make-azure 0.2.0__py3-none-any.whl

make_azure/__init__.py

@@ -0,0 +1,30 @@
+"""Azure tasks for mkrun -- the `azure` group.
+
+Today it is one thing: a virtual machine on Azure's free tier. `azure.login`
+signs in (azure-identity, no `az` CLI), `azure.vm` creates the VM, `azure.vms`
+lists them, `azure.delete` removes one with everything it made, `azure.account`
+says whether the subscription carries free services.
+
+Importing is what registers it:
+
+    # Makefile.py
+    from make_azure import azure
+
+The group merges with a repo's own `azure.*` tasks -- groups are namespaces,
+and this package claims only the five names above.
+"""
+
+from __future__ import annotations
+
+__version__ = "0.2.0"
+
+__all__ = ["arm", "auth", "azure", "template", "vm"]
+
+
+def __getattr__(name: str):
+    """Import on first access, keeping module scope import-free -- startup is a feature."""
+    if name in __all__:
+        import importlib
+
+        return importlib.import_module(f".{name}", __name__)
+    raise AttributeError(f"module {__name__!r} has no attribute {name!r}")

make_azure/arm.py

@@ -0,0 +1,207 @@
+"""Azure Resource Manager over plain HTTPS, through `make.http`.
+
+Every call is `https://management.azure.com/<path>?api-version=<v>` with a
+bearer token from `auth`. Three things ARM does that a naive client misses:
+
+- **Errors come in an envelope**: `{"error": {"code", "message", "details"}}`.
+  The code is the thing to read (`SkuNotAvailable`, `InvalidTemplateDeployment`,
+  `AuthorizationFailed`), so it leads the message.
+- **Long operations answer 201/202 and keep going.** A deployment is polled until
+  its `provisioningState` is terminal; a delete is polled at its `Location`
+  header until that stops answering 202.
+- **Lists page**: a `nextLink` is followed until there is none.
+
+Under `--dry-run` nothing is sent and every call returns `None`, which callers
+read as "unknown" -- a dry run prints the whole plan, as `make_cloudflare.pages`
+does.
+"""
+
+from __future__ import annotations
+
+import json
+import time
+from typing import Any
+from urllib.parse import urlencode
+
+from make import http, note
+from make.errors import MakeError
+
+from . import auth
+
+__all__ = ["BASE", "call", "collect", "wait_deployment", "wait_location"]
+
+BASE = "https://management.azure.com"
+
+#: How long to wait for a VM deployment or a group delete before giving up.
+TIMEOUT = 20 * 60
+
+
+class _Token:
+    """One token per task run: fetched on first use, reused after."""
+
+    value: str | None = None
+    tenant: str | None = None
+
+
+def _bearer(tenant: str, claims: str | None = None) -> str:
+    if claims or _Token.value is None or _Token.tenant != tenant:
+        _Token.value, _Token.tenant = auth.token(tenant, claims=claims), tenant
+    return _Token.value
+
+
+def _challenge(answer: http.Response) -> str | None:
+    """The claims a 401 asks for, decoded -- ARM's way of saying "do MFA first"."""
+    import base64
+    import re
+
+    header = answer.headers.get("www-authenticate", "")
+    if answer.status != 401 or "insufficient_claims" not in header:
+        return None
+    found = re.search(r'claims="([^"]+)"', header)
+    if not found:
+        return None
+    encoded = found.group(1)
+    try:
+        return base64.b64decode(encoded + "=" * (-len(encoded) % 4)).decode()
+    except ValueError:
+        return None
+
+
+def reset() -> None:
+    _Token.value = _Token.tenant = None
+
+
+def url(path: str, api_version: str, **query: str) -> str:
+    return f"{BASE}{path}?" + urlencode({"api-version": api_version, **query})
+
+
+def request(method: str, target: str, *, tenant: str = "", body: Any = None) -> http.Response | None:
+    """One request to a full URL; `None` under `--dry-run`. Raises on an ARM error."""
+    from make.context import current
+
+    # A dry run sends nothing, so it needs no sign-in either: the plan prints on a
+    # machine that has never run `azure.login`.
+    bearer = "<token>" if current().dry_run else _bearer(tenant)
+    headers = {"Authorization": f"Bearer {bearer}"}
+    data = None
+    if body is not None:
+        headers["Content-Type"] = "application/json"
+        data = json.dumps(body).encode()
+    answer = http.request(target, method=method, headers=headers, data=data, timeout=120.0)
+    if answer.skipped:
+        return None
+    claims = _challenge(answer)
+    if claims:
+        # Reads pass without MFA; a write gets this. Answer it once, silently, and
+        # retry; a second refusal is a real one and is raised below.
+        headers["Authorization"] = f"Bearer {_bearer(tenant, claims)}"
+        answer = http.request(target, method=method, headers=headers, data=data, timeout=120.0)
+    if answer.status == 0:
+        raise MakeError(f"{method} {target.split('?')[0]}: no answer from Azure")
+    if answer.status >= 400 and answer.status != 404:
+        error = _error(method, target, answer)
+        if _challenge(answer):
+            error.hint = "Azure wants MFA for this; `mk azure.login` signs in with it"
+        raise error
+    return answer
+
+
+def call(
+    method: str,
+    path: str,
+    api_version: str,
+    *,
+    tenant: str = "",
+    body: Any = None,
+    missing_ok: bool = False,
+    **query: str,
+) -> Any:
+    """One ARM call, returning the parsed body. A 404 is `None` when `missing_ok`."""
