certora-cli 8.8.0__tar.gz → 8.11.3__tar.gz

{certora_cli-8.8.0/certora_cli.egg-info → certora_cli-8.11.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: certora-cli
-Version: 8.8.0
+Version: 8.11.3
 Summary: Runner for the Certora Prover
 Home-page: https://pypi.org/project/certora-cli
 Author: Certora
@@ -38,4 +38,4 @@ Dynamic: requires-dist
 Dynamic: requires-python
 Dynamic: summary
 
-Commit 2cf089d.                    Build and Run scripts for executing the Certora Prover on Solidity smart contracts.
+Commit d4f463a.                    Build and Run scripts for executing the Certora Prover on Solidity smart contracts.

certora_cli-8.11.3/README.md

@@ -0,0 +1 @@
+Commit d4f463a.                    Build and Run scripts for executing the Certora Prover on Solidity smart contracts.

{certora_cli-8.8.0 → certora_cli-8.11.3}/certora_cli/CertoraProver/certoraBuild.py

@@ -890,7 +890,7 @@ class CertoraBuildGenerator:
                 #       same name but used separately could exist right?
                 # Add to the current contract all public/external functions, and internal/private ones if
                 # this is the declaring contract.
-                if func_visibility in ("public", "external") or (c_name == contract_name):
+                if func_visibility in ("public", "external") or (c_name == contract_name and c_file == contract_file):
                     funcs.append(func)
                     ast_logger.debug(f"Function {func.source_code_signature()} added")
 
@@ -1114,11 +1114,12 @@ class CertoraBuildGenerator:
                 assert "baseName" in bc and "referencedDeclaration" in bc["baseName"]
                 next_bc_ref = bc["baseName"]["referencedDeclaration"]
                 next_bc = self.get_contract_file_of(build_arg_contract_file, next_bc_ref)
-                if next_bc not in base_contracts_lst:
+                next_bc_name = self.asts[build_arg_contract_file][next_bc][next_bc_ref]["name"]
+                if (next_bc, next_bc_name) not in [(e[0], e[1]) for e in base_contracts_lst]:
                     base_contracts_lst.append(
-                        (next_bc, self.asts[build_arg_contract_file][next_bc][next_bc_ref]["name"],
+                        (next_bc, next_bc_name,
                          self.is_library_def_node(next_bc, next_bc_ref, build_arg_contract_file)))
-                    base_contracts_queue.insert(0, (next_bc, bc["baseName"]["referencedDeclaration"]))
+                    base_contracts_queue.insert(0, (next_bc, next_bc_ref))
 
             if base_contracts_queue:
                 retrieve_base_contracts_list_rec(base_contracts_queue, base_contracts_lst)
@@ -1447,7 +1448,9 @@ class CertoraBuildGenerator:
             if not self.context.strict_solc_optimizer and self.get_solc_via_ir_value(contract_file_path):
                 # The default optimizer steps (taken from libsolidity/interface/OptimiserSettings.h) but with the
                 # full inliner step removed
-                solc0_8_26_to_0_8_30 = ("dhfoDgvulfnTUtnIfxa[r]EscLMVcul[j]Trpeulxa[r]cLCTUca[r]LSsTFOtfDnca[r]" +
+                solc0_8_34_to_0_8_34 = ("dfDvulfnTUtnIfxa[r]EscLMVcul[j]Trpeulxa[r]cLvifMCTUca[r]LSsTFOtfDnca[r]"
+                                        "IulcscCTUtvifMx[scCTUt]TOntnfDIulvifMjmul[jul]VcTOculjmul")
+                solc0_8_26_to_0_8_33 = ("dhfoDgvulfnTUtnIfxa[r]EscLMVcul[j]Trpeulxa[r]cLCTUca[r]LSsTFOtfDnca[r]" +
                                         "IulcscCTUtx[scCTUt]TOntnfDIuljmul[jul]VcTOculjmul")
                 solc0_8_13_to_0_8_25 = "dhfoDgvulfnTUtnIf[xa[r]EscLMcCTUtTOntnfDIulLculVcul[j]T" + \
                                        "peulxa[rul]xa[r]cLgvifCTUca[r]LSsTFOtfDnca[r]Iulc]jmul[jul]VcTOculjmul"
@@ -1496,8 +1499,10 @@ class CertoraBuildGenerator:
                     yul_optimizer_steps = solc0_8_12
                 elif minor == 8 and 13 <= patch <= 25:
                     yul_optimizer_steps = solc0_8_13_to_0_8_25
-                elif minor == 8 and 26 <= patch <= 30:
-                    yul_optimizer_steps = solc0_8_26_to_0_8_30
+                elif minor == 8 and 26 <= patch <= 33:
+                    yul_optimizer_steps = solc0_8_26_to_0_8_33
+                elif minor == 8 and 34 <= patch <= 34:
+                    yul_optimizer_steps = solc0_8_34_to_0_8_34
                 assert yul_optimizer_steps is not None, \
                     'Yul Optimizer steps missing for requested Solidity version. Please contact Certora team.'
 
