vigil-fuse 0.3.0__tar.gz

vigil_fuse-0.3.0/LICENSE

@@ -0,0 +1,108 @@
+VIGIL-FUSE RESTRICTED USE LICENSE, VERSION 1.1
+
+Copyright (c) 2026 VIGIL-IoT
+
+Effective date: 2026-11-04
+
+This is a custom source-available license. It is not an OSI-approved open-source
+license. By installing, running, modifying, or distributing the Software as
+permitted below, you agree to these terms.
+
+1. Definitions
+
+"Software" means FUSE and the source code, object code, documentation, and
+other files owned by VIGIL-IoT and expressly made available under this license.
+It excludes third-party components, assets, data, and dependencies identified
+as subject to separate terms. Those separate terms continue to apply.
+
+"Official PyPI Distribution" means an unmodified source distribution or wheel
+for the package named "vigil-fuse", uploaded to PyPI by VIGIL-IoT or by a
+publisher authorized by VIGIL-IoT.
+
+"PyPI Services" means the Python Package Index service operated at pypi.org,
+its service providers, and facilities that operate a PyPI-compatible cache or
+mirror.
+
+"You" means the person or organization using the Software. If you use the
+Software for an organization, that organization is the licensee. Its employees
+and contractors may use the Software only on its behalf and under these terms.
+
+2. Permission to use
+
+VIGIL-IoT grants you a worldwide, royalty-free, non-exclusive,
+non-transferable license to download and make the copies reasonably necessary
+to install, run, test, back up, and privately modify the Software.
+
+You may use the Software for personal, educational, research, internal
+business, and other commercial purposes. You may use, share, and publish the
+analysis outputs produced by the Software. You may run the Software as part of
+a hosted service, provided that you do not provide third parties with a copy of
+the Software or a modified version.
+
+You may modify the Software for your own private or internal use. You may not
+publish or share those modifications, patches, or derivative versions.
+
+3. PyPI distribution permission
+
+VIGIL-IoT authorizes itself and publishers it has authorized to publish
+Official PyPI Distributions. For each Official PyPI Distribution, VIGIL-IoT
+grants the Python Software Foundation, its service providers, PyPI users, and
+operators of PyPI-compatible mirrors a worldwide, royalty-free,
+non-exclusive license to reproduce, host, cache, distribute, transmit, display,
+perform, publish, and make available unmodified copies of the Software through
+PyPI Services. These permissions allow PyPI Services to operate, cache, mirror,
+and archive the package, and allow users to download, install, run, test, back
+up, and redistribute unmodified package copies through PyPI Services.
+
+The permission to redistribute is limited to unmodified copies of an Official
+PyPI Distribution, through PyPI Services, without a fee for the Software
+itself. This permission does not authorize redistribution through another
+package registry, source repository, container registry, or download service.
+It does not authorize modified or derivative versions, repackaging, or removal
+of copyright notices or this license. This section is the only exception to
+the restrictions in section 4.
+
+4. Restrictions
+
+Except for the limited permission in section 3 or separate written permission
+from VIGIL-IoT, you may not:
+
+- distribute, publish, sublicense, sell, rent, lease, transfer, or otherwise
+  provide a copy of the Software to another person or organization;
+- upload or mirror the Software, or a modified version, to a public or private
+  package registry, source repository, container registry, or download service;
+- publish, share, or distribute a modified or derivative version, including a
+  fork or patch set; or
+- remove or alter copyright notices or this license.
+
+The permission to make installation, execution, backup, and private
+modification copies in section 2 does not permit sharing those copies except
+as expressly allowed in section 3.
+
+This license does not grant permission to use VIGIL-IoT, VIGIL, or FUSE names,
+logos, or trademarks to imply endorsement or affiliation.
+
+5. Ownership
+
+VIGIL-IoT retains ownership of the Software. This license grants only the
+permissions stated above. It does not transfer copyright or any other
+ownership rights to you.
+
+6. Termination
+
+Your permissions under this license end if you materially violate its terms.
+They resume if VIGIL-IoT expressly reinstates them in writing.
+
+7. Warranty and liability
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO EVENT SHALL
+VIGIL-IoT OR THE COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT, OR OTHERWISE, ARISING FROM,
+OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+8. Other permissions
+
+Any permission outside this license must be granted in writing by VIGIL-IoT.

