bayafs 0.1.0__tar.gz

bayafs-0.1.0/.gitignore

@@ -0,0 +1,223 @@
+# Prerequisites
+*.d
+
+# Compiled Object files
+*.slo
+*.lo
+*.o
+*.obj
+
+# Precompiled Headers
+*.gch
+*.pch
+
+# Compiled Dynamic libraries
+*.so
+*.dylib
+*.dll
+
+# Fortran module files
+*.mod
+*.smod
+
+# Compiled Static libraries
+*.lai
+*.la
+*.a
+*.lib
+
+# Executables
+*.exe
+*.out
+*.app
+
+# python virtual env
+env/
+.venv/
+
+# temp directory for cmake builds
+build/
+
+# ctest scratch, written into the cwd when ctest runs from the repo root.
+# Anchored: a nested Testing/ elsewhere in the tree is real source.
+/Testing/
+
+# pyarmor license registration zip (required for release generation)
+generate_release/fabric_studio/dependencies/pyarmor-regfile-4186.zip
+
+# temp directories for release generation and cmake builds
+/release_scratch/
+/release/
+/generated_rtl/
+/generated_perfapi/
+/sdc/
+/traces/
+/build_lib_perfapi/
+/lib_perfapi/
+/systemc_prefix/
+/arm_tlm_prefix/
+dist/
+*.whl
+
+# temp directories for python builds
+__pycache__/
+.pytest_cache/
+.hypothesis/
+*.egg-info/
+*.pyc
+
+# jupyter notebooks and jupyter lab
+.ipynb_checkpoints/
+.jupyter/
+
+
+# run area for hw tests
+run_area/
+
+# sw generated sv, fl, trace, json, dot, xml, svh, sdc files, zip
+src/sw/**/*.sv
+# ...but hand-written SV test fixtures are tracked
+!src/sw/python/tests/data/**/*.sv
+src/sw/**/*.sdc
+src/sw/**/*.svh
+src/sw/**/*.fl
+src/sw/**/*.xml
+src/sw/**/trace.txt
+src/sw/**/trm/
+src/sw/**/noc_datasheet/
+src/sw/python/**/trace
+src/sw/python/**/meta
+src/sw/python/.hypothesis/
+src/sw/python/designs/SW_simulator_trace.txt
+src/sw/python/jupyter_notebooks/*.json
+src/sw/python/**/generated_rtl/
+src/sw/python/**/generated_perfapi/
+src/sw/python/**/traces/*
+src/sw/python/designs/**/trace/**/*.txt
+src/sw/python/designs/**/meta/*.txt
+src/sw/python/designs/**/meta/*.xml
+src/sw/python/designs/**/meta/*.json
+src/sw/python/designs/tt_ring.json
+src/sw/python/jupyter_notebooks/interconnect_string.txt
+src/sw/python/jupyter_notebooks/mesh_sweep.csv
+routs_src*.csv
+
+# randomly generated vps configs
+src/hw/configs/vps_random/**/*.sv
+src/hw/configs/vps_random/**/*.fl
+src/hw/configs/vps_random/**/*.txt
+
+### VisualStudioCode ###
+.vscode/**/*      # Maybe .vscode/**/* instead - see comments
+!.vscode/settings.json
+!.vscode/tasks.json
+!.vscode/launch.json
+!.vscode/extensions.json
+
+### MacOS
+.DS_Store
+
+### Generated outputs
+*.numbers
+*.xlsx
+*.log
+*.prof
+sim_output.txt
+*output*
+src/sw/python/jupyter_notebooks/tt_ring.json
+src/sw/python/jupyter_notebooks/**/*.txt
+*.dot
+docs/out/
+api_trace*
+sim_log*.txt
+sim_events.json
+replay_events.json
+
+# FabricStudio GUI — generated outputs
+gui/designs/index.json
+gui/designs/*.elab.json
+gui/designs/*.sim_*.json
+gui/output/
+
+# Include xls files in the customer directory
+!customer/**/*.xls*
+customer/**/~*.xls*
+
+# Ctags for Verilog auti-browse
+tags
+
+# Random testcases
+random_test
+
+
+generate_release/fabric_studio/dependencies/pyarmor-regfile-4186.zip
+release_wheel_temp/
+
+# temporary PID file created when building bindings to ensure we don't run multiple builds at once
+build_bindings.pid
+
+# temp copy of assets for frontend testing in CacheSim
+src/sw/cachesim_py/Notebooks/assets
+generate_release/cachesim/release_dir/jupyter_notebooks/assets
+generate_release/cachesim/dependencies/pyarmor-regfile-4186.zip
+
+# sphinx
+src/sw/python/docs/_build
+src/sw/python/_build
+src/sw/cachesim_py/docs/_build
+
+src/sw/python/designs/img
+
+cache/
+Arch/oft_home*
+report.html
+report.xml
+
+# flopgen accuracy/error reports (diagnostic artifacts of `just rebuild_flops` /
+# `just report_datapoints`)
+flopgen_report*/
+
+# ipxact schemas
+src/sw/python/fabric_studio/data_models/sv/ipxact_schemas/
+
+# clangd cache
+.cache/clangd
+
+# claude superpowers plugin markdowns
+docs/superpowers/
+
+# architecture decision records (local only — not for the company repo)
+docs/adr/
+
+# domain-context notes (local scratch — durable facts live in CLAUDE.md)
+CONTEXT.md
+
+# claude code local settings (per-user, not shared) -- at every level
+**/.claude/settings.json
+
+# mempalace (claude code plugin) generated files
+entities.json
+mempalace.yaml
+
+# git worktrees (per-user, not shared)
+.claude/worktrees/
+# git worktrees + venvs built by coverage/collect.py for historical FS versions
+/fs-worktrees/
+# worktrees + venvs built by setup_alt_venv.py (just setup-alt-venv <ref>)
+/.alt-venv-worktrees/
+/.venv-*
+# uv cache, only when setup_sw_env.py cannot place it beside the clone
+/.uv-cache/
+# coverage collector --dryrun / baseline_dryrun.sh output (per-user, not shared)
+coverage_dryrun/
+
+# local secrets — never commit
+.env
+
+# local ruff settings
+.ruff.toml
+
+# FabricStudio SaaS per-server config + secrets (never commit)
+gui/saas_poc/setup/saas_config.env
+saas_secrets/
+gui/saas_poc/local/smtp.env

