certlord 1.0.0rc1__tar.gz

certlord-1.0.0rc1/.github/scripts/check-release.py

@@ -0,0 +1,32 @@
+"""Reject mismatched versions, tags or private documents before publication."""
+import ast
+import os
+from pathlib import Path, PurePosixPath
+import tarfile
+import zipfile
+import yaml
+
+root = Path(__file__).resolve().parents[2]
+version = (root / 'VERSION').read_text().strip()
+config = yaml.safe_load((root / 'setup.yml').read_text())
+assert config['version'] == config['release'] == version
+assert (root / 'RELEASE').read_text().strip() == version
+module = ast.parse((root / 'bin/certlord').read_text())
+cli_version = next(ast.literal_eval(n.value) for n in module.body
+                   if isinstance(n, ast.Assign) and any(isinstance(t, ast.Name) and t.id == '__version__' for t in n.targets))
+assert cli_version == version
+ref = os.environ.get('GITHUB_REF', '')
+if ref.startswith('refs/tags/'):
+    assert ref == 'refs/tags/v' + version, (ref, version)
+files = sorted((root / 'dist').iterdir())
+assert len(files) == 2 and sum(p.suffix == '.whl' for p in files) == 1
+assert sum(p.name.endswith('.tar.gz') for p in files) == 1
+for path in files:
+    assert version in path.name, path.name
+    names = zipfile.ZipFile(path).namelist() if path.suffix == '.whl' else tarfile.open(path).getnames()
+    for name in names:
+        parts = PurePosixPath(name).parts
+        assert not name.startswith('/') and '..' not in parts, name
+        assert not any(part in {'.git', 'ROADMAP.md', 'SANITIZED-MANIFEST.json', 'pr-history.json', 'evidence', 'framework_candidates'} for part in parts), name
+        assert not any(part.startswith(('review-20', 'release-readiness-', 'http-boundary-review-', 'operation-audit-review-')) for part in parts), name
+print('Release metadata, tag and distribution inventory verified:', version)

