approval, with a decision a reviewer can sign off |
+| Platform and backend teams | A vendor ships a Spring Boot service, a Python tool or a Rust CLI | Maven coordinates from nested JARs (Log4Shell is found inside `BOOT-INF/lib`), Python package versions and Rust crates, each with advisories |
+| Patch management | A new version of an approved app arrives | An update check that flags a removed signature or a different publisher before the rollout |
 | Product teams shipping Electron | A release candidate is ready | A CI gate that fails when `contextIsolation` is off, `RunAsNode` is enabled or bundled packages have critical advisories |
 | Supply-chain / compliance (EU CRA, medical-device SBOM expectations) | A vendor delivers a binary without an SBOM | A CycloneDX SBOM built from evidence inside the binary, with occurrences pointing to the source files |
 | Procurement / vendor review | Comparing two vendor builds | Reproducible JSON and SBOM output that can be compared across versions |
@@ -56,9 +63,9 @@ python -m pip install software-intake-gatekeeper
 To verify build provenance first, install the wheel from the GitHub release instead:
 
 ```powershell
-gh release download v0.2.2 -R Sushant-Nemade/software-intake-gatekeeper -p "*.whl"
-gh attestation verify software_intake_gatekeeper-0.2.2-py3-none-any.whl -R Sushant-Nemade/software-intake-gatekeeper
-python -m pip install software_intake_gatekeeper-0.2.2-py3-none-any.whl
+gh release download v0.3.0 -R Sushant-Nemade/software-intake-gatekeeper -p "*.whl"
+gh attestation verify software_intake_gatekeeper-0.3.0-py3-none-any.whl -R Sushant-Nemade/software-intake-gatekeeper
+python -m pip install software_intake_gatekeeper-0.3.0-py3-none-any.whl
 ```
 
 Or install from a clone (needed for the demo below):
@@ -154,23 +161,29 @@ Components changed: 2 | endpoints +1/-0 | binaries +1/-0/~0
 | Electron | Runtime version change and every fuse change; a fuse moving into its risky state is **weakened** |
 | Network endpoints | Hosts of `http(s)://` and `ws(s)://` URLs that start a string literal in app code (outside `node_modules`); URLs in comments and license headers, XML namespaces and local addresses are skipped |
 | Executables and native modules | Added, removed or changed (SHA-256) PE, ELF and Mach-O files, including `.node` modules |
+| Code signing | For the same file path: signature **removed**, **signer-changed** (different subject), `certificate-renewed` (same subject, new certificate) or `added` |
 
 **REJECT** if a new finding reaches `reject_at`. **REVIEW** for new findings at `review_at`, weakened
-fuses, new endpoints, new binaries, new components or blocking gaps in the new version.
-**APPROVE** otherwise. The SARIF output contains only the new findings.
+fuses, new endpoints, new binaries, new components, removed signatures, a different signer or
+blocking gaps in the new version. **APPROVE** otherwise. The SARIF output contains only the new
+findings.
 
 ## What it inspects
 
 | Evidence | Source inside the target | Output |
 |---|---|---|
 | Go modules and toolchain | Build info embedded by the Go linker (Go 1.18+) in PE, ELF and Mach-O executables | `pkg:golang/...` components, including `stdlib` and `replace` directives |
+| Rust crates | The zlib-compressed `.dep-v0` section that [`cargo auditable`](https://github.com/rust-secure-code/cargo-auditable) embeds in ELF, PE and Mach-O (including universal) binaries | `pkg:cargo/...` components; build-only crates and non-crates.io sources are listed but not queried |
+| Python packages | `*.dist-info/METADATA` and `*.egg-info` (`PKG-INFO`) on disk, for example a bundled `site-packages` | `pkg:pypi/...` components with PEP 503 names |
+| Maven artifacts | `META-INF/maven/**/pom.properties` in `.jar`, `.war` and `.ear` files, including nested archives such as Spring Boot `BOOT-INF/lib` and `WEB-INF/lib` (two levels, read in memory) | `pkg:maven/...` components, also for shaded dependencies |
 | npm packages | `node_modules/**/package.json` on disk and inside `.asar` archives | `pkg:npm/...` components; the app's own manifest is recorded but not queried |
 | NuGet packages | `*.deps.json` (`package` and self-contained `runtimepack` entries) | `pkg:nuget/...` components |
 | .NET shared framework | `*.runtimeconfig.json` | Minimum framework version, plus a note that the host runtime decides the patch level |
 | Electron runtime | The fuse sentinel and `Electron/x.y.z` string in the executable | Electron version (queried as npm `electron`) and the fuse states |
 | Electron app code | `.js/.cjs/.mjs/.ts` files outside `node_modules`, on disk or in `.asar` | `webPreferences` rule findings with line, column and snippet |
 | Network endpoints | `http(s)://` and `ws(s)://` hosts referenced by that app code | Host list with up to three source files each (used by the update check) |
-| Executables and native modules | PE, ELF and Mach-O files, including `.node` add-ons | Path, size, SHA-256 and kind (Go, Electron, native) |
+| Executables and native modules | PE, ELF and Mach-O files, including `.node` add-ons | Path, size, SHA-256 and kind (Go, Rust, Electron, native) |
+| Code signing | The Authenticode certificate table of PE files | Claimed signer subject, issuer and SHA-1 thumbprint (the value Windows shows); not cryptographically verified |
 