bayafs-0.1.0/LICENSE

@@ -0,0 +1,9 @@
+Copyright (c) Baya Systems, Inc. All rights reserved.
+
+This package installs and operates FabricStudio, licensed software of Baya Systems.
+
+Permission is granted to install and use this package solely to deploy and operate
+FabricStudio under a valid licence agreement with Baya Systems. The FabricStudio software
+this package installs is distributed separately and is governed by that agreement.
+
+THIS SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED.

bayafs-0.1.0/PKG-INFO

@@ -0,0 +1,109 @@
+Metadata-Version: 2.5
+Name: bayafs
+Version: 0.1.0
+Summary: Install and operate FabricStudio on your own infrastructure.
+Project-URL: Homepage, https://bayasystems.com
+Project-URL: Documentation, https://bayasystems.com/docs/self-hosted
+Author-email: Baya Systems <support@bayasystems.com>
+License-Expression: LicenseRef-Proprietary
+License-File: LICENSE
+Keywords: eda,fabricstudio,installer,noc,self-hosted
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: System Administrators
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: System :: Installation/Setup
+Classifier: Topic :: System :: Systems Administration
+Requires-Python: >=3.10
+Requires-Dist: pyyaml>=6
+Requires-Dist: rich>=13.7
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# baya — FabricStudio, self-hosted
+
+Installs and operates [FabricStudio](https://bayasystems.com) on your own Linux server:
+one command brings up the whole platform, and each engineer works in their own workspace,
+on their own home directory, signed in through your identity provider.
+
+Published as `bayafs`; the command is `baya`.
+
+## Requirements
+
+- Linux x86-64 — RHEL/Oracle, Ubuntu/Debian, or SLES
+- 4+ CPUs, 16 GB+ RAM, 100 GB+ free disk
+- root (the installer manages docker, Kubernetes, and port 443)
+- Outbound HTTPS to Baya's token broker and to Google Artifact Registry
+- A licence key from Baya
+
+## Install
+
+```sh
+pip install bayafs
+
+baya doctor                          # check this host; run it before anything else
+baya license set <your-licence-key>
+baya storage set --base /home        # where your engineers' home directories live
+baya init --hostname fs.yourcompany.com
+```
+
+`init` installs what is missing, starts a single-node Kubernetes cluster, pulls the images
+your licence entitles you to, and brings up the platform. It is safe to re-run: a failed
+step is resumed, not repeated.
+
+## Give people access
+
+```sh
+baya user map alice@yourcompany.com --linux-user alice --name "Alice Chen"
+baya verify
+```
+
+`user map` binds a login to a local account and starts that person's workspace on their real
+home directory — files their designs produce are owned by them, exactly as if they had run
+the tools from a shell. `verify` proves the install works end to end and names the command
+to run for anything that does not.
+
+## Day to day
+
+```sh
+baya status                  # version, health, users, certificate, licence
+baya verify                  # end-to-end check, after every change
+baya update --check          # versions newer than the one installed
+baya update                  # drains running work first; --force skips the wait
+baya rollback                # back to the previous version
+baya workspace list          # who is using what
+baya logs <service>          # no kubectl required
+baya support-bundle          # one tarball for Baya, secrets and designs redacted
+```
+
+## Certificates and identity
+
+A self-signed certificate is generated so day one works; replace it with yours:
+
+```sh
+baya tls set --cert /path/to/fullchain.pem --key /path/to/key.pem
+```
+
+Until an identity provider is federated, people sign in with a username and password held
+by the bundled Keycloak. To use your own:
+
+```sh
+baya idp add --type entra --tenant <id> --client-id <id> --client-secret <secret>
+baya idp test
+```
+
+## Uninstall
+
+```sh
+baya uninstall --yes
+```
+
+Removes the cluster and the install's own state. **Your engineers' files are never touched.**
+
+---
+
+Licensed software. `baya` itself is freely installable; running FabricStudio requires a
+licence key issued by Baya Systems.

