eqty-sdk 2.3.1rc1__tar.gz

eqty_sdk-2.3.1rc1/.claude/settings.local.json

@@ -0,0 +1,10 @@
+{
+  "permissions": {
+    "allow": [
+      "Bash(cargo check:*)",
+      "Bash(cargo clippy:*)",
+      "Bash(wc:*)",
+      "Bash(just lint-docs:*)"
+    ]
+  }
+}

eqty_sdk-2.3.1rc1/.envrc

@@ -0,0 +1,11 @@
+use flake
+
+if [[ -f .env ]]; then
+  dotenv .env
+fi
+
+# Load secrets last to override any un-set values
+if [[ -f .secrets ]]; then
+  dotenv .secrets
+fi
+

eqty_sdk-2.3.1rc1/.github/workflows/build-import-test-images.yml

@@ -0,0 +1,60 @@
+name: Build Import Test Images
+description: Builds the docker image matrix to test importing the sdk to systems with different versions of glibc, python, and pip
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - "integration-tests/images/**/Dockerfile"
+  workflow_dispatch:
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - context: integration-tests/images/centos7-python310
+            image: ghcr.io/eqtylab/import-test-centos7-python310
+          - context: integration-tests/images/ubuntu2204-python310
+            image: ghcr.io/eqtylab/import-test-ubuntu2204-python310
+          - context: integration-tests/images/ubuntu2404-python312
+            image: ghcr.io/eqtylab/import-test-ubuntu2404-python312
+          - context: integration-tests/images/debian-bookworm-python311
+            image: ghcr.io/eqtylab/import-test-debian-bookworm-python311
+          - context: integration-tests/images/ubi9-python311
+            image: ghcr.io/eqtylab/import-test-ubi9-python311
+          - context: integration-tests/images/ubi10-python312
+            image: ghcr.io/eqtylab/import-test-ubi10-python312
+          - context: integration-tests/images/alpine322-python312
+            image: ghcr.io/eqtylab/import-test-alpine322-python312
+
+    steps:
+      - name: Checkout Repo
+        uses: eqtylab-actions/checkout@v4
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to ghcr.io
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ matrix.context }}
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ matrix.image }}:latest

