{"id":17968749,"url":"https://github.com/david942j/honest","last_synced_at":"2025-03-25T10:32:38.335Z","repository":{"id":71063927,"uuid":"128368509","full_name":"david942j/honest","owner":"david942j","description":"Are your installed packages _really_ the same as you saw on GitHub?","archived":false,"fork":false,"pushed_at":"2018-06-01T04:32:58.000Z","size":437,"stargazers_count":24,"open_issues_count":0,"forks_count":1,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-03-20T01:11:13.619Z","etag":null,"topics":["package-manager","security"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/david942j.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-04-06T08:19:51.000Z","updated_at":"2023-08-23T22:13:24.000Z","dependencies_parsed_at":"2023-03-11T09:51:45.106Z","dependency_job_id":null,"html_url":"https://github.com/david942j/honest","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/david942j%2Fhonest","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/david942j%2Fhonest/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/david942j%2Fhonest/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/david942j%2Fhonest/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/david942j","download_url":"https://codeload.github.com/david942j/honest/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245444466,"owners_count":20616384,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["package-manager","security"],"created_at":"2024-10-29T14:41:26.017Z","updated_at":"2025-03-25T10:32:38.310Z","avatar_url":"https://github.com/david942j.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Honest: Are your installed packages honest?\n[![Build Status](https://travis-ci.org/david942j/honest.svg?branch=master)](https://travis-ci.org/david942j/honest)\n\nAre your installed packages _really_ the same as you saw on GitHub?\n\nVerify the source code before you installed it!\n\n## Why\n\nAll open-source projects can be reviewed on GitHub, BitBucket, GitLab, etc.\n\nBut are you sure those packages published to pip/gem *exactly* same as they are in git-repositories?\n\nImagine this:\nIt looks all good, secure, many-users on GitHub, but who has checked *the packge pushed* to PyPI?\nWhat if the developer hide an one-line backdoor in source-code before pushing it?\nOnce you installed it, you got owned!\n\nLet's find out whether the packages you installed are **Honest**!\n\n## Installation\n\n```bash\n$ git clone https://github.com/david942j/honest\n$ cd honest\n$ ./install.sh /usr/local # you may need sudo before the command\n# or you can install somewhere under your home directory, such as:\n# $ mkdir ~/local \u0026\u0026 ./install.sh ~/local \u0026\u0026 export PATH=\"$HOME/local/bin:$PATH\"\n\n$ honest --version # check if the installation succeed!\n```\n\n## Usage\n\n```bash\n$ honest github:david942j/one_gadget gem:one_gadget\n# [INFO] OK, one_gadget is Honest!\n```\n\nYou can specify a version:\n```bash\nhonest github:bbatsov/rubocop gem:rubocop -v 0.55.0\n# [INFO] OK, rubocop is Honest!\n```\n\nCompare with a local directory:\n```bash\n$ honest ./httpie pip:httpie -v 0.9.8\n# [INFO] OK, httpie is Honest!\n```\n\n\n#### See help for more details\n\n```bash\n$ honest\n# Honest version 1.0.0\n# Usage: honest [-h/--help] [--version]\n#               \u003cgit-url\u003e \u003cpackage\u003e [-v version[:version]]\n#\n# Examples:\n#        honest --version\n#        honest github:david942j/one_gadget gem:one_gadget\n#        honest github:david942j/one_gadget gem:one_gadget -v master:1.6.0\n#        honest https://github.com/pypa/setuptools pip:setuptools -v 39.0.1\n#        honest ~/path_on_my_laptop/seccomp-tools gem:seccomp-tools -v 1.2.0\n#\n# Options:\n#        -h, --help\n#               Show this usage.\n#        --version\n#               Display version information and exit.\n#\n# Git Url Parameter:\n#        \u003cgit-url\u003e can be:\n#               - A relative/absolute path\n#               - An url like https://\u003cgit host\u003e/\u003cauthor\u003e/\u003cproject\u003e\n#               - \u003cgithub|bitbucket|gitlab\u003e:\u003cauthor\u003e/\u003cproject\u003e\n#        If no branch/commit/tag is specified in the `-v` option, the latest release(tag) will be used.\n#        With this behavior we can have the simplest usage of honest: `$ honest github:user/proj pip:proj`.\n\n```\n\n## Screenshots\n\n![honest gem](https://github.com/david942j/honest/blob/master/screenshots/rubocop.png?raw=true)\n\n![honest pip](https://github.com/david942j/honest/blob/master/screenshots/setuptools.png?raw=true)\n\n## Supported Package Manager\n\n- [x] RubyGems (Ruby)\n- [x] PyPi (Python)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdavid942j%2Fhonest","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdavid942j%2Fhonest","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdavid942j%2Fhonest/lists"}