Honest: Are your installed packages honest?
Are your installed packages really the same as you saw on GitHub?
Verify the source code before you installed it!
Why
All open-source projects can be reviewed on GitHub, BitBucket, GitLab, etc.
But are you sure those packages published to pip/gem exactly same as they are in git-repositories?
Imagine this: It looks all good, secure, many-users on GitHub, but who has checked the packge pushed to PyPI? What if the developer hide an one-line backdoor in source-code before pushing it? Once you installed it, you got owned!
Let's find out whether the packages you installed are Honest!
Installation
$ git clone https://github.com/david942j/honest
$ cd honest
$ ./install.sh /usr/local # you may need sudo before the command
# or you can install somewhere under your home directory, such as:
# $ mkdir ~/local && ./install.sh ~/local && export PATH="$HOME/local/bin:$PATH"
$ honest --version # check if the installation succeed!Usage
$ honest github:david942j/one_gadget gem:one_gadget
# [INFO] OK, one_gadget is Honest!You can specify a version:
honest github:bbatsov/rubocop gem:rubocop -v 0.55.0
# [INFO] OK, rubocop is Honest!Compare with a local directory:
$ honest ./httpie pip:httpie -v 0.9.8
# [INFO] OK, httpie is Honest!See help for more details
$ honest
# Honest version 1.0.0
# Usage: honest [-h/--help] [--version]
# <git-url> <package> [-v version[:version]]
#
# Examples:
# honest --version
# honest github:david942j/one_gadget gem:one_gadget
# honest github:david942j/one_gadget gem:one_gadget -v master:1.6.0
# honest https://github.com/pypa/setuptools pip:setuptools -v 39.0.1
# honest ~/path_on_my_laptop/seccomp-tools gem:seccomp-tools -v 1.2.0
#
# Options:
# -h, --help
# Show this usage.
# --version
# Display version information and exit.
#
# Git Url Parameter:
# <git-url> can be:
# - A relative/absolute path
# - An url like https://<git host>/<author>/<project>
# - <github|bitbucket|gitlab>:<author>/<project>
# If no branch/commit/tag is specified in the `-v` option, the latest release(tag) will be used.
# With this behavior we can have the simplest usage of honest: `$ honest github:user/proj pip:proj`.
Screenshots
Supported Package Manager
- RubyGems (Ruby)
- PyPi (Python)