# 直接复制文件
curl -O https://raw.githubusercontent.com/kriskimmerle/wheelaudit/main/wheelaudit.py
chmod +x wheelaudit.py

# 或克隆仓库
git clone https://github.com/kriskimmerle/wheelaudit.git
cd wheelaudit

# 扫描一个 wheel 文件
python3 wheelaudit.py package-1.0.0-py3-none-any.whl

# 扫描多个 wheel
python3 wheelaudit.py *.whl

# 扫描一个目录中的 wheel
python3 wheelaudit.py ./wheels/

# CI 模式：分数低于阈值时退出码为 1
python3 wheelaudit.py package.whl --check --min-score 80

# 用于工具集成的 JSON 输出
python3 wheelaudit.py package.whl --json

# 带详细信息的详细模式
python3 wheelaudit.py package.whl -v

# 按严重级别过滤
python3 wheelaudit.py package.whl --severity high

# 忽略特定规则
python3 wheelaudit.py package.whl --ignore WH11

# 从标准输入读取
cat package.whl | python3 wheelaudit.py --stdin

============================================================
requests 2.32.5 — B (88/100)
============================================================

  [HIGH]
    WH11 可疑模式：__import__() — 动态导入 (requests/packages.py)

  摘要：1 个 high

============================================================
evil-pip 99.0.0 — F (0/100)
============================================================

  [CRITICAL]
    WH01 wheel 归档中的路径遍历 (../../../etc/crontab)
    WH04 入口点遮蔽系统命令：'pip'
    WH04 入口点遮蔽系统命令：'python'
    WH05 嵌入的机密信息：GitHub 个人访问令牌 (pip/__init__.py)

  [HIGH]
    WH02 文件未在 RECORD 中列出 (../../../etc/crontab)
    WH03 可疑文件类型：.exe (pip/payload.exe)
    WH11 可疑模式：os.system() — shell 命令执行
    WH11 可疑模式：eval() 调用 — 动态代码执行
    WH11 可疑模式：SSH 目录引用

  摘要：4 个 critical，5 个 high，2 个 medium，2 个 low

{
  "version": "0.1.0",
  "results": [
    {
      "path": "package-1.0.0-py3-none-any.whl",
      "score": 88,
      "grade": "B",
      "metadata": {
        "name": "package",
        "version": "1.0.0",
        "file_count": 15,
        "total_uncompressed_bytes": 45000
      },
      "findings": [
        {
          "rule": "WH11",
          "severity": "high",
          "message": "Suspicious pattern: __import__() — dynamic import",
          "file": "package/compat.py"
        }
      ],
      "summary": {
        "high": 1
      }
    }
  ]
}

- name: Audit wheel
  run: |
    python3 wheelaudit.py dist/*.whl --check --min-score 80

pip download some-package --no-deps -d /tmp/wheels
python3 wheelaudit.py /tmp/wheels/*.whl --check
pip install /tmp/wheels/*.whl