eqty_sdk-2.3.1rc1/.github/workflows/ci.yml

@@ -0,0 +1,201 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: 1
+
+jobs:
+  ci:
+    name: Run Tests and Checks
+    runs-on: ubuntu-latest
+    steps:
+      - name: Free runner disk space
+        run: |
+          df -h
+          candidates=(
+            /usr/local/lib/android
+            /usr/share/dotnet
+            /opt/ghc
+            /usr/local/.ghcup
+            /opt/hostedtoolcache/CodeQL
+            /usr/share/swift
+            /usr/local/share/swift
+            /usr/share/miniconda
+            /home/linuxbrew
+            /usr/local/share/vcpkg
+            /usr/local/kotlin
+            /opt/hostedtoolcache/go
+            /opt/hostedtoolcache/Python
+            /opt/hostedtoolcache/PyPy
+            /opt/hostedtoolcache/Ruby
+            /usr/local/share/boost
+            /opt/google/chrome
+            /opt/microsoft/msedge
+            /usr/lib/firefox
+          )
+          shopt -s nullglob
+          candidates+=(/usr/local/julia*)
+
+          for path in "${candidates[@]}"; do
+            if [ -d "$path" ]; then
+              size=$(du -sx --block-size=1 "$path" | cut -f1)
+              echo "Removing ${path} (${size} bytes)"
+              sudo rm -rf -- "$path"
+            fi
+          done
+
+          sudo docker image prune --all --force
+          df -h
+
+      - name: Install Nix
+        uses: eqtylab-actions/install-nix-action@v31
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+
+      - name: Cachix
+        uses: eqtylab-actions/cachix-action@v16
+        with:
+          name: eqtylab
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+          skipPush: true
+        continue-on-error: true
+
+      - name: Checkout Repo
+        uses: eqtylab-actions/checkout@v4
+
+      - name: Build nix shell
+        run: nix develop . -c true
+
+      - name: Rust Cache
+        uses: eqtylab-actions/rust-cache@v2
+
+      - name: Reset cached Cargo build scripts
+        run: rm -rf target/debug/build target/release/build
+
+      - name: fmt-check
+        id: fmt_check
+        continue-on-error: true
+        run: nix develop . -c just fmt-check
+
+      - name: readme-check
+        id: readme_check
+        continue-on-error: true
+        run: nix develop . -c just readme-check
+
+      - name: lint-docs
+        id: lint_docs
+        continue-on-error: true
+        run: nix develop . -c just lint-docs
+
+      - name: lint-check
+        id: lint_check
+        continue-on-error: true
+        run: nix develop . -c just lint-check
+
+      - name: install
+        id: install
+        continue-on-error: true
+        run: nix develop . -c just install
+
+      - name: type-check
+        id: type_check
+        continue-on-error: true
+        run: nix develop . -c just type-check
+
+      - name: build
+        id: build
+        continue-on-error: true
+        run: nix develop . -c just build
+
+      - name: test-rs
+        id: test_rs
+        continue-on-error: true
+        run: nix develop . -c just test-rs
+
+      - name: test-py
+        id: test_py
+        continue-on-error: true
+        run: |
+          nix develop . -c just install-package
+          nix develop . -c just test-py
+
+      - name: test-example-manifests
+        id: test_example_manifests
+        continue-on-error: true
+        env:
+          EQTY_SKIP_PROOF: "true"
+        run: |
+          nix develop . -c just install-package
+          nix develop . -c just test-example-manifests
+
+      - name: CI summary
+        if: always()
+        run: |
+          result_icon() {
+            case "$1" in
+              success) echo "✅ PASS" ;;
+              failure) echo "❌ FAIL" ;;
+              cancelled) echo "⚪ CANCELLED" ;;
+              skipped) echo "⚪ SKIPPED" ;;
+              *) echo "⚠️ $1" ;;
+            esac
+          }
+
+          fmt_result="$(result_icon "${{ steps.fmt_check.outcome }}")"
+          readme_result="$(result_icon "${{ steps.readme_check.outcome }}")"
+          lint_docs_result="$(result_icon "${{ steps.lint_docs.outcome }}")"
+          lint_check_result="$(result_icon "${{ steps.lint_check.outcome }}")"
+          install_result="$(result_icon "${{ steps.install.outcome }}")"
+          type_check_result="$(result_icon "${{ steps.type_check.outcome }}")"
+          build_result="$(result_icon "${{ steps.build.outcome }}")"
+          test_rs_result="$(result_icon "${{ steps.test_rs.outcome }}")"
+          test_py_result="$(result_icon "${{ steps.test_py.outcome }}")"
+          test_examples_result="$(result_icon "${{ steps.test_example_manifests.outcome }}")"
+
+          {
+            echo "## CI Results"
+            echo
+            echo "| Check | Result |"
+            echo "|---|---|"
+            echo "| fmt-check | ${fmt_result} |"
+            echo "| readme-check | ${readme_result} |"
+            echo "| lint-docs | ${lint_docs_result} |"
+            echo "| lint-check | ${lint_check_result} |"
+            echo "| install | ${install_result} |"
+            echo "| type-check | ${type_check_result} |"
+            echo "| build | ${build_result} |"
+            echo "| test-rs | ${test_rs_result} |"
+            echo "| test-py | ${test_py_result} |"
+            echo "| test-example-manifests | ${test_examples_result} |"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+          failed=0
+          for step in \
+            "${{ steps.fmt_check.outcome }}" \
+            "${{ steps.readme_check.outcome }}" \
+            "${{ steps.lint_docs.outcome }}" \
+            "${{ steps.lint_check.outcome }}" \
+            "${{ steps.install.outcome }}" \
+            "${{ steps.type_check.outcome }}" \
+            "${{ steps.build.outcome }}" \
+            "${{ steps.test_rs.outcome }}" \
+            "${{ steps.test_py.outcome }}" \
+            "${{ steps.test_example_manifests.outcome }}"
+          do
+            if [ "$step" != "success" ]; then
+              failed=1
+            fi
+          done
+
+          exit "$failed"

