软件供应链安全：你的依赖里藏着多少把刀

# Python 项目：生成完整依赖树（含间接依赖）
pip install pipdeptree
pipdeptree --json-tree > deps-tree.json

# 扫描已知漏洞（包括间接依赖）
pip install pip-audit
pip-audit -r requirements.txt --desc

# npm 项目同理
npm audit --json > npm-audit.json
npx npm-remote-ls your-package  # 查看间接依赖树

# CI 中校验 hash
pip-audit -r requirements.lock
sha256sum -c requirements.lock.sha256

# pip.conf — 优先内部仓库，公开 PyPI 只取白名单包
# 文件位置: ~/.pip/pip.conf 或 /etc/pip.conf

[global]
index-url = https://your-internal-mirror.example.com/simple/
extra-index-url = https://pypi.org/simple/

# 更安全的做法：只用内部镜像，完全不连公网 PyPI
# 在 CI 环境中：
[global]
index-url = https://your-internal-mirror.example.com/simple/
# 不设置 extra-index-url，彻底切断外部源

// .npmrc
registry=https://your-internal-npm.example.com/
// 白名单包才从公网拉取
// 严格模式下直接禁用公网源

name: supply-chain-gate

on:
  pull_request:
  push:
    branches: [main]

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        # 锁定 hash，防止 action 本身被篡改
        # 使用 commit SHA 而不是 tag

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install tools
        run: pip install pip-audit pipdeptree

      - name: Audit dependencies
        run: |
          # 检查已知漏洞
          pip-audit -r requirements.lock --strict
          # 生成依赖树供人工复查
          pipdeptree > deps-tree.txt

      - name: Verify lock file integrity
        run: |
          # requirements.lock.sha256 需提前生成并提交到仓库
          sha256sum -c requirements.lock.sha256

      - name: Check for typosquatting
        run: |
          # 简易同名仿冒检测：对比依赖名与 Top 100 包的编辑距离
          python scripts/typosquat_check.py requirements.lock

"""简易同名仿冒检测：计算依赖名与流行包名的编辑距离"""
import re
import sys

# 常见流行包列表（实际项目中应从下载量排行动态获取）
POPULAR_PACKAGES = [
    "requests", "flask", "django", "numpy", "pandas",
    "lodash", "express", "react", "axios", "moment",
]

def edit_distance(a: str, b: str) -> int:
    """Levenshtein 编辑距离"""
    if len(a) < len(b):
        return edit_distance(b, a)
    if len(b) == 0:
        return len(a)
    prev = range(len(b) + 1)
    for i, ca in enumerate(a):
        curr = [i + 1]
        for j, cb in enumerate(b):
            curr.append(min(
                prev[j + 1] + 1,       # 删除
                curr[j] + 1,           # 插入
                prev[j] + (ca != cb),  # 替换
            ))
        prev = curr
    return prev[-1]

def check_lock_file(path: str, threshold: int = 2):
    """扫描 lock 文件中编辑距离过近的包名"""
    with open(path) as f:
        deps = [line.split("==")[0].strip() for line in f if "==" in line]

    warnings = []
    for dep in deps:
        for popular in POPULAR_PACKAGES:
            dist = edit_distance(dep.lower(), popular.lower())
            if 0 < dist <= threshold and dep.lower() != popular.lower():
                warnings.append(
                    f"⚠ {dep} 与流行包 {popular} 编辑距离仅 {dist}，疑似仿冒"
                )

    for w in warnings:
        print(w)
    if warnings:
        sys.exit(1)
    print("✅ 未发现疑似同名仿冒包")

if __name__ == "__main__":
    check_lock_file(sys.argv[1])

# 生成 SBOM（Syft 是目前最成熟的工具）
# 安装
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin

# 对容器镜像或目录生成 SBOM
syft dir:./ -o spdx-json > sbom.spdx.json

# 用 cosign 对制品签名（Sigstore 无密钥模式）
# 安装 cosign
curl -sSfL https://raw.githubusercontent.com/sigstore/cosign/main/install.sh | sh -s -- -b /usr/local/bin

# 签名（Keyless 模式，用你的 OIDC 身份）
cosign sign blob sbom.spdx.json

# 验证别人发布的制品签名
cosign verify blob sbom.spdx.json \
  --certificate sbom.spdx.json.pem \
  --signature sbom.spdx.json.sig \
  --certificate-identity developer@example.com \
  --certificate-oidc-issuer https://accounts.google.com