certlord-1.0.0rc1/.github/scripts/check-test-collection.py

@@ -0,0 +1,138 @@
+#!/usr/bin/env python3
+"""Compare test declarations with actual collection (Python 3.8+ CI helper).
+
+Run before the normal test command, with the same interpreter and environment.
+Pass every separately discovered directory together; skipped tests still count
+as collected. This does not execute tests or replace the normal test command.
+"""
+import argparse
+import ast
+import inspect
+from pathlib import Path
+import sys
+import unittest
+
+
+TEST_PATTERN = 'test*.py'
+FUNCTION_NODES = (ast.FunctionDef, ast.AsyncFunctionDef)
+
+
+def declarations(directories):
+    expected = set()
+    files = {path.resolve() for directory in directories
+             for path in directory.rglob(TEST_PATTERN)}
+    for path in sorted(files):
+        tree = ast.parse(path.read_bytes(), filename=str(path))
+
+        def visit(nodes, prefix=''):
+            for node in nodes:
+                if isinstance(node, FUNCTION_NODES):
+                    if node.name.startswith('test'):
+                        key = (path, prefix + node.name)
+                        if key in expected:
+                            raise ValueError('Duplicate test declaration: %s:%s' % key)
+                        expected.add(key)
+                    # Helpers defined inside a test are not separate tests.
+                elif isinstance(node, ast.ClassDef):
+                    visit(node.body, prefix + node.name + '.')
+                else:
+                    # Include declarations behind module/class-level conditions.
+                    visit(list(ast.iter_child_nodes(node)), prefix)
+
+        visit(tree.body)
+    return expected
+
+
+def identity(obj):
+    obj = inspect.unwrap(obj)
+    source = inspect.getsourcefile(obj)
+    return (Path(source).resolve(), obj.__qualname__) if source else None
+
+
+def unittest_collection(directories):
+    collected = set()
+    count = 0
+
+    def cases(suite):
+        for item in suite:
+            if isinstance(item, unittest.TestSuite):
+                yield from cases(item)
+            else:
+                yield item
+
+    for directory in directories:
+        loader = unittest.TestLoader()
+        suite = loader.discover(str(directory), pattern=TEST_PATTERN)
+        if loader.errors:
+            raise ValueError('\n'.join(loader.errors))
+        items = list(cases(suite))
+        if not items:
+            raise ValueError('Empty test suite: %s' % directory)
+        count += len(items)
+        for case in items:
+            method = getattr(case, case._testMethodName)
+            collected.add(identity(method))
+    return collected, count
+
+
+def pytest_collection(directories):
+    import pytest
+
+    class Collector:
+        def __init__(self):
+            self.collected = set()
+            self.counts = {directory: 0 for directory in directories}
+            self.count = 0
+
+        def pytest_collection_finish(self, session):
+            self.count = len(session.items)
+            for item in session.items:
+                self.collected.add(identity(item.obj))
+                for directory in directories:
+                    if directory in Path(str(item.path)).resolve().parents:
+                        self.counts[directory] += 1
+
+    collector = Collector()
+    status = pytest.main(['--collect-only', '-q'] +
+                         [str(directory) for directory in directories],
+                         plugins=[collector])
+    if status != 0:
+        raise ValueError('pytest collection failed with exit code %s' % status)
+    for directory, count in collector.counts.items():
+        if not count:
+            raise ValueError('Empty test suite: %s' % directory)
+    return collector.collected, collector.count
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--runner', choices=('unittest', 'pytest'), required=True)
+    parser.add_argument('directories', type=Path, nargs='+')
+    args = parser.parse_args()
+    # Match python -m unittest/pytest: use the working directory, never the
+    # script repository. Installed-package jobs run from outside the checkout.
+    sys.path.insert(0, str(Path.cwd()))
+    directories = [directory.resolve() for directory in args.directories]
+    try:
+        for directory in directories:
+            if not directory.is_dir():
+                raise ValueError('Missing test directory: %s' % directory)
+        expected = declarations(directories)
+        collect = pytest_collection if args.runner == 'pytest' else unittest_collection
+        collected, count = collect(directories)
+        missing = expected - collected
+        if missing:
+            raise ValueError('Tests not collected by %s:\n%s' % (
+                args.runner, '\n'.join('%s:%s' % key for key in sorted(missing))))
+        if not expected:
+            raise ValueError('No test declarations found')
+        print('Collection verified: %d declarations, %d cases (%s)' %
+              (len(expected), count, args.runner))
+    except (ImportError, OSError, SyntaxError, ValueError) as exc:
+        print(str(exc), file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main())

certlord-1.0.0rc1/.github/scripts/install-lifecycle-tools.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+# Disposable Linux amd64 integration tools; no installation into the host PATH.
+set -euo pipefail
+fixture_dir="${1:?Usage: install-lifecycle-tools.sh DIRECTORY}"
+mkdir -p "$fixture_dir"
+cd "$fixture_dir"
+for binary in pebble pebble-challtestsrv; do
+    curl --fail --silent --show-error --location --retry 2 --max-time 120 \
+        "https://github.com/letsencrypt/pebble/releases/download/v2.10.1/${binary}-linux-amd64.tar.gz" \
+        --output "$binary.tar.gz"
+done
+curl --fail --silent --show-error --location --retry 2 --max-time 120 \
+    https://releases.hashicorp.com/vault/1.20.4/vault_1.20.4_linux_amd64.zip --output vault.zip
+sha256sum --check <<'SUMS'
+4f2fcb5bca8c85c9cf73ad140fccfc0d2be40bd81ab99879c79b7b8a0b4f70ed  pebble.tar.gz
+e93a5aa25ecdf3af2f9fbb2de32b0173e64a2eae81002a4ccfe35fa6f4f60b92  pebble-challtestsrv.tar.gz
+fc5fb5d01d192f1216b139fb5c6af17e3af742aaeffc289fd861920ec55f2c9c  vault.zip
+SUMS
+for binary in pebble pebble-challtestsrv; do
+    tar --no-same-owner -xzf "$binary.tar.gz"
+    cp "$binary-linux-amd64/linux/amd64/$binary" "$binary"
+    chmod +x "$binary"
+done
+unzip -q vault.zip vault

