trustcheck 2.0.2__tar.gz → 2.0.3__tar.gz

trustcheck-2.0.3/.github/workflows/binary-security.yml

@@ -0,0 +1,218 @@
+name: Binary Security
+
+on:
+  push:
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  windows-defender:
+    name: Windows Defender
+    runs-on: windows-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Install package and binary tooling
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e . "pyinstaller>=6.20,<7"
+
+      - name: Build Windows executable
+        run: python scripts/build_standalone.py
+
+      - name: Smoke test Windows executable
+        shell: pwsh
+        run: |
+          $binary = (Resolve-Path "dist\standalone\trustcheck.exe").Path
+          & $binary --version
+          if ($LASTEXITCODE -ne 0) {
+            exit $LASTEXITCODE
+          }
+          & $binary --help | Out-Null
+          if ($LASTEXITCODE -ne 0) {
+            exit $LASTEXITCODE
+          }
+
+      - name: Locate Microsoft Defender CLI
+        id: defender
+        shell: pwsh
+        run: |
+          $platformRoot = Join-Path $env:ProgramData "Microsoft\Windows Defender\Platform"
+          $candidates = @()
+          if (Test-Path $platformRoot) {
+            $candidates += Get-ChildItem -Path $platformRoot -Directory |
+              Sort-Object Name -Descending |
+              ForEach-Object { Join-Path $_.FullName "MpCmdRun.exe" }
+          }
+          $candidates += Join-Path $env:ProgramFiles "Windows Defender\MpCmdRun.exe"
+          $defender = $candidates |
+            Where-Object { Test-Path $_ } |
+            Select-Object -First 1
+          if (-not $defender) {
+            throw "MpCmdRun.exe was not found on the Windows runner."
+          }
+          "path=$defender" | Out-File -FilePath $env:GITHUB_OUTPUT -Append
+          Write-Host "Using Microsoft Defender CLI: $defender"
+
+      - name: Verify Microsoft Defender is enabled
+        shell: pwsh
+        run: |
+          Set-Service -Name wuauserv -StartupType Manual
+          Start-Service -Name wuauserv
+          $status = Get-MpComputerStatus
+          $status |
+            Select-Object AMServiceEnabled, AntivirusEnabled, AntivirusSignatureVersion |
+            Format-List |
+            Out-File defender-status.txt
+          Get-Content defender-status.txt
+          if (-not $status.AMServiceEnabled -or -not $status.AntivirusEnabled) {
+            throw "Microsoft Defender Antivirus is not enabled on the runner."
+          }
+
+      - name: Update Microsoft Defender signatures
+        shell: pwsh
+        env:
+          DEFENDER_CLI: ${{ steps.defender.outputs.path }}
+        run: |
+          "Microsoft Defender signature update" |
+            Set-Content -Path defender-signature-update.txt
+          $output = & $env:DEFENDER_CLI -SignatureUpdate 2>&1
+          $exitCode = $LASTEXITCODE
+          $output | Tee-Object -FilePath defender-signature-update.txt -Append
+          if ($exitCode -ne 0) {
+            Write-Error "Microsoft Defender signature update failed with exit code $exitCode."
+            exit $exitCode
+          }
+
+      - name: Scan executable with Microsoft Defender
+        shell: pwsh
+        env:
+          DEFENDER_CLI: ${{ steps.defender.outputs.path }}
+        run: |
