trustcheck 2.2.0__tar.gz → 2.2.1__tar.gz

{trustcheck-2.2.0 → trustcheck-2.2.1}/.github/workflows/ci.yml

@@ -379,13 +379,20 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           publish_root="$(mktemp -d)"
-          cp coverage-artifacts/coverage-badge/coverage.svg "$publish_root/coverage.svg"
           git -C "$publish_root" init
           git -C "$publish_root" config user.name "github-actions[bot]"
           git -C "$publish_root" config user.email "41898282+github-actions[bot]@users.noreply.github.com"
-          git -C "$publish_root" add coverage.svg
-          git -C "$publish_root" commit -m "Update coverage badge for ${GITHUB_SHA}"
-          git -C "$publish_root" branch -M coverage-badge
           git -C "$publish_root" remote add origin \
             "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+          git -C "$publish_root" fetch --depth=1 origin coverage-badge
+          if ! git -C "$publish_root" show FETCH_HEAD:PyPI.png > "$publish_root/PyPI.png"; then
+            printf '%s\n' \
+              "PyPI.png is missing from coverage-badge; refusing to replace the asset branch" \
+              "without it." >&2
+            exit 1
+          fi
+          cp coverage-artifacts/coverage-badge/coverage.svg "$publish_root/coverage.svg"
+          git -C "$publish_root" add PyPI.png coverage.svg
+          git -C "$publish_root" commit -m "Update coverage badge for ${GITHUB_SHA}"
+          git -C "$publish_root" branch -M coverage-badge
           git -C "$publish_root" push --force origin coverage-badge

{trustcheck-2.2.0 → trustcheck-2.2.1}/.github/workflows/publish.yml

@@ -837,6 +837,84 @@ jobs:
           packages-dir: dist/packages
           verbose: true
 
+  publish-homebrew-tap:
+    needs: publish-pypi
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out tagged commit
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+        with:
+          python-version: "3.12"
+
+      - name: Download build artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        with:
+          name: dist-${{ github.sha }}
+          path: dist
+
+      - name: Export Homebrew tap pins
+        run: |
+          python scripts/export_homebrew_tap.py \
+            --runtime-lock requirements/runtime.lock \
+            --build-lock requirements/action.lock \
+            --checksums dist/SHA256SUMS.txt \
+            --output-dir homebrew-tap-export/trustcheck \
+            --tag "$GITHUB_REF_NAME" \
+            --source-repository "$GITHUB_REPOSITORY" \
+            --source-commit "$GITHUB_SHA" \
+            --extra-package setuptools-scm \
+            --extra-package wheel
+
+      - name: Require Homebrew tap token
+        env:
+          HOMEBREW_TAP_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN || secrets.RELEASE_TOKEN }}
+        run: |
+          if [ -z "$HOMEBREW_TAP_TOKEN" ]; then
+            echo "Set HOMEBREW_TAP_TOKEN or RELEASE_TOKEN with contents:write access to Halfblood-Prince/homebrew-tap." >&2
+            exit 1
+          fi
+
+      - name: Check out Homebrew tap
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          repository: Halfblood-Prince/homebrew-tap
+          ref: main
+          token: ${{ secrets.HOMEBREW_TAP_TOKEN || secrets.RELEASE_TOKEN }}
+          path: homebrew-tap
+          persist-credentials: true
+
+      - name: Commit Homebrew tap pins
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          mkdir -p homebrew-tap/trustcheck
+          cp homebrew-tap-export/trustcheck/runtime.lock homebrew-tap/trustcheck/runtime.lock
+          cp homebrew-tap-export/trustcheck/resources.rb homebrew-tap/trustcheck/resources.rb
+          cp homebrew-tap-export/trustcheck/release.json homebrew-tap/trustcheck/release.json
+
+          git -C homebrew-tap config user.name "github-actions[bot]"
+          git -C homebrew-tap config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git -C homebrew-tap add trustcheck
+          if git -C homebrew-tap diff --cached --quiet; then
+            echo "No Homebrew tap pin changes to commit."
+            exit 0
+          fi
+          git -C homebrew-tap commit -m "Update trustcheck Homebrew pins for ${RELEASE_TAG}"
+          git -C homebrew-tap push
+          {
+            echo "## Homebrew tap"
+            echo
+            echo "- Updated \`Halfblood-Prince/homebrew-tap\` trustcheck pin export for \`${RELEASE_TAG}\`."
+            echo "- Wrote \`trustcheck/runtime.lock\`, \`trustcheck/resources.rb\`, and \`trustcheck/release.json\`."
+          } >> "$GITHUB_STEP_SUMMARY"
+
   publish-docker:
     needs:
       - coverage-build
@@ -935,9 +1013,9 @@ jobs:
           append_body: true
           body: |
             Published from immutable commit `${{ github.sha }}`.
-            The release workflow publishes PyPI, GitHub Action, Snap Store, and
-            GHCR Docker distributions after shared tag verification, QA, matrix,
-            and coverage builds.
+            The release workflow publishes PyPI, GitHub Action, Snap Store,
+            Homebrew tap pins, and GHCR Docker distributions after shared tag
+            verification, QA, matrix, and coverage builds.
 
