tenantguard-cli 0.1.1__tar.gz

tenantguard_cli-0.1.1/.gitignore

@@ -0,0 +1,13 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+.eggs/
+.venv/
+venv/
+build/
+dist/
+.pytest_cache/
+.coverage
+htmlcov/
+.mypy_cache/
+.ruff_cache/

tenantguard_cli-0.1.1/LICENSE

@@ -0,0 +1,190 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the
+      purposes of this License, Derivative Works shall not include works
+      that remain separable from, or merely link (or bind by name) to the
+      interfaces of, the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including the
+      original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing
+      the origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 Rudrendu Paul
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

tenantguard_cli-0.1.1/PKG-INFO

@@ -0,0 +1,86 @@
+Metadata-Version: 2.4
+Name: tenantguard-cli
+Version: 0.1.1
+Summary: PyPI wrapper for TenantGuard, a tenant-isolation security-audit CLI for self-hosted multi-tenant AI-agent platforms. Downloads and runs the official prebuilt Go binary from GitHub Releases.
+Project-URL: Homepage, https://github.com/RudrenduPaul/TenantGuard
+Project-URL: Repository, https://github.com/RudrenduPaul/TenantGuard
+Project-URL: Bug Tracker, https://github.com/RudrenduPaul/TenantGuard/issues
+Project-URL: Changelog, https://github.com/RudrenduPaul/TenantGuard/blob/main/CHANGELOG.md
+Project-URL: Author - Rudrendu Paul, https://github.com/RudrenduPaul
+Author: Rudrendu Paul
+License-Expression: Apache-2.0
+License-File: LICENSE
+Keywords: ai-agent,cli,hipaa,multi-tenant,opa,rego,sarif,security,tenant-isolation
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security
+Classifier: Topic :: Utilities
+Requires-Python: >=3.9
+Requires-Dist: sigstore<5,>=4.0
+Provides-Extra: dev
+Requires-Dist: build<2,>=1.0; extra == 'dev'
+Requires-Dist: pytest<9,>=7.0; extra == 'dev'
+Requires-Dist: twine<7,>=5.0; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# tenantguard-cli (PyPI)
+
+PyPI wrapper for [TenantGuard](https://github.com/RudrenduPaul/TenantGuard),
+a tenant-isolation security-audit CLI for self-hosted multi-tenant AI-agent
+platforms. This package does not reimplement TenantGuard in Python -- it
+downloads the official prebuilt `tenantguard` binary for your platform from
+TenantGuard's [GitHub Releases](https://github.com/RudrenduPaul/TenantGuard/releases)
+(published by goreleaser), verifies its SHA-256 checksum, caches it locally,
+and execs it.
+
+## Install
+
+```bash
+pip install tenantguard-cli
+```
+
+or run without installing:
+
+```bash
+uvx tenantguard-cli scan --demo
+```
+
+## Usage
+
+```bash
+tenantguard scan --demo
+tenantguard scan --format sarif
+tenantguard scan --format json
+```
+
+See the main [TenantGuard README](https://github.com/RudrenduPaul/TenantGuard#readme)
+for the full rule reference (TA01-TA16), SARIF/JSON output schema, and the
+GitHub Action.
+
+## How this differs from the npm package
+
+The `tenantguard-cli` npm package ships six platform-specific
+`optionalDependencies`, each embedding a cosign-verified binary at publish
+time -- no network access happens on an end user's `npm install`. A single
+pure-Python wheel can't embed six platform binaries the same way, so this
+package instead downloads the matching release archive the first time you
+run `tenantguard`, verifies its SHA-256 against the release's
+`checksums.txt`, and caches the verified binary locally (per package
+version) -- every run after that is offline. See `src/tenantguard_cli/cli.py`
+for the exact verification logic.
+
+Other distribution channels for TenantGuard: Homebrew, `go install`, and
+GitHub Releases directly -- see the main README for details.
+
+## License
+
+Apache-2.0, matching the main TenantGuard repository.

