feat: check PyPI packages for presence of a wheel file in malware metadata analysis#930

Closed

art1f1c3R wants to merge 505 commits intostagingfrom art1f1c3R/download-file-presence

+3-12

This pull request is big! We're only showing the most recent 250 commits

Commits on Sep 1, 2023

bump: release 0.3.0 → 0.4.0
behnazh-w
committed

Commits on Sep 8, 2023

Commits on Sep 13, 2023

fix(policy-engine): use component_id instead of repo_id in policy to find the check result (#473 )
behnazh-w
authored
chore(deps-dev): update hypothesis requirement from <6.82.7,>=6.21.0 to >=6.21.0,<6.84.4 (#470 )
dependabot[bot]
authored
chore(deps): bump actions/upload-artifact from 3.1.2 to 3.1.3 (#469 )
dependabot[bot]
authored
chore(deps): bump actions/checkout from 3.5.3 to 4.0.0 (#468 )
dependabot[bot]
authored
chore(deps-dev): update pre-commit requirement from <3.4.0,>=3.0.0 to >=3.0.0,<3.5.0 (#462 )
dependabot[bot]
authored
chore(deps): remove CVE-2023-40590 and CVE-2023-41040 from the ignore list (#459 )
behnazh-w
authored
feat: add a new check to map artifacts to pipelines (#471 )
behnazh-w
authored

Commits on Sep 14, 2023

Commits on Sep 21, 2023

Commits on Sep 22, 2023

test: adjust flaky test which relies on filesystem permissions (#481 )
nathanwn
authored

Commits on Sep 25, 2023

chore: resolve pylint unsubscriptable object issue (#485 )
nathanwn
authored

Commits on Oct 3, 2023

Commits on Oct 4, 2023

feat: support running the analysis with SBOM and the main software component with no repository (#165 )
tromai
authored

Commits on Oct 5, 2023

chore: add changesets/action for npm release (#503 )
behnazh-w
authored

Commits on Oct 10, 2023

feat: support gzipped provenance files (#504 )
nicallen
authored

Commits on Oct 13, 2023

chore: fix type correctness and remove many "type: ignore" directives (#509 )
nicallen
authored

Commits on Oct 18, 2023

chore: avoid running python dev scripts with system python (#520 )
nathanwn
authored

Commits on Oct 20, 2023

docs: add entries for npm, Yarn, and Go build tools (#525 )
behnazh-w
authored

Commits on Oct 25, 2023

Commits on Oct 26, 2023

fix: do not use git set-branches if the target branch is not currently available in the repository (#491 )
tromai
authored

Commits on Oct 27, 2023

Commits on Oct 31, 2023

refactor!: allow the branch name in the schema of a repository to be null (#532 )
behnazh-w
authored

Commits on Nov 1, 2023

fix: resolve podman compatibility issues (#512 )
nathanwn
authored

Commits on Nov 3, 2023

Commits on Nov 13, 2023

test: replace some micronaut-core tests with micronaut-test to reduce integration test time (#552 )
behnazh-w
authored

Commits on Nov 14, 2023

Commits on Nov 23, 2023

feat: find SLSA provenance v0.2 published on npm registry (#551 )
behnazh-w
authored

Commits on Nov 24, 2023

Commits on Dec 5, 2023

chore(deps-dev): update pre-commit hooks (#564 )
behnazh-w
authored

Commits on Dec 18, 2023

feat: map artifacts to commits via repo tags (#508 )
benmss
authored

Commits on Dec 20, 2023

chore(deps): bump actions/download-artifact from 3.0.2 to 4.0.0 (#574 )
dependabot[bot]
authored

Commits on Dec 22, 2023

Commits on Jan 4, 2024

chore: move return code check in integration test script to the end (#590 )
nathanwn
authored

Commits on Jan 5, 2024

Commits on Jan 8, 2024

Commits on Jan 10, 2024

docs: add the link to the demo (#596 )
behnazh-w
authored

Commits on Jan 11, 2024

feat: generate Verification Summary Attestation (#592 )

nathanwn
and
behnazh-w
authored

Commits on Jan 12, 2024

test: add docker integration test for VSA generation feature (#598 )
nathanwn
authored

Commits on Jan 15, 2024

feat: support tox to publish artifacts to PyPI (#599 )
behnazh-w
authored

Commits on Jan 18, 2024

Commits on Jan 23, 2024

docs: regenerate ToC (#613 )
jsoref
authored

Commits on Jan 24, 2024

chore: fix spelling errors (#612 )
jsoref
authored

Commits on Jan 25, 2024

chore: improve token import (#605 )
benmss
authored

Commits on Feb 6, 2024

docs: add link to database schema on output files page (#628 )
nicallen
authored

Commits on Feb 8, 2024

chore: improve build command output (#627 )
nicallen
authored

Commits on Feb 9, 2024

feat: use repository url provided as input for finding a commit (#622 )
benmss
authored

Commits on Feb 14, 2024

feat: follow indirect repository URLs (#629 )
benmss
authored

Commits on Feb 15, 2024

feat!: introduce confidence scores for check facts (#620 )
behnazh-w
authored

Commits on Feb 21, 2024

feat: add exclude and include check in ini config (#254 )
tromai
authored

Commits on Feb 27, 2024

Commits on Feb 28, 2024

chore: explicitly git init with the master branch in tests requiring it (#589 )
nathanwn
authored

Commits on Mar 1, 2024

chore: add provenance as an input CLI option (#654 )
tromai
authored

Commits on Mar 4, 2024

Commits on Mar 8, 2024

fix: preserve the order of elements of lists extracted from defaults.ini (#660 )
tromai
authored