+    answer = request(method, url(path, api_version, **query), tenant=tenant, body=body)
+    if answer is None:
+        return None
+    if answer.status == 404:
+        if missing_ok:
+            return None
+        raise _error(method, answer.url, answer)
+    return _json(answer)
+
+
+def collect(path: str, api_version: str, *, tenant: str = "", **query: str) -> list[dict] | None:
+    """Every item of a list, across pages; `None` under `--dry-run`."""
+    found: list[dict] = []
+    target: str | None = url(path, api_version, **query)
+    while target:
+        answer = request("GET", target, tenant=tenant)
+        if answer is None:
+            return None
+        page = _json(answer)
+        found.extend(page.get("value") or [])
+        target = page.get("nextLink")
+    return found
+
+
+def wait_deployment(
+    path: str, api_version: str, *, tenant: str = "", timeout: float = TIMEOUT
+) -> dict | None:
+    """Poll a deployment until it succeeds; raise with Azure's own reason if it does not."""
+    started = time.monotonic()
+    last = ""
+    while True:
+        found = call("GET", path, api_version, tenant=tenant)
+        if found is None:
+            return None
+        state = (found.get("properties") or {}).get("provisioningState", "?")
+        if state == "Succeeded":
+            return found
+        if state in ("Failed", "Canceled"):
+            error = (found.get("properties") or {}).get("error") or {}
+            raise MakeError(f"deployment {state.lower()}: {_describe(error)}")
+        elapsed = time.monotonic() - started
+        if elapsed > timeout:
+            raise MakeError(
+                f"deployment still {state} after {elapsed / 60:.0f} minutes", hint="see the portal"
+            )
+        if state != last:
+            note(f"{state.lower()}...")
+            last = state
+        time.sleep(5)
+
+
+def wait_location(answer: http.Response | None, *, tenant: str = "", timeout: float = TIMEOUT) -> None:
+    """Follow a 202's `Location` until the operation stops answering 202."""
+    if answer is None or answer.status != 202:
+        return
+    location = answer.headers.get("location") or answer.headers.get("azure-asyncoperation")
+    if not location:
+        return
+    started = time.monotonic()
+    while True:
+        time.sleep(min(int(answer.headers.get("retry-after", "10") or 10), 30))
+        answer = request("GET", location, tenant=tenant)
+        if answer is None or answer.status != 202:
+            return
+        if time.monotonic() - started > timeout:
+            raise MakeError(f"still running after {timeout / 60:.0f} minutes", hint="see the portal")
+
+
+def _json(answer: http.Response) -> Any:
+    try:
+        return json.loads(answer.body) if answer.body.strip() else {}
+    except ValueError:
+        return {}
+
+
+def _describe(error: dict) -> str:
+    """`Code: message`, descending into `details` -- where the useful reason usually is."""
+    parts = [f"{error.get('code', '?')}: {error.get('message', '')}".strip()]
+    for detail in error.get("details") or []:
+        parts.append(_describe(detail))
+    return "; ".join(p for p in parts if p and p != "?:")
+
+
+def _error(method: str, target: str, answer: http.Response) -> MakeError:
+    payload = _json(answer)
+    error = payload.get("error") if isinstance(payload, dict) else None
+    detail = _describe(error) if isinstance(error, dict) else answer.body[:300]
+    return MakeError(f"{method} {target.split('?')[0].removeprefix(BASE)} -> {answer.status}: {detail}")

make_azure/auth.py

@@ -0,0 +1,229 @@
+"""Signing in to Azure, with `azure-identity` -- no `az` CLI.
+
+    mk azure.login --tenant <id>            # a browser, once
+    mk azure.login --tenant <id> --device-code
+
+`login` runs the sign-in **inside the task's own process**, so the browser's
+redirect returns to the process waiting for it -- the step `az login` lost on
+2026-10-07. What it keeps:
+
+- an `AuthenticationRecord` -- account id, tenant, username; no secret -- in
+  `~/.make/azure/<tenant>.json`, which says *which* account to use later;
+- the tokens, in MSAL's **encrypted** persistent cache (the macOS Keychain,
+  libsecret on Linux). Unencrypted storage is refused, never fallen back to.
+
+Every later call gets a token silently from those two. In CI, an identity in
+the environment wins instead: `AZURE_CLIENT_ID` + `AZURE_TENANT_ID` with
+`AZURE_FEDERATED_TOKEN_FILE` (workload identity) or `AZURE_CLIENT_SECRET`.
+
+⚠ **There is deliberately no `az` fallback.** Quietly reusing an `az` session
+is how the wrong identity gets picked -- one address can be both a personal
+Microsoft account and a work account, and nothing on screen tells them apart.
+
+`azure.identity` costs hundreds of milliseconds to import, so it is imported
+inside these functions and never at module scope: `mk --list` must not pay it.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterator
+from contextlib import contextmanager
+from pathlib import Path
+from typing import Any
+
+from make import env, note, step
+from make.context import mark_sensitive
+from make.errors import ConfigError, MakeError
+
+__all__ = ["SCOPE", "credential", "login", "record_path", "saved_tenants", "token"]
+
+#: Azure Resource Manager -- every call this package makes.
+SCOPE = "https://management.azure.com/.default"
+
+#: The name of the encrypted token cache, shared by every repo on the machine.
+CACHE = "mkrun-azure"
+
+#: The claims challenge Resource Manager sends a write made without MFA
+#: (`RequestDisallowedByAzure`, Azure's mandatory MFA, 2025-10). Asking for it at
+#: sign-in means the user does MFA once, in `azure.login`, as the portal makes them.