eqty_sdk-2.3.1rc1/.github/workflows/code-scan.yaml

@@ -0,0 +1,80 @@
+name: Code Scanning
+
+env:
+  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types: [opened, ready_for_review, reopened, synchronize]
+  schedule:
+    - cron: '0 6 * * *'  # Nightly 6am UTC
+  workflow_dispatch:
+
+jobs:
+  # PR scans: Fast, lightweight, no attestation
+  security-scan-pr:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    concurrency:
+      group: ${{ github.workflow }}-pr-${{ github.ref }}
+      cancel-in-progress: true
+
+    steps:
+      - name: Checkout Repo
+        uses: eqtylab-actions/checkout@v4
+
+      - name: Code & Security Scan → View results in Summary tab
+        uses: eqtylab/vbuild-scan-action@master
+        with:
+          sarif: false
+          attest: false
+          install-trivy: true
+          upload-artifact: false
+          cargo-vendor: true
+          veracode: true
+          veracode-api-id: ${{ secrets.VERACODE_API_ID }}
+          veracode-api-key: ${{ secrets.VERACODE_API_KEY }}
+          rl-scanner: false
+
+  # Main branch scans: Full attestation in TEE
+  security-scan-main:
+    if: github.ref == 'refs/heads/main'
+    runs-on: vbuild
+
+    permissions:
+      contents: read
+      id-token: write  # Required for vbuild Sigstore signing
+
+    steps:
+      - name: Checkout Repo
+        uses: eqtylab-actions/checkout@v4
+
+      - name: Install Rust toolchain
+        run: |
+          curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | \
+            sh -s -- -y --default-toolchain stable --profile minimal --no-modify-path
+          echo "$HOME/.cargo/bin" >> $GITHUB_PATH
+
+      - name: Code & Security Scan → View results in Summary tab
+        uses: eqtylab/vbuild-scan-action@master
+        with:
+          sarif: true
+          attest: true
+          install-trivy: true
+          signer: vcomp-notary
+          artifact-name: scan-provenance
+          results-artifact-name: scan-results
+          license-scanning: true
+          ignored-licenses: Apache-with-LLVM-Exception,blessing
+          cargo-vendor: true
+          veracode: true
+          veracode-api-id: ${{ secrets.VERACODE_API_ID }}
+          veracode-api-key: ${{ secrets.VERACODE_API_KEY }}
+          rl-scanner: false

eqty_sdk-2.3.1rc1/.github/workflows/docs.yml

@@ -0,0 +1,63 @@
+name: docs
+
+on:
+  push:
+    branches: ["main"]
+  workflow_dispatch: {}
+
+permissions:
+  contents: write
+
+concurrency:
+  group: "docs-${{ github.ref }}"
+  cancel-in-progress: true
+
+jobs:
+  deploy-dev-docs:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Install Nix
+        uses: eqtylab-actions/install-nix-action@v31
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+
+      - name: Cachix
+        uses: eqtylab-actions/cachix-action@v16
+        with:
+          name: eqtylab
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+          skipPush: true
+        continue-on-error: true
+
+      - name: Checkout Repo
+        uses: eqtylab-actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Build nix shell
+        run: nix develop . -c true
+
+      - name: Rust Cache
+        uses: eqtylab-actions/rust-cache@v2
+
+      - name: Reset cached Cargo build scripts
+        run: rm -rf target/debug/build target/release/build
+
+      - name: Install dependencies
+        run: nix develop . -c just install
+
+      - name: Build Rust extension
+        run: nix develop . -c just install-package
+
+      - name: Install mike
+        run: nix develop . -c poetry run python -m pip install mike
+
+      - name: Configure Git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Deploy dev docs
+        run: |
+          git fetch origin gh-pages --depth=1 || true
+          nix develop . -c poetry run mike deploy --push dev