Commits on Mar 15, 2024

docs: add exclude include check feature tutorial (#667 )
tromai
authored

Commits on Mar 20, 2024

chore(deps): update slsa-verifier to v2.4.1 (#674 )
behnazh-w
authored

Commits on Apr 2, 2024

feat: extend static analysis and compute confidence scores for deploy commands (#673 )
behnazh-w
authored

Commits on Apr 4, 2024

chore: update deps.dev repo finder to use latest API. (#679 )
benmss
authored

Commits on Apr 8, 2024

chore: improve commit finder accuracy (#687 )
benmss
authored

Commits on Apr 10, 2024

Commits on Apr 11, 2024

Commits on Apr 12, 2024

fix: fix a compatibility issue in run_macaron.sh for macOS (#701 )
behnazh-w
authored

Commits on Apr 17, 2024

Commits on Apr 18, 2024

chore: allow independent extraction of repo and commit from provenance (#708 )
benmss
authored

Commits on Apr 19, 2024

feat: allow provenance files to be files containing a URL pointing to the actual provenance file which will be transparently downloaded (#710 )
nicallen
authored

Commits on Apr 21, 2024

fix: extract digest from provenance when repo path is provided but digest is not provided from the user (#711 )
tromai
authored

Commits on Apr 22, 2024

Commits on Apr 23, 2024

Commits on Apr 24, 2024

chore: improve log message for build checks (#718 )
behnazh-w
authored

Commits on Apr 26, 2024

fix: improve run_macaron.sh bash and docker version compatibility (#717 )
nicallen
authored

Commits on Apr 29, 2024

Commits on May 8, 2024

feat: add support for GitHub provenances passed as input (#732 )
behnazh-w
authored

Commits on May 14, 2024

fix: do not fetch from origin/HEAD for local repo targets (#734 )
behnazh-w
authored

Commits on May 15, 2024

Commits on May 23, 2024

chore: replace use of actionlint parser in golang for GitHub Workflow files, with a combination of yaml parsing and jsonschema validation in python. (#742 )
nicallen
authored

Commits on May 24, 2024

Commits on May 27, 2024

chore(deps): update slsa-verifier to v2.5.1 (#749 )
behnazh-w
authored

Commits on May 29, 2024

docs: update required go version to 1.21 (#756 )
nathanwn
authored

Commits on May 30, 2024

chore: improve log messages for local repositories (#753 )
behnazh-w
authored

Commits on Jun 4, 2024

chore: validate input repo, commit, provenance to ensure they match (#739 )
benmss
authored

Commits on Jun 10, 2024

chore: remove outdated TODO in repo finder function (#759 )
benmss
authored

Commits on Jun 13, 2024

chore: convert expectation files to policies and use in integration tests (#760 )
benmss
authored

Commits on Jun 18, 2024

Commits on Jun 24, 2024

Commits on Jul 3, 2024

Commits on Jul 4, 2024

Commits on Jul 15, 2024

chore: restrict malware check to python projects; apply general fixes… (#790 )
benmss
authored

Commits on Jul 16, 2024

chore: update django dependency policy to ignore minor version changes (#795 )
benmss
authored

Commits on Jul 17, 2024

chore: wrap up integration tests conversion (#782 )
tromai
authored

Commits on Jul 22, 2024

chore(mypy): remove redundant mypy_path configuration for type checking (#799 )
behnazh-w
authored

Commits on Jul 23, 2024

fix: use artifact filenames as keys for verifying jfrog assets in provenance_witness_l1_check (#796 )
tromai
authored

Commits on Jul 25, 2024

feat: verify npm SLSA provenance against signed npm provenance (#747 )
benmss
authored

Commits on Jul 30, 2024

Commits on Jul 31, 2024

Commits on Aug 9, 2024

docs: exclude hyphenated attributes in sphinx docs (#818 )
benmss
authored

Commits on Aug 12, 2024

docs: add a tutorial for malware detection check (#816 )
behnazh-w
authored

Commits on Aug 13, 2024

docs: emphasize Python 3.11 requirement for Python dep analysis (#825 )
behnazh-w
authored

Commits on Aug 14, 2024

chore: refactor provenance available check (#791 )
benmss
authored

Commits on Aug 16, 2024

Commits on Aug 27, 2024

chore: update third party license file for v0120 (#842 )
tromai
authored

Commits on Sep 3, 2024

Commits on Sep 9, 2024

test: disable mcn_infer_artifact_pipeline_1 for guava (#857 )
behnazh-w
authored

Commits on Sep 11, 2024

Commits on Sep 16, 2024

Commits on Sep 19, 2024

chore: move pom parser to parsers module (#863 )
benmss
authored

Commits on Sep 23, 2024

Commits on Sep 25, 2024

Commits on Sep 27, 2024

fix: prevent endless loop on 403 GitHub response (#866 )
benmss
authored

Commits on Sep 30, 2024

Commits on Oct 3, 2024

chore: fix pylint message else-if-used (#888 )
jenstroeger
authored

Commits on Oct 10, 2024

fix: fix a bug in GitHub Actions matrix variable resolution (#896 )
behnazh-w
authored

Commits on Oct 24, 2024

chore(deps): Update Go to v1.23 and golangci-lint to v1.61.0 (#905 )
behnazh-w
authored

Commits on Oct 28, 2024

feat: verify whether the reported repository can be linked back to the artifact (#873 )
mabdollahpour-ol
authored

Commits on Nov 4, 2024

Commits on Nov 11, 2024

feat: add command to run repo and commit finder without analysis (#827 )
benmss
authored

Commits on Nov 15, 2024

chore: update 3rd party license on deps.dev (#919 )
tromai
authored

Commits on Nov 22, 2024

Commits on Nov 25, 2024

Commits on Nov 26, 2024

Commits on Nov 29, 2024