tenantguard_cli-0.1.1/README.md

@@ -0,0 +1,52 @@
+# tenantguard-cli (PyPI)
+
+PyPI wrapper for [TenantGuard](https://github.com/RudrenduPaul/TenantGuard),
+a tenant-isolation security-audit CLI for self-hosted multi-tenant AI-agent
+platforms. This package does not reimplement TenantGuard in Python -- it
+downloads the official prebuilt `tenantguard` binary for your platform from
+TenantGuard's [GitHub Releases](https://github.com/RudrenduPaul/TenantGuard/releases)
+(published by goreleaser), verifies its SHA-256 checksum, caches it locally,
+and execs it.
+
+## Install
+
+```bash
+pip install tenantguard-cli
+```
+
+or run without installing:
+
+```bash
+uvx tenantguard-cli scan --demo
+```
+
+## Usage
+
+```bash
+tenantguard scan --demo
+tenantguard scan --format sarif
+tenantguard scan --format json
+```
+
+See the main [TenantGuard README](https://github.com/RudrenduPaul/TenantGuard#readme)
+for the full rule reference (TA01-TA16), SARIF/JSON output schema, and the
+GitHub Action.
+
+## How this differs from the npm package
+
+The `tenantguard-cli` npm package ships six platform-specific
+`optionalDependencies`, each embedding a cosign-verified binary at publish
+time -- no network access happens on an end user's `npm install`. A single
+pure-Python wheel can't embed six platform binaries the same way, so this
+package instead downloads the matching release archive the first time you
+run `tenantguard`, verifies its SHA-256 against the release's
+`checksums.txt`, and caches the verified binary locally (per package
+version) -- every run after that is offline. See `src/tenantguard_cli/cli.py`
+for the exact verification logic.
+
+Other distribution channels for TenantGuard: Homebrew, `go install`, and
+GitHub Releases directly -- see the main README for details.
+
+## License
+
+Apache-2.0, matching the main TenantGuard repository.

tenantguard_cli-0.1.1/pyproject.toml

@@ -0,0 +1,79 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "tenantguard-cli"
+version = "0.1.1"
+description = "PyPI wrapper for TenantGuard, a tenant-isolation security-audit CLI for self-hosted multi-tenant AI-agent platforms. Downloads and runs the official prebuilt Go binary from GitHub Releases."
+readme = "README.md"
+requires-python = ">=3.9"
+license = "Apache-2.0"
+authors = [
+  { name = "Rudrendu Paul" },
+]
+keywords = ["security", "tenant-isolation", "multi-tenant", "ai-agent", "sarif", "opa", "rego", "hipaa", "cli"]
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "Environment :: Console",
+  "Intended Audience :: Developers",
+  "License :: OSI Approved :: Apache Software License",
+  "Operating System :: OS Independent",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.9",
+  "Programming Language :: Python :: 3.10",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "Topic :: Security",
+  "Topic :: Utilities",
+]
+dependencies = [
+  # Pinned to the 4.x line: cli.py's signature-verification code relies on a
+  # documented-but-internal Verifier attribute (`_rekor`) for handling
+  # detached checksums.txt.sig/.pem materials, the same mechanism
+  # sigstore-python's own CLI uses internally for this case. Widen the upper
+  # bound only after re-verifying that internal surface against a new major.
+  "sigstore>=4.0,<5",
+]
+
+[project.optional-dependencies]
+dev = [
+  "pytest>=7.0,<9",
+  "build>=1.0,<2",
+  "twine>=5.0,<7",
+]
+
+[project.urls]
+Homepage = "https://github.com/RudrenduPaul/TenantGuard"
+Repository = "https://github.com/RudrenduPaul/TenantGuard"
+"Bug Tracker" = "https://github.com/RudrenduPaul/TenantGuard/issues"
+Changelog = "https://github.com/RudrenduPaul/TenantGuard/blob/main/CHANGELOG.md"
+"Author - Rudrendu Paul" = "https://github.com/RudrenduPaul"
+
+[project.scripts]
+tenantguard = "tenantguard_cli.cli:main"
+
+[tool.hatch.build]
+# This package lives in a subdirectory (python/) of a larger monorepo whose
+# .git directory is at the repo root, alongside the sibling Go module and npm
+# package. Hatchling's default VCS-aware file source walks up to that root
+# .git and pulls in root-level files (Go sources, npm/, action/, etc.) that
+# have nothing to do with this Python package. ignore-vcs disables that
+# VCS-based default source so only the explicit include/only-include lists
+# below decide what ships.
+ignore-vcs = true
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/tenantguard_cli"]
+
+[tool.hatch.build.targets.sdist]
+only-include = [
+  "src/tenantguard_cli",
+  "tests",
+  "README.md",
+  "LICENSE",
+]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]

tenantguard_cli-0.1.1/src/tenantguard_cli/__init__.py

@@ -0,0 +1,17 @@
+"""tenantguard-cli: a thin PyPI wrapper around the TenantGuard Go binary.
+
+This package does not reimplement TenantGuard in Python. It resolves the
+correct prebuilt binary for the running platform from TenantGuard's GitHub
+Releases (published by goreleaser), caches it locally, and execs it,
+forwarding argv/stdio/exit-code unchanged. See ``tenantguard_cli.cli`` and
+``tenantguard_cli.platforms`` for the implementation.
+"""
+
+__version__ = "0.1.1"
+
+# The GitHub release tag this package version is pinned to. Kept in lockstep
+# with __version__ (and with the npm wrapper's RELEASE_TAG in
+# npm/scripts/fetch-binary.js) -- a new TenantGuard release means a new
+# tenantguard-cli release pinned to the matching tag, never a silent
+# "latest" resolution at install or run time.
+RELEASE_TAG = f"v{__version__}"