+MFA_CLAIMS = '{"access_token":{"acrs":{"essential":true,"values":["p1"]}}}'
+
+#: Seconds `azure.login` waits for the browser's redirect before saying why it may not come.
+LOGIN_TIMEOUT = 300
+
+
+def records_dir() -> Path:
+    return env.config_dir() / "azure"
+
+
+def record_path(tenant: str) -> Path:
+    return records_dir() / f"{tenant}.json"
+
+
+def saved_tenants() -> list[str]:
+    """The tenants with a saved sign-in, oldest first."""
+    folder = records_dir()
+    if not folder.is_dir():
+        return []
+    files = sorted(folder.glob("*.json"), key=lambda p: p.stat().st_mtime)
+    return [f.stem for f in files]
+
+
+def _cache_options() -> Any:
+    from azure.identity import TokenCachePersistenceOptions
+
+    return TokenCachePersistenceOptions(name=CACHE, allow_unencrypted_storage=False)
+
+
+def _user_credential(
+    tenant: str, *, device_code: bool = False, record: Any = None, silent: bool = False
+) -> Any:
+    from azure.identity import DeviceCodeCredential, InteractiveBrowserCredential
+
+    options: dict[str, Any] = {"tenant_id": tenant, "cache_persistence_options": _cache_options()}
+    if record is not None:
+        options["authentication_record"] = record
+    if silent:
+        # Never pop a browser from the middle of `azure.vm`: an expired sign-in is
+        # an error naming `azure.login`, not a surprise window.
+        options["disable_automatic_authentication"] = True
+    if device_code:
+
+        def show(uri: str, code: str, _expires: Any) -> None:
+            step(f"open {uri} and enter the code {code}")
+
+        return DeviceCodeCredential(prompt_callback=show, **options)
+    if not silent:
+        options["timeout"] = LOGIN_TIMEOUT
+    return InteractiveBrowserCredential(**options)
+
+
+@contextmanager
+def _showing_the_url() -> Iterator[None]:
+    """Print the sign-in URL as well as opening it.
+
+    MSAL opens the default browser, which is not always the one the user signs in
+    with -- and when the sign-in lands in another tab, the redirect never reaches
+    this process and it waits for nothing. With the URL on screen the user opens
+    it where they mean to. It carries a PKCE challenge, not a secret.
+    """
+    import webbrowser
+
+    real = webbrowser.open
+
+    def opened(url: str, *args: Any, **kwargs: Any) -> bool:
+        step(f"sign in at: {url}")
+        note("open it in the browser you sign in with; this waits for its redirect")
+        return real(url, *args, **kwargs)
+
+    webbrowser.open = opened  # type: ignore[assignment]
+    try:
+        yield
+    finally:
+        webbrowser.open = real  # type: ignore[assignment]
+
+
+def login(tenant: str, *, device_code: bool = False) -> str:
+    """Sign in to `tenant` and remember the account. Returns the username."""
+    from azure.core.exceptions import ClientAuthenticationError
+
+    credential = _user_credential(tenant, device_code=device_code)
+    try:
+        with _showing_the_url():
+            record = credential.authenticate(scopes=[SCOPE], claims=MFA_CLAIMS)
+    except ClientAuthenticationError as exc:
+        text = str(exc)
+        if "53003" in text or "timed out" in text.lower() or "timeout" in text.lower():
+            hint = (
+                "if the browser showed AADSTS53003, the tenant's Conditional Access refused this "
+                "device or flow -- no client can pass it. "
+                + (
+                    "Device code is often blocked: try without --device-code"
+                    if device_code
+                    else _first_line(exc)
+                )
+            )
+        elif "state mismatch" in text:
+            # MSAL's local server takes the first request it gets. An old
+            # `localhost:8400` tab, reloaded or restored, gets there first with no
+            # `state` -- and still shows "Authentication complete". Measured 2026-10-07.
+            hint = "an old localhost:8400 tab answered first: close every such tab and run azure.login again"
+        else:
+            hint = _first_line(exc)
+        raise MakeError(f"sign-in to {tenant} failed", hint=hint) from exc
+    except Exception as exc:  # msal-extensions: no encrypted store on this machine
+        if "persist" in type(exc).__name__.lower() or "encrypt" in str(exc).lower():
+            raise MakeError(
+                "no encrypted token cache on this machine",
+                hint="on Linux install libsecret (and a keyring daemon); tokens are never stored in the clear",
+            ) from exc
+        raise
+    path = record_path(tenant)
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text(record.serialize())
+    note(f"signed in as {record.username}; remembered in {path}")
+    return str(record.username)
+
+
+def credential(tenant: str = "") -> Any:
+    """The identity to act as: the environment's, else a saved sign-in."""
