tests/test_public_clean.py

#!/usr/bin/env python3 """ test_public_clean.py - nothing private may ride along in a public download. This package is built beside private tooling that legitimately has a network lane, internal hostnames and a call-back path. None of that may cross into the download, and the risk is not that someone copies a module - it is that a COMMENT explaining a bug fix names a real machine. That is exactly what happened: a docstring explaining the project-directory fix named two internal hosts, and an example in --help used an internal machine name as its sample query. Three promises are checked here: 1. NO NETWORK. No URLs, no bare hostnames, no networking modules, no transport code at all. 2. NOTHING PRIVATE. No internal hostnames, no private address ranges, no internal product names, no in-group vocabulary - in code OR in comments. 3. NOBODY NAMED. Not the tools this one replaces, not their authors. Behaviour is described; nobody is named. The single exception is a literal path or directory name an importer must match to find a store on disk. That is data, it lives in the source table, and it lives nowhere else. The file list comes from build.py, so this checks exactly the bytes that ship. python3 tests/test_public_clean.py """ from __future__ import annotations import re import sys from pathlib import Path ROOT = Path(__file__).resolve().parent.parent # Assembled so this file does not trip the very check it performs. SCHEME = "htt" + "p" URL_RE = re.compile(SCHEME + "s?://") NET_MODULES = ("urllib", "socket", "requests", "http.client", "httpx", "websocket", "ftplib", "smtplib", "telnetlib", "xmlrpc") # Internal names that must never appear in something a stranger downloads. # Assembled, not written out - this file greps the package for these strings, so # spelling them literally would make the checker match itself. Same reason the URL # needle is built from parts. HOUSE = tuple(a + b for a, b in ( ("con", "do"), ("cit", "adel"), ("queen", "-x1"), ("queen", "x1"), ("kot", "-x1"), ("friday", "-brain"), ("tanks", "lab"), ("hey", "neo"), ("call", "home"), ("sealed", "_envelope"), ("swarm", "_conductor"), ("friday", "-on-box"), ("friday", "-console"), ("dom", "in"), # In-group vocabulary shipped in a docstring describing a feature this package # does not even contain. To a stranger it read as "this tool calls back to # machines its authors own" - the exact opposite of what the code does. Private # vocabulary is a leak even when the code itself is clean. ("fle", "et"), ("the ho", "use"), )) # Vendor names of tools this one replaces. Same rule: describe behaviour, name nobody. VENDOR = tuple(a + b for a, b in ( ("claude", "-mem"), ("cm", "em"), ("thedot", "mack"), ("neo", "-mcp"), ("post", "hog"), ("sync", "hub"), )) PRIVATE_NET = re.compile(r"\b(?:192\.168|10\.\d+|172\.(?:1[6-9]|2\d|3[01]))\.") # A HOSTNAME WITHOUT A SCHEME IS STILL A HOSTNAME. # The URL needle only catches a scheme, so a comment mentioning a bare API host # passed every check while sitting in a package whose headline promise is that it # never talks to anything. A reader auditing the source finds it and has to work out # whether the promise is true. Do not make them. BARE_HOST = re.compile( r"\b[a-z0-9][a-z0-9-]*(?:\.[a-z0-9-]+)*\.(?:com|net|org|io|dev|app|cloud)\b", re.I) def _shipped_files() -> tuple[list[Path], str]: """Exactly the files build.py will package - asked of build.py, not guessed. This used to be a hand-written suffix list (.py/.md/.toml/.txt). build.py packages by a different rule, so the two could disagree, and anything that shipped with an unlisted extension was never checked at all. A promise about "the bytes the site serves" has to be tested against the bytes that ship, or it is a promise about a different set of files than the one being published. Falls back to scanning everything if build.py cannot be imported - wider, never narrower, because the failure mode of this test must be a false alarm and not a false all-clear. """ try: sys.path.insert(0, str(ROOT)) import build return [f for f in build.sources(ROOT)], "build.py" except Exception: return ([f for f in ROOT.rglob("*") if f.is_file() and "__pycache__" not in str(f)], "fallback scan") def main() -> int: fails: list[str] = [] shipped, how = _shipped_files() files = [f for f in shipped if f.name != Path(__file__).name] for f in files: try: text = f.read_text(encoding="utf-8", errors="replace") except Exception: continue # a binary asset has no prose to leak rel = f.relative_to(ROOT) for i, line in enumerate(text.splitlines(), 1): if URL_RE.search(line): fails.append(f"URL in {rel}:{i}") if PRIVATE_NET.search(line): fails.append(f"private address in {rel}:{i}") for m in BARE_HOST.finditer(line): fails.append(f"hostname {m.group(0)!r} in {rel}:{i}") low = line.lower() for h in HOUSE: if h in low: fails.append(f"name {h!r} in {rel}:{i}") for v in VENDOR: if v not in low: continue # THE ONE CARVE-OUT: an importer that must find a file on disk has to # contain that file's path. A literal string it matches against is DATA. # It is allowed ONLY in the source table, and ONLY on a line that is # actually a path - never in prose, a heading, a help line or a filename. if rel.name == "sources.py" and "Path.home()" in line: continue fails.append(f"name {v!r} in {rel}:{i}") if f.suffix == ".py": for m in NET_MODULES: if re.search(rf"^\s*(?:import|from)\s+{re.escape(m)}\b", text, re.M): fails.append(f"networking module {m!r} imported in {rel}") seen, unique = set(), [] for x in fails: if x not in seen: seen.add(x); unique.append(x) for x in unique[:25]: print(" FAIL " + x, file=sys.stderr) if unique: print(f"\nPUBLIC-CLEAN TEST FAILED ({len(unique)} finding(s))", file=sys.stderr) return 1 print(f"public-clean test OK - {len(files)} files (chosen by {how}):") print(" no URLs, no bare hostnames, no network modules, no internal names,") print(" no private addresses") return 0 if __name__ == "__main__": sys.exit(main())