Initial release: offline NetScaler triage with Sigma rules and MIT license

tests/test_release_hygiene.py

@@ -0,0 +1,65 @@
+"""Keep public package sources and release inclusion rules free of case data."""
+
+import json
+import re
+import tomllib
+import unittest
+from importlib.resources import files
+from pathlib import Path
+
+
+class ReleaseHygieneTests(unittest.TestCase):
+    def test_public_package_and_explicit_release_allowlist(self) -> None:
+        package = files("netscaler_triage")
+        personal = re.compile(
+            r"/(?:Users|home)/[^\s/]+|[A-Za-z]:[\\/]Users[\\/][^\s\\/]+"
+            r"|(?im:^[ \t]*(?:Bearbeitung|Prepared by|Analyst|Investigator|Customer|Case ID)\s*:)"
+        )
+        stack = [package]
+        while stack:
+            directory = stack.pop()
+            for entry in directory.iterdir():
+                if entry.is_dir() and entry.name != "__pycache__":
+                    stack.append(entry)
+                elif entry.name.endswith((".py", ".json", ".yml", ".yaml")):
+                    self.assertIsNone(
+                        personal.search(entry.read_text(encoding="utf-8")), entry.name
+                    )
+        public = json.loads(package.joinpath("data", "threat_intel.json").read_text())
+        sources = {entry["id"] for entry in public["sources"]}
+        for indicator in public["indicators"]:
+            self.assertEqual(indicator["status"], "reference_only")
+            self.assertTrue(set(indicator["source_ids"]) <= sources)
+
+        # Installed-wheel tests lack repository metadata; package checks above still run.
+        project = Path(__file__).resolve().parents[1] / "pyproject.toml"
+        if project.is_file():
+            config = tomllib.loads(project.read_text(encoding="utf-8"))
+            allowed = {
+                "src/",
+                "tests/",
+                "typing_stubs/",
+                "examples/",
+                "README.txt",
+                "README.md",
+                "RULES.txt",
+                "VALIDATION.txt",
+                "THREAT_INTELLIGENCE.txt",
+                "LICENSE.txt",
+                "config/threat_intel.json",
+                "uv.lock",
+                ".python-version",
+                ".gitignore",
+                "pyproject.toml",
+            }
+            ignore = (project.parent / ".gitignore").read_text().splitlines()
+            self.assertTrue({"private/", "/private/"} & set(ignore))
+            included = set(config["tool"]["hatch"]["build"]["targets"]["sdist"]["include"])
+            self.assertFalse(any("private" in entry for entry in included))
+            self.assertTrue(
+                included <= allowed, f"Unreviewed release include entries: {included - allowed}"
+            )
+
+
+if __name__ == "__main__":
+    unittest.main()