Supply chain integrity

# Check a PyPI package for supply chain compromise
curl "https://api.attestd.io/v1/check?product=langchain&version=0.1.0" \
  -H "Authorization: Bearer YOUR_API_KEY"

import attestd

client = attestd.Client(api_key="YOUR_API_KEY")

# Check a PyPI package
result = client.check("langchain", "0.3.0")

# Check supply chain signal
if result.supply_chain and result.supply_chain.compromised:
    print(f"[ALERT] Malicious version detected: {result.product} {result.version}")
    print(f"Detected by: {', '.join(result.supply_chain.sources)}")
    print(f"Description: {result.supply_chain.description}")
    raise SystemExit("Do not deploy - compromised dependency")

if result.supply_chain is None:
    print(f"Note: {result.product} is not in supply chain monitoring")
    # Still check CVE risk
    if result.risk_state in ("critical", "high"):
        raise SystemExit(f"CVE risk detected: {result.risk_state}")

print(f"Safe to proceed: {result.product} {result.version}")

# requirements-check.py
import attestd
import re
import sys

def parse_requirements(filename):
    """Parse requirements.txt and return list of (package, version) tuples"""
    packages = []
    with open(filename) as f:
        for line in f:
            line = line.strip()
            if not line or line.startswith('#'):
                continue
            # Handle == and >= operators
            if '==' in line:
                pkg, ver = line.split('==')
                packages.append((pkg.strip(), ver.strip()))
            elif '>=' in line:
                pkg, ver = line.split('>=')
                packages.append((pkg.strip(), ver.strip()))
    return packages

def check_dependencies(filename, api_key):
    """Check all dependencies for supply chain compromise"""
    client = attestd.Client(api_key=api_key)
    packages = parse_requirements(filename)
    
    compromised = []
    for package, version in packages:
        try:
            result = client.check(package, version)
            
            # Check supply chain compromise
            if result.supply_chain and result.supply_chain.compromised:
                compromised.append({
                    'package': package,
                    'version': version,
                    'reason': result.supply_chain.description,
                    'sources': result.supply_chain.sources
                })
            
            # Also check CVE risk
            if result.risk_state in ("critical", "high"):
                compromised.append({
                    'package': package,
                    'version': version,
                    'reason': f"CVE risk: {result.risk_state}",
                    'cves': result.cve_ids
                })
        except attestd.AttestdUnsupportedProductError:
            # Not in attestd coverage - not necessarily bad, but alert
            print(f"[WARNING] {package} not in attestd coverage")
    
    if compromised:
        print("[ERROR] Compromised or risky packages found:")
        for item in compromised:
            print(f"  {item['package']}@{item['version']}: {item['reason']}")
        sys.exit(1)
    else:
        print(f"[OK] All {len(packages)} dependencies passed supply chain check")

python requirements-check.py requirements.txt