bayafs-0.1.0/README.md

@@ -0,0 +1,84 @@
+# baya — FabricStudio, self-hosted
+
+Installs and operates [FabricStudio](https://bayasystems.com) on your own Linux server:
+one command brings up the whole platform, and each engineer works in their own workspace,
+on their own home directory, signed in through your identity provider.
+
+Published as `bayafs`; the command is `baya`.
+
+## Requirements
+
+- Linux x86-64 — RHEL/Oracle, Ubuntu/Debian, or SLES
+- 4+ CPUs, 16 GB+ RAM, 100 GB+ free disk
+- root (the installer manages docker, Kubernetes, and port 443)
+- Outbound HTTPS to Baya's token broker and to Google Artifact Registry
+- A licence key from Baya
+
+## Install
+
+```sh
+pip install bayafs
+
+baya doctor                          # check this host; run it before anything else
+baya license set <your-licence-key>
+baya storage set --base /home        # where your engineers' home directories live
+baya init --hostname fs.yourcompany.com
+```
+
+`init` installs what is missing, starts a single-node Kubernetes cluster, pulls the images
+your licence entitles you to, and brings up the platform. It is safe to re-run: a failed
+step is resumed, not repeated.
+
+## Give people access
+
+```sh
+baya user map alice@yourcompany.com --linux-user alice --name "Alice Chen"
+baya verify
+```
+
+`user map` binds a login to a local account and starts that person's workspace on their real
+home directory — files their designs produce are owned by them, exactly as if they had run
+the tools from a shell. `verify` proves the install works end to end and names the command
+to run for anything that does not.
+
+## Day to day
+
+```sh
+baya status                  # version, health, users, certificate, licence
+baya verify                  # end-to-end check, after every change
+baya update --check          # versions newer than the one installed
+baya update                  # drains running work first; --force skips the wait
+baya rollback                # back to the previous version
+baya workspace list          # who is using what
+baya logs <service>          # no kubectl required
+baya support-bundle          # one tarball for Baya, secrets and designs redacted
+```
+
+## Certificates and identity
+
+A self-signed certificate is generated so day one works; replace it with yours:
+
+```sh
+baya tls set --cert /path/to/fullchain.pem --key /path/to/key.pem
+```
+
+Until an identity provider is federated, people sign in with a username and password held
+by the bundled Keycloak. To use your own:
+
+```sh
+baya idp add --type entra --tenant <id> --client-id <id> --client-secret <secret>
+baya idp test
+```
+
+## Uninstall
+
+```sh
+baya uninstall --yes
+```
+
+Removes the cluster and the install's own state. **Your engineers' files are never touched.**
+
+---
+
+Licensed software. `baya` itself is freely installable; running FabricStudio requires a
+licence key issued by Baya Systems.