             Release artifacts:
             - `dist/*`

{trustcheck-2.2.0 → trustcheck-2.2.1}/MANIFEST.in

@@ -1,2 +1,3 @@
 include scripts/verify_release_version.py
 include scripts/verify_release_channels.py
+include scripts/export_homebrew_tap.py

{trustcheck-2.2.0/src/trustcheck.egg-info → trustcheck-2.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: trustcheck
-Version: 2.2.0
+Version: 2.2.1
 Summary: Package trust and provenance verification for PyPI consumers.
 License-Expression: LicenseRef-Trustcheck-Personal-Use
 Project-URL: Repository, https://github.com/Halfblood-Prince/trustcheck
@@ -63,6 +63,7 @@ Dynamic: license-file
 [![TrustCheck Package Scanner](https://img.shields.io/badge/GitHub%20Action-TrustCheck%20Package%20Scanner-blue?logo=githubactions&logoColor=white)](https://github.com/marketplace/actions/trustcheck-package-scanner)
 
 [![Get it from the Snap Store](https://snapcraft.io/en/dark/install.svg)](https://snapcraft.io/trustcheck)
+<a href="https://pypi.org/project/trustcheck/"><img src="https://raw.githubusercontent.com/Halfblood-Prince/trustcheck/coverage-badge/PyPI.png" alt="Get it from PyPI" height="55"></a>
 
 `trustcheck` is a Python package and CLI for evaluating the trust posture of PyPI releases before they are installed, promoted, or approved.
 
@@ -81,6 +82,20 @@ Packages that publish no provenance are treated as needing review rather than as
 | `manifest` | lock approved trust evidence |
 | `impact` | prioritize by observed usage |
 
+<!-- trustcheck-benchmark:start -->
+## Latest benchmark
+
+Generated `2026-07-04T12:38:12.871592+00:00` on Python `3.14.6` with `pip-audit 2.10.1`. Corpus `2026.06` contains 133 entries; this fixed-input `--no-deps` comparison covers 112 comparable package entries.
+
+| Tool | Cold p50 | Warm p50 | Warm p95 | Peak RSS | Requests p50 | Recall |
+| --- | ---: | ---: | ---: | ---: | ---: | ---: |
+| trustcheck scan --fast | 16.00 s | 14.20 s | 14.44 s | 78.0 MiB | unknown | 1 |
+| pip-audit | 36.69 s | 38.51 s | 39.82 s | 75.6 MiB | unknown | 1 |
+
+Alias-aware agreement: `1.0` across `105` compared packages and `263` matched advisories.
+Resolver exact match: `True` (trustcheck `22`, pip-audit `22`).
+<!-- trustcheck-benchmark:end -->
+
 ## What it checks
 
 For a selected package version, `trustcheck` can:
@@ -141,20 +156,6 @@ artifact is scanned with ClamAV. Clean binaries, checksums, and scanner reports
 are retained as workflow artifacts by
 [Binary Security](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/binary-security.yml).
 
