Metadata-Version: 2.4
Name: chainprobe-guard
Version: 0.1.0
Summary: ChainProbe - Supply Chain Security Auditor
Author: ChainProbe Contributors
License: Apache-2.0
Keywords: security,supply-chain,sbom,vulnerability
Requires-Python: >=3.10
Description-Content-Type: text/markdown
License-File: LICENSE
Provides-Extra: dev
Requires-Dist: pytest>=7.0; extra == "dev"
Requires-Dist: pytest-cov>=4.0; extra == "dev"
Requires-Dist: ruff>=0.1.0; extra == "dev"
Dynamic: license-file

# RegistryPulse

**Package Registry Infrastructure Toolkit**

[![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)
[![Python 3.10+](https://img.shields.io/badge/python-3.10+-blue.svg)](https://www.python.org/downloads/)
[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/registrypulse/registrypulse/badge)](https://securityscorecards.dev/viewer/?uri=github.com/registrypulse/registrypulse)

RegistryPulse is an open-source infrastructure toolkit that monitors, secures, and audits package registries across all major ecosystems. It provides health monitoring, dependency analysis, provenance verification, and policy enforcement through a single unified interface.

## Why RegistryPulse?

Package registries are the backbone of modern software development, yet they lack standardized tooling for:

- **Health monitoring** — No unified way to track registry uptime, latency, and availability
- **Dependency analysis** — Cross-registry dependency graphs are impossible to build
- **Provenance verification** — No standard way to verify package build integrity
- **Policy enforcement** — Organizations can't enforce registry policies at scale

RegistryPulse provides all of this through a single CLI tool, supporting **7 ecosystems** out of the box: npm, PyPI, Cargo, Go, RubyGems, Maven, and Packagist.

## Quick Start

```bash
# Install
pip install registrypulse

# Audit all registries
registrypulse audit --all

# Check registry health
registrypulse health --all

# Analyze a package's dependencies
registrypulse deps npm:express
registrypulse deps pypi:flask --depth 2

# Verify package provenance
registrypulse provenance cargo:serde

# Generate a registry-level SBOM
registrypulse sbom --format spdx-json -o registry-sbom.json

# Check organizational policies
registrypulse policy ./my-project
```

## Commands

| Command | Description |
|---------|-------------|
| `registrypulse audit` | Audit registries for security and operational health |
| `registrypulse health` | Check registry availability and latency |
| `registrypulse deps` | Analyze cross-registry dependency graphs |
| `registrypulse provenance` | Verify package build provenance |
| `registrypulse sbom` | Generate registry-level SBOMs |
| `registrypulse policy` | Enforce organizational registry policies |
| `registrypulse ecosystem` | Show supported ecosystems and status |

## Supported Ecosystems

| Ecosystem | Registry | Manifest Files |
|-----------|----------|----------------|
| npm | registry.npmjs.org | `package.json`, `package-lock.json` |
| PyPI | pypi.org | `requirements.txt`, `pyproject.toml` |
| Cargo | crates.io | `Cargo.toml`, `Cargo.lock` |
| Go | proxy.golang.org | `go.mod`, `go.sum` |
| RubyGems | rubygems.org | `Gemfile`, `*.gemspec` |
| Maven | repo1.maven.org | `pom.xml`, `build.gradle` |
| Packagist | packagist.org | `composer.json` |

## Policy Enforcement

Create a `registrypulse-policy.json` in your project root:

```json
{
  "rules": [
    {
      "id": "ALLOWED_REGISTRIES",
      "allowed_registries": ["npm", "pypi", "cargo"]
    },
    {
      "id": "LICENSE_COMPLIANCE",
      "blocked_licenses": ["GPL-3.0", "AGPL-3.0", "SSPL-1.0"]
    },
    {
      "id": "VERSION_PINNING"
    },
    {
      "id": "MAX_DEPTH",
      "max_depth": 5
    }
  ]
}
```

## Contributing

We welcome contributions! See [CONTRIBUTING.md](CONTRIBUTING.md).

## Security Policy

See [SECURITY.md](SECURITY.md) for vulnerability reporting.

## License

Apache License 2.0 — see [LICENSE](LICENSE).