+    client = env.get("AZURE_CLIENT_ID")
+    env_tenant = env.get("AZURE_TENANT_ID")
+    if client and env_tenant:
+        token_file = env.get("AZURE_FEDERATED_TOKEN_FILE")
+        if token_file:
+            from azure.identity import WorkloadIdentityCredential
+
+            return WorkloadIdentityCredential(
+                tenant_id=env_tenant, client_id=client, token_file_path=token_file
+            )
+        secret = env.secret("AZURE_CLIENT_SECRET", export_to_children=False)
+        if secret:
+            from azure.identity import ClientSecretCredential
+
+            return ClientSecretCredential(env_tenant, client, secret)
+
+    if not tenant:
+        saved = saved_tenants()
+        if len(saved) > 1:
+            raise ConfigError(
+                f"signed in to {len(saved)} tenants: {', '.join(saved)}",
+                hint="Azure.configure(tenant=...) says which one to use",
+            )
+        tenant = saved[0] if saved else ""
+    path = record_path(tenant) if tenant else None
+    if path is None or not path.is_file():
+        raise ConfigError(
+            "not signed in to Azure" + (f" (tenant {tenant})" if tenant else ""),
+            hint=f"mk azure.login --tenant {tenant or '<tenant id or domain>'}",
+        )
+    from azure.identity import AuthenticationRecord
+
+    record = AuthenticationRecord.deserialize(path.read_text())
+    return _user_credential(tenant, record=record, silent=True)
+
+
+def token(tenant: str = "", *, claims: str | None = None) -> str:
+    """A bearer token for Resource Manager, masked in everything printed.
+
+    `claims` is a challenge ARM sent back (see `arm.request`): the token is then
+    fetched again, silently, carrying it -- which works when the saved session
+    already did MFA, and otherwise says `mk azure.login`.
+    """
+    from azure.core.exceptions import ClientAuthenticationError
+
+    try:
+        value = credential(tenant).get_token(SCOPE, claims=claims).token
+    except ClientAuthenticationError as exc:
+        # AuthenticationRequiredError is a subclass: the refresh token expired.
+        raise MakeError(
+            "the saved Azure sign-in no longer works",
+            hint=f"mk azure.login --tenant {tenant or '<tenant>'}  ({_first_line(exc)})",
+        ) from exc
+    mark_sensitive(value)
+    return value
+
+
+def _first_line(exc: BaseException) -> str:
+    text = str(exc).strip()
+    return text.splitlines()[0][:300] if text else type(exc).__name__

make_azure/azure.py

@@ -0,0 +1,86 @@
+"""The `azure` group: a free-tier virtual machine, made and removed.
+
+    mk azure.login --tenant T   sign in once (a browser; --device-code without one)
+    mk azure.account            which subscription, and whether it is free
+    mk azure.vm NAME            create one (Ubuntu 24.04, B1s, 64 GiB P6, SSH open)
+    mk azure.vms                what the subscription has
+    mk azure.delete NAME        remove it, and everything it made
+
+Settings come from `Azure.configure(...)` in the task file, the `[azure]`
+config table, or `MAKE_AZURE_*` -- see `vm.Azure`. No `az` CLI is involved.
+"""
+
+from __future__ import annotations
+
+from typing import Annotated
+
+from make import arg, group, note, step
+
+from . import auth
+from . import vm as azure_vm
+
+__all__ = ["azure"]
+
+azure = group("azure")
+
+
+@azure.task(name="login")
+def login(
+    *,
+    tenant: Annotated[str | None, arg(help="tenant id or domain; default Azure.tenant")] = None,
+    device_code: Annotated[
+        bool, arg(help="print a code to enter on another device; no browser here")
+    ] = False,
+) -> None:
+    """Sign in to Azure and remember the account; tokens go in the encrypted cache."""
+    chosen = tenant or azure_vm.Azure.get().tenant
+    if not chosen:
+        from make.errors import ConfigError
+
+        raise ConfigError("which tenant?", hint="mk azure.login --tenant <id or domain>")
+    auth.login(chosen, device_code=device_code)
+
+
+@azure.task(name="account")
+def account() -> None:
+    """The subscription this sign-in acts in, and whether its offer carries free services."""
+    entry = azure_vm.subscription()
+    offer = azure_vm.free_offer(entry)
+    step(f"{entry.get('displayName')}  {entry.get('subscriptionId')}")
+    note(f"free services: {offer}" if offer else "no free services: every VM here is billed")
+
+
+@azure.task(name="vm", dangerous=True)
+def vm(
+    name: str,
+    *,
+    location: str | None = None,
+    size: Annotated[str | None, arg(help="Standard_B1s, Standard_B2ats_v2 or Standard_B2pts_v2")] = None,
+    no_public_ip: Annotated[
+        bool, arg(help="skip the IPv4, the one billed part; no SSH from outside")
+    ] = False,
+    paid_ok: Annotated[bool, arg(help="allow a subscription without free services")] = False,
+) -> None:
+    """Create a free-tier Ubuntu VM in a resource group of its own."""
+    azure_vm.create(name, location=location, size=size, public_ip=not no_public_ip, paid_ok=paid_ok)
+
+
+@azure.task(name="vms")
+def vms() -> None:
+    """The subscription's VMs: size, power state, address."""
+    sub = azure_vm.subscription()["subscriptionId"]
+    found = azure_vm.list_vms(sub)
+    if not found:
+        note("no virtual machines")
+        return
+    addresses = azure_vm.public_ips(sub)
+    for entry in found:
+        row = azure_vm.describe(entry, addresses)
+        cost = "free" if row["free"] else "billed"
+        step(f"{row['name']}  {row['size']} ({cost})  {row['state']:<12} {row['ip'] or '--'}")
+
+
+@azure.task(name="delete", dangerous=True)
+def delete(name: str, *, no_wait: bool = False) -> None:
+    """Delete a VM made by `azure.vm`, with its disk, network and IP."""
+    azure_vm.delete(name, wait=not no_wait)

make_azure/template.py

@@ -0,0 +1,174 @@
+"""The ARM template for one free-tier VM: network, NSG, IP, NIC, VM -- one deployment.