+          $binary = (Resolve-Path "dist\standalone\trustcheck.exe").Path
+          "Microsoft Defender custom scan: $binary" |
+            Set-Content -Path defender-scan.txt
+          $output = & $env:DEFENDER_CLI `
+            -Scan `
+            -ScanType 3 `
+            -File $binary `
+            -DisableRemediation 2>&1
+          $exitCode = $LASTEXITCODE
+          $output | Tee-Object -FilePath defender-scan.txt -Append
+          if ($exitCode -ne 0) {
+            Write-Error "Microsoft Defender scan failed with exit code $exitCode."
+            exit $exitCode
+          }
+
+      - name: Generate Windows executable checksum
+        shell: pwsh
+        run: |
+          Get-FileHash "dist\standalone\trustcheck.exe" -Algorithm SHA256 |
+            Format-List |
+            Out-File "dist\standalone\trustcheck.exe.sha256.txt"
+
+      - name: Upload Microsoft Defender reports
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: windows-defender-reports-${{ github.sha }}
+          path: defender-*.txt
+          if-no-files-found: warn
+
+      - name: Upload clean Windows executable
+        uses: actions/upload-artifact@v7
+        with:
+          name: trustcheck-windows-${{ github.sha }}
+          path: |
+            dist/standalone/trustcheck.exe
+            dist/standalone/trustcheck.exe.sha256.txt
+          if-no-files-found: error
+
+  linux-clamav:
+    name: ClamAV
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Install package and binary tooling
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e . "pyinstaller>=6.20,<7"
+
+      - name: Build Linux executable
+        run: python scripts/build_standalone.py
+
+      - name: Smoke test Linux executable
+        run: |
+          test -x dist/standalone/trustcheck
+          dist/standalone/trustcheck --version
+          dist/standalone/trustcheck --help > /dev/null
+
+      - name: Install ClamAV
+        run: |
+          sudo apt-get update
+          sudo apt-get install --yes clamav
+
+      - name: Update ClamAV signatures
+        run: |
+          sudo systemctl stop clamav-freshclam.service 2>/dev/null || true
+          sudo freshclam --verbose | tee clamav-signature-update.txt
+
+      - name: Scan executable with ClamAV
+        run: |
+          set +e
+          clamscan \
+            --official-db-only=yes \
+            --verbose \
+            --log=clamav-scan.txt \
+            dist/standalone/trustcheck
+          scan_status=$?
+          set -e
+          cat clamav-scan.txt
+          if [ "$scan_status" -ne 0 ]; then
+            echo "ClamAV scan failed with exit code ${scan_status}." >&2
+            exit "$scan_status"
+          fi
+
+      - name: Generate Linux executable checksum
+        run: sha256sum dist/standalone/trustcheck > dist/standalone/trustcheck.sha256
+
+      - name: Upload ClamAV reports
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: linux-clamav-reports-${{ github.sha }}
+          path: clamav-*.txt
+          if-no-files-found: warn
+
+      - name: Upload clean Linux executable
+        uses: actions/upload-artifact@v7
+        with:
+          name: trustcheck-linux-${{ github.sha }}
+          path: |
+            dist/standalone/trustcheck
+            dist/standalone/trustcheck.sha256
+          if-no-files-found: error