vigil_fuse-0.3.0/PKG-INFO

@@ -0,0 +1,164 @@
+Metadata-Version: 2.4
+Name: vigil-fuse
+Version: 0.3.0
+Summary: FUSE, the Firmware & Unified Security Engine, a VIGIL Project
+License-Expression: LicenseRef-VIGIL-FUSE-PyPI-Restricted-Use
+Project-URL: Repository, https://github.com/VIGIL-IoT/VIGIL-FUSE
+Project-URL: Issues, https://github.com/VIGIL-IoT/VIGIL-FUSE/issues
+Keywords: embedded security,firmware analysis,IoT,static analysis
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: Information Technology
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Quality Assurance
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: esp-idf
+Requires-Dist: PyYAML<7,>=6; extra == "esp-idf"
+Provides-Extra: test
+Requires-Dist: jsonschema<5,>=4.23; extra == "test"
+Requires-Dist: psutil<8,>=7.2; extra == "test"
+Requires-Dist: pytest<10,>=9.0.3; extra == "test"
+Requires-Dist: PyYAML<7,>=6; extra == "test"
+Provides-Extra: dev
+Requires-Dist: build<2,>=1.2; extra == "dev"
+Requires-Dist: coverage[toml]<8,>=7.6; extra == "dev"
+Requires-Dist: jsonschema<5,>=4.23; extra == "dev"
+Requires-Dist: mypy<3,>=2.4.1; extra == "dev"
+Requires-Dist: pip-audit<3,>=2.10; extra == "dev"
+Requires-Dist: psutil<8,>=7.2; extra == "dev"
+Requires-Dist: PyYAML<7,>=6; extra == "dev"
+Requires-Dist: pytest<10,>=9.0.3; extra == "dev"
+Requires-Dist: pytest-cov<8,>=6; extra == "dev"
+Requires-Dist: ruff<1,>=0.11; extra == "dev"
+Requires-Dist: twine<7,>=6; extra == "dev"
+Requires-Dist: types-psutil<8,>=7.2; extra == "dev"
+Requires-Dist: types-PyYAML<7,>=6; extra == "dev"
+Dynamic: license-file
+
+# FUSE
+
+## Firmware & Unified Security Engine
+
+**A [VIGIL](https://github.com/VIGIL-IoT) Project**
+
+FUSE is a CLI-first analysis tool for embedded and IoT project repositories. It checks selected source and configuration files, inventories hardware and firmware candidates, reads selected build metadata, and can run optional dependency or firmware analyzers. Reports include evidence and explicit coverage so a static signal is not mistaken for a confirmed vulnerability.
+
+[![CI](https://img.shields.io/github/actions/workflow/status/VIGIL-IoT/VIGIL-FUSE/ci.yml?branch=main&label=CI)](https://github.com/VIGIL-IoT/VIGIL-FUSE/actions/workflows/ci.yml)
+[![Latest release](https://img.shields.io/github/v/release/VIGIL-IoT/VIGIL-FUSE)](https://github.com/VIGIL-IoT/VIGIL-FUSE/releases)
+[![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-3776AB?logo=python&logoColor=white)](pyproject.toml)
+[![License: VIGIL-FUSE Restricted Use](https://img.shields.io/badge/license-VIGIL--FUSE%20Restricted%20Use-7c3aed)](LICENSE)
+
+**Alpha · 0.3.0**
+
+## Start here
+
+Requires Python 3.11 or newer. The native scanner has no runtime dependencies.
+
+```sh
+pipx install vigil-fuse==0.3.0
+vigil-fuse doctor
+vigil-fuse scan path/to/embedded-project --plan
+vigil-fuse scan path/to/embedded-project --output-dir .fuse-results
+```
+
+A normal scan writes `findings.json`, `findings.txt`, and `findings.sarif` to `.fuse-results/`. Start with `--plan` to review selected inputs, supported stages, limits, and available tools before scanning.
+
+See the [usage guide](docs/usage.md) for setup, scan options, optional analyzers, and report review.
+
+## How a scan works
+
+![FUSE scan flow from a selected local project through bounded discovery, native checks, context inventory, optional analyzers, normalized findings, and local reports](docs/figures/fuse-scan-flow.svg)
+
+[Open the standalone diagram source](site/diagrams/fuse-scan-flow.html).
+
