versionsec 0.7.1__tar.gz

versionsec-0.7.1/LICENSE

@@ -0,0 +1,184 @@
+Apache License
+Version 2.0, January 2004
+http://www.apache.org/licenses/
+
+Copyright 2026 Gexiro Global Enterprises Ltd.
+
+TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+1. Definitions.
+
+"License" shall mean the terms and conditions for use, reproduction, and
+distribution as defined by Sections 1 through 9 of this document.
+
+"Licensor" shall mean the copyright owner or entity authorized by the copyright
+owner that is granting the License.
+
+"Legal Entity" shall mean the union of the acting entity and all other entities
+that control, are controlled by, or are under common control with that entity.
+For the purposes of this definition, "control" means (i) the power, direct or
+indirect, to cause the direction or management of such entity, whether by
+contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the
+outstanding shares, or (iii) beneficial ownership of such entity.
+
+"You" (or "Your") shall mean an individual or Legal Entity exercising
+permissions granted by this License.
+
+"Source" form shall mean the preferred form for making modifications, including
+but not limited to software source code, documentation source, and configuration
+files.
+
+"Object" form shall mean any form resulting from mechanical transformation or
+translation of a Source form, including but not limited to compiled object code,
+generated documentation, and conversions to other media types.
+
+"Work" shall mean the work of authorship, whether in Source or Object form,
+made available under the License, as indicated by a copyright notice that is
+included in or attached to the work.
+
+"Derivative Works" shall mean any work, whether in Source or Object form, that
+is based on (or derived from) the Work and for which the editorial revisions,
+annotations, elaborations, or other modifications represent, as a whole, an
+original work of authorship. For the purposes of this License, Derivative Works
+shall not include works that remain separable from, or merely link (or bind by
+name) to the interfaces of, the Work and Derivative Works thereof.
+
+"Contribution" shall mean any work of authorship, including the original version
+of the Work and any modifications or additions to that Work or Derivative Works
+thereof, that is intentionally submitted to Licensor for inclusion in the Work
+by the copyright owner or by an individual or Legal Entity authorized to submit
+on behalf of the copyright owner. For the purposes of this definition,
+"submitted" means any form of electronic, verbal, or written communication sent
+to the Licensor or its representatives, including but not limited to
+communication on electronic mailing lists, source code control systems, and
+issue tracking systems that are managed by, or on behalf of, the Licensor for
+the purpose of discussing and improving the Work, but excluding communication
+that is conspicuously marked or otherwise designated in writing by the copyright
+owner as "Not a Contribution."
+
+"Contributor" shall mean Licensor and any individual or Legal Entity on behalf
+of whom a Contribution has been received by Licensor and subsequently
+incorporated within the Work.
+
+2. Grant of Copyright License. Subject to the terms and conditions of this
+License, each Contributor hereby grants to You a perpetual, worldwide,
+non-exclusive, no-charge, royalty-free, irrevocable copyright license to
+reproduce, prepare Derivative Works of, publicly display, publicly perform,
+sublicense, and distribute the Work and such Derivative Works in Source or
+Object form.
+
+3. Grant of Patent License. Subject to the terms and conditions of this License,
+each Contributor hereby grants to You a perpetual, worldwide, non-exclusive,
+no-charge, royalty-free, irrevocable (except as stated in this section) patent
+license to make, have made, use, offer to sell, sell, import, and otherwise
+transfer the Work, where such license applies only to those patent claims
+licensable by such Contributor that are necessarily infringed by their
+Contribution(s) alone or by combination of their Contribution(s) with the Work
+to which such Contribution(s) was submitted. If You institute patent litigation
+against any entity (including a cross-claim or counterclaim in a lawsuit)
+alleging that the Work or a Contribution incorporated within the Work
+constitutes direct or contributory patent infringement, then any patent licenses
+granted to You under this License for that Work shall terminate as of the date
+such litigation is filed.