-<!-- trustcheck-benchmark:start -->
-## Latest benchmark
-
-Generated `2026-07-04T12:38:12.871592+00:00` on Python `3.14.6` with `pip-audit 2.10.1`. Corpus `2026.06` contains 133 entries; this fixed-input `--no-deps` comparison covers 112 comparable package entries.
-
-| Tool | Cold p50 | Warm p50 | Warm p95 | Peak RSS | Requests p50 | Recall |
-| --- | ---: | ---: | ---: | ---: | ---: | ---: |
-| trustcheck scan --fast | 16.00 s | 14.20 s | 14.44 s | 78.0 MiB | unknown | 1 |
-| pip-audit | 36.69 s | 38.51 s | 39.82 s | 75.6 MiB | unknown | 1 |
-
-Alias-aware agreement: `1.0` across `105` compared packages and `263` matched advisories.
-Resolver exact match: `True` (trustcheck `22`, pip-audit `22`).
-<!-- trustcheck-benchmark:end -->
-
 ## Installation
 
 Install from PyPI:

{trustcheck-2.2.0 → trustcheck-2.2.1}/README.md

@@ -22,6 +22,7 @@
 [![TrustCheck Package Scanner](https://img.shields.io/badge/GitHub%20Action-TrustCheck%20Package%20Scanner-blue?logo=githubactions&logoColor=white)](https://github.com/marketplace/actions/trustcheck-package-scanner)
 
 [![Get it from the Snap Store](https://snapcraft.io/en/dark/install.svg)](https://snapcraft.io/trustcheck)
+<a href="https://pypi.org/project/trustcheck/"><img src="https://raw.githubusercontent.com/Halfblood-Prince/trustcheck/coverage-badge/PyPI.png" alt="Get it from PyPI" height="55"></a>
 
 `trustcheck` is a Python package and CLI for evaluating the trust posture of PyPI releases before they are installed, promoted, or approved.
 
@@ -40,6 +41,20 @@ Packages that publish no provenance are treated as needing review rather than as
 | `manifest` | lock approved trust evidence |
 | `impact` | prioritize by observed usage |
 
+<!-- trustcheck-benchmark:start -->
+## Latest benchmark
+
+Generated `2026-07-04T12:38:12.871592+00:00` on Python `3.14.6` with `pip-audit 2.10.1`. Corpus `2026.06` contains 133 entries; this fixed-input `--no-deps` comparison covers 112 comparable package entries.
+
+| Tool | Cold p50 | Warm p50 | Warm p95 | Peak RSS | Requests p50 | Recall |
+| --- | ---: | ---: | ---: | ---: | ---: | ---: |
+| trustcheck scan --fast | 16.00 s | 14.20 s | 14.44 s | 78.0 MiB | unknown | 1 |
+| pip-audit | 36.69 s | 38.51 s | 39.82 s | 75.6 MiB | unknown | 1 |
+
+Alias-aware agreement: `1.0` across `105` compared packages and `263` matched advisories.
+Resolver exact match: `True` (trustcheck `22`, pip-audit `22`).
+<!-- trustcheck-benchmark:end -->
+
 ## What it checks
 
 For a selected package version, `trustcheck` can:
@@ -100,20 +115,6 @@ artifact is scanned with ClamAV. Clean binaries, checksums, and scanner reports
 are retained as workflow artifacts by
 [Binary Security](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/binary-security.yml).
 
-<!-- trustcheck-benchmark:start -->
-## Latest benchmark
-
-Generated `2026-07-04T12:38:12.871592+00:00` on Python `3.14.6` with `pip-audit 2.10.1`. Corpus `2026.06` contains 133 entries; this fixed-input `--no-deps` comparison covers 112 comparable package entries.
-
-| Tool | Cold p50 | Warm p50 | Warm p95 | Peak RSS | Requests p50 | Recall |
-| --- | ---: | ---: | ---: | ---: | ---: | ---: |
-| trustcheck scan --fast | 16.00 s | 14.20 s | 14.44 s | 78.0 MiB | unknown | 1 |
-| pip-audit | 36.69 s | 38.51 s | 39.82 s | 75.6 MiB | unknown | 1 |
-
-Alias-aware agreement: `1.0` across `105` compared packages and `263` matched advisories.
-Resolver exact match: `True` (trustcheck `22`, pip-audit `22`).
-<!-- trustcheck-benchmark:end -->
-
 ## Installation
 