+Native rules analyze selected text without importing or executing project code. FUSE does not flash devices, contact device services, or prove that a static signal is reachable in a deployed product. Optional external analyzers run on the host by default. Explicit Docker mode uses local digest-pinned images, read-only inputs, bounded output capture, no network by default, and resource limits. The report directory is never bind-mounted, and nested report paths are hidden behind bounded temporary storage. Host mode remains unsandboxed.
+
+![FUSE trust boundaries: untrusted project input, local analysis, and optional analyzers running on the host or in explicit Docker isolation](docs/figures/fuse-trust-boundaries.svg)
+
+The diagram shows the difference between default host execution and the explicitly configured Docker option. [Open its editable source](docs/diagrams/fuse-trust-boundaries.html).
+
+## Understand a finding
+
+Severity describes potential impact. Confidence describes the strength of the evidence. Applicability and validation are separate fields. FUSE does not combine these into a single risk score.
+
+![Conceptual FUSE finding model showing separate severity and confidence fields](docs/figures/fuse-finding-model.svg)
+
+The figure starts from the illustrative `FUSE001` record in the [finding format](docs/finding-schema.md). It is a teaching example, not a scan result or a physical FUSE device. [Open the interactive version](site/diagrams/fuse-finding-model.html).
+
+## Current scope
+
+- Seven conservative native rules for credential-like literals, private-key markers, TLS verification bypasses, plaintext HTTP and MQTT endpoints, and two ESP-IDF image-validation settings.
+- Hardware and firmware candidate inventories. These report recognized files and metadata, not hardware or firmware security assessments.
+- Optional Ghidra 12.2 Headless Analyzer support for selected ELF, PE, Mach-O, or explicitly mapped raw binaries. It writes bounded evidence and keeps static endpoint references as unvalidated candidates.
+- Selected ESP-IDF, Zephyr, PlatformIO, compilation database, and GitHub Actions metadata checks.
+- Optional Syft and OSV-Scanner dependency analysis, Binwalk firmware signature identification, and Gitleaks history checks.
+- Text, schema-versioned JSON, SARIF, CycloneDX inventory, scan coverage, evidence, and remediation guidance.
+
+See [supported inputs and limits](src/vigil_fuse/support-matrix.json), [firmware analysis](docs/firmware-analysis.md), [optional Ghidra analysis](docs/ghidra-analysis.md), [hardware analysis](docs/hardware-analysis.md), and [known limitations](docs/limitations.md) for exact boundaries. FUSE does not provide compiler-semantic C/C++ analysis, general firmware extraction, device testing, or hardware-in-the-loop validation.
+
+## Measured scan sample
+
+The same pinned four-scope cohort was scanned on GitHub-hosted Linux, Windows, and macOS runners with one warm-up and three measured runs per scope.
+
+| Selected scope | Linux | Windows | macOS | Coverage |
+| --- | ---: | ---: | ---: | --- |
+| Apache Mynewt Core | 7.586 s | 5.490 s | 6.508 s | 3,354 / 3,355, partial |
+| Mbed TLS | 1.544 s | 0.948 s | 1.234 s | 121 / 121, complete |
+| OpenThread | 2.629 s | 1.930 s | 2.047 s | 909 / 909, complete |
+| ESP-IoT-Solution | 5.760 s | 4.791 s | 4.877 s | 3,886 / 3,888, partial |
+
+These timings include 20 ms memory sampling and are descriptive samples from one hosted runner per OS, not a controlled speed ranking. Mynewt Core and ESP-IoT-Solution had oversized selected files skipped on every platform. The linked report also records sampled process-tree RSS. See the [method, limitations, and raw reports](docs/experiments/repository-scan-performance-matrix-2026-10-31.md).
