v0.5.1

Cordon 0.5.1

A home screen that reports the state you are in, and a help command.

   ┌──────────────────────────────────────────────────────────────────────────┐
   │  Detection is unchanged from 0.5.0: the same rulepack, the same          │
   │  advisories, the same findings. This release is the command line a       │
   │  person meets first, three commands that crashed or misled, and the      │
   │  data behind a future allowlist refresh.                                 │
   └──────────────────────────────────────────────────────────────────────────┘

  Map of this release
  ├─ Install ................ pipx · the Action · the container
  ├─ The home screen ........ what it reports, and where it reads it
  ├─ help ................... a command, an action, a misspelling
  ├─ Fixed .................. crashes, wrong command names
  └─ Verify it .............. hashes, signatures, provenance

---

Install

   pipx install cordon-scanner==0.5.1          or, already installed:
   pipx runpip cordon-scanner install --require-hashes -r <your pinned requirements>

   GitHub Action   uses: Threx-code/cordon/action@v0.5.1   (pin the commit SHA the tag names)
   Container       ghcr.io/threx-code/cordon:0.5.1        pin it by digest in a pipeline
   Bitbucket pipe  ghcr.io/threx-code/cordon-bitbucket-pipe:0.5.1

The home screen

   $ cordon-scanner

    ██████  ██████  ██████  ██████   ██████  ███    ██
   ██      ██    ██ ██   ██ ██   ██ ██    ██ ████   ██
   ██      ██    ██ ██████  ██   ██ ██    ██ ██ ██  ██
   ██      ██    ██ ██   ██ ██   ██ ██    ██ ██  ██ ██
    ██████  ██████  ██   ██ ██████   ██████  ██   ████
   Software supply-chain security scanner       v0.5.1

   ENVIRONMENT ─────────────────────────────────────────────────────────────
   Rulepack  0.2.0                         Hooks   pre-push runs cordon
   Policy    cordon.yaml · 1 suppression   Cloud   not signed in
   Intel     bundled · 1d old              Mode    offline by default · executes nothing

   SCAN AND INSPECT ─────────────────      POLICY ──────────────────────────
   scan        scan a directory, …         rules       list, test and show …
   …

   FACT       READ FROM                                      NEVER
   Rulepack   the installed package                          fetched
   Policy     cordon.yaml here, and its suppressions         guessed: an invalid file says so
   Intel      the bundled feed's age, stale or not           refreshed
   Hooks      .git/hooks or core.hooksPath, following a      credited unless the hook or the
              shim to the tracked hook it names              tracked hook it names runs cordon
   Cloud      the stored sign-in                             sent anywhere
   Mode       CORDON_OFFLINE                                 assumed

   A fact that cannot be read says `unavailable`; the screen still draws.

   ON A TERMINAL                          PIPED, CAPTURED, NO_COLOR
   the CORDON wordmark                    plain text
   the console's palette                  no escape sequences
   (24-bit, or 256-colour stand-ins)      no block letters
   two columns from 88 wide               the same facts and commands

help

   cordon-scanner help                    this screen
   cordon-scanner help sbom               one command's help
   cordon-scanner help sbom generate      one action's help
   cordon-scanner help sbm                did you mean: cordon-scanner help sbom

Fixed

   BEFORE                                                  NOW
   cordon-scanner config | report | baseline               each prints its own help, exit 3
     → "internal error: AttributeError … a bug in cordon"
   cordon-scanner agent | intel | sbom | bundle |          each prints its own help, exit 3
     advisories → one terse line
   whoami, sign-in errors, --judge and --upload help,      they say cordon-scanner login;
     several hints → "run `cordon login`" (no such         a test now fails if a message
     command; `cordon` on PyPI is another project)         names a `cordon` command
   cordon-scanner help → "invalid choice"                  the help command above
   every subcommand's --help → plain argparse              coloured headings, flags, values

   MAINTENANCE (not in the package, no released scan changed)
   the allowlist refresh read a rate-limited registry (HTTP 429) as the end of the list;
   pub.dev and RubyGems are now paced and retried, and an unreadable page fails its
   ecosystem instead of shortening it

Verify it

   wheel and sdist ... signed, SLSA build provenance; PyPI serves exactly what was uploaded
   images ............ signed keylessly with cosign, SLSA provenance
   SBOMs ............. sbom.cdx.json and sbom.spdx.json attached below
   install by hash ... pip install --require-hashes -r action/requirements.txt  (at the v0.5.1 tag)

Every change, in full: CHANGELOG.md, 0.5.1.