whatyouship 0.1.0b1__tar.gz

whatyouship-0.1.0b1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Nikolay Larin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

whatyouship-0.1.0b1/PKG-INFO

@@ -0,0 +1,271 @@
+Metadata-Version: 2.5
+Name: whatyouship
+Version: 0.1.0b1
+Summary: Know what you ship. Know what you install.
+Keywords: release,artifacts,installer,linting,binary-analysis
+Author-email: Nikolay Larin <nikolay.larin@gmail.com>
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-Expression: MIT
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Software Development :: Build Tools
+Classifier: Topic :: Software Development :: Quality Assurance
+Classifier: Topic :: System :: Software Distribution
+License-File: LICENSE
+Requires-Dist: pymsi==0.0.0rc1
+Requires-Dist: lief>=1.0,<2
+Project-URL: Issues, https://github.com/nikolay-larin-b/whatyouship/issues
+Project-URL: Repository, https://github.com/nikolay-larin-b/whatyouship
+Import-Name: whatyouship
+
+# WhatYouShip
+
+**Know what you ship. Know what you install.**
+
+WhatYouShip is an open-source release artifact linter. It analyzes the software package that users actually receive — not the source tree or build configuration.
+
+It can inspect, lint, and compare directory, MSI, NSIS installer, Inno Setup
+installer, and ZIP releases.
+
+## Quick start
+
+Inspect a release:
+
+```text
+whatyouship inspect release.msi
+```
+
+Lint it:
+
+```text
+whatyouship lint release.msi
+```
+
+Compare two releases:
+
+```text
+whatyouship compare previous.msi release.msi
+```
+
+Use the previous release as a baseline so that existing findings do not hide new regressions:
+
+```text
+whatyouship lint release.msi --baseline previous.msi
+```
+
+Save a report:
+
+```text
+whatyouship lint release.msi --baseline previous.msi -o lint.json
+```
+
+Use WhatYouShip as a CI release gate:
+
+```text
+whatyouship lint release.msi --baseline previous.msi --fail-on error
+```
+
+For available commands and options:
+
+```text
+whatyouship --help
+whatyouship inspect --help
+whatyouship lint --help
+whatyouship compare --help
+```
+
+## What it looks for
+
+WhatYouShip analyzes the final release rather than assumptions made by the build system.
+
+Current checks and comparisons include:
+
+* suspicious build artifacts accidentally included in a release;
+* unsigned Windows executables and libraries;
+* untrusted signers and invalid artifact signatures where platform verification is available;
+* inconsistent MSI installation scope;
+* added, removed, and changed files between releases;
+* binary architecture changes;
+* executable/library kind changes;
+* file and product version changes;
+* signature and signer changes between releases.
+
+For recognized Windows binaries, WhatYouShip also extracts architecture, binary kind, version metadata, and signature information.
+
+## Inspect, lint, compare
+
+### `inspect`
+
+Shows what is actually present in a release artifact.
+
+```text
+whatyouship inspect release.zip
+```
+
+For recognized binaries, the report includes metadata such as architecture, executable or library kind, versions, and signature information.
+
+### `lint`
+
+Runs release rules and reports findings.
+
+```text
+whatyouship lint release.msi
+```
+
+A product-specific TOML configuration can change rule settings:
+
+```text
+whatyouship lint release.msi --config examples/whatyouship.toml
+```
+
+See [`examples/whatyouship.toml`](examples/whatyouship.toml) for supported rule settings.
+
+### Baseline linting
+
+A previous release can be used as the baseline:
+
+```text
+whatyouship lint release.msi --baseline previous.msi
+```
+
+Findings are classified as:
+
+* **new** — present only in the new release;
+* **existing** — present in both releases;
+* **resolved** — present only in the baseline.
+
+This makes it possible to concentrate on regressions without losing track of known issues.
+
+### `compare`
+
+Compares the actual contents of two releases:
+
+```text
+whatyouship compare previous.msi release.msi