certlord-1.0.0rc1/.github/tests/test_collection_guard.py

@@ -0,0 +1,68 @@
+"""Regression tests for false-green collection failures."""
+import importlib.util
+from pathlib import Path
+import subprocess
+import sys
+import tempfile
+import unittest
+
+
+GUARD = Path(__file__).resolve().parents[1] / 'scripts' / 'check-test-collection.py'
+CASE = 'import unittest\nclass Example(unittest.TestCase):\n    def test_ok(self): pass\n'
+
+
+class CollectionGuardTests(unittest.TestCase):
+    def check(self, files, directories=('tests',), runner='unittest', succeeds=False):
+        with tempfile.TemporaryDirectory() as temporary:
+            root = Path(temporary)
+            for directory in directories:
+                (root / directory).mkdir(parents=True, exist_ok=True)
+            for name, content in files.items():
+                path = root / name
+                path.parent.mkdir(parents=True, exist_ok=True)
+                path.write_text(content)
+            result = subprocess.run(
+                [sys.executable, str(GUARD), '--runner', runner] + list(directories),
+                cwd=str(root), stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
+                universal_newlines=True, timeout=30)
+            self.assertEqual(result.returncode == 0, succeeds, result.stdout)
+            return result.stdout
+
+    def test_valid_and_skipped_cases_are_collected(self):
+        self.check({'tests/test_valid.py': CASE +
+                    '    @unittest.skip("requires integration service")\n'
+                    '    def test_skipped(self): pass\n'}, succeeds=True)
+
+    def test_unittest_rejects_ignored_function_next_to_valid_case(self):
+        output = self.check({'tests/test_mixed.py': CASE + '\ndef test_lost(): pass\n'})
+        self.assertIn('test_lost', output)
+
+    def test_empty_suite_fails(self):
+        self.assertIn('Empty test suite', self.check({}))
+
+    def test_nested_directory_requires_separate_discovery(self):
+        files = {'tests/test_outer.py': CASE, 'tests/contracts/test_inner.py': CASE}
+        self.assertIn('not collected', self.check(files))
+        self.check(files, directories=('tests', 'tests/contracts'), succeeds=True)
+
+    def test_import_error_fails(self):
+        self.assertIn('ImportError', self.check({
+            'tests/test_broken.py': 'raise ImportError("broken dependency")\n'}))
+
+    def test_duplicate_definition_fails(self):
+        self.assertIn('Duplicate test declaration', self.check({
+            'tests/test_duplicate.py': CASE + '    def test_ok(self): pass\n'}))
+
+    def test_plain_class_is_not_a_unittest_case(self):
+        self.assertIn('TestLost.test_lost', self.check({
+            'tests/test_plain.py': CASE + '\nclass TestLost:\n    def test_lost(self): pass\n'}))
+
+    @unittest.skipUnless(importlib.util.find_spec('pytest'), 'pytest runner only')
+    def test_pytest_parameterization_and_deselection(self):
+        files = {'tests/test_parameters.py':
+                 'import pytest\n@pytest.mark.parametrize("value", [1, 2])\n'
+                 'def test_value(value): assert value > 0\n'}
+        self.check(files, runner='pytest', succeeds=True)
+        files['tests/conftest.py'] = (
+            'def pytest_collection_modifyitems(items):\n    items.clear()\n')
+        self.check(files, runner='pytest')

