pcr-scan

Files (1)

• SKILL.md

SKILL.md (first lines)

# Scan (read-only)

Follow **pcr-navigator** rules. The scanner is `scripts/pycert-scan.py` (Python 3.8+,
stdlib only, Linux/macOS/Windows). It checks bundle **contents** by SHA-256
fingerprint, so a patched-in-place bundle is not a false alarm and an old one with a
new-looking version is not missed. Its probe never imports third-party packages.

## Commands

| Goal | Command |
|---|---|
| This machine | `python3 "$PCR/scripts/pycert-scan.py" --local -o reports/python` |
| + project venvs | add `--venvs ~/code` (finds every `pyvenv.cfg` and conda env) |
| One interpreter / venv | `--python /path/to/venv` (repeatable) |
| Repos | `--project ~/code` (requirements, uv/poetry/pdm/Pipfile locks, environment.yml, Dockerfiles, uv exclude-newer, Renovate/Dependabot cooldowns) |
| Any CA bundle | `--bundle /etc/ssl/cert.pem` (file or hashed cert directory) |
| Definitive check | add `--live`: TLS handshake per trust path against the incident's public test hosts; a safe client must refuse them (control: pypi.org) |

Windows: run with `py -3 pycert-scan.py --local ...` in PowerShell.

## Read the results

| Status | Meaning | Next |
|---|---|---|
| AFFECTED | A bundle this environment uses trusts the compromised chain (pip, certifi, OS store, env override, vendored bundle) or uv is old | pcr-fix |
| EOL | Python < 3.10 with affected pip: the fixed pip does not install there | pcr-fix (old Python section) |
| WARN | New venvs will start vulnerable (ensurepip), Docker images need rebuild, cooldowns block the fix, or only the Sectigo cross-sign root is present | pcr-fix |
| CHECK | Could not read something, or a conda `ca-certificates` pin | Confirm manually |
| OK | Clean (the report notes patched-in-place copies of older versions) | Verify later with `--live` |

Live verdicts: **VULNERABLE** (a trust path accepted a test host: confirmed),
**SAFE** (all paths refused and the control worked), **INCONCLUSIVE** (network
blocked or control failed; rely on the fingerprint result).

## Present

Group by machine: P1 = AFFECTED environments used for production/CI or on laptops
that join public networks; then EOL; then WARN. Hand off to **pcr-fix** with the
generated `-fix-plan.md`.

From luivc1/python-cert-responder, MIT.

More from luivc1/python-cert-responder