+
+4. Redistribution. You may reproduce and distribute copies of the Work or
+Derivative Works thereof in any medium, with or without modifications, and in
+Source or Object form, provided that You meet the following conditions:
+
+(a) You must give any other recipients of the Work or Derivative Works a copy of
+this License; and
+
+(b) You must cause any modified files to carry prominent notices stating that
+You changed the files; and
+
+(c) You must retain, in the Source form of any Derivative Works that You
+distribute, all copyright, patent, trademark, and attribution notices from the
+Source form of the Work, excluding those notices that do not pertain to any part
+of the Derivative Works; and
+
+(d) If the Work includes a "NOTICE" text file as part of its distribution, then
+any Derivative Works that You distribute must include a readable copy of the
+attribution notices contained within such NOTICE file, excluding those notices
+that do not pertain to any part of the Derivative Works, in at least one of the
+following places: within a NOTICE text file distributed as part of the
+Derivative Works; within the Source form or documentation, if provided along
+with the Derivative Works; or, within a display generated by the Derivative
+Works, if and wherever such third-party notices normally appear. The contents of
+the NOTICE file are for informational purposes only and do not modify the
+License. You may add Your own attribution notices within Derivative Works that
+You distribute, alongside or as an addendum to the NOTICE text from the Work,
+provided that such additional attribution notices cannot be construed as
+modifying the License.
+
+You may add Your own copyright statement to Your modifications and may provide
+additional or different license terms and conditions for use, reproduction, or
+distribution of Your modifications, or for any such Derivative Works as a whole,
+provided Your use, reproduction, and distribution of the Work otherwise complies
+with the conditions stated in this License.
+
+5. Submission of Contributions. Unless You explicitly state otherwise, any
+Contribution intentionally submitted for inclusion in the Work by You to the
+Licensor shall be under the terms and conditions of this License, without any
+additional terms or conditions. Notwithstanding the above, nothing herein shall
+supersede or modify the terms of any separate license agreement you may have
+executed with Licensor regarding such Contributions.
+
+6. Trademarks. This License does not grant permission to use the trade names,
+trademarks, service marks, or product names of the Licensor, except as required
+for reasonable and customary use in describing the origin of the Work and
+reproducing the content of the NOTICE file.
+
+7. Disclaimer of Warranty. Unless required by applicable law or agreed to in
+writing, Licensor provides the Work (and each Contributor provides its
+Contributions) on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied, including, without limitation, any warranties or
+conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+PARTICULAR PURPOSE. You are solely responsible for determining the
+appropriateness of using or redistributing the Work and assume any risks
+associated with Your exercise of permissions under this License.
+
+8. Limitation of Liability. In no event and under no legal theory, whether in
+tort (including negligence), contract, or otherwise, unless required by
+applicable law (such as deliberate and grossly negligent acts) or agreed to in
+writing, shall any Contributor be liable to You for damages, including any
+direct, indirect, special, incidental, or consequential damages of any character
+arising as a result of this License or out of the use or inability to use the
+Work (including but not limited to damages for loss of goodwill, work stoppage,
+computer failure or malfunction, or any and all other commercial damages or
+losses), even if such Contributor has been advised of the possibility of such
+damages.
+
+9. Accepting Warranty or Additional Liability. While redistributing the Work or
+Derivative Works thereof, You may choose to offer, and charge a fee for,
+acceptance of support, warranty, indemnity, or other liability obligations
+and/or rights consistent with this License. However, in accepting such
+obligations, You may act only on Your own behalf and on Your sole
+responsibility, not on behalf of any other Contributor, and only if You agree to
+indemnify, defend, and hold each Contributor harmless for any liability incurred
+by, or claims asserted against, such Contributor by reason of your accepting any
+such warranty or additional liability.
+
+END OF TERMS AND CONDITIONS
+
+APPENDIX: How to apply the Apache License to your work.
+
+To apply the Apache License to your work, attach the following boilerplate
+notice, with the fields enclosed by brackets "[]" replaced with your own
+identifying information. Do not include the brackets. The text should be
+enclosed in the appropriate comment syntax for the file format. We also
+recommend that a file or class name and description of purpose be included on
+the same "printed page" as the copyright notice for easier identification within
+third-party archives.
+
+Copyright 2026 Gexiro Global Enterprises Ltd.
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use
+this file except in compliance with the License. You may obtain a copy of the
+License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed
+under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR
+CONDITIONS OF ANY KIND, either express or implied. See the License for the
+specific language governing permissions and limitations under the License.