certlord-1.0.0rc1/.github/workflows/debian.yml

@@ -0,0 +1,158 @@
+name: Debian packaging
+on:
+  workflow_call:
+  pull_request:
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  debian12:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    container: debian:12
+    steps:
+      - name: Install build tools
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends ca-certificates git build-essential debhelper dh-virtualenv python3 python3-venv python3-dev python3-setuptools python3-yaml libcurl4-openssl-dev libssl-dev
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - name: Build Debian package with isolated dependencies
+        run: |
+          dpkg-buildpackage -us -uc -b
+          mkdir -p deb-artifacts
+          cp ../certlord_*.deb deb-artifacts/
+      - name: Install without network access to package indexes
+        run: |
+          export PIP_NO_INDEX=1
+          export http_proxy=http://127.0.0.1:9
+          export https_proxy=http://127.0.0.1:9
+          dpkg -i ../certlord_*.deb
+          /opt/venvs/certlord/bin/python -X faulthandler -c 'import sys; print(sys.version, flush=True); import pycurl; print("pycurl imported", flush=True); import cryptography; print("cryptography imported", flush=True)'
+          PYTHONFAULTHANDLER=1 /usr/bin/certlord --help
+          /opt/venvs/certlord/bin/python -m pip check
+          /usr/bin/python3 -I -c 'import importlib.util; assert importlib.util.find_spec("certlord") is None'
+          test ! -e /etc/certlord/certlord.yml
+          test ! -e /etc/systemd/system/multi-user.target.wants/certlord.service
+          test ! -e /etc/sudoers.d/90-certlord
+          test "$(stat -c %U /opt/venvs/certlord)" = root
+          test "$(stat -c %U /var/lib/certlord)" = certlord
+      - name: Installed regression suites outside source checkout
+        run: |
+          suite_dir=$(mktemp -d)
+          cp -R tests etc "$suite_dir/"
+          cp .github/scripts/check-test-collection.py "$suite_dir/"
+          cd "$suite_dir"
+          /opt/venvs/certlord/bin/python check-test-collection.py --runner unittest tests tests/contracts
+          /opt/venvs/certlord/bin/python -m unittest discover -s tests -q
+          /opt/venvs/certlord/bin/python -m unittest discover -s tests/contracts -q
+      - name: Reconfigure and remove without deleting local state
+        run: |
+          touch /var/lib/certlord/retained-fixture
+          PIP_NO_INDEX=1 dpkg -i ../certlord_*.deb
+          dpkg --remove certlord
+          test -f /var/lib/certlord/retained-fixture
+          test ! -e /usr/bin/certlord
+      - uses: actions/upload-artifact@v4
+        with:
+          name: certlord-debian12-amd64
+          path: deb-artifacts/*.deb
+          if-no-files-found: error
+          retention-days: 7
+  clean-runtime:
+    needs: debian12
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    container: debian:12
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: certlord-debian12-amd64
+          path: /tmp/certlord-package
+      - name: Install on clean runtime without build dependencies
+        run: |
+          apt-get update -qq
+          apt-get install -y --no-install-recommends /tmp/certlord-package/certlord_*.deb
+          cd /tmp
+          PYTHONFAULTHANDLER=1 /usr/bin/certlord --help
+          /opt/venvs/certlord/bin/certbot --version
+          /opt/venvs/certlord/bin/auton --help
+          /opt/venvs/certlord/bin/python -m pip check
+          /usr/bin/python3 -I -c 'import importlib.util; assert importlib.util.find_spec("certlord") is None'
+          test ! -e /etc/certlord/certlord.yml
+          test ! -e /etc/sudoers.d/90-certlord
+          test ! -e /etc/systemd/system/multi-user.target.wants/certlord.service
+  systemd-runtime:
+    needs: debian12
+    runs-on: ubuntu-latest
+    timeout-minutes: 12
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/download-artifact@v4