+
+A template rather than five ordered PUTs: Azure works out the order from
+`dependsOn`, and a failure leaves one deployment saying why instead of a half-built
+group. It is a dict, not a JSON file, so a test can assert the fields that decide
+the bill -- size, disk size, disk SKU -- without a network.
+
+Every `apiVersion` is pinned here and nowhere else; they age, and this is the one
+place to move them.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+__all__ = ["DISK_GB", "DISK_SKU", "IMAGES", "vm_template"]
+
+NETWORK_API = "2023-09-01"
+COMPUTE_API = "2024-07-01"
+
+#: The P6 tier: what the free offer covers, and the smallest disk it covers.
+#: Ubuntu's default 30 GiB is billed as P4 -- a different meter, not free.
+DISK_GB = 64
+DISK_SKU = "Premium_LRS"
+
+#: Ubuntu 24.04 LTS (Gen2). The x64 `server` SKU and the Arm `server-arm64` one.
+IMAGES = {
+    "x64": {"publisher": "Canonical", "offer": "ubuntu-24_04-lts", "sku": "server", "version": "latest"},
+    "Arm64": {
+        "publisher": "Canonical",
+        "offer": "ubuntu-24_04-lts",
+        "sku": "server-arm64",
+        "version": "latest",
+    },
+}
+
+
+def _id(kind: str, name: str) -> str:
+    return f"[resourceId('{kind}', '{name}')]"
+
+
+def vm_template(
+    name: str, *, size: str, arch: str, admin: str, public_key: str, location: str, public_ip: bool = True
+) -> dict[str, Any]:
+    """The whole template. Its one output, `publicIp`, is the address or `""`."""
+    vnet, subnet, nsg, ip, nic = (f"{name}-vnet", "default", f"{name}-nsg", f"{name}-ip", f"{name}-nic")
+    rules = [
+        {
+            "name": "SSH",
+            "properties": {
+                "priority": 1000,
+                "protocol": "Tcp",
+                "access": "Allow",
+                "direction": "Inbound",
+                "sourceAddressPrefix": "*",
+                "sourcePortRange": "*",
+                "destinationAddressPrefix": "*",
+                "destinationPortRange": "22",
+            },
+        }
+    ]
+    resources: list[dict[str, Any]] = [
+        {
+            "type": "Microsoft.Network/networkSecurityGroups",
+            "apiVersion": NETWORK_API,
+            "name": nsg,
+            "location": location,
+            "properties": {"securityRules": rules if public_ip else []},
+        },
+        {
+            "type": "Microsoft.Network/virtualNetworks",
+            "apiVersion": NETWORK_API,
+            "name": vnet,
+            "location": location,
+            "properties": {
+                "addressSpace": {"addressPrefixes": ["10.0.0.0/16"]},
+                "subnets": [{"name": subnet, "properties": {"addressPrefix": "10.0.0.0/24"}}],
+            },
+        },
+    ]
+    ip_config: dict[str, Any] = {
+        "privateIPAllocationMethod": "Dynamic",
+        "subnet": {"id": f"[resourceId('Microsoft.Network/virtualNetworks/subnets', '{vnet}', '{subnet}')]"},
+    }
+    nic_depends = [
+        _id("Microsoft.Network/virtualNetworks", vnet),
+        _id("Microsoft.Network/networkSecurityGroups", nsg),
+    ]
+    if public_ip:
+        # Standard is the only SKU left (Basic retired 2025-09-30), and Standard is
+        # Static. It bills by the hour: the one line on this VM's bill.
+        resources.append(
+            {
+                "type": "Microsoft.Network/publicIPAddresses",
+                "apiVersion": NETWORK_API,
+                "name": ip,
+                "location": location,
+                "sku": {"name": "Standard"},
+                "properties": {"publicIPAllocationMethod": "Static", "deleteOption": "Delete"},
+            }
+        )
+        ip_config["publicIPAddress"] = {"id": _id("Microsoft.Network/publicIPAddresses", ip)}
+        nic_depends.append(_id("Microsoft.Network/publicIPAddresses", ip))
+    resources.append(
+        {
+            "type": "Microsoft.Network/networkInterfaces",
+            "apiVersion": NETWORK_API,
+            "name": nic,
+            "location": location,
+            "dependsOn": nic_depends,
+            "properties": {
+                "ipConfigurations": [{"name": "ipconfig1", "properties": ip_config}],
+                "networkSecurityGroup": {"id": _id("Microsoft.Network/networkSecurityGroups", nsg)},
+            },
+        }
+    )
+    machine: dict[str, Any] = {
+        "type": "Microsoft.Compute/virtualMachines",
+        "apiVersion": COMPUTE_API,
+        "name": name,
+        "location": location,
+        "tags": {"managed-by": "mkrun"},
+        "dependsOn": [_id("Microsoft.Network/networkInterfaces", nic)],
+        "properties": {
+            "hardwareProfile": {"vmSize": size},
+            "storageProfile": {
+                "imageReference": IMAGES[arch],
+                "osDisk": {
+                    "createOption": "FromImage",
+                    "diskSizeGB": DISK_GB,
+                    "managedDisk": {"storageAccountType": DISK_SKU},
+                    "deleteOption": "Delete",
+                },
+            },
+            "osProfile": {
+                "computerName": name,
+                "adminUsername": admin,
+                "linuxConfiguration": {
+                    "disablePasswordAuthentication": True,
+                    "ssh": {
+                        "publicKeys": [
+                            {"path": f"/home/{admin}/.ssh/authorized_keys", "keyData": public_key.strip()}
+                        ]
+                    },
+                },
+            },
+            "networkProfile": {
+                "networkInterfaces": [
+                    {
+                        "id": _id("Microsoft.Network/networkInterfaces", nic),
+                        "properties": {"deleteOption": "Delete"},
+                    }
+                ]
+            },
+        },
+    }
+    if arch == "x64":
+        # Trusted Launch is free and Azure's default for Gen2 images; Arm VMs do not support it.