+
+## Relationship to the VIGIL-IoT suite
+
+FUSE is a VIGIL Project. Within the wider [VIGIL-IoT suite](https://github.com/VIGIL-IoT), it inspects candidate weaknesses while SPECTRA-32 can reproduce selected cases in a controlled lab, evaluate mitigations, and measure overhead. Findings remain candidates until the relevant behavior is validated.
+
+## Documentation
+
+- [Architecture and data flow](docs/architecture.md)
+- [Compatibility and CI evidence](docs/compatibility.md)
+- [Finding fields and JSON schema](docs/finding-schema.md)
+- [Rules and fixture requirements](docs/rule-development.md)
+- [Configuration and integrations](docs/integrations.md)
+- [Ghidra analysis and its limits](docs/ghidra-analysis.md) · [Third-party credits](docs/THIRD_PARTY_CREDITS.md)
+- [Ghidra pipeline figure](site/diagrams/fuse-ghidra-pipeline.html) · [Controlled Ghidra benchmark](docs/experiments/ghidra-adapter-2026-11-03.md)
+- [Threat model](docs/threat-model.md) · [Limitations](docs/limitations.md)
+- [Methodology](docs/methodology.md) · [Traceability](docs/traceability.md)
+- [Benchmark method and evidence](docs/benchmarks.md) · [Synthetic scan baseline](reports/benchmark/scan-performance.json) · [Pinned repository performance report](reports/benchmark/repository-scan-performance.json) · [Cross-platform report set](docs/experiments/repository-scan-performance-matrix-2026-10-31.md)
+- [Repository scan reports](reports/repository-scans/README.md) · [Evaluation notes](docs/experiments/pilot-scan-2026-10.md)
+- [Development roadmap](docs/roadmap.md) · [Release process](docs/release-process.md)
+- [Repository audit and maturity evidence](docs/REPOSITORY_AUDIT.md) · [AI skills and specialist tools reference](docs/AI_SKILLS_REFERENCE.md) · [Research source ledger](docs/research-sources.md)
+- [Project site](site/) · [Website maintenance notes](docs/website.md)
+
+## Develop
+
+```sh
+python -m pip install -e ".[dev]"
+python -m pytest -q
+python -m ruff check src tests scripts
+python -m mypy
+python scripts/validate_docs.py
+```
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for repository setup and [rule development](docs/rule-development.md) for the vulnerable fixture, secure fixture, and expected-result workflow.
+
+## License status
+
+FUSE is source-available under the [VIGIL-FUSE Restricted Use License, version 1.1](LICENSE). It permits personal and commercial use, private modifications, and redistribution of unmodified official packages through PyPI and its compatible mirrors for installation and use. It does not permit rehosting through other registries or publishing modified versions without written permission from VIGIL-IoT. This is a custom license, not an OSI-approved open-source license. PyPI publication is not complete, and channel and rights review remain open.
+
+An earlier public snapshot included MIT terms at [commit `ec91524`](https://github.com/VIGIL-IoT/VIGIL-FUSE/commit/ec91524). This license does not revoke permissions already granted for copies made available under those earlier terms. Review the license attached to the specific version you use.
+
+Because this repository is public on GitHub, GitHub's [Terms of Service](https://docs.github.com/en/site-policy/github-terms/github-terms-of-service) allow users to view and fork it within the service. This license does not disable GitHub's fork feature.
+
+---
+
+**FUSE · Firmware & Unified Security Engine · A [VIGIL](https://github.com/VIGIL-IoT) Project**