+        with:
+          name: certlord-debian12-amd64
+          path: tests/integration/package
+      - name: Fetch checksum-verified disposable Vault
+        run: |
+          curl --fail --silent --show-error --location --retry 2 --max-time 120 https://releases.hashicorp.com/vault/1.20.4/vault_1.20.4_linux_amd64.zip --output "$RUNNER_TEMP/vault.zip"
+          echo "fc5fb5d01d192f1216b139fb5c6af17e3af742aaeffc289fd861920ec55f2c9c  $RUNNER_TEMP/vault.zip" | sha256sum --check
+          unzip -q "$RUNNER_TEMP/vault.zip" vault -d tests/integration
+      - name: Build disposable systemd acceptance image
+        run: docker build --target service -f tests/integration/systemd.Dockerfile -t certlord-systemd-fixture tests/integration
+      - name: Boot systemd and verify installed service
+        run: |
+          mkdir -p "$RUNNER_TEMP/systemd-evidence"
+          docker run -d --name certlord-systemd --privileged --cgroupns=private --tmpfs /run --tmpfs /run/lock --mount "type=bind,src=$RUNNER_TEMP/systemd-evidence,dst=/evidence" certlord-systemd-fixture
+          timeout 45 bash -c 'until docker exec certlord-systemd systemctl list-units --no-pager >/dev/null 2>&1; do sleep 1; done'
+          docker exec certlord-systemd /opt/venvs/certlord/bin/python /fixture/systemd_acceptance.py
+      - name: Retain sanitized systemd evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: certlord-systemd-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/systemd-evidence/systemd.json
+          if-no-files-found: warn
+          retention-days: 7
+      - name: Remove disposable acceptance container
+        if: always()
+        run: |
+          if docker container inspect certlord-systemd >/dev/null 2>&1; then
+            docker rm -f certlord-systemd
+          fi
+  systemd-lifecycle:
+    needs: debian12
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/download-artifact@v4
+        with:
+          name: certlord-debian12-amd64
+          path: tests/integration/package
+      - name: Prepare checksum-verified disposable tools and examples
+        run: |
+          bash .github/scripts/install-lifecycle-tools.sh "$GITHUB_WORKSPACE/tests/integration/tools"
+          cp tests/integration/tools/vault tests/integration/vault
+          mkdir tests/integration/source
+          cp -R etc tests/integration/source/
+      - name: Build installed-service lifecycle image
+        run: docker build --target lifecycle -f tests/integration/systemd.Dockerfile -t certlord-systemd-lifecycle tests/integration
+      - name: Interrupt actual issuance and deployment through systemctl
+        run: |
+          mkdir -p "$RUNNER_TEMP/systemd-lifecycle-evidence"
+          docker run -d --name certlord-systemd-lifecycle --privileged --cgroupns=private --tmpfs /run --tmpfs /run/lock --mount "type=bind,src=$RUNNER_TEMP/systemd-lifecycle-evidence,dst=/evidence" certlord-systemd-lifecycle
+          timeout 45 bash -c 'until docker exec certlord-systemd-lifecycle systemctl list-units --no-pager >/dev/null 2>&1; do sleep 1; done'
+          docker exec -e CERTLORD_DISPOSABLE_SYSTEMD=1 -e PATH=/opt/venvs/certlord/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin certlord-systemd-lifecycle /opt/venvs/certlord/bin/python /fixture/lifecycle.py run --systemd-scheduler --tools /fixture/tools --source /fixture/source --report /evidence/report.json
+      - name: Retain sanitized systemd lifecycle evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: certlord-systemd-lifecycle-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/systemd-lifecycle-evidence/report.json
+          if-no-files-found: warn
+          retention-days: 7
+      - name: Remove disposable lifecycle container
+        if: always()
+        run: |
+          if docker container inspect certlord-systemd-lifecycle >/dev/null 2>&1; then
+            docker rm -f certlord-systemd-lifecycle
+          fi