+```
+
+In addition to added, removed, changed, and unchanged files, WhatYouShip reports semantic binary changes such as version, architecture, and signature changes.
+
+## Supported artifacts
+
+| Artifact       | Inspect | Lint | Compare |
+| -------------- | ------- | ---- | ------- |
+| Directory      | Yes     | Yes  | Yes     |
+| MSI            | Yes     | Yes  | Yes     |
+| NSIS EXE       | Yes     | Yes  | Yes     |
+| Inno Setup EXE | Yes     | Yes  | Yes     |
+| ZIP            | Yes     | Yes  | Yes     |
+
+MSI extraction and static MSI analysis are platform-independent.
+
+On Windows, the signature of the MSI package itself is verified using the system Authenticode API. Signature status distinguishes unsigned, valid and trusted, signed but untrusted, and cryptographically invalid artifacts. Package signature verification is currently unsupported on Linux and macOS.
+
+ZIP releases use the same file and binary analysis as ordinary directories.
+
+NSIS installers require `7z` or `7zz` from 7-Zip to be available in `PATH`.
+WhatYouShip inspects the extracted payload; extracted paths are not an exact
+simulation of runtime installation paths. On Windows, the outer installer's
+Authenticode signature is checked separately from signatures of binaries in its
+payload.
+
+Inno Setup installers require `innoextract` to be available in `PATH`. Their
+extracted layout is a payload representation, not an exact simulation of
+runtime installation paths. On Windows, the outer installer's Authenticode
+signature is checked separately from signatures of binaries in its payload.
+
+## MSI installation scope
+
+WhatYouShip statically analyzes MSI installation scope and distinguishes:
+
+* `per-user`;
+* `per-machine`;
+* `dual-purpose`;
+* `ambiguous`.
+
+The `inconsistent-installation-scope` rule reports concrete conflicts between the declared installation context and component resources.
+
+WhatYouShip also reports installation-scope changes when comparing MSI releases.
+
+Because this is static analysis, runtime conditions and installer choices cannot always be resolved in advance.
+
+## Reports
+
+Use `-o` or `--output` to write a report to a file. The extension selects the format.
+
+```text
+whatyouship inspect release.zip -o inspect.json
+whatyouship lint release.zip -o lint.csv
+whatyouship compare previous.zip release.zip -o compare.txt
+```
+
+Supported formats:
+
+| Format  | Inspect | Lint | Compare |
+| ------- | ------- | ---- | ------- |
+| `.txt`  | Yes     | Yes  | Yes     |
+| `.json` | Yes     | Yes  | Yes     |
+| `.csv`  | Yes     | Yes  | No      |
+
+Without `--output`, commands print text to stdout.
+
+JSON reports contain structured data and include `schema_version`, `tool_version`, and the report type.
+
+## CI and exit codes
+
+`lint` can be used directly as a release gate.
+
+```text
+whatyouship lint release.msi --fail-on error
+```
+
+Available thresholds:
+
+```text
+--fail-on error
+--fail-on warning
+--fail-on never
+```
+
+The default is `--fail-on error`.
+
+Exit codes:
+
+* `0` — the release passes the selected threshold;
+* `1` — lint findings reach the selected threshold;
+* `2` — WhatYouShip cannot complete the operation because of an input, configuration, or tool error.
+
+With `--baseline`, only **new** findings affect the lint exit code.
+
+For example:
+
+```text
+whatyouship lint release.msi --baseline previous.msi --fail-on error -o lint.json
+```
+
+## Cache
+
+WhatYouShip keeps its user data under:
+
+```text
+~/.whatyouship/
+```
+
+Extracted artifacts are cached by SHA-256:
+
+```text
+~/.whatyouship/cache/msi/v1/
+~/.whatyouship/cache/nsis/v1/
+~/.whatyouship/cache/inno/v1/
+~/.whatyouship/cache/zip/v1/
+```
+
+The cache avoids repeated extraction of the same artifact. Binary metadata and lint analysis are performed again on each run.
+
+The cache hash identifies artifact content; it is not a signature or authenticity check.
+
+On Windows, `~` refers to the user's profile directory.
+