tenantguard_cli-0.1.1/src/tenantguard_cli/cli.py

@@ -0,0 +1,315 @@
+"""Runtime entry point for the `tenantguard` console script.
+
+On first invocation for a given (package version, platform, arch), this
+downloads the matching TenantGuard release archive from GitHub Releases,
+verifies checksums.txt's Sigstore signature (keyless, GitHub Actions OIDC)
+before trusting any digest inside it, verifies the archive against that
+digest (SHA-256), extracts the binary into a local cache directory, then
+execs it -- forwarding argv, stdio, and exit code unchanged. Subsequent
+invocations reuse the cached binary; no network access happens once it's
+cached.
+
+Signature verification uses the `sigstore` PyPI package (a pure-Python
+Sigstore client, see https://pypi.org/project/sigstore/), not the `cosign`
+CLI binary that npm/scripts/fetch-binary.js shells out to. That script runs
+only at *publish* time, on the maintainer's own CI runner, where installing
+an extra CLI binary is a reasonable ask. This package's download happens on
+the *end user's* machine at first run instead -- a single pure-Python wheel
+can't embed all platform binaries the way npm's per-platform packages can --
+so requiring end users to separately install `cosign` would be a real
+usability regression. sigstore-python avoids that tradeoff: the same
+verification guarantee (checksums.txt must carry a valid Sigstore signature
+from this repo's own release workflow, keyless via GitHub Actions OIDC, with
+certificate identity and issuer checked against the pinned RELEASE_TAG) with
+no extra binary for the end user to install.
+
+checksums.txt.sig and checksums.txt.pem (the same release assets the npm
+script already consumes) are fetched alongside checksums.txt and verified
+BEFORE any digest is parsed out of it. That ordering is what actually closes
+the gap SHA-256-over-HTTPS alone leaves open: if checksums.txt and a
+malicious archive were served together from a single compromised source,
+they'd still agree with each other and pass a bare digest check. Requiring a
+valid signature from the real release workflow first means an attacker would
+also need to forge that signature, not just serve consistent bytes.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import io
+import os
+import stat
+import subprocess
+import sys
+import tarfile
+import urllib.error
+import urllib.request
+import zipfile
+from pathlib import Path
+
+from cryptography.x509 import load_pem_x509_certificate
+from sigstore._internal.rekor import _hashedrekord_from_parts
+from sigstore.hashes import HashAlgorithm, Hashed
+from sigstore.models import Bundle
+from sigstore.verify import Verifier
+from sigstore.verify import policy as sigstore_policy
+
+from . import RELEASE_TAG, __version__
+from .platforms import (
+    UnsupportedPlatformError,
+    archive_ext,
+    archive_name,
+    binary_name,
+    resolve_goarch,
+    resolve_goos,
+)
+
+REPO = "RudrenduPaul/TenantGuard"
+PROJECT_NAME = "tenantguard"
+RELEASE_BASE = f"https://github.com/{REPO}/releases/download/{RELEASE_TAG}"
+USER_AGENT = "tenantguard-cli-pypi-wrapper"
+REQUEST_TIMEOUT_SECONDS = 30
+
+# Same identity/issuer the release workflow (.github/workflows/release.yml)
+# signs checksums.txt with, and that npm/scripts/fetch-binary.js's cosign
+# check already verifies against -- keyless Sigstore signing via GitHub
+# Actions OIDC, scoped to this exact release workflow run for this exact tag.
+SIGSTORE_OIDC_ISSUER = "https://token.actions.githubusercontent.com"
+
+
+def _sigstore_certificate_identity() -> str:
+    return f"https://github.com/{REPO}/.github/workflows/release.yml@refs/tags/{RELEASE_TAG}"
+
+
+def _cache_dir() -> Path:
+    """Version-scoped cache directory. A new pinned RELEASE_TAG (i.e. a new
+    tenantguard-cli release) gets its own subdirectory, so upgrading this
+    package always re-downloads rather than silently reusing a stale binary.
+    """
+    base = os.environ.get("TENANTGUARD_CLI_CACHE_DIR")
+    if base:
+        root = Path(base)
+    elif sys.platform == "win32":
+        root = Path(os.environ.get("LOCALAPPDATA", Path.home() / "AppData" / "Local")) / "tenantguard-cli"
+    elif sys.platform == "darwin":
+        root = Path.home() / "Library" / "Caches" / "tenantguard-cli"
+    else:
+        xdg = os.environ.get("XDG_CACHE_HOME")
+        root = Path(xdg) / "tenantguard-cli" if xdg else Path.home() / ".cache" / "tenantguard-cli"