 Install from PyPI:

trustcheck-2.2.1/scripts/export_homebrew_tap.py

@@ -0,0 +1,307 @@
+from __future__ import annotations
+
+import argparse
+import json
+import re
+import shutil
+import time
+from collections.abc import Callable, Mapping, Sequence
+from dataclasses import asdict, dataclass
+from pathlib import Path
+from urllib.parse import quote
+
+import urllib3
+
+PACKAGE_LINE = re.compile(
+    r"^(?P<name>[A-Za-z0-9_.-]+)==(?P<version>[^\\\s;]+)(?:\s*;[^\\]+)?(?:\s*\\)?$"
+)
+HASH_LINE = re.compile(r"--hash=sha256:(?P<hash>[0-9a-f]{64})")
+
+
+FetchJson = Callable[[str, str], Mapping[str, object]]
+
+
+@dataclass(frozen=True, slots=True)
+class LockedPackage:
+    name: str
+    version: str
+    hashes: frozenset[str]
+
+
+@dataclass(frozen=True, slots=True)
+class Distribution:
+    filename: str
+    url: str
+    sha256: str
+
+
+@dataclass(frozen=True, slots=True)
+class ResourcePin:
+    name: str
+    version: str
+    filename: str
+    url: str
+    sha256: str
+
+
+def canonical_name(name: str) -> str:
+    return re.sub(r"[-_.]+", "-", name).lower()
+
+
+def parse_lockfile(path: Path) -> dict[str, LockedPackage]:
+    packages: dict[str, LockedPackage] = {}
+    current_name: str | None = None
+    current_version: str | None = None
+    current_hashes: set[str] = set()
+
+    def flush_current() -> None:
+        nonlocal current_name, current_version, current_hashes
+        if current_name is None or current_version is None:
+            return
+        if not current_hashes:
+            raise ValueError(f"{path}: {current_name}=={current_version} has no hashes")
+        packages[canonical_name(current_name)] = LockedPackage(
+            name=current_name,
+            version=current_version,
+            hashes=frozenset(current_hashes),
+        )
+        current_name = None
+        current_version = None
+        current_hashes = set()
+
+    for raw_line in path.read_text(encoding="utf-8").splitlines():
+        line = raw_line.strip()
+        package_match = PACKAGE_LINE.match(line)
+        if package_match is not None:
+            flush_current()
+            current_name = package_match.group("name")
+            current_version = package_match.group("version")
+            continue
+        if current_name is None:
+            continue
+        for hash_match in HASH_LINE.finditer(line):
+            current_hashes.add(hash_match.group("hash"))
+    flush_current()
+    if not packages:
+        raise ValueError(f"{path}: no pinned packages found")
+    return packages
+
+
+def parse_checksums(path: Path) -> dict[str, str]:
+    checksums: dict[str, str] = {}
+    for line in path.read_text(encoding="utf-8").splitlines():
+        stripped = line.strip()
+        if not stripped:
+            continue
+        digest, filename = stripped.split(maxsplit=1)
+        checksums[Path(filename).name] = digest.lower()
+    if not checksums:
+        raise ValueError(f"{path}: no checksums found")
+    return checksums
+
+
+def read_pypi_json(project: str, version: str) -> Mapping[str, object]:
+    encoded_project = quote(project, safe="")
+    encoded_version = quote(version, safe="")
+    url = f"https://pypi.org/pypi/{encoded_project}/{encoded_version}/json"
+    pool = urllib3.PoolManager()
+    last_error: Exception | None = None
+    for attempt in range(1, 7):
+        try:
+            response = pool.request(
+                "GET",
+                url,
+                headers={
+                    "Accept": "application/json",
+                    "User-Agent": "trustcheck-homebrew-tap-exporter",
+                },
+                retries=False,
+                timeout=urllib3.Timeout(total=30),
+            )
+            if response.status >= 400:
+                raise ValueError(
+                    f"{project}=={version}: PyPI returned HTTP {response.status}"
+                )
+            payload = json.loads(response.data)
+            if not isinstance(payload, dict):
+                raise ValueError(f"{project}=={version}: PyPI returned non-object JSON")
+            return payload
+        except (urllib3.exceptions.HTTPError, ValueError) as exc:
+            last_error = exc
+            if attempt < 6:
+                time.sleep(10)
+    raise ValueError(f"Unable to read PyPI metadata for {project}=={version}") from last_error
+
+
+def fetch_sdist(
+    project: str,
+    version: str,
+    fetch_json: FetchJson = read_pypi_json,
+) -> Distribution:
+    payload = fetch_json(project, version)
+    urls = payload.get("urls")
+    if not isinstance(urls, list):
+        raise ValueError(f"{project}=={version}: PyPI metadata has no urls array")
+
+    candidates: list[Distribution] = []
+    for item in urls:
+        if not isinstance(item, Mapping) or item.get("packagetype") != "sdist":
+            continue
+        digests = item.get("digests")
+        filename = item.get("filename")
+        url = item.get("url")
+        if not isinstance(digests, Mapping):
+            continue
+        sha256 = digests.get("sha256")
+        if (
+            isinstance(filename, str)
+            and isinstance(url, str)
+            and isinstance(sha256, str)