{trustcheck-2.0.2 → trustcheck-2.0.3}/.github/workflows/publish.yml

@@ -310,6 +310,25 @@ jobs:
           export PATH="/snap/bin:$PATH"
           test "$(command -v trustcheck)" = "/snap/bin/trustcheck"
           trustcheck --help > /dev/null
+          trustcheck inspect sampleproject \
+            --version 4.0.0 \
+            --format json \
+            > snap-verification-report.json
+          python - <<'PY'
+          import json
+          from pathlib import Path
+
+          payload = json.loads(
+              Path("snap-verification-report.json").read_text(encoding="utf-8")
+          )
+          report = payload["report"]
+          assert report["coverage"]["verified_files"] > 0, report["coverage"]
+          failures = report["diagnostics"]["artifact_failures"]
+          assert not any(
+              item["subcode"] == "unexpected_verification_error"
+              for item in failures
+          ), failures
+          PY
 
       - name: Generate snap checksum
         env:
@@ -330,6 +349,84 @@ jobs:
             ${{ steps.snapcraft.outputs.snap }}.sha256
           if-no-files-found: error
 
+  build-windows-executable:
+    needs:
+      - coverage-build
+      - snap-qa
+    runs-on: windows-latest
+
+    steps:
+      - name: Check out tagged commit
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+
+      - name: Install PyInstaller tooling
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e . "pyinstaller>=6.20,<7"
+
+      - name: Build standalone Windows executable
+        run: python scripts/build_standalone.py
+
+      - name: Smoke test and name release executable
+        id: executable
+        shell: pwsh
+        env:
+          TAG_NAME: ${{ github.ref_name }}
+        run: |
+          $binary = (Resolve-Path "dist\standalone\trustcheck.exe").Path
+          $releaseVersion = $env:TAG_NAME.TrimStart("v")
+          $versionOutput = & $binary --version
+          if ($LASTEXITCODE -ne 0) {
+            throw "The standalone executable failed its version smoke test."
+          }
+          if (-not $versionOutput.StartsWith("trustcheck $releaseVersion ")) {
+            throw "Executable version '$versionOutput' does not match $releaseVersion."
+          }
+          & $binary --help | Out-Null
+          if ($LASTEXITCODE -ne 0) {
+            throw "The standalone executable failed its help smoke test."
+          }
+
+          New-Item -ItemType Directory -Force "release\windows" | Out-Null
+          $releaseName = "trustcheck-$releaseVersion-windows-x86_64.exe"
+          $releasePath = Join-Path "release\windows" $releaseName
+          Move-Item -LiteralPath $binary -Destination $releasePath
+          "path=$releasePath" >> $env:GITHUB_OUTPUT
+          "name=$releaseName" >> $env:GITHUB_OUTPUT
+
+      - name: Generate executable checksum
+        shell: pwsh
+        env:
+          EXECUTABLE_NAME: ${{ steps.executable.outputs.name }}
+          EXECUTABLE_PATH: ${{ steps.executable.outputs.path }}
+        run: |
+          $hash = (Get-FileHash $env:EXECUTABLE_PATH -Algorithm SHA256).Hash.ToLowerInvariant()
+          "$hash  $env:EXECUTABLE_NAME" |
+            Set-Content -Encoding ascii "$env:EXECUTABLE_PATH.sha256"
+
+      - name: Attest executable build provenance
+        uses: actions/attest-build-provenance@v4
+        with:
+          subject-path: ${{ steps.executable.outputs.path }}
+
+      - name: Upload Windows executable
+        uses: actions/upload-artifact@v7
+        with:
+          name: windows-executable-${{ github.sha }}
+          path: |
+            ${{ steps.executable.outputs.path }}
+            ${{ steps.executable.outputs.path }}.sha256
+          if-no-files-found: error
+
   publish-pypi:
     needs:
       - coverage-build
@@ -401,6 +498,7 @@ jobs:
             - `dist/SHA256SUMS.txt`
             - `dist/trustcheck-sbom.json`
             - verified `trustcheck_*.snap` with checksum
+            - standalone `trustcheck-*-windows-x86_64.exe` with checksum
 
             GitHub Action:
             - Immutable: `uses: Halfblood-Prince/trustcheck@${{ github.ref_name }}`
@@ -463,6 +561,29 @@ jobs:
             echo "[Edit ${RELEASE_TAG} and select **Publish this Action to the GitHub Marketplace**](https://github.com/${GITHUB_REPOSITORY}/releases/edit/${RELEASE_TAG})."
           } >> "$GITHUB_STEP_SUMMARY"
 
+  attach-windows-executable:
+    needs:
+      - build-windows-executable
+      - publish-github-action
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Download Windows executable
+        uses: actions/download-artifact@v8
+        with:
+          name: windows-executable-${{ github.sha }}
+          path: windows-executable
+
+      - name: Attach executable to GitHub Release
+        env:
+          GH_TOKEN: ${{ secrets.RELEASE_TOKEN || github.token }}
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          gh release upload "$RELEASE_TAG" \
+            windows-executable/* \
+            --clobber \
+            --repo "$GITHUB_REPOSITORY"
+
   publish-snap:
     needs:
       - coverage-build

{trustcheck-2.0.2 → trustcheck-2.0.3}/CHANGELOG.md

@@ -31,6 +31,11 @@ The project follows Semantic Versioning for the supported public API described i
 - Renamed the reusable GitHub Action and Marketplace display name to `TrustCheck Package Scanner`.
 - Expanded the Snap Store listing with richer feature copy, quick-start examples, project links, and a dedicated storefront icon.
 - Updated Snap release smoke tests and installation documentation to verify the public `trustcheck` command and diagnose shells where `/snap/bin` is missing from `PATH`.
+- Redirected Sigstore XDG data, cache, and configuration into writable Snap-owned storage, fixing errno 13 provenance verification failures under strict confinement.
+- Expanded Snap release QA to perform live verified-provenance inspection from the installed snap and reject unexpected verification errors.
+- Added a push-triggered binary security workflow that builds standalone Windows and Linux executables with PyInstaller.
+- Added a parallel release job that builds, smoke-tests, checksums, and attests a versioned Windows executable, then attaches it to the GitHub release.
+- Added Microsoft Defender CLI and ClamAV scanning, retained scan reports, clean binary artifacts, checksums, and independent README check-run badges.
 