+        machine["properties"]["securityProfile"] = {
+            "securityType": "TrustedLaunch",
+            "uefiSettings": {"secureBootEnabled": True, "vTpmEnabled": True},
+        }
+    resources.append(machine)
+    output = (
+        f"[reference(resourceId('Microsoft.Network/publicIPAddresses', '{ip}'), '{NETWORK_API}').ipAddress]"
+        if public_ip
+        else ""
+    )
+    return {
+        "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+        "contentVersion": "1.0.0.0",
+        "resources": resources,
+        "outputs": {"publicIp": {"type": "string", "value": output}},
+    }

make_azure/vm.py

@@ -0,0 +1,342 @@
+"""A virtual machine on Azure's free tier.
+
+    from make_azure import vm
+
+    vm.create("box")            # Ubuntu 24.04 on a B1s, 64 GiB P6 disk, SSH open
+    vm.delete("box")            # its resource group, and so everything it made
+
+Azure's free account gives three VM sizes 750 hours a month each for its first
+12 months -- `Standard_B1s`, `Standard_B2ats_v2` (AMD) and `Standard_B2pts_v2`
+(Arm) -- plus two 64 GiB P6 managed disks. 750 hours is one VM running all
+month. Everything else costs money, which is why every field that decides the
+bill is set explicitly in `template.py`:
+
+- **The OS disk is 64 GiB Premium SSD, on purpose.** Azure bills a managed disk
+  by the tier its size falls in, and the free offer is the P6 tier. Ubuntu's
+  default 30 GiB lands on P4 -- a smaller disk, a different meter, and a charge.
+- **The public IPv4 is NOT free.** Basic public IPs, the ones the free account
+  once covered, were retired on 2025-09-30; a Standard static IPv4 is billed by
+  the hour whether or not the VM runs. `create` says so, and `public_ip=False`
+  leaves it out (and the VM unreachable from outside).
+- **Everything goes in one resource group of its own**, so `delete` removes the
+  group and nothing that bills -- a NIC, a disk, an IP -- outlives the VM.
+
+The free hours exist only on a free account (or Azure for Students), or on one
+upgraded from it during its first 12 months. A pay-as-you-go subscription takes
+the same request and bills it, so `create` reads the subscription's offer first
+and refuses anything else unless told `paid_ok=True`.
+
+The sign-in is `auth` (`mk azure.login`); the calls are `arm`. No `az`.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Any
+from urllib.parse import quote
+
+from make import config, note, step, warn
+from make.errors import ConfigError, MakeError
+
+from . import arm
+from .template import DISK_GB, vm_template
+
+__all__ = [
+    "FREE_SIZES",
+    "Azure",
+    "create",
+    "delete",
+    "free_offer",
+    "list_vms",
+    "resource_group",
+    "ssh_key",
+    "subscription",
+]
+
+#: The sizes the free account covers, and the architecture each one runs.
+FREE_SIZES = {"Standard_B1s": "x64", "Standard_B2ats_v2": "x64", "Standard_B2pts_v2": "Arm64"}
+
+#: `subscriptionPolicies.quotaId` prefixes of the offers that carry free services.
+FREE_OFFERS = ("FreeTrial_", "AzureForStudents_")
+
+SUBSCRIPTIONS_API = "2022-12-01"
+RESOURCES_API = "2022-09-01"
+SKUS_API = "2021-07-01"
+COMPUTE_API = "2024-07-01"
+NETWORK_API = "2023-09-01"
+
+
+@config.section("azure")
+@dataclass
+class Azure:
+    """Who signs in, where the VM goes, and who logs in to it."""
+
+    tenant: str = ""
+    """The Entra tenant (id or domain). Empty: the only one `azure.login` has saved."""
+
+    subscription: str = ""
+    """Subscription id or name. Empty: the only one the sign-in can reach."""
+
+    location: str = "westeurope"
+    """Any region that offers the size; the free hours are not tied to one."""
+
+    size: str = "Standard_B1s"
+    """One of `FREE_SIZES`. B1s is 1 vCPU and 1 GiB; the v2 sizes are 2 vCPU and 1 GiB."""
+
+    admin: str = "azureuser"
+    """The login user on the VM."""
+
+    ssh_key: str = ""
+    """A public key file. Empty: `~/.ssh/id_ed25519.pub`, then `~/.ssh/id_rsa.pub`."""
+
+
+def _tenant() -> str:
+    return Azure.get().tenant
+
+
+# -- the account -----------------------------------------------------------
+
+
+def subscriptions() -> list[dict] | None:
+    """Every subscription the sign-in reaches; `None` under `--dry-run`."""
+    return arm.collect("/subscriptions", SUBSCRIPTIONS_API, tenant=_tenant())
+
+
+def subscription() -> dict:
+    """The subscription to act in, refusing a sign-in that has none.
+
+    Under `--dry-run` a stand-in comes back, so the plan keeps going.