 ### Electron rules
 
@@ -316,23 +329,32 @@ and a `SHA256SUMS` file.
 | Check | How |
 |---|---|
 | Go build info decoding | Compared with `go version -m` on real binaries built in CI for Windows PE, Linux ELF and macOS Mach-O |
+| Rust `cargo auditable` | CI builds a fixture with `cargo auditable` 0.7.7 on Linux, Windows and macOS and requires the same crates as the official `rust-audit-info` 0.5.4 decoder, then finds RUSTSEC-2021-0003 through live OSV. Locally, Alpine Linux's official `ripgrep` 14.1.1 binary decoded to 42 crates, every one matching ripgrep's `Cargo.lock` |
+| Maven and Python | CI downloads `log4j-core` 2.14.1 from Maven Central (SHA-1 checked), nests it in a Spring Boot style JAR and requires Log4Shell (CVE-2021-44228); pip installs `requests` 2.25.0 and CVE-2023-32681 must be found. Locally, `jackson-databind` 2.9.10 nested in a fat JAR returned 49 advisories |
+| Authenticode | CI compares signer and thumbprint with Windows' `Get-AuthenticodeSignature` for a signed executable. Locally identical for VS Code, Node.js, Git and uv; catalog-signed and unsigned files report no embedded signature |
 | ASAR parsing | Fixture packed by `@electron/asar` 4.3.1; listing matches the official tool |
 | Fuse decoding | Wire layout taken from `@electron/fuses`. A read-only local check on an installed Electron app (VS Code) matched `npx @electron/fuses read` for all 9 fuses |
 | Output formats | CycloneDX validated with `cyclonedx-python-lib` against the 1.6 schema in tests. SARIF validated against the OASIS 2.1.0 schema during development |
 | OSV client | Mocked transport tests (batching, pagination, retries, alias grouping, withdrawn advisories) plus an opt-in live test (`INTAKE_LIVE_OSV=1`) |
 | Scale | Read-only scan of a locally installed VS Code: 3,243 files and 5,451 archive entries in about 19 s with a warm file cache |
 | Real update | Update check of the open-source editor MarkText 0.21.1 to 0.21.2 (official Windows zips, checksums verified; 20,072 ASAR entries, 505 npm packages, live OSV) in about 30 s. It showed 27 resolved advisories, 49 new packages and changed native modules. The first run also reported 10 new and 10 resolved code findings that were only a renamed bundle (`index-BBEVtY79.js` to `index-Cz8Eo_n9.js`), and 44 new endpoints taken from code comments; v0.2.2 fixed both, leaving 0 new findings and 1 new endpoint |
-| CI | Ubuntu (Python 3.11 and 3.13) and Windows (3.13): pytest, ruff, mypy `--strict`, build, twine, pip-audit. The action itself runs on Ubuntu, Windows and macOS against the demo with live OSV, plus fail-on, invalid-input and update-check (`compare-to`) runs |
+| CI | Ubuntu (Python 3.11 and 3.13) and Windows (3.13): pytest, ruff, mypy `--strict`, build, twine, pip-audit. A real-artifact job on Ubuntu, Windows and macOS. The action itself runs on Ubuntu, Windows and macOS against the demo with live OSV, plus fail-on, invalid-input and update-check (`compare-to`) runs |
 
-No third-party application files are committed. The local real-app checks are listed for
-transparency only.
+No third-party application files are committed. Unit tests build minimal ELF, PE and Mach-O files
+and sign them with throwaway certificates; real artifacts are downloaded and checked in CI.
 