@@ -1591,10 +1596,12 @@ class CertoraBuildGenerator:
                                 "evm.bytecode.functionDebugData"]
             ast_selection = ["id", "ast"]
         elif compiler_collector_lang == CompilerLangVy():
-            main_contract_for_output_selection = "*"
             sources_dict = {}
-            with open(contract_file_posix_abs) as f:
-                if self.context.vyper_custom_std_json_in_map and contract_file_as_provided in self.context.vyper_custom_std_json_in_map:
+            vyper_custom_std_json_in = None
+
+            if self.context.vyper_custom_std_json_in_map:
+                main_contract_for_output_selection = contract_file_as_provided
+                if contract_file_as_provided in self.context.vyper_custom_std_json_in_map:
                     """
                     If we're given a custom standard_json, we'll take from it the sources and
                     the search paths.
@@ -1606,18 +1613,36 @@ class CertoraBuildGenerator:
                     if we get more projects.
                     """
                     vyper_custom_std_json_in = self.context.vyper_custom_std_json_in_map[contract_file_as_provided]
-                    with open(vyper_custom_std_json_in) as custom:
-                        custom_json = json.load(custom)
-                        sources_dict = custom_json.get("sources", None)
-                        search_paths_arr = custom_json.get("settings", {}).get("search_paths", None)
-                        additional_asts = [x for x, _ in sources_dict.items() if x.endswith(".vy")]
-                if not sources_dict:
+            elif self.context.resolve_vyper_imports and compiler_collector.compiler_version >= (0, 4, 0):
+                main_contract_for_output_selection = contract_file_as_provided
+                """
+                If resolve_vyper_imports is enabled, we ask the vyper compiler to generate a standard_json for us.
+                """
+                compiler_ver_to_run = get_relevant_compiler(Path(contract_file_as_provided), self.context)
+                vyper_options = f"-f solc_json {contract_file_as_provided} --disable-sys-path"
+                for path in ((self.context.vyper_system_path or []) + (self.context.vyper_import_path or [])):
+                    vyper_options += f" -p {path}"
+                Util.run_compiler_cmd(f"{compiler_ver_to_run} {vyper_options}",
+                                      f"{contract_file_posix_abs.name}.std_json_generated.json",
+                                      wd=compile_wd)
+                vyper_custom_std_json_in = compiler_collector_lang.compilation_output_path(
+                    f"{contract_file_posix_abs.name}.std_json_generated.stdout.json")
+
+            if vyper_custom_std_json_in:
+                with open(vyper_custom_std_json_in) as custom:
+                    custom_json = json.load(custom)
+                    sources_dict = custom_json.get("sources", None)
+                    search_paths_arr = custom_json.get("settings", {}).get("search_paths", None)
+                    additional_asts = [x for x, _ in sources_dict.items() if x.endswith(".vy")]
+
+            if not sources_dict:
+                with open(contract_file_posix_abs) as f:
                     contents = f.read()
                     sources_dict = {str(contract_file_posix_abs): {"content": contents}}
-                output_selection = ["abi", "evm.bytecode", "evm.deployedBytecode", "evm.methodIdentifiers"]
-                if compiler_collector.compiler_version >= (0, 4, 4):
-                    output_selection += ["metadata", "evm.deployedBytecode.symbolMap"]
-                ast_selection = ["ast"]
+            output_selection = ["abi", "evm.bytecode", "evm.deployedBytecode", "evm.methodIdentifiers"]
+            if compiler_collector.compiler_version >= (0, 4, 4):
+                output_selection += ["metadata", "evm.deployedBytecode.symbolMap"]
+            ast_selection = ["ast"]
         else:
             # "non-compilable" language so no need to deal with it
             fatal_error(compiler_logger, "Expected only Solidity and Vyper as "
@@ -2483,8 +2508,8 @@ class CertoraBuildGenerator:
         return f"{contract}_{address}"
 
     @staticmethod
-    def get_primary_contract_from_sdc(contracts: List[ContractInSDC], primary: str) -> List[ContractInSDC]:
-        return [x for x in contracts if x.name == primary]
+    def get_primary_contract_from_sdc(contracts: List[ContractInSDC], primary: str, primary_file: str) -> List[ContractInSDC]:
+        return [x for x in contracts if x.name == primary and Util.abs_norm_path(x.original_file) == Util.abs_norm_path(primary_file)]
 
     @staticmethod
     def generate_library_import(file_absolute_path: str, library_name: str) -> str:
@@ -2945,7 +2970,7 @@ class CertoraBuildGenerator:
                                   sdc.original_srclist,
                                   sdc.report_srclist,
                                   f"{sdc.sdc_name}_{library_contract.name}",
-                                  self.get_primary_contract_from_sdc(sdc.contracts, library_contract.name),
+                                  self.get_primary_contract_from_sdc(sdc.contracts, library_contract.name, library_contract.original_file),
                                   [],
                                   {},
                                   {},
@@ -2956,7 +2981,7 @@ class CertoraBuildGenerator:
                     self.SDCs[self.get_sdc_key(sdc_lib.primary_contract, sdc_lib.primary_contract_address)] = sdc_lib
 
                 # Filter out irrelevant contracts, now that we extracted the libraries, leave just the primary
-                sdc.contracts = self.get_primary_contract_from_sdc(sdc.contracts, sdc.primary_contract)
+                sdc.contracts = self.get_primary_contract_from_sdc(sdc.contracts, sdc.primary_contract, sdc.sdc_origin_file)
                 assert len(
                     sdc.contracts) == 1, f"Found multiple primary contracts ({sdc.contracts}) in SDC {sdc.sdc_name}"
 
@@ -2977,8 +3002,13 @@ class CertoraBuildGenerator:
         corresponding to the namespaced types.
 