+    return root / __version__
+
+
+def _fetch(url: str) -> bytes:
+    request = urllib.request.Request(url, headers={"User-Agent": USER_AGENT})
+    try:
+        with urllib.request.urlopen(request, timeout=REQUEST_TIMEOUT_SECONDS) as response:
+            return response.read()
+    except urllib.error.HTTPError as exc:
+        raise RuntimeError(f"tenantguard-cli: GET {url} failed: HTTP {exc.code}") from exc
+    except urllib.error.URLError as exc:
+        raise RuntimeError(f"tenantguard-cli: GET {url} failed: {exc.reason}") from exc
+
+
+def _sha256_hex(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()
+
+
+def _build_sigstore_verifier() -> Verifier:
+    """Split out so tests can monkeypatch it instead of hitting the real
+    Sigstore trust root / TUF refresh."""
+    return Verifier.production()
+
+
+def _retrieve_sigstore_log_entry(verifier: Verifier, certificate, signature: bytes, hashed: Hashed):
+    """Looks up the Rekor transparency-log entry matching a *detached*
+    signature + certificate pair (i.e. separate .sig/.pem files, the same
+    shape cosign produces and that checksums.txt.sig/.pem already are) --
+    mirrors what sigstore-python's own CLI does internally for this exact
+    "detached materials" case (see sigstore.verify.Verifier's `_rekor`
+    attribute and its "ugly hack needed for verifying detached materials"
+    comment). A `Bundle` built via `Bundle.from_parts` requires this log
+    entry, so it has to be fetched before verification can proceed. Split out
+    so tests can monkeypatch it instead of hitting the real transparency log.
+    """
+    return verifier._rekor.log.entries.retrieve.post(  # noqa: SLF001
+        _hashedrekord_from_parts(certificate, signature, hashed)
+    )
+
+
+def _verify_checksums_signature(checksums_bytes: bytes, cert_pem_bytes: bytes, sig_bytes: bytes) -> None:
+    """Verifies checksums.txt was signed by this repo's own release workflow
+    via Sigstore keyless signing (GitHub Actions OIDC), using the pure-Python
+    `sigstore` library. `cert_pem_bytes`/`sig_bytes` are the raw bytes
+    downloaded from checksums.txt.pem / checksums.txt.sig -- the same release
+    assets npm/scripts/fetch-binary.js's cosign check already consumes.
+
+    Raises RuntimeError on any failure: a certificate that doesn't parse, no
+    matching transparency-log entry, a signature that doesn't verify, or a
+    certificate identity/issuer that doesn't match this exact release
+    workflow run. Must be called, and must succeed, before any digest parsed
+    out of checksums.txt is trusted.
+    """
+    try:
+        certificate = load_pem_x509_certificate(cert_pem_bytes)
+    except ValueError as exc:
+        raise RuntimeError(
+            f"tenantguard-cli: could not parse checksums.txt.pem as a PEM certificate: {exc}"
+        ) from exc
+
+    hashed = Hashed(algorithm=HashAlgorithm.SHA2_256, digest=hashlib.sha256(checksums_bytes).digest())
+    verifier = _build_sigstore_verifier()
+
+    try:
+        log_entry = _retrieve_sigstore_log_entry(verifier, certificate, sig_bytes, hashed)
+    except Exception as exc:
+        raise RuntimeError(
+            "tenantguard-cli: failed to look up checksums.txt's signature in the Sigstore "
+            f"transparency log: {exc}"
+        ) from exc
+
+    if log_entry is None:
+        raise RuntimeError(
+            "tenantguard-cli: no matching Sigstore transparency log entry found for "
+            "checksums.txt.sig/checksums.txt.pem -- refusing to trust checksums.txt."
+        )
+
+    try:
+        bundle = Bundle.from_parts(certificate, sig_bytes, log_entry)
+    except Exception as exc:
+        raise RuntimeError(
+            f"tenantguard-cli: could not assemble a Sigstore bundle for checksums.txt: {exc}"
+        ) from exc
+
+    verification_policy = sigstore_policy.Identity(
+        identity=_sigstore_certificate_identity(),
+        issuer=SIGSTORE_OIDC_ISSUER,
+    )
+
+    try:
+        verifier.verify_artifact(checksums_bytes, bundle, verification_policy)
+    except Exception as exc:
+        raise RuntimeError(
+            f"tenantguard-cli: Sigstore signature verification failed for checksums.txt: {exc}"
+        ) from exc
+
+    print(
+        "tenantguard-cli: sigstore signature verified for checksums.txt "
+        "(keyless, GitHub Actions OIDC)",
+        file=sys.stderr,
+    )
+
+
+def _parse_checksums(text: str) -> dict[str, str]:
