Metadata-Version: 2.4
Name: etribe-bancoppel
Version: 0.3.0
Summary: Librería utilitaria para operaciones básicas - POC BanCoppel
Author-email: Arturo Gutierrez Rubio Rojas <agr.rojas@etribe.com>
License: MIT
Project-URL: Homepage, https://github.com/techoffice-beep/etribe-bancoppel-poc
Project-URL: Repository, https://github.com/techoffice-beep/etribe-bancoppel-poc
Keywords: bancoppel,etribe,utilities
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: MIT License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
Dynamic: license-file

# 🏦 etribe-bancoppel

> Governed & Secure Utility Library — POC BanCoppel

---

## 🚀 etribe-bancoppel v0.2.0 — Secure Release

Librería utilitaria con **cadena de suministro verificada** y análisis de vulnerabilidades potenciado por **IA (Claude)**. Cada release pasa por un pipeline de seguridad enterprise-grade antes de publicarse.

---

## 🔐 Supply Chain Security

|  | Control | Herramienta | Estado |
|:--:|:--------|:------------|:------:|
| 🛡️ | SAST (Static Analysis) | Bandit | ✅ Gate HIGH/CRITICAL |
| 📦 | SCA (Dependencies) | pip-audit | ✅ Gate HIGH/CRITICAL |
| 🧱 | SBOM | SPDX + Cosign OIDC | ✅ Firmado Keyless |
| 🔐 | Provenance | SLSA in-toto + Cosign | ✅ Firmada + Verificada |
| 🤖 | AI Security Analysis | Claude (Anthropic) | ✅ En caliente |
| 🏗️ | Build Isolation | GitHub Actions | ✅ Jobs separados |
| 📋 | Audit Reports | Auto-commit | ✅ Historial en `reports/` |

### 🧠 AI-Powered Vulnerability Analysis

Cuando el pipeline detecta vulnerabilidades, **Claude analiza automáticamente**:

```text
┌─────────────────────────────────────────────────────┐
│  Bandit scan  ──┐                                    │
│                 ├──→ 🤖 Claude API ──→ Análisis:    │
│  pip-audit    ──┘         │                          │
│                           ├── Resumen ejecutivo      │
│                           ├── Riesgo real            │
│                           ├── Prioridad remediación  │
│                           └── Fix recomendado        │
└─────────────────────────────────────────────────────┘
```

### 📜 Verificación de firma

```bash
# Verificar SBOM
cosign verify-blob \
  --bundle sbom.spdx.bundle \
  --certificate-identity-regexp "github.com/techoffice-beep/etribe-bancoppel-poc" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  sbom.spdx.json
```

---

## ⚡ Instalación

```bash
pip install etribe-bancoppel
```

---

## 🚀 Uso rápido

```python
from etribe_bancoppel import hello, add, subtract, multiply, version

# Saludo personalizado
print(hello("BanCoppel"))  # → "Hola, BanCoppel!"

# Operaciones matemáticas
print(add(2, 3))        # → 5
print(subtract(10, 4))  # → 6
print(multiply(3, 7))   # → 21

# Versión
print(version())  # → "0.2.0"
```

---

## 📐 API Reference

| Función | Descripción | Input | Output |
|:--------|:------------|:------|:-------|
| `hello(name)` | Saludo personalizado | `str` | `"Hola, {name}!"` |
| `add(a, b)` | Suma | `float, float` | `float` |
| `subtract(a, b)` | Resta | `float, float` | `float` |
| `multiply(a, b)` | Multiplicación | `float, float` | `float` |
| `version()` | Versión actual | — | `str` |

---

## 🔄 Pipeline de Seguridad

```text
  ┌──────────┐    ┌──────────┐    ┌──────────┐    ┌──────────┐
  │  Push    │───▶│  Scans   │───▶│  Build   │───▶│  Sign    │
  │  main    │    │ SAST+SCA │    │ Isolated │    │ SBOM+    │
  └──────────┘    └────┬─────┘    └──────────┘    │ Provenance│
                       │                           └─────┬────┘
                       ▼                                 │
                 ┌──────────┐                            ▼
                 │  🤖 AI   │                     ┌──────────┐
                 │  Claude  │                     │ Publish  │
                 │ Analysis │                     │  PyPI    │
                 └──────────┘                     └──────────┘
```

### Flujo detallado

| Paso | Job | Qué hace |
|:----:|:----|:---------|
| 1 | Security Scans | Bandit (SAST) + pip-audit (SCA) + Gate |
| 2 | AI Analysis | Claude analiza vulnerabilidades detectadas |
| 3 | Build | Genera wheel/sdist + SHA256 hashes |
| 4 | Provenance | Genera SLSA in-toto + firma Cosign OIDC |
| 5 | SBOM | Genera SPDX + firma Cosign OIDC + verificación |
| 6 | Publish | Publica a PyPI con API token |
| 7 | Release | Tag + Summary |

---

## 🏗️ Arquitectura de Supply Chain

```text
┌─────────────────────────────────────────────────────────────┐
│  🛡️ Security Layer                                          │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────────────┐ │
│  │ Bandit SAST │  │ pip-audit   │  │ 🤖 Claude AI        │ │
│  │ Code Vulns  │  │ Dep Vulns   │  │ Risk Analysis       │ │
│  └─────────────┘  └─────────────┘  └─────────────────────┘ │
├─────────────────────────────────────────────────────────────┤
│  🏗️ Build Layer                                             │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────────────┐ │
│  │ Isolated    │  │ SHA256      │  │ Dependency Lock     │ │
│  │ Build Job   │  │ Hashes      │  │ with Hashes         │ │
│  └─────────────┘  └─────────────┘  └─────────────────────┘ │
├─────────────────────────────────────────────────────────────┤
│  🔐 Signing Layer                                           │
│  ┌─────────────┐  ┌─────────────┐  ┌─────────────────────┐ │
│  │ SBOM (SPDX) │  │ Provenance  │  │ Cosign OIDC         │ │
│  │ Signed      │  │ (in-toto)   │  │ Keyless Signing     │ │
│  └─────────────┘  └─────────────┘  └─────────────────────┘ │
├─────────────────────────────────────────────────────────────┤
│  📦 Distribution Layer                                      │
│  ┌─────────────────────────────────────────────────────────┐│
│  │ PyPI Publish + Git Tag + Audit Reports                  ││
│  └─────────────────────────────────────────────────────────┘│
└─────────────────────────────────────────────────────────────┘
```

---

## 📊 Security Metrics

| Métrica | Valor |
|:--------|:------|
| Dependencias externas | 0 (core) |
| Vulnerabilidades conocidas | 0 |
| SBOM firmado | ✅ Cosign OIDC |
| Provenance firmada | ✅ in-toto + Cosign |
| Build aislado | ✅ Job separado |
| AI Analysis | ✅ Claude (Anthropic) |
| Nivel SLSA | Level 1 + signed provenance |

---

## 📄 Licencia

MIT

---

## 👤 Autor

**Arturo Gutierrez Rubio Rojas** — [etribe](https://etribe.com)

---

```text
                    Built with 🔐 by etribe
         Secure Software Supply Chain — POC BanCoppel
              https://pypi.org/project/etribe-bancoppel/
```