         Args:
-            original_file: Path to the Solidity file containing namespaced storage declarations
+            original_file: Path to the Solidity file containing namespaced storage declarations.
+                This may be a (transitivly) imported file rather than a user-specified target.
             ns_storage: Set of tuples (type_name, namespace) for each namespaced storage
+            compiler_version: The compiler version to use, already resolved from target_file
+            target_file: The user-specified file (from conf file) that imported original_file.
+                Used to resolve compilation settings (solc_optimize_map, solc_via_ir_map, etc.)
+                for the temporary harness file, since original_file may not have entries in those maps.
 
         Returns:
             NewStorageInfo: A tuple (fields, types) where:
@@ -2997,8 +3027,24 @@ class CertoraBuildGenerator:
             # directly can cause issues.
             tmp_file.write(f"import \"{original_file}\";\n\n")
             rel_path = os.path.relpath(tmp_file.name, Path.cwd())
-            if self.context.compiler_map:
-                self.context.compiler_map.update({rel_path: compiler_version}, last=False)
+            tmp_abs_path = Util.abs_posix_path(tmp_file.name)
+            # Add the temp file to all map attributes so that map lookups
+            # (solc_optimize_map, solc_via_ir_map, etc.) succeed during compilation.
+            # We resolve values from target_file (a user-specified file in context.file_paths)
+            # rather than original_file (which may be a transitive dependency not in any map).
+            # We store both relative and absolute path keys because different lookup sites
+            # normalize paths differently: get_relevant_compiler uses relative paths,
+            # while _handle_via_ir/_handle_optimize use absolute paths.
+            for map_attr in self.context.app.attr_class.all_map_attrs():
+                map_attr_value = getattr(self.context, map_attr, None)
+                if not map_attr_value:
+                    continue
+                attr_name = map_attr[:-len(Util.MAP_SUFFIX)]
+                target_value = Ctx.get_map_attribute_value(
+                    self.context, Path(target_file), attr_name
+                )
+                if target_value is not None:
+                    map_attr_value.update({rel_path: target_value, tmp_abs_path: target_value}, last=False)
             # Write the harness contract with dummy fields for each namespaced storage
             var_to_slot = storageExtension.write_harness_contract(tmp_file, harness_name, ns_storage)
             tmp_file.flush()
@@ -4121,8 +4167,13 @@ def build_from_scratch(context: CertoraContext,
                   indent=4,
                   sort_keys=True)
 
+    # check if asts file exists (only when --dump_asts is used)
+    asts_file = Util.get_asts_file()
+    asts_file_if_exists = asts_file if asts_file.exists() else None
+
     return CachedFiles(certora_build_file, all_contract_files, build_output_props_file, may_store_in_build_cache,
-                       path_with_additional_included_files=absolute_sources_dir)
+                       path_with_additional_included_files=absolute_sources_dir,
+                       asts_file=asts_file_if_exists)
 
 
 def build_from_cache_or_scratch(context: CertoraContext,
@@ -4204,6 +4255,10 @@ def build_from_cache_or_scratch(context: CertoraContext,
         else:
             shutil.copyfile(p, Util.get_certora_sources_dir() / p.name)
 
+    # restore asts file from cache if present
+    if cached_files.asts_file is not None and cached_files.asts_file.exists():
+        shutil.copyfile(cached_files.asts_file, Util.get_asts_file())
+
     return False, cached_files
 
 

{certora_cli-8.8.0 → certora_cli-8.11.3}/certora_cli/CertoraProver/certoraBuildCacheManager.py

@@ -41,6 +41,9 @@ class CachedFiles:
     # to keep .post_autofinders
     path_with_additional_included_files: Path
 
+    # optional asts file (only present when --dump_asts is used)
+    asts_file: Optional[Path] = None
+
     def all_exist(self, main_cache_entry_dir: Path, sub_cache_key: str) -> bool:
         exist = self.certora_build_file.exists() and \
             self.certora_build_file == main_cache_entry_dir / f"{sub_cache_key}.{CachedFiles.certora_build_suffix}"
@@ -55,6 +58,7 @@ class CachedFiles:
     file_list_suffix = "file_list.json"
     build_output_props_suffix = "build_output_props.json"
     additional_included_files = "additional_included_files"
+    asts_suffix = "asts.json"
 
 
 class CertoraBuildCacheManager:
@@ -124,8 +128,14 @@ class CertoraBuildCacheManager:
             return None
 
         additional_included_files = main_cache_entry_dir / f"{sub_cache_key}.{CachedFiles.additional_included_files}"
+
+        # check if asts file exists in cache
+        asts_file_in_cache = main_cache_entry_dir / f"{sub_cache_key}.{CachedFiles.asts_suffix}"
+        asts_file = asts_file_in_cache if asts_file_in_cache.exists() else None
+
         return CachedFiles(certora_build_file, all_contract_files, build_output_props_file,
-                           may_store_in_build_cache=True, path_with_additional_included_files=additional_included_files)
+                           may_store_in_build_cache=True, path_with_additional_included_files=additional_included_files,
+                           asts_file=asts_file)
 