certlord-1.0.0rc1/.github/workflows/lifecycle.yml

@@ -0,0 +1,39 @@
+name: lifecycle acceptance
+on:
+  workflow_call:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+permissions:
+  contents: read
+jobs:
+  lifecycle:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: '3.12'
+      - name: Install runtime and pinned external clients
+        run: |
+          sudo apt-get update -qq
+          sudo apt-get install -y redis-server unzip
+          python -m pip install . 'certbot-httpreq==0.0.24' 'acme-http-connector==0.2.1' 'certbot==5.8.0' 'auton==1.2.1' 'autond==1.2.1'
+      - name: Install checksum-verified disposable CA and Vault
+        run: bash .github/scripts/install-lifecycle-tools.sh "$RUNNER_TEMP/certlord-tools"
+      - name: Installed lifecycle, actual served TLS and failure recovery
+        working-directory: ${{ runner.temp }}
+        run: >-
+          python "$GITHUB_WORKSPACE/tests/integration/lifecycle.py" run
+          --tools "$RUNNER_TEMP/certlord-tools" --source "$GITHUB_WORKSPACE"
+          --report "$RUNNER_TEMP/certlord-evidence/report.json"
+      - name: Retain only sanitized test evidence
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: certlord-lifecycle-${{ github.run_attempt }}
+          path: ${{ runner.temp }}/certlord-evidence/report.json
+          if-no-files-found: warn
+          retention-days: 7

certlord-1.0.0rc1/.github/workflows/pypi.yml

@@ -0,0 +1,98 @@
+name: Release candidate and PyPI publication
+on:
+  workflow_dispatch:
+  push:
+    tags: ['v*']
+  pull_request:
+permissions:
+  contents: read
+concurrency:
+  group: publish-${{ github.ref }}
+  cancel-in-progress: false
+jobs:
+  tests:
+    uses: ./.github/workflows/tests.yml
+  lifecycle:
+    uses: ./.github/workflows/lifecycle.yml
+  debian:
+    uses: ./.github/workflows/debian.yml
+  build:
+    needs: [tests, lifecycle, debian]
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+        with:
+          python-version: '3.12'
+      - run: python -m pip install build twine PyYAML
+      - run: python -m build
+      - run: python -m twine check --strict dist/*
+      - run: python .github/scripts/check-release.py
+      - uses: actions/upload-artifact@v4
+        with:
+          name: release-distributions
+          path: dist/
+          if-no-files-found: error
+  tag:
+    needs: build
+    if: (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main') && github.repository == 'decryptus/certlord' && !github.event.repository.private
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    outputs:
+      version: ${{ steps.tag.outputs.version }}
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+      - id: tag
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -eu
+          version=$(cat VERSION)
+          echo "version=$version" >> "$GITHUB_OUTPUT"
+          tag="v$version"
+          if existing=$(gh api "repos/$GITHUB_REPOSITORY/git/ref/tags/$tag" --jq '.object.sha'); then
+            test "$existing" = "$GITHUB_SHA"
+          else
+            gh api --method POST "repos/$GITHUB_REPOSITORY/git/refs" -f ref="refs/tags/$tag" -f sha="$GITHUB_SHA"
+          fi
+  publish:
+    needs: [build, tag]
+    if: (github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main') && github.repository == 'decryptus/certlord' && !github.event.repository.private
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: release-distributions
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+  github-release:
+    needs: [publish, tag]
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        with:
+          persist-credentials: false
+      - uses: actions/download-artifact@v4
+        with:
+          name: release-distributions
+          path: dist/
+      - name: Publish matching GitHub release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: v${{ needs.tag.outputs.version }}
+        run: |
+          set -eu
+          prerelease_flag=''
+          case "$RELEASE_TAG" in *rc*|*a[0-9]*|*b[0-9]*) prerelease_flag='--prerelease';; esac
+          gh release create "$RELEASE_TAG" dist/* --verify-tag --title "CertLord $RELEASE_TAG" --notes-file docs/release-notes.md $prerelease_flag