+            and re.fullmatch(r"[0-9a-f]{64}", sha256)
+        ):
+            candidates.append(Distribution(filename=filename, url=url, sha256=sha256))
+    if not candidates:
+        raise ValueError(f"{project}=={version}: no PyPI sdist found")
+    return sorted(
+        candidates,
+        key=lambda item: (not item.filename.endswith(".tar.gz"), item.filename),
+    )[0]
+
+
+def render_homebrew_resources(resources: Sequence[ResourcePin]) -> str:
+    lines = [
+        "# This file is generated by scripts/export_homebrew_tap.py.",
+        "# Do not edit manually.",
+        "",
+    ]
+    for resource in resources:
+        lines.extend(
+            [
+                f'resource "{resource.name}" do',
+                f'  url "{resource.url}"',
+                f'  sha256 "{resource.sha256}"',
+                "end",
+                "",
+            ]
+        )
+    return "\n".join(lines)
+
+
+def export_homebrew_tap(
+    *,
+    runtime_lock: Path,
+    build_lock: Path | None,
+    checksums: Path,
+    output_dir: Path,
+    tag: str,
+    source_repository: str,
+    source_commit: str,
+    package_name: str = "trustcheck",
+    extra_packages: Sequence[str] = (),
+    fetch_json: FetchJson = read_pypi_json,
+) -> None:
+    version = tag.removeprefix("v")
+    runtime_packages = parse_lockfile(runtime_lock)
+    build_packages = parse_lockfile(build_lock) if build_lock is not None else {}
+    selected_packages = dict(runtime_packages)
+
+    for package in extra_packages:
+        key = canonical_name(package)
+        if key in selected_packages:
+            continue
+        try:
+            selected_packages[key] = build_packages[key]
+        except KeyError as exc:
+            raise ValueError(
+                f"extra package {package!r} is not pinned in {build_lock}"
+            ) from exc
+
+    release_sdist = fetch_sdist(package_name, version, fetch_json)
+    release_checksums = parse_checksums(checksums)
+    expected_release_hash = release_checksums.get(release_sdist.filename)
+    if expected_release_hash != release_sdist.sha256:
+        raise ValueError(
+            f"{release_sdist.filename} PyPI sha256 does not match {checksums}: "
+            f"{release_sdist.sha256} != {expected_release_hash}"
+        )
+
+    resources: list[ResourcePin] = []
+    for package in sorted(
+        selected_packages.values(),
+        key=lambda item: canonical_name(item.name),
+    ):
+        sdist = fetch_sdist(package.name, package.version, fetch_json)
+        if sdist.sha256 not in package.hashes:
+            raise ValueError(
+                f"{package.name}=={package.version} sdist hash is not pinned in lockfile: "
+                f"{sdist.sha256}"
+            )
+        resources.append(
+            ResourcePin(
+                name=canonical_name(package.name),
+                version=package.version,
+                filename=sdist.filename,
+                url=sdist.url,
+                sha256=sdist.sha256,
+            )
+        )
+
+    output_dir.mkdir(parents=True, exist_ok=True)
+    shutil.copyfile(runtime_lock, output_dir / "runtime.lock")
+    (output_dir / "resources.rb").write_text(
+        render_homebrew_resources(resources),
+        encoding="utf-8",
+    )
+    (output_dir / "release.json").write_text(
+        json.dumps(
+            {
+                "generated_by": "scripts/export_homebrew_tap.py",
+                "package": {
+                    "name": package_name,
+                    "version": version,
+                    "tag": tag,
+                    "source_repository": source_repository,
+                    "source_commit": source_commit,
+                    "sdist": asdict(release_sdist),
+                },
+                "resources": [asdict(resource) for resource in resources],
+            },
+            indent=2,
+            sort_keys=True,
+        )
+        + "\n",
+        encoding="utf-8",
+    )
+
+
+def main(argv: Sequence[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(
+        description="Export trustcheck release pins for the Homebrew tap."
+    )
+    parser.add_argument("--runtime-lock", type=Path, required=True)
+    parser.add_argument("--build-lock", type=Path)
+    parser.add_argument("--checksums", type=Path, required=True)
+    parser.add_argument("--output-dir", type=Path, required=True)
+    parser.add_argument("--tag", required=True)
+    parser.add_argument("--source-repository", required=True)
+    parser.add_argument("--source-commit", required=True)
+    parser.add_argument("--package-name", default="trustcheck")
+    parser.add_argument("--extra-package", action="append", default=[])
+    args = parser.parse_args(argv)
+
+    export_homebrew_tap(
+        runtime_lock=args.runtime_lock,
+        build_lock=args.build_lock,
+        checksums=args.checksums,
+        output_dir=args.output_dir,
+        tag=args.tag,
+        source_repository=args.source_repository,
+        source_commit=args.source_commit,
+        package_name=args.package_name,
+        extra_packages=args.extra_package,
+    )
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