     @staticmethod
     def save_build_cache(context: CertoraContext, cached_files: CachedFiles) -> None:
@@ -170,6 +180,11 @@ class CertoraBuildCacheManager:
         # save additional props file
         shutil.copyfile(cached_files.build_output_props_file,
                         main_cache_entry_dir / f"{sub_cache_key}.{CachedFiles.build_output_props_suffix}")
+        # save asts file if present
+        if cached_files.asts_file is not None and cached_files.asts_file.exists():
+            shutil.copyfile(cached_files.asts_file,
+                            main_cache_entry_dir / f"{sub_cache_key}.{CachedFiles.asts_suffix}")
+
         # save .post_autofinders from additional included files
         trg_path_with_additional_included_files = \
             main_cache_entry_dir / f"{sub_cache_key}.{CachedFiles.additional_included_files}"

{certora_cli-8.8.0 → certora_cli-8.11.3}/certora_cli/CertoraProver/certoraBuildSui.py

@@ -55,13 +55,42 @@ def build_sui_project(context: CertoraContext, timings: Dict) -> None:
 def set_sui_build_directory(context: CertoraContext) -> None:
     sources: Set[Path] = set()
 
-    # If no move_path was specified, try to build the package
-    if not context.move_path:
-        move_toml_file = Util.find_file_in_parents("Move.toml")
-        if not move_toml_file:
-            raise Util.CertoraUserInputError("Could not find Move.toml, and no move_path was specified.")
+    move_toml_file: Path | None = None
+
+    if context.move_path:
+        # If move_path is specified, we assume the user has already built the spec package separately.  This is a legacy
+        # option that should not be used by new projects; they should use `spec_package_path` and/or `build_script`
+        # instead.
+        assert not context.build_script, "cannot have move_path and build_script together"
+        assert not context.spec_package_path, "cannot have move_path and spec_package_path together"
+        context.sui_package_summary_path = None
+    else:
+        if context.spec_package_path:
+            # Verify that there is a Move.toml at the specified spec_package_path
+            spec_package_dir = Path(context.spec_package_path)
+            move_toml_file = spec_package_dir / "Move.toml"
+            if not move_toml_file.exists():
+                raise Util.CertoraUserInputError(f"Could not find Move.toml at specified spec_package_path '{context.spec_package_path}'")
+        else:
+            # If spec_package_path is not specified, try to find the package that the current directory is in.
+            move_toml_file = Util.find_file_in_parents("Move.toml")
+            if not move_toml_file:
+                raise Util.CertoraUserInputError("Could not find Move.toml, and no spec_package_path was specified.")
+            spec_package_dir = move_toml_file.parent
+            context.spec_package_path = str(spec_package_dir)
+
         sources.add(move_toml_file.absolute())
-        run_sui_build(context, move_toml_file.parent)
+        context.move_path = str(spec_package_dir / "build")
+        context.sui_package_summary_path = spec_package_dir / "package_summaries"
+
+        if context.build_script:
+            # Run the user-provided build script
+            script_path = Path(context.build_script).resolve()
+            sources.add(script_path)
+            run_sui_build([str(script_path), str(spec_package_dir)])
+        else:
+            # Build the package using `sui move summary`, which will also produce the package summaries.
+            run_sui_build(["sui", "move", "summary", "--test", "--path", str(move_toml_file.parent)])
 
     assert context.move_path, "expecting move_path to be set after build"
     move_dir = Path(context.move_path)
@@ -81,6 +110,12 @@ def set_sui_build_directory(context: CertoraContext) -> None:
                     Util.get_build_dir() / move_dir.name,
                     ignore=shutil.ignore_patterns('*.move'))
 
+    # Copy package summary directory if it exists.  Projects built manually with "sui move build" may not have this.
+    if context.sui_package_summary_path and context.sui_package_summary_path.exists():
+        assert context.sui_package_summary_path.is_dir(), f"Package summary path '{context.sui_package_summary_path}' is not a directory"
+        shutil.copytree(context.sui_package_summary_path,
+                        Util.get_build_dir() / context.sui_package_summary_path.name)
+
     try:
         # Create generators
         build_source_tree(sources, context)
@@ -88,11 +123,8 @@ def set_sui_build_directory(context: CertoraContext) -> None:
     except Exception as e:
         raise Util.CertoraUserInputError(f"Collecting build files failed with the exception: {e}")
 
-def run_sui_build(context: CertoraContext, package_dir: Path) -> None:
-    assert not context.move_path, "run_sui_build: expecting move_path to be empty"
-
-    build_cmd = ["sui", "move", "build", "--test", "--path", str(package_dir)]
 