 ## [1.9.0] - 2026-06-09
 

{trustcheck-2.0.2 → trustcheck-2.0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: trustcheck
-Version: 2.0.2
+Version: 2.0.3
 Summary: Package trust and provenance verification for PyPI consumers.
 License: Trustcheck Personal Use License
         
@@ -113,6 +113,8 @@ Dynamic: license-file
 [![pip-audit](https://img.shields.io/github/actions/workflow/status/Halfblood-Prince/trustcheck/ci.yml?branch=main&label=pip-audit)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/ci.yml)
 [![Bandit](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/bandit.yml/badge.svg?branch=main)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/bandit.yml)
 [![Semgrep](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/semgrep.yml/badge.svg?branch=main)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/semgrep.yml)
+[![Windows Defender](https://img.shields.io/github/check-runs/Halfblood-Prince/trustcheck/main?nameFilter=Windows%20Defender&label=Windows%20Defender&logo=windows11)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/binary-security.yml)
+[![ClamAV](https://img.shields.io/github/check-runs/Halfblood-Prince/trustcheck/main?nameFilter=ClamAV&label=ClamAV&logo=linux)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/binary-security.yml)
 [![Ruff](https://img.shields.io/github/actions/workflow/status/Halfblood-Prince/trustcheck/ci.yml?branch=main&label=ruff)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/ci.yml)
 [![mypy](https://img.shields.io/github/actions/workflow/status/Halfblood-Prince/trustcheck/ci.yml?branch=main&label=mypy)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/ci.yml)
 [![Coverage](docs/assets/images/coverage.svg)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/ci.yml)
@@ -140,6 +142,12 @@ For a selected package version, `trustcheck` can:
 - optionally inspect wheel and sdist contents without importing or executing package code
 - emit concise text output or structured JSON for automation
 
+Every push also builds standalone Windows and Linux executables. The Windows
+artifact is scanned with Microsoft Defender's `MpCmdRun.exe`; the Linux
+artifact is scanned with ClamAV. Clean binaries, checksums, and scanner reports
+are retained as workflow artifacts by
+[Binary Security](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/binary-security.yml).
+
 ## Installation
 
 Install from PyPI:

{trustcheck-2.0.2 → trustcheck-2.0.3}/README.md

@@ -10,6 +10,8 @@
 [![pip-audit](https://img.shields.io/github/actions/workflow/status/Halfblood-Prince/trustcheck/ci.yml?branch=main&label=pip-audit)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/ci.yml)
 [![Bandit](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/bandit.yml/badge.svg?branch=main)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/bandit.yml)
 [![Semgrep](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/semgrep.yml/badge.svg?branch=main)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/semgrep.yml)
+[![Windows Defender](https://img.shields.io/github/check-runs/Halfblood-Prince/trustcheck/main?nameFilter=Windows%20Defender&label=Windows%20Defender&logo=windows11)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/binary-security.yml)
+[![ClamAV](https://img.shields.io/github/check-runs/Halfblood-Prince/trustcheck/main?nameFilter=ClamAV&label=ClamAV&logo=linux)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/binary-security.yml)
 [![Ruff](https://img.shields.io/github/actions/workflow/status/Halfblood-Prince/trustcheck/ci.yml?branch=main&label=ruff)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/ci.yml)
 [![mypy](https://img.shields.io/github/actions/workflow/status/Halfblood-Prince/trustcheck/ci.yml?branch=main&label=mypy)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/ci.yml)
 [![Coverage](docs/assets/images/coverage.svg)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/ci.yml)
@@ -37,6 +39,12 @@ For a selected package version, `trustcheck` can:
 - optionally inspect wheel and sdist contents without importing or executing package code
 - emit concise text output or structured JSON for automation
 
+Every push also builds standalone Windows and Linux executables. The Windows
+artifact is scanned with Microsoft Defender's `MpCmdRun.exe`; the Linux
+artifact is scanned with ClamAV. Clean binaries, checksums, and scanner reports
+are retained as workflow artifacts by
+[Binary Security](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/binary-security.yml).
+
 ## Installation
 
 Install from PyPI:

{trustcheck-2.0.2 → trustcheck-2.0.3}/docs/getting-started/installation.md

@@ -65,6 +65,24 @@ snap info trustcheck
 snap connections trustcheck
 ```
 
+### Snap provenance verification reports permission denied
+
+Versions before the XDG confinement fix could let Sigstore resolve its TUF
+trust metadata to hidden directories in the real home directory. The Snap
+`home` interface does not grant general access to hidden home paths, so
+verification could report `[unexpected_verification_error] [Errno 13]
+Permission denied`.
+
+Refresh to the latest stable revision:
+
+```bash
+sudo snap refresh trustcheck
+trustcheck inspect sampleproject --version 4.0.0
+```
+
+Current revisions keep Sigstore data, cache, and configuration under the
+snap-owned `$SNAP_USER_COMMON` directory.
+
 ## Notes
 
 CI runs should stay aligned with the package's advertised Python support. When you need fully reproducible automation, pin both the Python version and the `trustcheck` version.

{trustcheck-2.0.2 → trustcheck-2.0.3}/docs/guides/development.md

@@ -38,6 +38,7 @@ The repository includes:
 
 - CI for lint, type checks, cross-platform test matrices, coverage enforcement, and build smoke tests
 - dependency auditing and secret scanning in CI
+- standalone Windows and Linux binary builds on every push, scanned with Microsoft Defender and ClamAV
 - CodeQL analysis for the Python codebase
 - release publishing from immutable tagged commits
 - annotated tag enforcement for releases

{trustcheck-2.0.2 → trustcheck-2.0.3}/docs/guides/release-publishing.md

@@ -3,12 +3,13 @@
 An annotated `vMAJOR.MINOR.PATCH` tag starts `.github/workflows/publish.yml`.
 The workflow verifies the tag, runs the package test matrix, builds the Python
 distribution, and builds, lints, installs, and smoke-tests the snap. Only
-after those checks pass do three independent publication jobs start in
-parallel:
+after those checks pass do three independent publication jobs and the Windows
+executable build start in parallel:
 
 - PyPI Trusted Publishing
 - GitHub Release and GitHub Action version tags
 - Snap Store publication to `stable`
+- PyInstaller build of the standalone Windows executable
 
 ## PyPI setup
 
@@ -25,7 +26,9 @@ only the wheel and sdist produced by the verified build job.
 
 The workflow creates the immutable release tag, updates the compatible major
 tag such as `v1`, and creates a GitHub Release containing the Python
-distributions, SBOM, checksums, and snap.
+distributions, SBOM, checksums, snap, and versioned Windows executable. The
+executable is smoke-tested, checksummed, and attested before a follow-up job
+attaches it to the generated GitHub Release.
 
 GitHub does not expose Marketplace publication as a workflow or Releases API
 field. For the first Marketplace publication, and for any release GitHub
@@ -91,4 +94,4 @@ git push origin v1.10.0
 ```
 
 Lightweight tags and prerelease-shaped tags are rejected. If any QA job
-fails, none of the three publication jobs starts.
+fails, neither the publication jobs nor the Windows executable build starts.

trustcheck-2.0.3/scripts/build_standalone.py

@@ -0,0 +1,41 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+import PyInstaller.__main__
+
+ROOT = Path(__file__).parents[1]
+DIST_DIR = ROOT / "dist" / "standalone"
+WORK_DIR = ROOT / "build" / "pyinstaller"
+SPEC_DIR = WORK_DIR / "spec"
+
+
+def main() -> int:
+    SPEC_DIR.mkdir(parents=True, exist_ok=True)
+    arguments = [
+        "--clean",
+        "--noconfirm",
+        "--onefile",
+        "--noupx",
+        "--name=trustcheck",
+        f"--distpath={DIST_DIR}",
+        f"--workpath={WORK_DIR}",
+        f"--specpath={SPEC_DIR}",
+        "--recursive-copy-metadata=trustcheck",
+    ]
+    for package in (
+        "pypi_attestations",
+        "rekor_types",
+        "sigstore",
+        "sigstore_models",
+        "tuf",
+    ):
+        arguments.append(f"--collect-all={package}")
+    arguments.append(str(ROOT / "scripts" / "trustcheck_binary.py"))
+
+    PyInstaller.__main__.run(arguments)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

trustcheck-2.0.3/scripts/trustcheck_binary.py

@@ -0,0 +1,4 @@
+from trustcheck.cli import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())

{trustcheck-2.0.2 → trustcheck-2.0.3}/snap/README.md

@@ -5,6 +5,11 @@ The root `snap/snapcraft.yaml` builds the `trustcheck` CLI as a strict,
 interfaces so it can query package registries and scan dependency files
 without classic confinement.
 
