Skip to content

v0.7.0

Choose a tag to compare

View all tags
@emiliano-go emiliano-go released this 26 Jul 08:11
v0.7.0
This tag was signed with the committer’s verified signature.
emiliano-go Emiliano G.O.
GPG key ID: 5CC3B4C50D37E793
Verified
Learn about vigilant mode.
fa8a32f
This commit was signed with the committer’s verified signature.
emiliano-go Emiliano G.O.
GPG key ID: 5CC3B4C50D37E793
Verified
Learn about vigilant mode.

TL;DR

Eleven new rules across four rule families (temporal, install/build/maintainer, naming, dependency-set), seven crash-bug fixes, python -m trustsight support, and fire rates measured for R068-R073 on the 3246-diff benign corpus.

Added

  • Temporal context rules (R065-R067). Three code-emitted rules that inspect git commit timestamps on the AUR repository rather than diff content. All are on by default with no config toggle.

    Rule Name Severity Condition
    R065 Very Recent Update INFO (w 0) HEAD commit < 72 h old
    R066 Brand New Package INFO (w 0) First AUR commit < 30 days old
    R067 Stale Package Revived MEDIUM (w 15) Gap to last analyzed commit > 365 days

  • Install, build, and maintainer rules (R068-R073). Six code-emitted rules that inspect install hooks, GPG verification removal, build environment subversion, maintainer takeovers, capability density, and release cadence.

    Rule Name Severity Category Condition
    R068 Install Hook Present INFO (w 0) context PKGBUILD declares install= or diff touches *.install
    R069 GPG Verification Removed HIGH (w 25) integrity validpgpkeys populated before, empty/absent after
    R070 Build Environment Subversion HIGH/MEDIUM (w 25/15) build LD_PRELOAD/LD_LIBRARY_PATH (HIGH) or CFLAGS/LDFLAGS/MAKEFLAGS/PATH (MED) set inside build function
    R071 Untrusted Maintainer Takeover HIGH (w 25) maintainer Maintainer changed + new maintainer globally novel
    R072 Capability Density Anomaly INFO (w 0) meta Rule hits span 3+ distinct categories
    R073 Accelerated Release Cadence metadata (never scored) temporal-metadata HEAD has 3+ ancestors in the last 24 h

    All R068-R073 are always on, gated only by diff content or database
    maturity rather than an experimental flag.

  • Naming and dependency-set rules (R074-R075). Two code-emitted rules that detect package-name typosquatting and aggregate dependency-set expansion. Both are always on, gated only by a cold-start maturity check.

    Rule Name Severity Category Condition
    R074 Package-Name Typosquat HIGH (w 25) naming Name within edit-distance 2 of a far-more-popular package, not a variant
    R075 Dependency-Set Expansion MEDIUM (w 15) dependency Diff adds 3+ deps whose count x mean-rarity exceeds gate (>= 1.5)

    R074 uses seed popularity data and requires a warmed database. R075 is fully corpus-calibratable.

  • Fire rates measured for R068-R075 on the 3246-diff benign corpus. All scored rules pass the 30% gate:

    Rule Severity Fire rate Hits
    R068 INFO 20.95 % 680/3246
    R069 HIGH 0.03 % 1/3246
    R070 HIGH/MED 0.25 % 8/3246
    R072 INFO 15.87 % 515/3246
    R074 HIGH 1.12 % 2/179 pkgs
    R075 MEDIUM 0.34 % 11/3246

    R071 and R073 require live git history and are marked TBD in fire-rates.md.

  • python -m trustsight support. Added src/trustsight/__main__.py so the tool works with python -m trustsight in addition to the installed CLI script.

Fixed

  • Seven crash bugs (B1-B6, B10) that prevented the tool from running on unusual package states or missing dependencies:

    ID Issue Fix
    B1 pygit2.GitError raised NameError at runtime because pygit2 was not imported in analysis.py Added import pygit2 at module level
    B2 generate_diff crashes on stale commit OIDs that produce None commits Guard against None before accessing .tree
    B3 get_head_commit propagates GitError for empty/unborn repos Wrapped in try/except, returns "" on failure
    B4 One bad package in a batch aborts the entire scan Per-package try/except around analyze_package in CLI loop
    B5 Tool crashes on startup when rich is not installed Guard console() and fallback paths with HAS_RICH checks
    B6 Seed-import message leaks into JSON stdout with --json Pass quiet=True to maybe_auto_import_seed in JSON mode
    B10 _simple_vercmp compares version parts lexicographically (e.g. 9 > 10) Parse as integers before comparison

  • old_version was hardcoded to empty string. Now queries pacman -Q to populate the installed version, so the LLM verdict shows the correct version range.

  • Stored empty commit treated as "no history" on every subsequent run, looping back to _make_fresh_analysis. Changed the guard to distinguish "no record" from "record with empty commit."

  • Zero-line diff shown unconditionally even when no diff was computed. Now guarded behind lines_added or lines_removed.

  • fallback_verdict() always said "Version bump" regardless of whether version data existed. Now checks first_seen and returns a context-appropriate message.

  • python-openai moved to optdepends to avoid httpx conflict with the httpx CLI package. The import is lazy, so the conflict only arises when verdict generation is invoked, not at CLI startup.

  • D001/D004 tests now seed enough observations to fire correctly after the default-true promotion in v0.6.1.

Stats

  • 11 commits since v0.6.1
  • 702 tests (19 files), all passing
  • Package version 0.7.0
Assets 2
Loading