+def run_sui_build(build_cmd: list[str]) -> None:
     try:
         build_cmd_text = ' '.join(build_cmd)
         log.info(f"Building by calling `{build_cmd_text}`")
@@ -102,8 +134,6 @@ def run_sui_build(context: CertoraContext, package_dir: Path) -> None:
         if result.returncode != 0:
             raise Util.CertoraUserInputError(f"Error running `{build_cmd_text}`")
 
-        context.move_path = str(package_dir / "build")
-
     except Util.TestResultsReady as e:
         raise e
     except Util.CertoraUserInputError as e:

{certora_cli-8.8.0 → certora_cli-8.11.3}/certora_cli/CertoraProver/certoraCloudIO.py

@@ -615,6 +615,9 @@ class CloudVerification:
 
         elif Attrs.is_sui_app():
             sui_jar_settings = ['-movePath', Path(self.context.move_path).name]
+            if self.context.sui_package_summary_path and self.context.sui_package_summary_path.exists():
+                sui_jar_settings.append('-suiPackageSummaryPath')
+                sui_jar_settings.append(self.context.sui_package_summary_path.name)
             auth_data["jarSettings"] = sui_jar_settings + jar_settings
 
         elif Attrs.is_concord_app():
@@ -766,6 +769,9 @@ class CloudVerification:
                           Util.get_configuration_layout_data_file(),
                           Util.get_build_dir() / Path(self.context.move_path).name]
 
+            if self.context.sui_package_summary_path and self.context.sui_package_summary_path.exists():
+                files_list.append(Util.get_build_dir() / self.context.sui_package_summary_path.name)
+
             if Util.get_certora_sources_dir().exists():
                 files_list.append(Util.get_certora_sources_dir())
 

{certora_cli-8.8.0 → certora_cli-8.11.3}/certora_cli/CertoraProver/certoraContext.py

@@ -63,6 +63,9 @@ def is_evm_app_class(context: CertoraContext) -> bool:
 def is_rust_app_class(context: CertoraContext) -> bool:
     return issubclass(context.app, App.RustAppClass)
 
+def is_move_app_class(context: CertoraContext) -> bool:
+    return issubclass(context.app, App.MoveAppClass)
+
 def get_attr_value(context: CertoraContext, attr: AttrUtil.AttributeDefinition) -> Any:
     conf_key = attr.get_conf_key()
     return getattr(context, conf_key, None)
@@ -133,6 +136,9 @@ def get_local_run_cmd(context: CertoraContext) -> List[str]:
         # For local runs, we want path to be relative to cwd instead of zip root.
         move_rel_path = os.path.relpath(Path(context.move_path), os.getcwd())
         run_args.extend(['-movePath', move_rel_path])
+        if context.sui_package_summary_path and context.sui_package_summary_path.exists():
+            spec_package_summary_rel_path = os.path.relpath(context.sui_package_summary_path, os.getcwd())
+            run_args.extend(['-suiPackageSummaryPath', spec_package_summary_rel_path])
     elif is_rust_app_class(context):
         # For local runs, we want path to be relative to cwd instead of zip root.
         rust_rel_path = os.path.relpath(Path(context.files[0]), os.getcwd())
@@ -284,6 +290,9 @@ def get_args(args_list: List[str], app: Type[App.CertoraApp]) -> CertoraContext:
             Util.reset_certora_internal_dir(context.build_dir)
             os.rename(current_build_directory, context.build_dir)
 
+    if is_evm_app_class(context):
+        handle_vyper_system_path(context)
+
     # Store current options (including the ones read from .conf file)
     context.conf_options = current_conf_to_file(context)
 
@@ -297,6 +306,8 @@ def get_args(args_list: List[str], app: Type[App.CertoraApp]) -> CertoraContext:
         validator.handle_concord_attrs()
     if is_rust_app_class(context):
         validator.check_rust_args_post_argparse()
+    if is_move_app_class(context):
+        validator.check_move_args_post_argparse()
 
     attrs_to_relative(context)
     # Setup defaults (defaults are not recorded in conf file)
@@ -594,14 +605,14 @@ def run_local_spec_check(with_typechecking: bool, context: CertoraContext, extra
         raise Util.CertoraUserInputError("Cannot run local checks because of missing a suitable java installation. "
                                          "To skip local checks run with the --disable_local_typechecking flag")
 
-def attrs_to_relative(context: CertoraContext) -> None:
-    def to_relative(input_path: Union[str, Path]) -> Union[str, Path]:
-        path = Path(input_path) if isinstance(input_path, str) else input_path
-        if path.is_absolute():
-            relative_path = os.path.relpath(path, cwd)   # Path.relative_to only works for subdirectories
-            return str(relative_path) if isinstance(input_path, str) else relative_path
-        return input_path
+def to_relative(input_path: Union[str, Path]) -> Union[str, Path]:
+    path = Path(input_path) if isinstance(input_path, str) else input_path
+    if path.is_absolute():
+        relative_path = os.path.relpath(path, Path.cwd())   # Path.relative_to only works for subdirectories
+        return str(relative_path) if isinstance(input_path, str) else relative_path
+    return input_path
 