whatyouship-0.1.0b1/README.md

@@ -0,0 +1,246 @@
+# WhatYouShip
+
+**Know what you ship. Know what you install.**
+
+WhatYouShip is an open-source release artifact linter. It analyzes the software package that users actually receive — not the source tree or build configuration.
+
+It can inspect, lint, and compare directory, MSI, NSIS installer, Inno Setup
+installer, and ZIP releases.
+
+## Quick start
+
+Inspect a release:
+
+```text
+whatyouship inspect release.msi
+```
+
+Lint it:
+
+```text
+whatyouship lint release.msi
+```
+
+Compare two releases:
+
+```text
+whatyouship compare previous.msi release.msi
+```
+
+Use the previous release as a baseline so that existing findings do not hide new regressions:
+
+```text
+whatyouship lint release.msi --baseline previous.msi
+```
+
+Save a report:
+
+```text
+whatyouship lint release.msi --baseline previous.msi -o lint.json
+```
+
+Use WhatYouShip as a CI release gate:
+
+```text
+whatyouship lint release.msi --baseline previous.msi --fail-on error
+```
+
+For available commands and options:
+
+```text
+whatyouship --help
+whatyouship inspect --help
+whatyouship lint --help
+whatyouship compare --help
+```
+
+## What it looks for
+
+WhatYouShip analyzes the final release rather than assumptions made by the build system.
+
+Current checks and comparisons include:
+
+* suspicious build artifacts accidentally included in a release;
+* unsigned Windows executables and libraries;
+* untrusted signers and invalid artifact signatures where platform verification is available;
+* inconsistent MSI installation scope;
+* added, removed, and changed files between releases;
+* binary architecture changes;
+* executable/library kind changes;
+* file and product version changes;
+* signature and signer changes between releases.
+
+For recognized Windows binaries, WhatYouShip also extracts architecture, binary kind, version metadata, and signature information.
+
+## Inspect, lint, compare
+
+### `inspect`
+
+Shows what is actually present in a release artifact.
+
+```text
+whatyouship inspect release.zip
+```
+
+For recognized binaries, the report includes metadata such as architecture, executable or library kind, versions, and signature information.
+
+### `lint`
+
+Runs release rules and reports findings.
+
+```text
+whatyouship lint release.msi
+```
+
+A product-specific TOML configuration can change rule settings:
+
+```text
+whatyouship lint release.msi --config examples/whatyouship.toml
+```
+
+See [`examples/whatyouship.toml`](examples/whatyouship.toml) for supported rule settings.
+
+### Baseline linting
+
+A previous release can be used as the baseline:
+
+```text
+whatyouship lint release.msi --baseline previous.msi
+```
+
+Findings are classified as:
+
+* **new** — present only in the new release;
+* **existing** — present in both releases;
+* **resolved** — present only in the baseline.
+
+This makes it possible to concentrate on regressions without losing track of known issues.
+
+### `compare`
+
+Compares the actual contents of two releases:
+
+```text
+whatyouship compare previous.msi release.msi
+```
+
+In addition to added, removed, changed, and unchanged files, WhatYouShip reports semantic binary changes such as version, architecture, and signature changes.
+
+## Supported artifacts
+
+| Artifact       | Inspect | Lint | Compare |
+| -------------- | ------- | ---- | ------- |
+| Directory      | Yes     | Yes  | Yes     |
+| MSI            | Yes     | Yes  | Yes     |
+| NSIS EXE       | Yes     | Yes  | Yes     |
+| Inno Setup EXE | Yes     | Yes  | Yes     |
+| ZIP            | Yes     | Yes  | Yes     |
+
+MSI extraction and static MSI analysis are platform-independent.
+
+On Windows, the signature of the MSI package itself is verified using the system Authenticode API. Signature status distinguishes unsigned, valid and trusted, signed but untrusted, and cryptographically invalid artifacts. Package signature verification is currently unsupported on Linux and macOS.
+
+ZIP releases use the same file and binary analysis as ordinary directories.
+
+NSIS installers require `7z` or `7zz` from 7-Zip to be available in `PATH`.
+WhatYouShip inspects the extracted payload; extracted paths are not an exact
+simulation of runtime installation paths. On Windows, the outer installer's
+Authenticode signature is checked separately from signatures of binaries in its
+payload.
+
+Inno Setup installers require `innoextract` to be available in `PATH`. Their
+extracted layout is a payload representation, not an exact simulation of
+runtime installation paths. On Windows, the outer installer's Authenticode
+signature is checked separately from signatures of binaries in its payload.
+
+## MSI installation scope
+
+WhatYouShip statically analyzes MSI installation scope and distinguishes:
+
+* `per-user`;
+* `per-machine`;
+* `dual-purpose`;
+* `ambiguous`.
+
+The `inconsistent-installation-scope` rule reports concrete conflicts between the declared installation context and component resources.
+
+WhatYouShip also reports installation-scope changes when comparing MSI releases.
+
+Because this is static analysis, runtime conditions and installer choices cannot always be resolved in advance.
+
+## Reports
+
+Use `-o` or `--output` to write a report to a file. The extension selects the format.
+
+```text
+whatyouship inspect release.zip -o inspect.json
+whatyouship lint release.zip -o lint.csv
+whatyouship compare previous.zip release.zip -o compare.txt
+```
+
+Supported formats:
+
+| Format  | Inspect | Lint | Compare |
+| ------- | ------- | ---- | ------- |
+| `.txt`  | Yes     | Yes  | Yes     |
+| `.json` | Yes     | Yes  | Yes     |
+| `.csv`  | Yes     | Yes  | No      |
+
+Without `--output`, commands print text to stdout.
+
+JSON reports contain structured data and include `schema_version`, `tool_version`, and the report type.
+
+## CI and exit codes
+
+`lint` can be used directly as a release gate.
+
+```text
+whatyouship lint release.msi --fail-on error
+```
+
+Available thresholds:
+
+```text
+--fail-on error
+--fail-on warning
+--fail-on never
+```
+
+The default is `--fail-on error`.
+
+Exit codes:
+
+* `0` — the release passes the selected threshold;
+* `1` — lint findings reach the selected threshold;
+* `2` — WhatYouShip cannot complete the operation because of an input, configuration, or tool error.
+
+With `--baseline`, only **new** findings affect the lint exit code.
+
+For example:
+
+```text
+whatyouship lint release.msi --baseline previous.msi --fail-on error -o lint.json
+```
+
+## Cache
+
+WhatYouShip keeps its user data under:
+
+```text
+~/.whatyouship/
+```
+
+Extracted artifacts are cached by SHA-256:
+
+```text
+~/.whatyouship/cache/msi/v1/
+~/.whatyouship/cache/nsis/v1/
+~/.whatyouship/cache/inno/v1/
+~/.whatyouship/cache/zip/v1/
+```
+
+The cache avoids repeated extraction of the same artifact. Binary metadata and lint analysis are performed again on each run.
+
+The cache hash identifies artifact content; it is not a signature or authenticity check.
+
+On Windows, `~` refers to the user's profile directory.