{trustcheck-2.2.0 → trustcheck-2.2.1}/src/trustcheck/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = 'v2.2.0'
-__version_tuple__ = version_tuple = (2, 2, 0)
+__version__ = version = 'v2.2.1'
+__version_tuple__ = version_tuple = (2, 2, 1)
 
 __commit_id__ = commit_id = None

{trustcheck-2.2.0 → trustcheck-2.2.1/src/trustcheck.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: trustcheck
-Version: 2.2.0
+Version: 2.2.1
 Summary: Package trust and provenance verification for PyPI consumers.
 License-Expression: LicenseRef-Trustcheck-Personal-Use
 Project-URL: Repository, https://github.com/Halfblood-Prince/trustcheck
@@ -63,6 +63,7 @@ Dynamic: license-file
 [![TrustCheck Package Scanner](https://img.shields.io/badge/GitHub%20Action-TrustCheck%20Package%20Scanner-blue?logo=githubactions&logoColor=white)](https://github.com/marketplace/actions/trustcheck-package-scanner)
 
 [![Get it from the Snap Store](https://snapcraft.io/en/dark/install.svg)](https://snapcraft.io/trustcheck)
+<a href="https://pypi.org/project/trustcheck/"><img src="https://raw.githubusercontent.com/Halfblood-Prince/trustcheck/coverage-badge/PyPI.png" alt="Get it from PyPI" height="55"></a>
 
 `trustcheck` is a Python package and CLI for evaluating the trust posture of PyPI releases before they are installed, promoted, or approved.
 