vigil_fuse-0.3.0/README.md

@@ -0,0 +1,118 @@
+# FUSE
+
+## Firmware & Unified Security Engine
+
+**A [VIGIL](https://github.com/VIGIL-IoT) Project**
+
+FUSE is a CLI-first analysis tool for embedded and IoT project repositories. It checks selected source and configuration files, inventories hardware and firmware candidates, reads selected build metadata, and can run optional dependency or firmware analyzers. Reports include evidence and explicit coverage so a static signal is not mistaken for a confirmed vulnerability.
+
+[![CI](https://img.shields.io/github/actions/workflow/status/VIGIL-IoT/VIGIL-FUSE/ci.yml?branch=main&label=CI)](https://github.com/VIGIL-IoT/VIGIL-FUSE/actions/workflows/ci.yml)
+[![Latest release](https://img.shields.io/github/v/release/VIGIL-IoT/VIGIL-FUSE)](https://github.com/VIGIL-IoT/VIGIL-FUSE/releases)
+[![Python 3.11+](https://img.shields.io/badge/python-3.11%2B-3776AB?logo=python&logoColor=white)](pyproject.toml)
+[![License: VIGIL-FUSE Restricted Use](https://img.shields.io/badge/license-VIGIL--FUSE%20Restricted%20Use-7c3aed)](LICENSE)
+
+**Alpha · 0.3.0**
+
+## Start here
+
+Requires Python 3.11 or newer. The native scanner has no runtime dependencies.
+
+```sh
+pipx install vigil-fuse==0.3.0
+vigil-fuse doctor
+vigil-fuse scan path/to/embedded-project --plan
+vigil-fuse scan path/to/embedded-project --output-dir .fuse-results
+```
+
+A normal scan writes `findings.json`, `findings.txt`, and `findings.sarif` to `.fuse-results/`. Start with `--plan` to review selected inputs, supported stages, limits, and available tools before scanning.
+
+See the [usage guide](docs/usage.md) for setup, scan options, optional analyzers, and report review.
+
+## How a scan works
+
+![FUSE scan flow from a selected local project through bounded discovery, native checks, context inventory, optional analyzers, normalized findings, and local reports](docs/figures/fuse-scan-flow.svg)
+
+[Open the standalone diagram source](site/diagrams/fuse-scan-flow.html).
+
+Native rules analyze selected text without importing or executing project code. FUSE does not flash devices, contact device services, or prove that a static signal is reachable in a deployed product. Optional external analyzers run on the host by default. Explicit Docker mode uses local digest-pinned images, read-only inputs, bounded output capture, no network by default, and resource limits. The report directory is never bind-mounted, and nested report paths are hidden behind bounded temporary storage. Host mode remains unsandboxed.
+
+![FUSE trust boundaries: untrusted project input, local analysis, and optional analyzers running on the host or in explicit Docker isolation](docs/figures/fuse-trust-boundaries.svg)
+
+The diagram shows the difference between default host execution and the explicitly configured Docker option. [Open its editable source](docs/diagrams/fuse-trust-boundaries.html).
+
+## Understand a finding
+
+Severity describes potential impact. Confidence describes the strength of the evidence. Applicability and validation are separate fields. FUSE does not combine these into a single risk score.
+
+![Conceptual FUSE finding model showing separate severity and confidence fields](docs/figures/fuse-finding-model.svg)
+
+The figure starts from the illustrative `FUSE001` record in the [finding format](docs/finding-schema.md). It is a teaching example, not a scan result or a physical FUSE device. [Open the interactive version](site/diagrams/fuse-finding-model.html).
+
+## Current scope
+
+- Seven conservative native rules for credential-like literals, private-key markers, TLS verification bypasses, plaintext HTTP and MQTT endpoints, and two ESP-IDF image-validation settings.
+- Hardware and firmware candidate inventories. These report recognized files and metadata, not hardware or firmware security assessments.
+- Optional Ghidra 12.2 Headless Analyzer support for selected ELF, PE, Mach-O, or explicitly mapped raw binaries. It writes bounded evidence and keeps static endpoint references as unvalidated candidates.
+- Selected ESP-IDF, Zephyr, PlatformIO, compilation database, and GitHub Actions metadata checks.
+- Optional Syft and OSV-Scanner dependency analysis, Binwalk firmware signature identification, and Gitleaks history checks.
+- Text, schema-versioned JSON, SARIF, CycloneDX inventory, scan coverage, evidence, and remediation guidance.
+
+See [supported inputs and limits](src/vigil_fuse/support-matrix.json), [firmware analysis](docs/firmware-analysis.md), [optional Ghidra analysis](docs/ghidra-analysis.md), [hardware analysis](docs/hardware-analysis.md), and [known limitations](docs/limitations.md) for exact boundaries. FUSE does not provide compiler-semantic C/C++ analysis, general firmware extraction, device testing, or hardware-in-the-loop validation.