+Sigstore stores TUF trust metadata through the XDG data and cache paths. The
+snap redirects those paths into `$SNAP_USER_COMMON` so provenance verification
+can update trust material under strict confinement and retain it across snap
+revisions.
+
 Supported Snap platforms are:
 
 - `amd64` for 64-bit x86

{trustcheck-2.0.2 → trustcheck-2.0.3}/snap/snapcraft.yaml

@@ -62,6 +62,10 @@ platforms:
 apps:
   trustcheck:
     command: bin/trustcheck
+    environment:
+      XDG_CACHE_HOME: $SNAP_USER_COMMON/cache
+      XDG_CONFIG_HOME: $SNAP_USER_COMMON/config
+      XDG_DATA_HOME: $SNAP_USER_COMMON/data
     plugs:
       - home
       - network

{trustcheck-2.0.2 → trustcheck-2.0.3}/src/trustcheck/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '2.0.2'
-__version_tuple__ = version_tuple = (2, 0, 2)
+__version__ = version = '2.0.3'
+__version_tuple__ = version_tuple = (2, 0, 3)
 
-__commit_id__ = commit_id = 'g4c245c0ac'
+__commit_id__ = commit_id = 'g8dc614f20'

{trustcheck-2.0.2 → trustcheck-2.0.3}/src/trustcheck.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: trustcheck
-Version: 2.0.2
+Version: 2.0.3
 Summary: Package trust and provenance verification for PyPI consumers.
 License: Trustcheck Personal Use License
         
@@ -113,6 +113,8 @@ Dynamic: license-file
 [![pip-audit](https://img.shields.io/github/actions/workflow/status/Halfblood-Prince/trustcheck/ci.yml?branch=main&label=pip-audit)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/ci.yml)
 [![Bandit](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/bandit.yml/badge.svg?branch=main)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/bandit.yml)
 [![Semgrep](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/semgrep.yml/badge.svg?branch=main)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/semgrep.yml)
+[![Windows Defender](https://img.shields.io/github/check-runs/Halfblood-Prince/trustcheck/main?nameFilter=Windows%20Defender&label=Windows%20Defender&logo=windows11)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/binary-security.yml)
+[![ClamAV](https://img.shields.io/github/check-runs/Halfblood-Prince/trustcheck/main?nameFilter=ClamAV&label=ClamAV&logo=linux)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/binary-security.yml)
 [![Ruff](https://img.shields.io/github/actions/workflow/status/Halfblood-Prince/trustcheck/ci.yml?branch=main&label=ruff)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/ci.yml)
 [![mypy](https://img.shields.io/github/actions/workflow/status/Halfblood-Prince/trustcheck/ci.yml?branch=main&label=mypy)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/ci.yml)
 [![Coverage](docs/assets/images/coverage.svg)](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/ci.yml)
@@ -140,6 +142,12 @@ For a selected package version, `trustcheck` can:
 - optionally inspect wheel and sdist contents without importing or executing package code
 - emit concise text output or structured JSON for automation
 
+Every push also builds standalone Windows and Linux executables. The Windows
+artifact is scanned with Microsoft Defender's `MpCmdRun.exe`; the Linux
+artifact is scanned with ClamAV. Clean binaries, checksums, and scanner reports
+are retained as workflow artifacts by
+[Binary Security](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/binary-security.yml).
+
 ## Installation
 
 Install from PyPI:

{trustcheck-2.0.2 → trustcheck-2.0.3}/src/trustcheck.egg-info/SOURCES.txt

@@ -13,6 +13,7 @@ pyproject.toml
 .github/ISSUE_TEMPLATE/general.yml
 .github/workflows/action-integration.yml
 .github/workflows/bandit.yml
+.github/workflows/binary-security.yml
 .github/workflows/ci.yml
 .github/workflows/codeql.yml
 .github/workflows/docs.yml
@@ -39,6 +40,8 @@ docs/reference/json-contract.md
 docs/reference/python-api.md
 docs/reference/recommendations.md
 docs/reference/trust-model.md
+scripts/build_standalone.py
+scripts/trustcheck_binary.py
 scripts/update_coverage_badge.py
 snap/README.md
 snap/snapcraft.yaml
@@ -66,6 +69,7 @@ src/trustcheck.egg-info/requires.txt
 src/trustcheck.egg-info/top_level.txt
 tests/test_advisories.py
 tests/test_artifacts.py
+tests/test_binary_security_workflow.py
 tests/test_cli.py
 tests/test_contract.py
 tests/test_edge_cases.py
@@ -74,6 +78,7 @@ tests/test_integration_live.py
 tests/test_lockfiles.py
 tests/test_public_api.py
 tests/test_pypi.py
+tests/test_release_executable.py
 tests/test_release_readiness.py
 tests/test_service.py
 tests/test_snap_packaging.py