versionsec-0.7.1/PKG-INFO

@@ -0,0 +1,142 @@
+Metadata-Version: 2.4
+Name: versionsec
+Version: 0.7.1
+Summary: Read-only security posture review for one authorized self-hosted Gitea or Forgejo instance, including offline configuration and runner review.
+Author: Gexiro Global Enterprises Ltd
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://versionsec.com
+Project-URL: Repository, https://github.com/gexiro-global/versionsec
+Project-URL: Documentation, https://github.com/gexiro-global/versionsec/tree/main/docs
+Project-URL: Issues, https://github.com/gexiro-global/versionsec/issues
+Project-URL: Changelog, https://github.com/gexiro-global/versionsec/blob/main/CHANGELOG.md
+Keywords: gitea,forgejo,security,posture,self-hosted,sarif,runner
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: httpx<1,>=0.27
+Requires-Dist: pydantic<3,>=2
+Requires-Dist: typer<1,>=0.12
+Provides-Extra: dev
+Requires-Dist: build==1.6.1; extra == "dev"
+Requires-Dist: pytest==9.1.1; extra == "dev"
+Requires-Dist: ruff==0.16.6; extra == "dev"
+Requires-Dist: twine==6.2.0; extra == "dev"
+Requires-Dist: pytest-cov==7.1.0; extra == "dev"
+Requires-Dist: jsonschema==4.26.0; extra == "dev"
+Requires-Dist: PyYAML==6.0.3; extra == "dev"
+Dynamic: license-file
+
+# VersionSec
+
+> **VersionSec was formerly ForgeGuard.** Releases up to and including 0.6.0 were published
+> as `forgeguard` and remain available and unchanged. From 0.7.0 the canonical name is
+> VersionSec (`pip install versionsec`). `forgeguard==0.7.1` is a compatibility bridge and
+> the `forgeguard` CLI/import keep working. Stable `FG-*` finding IDs are unchanged.
+> See [MIGRATION.md](MIGRATION.md).
+
+[![CI](https://github.com/gexiro-global/versionsec/actions/workflows/ci.yml/badge.svg)](https://github.com/gexiro-global/versionsec/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/versionsec.svg)](https://pypi.org/project/versionsec/)
+[![Python](https://img.shields.io/pypi/pyversions/versionsec.svg)](https://pypi.org/project/versionsec/)
+[![License: Apache-2.0](https://img.shields.io/pypi/l/versionsec.svg)](https://github.com/gexiro-global/versionsec/blob/main/LICENSE)
+
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/gexiro-global/versionsec/badge)](https://scorecard.dev/viewer/?uri=github.com/gexiro-global/versionsec)
+[Security and trust evidence](docs/SECURITY-TRUST.md) documents the project's policies and automated checks. No certification or badge level is claimed.
+
+Read-only posture assessment for one explicitly authorized self-hosted Gitea or Forgejo instance, or an explicitly supplied anonymized configuration snapshot.
+
+## VersionSec — 0.7.1
+
+The ForgeGuard → VersionSec rebrand. No capability was removed: the separate Gitea or Forgejo providers, read-only live posture assessment, offline configuration review, offline runner review, Markdown/JSON/SARIF exports and deterministic completeness semantics all carry over unchanged. Canonical CLI is `versionsec`, canonical import is `versionsec`; the `forgeguard` CLI and `import forgeguard` continue to work through a compatibility shim that resolves to the same implementation. Machine-readable schema identifiers (`forgeguard.assessment.v1`, `forgeguard.config-snapshot.v1`, `forgeguard.runner-snapshot.v1`) and all `FG-*` finding IDs are deliberately unchanged so existing report consumers keep working. See [MIGRATION.md](MIGRATION.md).
+
+## Control Plane Hardening — 0.6.0
+
+Adds an offline runner posture review (`versionsec runner review`) for the trust boundaries that matter most to a Gitea or Forgejo administrator: execution engine isolation, privileged mode, host volume mounts, Docker socket exposure, job network mode, ephemeral registration, and the experimental Forgejo plugin engine. Runner review is zero-network, evaluates only an explicitly supplied `forgeguard.runner-snapshot.v1` snapshot, and never reads runner credentials, `.runner` files, or Docker/registry secrets. Runner qualification targets are Gitea Runner 3.4.2 and Forgejo Runner 13.0.0 / 13.1.0 — see [upstream evidence](docs/UPSTREAM.md) and [runner review](docs/RUNNER_REVIEW.md).