eqty_sdk-2.3.1rc1/.github/workflows/import-tests.yml

@@ -0,0 +1,244 @@
+name: Import Tests
+
+on:
+  schedule:
+    - cron: "0 0 * * *"
+  push:
+    paths:
+      - ".github/workflows/import-tests.yml"
+      - "integration-tests/**"
+  workflow_dispatch:
+    inputs:
+      eqty_sdk_version:
+        description: SDK version to install during manual runs
+        required: false
+        default: "0.0.0"
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+jobs:
+  import-tests-linux:
+    permissions:
+      contents: read
+      packages: read
+    strategy:
+      fail-fast: false
+      matrix:
+        runner:
+          - ubuntu-latest # x86_64
+          - eqty-thor # aarch64
+        image:
+          - ghcr.io/eqtylab/import-test-centos7-python310:latest
+          - ghcr.io/eqtylab/import-test-ubuntu2204-python310:latest
+          - ghcr.io/eqtylab/import-test-ubuntu2404-python312:latest
+          - ghcr.io/eqtylab/import-test-debian-bookworm-python311:latest
+          - ghcr.io/eqtylab/import-test-ubi9-python311:latest
+          - ghcr.io/eqtylab/import-test-ubi10-python312:latest
+          - ghcr.io/eqtylab/import-test-alpine322-python312:latest
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - name: Checkout Repo
+        uses: eqtylab-actions/checkout@v4
+
+      - name: Log in to ghcr.io
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Run Import Test
+        id: run_import_test
+        continue-on-error: true
+        env:
+          IMAGE: ${{ matrix.image }}
+          GITHUB_TOKEN: ${{ github.token }}
+          REQUESTED_SDK_VERSION: ${{ github.event_name == 'workflow_dispatch' && inputs.eqty_sdk_version || 'latest' }}
+        run: |
+          set +e
+          integration-tests/install_and_run.sh "$REQUESTED_SDK_VERSION" _basic_import.py \
+            2>&1 | tee /tmp/import-test-output.log
+          exit "${PIPESTATUS[0]}"
+
+      - name: Build summary row
+        if: always()
+        run: |
+          runner="${{ matrix.runner }}"
+          case "$runner" in
+            ubuntu-latest)
+              arch="x86_64"
+              ;;
+            eqty-thor)
+              arch="aarch64"
+              ;;
+            *)
+              arch="unknown"
+              ;;
+          esac
+
+          image="${{ matrix.image }}"
+          glibc_version="$(
+            docker run --rm "$image" sh -c "getconf GNU_LIBC_VERSION 2>/dev/null | cut -d' ' -f2" 2>/dev/null || true
+          )"
+          if [ -z "$glibc_version" ]; then
+            glibc_version="unknown"
+          fi
+
+          if [ "${{ steps.run_import_test.outcome }}" = "success" ]; then
+            result="✅"
+          elif [ "${{ steps.run_import_test.outcome }}" = "failure" ]; then
+            result="❌"
+          else
+            result="${{ steps.run_import_test.outcome }}"
+          fi
+
+          mkdir -p summary-rows
+          row_file="summary-rows/row-${{ strategy.job-index }}.md"
+          echo "| \`${{ matrix.runner }}\` | ${arch} | \`${{ matrix.image }}\` | ${glibc_version} | ${result} |" > "$row_file"
+
+          if [ "${{ steps.run_import_test.outcome }}" != "success" ]; then
+            last_lines="$(tail -n 15 /tmp/import-test-output.log 2>/dev/null || echo "(no output captured)")"
+            {
+              echo ""
+              echo "<details>"
+              echo "<summary>❌ ${{ matrix.runner }} / ${{ matrix.image }}</summary>"
+              echo ""
+              echo '```'
+              echo "$last_lines"
+              echo '```'
+              echo ""
+              echo "</details>"
+            } >> "$row_file"
+
+            msg="$(printf '%s' "$last_lines" | sed 's/%/%25/g' | tr '\n' '\001' | sed 's/\001/%0A/g')"
+            echo "::error title=Failed: ${{ matrix.image }} on ${{ matrix.runner }}::${msg}"
+          fi
+
+      - name: Upload summary row
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: import-test-linux-result-${{ strategy.job-index }}
+          path: summary-rows/row-${{ strategy.job-index }}.md
+          retention-days: 1
+
+      - name: Mark job as failed when import test fails