+    """checksums.txt lines look like "<64 hex chars>  <filename>" (goreleaser's
+    default sha256sum-compatible format; tolerate an optional leading "*")."""
+    checksums: dict[str, str] = {}
+    for raw_line in text.splitlines():
+        line = raw_line.strip()
+        if not line:
+            continue
+        parts = line.split(None, 1)
+        if len(parts) != 2:
+            continue
+        digest, filename = parts
+        digest = digest.strip().lower()
+        filename = filename.lstrip("*").strip()
+        if len(digest) == 64:
+            checksums[filename] = digest
+    return checksums
+
+
+def _extract_binary(archive_bytes: bytes, ext: str, target_basename: str) -> bytes:
+    if ext == "zip":
+        with zipfile.ZipFile(io.BytesIO(archive_bytes)) as zf:
+            for name in zf.namelist():
+                if os.path.basename(name) == target_basename:
+                    return zf.read(name)
+    else:
+        with tarfile.open(fileobj=io.BytesIO(archive_bytes), mode="r:gz") as tf:
+            for member in tf.getmembers():
+                if os.path.basename(member.name) == target_basename:
+                    extracted = tf.extractfile(member)
+                    if extracted is None:
+                        break
+                    return extracted.read()
+    raise RuntimeError(
+        f"tenantguard-cli: could not find '{target_basename}' inside the downloaded archive."
+    )
+
+
+def ensure_binary() -> Path:
+    """Returns the path to a verified, cached tenantguard binary for the
+    current platform, downloading and extracting it first if needed.
+    """
+    goos = resolve_goos()
+    goarch = resolve_goarch()
+    bin_name = binary_name(goos)
+
+    cache_dir = _cache_dir()
+    cached_path = cache_dir / bin_name
+    if cached_path.is_file() and os.access(cached_path, os.X_OK):
+        return cached_path
+
+    asset_name = archive_name(PROJECT_NAME, goos, goarch)
+    archive_url = f"{RELEASE_BASE}/{asset_name}"
+    checksums_url = f"{RELEASE_BASE}/checksums.txt"
+    checksums_sig_url = f"{checksums_url}.sig"
+    checksums_cert_url = f"{checksums_url}.pem"
+
+    print(f"tenantguard-cli: downloading {archive_url}", file=sys.stderr)
+    archive_bytes = _fetch(archive_url)
+    checksums_bytes = _fetch(checksums_url)
+    checksums_sig_bytes = _fetch(checksums_sig_url)
+    checksums_cert_bytes = _fetch(checksums_cert_url)
+
+    _verify_checksums_signature(checksums_bytes, checksums_cert_bytes, checksums_sig_bytes)
+
+    checksums = _parse_checksums(checksums_bytes.decode("utf-8", errors="replace"))
+    expected_digest = checksums.get(asset_name)
+    if not expected_digest:
+        raise RuntimeError(
+            f"tenantguard-cli: no checksum entry for '{asset_name}' in {RELEASE_TAG}'s "
+            "checksums.txt -- refusing to proceed."
+        )
+
+    actual_digest = _sha256_hex(archive_bytes)
+    if actual_digest != expected_digest:
+        raise RuntimeError(
+            f"tenantguard-cli: checksum mismatch for {asset_name}: "
+            f"expected {expected_digest}, got {actual_digest}. Refusing to extract."
+        )
+    print(f"tenantguard-cli: checksum verified for {asset_name}", file=sys.stderr)
+
+    binary_data = _extract_binary(archive_bytes, ext=archive_ext(goos), target_basename=bin_name)
+    if not binary_data:
+        raise RuntimeError(f"tenantguard-cli: extracted an empty '{bin_name}' from {asset_name}.")
+
+    cache_dir.mkdir(parents=True, exist_ok=True)
+    tmp_path = cached_path.with_suffix(cached_path.suffix + ".tmp")
+    tmp_path.write_bytes(binary_data)
+    if sys.platform != "win32":
+        current_mode = tmp_path.stat().st_mode
+        tmp_path.chmod(current_mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
+    tmp_path.replace(cached_path)
+
+    print(f"tenantguard-cli: cached verified binary at {cached_path}", file=sys.stderr)
+    return cached_path
+
+
+def main(argv: list[str] | None = None) -> int:
+    argv = sys.argv[1:] if argv is None else argv
+    try:
+        binary_path = ensure_binary()
+    except UnsupportedPlatformError as exc:
+        print(str(exc), file=sys.stderr)
+        return 1
+    except RuntimeError as exc:
+        print(str(exc), file=sys.stderr)
+        return 1
+
+    result = subprocess.run([str(binary_path), *argv])
+    return result.returncode
+
+
+if __name__ == "__main__":
+    sys.exit(main())