+    """
+    found = subscriptions()
+    if found is None:
+        return {
+            "subscriptionId": "<subscription>",
+            "displayName": "<dry-run>",
+            "subscriptionPolicies": {"quotaId": "FreeTrial_<dry-run>"},
+        }
+    wanted = Azure.get().subscription
+    if wanted:
+        for entry in found:
+            if wanted in (entry.get("subscriptionId"), entry.get("displayName")):
+                return entry
+        raise ConfigError(
+            f"the sign-in cannot reach subscription {wanted}",
+            hint="it reaches: " + (", ".join(e.get("displayName", "?") for e in found) or "none"),
+        )
+    enabled = [e for e in found if e.get("state", "Enabled") == "Enabled"]
+    if not enabled:
+        raise MakeError(
+            "the Azure sign-in has no subscription",
+            hint="sign up for a free account at https://azure.microsoft.com/free, or "
+            "`mk azure.login --tenant <id>` as an identity that has one",
+        )
+    if len(enabled) > 1:
+        raise ConfigError(
+            f"the sign-in reaches {len(enabled)} subscriptions",
+            hint="Azure.configure(subscription=...) -- one of: "
+            + ", ".join(e.get("displayName", "?") for e in enabled),
+        )
+    return enabled[0]
+
+
+def free_offer(entry: dict) -> str | None:
+    """The subscription's offer (`quotaId`) if it carries the free services, else None."""
+    quota = (entry.get("subscriptionPolicies") or {}).get("quotaId", "")
+    return quota if quota.startswith(FREE_OFFERS) else None
+
+
+def ssh_key(given: str = "") -> Path:
+    """The public key the VM will accept."""
+    candidates = (
+        [Path(given).expanduser()]
+        if given
+        else [Path("~/.ssh/id_ed25519.pub").expanduser(), Path("~/.ssh/id_rsa.pub").expanduser()]
+    )
+    for candidate in candidates:
+        if candidate.is_file():
+            return candidate
+    raise ConfigError(
+        f"no SSH public key at {', '.join(str(c) for c in candidates)}",
+        hint="ssh-keygen -t ed25519, or Azure.configure(ssh_key=...)",
+    )
+
+
+def resource_group(name: str) -> str:
+    """The resource group a VM lives in: one per VM, so deleting it deletes all of it."""
+    return f"{name}-rg"
+
+
+def _group_path(sub: str, name: str) -> str:
+    return f"/subscriptions/{sub}/resourcegroups/{resource_group(name)}"
+
+
+# -- the VM ----------------------------------------------------------------
+
+
+def _available(sub: str, size: str, location: str) -> None:
+    """Refuse a size the region will not sell this subscription.
+
+    Free accounts are routinely restricted from B-series capacity in the busy
+    regions; the deployment would find out only after the group exists, as
+    `SkuNotAvailable`. Asking first costs one call and names the fix.
+    """
+    skus = arm.collect(
+        f"/subscriptions/{sub}/providers/Microsoft.Compute/skus",
+        SKUS_API,
+        tenant=_tenant(),
+        **{"$filter": f"location eq '{location}'"},
+    )
+    if skus is None:
+        return
+    matches = [s for s in skus if s.get("name") == size and s.get("resourceType") == "virtualMachines"]
+    if not matches:
+        raise MakeError(f"{location} does not offer {size}", hint="pick another location")
+    if any(r.get("type") == "Location" for s in matches for r in s.get("restrictions") or []):
+        raise MakeError(
+            f"{size} is restricted for this subscription in {location}",
+            hint="free accounts often are in busy regions; try another, e.g. --location swedencentral",
+        )
+
+
+def create(
+    name: str,
+    *,
+    location: str | None = None,
+    size: str | None = None,
+    public_ip: bool = True,
+    paid_ok: bool = False,
+) -> dict:
+    """Create a free-tier Ubuntu VM; return `{"publicIp": ..., "resourceGroup": ...}`.
+
+    Refuses, before anything is created: a size the free account does not
+    cover; a subscription without the free services (unless `paid_ok`); a
+    region that will not sell the size; a name already taken.
+    """
+    settings = Azure.get()
+    location = location or settings.location
+    size = size or settings.size
+    if size not in FREE_SIZES:
+        raise MakeError(f"{size} is not a free-tier size", hint="one of: " + ", ".join(FREE_SIZES))
+    key = ssh_key(settings.ssh_key)
+
+    entry = subscription()
+    sub, label = entry["subscriptionId"], entry.get("displayName", "?")