trustcheck-2.0.3/tests/test_binary_security_workflow.py

@@ -0,0 +1,83 @@
+from __future__ import annotations
+
+import unittest
+from pathlib import Path
+
+ROOT = Path(__file__).parents[1]
+
+
+class BinarySecurityWorkflowTests(unittest.TestCase):
+    def test_workflow_builds_and_scans_both_platform_binaries_on_push(self) -> None:
+        workflow = (
+            ROOT / ".github" / "workflows" / "binary-security.yml"
+        ).read_text(encoding="utf-8")
+
+        self.assertRegex(workflow, r"(?m)^  push:$")
+        self.assertIn("name: Windows Defender", workflow)
+        self.assertIn("runs-on: windows-latest", workflow)
+        self.assertIn("name: ClamAV", workflow)
+        self.assertIn("runs-on: ubuntu-latest", workflow)
+        self.assertEqual(workflow.count("python scripts/build_standalone.py"), 2)
+        self.assertIn("dist\\standalone\\trustcheck.exe", workflow)
+        self.assertIn("dist/standalone/trustcheck", workflow)
+
+    def test_windows_job_uses_defender_cli_for_exact_executable(self) -> None:
+        workflow = (
+            ROOT / ".github" / "workflows" / "binary-security.yml"
+        ).read_text(encoding="utf-8")
+
+        self.assertIn("MpCmdRun.exe", workflow)
+        self.assertIn("Start-Service -Name wuauserv", workflow)
+        self.assertIn("Get-MpComputerStatus", workflow)
+        self.assertIn("$status.AntivirusEnabled", workflow)
+        self.assertIn("-SignatureUpdate", workflow)
+        self.assertIn("-ScanType 3", workflow)
+        self.assertIn("-File $binary", workflow)
+        self.assertIn("-DisableRemediation", workflow)
+        self.assertIn("defender-scan.txt", workflow)
+        self.assertIn("Upload clean Windows executable", workflow)
+
+    def test_linux_job_updates_signatures_and_scans_exact_executable(self) -> None:
+        workflow = (
+            ROOT / ".github" / "workflows" / "binary-security.yml"
+        ).read_text(encoding="utf-8")
+
+        self.assertIn("sudo apt-get install --yes clamav", workflow)
+        self.assertIn("sudo freshclam --verbose", workflow)
+        self.assertIn("clamscan \\", workflow)
+        self.assertIn("dist/standalone/trustcheck", workflow)
+        self.assertIn("--official-db-only=yes", workflow)
+        self.assertIn("clamav-scan.txt", workflow)
+        self.assertIn("Upload clean Linux executable", workflow)
+
+    def test_standalone_builder_includes_verification_resources(self) -> None:
+        builder = (ROOT / "scripts" / "build_standalone.py").read_text(
+            encoding="utf-8"
+        )
+        entrypoint = (ROOT / "scripts" / "trustcheck_binary.py").read_text(
+            encoding="utf-8"
+        )
+
+        self.assertIn('"--onefile"', builder)
+        self.assertIn('"--noupx"', builder)
+        self.assertIn('"--recursive-copy-metadata=trustcheck"', builder)
+        for package in (
+            "pypi_attestations",
+            "rekor_types",
+            "sigstore",
+            "sigstore_models",
+            "tuf",
+        ):
+            self.assertIn(f'"{package}"', builder)
+        self.assertIn("from trustcheck.cli import main", entrypoint)
+
+    def test_readme_has_independent_check_run_badges(self) -> None:
+        readme = (ROOT / "README.md").read_text(encoding="utf-8")
+
+        self.assertIn("nameFilter=Windows%20Defender", readme)
+        self.assertIn("nameFilter=ClamAV", readme)
+        self.assertEqual(readme.count("actions/workflows/binary-security.yml"), 3)
+
+
+if __name__ == "__main__":
+    unittest.main()