+def attrs_to_relative(context: CertoraContext) -> None:
     def str_attr_to_relative(attr_name: str) -> None:
         attr_value = getattr(context, attr_name, None)
         if attr_value:
@@ -647,7 +658,6 @@ def attrs_to_relative(context: CertoraContext) -> None:
             if Path(spec_file).is_absolute():
                 context.verify = ':'.join([contract, str(to_relative(spec_file))])
 
-    cwd = Path.cwd()
     str_attr_to_relative('packages_path')
     str_attr_to_relative('bytecode_spec')
     str_attr_to_relative('yul_abi')
@@ -683,3 +693,24 @@ def get_map_attribute_value(context: CertoraContext, path: Path, attr_name: str)
             if glob.globmatch(str(path), pattern, flags=glob.GLOBSTAR):
                 return entry_value
     raise RuntimeError(f"cannot match {attr_name} to {path} from {attr_name}_map")
+
+def handle_vyper_system_path(context: CertoraContext) -> None:
+    """
+    Just like the Vyper compiler, we add the sys.path to the search path for imports, which allows us to resolve imports
+    using a package manager.
+
+    Note that we do this here, rather than allowing the Vyper compiler to do it, because we want to persist these paths
+    in the generated run.conf file, to make it easy to reproduce in a different environment.
+    """
+    if context.resolve_vyper_imports:
+        if not context.vyper_system_path:
+            # Pass the directories from sys.path in reversed order (Vyper treats later paths as higher precedence)
+            context.vyper_system_path = [
+                to_relative(p) for p in reversed(sys.path) if Path(p).is_dir()
+            ]
+        else:
+            # Filter out any directories that do not exist, to make the generated run.conf file more portable to
+            # different environments.
+            context.vyper_system_path = [
+                p for p in context.vyper_system_path if Path(p).is_dir()
+            ]

{certora_cli-8.8.0 → certora_cli-8.11.3}/certora_cli/CertoraProver/certoraContextAttributes.py

@@ -269,6 +269,22 @@ class DeprecatedAttributes(AttrUtil.Attributes):
             main_section=MainSection.SOLIDITY_COMPILER
         )
     )
+    MOVE_PATH = AttrUtil.AttributeDefinition(
+        attr_validation_func=Vf.validate_dir,
+        arg_type=AttrUtil.AttrArgType.STRING,
+        help_msg="path to a directory which includes all binary .mv files for the Prover",
+        deprecation_msg="`move_path` is deprecated and will be removed in a future release. "
+                        "Please use `spec_package_path` instead.",
+        default_desc="",
+        argparse_args={
+            'action': AttrUtil.UniqueStore
+        },
+        affects_build_cache_key=True,
+        disables_build_cache=False,
+        config_data=AttributeJobConfigData(
+            main_section=MainSection.NEW_SECTION
+        )
+    )
 
 
 class EvmAttributes(AttrUtil.Attributes):
@@ -326,6 +342,51 @@ class EvmAttributes(AttrUtil.Attributes):
         )
     )
 
+    RESOLVE_VYPER_IMPORTS = AttrUtil.AttributeDefinition(
+        arg_type=AttrUtil.AttrArgType.BOOLEAN,
+        help_msg="Whether to resolve Vyper imports (Vyper >= 4 only)",
+        default_desc="Vyper contracts are assumed not to use the import system",
+        argparse_args={
+            "action": AttrUtil.STORE_TRUE
+        },
+        affects_build_cache_key=True,
+        disables_build_cache=False,
+        config_data=AttributeJobConfigData(
+            main_section=MainSection.SOLIDITY_COMPILER
+        )
+    )
+
+    VYPER_IMPORT_PATH = AttrUtil.AttributeDefinition(
+        attr_validation_func=Vf.validate_dir,
+        arg_type=AttrUtil.AttrArgType.LIST,
+        help_msg="Additional paths to search for Vyper imports (Vyper >= 4 only)",
+        default_desc="Only the Python system path will be searched",
+        argparse_args={
+            'nargs': AttrUtil.MULTIPLE_OCCURRENCES,
+            'action': AttrUtil.APPEND
+        },
+        affects_build_cache_key=True,
+        disables_build_cache=False,
+        config_data=AttributeJobConfigData(
+            main_section=MainSection.NEW_SECTION
+        )
+    )
+
+    VYPER_SYSTEM_PATH = AttrUtil.AttributeDefinition(
+        arg_type=AttrUtil.AttrArgType.LIST,
+        help_msg="The system path to pass to Vyper (Vyper >= 4 only); typically automatically populated",
+        default_desc="Use the current Python system path",
+        argparse_args={
+            'nargs': AttrUtil.MULTIPLE_OCCURRENCES,
+            'action': AttrUtil.APPEND
+        },
+        affects_build_cache_key=True,
+        disables_build_cache=False,
+        config_data=AttributeJobConfigData(
+            main_section=MainSection.NEW_SECTION
+        )
+    )
+
     VYPER_CUSTOM_STD_JSON_IN_MAP = AttrUtil.AttributeDefinition(
         arg_type=AttrUtil.AttrArgType.MAP,
         attr_validation_func=Vf.validate_vyper_custom_std_json_in_map,
@@ -1215,7 +1276,7 @@ class EvmAttributes(AttrUtil.Attributes):
         argparse_args={
             'action': AttrUtil.STORE_TRUE
         },
-        affects_build_cache_key=False,
+        affects_build_cache_key=True,
         disables_build_cache=False,
     )
 