+
+## Multi-Forge Support — 0.5.0
+
+Adds Gitea or Forgejo as separate providers, with operator-declared product identity, finite provider-specific advisory catalogs, exposure intent, request profiles, offline configuration review of an explicitly supplied snapshot, and JSON/Markdown/SARIF exports. It does not scan application source code or private artifact contents.
+
+Qualification targets are Gitea 1.26.4 / 1.27.3 and Forgejo 15.0.8 / 16.0.4 — these are the exact tested targets, not a universal support promise; see [release notes](docs/RELEASE_CANDIDATE_0_5.md) and the CI evidence linked from the release.
+
+## Install
+
+```bash
+python -m pip install versionsec
+```
+
+Or pin the exact release:
+
+```bash
+python -m pip install versionsec==0.7.1
+```
+
+## Usage
+
+```bash
+versionsec providers
+versionsec checks
+versionsec scan --url https://git.example.com/team --authorized --product forgejo --profile standard --policy public --dry-run
+versionsec scan --url https://git.example.com/team --authorized --product forgejo --profile standard --policy public --format json
+versionsec config review --snapshot anonymized-snapshot.json --policy private --format json
+versionsec runner review --snapshot runner-snapshot.json --format json
+```
+
+Use minimal for one version request, standard for five bounded existing requests, or extended for those requests plus root. The profiles change scope, not aggressiveness. Exposure intent (public/private/unspecified) is independent; unspecified is the default.
+
+The operator declares product identity. Compatible APIs and inventory versions alone do not identify a product. Opposing markers, conflicting versions, unknown syntax and unsupported evidence remain explicitly incomplete. No Gitea advisory is applied to Forgejo.
+
+## Evidence boundaries
+
+HTTP 200 on a checked path is only a status observation, not proof of repository readability, private data access or loaded configuration. Public-by-design status observations are informational. Private intent creates a bounded review warning. HTTP 401/403 may support denial on that path only. Errors, redirects, 404, 429, malformed version JSON, timeouts and truncation remain incomplete.
+
+Incomplete assessments have null score, N/A grade and assessed=false, even when another check warns. Skipped checks remain listed. Version 2 scores are not comparable with 0.2.2. No score is security certification or a claim of no vulnerabilities.
+
+Offline review performs zero requests and evaluates only the supplied snapshot. It supports a closed key list for registration, sign-in, new-repository privacy and product-specific MFA. It never reads app.ini, production files, tokens, databases or private keys. See [config review](docs/CONFIG_REVIEW.md).
+
+## Transport and reports
+
+One target, GET only, finite allowlist, no retries or redirects, serial requests, at most 12 requests, 10 seconds each and 60 seconds overall. Responses are streamed with a 256 KiB decompressed limit. HTTPS verifies certificates; --ca-bundle explicitly supplies a private CA. Ambient proxy/CA settings are ignored. HTTP never transmits a token. Anonymous requests do not inherit authentication or cookies.
+
+Prefer VERSIONSEC_TOKEN for the optional version-read token. The legacy --token option warns because shell history/process listings may retain it. Reports do not contain the token.
+
+Use --format md,json,sarif with --out reports/result.md for separate files. The directory must exist. Existing files, symlinks and collisions are refused, and writes are atomic. Multiple formats require files; single machine-readable stdout is clean.
+
+JSON uses forgeguard.assessment.v1 with a packaged schema. SARIF 2.1.0 is schema-validated against frozen OASIS errata01. No source locations are invented. No DevGuard or GitHub Code Scanning importer integration is claimed.