 ## Limitations
 
 - Version matching is not reachability. A vulnerable function may never be called; use waivers
   with reasons when you have checked this.
-- It reads Go build info only for Go 1.18+ (older binaries are reported as gaps). It does not yet
-  read Rust `cargo auditable` sections, Python wheels, Java JARs or native C/C++ libraries.
+- It reads Go build info only for Go 1.18+ (older binaries are reported as gaps) and Rust crates
+  only from binaries built with `cargo auditable`. Native C/C++ libraries are fingerprinted but not
+  identified.
+- Python packages are read from installed metadata folders, not from wheels, eggs or
+  PyInstaller/zipapp bundles. JARs without `pom.properties` are counted as a coverage note.
+- The Authenticode check reports who a signature *claims* to be from. It does not verify the
+  signature, the certificate chain or revocation; use `Get-AuthenticodeSignature` or `signtool
+  verify` for that. Catalog signatures and macOS code signatures are not read.
 - Electron code rules are pattern-based. They catch literal settings, including minified ones,
   but not values computed at runtime.
 - Installers (`.exe`/`.msi`/`.dmg`) must be extracted or installed first. The tool does not unpack
@@ -342,12 +364,13 @@ transparency only.
 
 ## Roadmap
 
-1. Rust `cargo auditable`, Python `*.dist-info` and Java `pom.properties` inventories.
-2. Signature and publisher changes (Authenticode, code signing) in the update check.
+1. macOS code signatures (Team ID) in the update check.
+2. Python wheels and PyInstaller bundles; Gradle and `MANIFEST.MF`-only JARs.
 3. An optional adapter for reverse-engineering evidence tools behind an approval gate.
 
-Shipped from earlier roadmap items: the version-to-version update check (v0.2.0) and the
-PII-in-HAR inspector, released as the separate
+Shipped from earlier roadmap items: Rust, Python and Maven inventories with Authenticode signer
+changes (v0.3.0), the version-to-version update check (v0.2.0) and the PII-in-HAR inspector,
+released as the separate
 [Privacy Flow Inspector](https://github.com/Sushant-Nemade/privacy-flow-inspector).
 
 ## Development

software_intake_gatekeeper-0.3.0/examples/rust-demo/Cargo.lock

@@ -0,0 +1,16 @@
+# This file is automatically @generated by Cargo.
+# It is not intended for manual editing.
+version = 4
+
+[[package]]
+name = "rust-demo"
+version = "0.1.0"
+dependencies = [
+ "smallvec",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a55ca5f3b68e41c979bf8c46a6f1da892ca4db8f94023ce0bd32407573b1ac0"

software_intake_gatekeeper-0.3.0/examples/rust-demo/Cargo.toml

@@ -0,0 +1,10 @@
+[package]
+name = "rust-demo"
+version = "0.1.0"
+edition = "2021"
+publish = false
+description = "Fictional fixture for Software Intake Gatekeeper; smallvec 1.6.0 is pinned on purpose (RUSTSEC-2021-0003)."
+license = "MIT"
+
+[dependencies]
+smallvec = "=1.6.0"

software_intake_gatekeeper-0.3.0/examples/rust-demo/src/main.rs

@@ -0,0 +1,7 @@
+use smallvec::SmallVec;
+
+fn main() {
+    let mut values: SmallVec<[u8; 4]> = SmallVec::new();
+    values.extend_from_slice(b"intake");
+    println!("fixture for Software Intake Gatekeeper: {} bytes", values.len());
+}

{software_intake_gatekeeper-0.2.2 → software_intake_gatekeeper-0.3.0}/pyproject.toml

@@ -4,14 +4,14 @@ build-backend = "hatchling.build"
 
