Skip to content

v0.7.1

Choose a tag to compare

View all tags
@emiliano-go emiliano-go released this 27 Jul 15:06
v0.7.1
This tag was signed with the committer’s verified signature.
emiliano-go Emiliano G.O.
GPG key ID: 5CC3B4C50D37E793
Verified
Learn about vigilant mode.
307f84a
This commit was signed with the committer’s verified signature.
emiliano-go Emiliano G.O.
GPG key ID: 5CC3B4C50D37E793
Verified
Learn about vigilant mode.

TL;DR

Eleven commits since v0.7.0: database migration for upgrades, a 40x batch-review speedup, IDN homograph false-positive fix, lazy version loading, connection caching, concurrent prefetch, AUR RPC support, drift detection, test dedup (173 lines removed), docstrings on every function, dead code cleanup, and ruff E402 fixes.

Added

  • Database schema migration for current_maintainer. A migration step
    (_migrate + _ADDED_COLUMNS) now safely adds columns that were introduced
    after the initial schema shipped. Existing databases created before
    current_maintainer existed will have it added on the first run, fixing a
    crash on upgrade.

  • Concurrent prefetch of AUR repositories. The batch-review path clones or
    fetches all package repos in parallel before beginning analysis, so the
    network latency of 20 sequential fetches no longer dominates the runtime.

  • AUR RPC helpers. get_aur_package_info and get_aur_latest_versions
    batch-query the AUR RPC interface, replacing individual per-package lookups
    and reducing network round-trips.

  • Drift detection for shipped rules. drifted_shipped_rules() compares the
    on-disk rules.toml against the shipped template, flagging when a rule
    definition has drifted from the canonical copy.

  • diff_truncated field on PackageFact. Marks analyses where the diff
    was truncated, so the report can indicate the change was only partially
    examined.

  • Test fixtures shared via conftest.py. SHARED_RULES (R001-R013) and
    SHARED_CONFIG are now defined once and imported by four test files,
    removing 173 lines of duplication.

Fixed

  • IDN homograph false positive. has_homograph() no longer flags
    single-script labels containing non-ASCII Latin letters or combining marks.
    Only mixed-script labels are confusables per UTS #39 Highly Restrictive.
    Legitimate IDNs like münchen.de and café.fr are no longer reported.

  • PKGBUILD check() function. Now builds a venv, installs the built wheel,
    and runs pytest. The previous bare python -m pytest call failed against an
    uninstalled source tree.

Changed

  • _is_current uses HEAD commit time as fallback. Clones from earlier
    versions had no marker file and triggered a redundant git fetch for every
    package. Cutting this from 19 network round-trips to zero drops the batch
    review wall clock from ~2min to ~3s for a 19-package run.

  • _ensure_init runs init once per process. Previously
    ensure_default_configs() and init_db() ran on every analyze_package()
    call. Now they run once per process, saving ~100-200ms per package.

  • R066 (_package_is_new) capped at 100 commits. The brand-new-package
    check previously walked the entire DAG to find the root commit. Packages with
    more than 100 commits are now skipped, eliminating full-history walks that
    cost ~30-50s for packages with thousands of commits.

  • Thread-local connection caching. Database connections are cached per
    thread rather than opened per query. The hot paths issue thousands of small
    reads; opening a connection once instead of per query reduces overhead from
    ~0.35ms to effectively zero on repeat use.

  • Lazy __version__ loading. The version string is now loaded via PEP 562
    __getattr__ instead of importlib.metadata.version() at import time,
    avoiding a 46ms penalty on every import trustsight.

  • Pattern cache in rules.py. Compiled regex patterns are cached across
    diffs, avoiding repeated re.compile calls that dominated the diff-analysis
    hot path.

  • Typosquat detection uses top_dependency_pairs(). The rank-and-compare
    loop now fetches name-count pairs in a single query instead of running one
    query per candidate, fixing a performance regression on large databases.

Removed

  • Dead code and duplicate patterns. parse_srcinfo_with_pkgbase (uncalled)
    and several unreachable lines were removed. _PINNING_ORDER was unified in
    buckets.py; risk_level() is now the single source of truth.

  • .seo-debug/ tracked artifacts. Documentation JSON files committed by a
    prior zensical run are removed from the index and gitignored.

Style

  • Ruff E402 violations resolved. log = logging.getLogger(__name__) was
    moved below all imports. Exception handlers narrowed from
    except BaseException to except Exception.

Documentation

  • Docstrings added to all 124 functions across 19 source files, covering
    every public and private function including inner closures.

Build

  • .gitignore updated for makepkg artifacts. packaging/aur/pkg/,
    packaging/aur/src/, *.tar.gz, and *.pkg.tar.* are now ignored.

Stats

  • 11 commits since v0.7.0
  • 739 tests (25 files), all passing
  • Package version 0.7.1
Assets 2
Loading