tenantguard_cli-0.1.1/src/tenantguard_cli/platforms.py

@@ -0,0 +1,70 @@
+"""Pure platform/arch resolution logic, kept separate from cli.py so it can
+be unit tested without touching the network or the filesystem.
+
+Mirrors the goreleaser build matrix in .goreleaser.yml (goos: linux, darwin,
+windows / goarch: amd64, arm64) and the archive naming template
+"{{ .ProjectName }}_{{ .Os }}_{{ .Arch }}" -- the same convention the npm
+wrapper's optionalDependency package names / npm/scripts/fetch-binary.js
+already rely on for this exact repo.
+"""
+
+from __future__ import annotations
+
+import platform
+import sys
+
+# sys.platform -> goreleaser GOOS
+_GOOS_MAP = {
+    "linux": "linux",
+    "darwin": "darwin",
+    "win32": "windows",
+    "cygwin": "windows",
+}
+
+# platform.machine() (lowercased) -> goreleaser GOARCH
+_GOARCH_MAP = {
+    "x86_64": "amd64",
+    "amd64": "amd64",
+    "arm64": "arm64",
+    "aarch64": "arm64",
+}
+
+
+class UnsupportedPlatformError(RuntimeError):
+    """Raised when the running machine has no matching TenantGuard release asset."""
+
+
+def resolve_goos(sys_platform: str = sys.platform) -> str:
+    goos = _GOOS_MAP.get(sys_platform)
+    if goos is None:
+        raise UnsupportedPlatformError(
+            f"tenantguard-cli: unsupported platform '{sys_platform}'. "
+            f"Supported: {sorted(set(_GOOS_MAP.values()))}."
+        )
+    return goos
+
+
+def resolve_goarch(machine: str | None = None) -> str:
+    machine = (machine if machine is not None else platform.machine()).lower()
+    goarch = _GOARCH_MAP.get(machine)
+    if goarch is None:
+        raise UnsupportedPlatformError(
+            f"tenantguard-cli: unsupported CPU architecture '{machine}'. "
+            f"Supported: {sorted(set(_GOARCH_MAP.values()))}."
+        )
+    return goarch
+
+
+def archive_ext(goos: str) -> str:
+    return "zip" if goos == "windows" else "tar.gz"
+
+
+def binary_name(goos: str, base_name: str = "tenantguard") -> str:
+    return f"{base_name}.exe" if goos == "windows" else base_name
+
+
+def archive_name(project_name: str, goos: str, goarch: str) -> str:
+    """Matches the .goreleaser.yml archive name_template:
+    "{{ .ProjectName }}_{{ .Os }}_{{ .Arch }}" plus the format extension.
+    """
+    return f"{project_name}_{goos}_{goarch}.{archive_ext(goos)}"