bayafs-0.1.0/pyproject.toml

@@ -0,0 +1,50 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "bayafs"
+version = "0.1.0"
+description = "Install and operate FabricStudio on your own infrastructure."
+readme = "README.md"
+requires-python = ">=3.10"
+license = "LicenseRef-Proprietary"
+license-files = ["LICENSE"]
+authors = [{ name = "Baya Systems", email = "support@bayasystems.com" }]
+keywords = ["fabricstudio", "noc", "eda", "self-hosted", "installer"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Environment :: Console",
+    "Intended Audience :: System Administrators",
+    "Operating System :: POSIX :: Linux",
+    "Programming Language :: Python :: 3",
+    "Topic :: System :: Installation/Setup",
+    "Topic :: System :: Systems Administration",
+]
+dependencies = [
+    "rich>=13.7",
+    # The per-engineer workspace manifest is edited structurally, not textually: its
+    # storage must be repointed at that engineer's real home directory.
+    "PyYAML>=6",
+]
+
+[project.urls]
+Homepage = "https://bayasystems.com"
+Documentation = "https://bayasystems.com/docs/self-hosted"
+
+[project.optional-dependencies]
+dev = ["pytest>=8", "ruff"]
+
+[project.scripts]
+baya = "baya.cli:main"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/baya"]
+
+[tool.hatch.build.targets.sdist]
+# Tests ship with the sdist so a customer's security team can run them.
+include = ["src", "tests", "README.md", "LICENSE"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "-q"

bayafs-0.1.0/src/baya/__init__.py

@@ -0,0 +1,11 @@
+"""baya — install and operate FabricStudio on your own infrastructure.
+
+Distributed as `bayafs` on PyPI; the command is `baya`. Implements FR-B of
+gui/ONPREM_SPEC.md, per gui/ONPREM_BAYA_PLAN.md.
+
+Deliberately shares no code with `bayactl` (spec D12/D23): admin tooling must not ship to
+customers. Where the two look alike — output conventions, the subprocess wrapper — the code
+is reimplemented here rather than imported, and the duplication is the point.
+"""
+
+__version__ = "0.1.0"