@@ -81,6 +82,20 @@ Packages that publish no provenance are treated as needing review rather than as
 | `manifest` | lock approved trust evidence |
 | `impact` | prioritize by observed usage |
 
+<!-- trustcheck-benchmark:start -->
+## Latest benchmark
+
+Generated `2026-07-04T12:38:12.871592+00:00` on Python `3.14.6` with `pip-audit 2.10.1`. Corpus `2026.06` contains 133 entries; this fixed-input `--no-deps` comparison covers 112 comparable package entries.
+
+| Tool | Cold p50 | Warm p50 | Warm p95 | Peak RSS | Requests p50 | Recall |
+| --- | ---: | ---: | ---: | ---: | ---: | ---: |
+| trustcheck scan --fast | 16.00 s | 14.20 s | 14.44 s | 78.0 MiB | unknown | 1 |
+| pip-audit | 36.69 s | 38.51 s | 39.82 s | 75.6 MiB | unknown | 1 |
+
+Alias-aware agreement: `1.0` across `105` compared packages and `263` matched advisories.
+Resolver exact match: `True` (trustcheck `22`, pip-audit `22`).
+<!-- trustcheck-benchmark:end -->
+
 ## What it checks
 
 For a selected package version, `trustcheck` can:
@@ -141,20 +156,6 @@ artifact is scanned with ClamAV. Clean binaries, checksums, and scanner reports
 are retained as workflow artifacts by
 [Binary Security](https://github.com/Halfblood-Prince/trustcheck/actions/workflows/binary-security.yml).
 
-<!-- trustcheck-benchmark:start -->
-## Latest benchmark
-
-Generated `2026-07-04T12:38:12.871592+00:00` on Python `3.14.6` with `pip-audit 2.10.1`. Corpus `2026.06` contains 133 entries; this fixed-input `--no-deps` comparison covers 112 comparable package entries.
-
-| Tool | Cold p50 | Warm p50 | Warm p95 | Peak RSS | Requests p50 | Recall |
-| --- | ---: | ---: | ---: | ---: | ---: | ---: |
-| trustcheck scan --fast | 16.00 s | 14.20 s | 14.44 s | 78.0 MiB | unknown | 1 |
-| pip-audit | 36.69 s | 38.51 s | 39.82 s | 75.6 MiB | unknown | 1 |
-
-Alias-aware agreement: `1.0` across `105` compared packages and `263` matched advisories.
-Resolver exact match: `True` (trustcheck `22`, pip-audit `22`).
-<!-- trustcheck-benchmark:end -->
-
 ## Installation
 
 Install from PyPI:

{trustcheck-2.2.0 → trustcheck-2.2.1}/src/trustcheck.egg-info/SOURCES.txt

@@ -101,6 +101,7 @@ scripts/build_msix_layout.py
 scripts/build_standalone.py
 scripts/check_mutation_score.py
 scripts/dependency_bounds.py
+scripts/export_homebrew_tap.py
 scripts/github_plagiarism_scan.py
 scripts/smoke_test_distribution.py
 scripts/trustcheck_binary.py
@@ -188,6 +189,7 @@ tests/test_dynamic.py
 tests/test_edge_cases.py
 tests/test_exports.py
 tests/test_github_action.py
+tests/test_homebrew_tap_export.py
 tests/test_impact.py
 tests/test_indexes.py
 tests/test_install_command.py

{trustcheck-2.2.0 → trustcheck-2.2.1}/tests/test_ci_workflow.py

@@ -137,6 +137,11 @@ class CoverageBadgeWorkflowTests(unittest.TestCase):
         self.assertIn("github.event_name == 'push'", workflow)
         self.assertIn("group: coverage-badge", workflow)
         self.assertIn("cancel-in-progress: true", workflow)
+        self.assertIn("git -C \"$publish_root\" fetch --depth=1 origin coverage-badge", workflow)
+        self.assertIn("show FETCH_HEAD:PyPI.png", workflow)
+        self.assertIn("refusing to replace the asset branch", workflow)
+        self.assertIn("\"without it.\"", workflow)
+        self.assertIn("git -C \"$publish_root\" add PyPI.png coverage.svg", workflow)
         self.assertIn("git -C \"$publish_root\" push --force origin coverage-badge", workflow)
         self.assertNotIn("git diff --exit-code -- docs/assets/images/coverage.svg", workflow)