+
+## Documentation
+
+- [Migration and exit codes](docs/MIGRATION_0_5.md)
+- [Security model](docs/SECURITY_MODEL.md) and [authorized use](AUTHORIZED_USE.md)
+- [Scoring](docs/SCORING.md), [checks](docs/CHECKS.md), [upstream evidence](docs/UPSTREAM.md)
+- [Provider guide](docs/PROVIDERS.md), [runner review](docs/RUNNER_REVIEW.md) and [integration lab](docs/INTEGRATION_TESTING.md)
+- [Candidate notes](docs/RELEASE_CANDIDATE_0_5.md) and [release checklist](docs/RELEASE_CHECKLIST.md)
+
+Historical 0.2.2 before/after examples remain in examples/ for migration context. Current examples use the golden- prefix and are synthetic offline fixtures, not production scans.
+
+## Commercial hardening
+
+Gexiro offers a paid Hardening Report for authorized Gitea operators who want human review of bounded evidence, explicit limitations, prioritized findings, and a practical remediation plan.
+
+A Remediation Sprint is a separate engagement: scope and acceptance criteria are frozen first, changes begin only after explicit approval, and the result includes before/after verification. Scope expansion, third-party targets, and remote changes require separate written authorization.
+
+VersionSec remains usable as a free OSS CLI without a hosted account or control plane. Heavy SaaS and recurring monitoring are not offered at this stage.
+
+[Request a scoped VersionSec Hardening Report](mailto:contact@gexiro.com?subject=VersionSec%20Hardening%20Report)
+
+## License
+
+Apache-2.0. See [LICENSE](LICENSE).
+
+Built and maintained by [Gexiro Global Enterprises Ltd](https://gexiro.com).
+
+Part of the [Gexiro open-source toolkit](https://github.com/gexiro-global).
+
+VersionSec by Gexiro
+
+Not affiliated with Gitea, Forgejo, Codeberg, GitHub, or GitLab.

versionsec-0.7.1/README.md

@@ -0,0 +1,108 @@
+# VersionSec
+
+> **VersionSec was formerly ForgeGuard.** Releases up to and including 0.6.0 were published
+> as `forgeguard` and remain available and unchanged. From 0.7.0 the canonical name is
+> VersionSec (`pip install versionsec`). `forgeguard==0.7.1` is a compatibility bridge and
+> the `forgeguard` CLI/import keep working. Stable `FG-*` finding IDs are unchanged.
+> See [MIGRATION.md](MIGRATION.md).
+
+[![CI](https://github.com/gexiro-global/versionsec/actions/workflows/ci.yml/badge.svg)](https://github.com/gexiro-global/versionsec/actions/workflows/ci.yml)
+[![PyPI](https://img.shields.io/pypi/v/versionsec.svg)](https://pypi.org/project/versionsec/)
+[![Python](https://img.shields.io/pypi/pyversions/versionsec.svg)](https://pypi.org/project/versionsec/)
+[![License: Apache-2.0](https://img.shields.io/pypi/l/versionsec.svg)](https://github.com/gexiro-global/versionsec/blob/main/LICENSE)
+
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/gexiro-global/versionsec/badge)](https://scorecard.dev/viewer/?uri=github.com/gexiro-global/versionsec)
+[Security and trust evidence](docs/SECURITY-TRUST.md) documents the project's policies and automated checks. No certification or badge level is claimed.
+
+Read-only posture assessment for one explicitly authorized self-hosted Gitea or Forgejo instance, or an explicitly supplied anonymized configuration snapshot.
+
+## VersionSec — 0.7.1
+
+The ForgeGuard → VersionSec rebrand. No capability was removed: the separate Gitea or Forgejo providers, read-only live posture assessment, offline configuration review, offline runner review, Markdown/JSON/SARIF exports and deterministic completeness semantics all carry over unchanged. Canonical CLI is `versionsec`, canonical import is `versionsec`; the `forgeguard` CLI and `import forgeguard` continue to work through a compatibility shim that resolves to the same implementation. Machine-readable schema identifiers (`forgeguard.assessment.v1`, `forgeguard.config-snapshot.v1`, `forgeguard.runner-snapshot.v1`) and all `FG-*` finding IDs are deliberately unchanged so existing report consumers keep working. See [MIGRATION.md](MIGRATION.md).