certlord-1.0.0rc1/.github/workflows/tests.yml

@@ -0,0 +1,56 @@
+name: Tests
+on:
+  workflow_call:
+  push:
+  pull_request:
+permissions:
+  contents: read
+jobs:
+  tests:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python: ['3.11', '3.12']
+        dependencies: ['minimum', 'latest']
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        with:
+          python-version: ${{ matrix.python }}
+      - name: Install dependencies
+        run: |
+          if [ "${{ matrix.dependencies }}" = "minimum" ]; then
+            python -m pip install -r requirements.txt -c constraints-minimum.txt build
+          else
+            python -m pip install -r requirements.txt build
+          fi
+          python -m pip check
+      - name: Verify collection and its failure guards
+        run: |
+          python .github/scripts/check-test-collection.py --runner unittest tests tests/contracts
+          python .github/scripts/check-test-collection.py --runner unittest .github/tests
+          python -m unittest discover -s .github/tests -v
+      - name: Unit tests
+        run: python -m unittest discover -s tests -v
+      - name: Component contracts
+        run: python -m unittest discover -s tests/contracts -v
+      - name: Build source archive and wheel
+        run: python -m build
+      - name: Install built wheel
+        run: |
+          python -m pip install --force-reinstall --no-deps dist/*.whl
+          python -m pip check
+      - name: Installed CLI smoke test
+        working-directory: /tmp
+        run: certlord --help
+
+
+      - name: Installed-package regression suites outside checkout
+        working-directory: /tmp
+        run: |
+          suite_dir=$(mktemp -d)
+          cp -R "$GITHUB_WORKSPACE/tests" "$GITHUB_WORKSPACE/etc" "$suite_dir/"
+          cd "$suite_dir"
+          python "$GITHUB_WORKSPACE/.github/scripts/check-test-collection.py" --runner unittest tests tests/contracts
+          python -m unittest discover -s tests -v
+          python -m unittest discover -s tests/contracts -v

certlord-1.0.0rc1/AGENTS.md

@@ -0,0 +1,31 @@
+# Engineering requirements
+
+These are maintainer requirements.
+
+## Test discovery and execution
+
+- Verify the actual runner and every discovery root before adding or changing
+  tests. A green command does not prove that all test declarations were loaded.
+  Do not put standalone pytest functions into a suite run only by unittest.
+- Run `.github/scripts/check-test-collection.py` with Python, the same
+  interpreter/environment as the tests, and the declared runner. Pass separately
+  discovered directories together when they are nested. The guard compares
+  declarations in `test*.py` files with actual collection; it does not run tests.
+- Reject empty suites, import/collection errors, duplicate definitions and
+  declarations omitted by the runner. Keep test helpers out of the `test*`
+  namespace. Explain intentional skips and separate integration prerequisites;
+  never hide failures with `continue-on-error` or `|| true`.
+- Run the normal test command after the guard. Report collected/executed/skipped
+  counts and investigate unexpected changes; collection alone is not a passing
+  test run. Parameterization may produce several cases per declaration.
+- Check test paths, naming patterns, selection filters and CI commands together.
+  A new test directory or non-Python test harness needs an explicit CI entry;
+  this guard only covers the directories and Python naming pattern passed to it.
+- Verify installed-package tests outside the source checkout where applicable.
+  Architecture scans must resolve the package under test and reject empty scans.
+- Preserve supported interpreter matrices. Changing runners requires an explicit
+  decision and collection parity; this Python 3.8+ CI helper does not replace
+  legacy-interpreter execution or integration/system acceptance tests.
+
+Current project runner: `unittest` for `tests` and `tests/contracts`. CI helper tests use
+`unittest` in `.github/tests`.

certlord-1.0.0rc1/CHANGELOG

@@ -0,0 +1,9 @@
+certlord (1.0.0~rc1) UNRELEASED; urgency=medium
+
+  * Prepare the first public release candidate, Python version 1.0.0rc1.
+  * ACME issuance/renewal and external PEM import/versioned replacement.
+  * Vault KV v2 storage, authenticated HTTP API, CLI and explicit TUI.
+  * Auton deployment, optional remote receipts and served TLS verification.
+  * Operational observations, bounded shutdown and recovery checks.
+
+ -- Adrien Delle Cave <pypi@doowan.net>  Sat, 03 Oct 2026 00:45:00 +0000