+
+## Measured scan sample
+
+The same pinned four-scope cohort was scanned on GitHub-hosted Linux, Windows, and macOS runners with one warm-up and three measured runs per scope.
+
+| Selected scope | Linux | Windows | macOS | Coverage |
+| --- | ---: | ---: | ---: | --- |
+| Apache Mynewt Core | 7.586 s | 5.490 s | 6.508 s | 3,354 / 3,355, partial |
+| Mbed TLS | 1.544 s | 0.948 s | 1.234 s | 121 / 121, complete |
+| OpenThread | 2.629 s | 1.930 s | 2.047 s | 909 / 909, complete |
+| ESP-IoT-Solution | 5.760 s | 4.791 s | 4.877 s | 3,886 / 3,888, partial |
+
+These timings include 20 ms memory sampling and are descriptive samples from one hosted runner per OS, not a controlled speed ranking. Mynewt Core and ESP-IoT-Solution had oversized selected files skipped on every platform. The linked report also records sampled process-tree RSS. See the [method, limitations, and raw reports](docs/experiments/repository-scan-performance-matrix-2026-10-31.md).
+
+## Relationship to the VIGIL-IoT suite
+
+FUSE is a VIGIL Project. Within the wider [VIGIL-IoT suite](https://github.com/VIGIL-IoT), it inspects candidate weaknesses while SPECTRA-32 can reproduce selected cases in a controlled lab, evaluate mitigations, and measure overhead. Findings remain candidates until the relevant behavior is validated.
+
+## Documentation
+
+- [Architecture and data flow](docs/architecture.md)
+- [Compatibility and CI evidence](docs/compatibility.md)
+- [Finding fields and JSON schema](docs/finding-schema.md)
+- [Rules and fixture requirements](docs/rule-development.md)
+- [Configuration and integrations](docs/integrations.md)
+- [Ghidra analysis and its limits](docs/ghidra-analysis.md) · [Third-party credits](docs/THIRD_PARTY_CREDITS.md)
+- [Ghidra pipeline figure](site/diagrams/fuse-ghidra-pipeline.html) · [Controlled Ghidra benchmark](docs/experiments/ghidra-adapter-2026-11-03.md)
+- [Threat model](docs/threat-model.md) · [Limitations](docs/limitations.md)
+- [Methodology](docs/methodology.md) · [Traceability](docs/traceability.md)
+- [Benchmark method and evidence](docs/benchmarks.md) · [Synthetic scan baseline](reports/benchmark/scan-performance.json) · [Pinned repository performance report](reports/benchmark/repository-scan-performance.json) · [Cross-platform report set](docs/experiments/repository-scan-performance-matrix-2026-10-31.md)
+- [Repository scan reports](reports/repository-scans/README.md) · [Evaluation notes](docs/experiments/pilot-scan-2026-10.md)
+- [Development roadmap](docs/roadmap.md) · [Release process](docs/release-process.md)
+- [Repository audit and maturity evidence](docs/REPOSITORY_AUDIT.md) · [AI skills and specialist tools reference](docs/AI_SKILLS_REFERENCE.md) · [Research source ledger](docs/research-sources.md)
+- [Project site](site/) · [Website maintenance notes](docs/website.md)
+
+## Develop
+
+```sh
+python -m pip install -e ".[dev]"
+python -m pytest -q
+python -m ruff check src tests scripts
+python -m mypy
+python scripts/validate_docs.py
+```
+
+See [CONTRIBUTING.md](CONTRIBUTING.md) for repository setup and [rule development](docs/rule-development.md) for the vulnerable fixture, secure fixture, and expected-result workflow.
+
+## License status
+
+FUSE is source-available under the [VIGIL-FUSE Restricted Use License, version 1.1](LICENSE). It permits personal and commercial use, private modifications, and redistribution of unmodified official packages through PyPI and its compatible mirrors for installation and use. It does not permit rehosting through other registries or publishing modified versions without written permission from VIGIL-IoT. This is a custom license, not an OSI-approved open-source license. PyPI publication is not complete, and channel and rights review remain open.
+
+An earlier public snapshot included MIT terms at [commit `ec91524`](https://github.com/VIGIL-IoT/VIGIL-FUSE/commit/ec91524). This license does not revoke permissions already granted for copies made available under those earlier terms. Review the license attached to the specific version you use.
+
+Because this repository is public on GitHub, GitHub's [Terms of Service](https://docs.github.com/en/site-policy/github-terms/github-terms-of-service) allow users to view and fork it within the service. This license does not disable GitHub's fork feature.
+
+---
+
+**FUSE · Firmware & Unified Security Engine · A [VIGIL](https://github.com/VIGIL-IoT) Project**

