chenzehaoo/moon_guard/lib/report

README
V
crypto_keypair
V
crypto_sign
V
crypto_verify
V
manifest_sha256
V
report_new
V
trust_store
V
verify_package

chenzehaoo/moon_guard/lib/report does not have a README file

Finding

pub(all) struct Finding {
  title : String
  description : String
  risk_level : RiskLevel
  remediation : String
}

ReportStatus

source

pub(all) enum ReportStatus {
  Pass
  Warning
  Fail
} derive(Eq, @moonbitlang/core/debug.Debug
Debug)

impl Show for ReportStatus

RiskLevel

source

pub(all) enum RiskLevel {
  Critical
  High
  Medium
  Low
  Info
} derive(Eq)

impl Show for RiskLevel

SecurityReport

source

pub(all) struct SecurityReport {
  package_name : String
  package_version : String
  overall_status : ReportStatus
  findings : Array[Finding]
  signature_verified : Bool
  typosquat_suspects : Array[String]
  file_count : Int
  risk_score : Double
  audit_timestamp : String
}

SecurityReport::add_finding

source

fn SecurityReport::add_finding(self : SecurityReport, f : Finding) -> Unit

SecurityReport::new

source

fn SecurityReport::new(package_name : String, package_version : String) -> SecurityReport

SecurityReport::recompute_score

source

fn SecurityReport::recompute_score(self : SecurityReport) -> Unit

Recompute risk_score and clamp to [0, 10]. Call after batch-adding findings so callers don't have to track the running total.

SecurityReport::summary

source

fn SecurityReport::summary(self : SecurityReport) -> String

TyposquatSummaryEntry

source

pub(all) struct TyposquatSummaryEntry {
  suspect : String
  hit_count : Int
  first_similar_to : String
  first_attack : String
}

make_finding

source

fn make_finding(title : String, description : String, risk : RiskLevel, remediation : String) -> Finding

Convenience constructor that wires a Finding together from common fields. Cuts down on the boilerplate at audit call sites.

report_to_json

source

fn report_to_json(report : SecurityReport) -> String

Source Files

report.mbt

Install

Download zip

MoonGuard is a pure-MoonBit supply chain security toolchain providing Ed25519 package signing and verification, SHA-256 manifest integrity checks, JSON+PEM trusted key management, Levenshtein and homoglyph typosquat detection, CVSS-style cumulative risk scores, JSON security reports, and a `moon_guard` CLI with subcommands for keygen, sign, verify, trust, typosquat, manifest, hash, audit, and version. Includes a runnable end-to-end audit example at `examples/basic_audit`. MoonGuard 是用纯 MoonBit 实现的 MoonBit 包供应链安全工具链，提供 Ed25519 签名、SHA-256 清单、JSON+PEM 可信密钥管理、Levenshtein 与同形（homoglyph）双模式 typosquat 检测、CVSS 风格风险评分、JSON 安全报告与 9 子命令 CLI。

securitysupply-chainmoonbited25519sha256typosquatsupply-chain-securitymanifesttrust-storecode-signing依赖混淆供应链安全代码签名清单校验Typosquat 检测

chenzehaoo

Apache-2.0