tenantguard_cli-0.1.1/tests/test_cli.py

@@ -0,0 +1,177 @@
+import hashlib
+
+import pytest
+
+from tenantguard_cli import cli
+from tenantguard_cli.cli import _parse_checksums, _sha256_hex, _verify_checksums_signature
+
+
+def test_parse_checksums_standard_format():
+    text = (
+        "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa  "
+        "tenantguard_linux_amd64.tar.gz\n"
+        "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb  "
+        "tenantguard_darwin_arm64.tar.gz\n"
+    )
+    checksums = _parse_checksums(text)
+    assert checksums["tenantguard_linux_amd64.tar.gz"] == "a" * 64
+    assert checksums["tenantguard_darwin_arm64.tar.gz"] == "b" * 64
+
+
+def test_parse_checksums_tolerates_leading_star_and_blank_lines():
+    text = "\n" + "c" * 64 + "  *tenantguard_windows_amd64.zip\n\n"
+    checksums = _parse_checksums(text)
+    assert checksums["tenantguard_windows_amd64.zip"] == "c" * 64
+
+
+def test_parse_checksums_ignores_malformed_lines():
+    checksums = _parse_checksums("not-a-checksum-line\n")
+    assert checksums == {}
+
+
+def test_sha256_hex_matches_hashlib():
+    data = b"tenantguard test payload"
+    assert _sha256_hex(data) == hashlib.sha256(data).hexdigest()
+
+
+# --- checksums.txt Sigstore signature verification --------------------------
+#
+# These tests never touch the real Sigstore transparency log or Fulcio trust
+# root: they monkeypatch the seams `_verify_checksums_signature` calls out to
+# (certificate parsing, verifier construction, the Rekor log-entry lookup,
+# and bundle assembly), so only the actual policy-check call --
+# `Verifier.verify_artifact` -- is exercised, via a fake standing in for it.
+
+
+class _FakeVerifier:
+    """Stand-in for sigstore.verify.Verifier. Records every call made to
+    verify_artifact (so tests can assert what identity/issuer policy was
+    checked against) and either succeeds or raises whatever exception the
+    test configures, exactly like the real Verifier would on a rejected
+    signature or an identity/issuer mismatch."""
+
+    def __init__(self, raises: Exception | None = None):
+        self.raises = raises
+        self.calls = []
+
+    def verify_artifact(self, input_, bundle, policy):
+        self.calls.append((input_, bundle, policy))
+        if self.raises is not None:
+            raise self.raises
+
+
+def _patch_sigstore_plumbing(monkeypatch, verifier, *, log_entry=object(), bundle=object()):
+    """Bypasses everything upstream of the policy check -- PEM parsing, the
+    Rekor transparency-log lookup, and Sigstore bundle assembly -- with
+    lightweight stand-ins, since none of those are what this test suite is
+    verifying: they're sigstore-python's own responsibility, already covered
+    by that library's tests. What this module owns, and what these tests
+    verify, is that `ensure_binary()`'s digest never gets trusted until
+    `Verifier.verify_artifact` succeeds against the right identity/issuer.
+    """
+    monkeypatch.setattr(cli, "load_pem_x509_certificate", lambda pem: object())
+    monkeypatch.setattr(cli, "_build_sigstore_verifier", lambda: verifier)
+    monkeypatch.setattr(cli, "_retrieve_sigstore_log_entry", lambda *a, **k: log_entry)
+    monkeypatch.setattr(cli.Bundle, "from_parts", staticmethod(lambda *a, **k: bundle))
+
+
+def _assert_policy_matches_pinned_identity(checked_policy) -> None:
+    """sigstore.verify.policy.Identity stores its fields as private
+    attributes (`_identity`, `_issuer._value`) rather than a public API --
+    reach into them here (test-only) to confirm _verify_checksums_signature
+    builds its policy from the pinned RELEASE_TAG-scoped identity and the
+    GitHub Actions OIDC issuer, not something looser."""
+    assert checked_policy._identity == cli._sigstore_certificate_identity()
+    assert checked_policy._issuer._value == cli.SIGSTORE_OIDC_ISSUER
+
+
+def test_sigstore_certificate_identity_matches_release_workflow():
+    assert cli._sigstore_certificate_identity() == (
+        f"https://github.com/{cli.REPO}/.github/workflows/release.yml@refs/tags/{cli.RELEASE_TAG}"
+    )
+    assert cli.SIGSTORE_OIDC_ISSUER == "https://token.actions.githubusercontent.com"
+
+
+def test_verify_checksums_signature_success_checks_correct_identity_and_issuer(monkeypatch):
+    verifier = _FakeVerifier(raises=None)
+    _patch_sigstore_plumbing(monkeypatch, verifier)
+
+    # Should not raise.
+    _verify_checksums_signature(b"checksums.txt contents", b"-----BEGIN CERTIFICATE-----", b"signature-bytes")
+
+    assert len(verifier.calls) == 1
+    checked_input, _checked_bundle, checked_policy = verifier.calls[0]
+    assert checked_input == b"checksums.txt contents"
+    _assert_policy_matches_pinned_identity(checked_policy)
+
+
+def test_verify_checksums_signature_rejects_tampered_checksums(monkeypatch):
+    """A checksums.txt that was tampered with after signing no longer
+    matches the signature that was computed over the original bytes --
+    sigstore-python's verify_artifact raises VerificationError for this, and
+    that must surface as a RuntimeError, matching this module's error style,
+    before any digest inside checksums.txt is ever trusted."""
+    from sigstore.errors import VerificationError
+
+    verifier = _FakeVerifier(raises=VerificationError("Signature is invalid for input"))
+    _patch_sigstore_plumbing(monkeypatch, verifier)
+
+    with pytest.raises(RuntimeError, match="Sigstore signature verification failed"):
+        _verify_checksums_signature(b"tampered checksums.txt contents", b"-----BEGIN CERTIFICATE-----", b"sig")
+
+
+def test_verify_checksums_signature_rejects_wrong_identity_or_issuer(monkeypatch):
+    """A certificate signed by a different workflow/repo/tag, or issued by a
+    different OIDC issuer than GitHub Actions, must be rejected even if the
+    signature itself is otherwise cryptographically valid -- this is what
+    the certificate-identity/issuer policy check exists for. sigstore-python
+    raises VerificationError for a policy mismatch too (from inside
+    verify_artifact's common-signing-cert checks); it must still surface as
+    a RuntimeError here."""
+    from sigstore.errors import VerificationError
+
+    verifier = _FakeVerifier(
+        raises=VerificationError(
+            "Certificate's SANs do not match the expected identity, or the "
+            "certificate's issuer extension does not match the expected issuer"
+        )
+    )
+    _patch_sigstore_plumbing(monkeypatch, verifier)
+
+    with pytest.raises(RuntimeError, match="Sigstore signature verification failed"):
+        _verify_checksums_signature(b"checksums.txt contents", b"-----BEGIN CERTIFICATE-----", b"sig")
+
+    # The policy actually checked was still the pinned identity/issuer, not
+    # something looser -- confirms the rejection came from that policy, not
+    # a coincidentally-broad one that would have let a wrong cert through.
+    assert len(verifier.calls) == 1
+    _, _, checked_policy = verifier.calls[0]
+    _assert_policy_matches_pinned_identity(checked_policy)
+
+
+def test_verify_checksums_signature_rejects_missing_transparency_log_entry(monkeypatch):
+    """No matching Rekor entry (e.g. checksums.txt.sig/.pem weren't actually
+    produced by a real Sigstore signing operation) must fail loudly rather
+    than silently skipping straight to the SHA-256 check."""
+    verifier = _FakeVerifier(raises=None)
+    _patch_sigstore_plumbing(monkeypatch, verifier, log_entry=None)
+
+    with pytest.raises(RuntimeError, match="no matching Sigstore transparency log entry"):
+        _verify_checksums_signature(b"checksums.txt contents", b"-----BEGIN CERTIFICATE-----", b"sig")
+
+    # verify_artifact must never be reached without a log entry to build a bundle from.
+    assert verifier.calls == []
+
+
+def test_verify_checksums_signature_rejects_unparseable_certificate(monkeypatch):
+    """A missing/corrupt checksums.txt.pem (e.g. the signing step never ran,
+    or the release asset wasn't published) must fail loudly with a clear
+    error rather than crash on an unhandled exception."""
+
+    def _raise_value_error(_pem):
+        raise ValueError("Unable to load PEM file")
+
+    monkeypatch.setattr(cli, "load_pem_x509_certificate", _raise_value_error)
+
+    with pytest.raises(RuntimeError, match="could not parse checksums.txt.pem"):
+        _verify_checksums_signature(b"checksums.txt contents", b"not a real certificate", b"sig")