bayafs-0.1.0/src/baya/broker.py

@@ -0,0 +1,178 @@
+"""Exchanging the license key for a registry credential.
+
+The key is a claim ticket: it authenticates the install to Baya, and what comes back is a
+short-lived credential scoped to this customer's own repository. Nothing here can pull an
+image by itself.
+
+Credentials last an hour (FR-A7), which is shorter than anything else in an install, so they
+are cached in state and refreshed before expiry rather than fetched per operation.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import urllib.error
+import urllib.request
+from dataclasses import dataclass
+from datetime import UTC, datetime, timedelta
+
+from . import license as license_mod
+from . import ui
+from .config import Config
+from .errors import BayaError
+
+TIMEOUT = 20
+# Refresh this far ahead of expiry: a pull that starts inside the window must not have the
+# credential expire underneath it.
+REFRESH_MARGIN = timedelta(minutes=10)
+FAKE_ENV = "BAYA_FAKE_BROKER"
+
+
+@dataclass
+class Exchange:
+    username: str
+    password: str
+    expires_at: str
+    registry: str
+    versions: list[str]
+    engines: list[str]
+    channel: str
+
+    @property
+    def expiry(self) -> datetime | None:
+        try:
+            # fromisoformat handles a trailing Z from Python 3.11 on; the broker sends both forms.
+            return datetime.fromisoformat(self.expires_at)
+        except (ValueError, AttributeError):
+            return None
+
+    def expiring_within(self, margin: timedelta = REFRESH_MARGIN) -> bool:
+        expiry = self.expiry
+        return expiry is None or expiry - datetime.now(UTC) < margin
+
+    def to_state(self) -> dict:
+        return {
+            "credential_username": self.username,
+            "credential_password": self.password,
+            "credential_expires_at": self.expires_at,
+            "registry": self.registry,
+            "granted_versions": self.versions,
+            "granted_engines": self.engines,
+            "channel": self.channel,
+            "last_exchange": datetime.now(UTC).isoformat(timespec="seconds"),
+        }
+
+    @classmethod
+    def from_state(cls, state: dict) -> Exchange | None:
+        if not state.get("credential_password"):
+            return None
+        return cls(
+            username=state.get("credential_username", "oauth2accesstoken"),
+            password=state["credential_password"],
+            expires_at=state.get("credential_expires_at", ""),
+            registry=state.get("registry", ""),
+            versions=list(state.get("granted_versions", [])),
+            engines=list(state.get("granted_engines", [])),
+            channel=state.get("channel", "stable"),
+        )
+
+
+def _fake(key: str) -> Exchange:
+    """Development without the broker (plan D24). Never returns a usable credential."""
+    return Exchange(
+        username="_fake",
+        password=f"fake-credential-for-{license_mod.key_id(key)}",
+        expires_at=(datetime.now(UTC) + timedelta(hours=1)).isoformat(timespec="seconds"),
+        registry="localhost:5000/fs-fake",
+        versions=["0.0.1"],
+        engines=["latest"],
+        channel="stable",
+    )
+
+
+def exchange(
+    cfg: Config, key: str, *, version: str | None = None, install_id: str | None = None
+) -> Exchange:
+    """Trade the license key for a credential. Raises BayaError with an actionable message."""
+    if not license_mod.is_well_formed(key):
+        raise BayaError(f"that license key is not usable: {license_mod.why_invalid(key)}")
+    if os.environ.get(FAKE_ENV):
+        ui.warn(f"{FAKE_ENV} is set — using a fake credential that cannot pull anything")
+        return _fake(key)
+
+    url = cfg.broker_url.rstrip("/") + "/v1/token"
+    payload = {"license_key": key}
+    if version:
+        payload["version"] = version
+    if install_id:
+        payload["install_id"] = install_id
+    request = urllib.request.Request(
+        url,
+        data=json.dumps(payload).encode(),
+        method="POST",
+        headers={"Content-Type": "application/json"},
+    )
+    try:
+        with urllib.request.urlopen(request, timeout=TIMEOUT) as response:
+            body = json.loads(response.read())
+    except urllib.error.HTTPError as exc:
+        raise BayaError(_explain(exc)) from exc
+    except (urllib.error.URLError, TimeoutError, OSError) as exc:
+        raise BayaError(
+            f"could not reach {cfg.broker_url}: {getattr(exc, 'reason', exc)}\n"
+            "   This host needs outbound HTTPS to it; `baya doctor` checks that."
+        ) from exc
+
+    credential = body.get("credential") or {}
+    access = body.get("access") or {}
+    return Exchange(
+        username=credential.get("username", "oauth2accesstoken"),
+        password=credential.get("password", ""),
+        expires_at=credential.get("expires_at", ""),
+        registry=credential.get("registry", ""),
+        versions=list(access.get("versions", [])),
+        engines=list(access.get("engine_tags", [])),
+        channel=access.get("channel", "stable"),
+    )
+
+
+def _explain(exc: urllib.error.HTTPError) -> str:
+    """Turn the broker's answer into something an administrator can act on.
+
+    The broker deliberately says little about why a key was refused; this maps each status
+    to the action the administrator would take next.
+    """
+    try:
+        reason = json.loads(exc.read()).get("error", "")
+    except (ValueError, OSError):
+        reason = ""
+    if exc.code == 400:
+        return f"the broker rejected the license key: {reason or 'malformed'}"
+    if exc.code == 401:
+        return (
+            "the broker does not recognise this license key.\n"
+            "   Check it was copied whole, or ask Baya to reissue it."
+        )
+    if exc.code == 403:
+        return (
+            f"this license key is not permitted to pull: {reason or 'refused'}\n"
+            "   Ask Baya to restore access or grant the version you are installing."
+        )
+    if exc.code >= 500:
+        return f"the broker could not issue a credential ({reason or exc.code}); this is Baya's side, retry shortly"
+    return f"the broker refused the exchange (HTTP {exc.code}): {reason}"
+
+
+def current(cfg: Config, *, refresh: bool = False, version: str | None = None) -> Exchange:
+    """The credential to use now, exchanging only when the cached one is near expiry."""
+    state = cfg.read_state()
+    cached = Exchange.from_state(state)
+    if cached and not refresh and not cached.expiring_within():
+        return cached
+    key = state.get("license_key")
+    if not key:
+        raise BayaError("no license key on this host — run `baya license set <key>` first")
+    fresh = exchange(cfg, key, version=version, install_id=state.get("install_id"))
+    cfg.update_state(**fresh.to_state())
+    return fresh