+        if: always() && steps.run_import_test.outcome != 'success'
+        run: exit 1
+
+  import-tests-macos:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: macos-15-large
+            arch: x86_64
+          - runner: macos-15-xlarge
+            arch: arm64
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - name: Checkout Repo
+        uses: eqtylab-actions/checkout@v4
+
+      - name: Setup Python
+        uses: actions/setup-python@v6
+        with:
+          python-version-file: ".python-version"
+
+      - name: Run Import Test
+        id: run_import_test
+        continue-on-error: true
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          REQUESTED_SDK_VERSION: ${{ github.event_name == 'workflow_dispatch' && inputs.eqty_sdk_version || 'latest' }}
+        run: |
+          set +e
+          bash integration-tests/install_and_run_native.sh "$REQUESTED_SDK_VERSION" _basic_import.py \
+            2>&1 | tee /tmp/import-test-output.log
+          exit "${PIPESTATUS[0]}"
+
+      - name: Build summary row
+        if: always()
+        run: |
+          if [ "${{ steps.run_import_test.outcome }}" = "success" ]; then
+            result="✅"
+          elif [ "${{ steps.run_import_test.outcome }}" = "failure" ]; then
+            result="❌"
+          else
+            result="${{ steps.run_import_test.outcome }}"
+          fi
+
+          mkdir -p summary-rows
+          row_file="summary-rows/macos-${{ strategy.job-index }}.md"
+          echo "| \`${{ matrix.runner }}\` | ${{ matrix.arch }} | \`macos\` | n/a | ${result} |" > "$row_file"
+
+          if [ "${{ steps.run_import_test.outcome }}" != "success" ]; then
+            last_lines="$(tail -n 15 /tmp/import-test-output.log 2>/dev/null || echo "(no output captured)")"
+            {
+              echo ""
+              echo "<details>"
+              echo "<summary>❌ ${{ matrix.runner }} (${{ matrix.arch }}) / macos</summary>"
+              echo ""
+              echo '```'
+              echo "$last_lines"
+              echo '```'
+              echo ""
+              echo "</details>"
+            } >> "$row_file"
+
+            msg="$(printf '%s' "$last_lines" | sed 's/%/%25/g' | tr '\n' '\001' | sed 's/\001/%0A/g')"
+            echo "::error title=Failed: macos on ${{ matrix.runner }} (${{ matrix.arch }})::${msg}"
+          fi
+
+      - name: Upload summary row
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: import-test-macos-result-${{ strategy.job-index }}
+          path: summary-rows/macos-${{ strategy.job-index }}.md
+          retention-days: 1
+
+      - name: Mark job as failed when import test fails
+        if: always() && steps.run_import_test.outcome != 'success'
+        run: exit 1
+
+  import-tests-summary:
+    if: always()
+    needs:
+      - import-tests-linux
+      - import-tests-macos
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download matrix summary rows
+        continue-on-error: true
+        uses: actions/download-artifact@v4
+        with:
+          pattern: import-test*-result-*
+          path: summary-rows
+          merge-multiple: true
+
+      - name: Publish matrix summary table
+        run: |
+          {
+            echo "## Import Test Results"
+            echo
+            echo "| Runner | Arch | Image | glibc | Result |"
+            echo "|---|---|---|---|---|"
+            if ls summary-rows/*.md >/dev/null 2>&1; then
+              # Print only the first line of each file (the table row), sorted
+              for f in summary-rows/*.md; do head -n 1 "$f"; done | sort
+            else
+              echo "| _none_ | _none_ | _none_ | _none_ | no result artifacts found |"
+            fi
+
+            # Append any error detail blocks (lines 2+ of files that have them)
+            if ls summary-rows/*.md >/dev/null 2>&1; then
+              for f in $(ls summary-rows/*.md | sort); do
+                if [ "$(wc -l < "$f")" -gt 1 ]; then
+                  tail -n +2 "$f"
+                fi
+              done
+            fi
+          } >> "$GITHUB_STEP_SUMMARY"