rmonteiro-pereira/oblitus

No problems traced to this repository code in these checks. 11 static matches retained as context.

11 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

• scan reports each column's category, sensitivity, confidence and evidence: Real input produced the expected result: the column name and the values both look like person names

  Source: Prints each column's category, sensitivity, confidence and evidence

  Input: customers.csv

  Expected: a per-column report including the name-detection evidence

  Command: <guest-path> scan customers.csv

  Observed: …the column name and the values both look like person names email email direct_identifier 0.99 100% of sampled values are valid email values and the column name agrees cpf cpf direct_identifier 1.00 100% of sampled values are valid CPF values and the column name agrees signup_date generic_datetime non_sensitive 0.85 no sign of personal data in the name or the values age age quasi_identifier 0.55 the column name suggests age plan gene

• apply reports the protection level reached: Real input produced the expected result: result is anonymized

  Source: `wrote 2000 rows to customers_anon.csv; k-anonymity 1 -> 5; result is anonymized`

  Input: customers.csv with plan.json

  Expected: output reports result is anonymized

  Command: <guest-path> apply customers.csv --plan plan.json -o claim_anon.csv

  Observed: …result is anonymized warning: OBLITUS_SECRET_KEY is not set; pseudonymization plans will give different pseudonyms on every run

Examples

• Quick start: generate a sample customer table from the bundled schema: command completed successfully

  Source: README.md Quick start

  Input: examples/customers_schema.json --rows 2000

  Expected: writes 2000 rows

  Command: <guest-path> synthesize --schema <guest-path> --rows 2000 -o ex_customers.csv

  Observed: wrote 2000 rows to ex_customers.csv

• Quick start: write the noise explorer page for one column: command completed successfully

  Source: README.md Quick start

  Input: customers.csv --column monthly_spend

  Expected: writes the HTML page

  Command: <guest-path> explore-noise customers.csv --column monthly_spend -o ex_noise.html

  Observed: wrote ex_noise.html; open it in a browser

Local or hosted: local

Install oblitus from PyPI into a Python 3.12 venv and run the README Quick start CLI pipeline: synthesize, scan, propose, apply (with protection check) and explore-noise, on a 2000-row sample customer table.

