crypto-time-machine
用 git 真历史 回答一个问题：某个密码学 API / 算法是哪个 commit 引入的、何时被改过、影响了哪些文件。
零第三方依赖（只用标准库 subprocess / sqlite3 / json），只读仓库，不写任何源文件。
安装
pip install crypto-time-machine
用法
# 在任意 git 仓库里追踪一个符号，产出 timeline.db
crypto-time-machine --repo /path/to/repo --pattern ml_kem768
# 只看某个 commit 之后的影响面
crypto-time-machine --repo . --pattern ml_kem768 --query-after <sha>
# 用 -G（diff 命中）而不是 -S（内容变化）
crypto-time-machine --repo . --pattern kyber --mode -G
# 默认数据库是当前目录的 timeline.db，可显式指定
crypto-time-machine --repo . --pattern ml_kem768 --db /tmp/t.db
等价的模块入口：python -m ctime --pattern ml_kem768。
输出与退出码
- 成功：stdout 打印
pattern=... mode=... events=N db=...，退出码 0 - 不是 git 仓库 / git 执行失败：stderr 给出原因，退出码 2
- 模式匹配为空：默认拒绝覆盖已有时间轴并退出 2；确需写入空结果加
--allow-empty --query-after给了不在时间轴里的 sha：退出 2（不静默返回全量）
边界（明确不做的事）
- 不判断安全性：只报告「何时引入/变更/影响哪些文件」，不做漏洞判定
- 不做语义猜测：所有结论来自
git log -S/-G的真实输出，匹配为空就报空 - 不改仓库：只读；数据库写在
--db指定位置 - 不合并历史：重命名 / 跨文件移动的追踪依赖 git 自身的
--follow语义，超出范围时不猜测
许可
Apache-2.0
1 maintainer
Metadata
1 maintainer
Release files for crypto-time-machine 0.1.2
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| crypto_time_machine-0.1.2.tar.gz | 12.0 kB | With provenance | Details for crypto_time_machine-0.1.2.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| crypto_time_machine-0.1.2-py3-none-any.whl | Python 3 | none | any | Details for crypto_time_machine-0.1.2-py3-none-any.whl |
Total release size: 25.0 kB
Release files / crypto_time_machine-0.1.2.tar.gz
| Download URL | crypto_time_machine-0.1.2.tar.gz |
|---|---|
| Size | 12.0 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
84222aae3da7db8b09859f943186259a9d23f150bbc86e253addb160ec7ddea9
|
|
BLAKE2b-256 checksum How to use checksums |
44c836a1a2fe8768d34b7e14448fced9f54653921d71e56e344c2ce152f82292
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 28, 2026.
Transparency logRelease files / crypto_time_machine-0.1.2-py3-none-any.whl
| Download URL | crypto_time_machine-0.1.2-py3-none-any.whl |
|---|---|
| Size | 13.1 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
55f3fd865c72ae27cffb67bf338a99dd650a0fed1fed5355c45792c52ec0c040
|
|
BLAKE2b-256 checksum How to use checksums |
5a59387a18a14c1ccb0553a652fb4bc379fa49fc857322f43a40eaf7107bf6ef
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/7.0.0 CPython/3.13.16
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 28, 2026.
Transparency logSecurity for crypto-time-machine 0.1.2
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for crypto_time_machine-0.1.2.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Oct 28, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