vigil_fuse-0.3.0/pyproject.toml

@@ -0,0 +1,100 @@
+[build-system]
+requires = ["setuptools>=77.0.3"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "vigil-fuse"
+dynamic = ["version"]
+description = "FUSE, the Firmware & Unified Security Engine, a VIGIL Project"
+readme = "README.md"
+requires-python = ">=3.11"
+dependencies = []
+license = "LicenseRef-VIGIL-FUSE-PyPI-Restricted-Use"
+license-files = ["LICENSE"]
+keywords = ["embedded security", "firmware analysis", "IoT", "static analysis"]
+classifiers = [
+  "Development Status :: 3 - Alpha",
+  "Environment :: Console",
+  "Intended Audience :: Developers",
+  "Intended Audience :: Information Technology",
+  "Operating System :: OS Independent",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Programming Language :: Python :: 3.13",
+  "Programming Language :: Python :: 3.14",
+  "Topic :: Security",
+  "Topic :: Software Development :: Quality Assurance",
+]
+
+[project.optional-dependencies]
+esp-idf = ["PyYAML>=6,<7"]
+test = ["jsonschema>=4.23,<5", "psutil>=7.2,<8", "pytest>=9.0.3,<10", "PyYAML>=6,<7"]
+dev = [
+  "build>=1.2,<2",
+  "coverage[toml]>=7.6,<8",
+  "jsonschema>=4.23,<5",
+  "mypy>=2.4.1,<3",
+  "pip-audit>=2.10,<3",
+  "psutil>=7.2,<8",
+  "PyYAML>=6,<7",
+  "pytest>=9.0.3,<10",
+  "pytest-cov>=6,<8",
+  "ruff>=0.11,<1",
+  "twine>=6,<7",
+  "types-psutil>=7.2,<8",
+  "types-PyYAML>=6,<7",
+]
+
+[project.urls]
+Repository = "https://github.com/VIGIL-IoT/VIGIL-FUSE"
+Issues = "https://github.com/VIGIL-IoT/VIGIL-FUSE/issues"
+
+[project.scripts]
+vigil-fuse = "vigil_fuse.cli:main"
+
+[tool.setuptools.dynamic]
+version = { attr = "vigil_fuse.__version__" }
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+vigil_fuse = ["schemas/*.json", "resources/ghidra/*.java", "support-matrix.json"]
+
+[tool.ruff]
+target-version = "py311"
+line-length = 100
+
+[tool.ruff.lint]
+select = ["E4", "E7", "E9", "F"]
+
+[tool.mypy]
+python_version = "3.11"
+files = [
+  "src/vigil_fuse",
+  "scripts/benchmark_scan.py",
+  "scripts/benchmark_repository_cohort.py",
+  "scripts/prepare_repository_benchmark_cohort.py",
+  "scripts/benchmark_process.py",
+  "scripts/build_repository_scan_dashboard.py",
+  "scripts/install_ci_analyzers.py",
+  "scripts/verify_binwalk_adapter.py",
+  "scripts/verify_esp_idf_build_context.py",
+  "scripts/evaluate_sard_fuse001_cohort.py",
+  "scripts/evaluate_sard_fuse001_catalogue.py",
+  "scripts/compare_repository_scan_snapshots.py",
+  "scripts/benchmark_ghidra_adapter.py",
+]
+mypy_path = "src"
+explicit_package_bases = true
+strict = true
+
+[tool.coverage.run]
+branch = true
+relative_files = true
+source = ["vigil_fuse"]
+
+[tool.coverage.report]
+show_missing = true
+skip_covered = true

vigil_fuse-0.3.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

vigil_fuse-0.3.0/src/vigil_fuse/__init__.py

@@ -0,0 +1,3 @@
+"""FUSE: Firmware & Unified Security Engine, a VIGIL Project."""
+
+__version__ = "0.3.0"

vigil_fuse-0.3.0/src/vigil_fuse/__main__.py

@@ -0,0 +1,3 @@
+from .cli import main
+
+raise SystemExit(main())