tenantguard_cli-0.1.1/tests/test_platforms.py

@@ -0,0 +1,55 @@
+import pytest
+
+from tenantguard_cli.platforms import (
+    UnsupportedPlatformError,
+    archive_ext,
+    archive_name,
+    binary_name,
+    resolve_goarch,
+    resolve_goos,
+)
+
+
+def test_resolve_goos_known_platforms():
+    assert resolve_goos("linux") == "linux"
+    assert resolve_goos("darwin") == "darwin"
+    assert resolve_goos("win32") == "windows"
+    assert resolve_goos("cygwin") == "windows"
+
+
+def test_resolve_goos_unsupported():
+    with pytest.raises(UnsupportedPlatformError):
+        resolve_goos("freebsd")
+
+
+def test_resolve_goarch_known_machines():
+    assert resolve_goarch("x86_64") == "amd64"
+    assert resolve_goarch("amd64") == "amd64"
+    assert resolve_goarch("arm64") == "arm64"
+    assert resolve_goarch("aarch64") == "arm64"
+    # case-insensitive
+    assert resolve_goarch("X86_64") == "amd64"
+
+
+def test_resolve_goarch_unsupported():
+    with pytest.raises(UnsupportedPlatformError):
+        resolve_goarch("riscv64")
+
+
+def test_archive_ext():
+    assert archive_ext("windows") == "zip"
+    assert archive_ext("linux") == "tar.gz"
+    assert archive_ext("darwin") == "tar.gz"
+
+
+def test_binary_name():
+    assert binary_name("windows") == "tenantguard.exe"
+    assert binary_name("linux") == "tenantguard"
+    assert binary_name("darwin") == "tenantguard"
+
+
+def test_archive_name_matches_goreleaser_template():
+    # Matches .goreleaser.yml's name_template: "{{ .ProjectName }}_{{ .Os }}_{{ .Arch }}"
+    assert archive_name("tenantguard", "darwin", "arm64") == "tenantguard_darwin_arm64.tar.gz"
+    assert archive_name("tenantguard", "linux", "amd64") == "tenantguard_linux_amd64.tar.gz"
+    assert archive_name("tenantguard", "windows", "amd64") == "tenantguard_windows_amd64.zip"