trustcheck-2.0.3/tests/test_release_executable.py

@@ -0,0 +1,74 @@
+from __future__ import annotations
+
+import re
+import unittest
+from pathlib import Path
+
+ROOT = Path(__file__).parents[1]
+
+
+def _job_block(workflow: str, job_name: str) -> str:
+    marker = f"  {job_name}:\n"
+    start = workflow.index(marker)
+    tail_start = start + len(marker)
+    next_job = re.search(r"(?m)^  [A-Za-z0-9_-]+:\s*$", workflow[tail_start:])
+    if next_job is None:
+        return workflow[start:]
+    return workflow[start : tail_start + next_job.start()]
+
+
+class ReleaseExecutableWorkflowTests(unittest.TestCase):
+    def test_windows_executable_build_runs_beside_publish_jobs(self) -> None:
+        workflow = (
+            ROOT / ".github" / "workflows" / "publish.yml"
+        ).read_text(encoding="utf-8")
+        build = _job_block(workflow, "build-windows-executable")
+
+        self.assertIn("- coverage-build", build)
+        self.assertIn("- snap-qa", build)
+        self.assertNotIn("- publish-pypi", build)
+        self.assertNotIn("- publish-github-action", build)
+        self.assertNotIn("- publish-snap", build)
+        self.assertIn("runs-on: windows-latest", build)
+
+    def test_release_build_creates_and_verifies_versioned_executable(self) -> None:
+        workflow = (
+            ROOT / ".github" / "workflows" / "publish.yml"
+        ).read_text(encoding="utf-8")
+        build = _job_block(workflow, "build-windows-executable")
+
+        self.assertIn('"pyinstaller>=6.20,<7"', build)
+        self.assertIn("python scripts/build_standalone.py", build)
+        self.assertIn("dist\\standalone\\trustcheck.exe", build)
+        self.assertIn("& $binary --version", build)
+        self.assertIn("& $binary --help", build)
+        self.assertIn("trustcheck-$releaseVersion-windows-x86_64.exe", build)
+        self.assertIn("Get-FileHash", build)
+        self.assertIn("actions/attest-build-provenance@v4", build)
+        self.assertIn("windows-executable-${{ github.sha }}", build)
+
+    def test_verified_executable_is_attached_after_release_creation(self) -> None:
+        workflow = (
+            ROOT / ".github" / "workflows" / "publish.yml"
+        ).read_text(encoding="utf-8")
+        attach = _job_block(workflow, "attach-windows-executable")
+
+        self.assertIn("- build-windows-executable", attach)
+        self.assertIn("- publish-github-action", attach)
+        self.assertIn("actions/download-artifact@v8", attach)
+        self.assertIn('gh release upload "$RELEASE_TAG"', attach)
+        self.assertIn("windows-executable/*", attach)
+        self.assertIn("--clobber", attach)
+
+    def test_release_guide_documents_executable_publication(self) -> None:
+        guide = (
+            ROOT / "docs" / "guides" / "release-publishing.md"
+        ).read_text(encoding="utf-8")
+
+        self.assertIn("Windows\nexecutable build start in parallel", guide)
+        self.assertIn("PyInstaller build", guide)
+        self.assertIn("versioned Windows executable", guide)
+
+
+if __name__ == "__main__":
+    unittest.main()

{trustcheck-2.0.2 → trustcheck-2.0.3}/tests/test_snap_packaging.py

@@ -36,6 +36,9 @@ class SnapPackagingTests(unittest.TestCase):
         self.assertIn("confinement: strict", snapcraft)
         self.assertIn("license: Proprietary", snapcraft)
         self.assertIn("command: bin/trustcheck", snapcraft)
+        self.assertIn("XDG_CACHE_HOME: $SNAP_USER_COMMON/cache", snapcraft)
+        self.assertIn("XDG_CONFIG_HOME: $SNAP_USER_COMMON/config", snapcraft)
+        self.assertIn("XDG_DATA_HOME: $SNAP_USER_COMMON/data", snapcraft)
         self.assertIn("plugin: python", snapcraft)
         self.assertIn("source: .", snapcraft)
         self.assertIn("- home", snapcraft)
@@ -108,6 +111,8 @@ class SnapPackagingTests(unittest.TestCase):
             "snap run trustcheck --version",
             'export PATH="/snap/bin:$PATH"',
             "trustcheck --help",
+            "trustcheck inspect sampleproject",
+            "unexpected_verification_error",
             "actions/attest-build-provenance@v4",
             "Upload verified snap",
         )
@@ -118,6 +123,8 @@ class SnapPackagingTests(unittest.TestCase):
         self.assertIn("snapcraft status trustcheck", qa)
         self.assertIn("secrets.SNAPCRAFT_STORE_CREDENTIALS", qa)
         self.assertIn('test "$(command -v trustcheck)" = "/snap/bin/trustcheck"', qa)
+        self.assertIn("--version 4.0.0", qa)
+        self.assertIn('report["coverage"]["verified_files"] > 0', qa)
         self.assertIn("snap-${{ github.sha }}", qa)
         self.assertIn("${{ steps.snapcraft.outputs.snap }}.sha256", qa)