+
+## Control Plane Hardening — 0.6.0
+
+Adds an offline runner posture review (`versionsec runner review`) for the trust boundaries that matter most to a Gitea or Forgejo administrator: execution engine isolation, privileged mode, host volume mounts, Docker socket exposure, job network mode, ephemeral registration, and the experimental Forgejo plugin engine. Runner review is zero-network, evaluates only an explicitly supplied `forgeguard.runner-snapshot.v1` snapshot, and never reads runner credentials, `.runner` files, or Docker/registry secrets. Runner qualification targets are Gitea Runner 3.4.2 and Forgejo Runner 13.0.0 / 13.1.0 — see [upstream evidence](docs/UPSTREAM.md) and [runner review](docs/RUNNER_REVIEW.md).
+
+## Multi-Forge Support — 0.5.0
+
+Adds Gitea or Forgejo as separate providers, with operator-declared product identity, finite provider-specific advisory catalogs, exposure intent, request profiles, offline configuration review of an explicitly supplied snapshot, and JSON/Markdown/SARIF exports. It does not scan application source code or private artifact contents.
+
+Qualification targets are Gitea 1.26.4 / 1.27.3 and Forgejo 15.0.8 / 16.0.4 — these are the exact tested targets, not a universal support promise; see [release notes](docs/RELEASE_CANDIDATE_0_5.md) and the CI evidence linked from the release.
+
+## Install
+
+```bash
+python -m pip install versionsec
+```
+
+Or pin the exact release:
+
+```bash
+python -m pip install versionsec==0.7.1
+```
+
+## Usage
+
+```bash
+versionsec providers
+versionsec checks
+versionsec scan --url https://git.example.com/team --authorized --product forgejo --profile standard --policy public --dry-run
+versionsec scan --url https://git.example.com/team --authorized --product forgejo --profile standard --policy public --format json
+versionsec config review --snapshot anonymized-snapshot.json --policy private --format json
+versionsec runner review --snapshot runner-snapshot.json --format json
+```
+
+Use minimal for one version request, standard for five bounded existing requests, or extended for those requests plus root. The profiles change scope, not aggressiveness. Exposure intent (public/private/unspecified) is independent; unspecified is the default.
+
+The operator declares product identity. Compatible APIs and inventory versions alone do not identify a product. Opposing markers, conflicting versions, unknown syntax and unsupported evidence remain explicitly incomplete. No Gitea advisory is applied to Forgejo.
+
+## Evidence boundaries
+
+HTTP 200 on a checked path is only a status observation, not proof of repository readability, private data access or loaded configuration. Public-by-design status observations are informational. Private intent creates a bounded review warning. HTTP 401/403 may support denial on that path only. Errors, redirects, 404, 429, malformed version JSON, timeouts and truncation remain incomplete.
+
+Incomplete assessments have null score, N/A grade and assessed=false, even when another check warns. Skipped checks remain listed. Version 2 scores are not comparable with 0.2.2. No score is security certification or a claim of no vulnerabilities.
+
+Offline review performs zero requests and evaluates only the supplied snapshot. It supports a closed key list for registration, sign-in, new-repository privacy and product-specific MFA. It never reads app.ini, production files, tokens, databases or private keys. See [config review](docs/CONFIG_REVIEW.md).
+
+## Transport and reports
+
+One target, GET only, finite allowlist, no retries or redirects, serial requests, at most 12 requests, 10 seconds each and 60 seconds overall. Responses are streamed with a 256 KiB decompressed limit. HTTPS verifies certificates; --ca-bundle explicitly supplies a private CA. Ambient proxy/CA settings are ignored. HTTP never transmits a token. Anonymous requests do not inherit authentication or cookies.
+
+Prefer VERSIONSEC_TOKEN for the optional version-read token. The legacy --token option warns because shell history/process listings may retain it. Reports do not contain the token.
+
+Use --format md,json,sarif with --out reports/result.md for separate files. The directory must exist. Existing files, symlinks and collisions are refused, and writes are atomic. Multiple formats require files; single machine-readable stdout is clean.
+
+JSON uses forgeguard.assessment.v1 with a packaged schema. SARIF 2.1.0 is schema-validated against frozen OASIS errata01. No source locations are invented. No DevGuard or GitHub Code Scanning importer integration is claimed.
