🇨🇳 中文简述:我们更倾向于小而确定的取证原语,而非针对特定题目的答案脚本。新增能力请遵循下方原则,并附带回归测试;发布前请用
python -m build与python -m twine check --strict校验分发包。
DFTK favors small, deterministic forensic primitives over challenge-specific answer scripts.
A new capability should:
- accept generic artifact parameters rather than embedding case constants;
- preserve source evidence by default;
- distinguish
unsupported,error,blocked, and negative findings; - return structured facts and explicit evidence locators;
- declare safety level, network behavior, optional requirements, tags and produced evidence types;
- include regression tests for both successful parsing and malformed / unsupported input;
- avoid silently swallowing parser errors.
git clone https://github.com/DigiForensics/DFTK.git
cd DFTK
python -m venv .venv
python -m pip install -e ".[dev]"
pytest -q- Implement the primitive in
src/dftk/primitives/(or a recipe insrc/dftk/recipes/). - Register it with the
ToolRegistrydecorator, declaringname,description,parameters,safety,network,tags,produces,requires,deterministic, andcost_hint. - Return a single
Observationwith explicitstatus,facts, andevidence. - Add regression tests under
tests/.
See ARCHITECTURE.md for the public tool boundary, evidence contract, and promotion rules.
pytest -q --cov=dftk --cov-report=term-missing --cov-fail-under=60
python -m build
python -m twine check --strict dist/*CI runs the suite with the same coverage floor (--cov-fail-under=60), so a PR that drops coverage below it fails. Raise the floor in .github/workflows/ci.yml when the real number moves up durably; do not lower it to make a change pass.
- Keep changes focused and described in the PR body.
- Add or update tests for behavioral changes.
- Update
CHANGELOG.mdfor user-visible changes. - Follow the existing code style (4-space indentation,
from __future__ import annotations). - Be respectful — see CODE_OF_CONDUCT.md.
Do not open a public issue for vulnerabilities. See SECURITY.md.