@@ -1874,7 +1935,7 @@ class SorobanProverAttributes(CommonAttributes, InternalUseAttributes, BackendAt
     )
 
 
-class SuiProverAttributes(CommonAttributes, InternalUseAttributes, BackendAttributes):
+class SuiProverAttributes(CommonAttributes, InternalUseAttributes, BackendAttributes, DeprecatedAttributes):
     FILES = AttrUtil.AttributeDefinition(
         attr_validation_func=Vf.validate_dir,
         arg_type=AttrUtil.AttrArgType.LIST,
@@ -1888,10 +1949,10 @@ class SuiProverAttributes(CommonAttributes, InternalUseAttributes, BackendAttrib
         )
     )
 
-    MOVE_PATH = AttrUtil.AttributeDefinition(
+    SPEC_PACKAGE_PATH = AttrUtil.AttributeDefinition(
         attr_validation_func=Vf.validate_dir,
         arg_type=AttrUtil.AttrArgType.STRING,
-        help_msg="path to a directory which includes all binary .mv files for the Prover",
+        help_msg="path to the Move package containing the specification to be verified",
         default_desc="",
         argparse_args={
             'action': AttrUtil.UniqueStore
@@ -1903,6 +1964,17 @@ class SuiProverAttributes(CommonAttributes, InternalUseAttributes, BackendAttrib
         )
     )
 
+    BUILD_SCRIPT = AttrUtil.AttributeDefinition(
+        attr_validation_func=Vf.validate_exec_file,
+        help_msg="script to build a Move project",
+        default_desc="Using default building command",
+        argparse_args={
+            'action': AttrUtil.UniqueStore
+        },
+        affects_build_cache_key=False,
+        disables_build_cache=False
+    )
+
     RULE = AttrUtil.AttributeDefinition(
         arg_type=AttrUtil.AttrArgType.LIST,
         attr_validation_func=Vf.validate_move_rule_name,
@@ -2006,6 +2078,7 @@ class SolanaProverAttributes(CommonAttributes, InternalUseAttributes, BackendAtt
 ATTRIBUTES_CLASS: Optional[Type[AttrUtil.Attributes]] = None
 
 ARG_FLAG_LIST_ATTRIBUTES = ['prover_args', 'java_args']
+DUPLICATES_ALLOWED_LIST_ATTRIBUTES = [*ARG_FLAG_LIST_ATTRIBUTES, 'vyper_system_path']
 
 
 def get_attribute_class() -> Type[AttrUtil.Attributes]:

{certora_cli-8.8.0 → certora_cli-8.11.3}/certora_cli/CertoraProver/certoraContextValidator.py

@@ -146,7 +146,7 @@ class CertoraContextValidator:
         # Check for duplicates, we exclude ARG_FLAG_LIST_ATTRIBUTES as those can have duplicates e.g.
         # prover_args value of “-rule rule1 -rule rule2" is valid, although the -rule string appears more than once.
 
-        if conf_key not in Attrs.ARG_FLAG_LIST_ATTRIBUTES:
+        if conf_key not in Attrs.DUPLICATES_ALLOWED_LIST_ATTRIBUTES:
             if len(value) != len(set(value)):
                 raise Util.CertoraUserInputError(f"The value of attribute '{conf_key}' contains duplicate entries: {value}")
 
@@ -196,6 +196,20 @@ class CertoraContextValidator:
                          ci_value=str(Vf.UrlVisibilityOptions.PUBLIC),
                          default_value=str(Vf.UrlVisibilityOptions.PRIVATE))
 
+    def check_move_args_post_argparse(self) -> None:
+        context = self.context
+        if context.move_path:
+            # Old-style move_path specification.  We don't support build scripts or package paths in this case
+            if context.build_script:
+                raise Util.CertoraUserInputError(
+                    "'move_path' and 'build_script' cannot be used together.  To target a specific Move package with a "
+                    "build script, specify `spec_package_path`."
+                )
+            if context.spec_package_path:
+                raise Util.CertoraUserInputError(
+                    "'move_path' and 'spec_package_path' cannot be used together. `spec_package_path` is preferred."
+                )
+
     def check_args_post_argparse(self) -> None:
         """
         Performs checks over the arguments after basic argparse parsing
@@ -229,6 +243,7 @@ class CertoraContextValidator:
         set_bytecode_relative_paths(context)
         check_files_input(context.files)
         check_vyper_flag(context)
+        check_vyper_imports(context)
         check_via_ir_attr(context)
         check_contract_name_arg_inputs(context)  # Here context.contracts is set
         Util.check_packages_arguments(context)
@@ -426,6 +441,15 @@ def check_vyper_flag(context: CertoraContext) -> None:
         if not vy_paths:
             validation_logger.warning("vyper attribute was set but no Vyper files were set")
 