+
+## Documentation
+
+- [Migration and exit codes](docs/MIGRATION_0_5.md)
+- [Security model](docs/SECURITY_MODEL.md) and [authorized use](AUTHORIZED_USE.md)
+- [Scoring](docs/SCORING.md), [checks](docs/CHECKS.md), [upstream evidence](docs/UPSTREAM.md)
+- [Provider guide](docs/PROVIDERS.md), [runner review](docs/RUNNER_REVIEW.md) and [integration lab](docs/INTEGRATION_TESTING.md)
+- [Candidate notes](docs/RELEASE_CANDIDATE_0_5.md) and [release checklist](docs/RELEASE_CHECKLIST.md)
+
+Historical 0.2.2 before/after examples remain in examples/ for migration context. Current examples use the golden- prefix and are synthetic offline fixtures, not production scans.
+
+## Commercial hardening
+
+Gexiro offers a paid Hardening Report for authorized Gitea operators who want human review of bounded evidence, explicit limitations, prioritized findings, and a practical remediation plan.
+
+A Remediation Sprint is a separate engagement: scope and acceptance criteria are frozen first, changes begin only after explicit approval, and the result includes before/after verification. Scope expansion, third-party targets, and remote changes require separate written authorization.
+
+VersionSec remains usable as a free OSS CLI without a hosted account or control plane. Heavy SaaS and recurring monitoring are not offered at this stage.
+
+[Request a scoped VersionSec Hardening Report](mailto:contact@gexiro.com?subject=VersionSec%20Hardening%20Report)
+
+## License
+
+Apache-2.0. See [LICENSE](LICENSE).
+
+Built and maintained by [Gexiro Global Enterprises Ltd](https://gexiro.com).
+
+Part of the [Gexiro open-source toolkit](https://github.com/gexiro-global).
+
+VersionSec by Gexiro
+
+Not affiliated with Gitea, Forgejo, Codeberg, GitHub, or GitLab.

versionsec-0.7.1/forgeguard/__init__.py

@@ -0,0 +1,78 @@
+"""Compatibility shim: ForgeGuard was renamed to VersionSec in 0.7.0.
+
+``import forgeguard`` and ``import forgeguard.cli`` keep working and resolve to the
+canonical ``versionsec`` implementation. There is no second implementation here: every
+name is an alias of the canonical module object, so the two import paths cannot drift.
+
+Canonical from 0.7.0 onward::
+
+    python -m pip install versionsec
+    import versionsec
+
+The legacy path stays quiet on purpose - it emits no warning to stdout or stderr, so
+existing automation does not break. See MIGRATION.md.
+"""
+
+from __future__ import annotations
+
+import importlib
+import sys
+
+import versionsec as _versionsec
+
+__version__ = _versionsec.__version__
+__all__ = list(getattr(_versionsec, "__all__", []))
+
+_SUBMODULES = (
+    "advisories",
+    "advisories.evaluator",
+    "advisories.models",
+    "assessment",
+    "checks",
+    "cli",
+    "client",
+    "config_review",
+    "engine",
+    "exporters",
+    "exporters.json",
+    "exporters.markdown",
+    "exporters.sarif",
+    "models",
+    "output",
+    "policy",
+    "providers",
+    "providers.base",
+    "providers.forgejo",
+    "providers.gitea",
+    "providers.registry",
+    "report",
+    "runner_review",
+    "safety",
+    "scoring",
+    "urls",
+    "version",
+)
+
+# Register each canonical submodule under the legacy name as well, so that the
+# statement form ``import forgeguard.cli`` resolves without a second implementation.
+for _name in _SUBMODULES:
+    try:
+        _module = importlib.import_module(f"versionsec.{_name}")
+    except ModuleNotFoundError:  # pragma: no cover - defensive
+        continue
+    sys.modules[f"{__name__}.{_name}"] = _module
+    if "." not in _name:
+        globals()[_name] = _module
+del _name, _module
+
+
+def __getattr__(name: str):
+    """Any remaining attribute resolves against the canonical package."""
