1f45e0c611
Every existing test asserted the history scan reports nothing — on this repository, which has never committed a credential. That is the wrong direction to test alone: a detector exercised only against clean input is indistinguishable from a function that returns an empty vector, and this one has already shipped four false-negative-shaped bugs today. The new test builds a repository from scratch by writing zlib-compressed git objects directly — no subprocess, for the same reason the scanner uses none — commits a key, and leaves no working-tree copy at all. Only the history has it, which is the situation the whole module exists for. It asserts the scan finds it, names the file, says revoke, and does not carry the credential's value into the finding. The fixture key is assembled at runtime so this source file does not itself contain a credential-shaped string, which is the trap that made the detector report its own definitions earlier today. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
16 lines
411 B
TOML
16 lines
411 B
TOML
[package]
|
|
name = "hound-supply"
|
|
description = "Supply-chain and agent-era threat detection: typosquats, install scripts, pickle RCE, prompt injection, MCP overreach"
|
|
version.workspace = true
|
|
edition.workspace = true
|
|
license.workspace = true
|
|
repository.workspace = true
|
|
|
|
[dependencies]
|
|
flate2 = "1"
|
|
hound-defs.workspace = true
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
|
|
[dev-dependencies]
|
|
sha1 = "0.10"
|