+def check_vyper_imports(context: CertoraContext) -> None:
+    if not context.resolve_vyper_imports:
+        if context.vyper_import_path:
+            raise Util.CertoraUserInputError("cannot set 'vyper_import_path' without setting 'resolve_vyper_imports' "
+                                             "to true")
+        if context.vyper_system_path:
+            raise Util.CertoraUserInputError("cannot set 'vyper_system_path' without setting 'resolve_vyper_imports' "
+                                             "to true")
+
 def check_contract_name_arg_inputs(context: CertoraContext) -> None:
     """
     This function verifies that all options that expect to get contract names get valid contract names.

{certora_cli-8.8.0 → certora_cli-8.11.3}/certora_cli/Shared/certoraUtils.py

@@ -265,8 +265,10 @@ def get_debug_log_file() -> Path:
 def get_extension_info_file() -> Path:
     return path_in_build_directory(Path(".vscode_extension_info.json"))
 
+ASTS_FILE_NAME = ".asts.json"
+
 def get_asts_file() -> Path:
-    return path_in_build_directory(Path(".asts.json"))
+    return path_in_build_directory(Path(ASTS_FILE_NAME))
 
 def get_zip_output_url_file() -> Path:
     return CERTORA_INTERNAL_ROOT / '.zip-output-url.txt'

{certora_cli-8.8.0 → certora_cli-8.11.3}/certora_cli/Shared/certoraValidateFuncs.py

@@ -874,6 +874,12 @@ def validate_evm_rule_name(rule_str: str) -> str:
     else:
         return __validate_solidity_id(rule_str, "rule")
 
+def validate_move_rule_pattern_string(rule_str: str) -> str:
+    if not re.match(r"^([a-zA-Z0-9_$*]|::)+$", rule_str):
+        raise Util.CertoraUserInputError(f"invalid rule pattern \"{rule_str}\": rule patterns must contain only "
+                                         "letters, digits, dollar signs, underscores, asterisks, or double colons")
+    return rule_str
+
 def validate_move_function_name(name: str) -> str:
     if not re.match(r"^(0x[0-9a-fA-F]+|([a-zA-Z_][a-zA-Z0-9_]*))::[a-zA-Z_][a-zA-Z0-9_]*::[a-zA-Z_][a-zA-Z0-9_]*$", name):
         raise Util.CertoraUserInputError(f"invalid Move function name \"{name}\": must be a fully-qualified Move "
@@ -882,7 +888,7 @@ def validate_move_function_name(name: str) -> str:
 
 def validate_move_rule_name(rule_str: str) -> str:
     if ("*" in rule_str):
-        return validate_rule_pattern_string(rule_str)
+        return validate_move_rule_pattern_string(rule_str)
     else:
         return validate_move_function_name(rule_str)
 

{certora_cli-8.8.0 → certora_cli-8.11.3/certora_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: certora-cli
-Version: 8.8.0
+Version: 8.11.3
 Summary: Runner for the Certora Prover
 Home-page: https://pypi.org/project/certora-cli
 Author: Certora
@@ -38,4 +38,4 @@ Dynamic: requires-dist
 Dynamic: requires-python
 Dynamic: summary
 
-Commit 2cf089d.                    Build and Run scripts for executing the Certora Prover on Solidity smart contracts.
+Commit d4f463a.                    Build and Run scripts for executing the Certora Prover on Solidity smart contracts.

certora_cli-8.11.3/certora_jars/CERTORA-CLI-VERSION-METADATA.json

@@ -0,0 +1 @@
+{"name": "certora-cli", "tag": "8.11.3", "branch": "", "commit": "d4f463a", "timestamp": "20260421.18.49.434064", "version": "8.11.3"}

{certora_cli-8.8.0 → certora_cli-8.11.3}/setup.py

@@ -3,11 +3,11 @@ import setuptools
 
 setuptools.setup(
     name="certora-cli",
-    version="8.8.0",
+    version="8.11.3",
     author="Certora",
     author_email="support@certora.com",
     description="Runner for the Certora Prover",
-    long_description="Commit 2cf089d.                    Build and Run scripts for executing the Certora Prover on Solidity smart contracts.",
+    long_description="Commit d4f463a.                    Build and Run scripts for executing the Certora Prover on Solidity smart contracts.",
     long_description_content_type="text/markdown",
     url="https://pypi.org/project/certora-cli",
     packages=setuptools.find_packages(),

certora_cli-8.8.0/README.md

@@ -1 +0,0 @@
-Commit 2cf089d.                    Build and Run scripts for executing the Certora Prover on Solidity smart contracts.

certora_cli-8.8.0/certora_jars/CERTORA-CLI-VERSION-METADATA.json

@@ -1 +0,0 @@
-{"name": "certora-cli", "tag": "8.8.0", "branch": "", "commit": "2cf089d", "timestamp": "20260209.18.33.322934", "version": "8.8.0"}