Metadata-Version: 2.4
Name: rust-audit
Version: 0.2.4
Summary: Static auditor and auto-fixer for AI-generated Rust traps — stubs, fake tests, swallowed errors, panic/unsafe misuse, hallucinated or typosquatted crates
Author-email: Antonio Cantallops Alba <contact@exyonq.org>
License-Expression: Apache-2.0
Project-URL: Homepage, https://github.com/Doken-Tokuyama/Rust-Audit
Project-URL: Source, https://github.com/Doken-Tokuyama/Rust-Audit
Project-URL: Issues, https://github.com/Doken-Tokuyama/Rust-Audit/issues
Project-URL: Documentation, https://github.com/Doken-Tokuyama/Rust-Audit/blob/main/SKILL.md
Keywords: rust,audit,linter,static-analysis,ai-generated-code,supply-chain,typosquatting,agent-skills
Classifier: Development Status :: 4 - Beta
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Operating System :: MacOS
Classifier: Operating System :: Microsoft :: Windows
Classifier: Operating System :: POSIX :: Linux
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Software Development :: Quality Assurance
Classifier: Typing :: Typed
Requires-Python: >=3.11
Description-Content-Type: text/markdown
License-File: LICENSE
Provides-Extra: dev
Requires-Dist: pytest>=7.4.0; extra == "dev"
Dynamic: license-file

# Rust Audit

Auditor and auto-fixer for **AI-generated Rust code**: stubs, demo code, fake
tests, fakes/mocks leaking into production, panic/unsafe misuse, swallowed
errors, async pitfalls, and fake / hallucinated / typosquatted dependencies
(slopsquatting).

Python 3.11+ stdlib only — no dependencies. English output.

## Install

```bash
pipx install rust-audit      # or: pip install rust-audit
rust-audit selftest          # prints `selftest PASS`
```

From PyPI as **`rust-audit`**, whose wheel installs both commands: `rust-audit`
and `rustaudit` run the same module. There is no separate one-word project on
PyPI — it answers "This project name is too similar to an existing project" —
so the spelling is served by this package's own entry point.
Nothing is fetched or executed at install time, and
the wheel carries the same `rust_audit.py` as the signed release asset — so the
verify-before-use chain below still applies to the script you download.

## Quick start

```bash
# 0) verify before use — check the exact audited bytes before executing them
#    (key pin -> SSH signature -> checksum -> tag identity) and proceed only
#    on VERIFIED (exit 0); see SECURITY.md for the pinned key and the chain
scripts/verify_release.sh v0.2.4 ./rust_audit.py

python3 scripts/rust_audit.py selftest
python3 scripts/rust_audit.py scan  <rust-project> --format terminal,md,json,sarif --fail-on high
python3 scripts/rust_audit.py fix   <rust-project> --dry-run
python3 scripts/rust_audit.py cargo <rust-project> --deep --supply-chain
```

Exit codes: `0` clean · `1` findings at/above `--fail-on` · `2` execution error.
Every run writes a **not-executed report** (`report/not-executed-<date>.md`)
listing the checks that could not run and how to enable them — read it before
calling an audit complete.

As a Freebuff agent skill: install `rust-audit` into Freebuff on any machine
by following [docs/freebuff-skill-install.md](docs/freebuff-skill-install.md).

## Tests

Production E2E suite: the real CLI audited against real Rust workspaces
(`BurntSushi/ripgrep` and `tokio-rs/tokio`, each pinned by commit — no demo
fixtures), with per-project goldens. Needs network to fetch the pinned
workspaces, Python 3.11+ and pytest in a venv:

```bash
python3 -m venv .venv && .venv/bin/pip install pytest
.venv/bin/python -m pytest tests/
```

See [SKILL.md](SKILL.md) for the rule catalog (R01–R21), the auto-fix policy,
the CI templates and the honest limitations.

## Security

The trust model is explicit: what executes (literal `cargo` argv, no shell),
what leaves the machine (opt-in `--online` registry/OSV lookups only) and
what writes to disk (transactional `fix`). See [SECURITY.md](SECURITY.md) —
including the notes for static skill auditors.

Release assets are **SSH-signed**: an install can verify it has the exact
audited `rust_audit.py` with preinstalled `ssh-keygen` alone — commands and
the pinned signing key live in [SECURITY.md](SECURITY.md#release-attestation-v020--verify-the-exact-audited-bytes).

Hardened scanners can enforce the static-only contract in code: every
subcommand accepts **`--no-exec`**, under which process creation is
impossible (one guarded entry point refuses every spawn) and each check that
would have executed is recorded as *skipped* in the not-executed report.

## License

Apache License 2.0 — see [LICENSE](LICENSE).
Copyright (c) 2026 Antonio Cantallops Alba · contact@exyonq.org