cd <guest-path> && ls -la && cat README.md | head -c 7000; python3 --version
cd <guest-path> && tail -c +7000 README.md | head -c 8000; cat .python-version; ls .coldpass
cd <guest-path> && tail -c +15000 README.md | head -c 7000
cd /tmp && python3 -m venv <guest-path> && <guest-path> install -q --upgrade pip && <guest-path> install -q oblitus 2>&1 | tail -5; <guest-path> --help 2>&1 | head -40
mkdir -p <guest-path> && cd <guest-path> && export OBLITUS_SECRET_KEY="$(openssl rand -hex 32)" && O=<guest-path> && W=<guest-path> && $O synthesize --schema $W/examples/customers_schema.json --rows 2000 -o customers.csv; echo "rc=$?"; $O scan customers.csv; echo "rc=$?"; $O propose customers.csv --protection anonymization -o plan.json; echo "rc=$?"; ls -la
cd <guest-path> && export OBLITUS_SECRET_KEY="$(openssl rand -hex 32)" && O=<guest-path> && $O apply customers.csv --plan plan.json -o customers_anon.csv --report report.json; echo "rc=$?"; head -3 customers_anon.csv; $O explore-noise customers.csv --column monthly_spend -o monthly_spend_noise.html; echo "rc=$?"; ls -la
cd <guest-path> && cat > claims.json <<'EOF'
[
  {"kind":"claim","claim":"scan reports each column's category, sensitivity, confidence and evidence","source":"Prints each column's category, sensitivity, confidence and evidence","input":"customers.csv","expected":"a per-column report including the name-detection evidence","probe_kind":"cli","argv":["<guest-path>","scan","customers.csv"],"expected_text":"the column name and the values both look like person names","cwd":"<guest-path>"},
  {"kind":"claim","claim":"apply reports the protection level reached","source":"`wrote 2000 rows to customers_anon.csv; k-anonymity 1 -> 5; result is anonymized`","input":"customers.csv with plan.json","expected":"output reports result is anonymized","probe_kind":"cli","argv":["<guest-path>","apply","customers.csv","--plan","plan.json","-o","claim_anon.csv"],"expected_text":"result is anonymized","cwd":"<guest-path>"}
]
EOF
cat > probe.json <<'EOF'
{"kind":"cli","argv":["<guest-path>","apply","customers.csv","--plan","plan.json","-o","probe_anon.csv"],"cwd":"<guest-path>","expected_text":"result is anonymized"}
EOF
cat > examples.json <<'EOF'
[
  {"kind":"example","claim":"Quick start: generate a sample customer table from the bundled schema","source":"README.md Quick start","input":"examples/customers_schema.json --rows 2000","expected":"writes 2000 rows","argv":["<guest-path>","synthesize","--schema","<guest-path>","--rows","2000","-o","ex_customers.csv"],"cwd":"<guest-path>","env":{},"expected_text":"wrote 2000 rows to ex_customers.csv"},
  {"kind":"example","claim":"Quick start: write the noise explorer page for one column","source":"README.md Quick start","input":"customers.csv --column monthly_spend","expected":"writes the HTML page","argv":["<guest-path>","explore-noise","customers.csv","--column","monthly_spend","-o","ex_noise.html"],"cwd":"<guest-path>","env":{},"expected_text":"wrote ex_noise.html"}
]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"checks":[],"reason":"Inspected README.md and the oblitus CLI help (scan, propose, apply, apply-many, reveal, infer-schema, synthesize, dp-synthesize, check-synthetic, dp-aggregate, explore-noise, challenge, keygen, techniques). These are one-shot batch commands with no cron, loop, webhook, scheduler or --once/--now trigger documented."}
EOF
for f in claims probe examples cycles; do python3 -I -c "import json,sys;json.load(open('$f.json'));print('$f ok')"; done
cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | tail -c 6000; echo "rc=${PIPESTATUS[0]}"
cd <guest-path> && ls /inputs/ 2>&1; (test -f /inputs/coldpass-preflight.py && <env-var>=<guest-path> python3 -I /inputs/coldpass-preflight.py --validate --replay 2>&1 | tail -c 1500; echo "rc=$?") ; git init -q 2>&1; git remote add origin https://github.com/rmonteiro-pereira/oblitus 2>&1; timeout 120 git fetch --depth 1 origin b749ad13523fc751618154ce050a44cfdc7400c4 2>&1 | tail -3; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git rev-parse HEAD
cd <guest-path> && mkdir -p .coldpass && cat > .coldpass/report.json <<'EOF'
{"outcome":"working","fault_owner":null,"operation":"Install oblitus from PyPI into a Python 3.12 venv and run the README Quick start CLI pipeline: synthesize, scan, propose, apply (with protection check) and explore-noise, on a 2000-row sample customer table.","operation_scope":"CLI only, Linux, Python 3.12.3 (matches .python-version and README 'Python 3.12 or later'). No optional extras, no browser (explore-noise HTML was written but not opened), no DuckDB/Spark/OpenDP/AIM/Anonymeter. Repo pytest suite not run.","steps":["python3 -m venv <guest-path>; pip install oblitus (README Install)","oblitus synthesize --schema examples/customers_schema.json --rows 2000 -o customers.csv (Quick start)","oblitus scan customers.csv","oblitus propose customers.csv --protection anonymization -o plan.json","oblitus apply customers.csv --plan plan.json -o customers_anon.csv --report report.json","oblitus explore-noise customers.csv --column monthly_spend -o monthly_spend_noise.html"],"deviations":["Installed the published PyPI package with pip in a venv instead of cloning and running uv sync; the README lists pip install oblitus as the install route.","The workspace had no git metadata; ran git init, remote add, fetch --depth 1 and reset --mixed to the pinned commit b749ad13.","/inputs/coldpass-preflight.py is not present in this guest; validation was run with <guest-path> instead.","OBLITUS_SECRET_KEY was set for the quick-start steps; the probe and claim apply runs had it unset and printed the documented warning on stderr (pseudonymization plans give different pseudonyms per run). Output still reported result is anonymized.","Quick-start demo files were written to <guest-path>, not the workspace."],"stuck_step":null,"main_blocker":null,"plain_failure":null,"suggested_fix":"None required for the exercised CLI path. Optional: run the repo's uv run pytest suite and the optional-extra commands for full coverage."}
EOF
python3 -I -c "import json;json.load(open('.coldpass/report.json'));print('report ok')"; <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | head -c 400; echo; git status --short | head