whatyouship-0.1.0b1/pyproject.toml

@@ -0,0 +1,49 @@
+[build-system]
+requires = ["flit_core>=3.12,<5"]
+build-backend = "flit_core.buildapi"
+
+[project]
+name = "whatyouship"
+dynamic = ["version"]
+description = "Know what you ship. Know what you install."
+readme = "README.md"
+requires-python = ">=3.11"
+license = "MIT"
+
+authors = [
+    { name = "Nikolay Larin", email = "nikolay.larin@gmail.com" },
+]
+
+keywords = [
+    "release",
+    "artifacts",
+    "installer",
+    "linting",
+    "binary-analysis",
+]
+
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Environment :: Console",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Topic :: Software Development :: Build Tools",
+    "Topic :: Software Development :: Quality Assurance",
+    "Topic :: System :: Software Distribution",
+]
+
+dependencies = [
+    "pymsi==0.0.0rc1",
+    "lief>=1.0,<2",
+]
+
+[project.urls]
+Repository = "https://github.com/nikolay-larin-b/whatyouship"
+Issues = "https://github.com/nikolay-larin-b/whatyouship/issues"
+
+[project.scripts]
+whatyouship = "whatyouship.cli:main"
+
+[tool.flit.module]
+name = "whatyouship"

whatyouship-0.1.0b1/src/whatyouship/__init__.py

@@ -0,0 +1,6 @@
+# Copyright (c) 2026 Nikolay Larin
+# SPDX-License-Identifier: MIT
+
+"""WhatYouShip package."""
+
+__version__ = "0.1.0b1"

whatyouship-0.1.0b1/src/whatyouship/binary/__init__.py

@@ -0,0 +1,4 @@
+# Copyright (c) 2026 Nikolay Larin
+# SPDX-License-Identifier: MIT
+
+"""Inspect binary formats independently of release artifact sources."""