Spectrmachina/Ztrust

选用指南

AI 根据 README 整理 · 2026/10/23 07:26:30

使用方式

通过命令行工具 `ztrust scan` 使用，也可作为 GitHub Action 集成到 CI 中。

查看 README 依据

git clone https://github.com/Lostreaksmb/ztrust.git cd ztrust pip install -e . ztrust scan examples/vulnerable-app # an intentionally broken demo project ztrust scan . # your project ``` ```text ╭───────────────────────────────────────────────────────────────────────────╮ │ ZTrust v0.1.0 /home/me/ztrust/examples/vulnerable-app │ │ 7 dependencies · scanners: secrets, typosquat, integrity, ci, vulns · 1.84s│ │ CRITICAL 1 HIGH 9 MEDIUM 6 LOW 3 INFO 1 │

| `ztrust pay-uri --address u1… --amount 1.5 --memo "thanks"` | ZIP-321 payment link | | `ztrust check-address u1…` | Validate & classify a Zcash address | | `ztrust serve` | Run the bounty API (`pip install -e ".[server]"`) | **Exit codes:** `0` clean · `1` findings ≥ `--fail-on` (default `high`) · `2` usage error. --- ## ⚙️ GitHub Action ```yaml # .github/workflows/ztrust.yml name: ZTrust on: [push, pull_request] permissions: contents: read security-events: write # upload SARIF to the Security tab jobs: scan: runs-on: ubuntu-latest steps:

部署要求

需要 Python 3.11、3.12 或 3.13。

查看 README 依据

<div align="center"> <img src="docs/assets/logo.png" alt="ZTrust" width="560"> ### Zero-trust software supply-chain security — with shielded Zcash bounties for the people who defend open source [](https://github.com/Lostreaksmb/ztrust/actions/workflows/ci.yml) [](https://www.python.org/) [](LICENSE)

已知限制

目前不支持 yarn/pnpm 锁文件、Maven、NuGet 和 RubyGems。

查看 README 依据

│ │ └── store.py # SQLite │ └── server/app.py # FastAPI bounty API ├── tests/ # pytest suite ├── examples/ # vulnerable demo app + bounty walkthrough └── docs/ # architecture, protocol, Zcash, threat model, rules, API, roadmap ``` --- ## 🛣️ Roadmap - [x] Five scanners, SARIF, GitHub Action - [x] Bounty API with commit-reveal and shielded payouts - [ ] yarn / pnpm lockfiles, Maven, NuGet, RubyGems - [ ] Sigstore / npm provenance & SLSA verification