 [project]
 name = "software-intake-gatekeeper"
-version = "0.2.2"
-description = "Local, evidence-first intake checks for third-party apps and binaries: SBOM, known vulnerabilities and Electron hardening."
+version = "0.3.0"
+description = "Local, evidence-first intake checks for third-party apps and binaries: SBOM (Go, Rust, npm, NuGet, Python, Maven), known vulnerabilities, Electron hardening and code-signing changes."
 readme = "README.md"
 license = "MIT"
 license-files = ["LICENSE"]
 requires-python = ">=3.11"
 authors = [{ name = "Sushant Nemade" }]
-keywords = ["sbom", "cyclonedx", "sarif", "osv", "electron", "supply-chain", "security"]
+keywords = ["sbom", "cyclonedx", "sarif", "osv", "electron", "supply-chain", "security", "cargo-auditable", "maven", "authenticode"]
 classifiers = [
     "Development Status :: 3 - Alpha",
     "Environment :: Console",
@@ -34,6 +34,7 @@ dependencies = [
 [project.optional-dependencies]
 dev = [
     "build>=1.2",
+    "cryptography>=44",
     "cyclonedx-python-lib[json-validation]>=9",
     "mypy>=1.13",
     "pip-audit>=2.7",

{software_intake_gatekeeper-0.2.2 → software_intake_gatekeeper-0.3.0}/src/intake_gatekeeper/__init__.py

@@ -1,3 +1,3 @@
 """Software Intake Gatekeeper: evidence-first intake checks for third-party software."""
 
-__version__ = "0.2.2"
+__version__ = "0.3.0"

