Metadata-Version: 2.1
Name: vigihq
Version: 0.1.47
Summary: Catch supply-chain attacks. One binary, no agent, no cloud.
Home-page: https://vigihq.com
Author: Modul4r Solutions
Author-email: support@vigihq.com
License: Proprietary
Project-URL: Documentation, https://vigihq.com/docs
Project-URL: Changelog, https://vigihq.com/changelog
Classifier: Development Status :: 5 - Production/Stable
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: System Administrators
Classifier: License :: Other/Proprietary License
Classifier: Operating System :: MacOS :: MacOS X
Classifier: Operating System :: Microsoft :: Windows
Classifier: Operating System :: POSIX :: Linux
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Quality Assurance
Requires-Python: >=3.8
Description-Content-Type: text/markdown

# vigihq

Vigilance reports the files that gained a power they did not have before, in
any part of the SDLC.

A supply chain attack hides one bad change inside a normal release. Everything
else in that release is genuine, so a list of changed files tells you nothing.
Vigilance does not hunt for known bad code and does not care about CVEs. It
reports the change that can now do something the last version could not.

```
pip install vigihq
vigi ./dist
```

The command is `vigi`. One binary, written in Go. It brings no Python
dependencies, opens no network connection, holds no credentials, and runs
nothing it reads. There is no AI in it.

## In CI

```
vigi ./dist --report vigi-report.html
vigi ./dist --deny network-shell --sarif
```

`--report` writes one plain HTML file, black on white, that prints and survives
a mail client. `--sarif` writes SARIF 2.1.0 for a code scanning pipeline. A file
holding a denied power raises an alarm and the run exits 5.

## Keeping watch

```
vigi setup
vigi watch /opt/app
vigi status
```

`setup` asks two questions, then installs a scheduled check using launchd,
systemd, cron or Task Scheduler, whichever the machine has. `status` says
whether those checks are alive and quiet.

## On a server

```
vigi dpkg
vigi rpm
```

Reads the package manager's own record and asks whether the files on disk match
what it says it installed. That record is root-owned, so it is a second witness
a payload running as you cannot edit.

Full documentation is at https://vigihq.com/docs

Commercial software. Free tier and Pro at https://vigihq.com
Questions go to support@vigihq.com