+    try:
+        return getattr(_versionsec, name)
+    except AttributeError as exc:
+        raise AttributeError(name) from exc
+
+
+def __dir__():
+    return sorted(set(dir(_versionsec)) | {n for n in _SUBMODULES if "." not in n})

versionsec-0.7.1/pyproject.toml

@@ -0,0 +1,59 @@
+[build-system]
+requires = ["setuptools==84.0.0", "wheel==0.48.0"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "versionsec"
+version = "0.7.1"
+description = "Read-only security posture review for one authorized self-hosted Gitea or Forgejo instance, including offline configuration and runner review."
+readme = "README.md"
+requires-python = ">=3.11"
+license = "Apache-2.0"
+license-files = ["LICENSE"]
+authors = [
+  {name = "Gexiro Global Enterprises Ltd"}
+]
+keywords = ["gitea", "forgejo", "security", "posture", "self-hosted", "sarif", "runner"]
+classifiers = [
+  "Intended Audience :: Developers",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Topic :: Security",
+  "Typing :: Typed",
+]
+dependencies = [
+  "httpx>=0.27,<1",
+  "pydantic>=2,<3",
+  "typer>=0.12,<1"
+]
+
+[project.urls]
+Homepage = "https://versionsec.com"
+Repository = "https://github.com/gexiro-global/versionsec"
+Documentation = "https://github.com/gexiro-global/versionsec/tree/main/docs"
+Issues = "https://github.com/gexiro-global/versionsec/issues"
+Changelog = "https://github.com/gexiro-global/versionsec/blob/main/CHANGELOG.md"
+
+[project.scripts]
+versionsec = "versionsec.cli:main"
+# Compatibility alias retained for the ForgeGuard -> VersionSec migration; see MIGRATION.md.
+forgeguard = "versionsec.cli:main"
+
+[project.optional-dependencies]
+dev = [
+  "build==1.6.1",
+  "pytest==9.1.1",
+  "ruff==0.16.6",
+  "twine==6.2.0",
+  "pytest-cov==7.1.0",
+  "jsonschema==4.26.0",
+  "PyYAML==6.0.3",
+]
+
+[tool.setuptools.packages.find]
+# forgeguard* is the import-compatibility shim, not a second implementation.
+include = ["versionsec*", "forgeguard*"]
+
+[tool.setuptools.package-data]
+versionsec = ["py.typed", "schemas/*.json", "schemas/*.md", "advisories/catalog/*.json"]

versionsec-0.7.1/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

versionsec-0.7.1/tests/test_audit_reconcile.py

@@ -0,0 +1,41 @@
+"""E-FINAL: inventory/audit reconciliation is a set comparison, not a count."""
+
+from tools.audit_reconcile import normalize, reconcile
+
+
+def test_full_coverage_ok():
+    inv = {"httpx": "0.28.1", "pydantic": "2.13.5", "typer": "0.27.2"}
+    r = reconcile(inv, dict(inv))
+    assert r["ok"] and not r["missing"] and not r["version_mismatches"]
+
+
+def test_detects_removed_record():
+    inv = {"httpx": "0.28.1", "setuptools": "84.0.0", "wheel": "0.48.0"}
+    audited = {"httpx": "0.28.1"}  # tooling silently dropped
+    r = reconcile(inv, audited)
+    assert r["missing"] == ["setuptools", "wheel"]
+    assert not r["ok"]
+
+
+def test_detects_version_swap_at_same_count():
+    inv = {"packaging": "26.3", "httpx": "0.28.1"}
+    audited = {"packaging": "25.0", "httpx": "0.28.1"}  # same count, wrong version
+    r = reconcile(inv, audited)
+    assert len(inv) == len(audited)
+    assert r["version_mismatches"] == [
+        {"package": "packaging", "inventory": "26.3", "audited": "25.0"}
+    ]
+    assert not r["ok"]
+
+
+def test_detects_unexpected_extra():
+    r = reconcile({"httpx": "0.28.1"}, {"httpx": "0.28.1", "evil": "1.0"})
+    assert r["unexpected"] == ["evil"]
+    assert not r["ok"]
+
+
+def test_name_normalisation():
+    assert normalize("PyYAML") == "pyyaml"
+    assert normalize("typing_extensions") == "typing-extensions"
+    r = reconcile({"PyYAML": "6.0.3"}, {"pyyaml": "6.0.3"})
+    assert r["ok"]