software_intake_gatekeeper-0.3.0/src/intake_gatekeeper/authenticode.py

@@ -0,0 +1,149 @@
+"""Read the Authenticode signer identity from a PE file without verifying it.
+
+Only identifies who the embedded signature claims to be from. Cryptographic validity, chain trust,
+revocation and catalog signatures are outside this module.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import struct
+from dataclasses import dataclass
+
+from intake_gatekeeper import objfile
+from intake_gatekeeper.golang import Bytes
+
+_MAX_TABLE = 16 * 1024 * 1024
+_SIGNED_DATA = bytes.fromhex("2a864886f70d010702")
+_OID_CN = bytes.fromhex("550403")
+_OID_O = bytes.fromhex("55040a")
+_STRING_TAGS = {
+    0x0C: "utf-8",
+    0x13: "ascii",
+    0x16: "ascii",
+    0x14: "latin-1",
+    0x1E: "utf-16-be",
+    0x1C: "utf-32-be",
+}
+
+
+@dataclass(frozen=True)
+class Signer:
+    subject: str
+    issuer: str
+    serial: str
+    sha1: str
+    sha256: str
+
+
+class SignatureError(ValueError):
+    pass
+
+
+def _tlv(data: bytes, pos: int, end: int) -> tuple[int, int, int]:
+    """Return (tag, content start, content end) of the DER element at pos."""
+    if pos + 2 > end:
+        raise SignatureError("truncated DER element")
+    tag, first = data[pos], data[pos + 1]
+    pos += 2
+    if first < 0x80:
+        length = first
+    else:
+        count = first & 0x7F
+        if count == 0 or count > 4 or pos + count > end:
+            raise SignatureError("unsupported DER length")
+        length = int.from_bytes(data[pos : pos + count], "big")
+        pos += count
+    if pos + length > end:
+        raise SignatureError("DER element exceeds its container")
+    return tag, pos, pos + length
+
+
+def _children(data: bytes, start: int, end: int) -> list[tuple[int, int, int, int]]:
+    """(tag, content start, content end, element start) for each element in a range."""
+    items = []
+    while start < end:
+        tag, inner, stop = _tlv(data, start, end)
+        items.append((tag, inner, stop, start))
+        start = stop
+    return items
+
+
+def _name(data: bytes, start: int, end: int) -> str:
+    parts: dict[bytes, str] = {}
+    for _set_tag, set_start, set_end, _ in _children(data, start, end):
+        for _seq_tag, seq_start, seq_end, _ in _children(data, set_start, set_end):
+            items = _children(data, seq_start, seq_end)
+            if len(items) != 2 or items[0][0] != 0x06:
+                continue
+            oid = data[items[0][1] : items[0][2]]
+            tag, value_start, value_end, _ = items[1]
+            encoding = _STRING_TAGS.get(tag)
+            if oid in (_OID_CN, _OID_O) and encoding and oid not in parts:
+                parts[oid] = data[value_start:value_end].decode(encoding, errors="replace")
+    labels = [f"CN={parts[_OID_CN]}"] if _OID_CN in parts else []
+    if _OID_O in parts:
+        labels.append(f"O={parts[_OID_O]}")
+    return ", ".join(labels) or "(no CN or O)"
+
+
+def _certificate(data: bytes, start: int, end: int) -> tuple[bytes, bytes, bytes]:
+    """Return (serial, issuer name, subject name) contents of one certificate."""
+    _tag, tbs_start, tbs_end, _ = _children(data, start, end)[0]
+    fields = _children(data, tbs_start, tbs_end)
+    if fields and fields[0][0] == 0xA0:
+        fields = fields[1:]
+    if len(fields) < 5:
+        raise SignatureError("certificate is missing fields")
+    serial = data[fields[0][1] : fields[0][2]]
+    issuer = data[fields[2][1] : fields[2][2]]
+    subject = data[fields[4][1] : fields[4][2]]
+    return serial, issuer, subject
+
+
+def parse_pkcs7(blob: bytes) -> Signer:
+    _tag, info_start, info_end = _tlv(blob, 0, len(blob))
+    info = _children(blob, info_start, info_end)
+    if len(info) < 2 or blob[info[0][1] : info[0][2]] != _SIGNED_DATA or info[1][0] != 0xA0:
+        raise SignatureError("not a PKCS#7 SignedData structure")
+    _tag, signed_start, signed_end, _ = _children(blob, info[1][1], info[1][2])[0]
+    parts = _children(blob, signed_start, signed_end)
+    certificates = next((p for p in parts if p[0] == 0xA0), None)
+    signer_infos = parts[-1]
+    if certificates is None or signer_infos[0] != 0x31:
+        raise SignatureError("SignedData has no certificates or signer")
+    signer_info = _children(blob, signer_infos[1], signer_infos[2])[0]
+    sid = _children(blob, signer_info[1], signer_info[2])[1]
+    if sid[0] != 0x30:
+        raise SignatureError("signer identified by key id, not issuer and serial")
+    issuer_tlv, serial_tlv = _children(blob, sid[1], sid[2])[:2]
+    wanted_issuer = blob[issuer_tlv[1] : issuer_tlv[2]]
+    wanted_serial = blob[serial_tlv[1] : serial_tlv[2]]
+    for _tag, cert_start, cert_end, cert_begin in _children(blob, certificates[1], certificates[2]):
+        serial, issuer, subject = _certificate(blob, cert_start, cert_end)
+        if serial == wanted_serial and issuer == wanted_issuer:
+            der = blob[cert_begin:cert_end]
+            return Signer(
+                subject=_name(subject, 0, len(subject)),
+                issuer=_name(issuer, 0, len(issuer)),
+                serial=serial.lstrip(b"\x00").hex().upper() or "00",
+                sha1=hashlib.sha1(der, usedforsecurity=False).hexdigest().upper(),
+                sha256=hashlib.sha256(der).hexdigest(),
+            )
+    raise SignatureError("signer certificate is not included in the signature")
+
+
+def read_signer(data: Bytes) -> Signer | None:
+    """Signer of the first embedded Authenticode signature; None when the file has none."""
+    try:
+        table = objfile.pe_certificate_table(data)
+    except objfile.FormatError as error:
+        raise SignatureError(f"PE headers are malformed: {error}") from None
+    if table is None:
+        return None
+    if table.size > _MAX_TABLE or table.size < 8:
+        raise SignatureError("certificate table size is out of range")
+    length, _revision, kind = struct.unpack("<IHH", data[table.offset : table.offset + 8])
+    if kind != 0x0002 or not 8 < length <= table.size:
+        raise SignatureError("certificate table holds no PKCS#7 signature")
+    return parse_pkcs7(bytes(data[table.offset + 8 : table.offset + length]))