+    offer = free_offer(entry)
+    if offer:
+        step(f"subscription {label} ({offer})")
+    elif paid_ok:
+        warn(f"subscription {label} has no free services: this VM is billed in full")
+    else:
+        raise MakeError(
+            f"subscription {label} is not a free account, so this VM would be billed",
+            hint="a free account upgraded to pay-as-you-go keeps the free hours for its first 12 "
+            "months; if this is one, pass --paid-ok",
+        )
+
+    group = _group_path(sub, name)
+    if arm.call("GET", group, RESOURCES_API, tenant=_tenant(), missing_ok=True):
+        raise MakeError(f"{resource_group(name)} already exists", hint=f"mk azure.delete {name}")
+    if any(v.get("properties", {}).get("hardwareProfile", {}).get("vmSize") == size for v in list_vms(sub)):
+        warn(f"another {size} already exists: two running all month exceed the 750 free hours")
+
+    _available(sub, size, location)
+
+    arch = FREE_SIZES[size]
+    step(f"{name}: {size} ({arch}), Ubuntu 24.04, {DISK_GB} GiB P6 SSD, in {location}")
+    arm.call(
+        "PUT",
+        group,
+        RESOURCES_API,
+        tenant=_tenant(),
+        body={"location": location, "tags": {"managed-by": "mkrun"}},
+    )
+    deployment = f"{group}/providers/Microsoft.Resources/deployments/{quote(name)}-vm"
+    template = vm_template(
+        name,
+        size=size,
+        arch=arch,
+        admin=settings.admin,
+        public_key=key.read_text(),
+        location=location,
+        public_ip=public_ip,
+    )
+    arm.call(
+        "PUT",
+        deployment,
+        RESOURCES_API,
+        tenant=_tenant(),
+        body={"properties": {"mode": "Incremental", "template": template}},
+    )
+    done = arm.wait_deployment(deployment, RESOURCES_API, tenant=_tenant()) or {}
+    outputs = (done.get("properties") or {}).get("outputs") or {}
+    address = (outputs.get("publicIp") or {}).get("value") or ("<ip>" if not done else "")
+    if public_ip:
+        note("the public IPv4 is the one part of this VM the free tier does not cover (about $3.65 a month)")
+    if address:
+        note(f"ssh {settings.admin}@{address}")
+    return {"publicIp": address, "resourceGroup": resource_group(name)}
+
+
+def list_vms(sub: str | None = None) -> list[dict]:
+    """Every VM in the subscription, with its power state (`statusOnly=true`)."""
+    sub = sub or subscription()["subscriptionId"]
+    found = arm.collect(
+        f"/subscriptions/{sub}/providers/Microsoft.Compute/virtualMachines",
+        COMPUTE_API,
+        tenant=_tenant(),
+        statusOnly="true",
+    )
+    return found or []
+
+
+def public_ips(sub: str) -> dict[str, str]:
+    """Public IP name -> address, across the subscription."""
+    found = arm.collect(
+        f"/subscriptions/{sub}/providers/Microsoft.Network/publicIPAddresses", NETWORK_API, tenant=_tenant()
+    )
+    return {p.get("name", ""): (p.get("properties") or {}).get("ipAddress", "") for p in found or []}
+
+
+def power_state(entry: dict) -> str:
+    statuses = ((entry.get("properties") or {}).get("instanceView") or {}).get("statuses") or []
+    for status in statuses:
+        code = status.get("code", "")
+        if code.startswith("PowerState/"):
+            return code.removeprefix("PowerState/")
+    return "?"
+
+
+def delete(name: str, *, wait: bool = True) -> None:
+    """Delete a VM's resource group: the VM, its disk, NIC, IP and network, at once."""
+    sub = subscription()["subscriptionId"]
+    group = _group_path(sub, name)
+    found = arm.call("GET", group, RESOURCES_API, tenant=_tenant(), missing_ok=True)
+    if found is None and not _dry():
+        raise MakeError(f"no resource group {resource_group(name)}", hint="mk azure.vms lists what exists")
+    answer = arm.request("DELETE", arm.url(group, RESOURCES_API), tenant=_tenant())
+    if wait:
+        step(f"deleting {resource_group(name)} (a few minutes)")
+        arm.wait_location(answer, tenant=_tenant())
+        note(f"deleted {resource_group(name)}; nothing it held is billed any more")
+    else:
+        note(f"deleting {resource_group(name)} in the background")
+
+
+def _dry() -> bool:
+    from make.context import current
+
+    return current().dry_run
+
+
+def describe(entry: dict, addresses: dict[str, str]) -> dict[str, Any]:
+    """The fields `azure.vms` prints."""
+    size = (entry.get("properties") or {}).get("hardwareProfile", {}).get("vmSize", "?")
+    name = entry.get("name", "?")
+    return {
+        "name": name,
+        "size": size,
+        "free": size in FREE_SIZES,
+        "state": power_state(entry),
+        "ip": addresses.get(f"{name}-ip", ""),
+    }

make_azure-0.2.0.dist-info/METADATA

@@ -0,0 +1,152 @@
+Metadata-Version: 2.5
+Name: make-azure
+Version: 0.2.0
+Summary: Azure tasks for mkrun -- sign in with azure-identity, and create a free-tier virtual machine with nothing billed left behind.
+Project-URL: Homepage, https://make.optersoft.com
+Author-email: "Optersoft, S.L." <david@optersoft.com>
+License-Expression: MIT OR Apache-2.0
+Keywords: az,azure,free tier,mk,mkrun,virtual machine
+Requires-Python: >=3.11
+Requires-Dist: azure-identity>=1.16
+Requires-Dist: mkrun>=0.4.1
+Description-Content-Type: text/markdown
+
+# make-azure
+
+A virtual machine on **Azure's free tier**, for [`mkrun`](https://pypi.org/project/mkrun/):
+signed in with Microsoft's own `azure-identity`, created with every field that
+decides the bill set explicitly, and removed with nothing billed left behind.
+No `az` CLI.
+
+```python
+# Makefile.py in a consuming repo
+# /// script
+# requires-python = ">=3.11"
+# dependencies = ["mkrun>=0.4.1", "make-azure>=0.2"]
+# ///
+from make_azure import azure  # importing is what registers the group
+from make_azure.vm import Azure
+
+Azure.configure(tenant="contoso.onmicrosoft.com", location="swedencentral")  # optional
+```
+
+```console
+$ mk azure.login --tenant <id or domain>   # once; a browser opens
+$ mk azure.login --tenant <t> --device-code  # no browser here: enter a code elsewhere
+$ mk azure.account                         # which subscription, and is it a free one
+$ mk azure.vm box                          # Ubuntu 24.04 on a B1s, SSH open
+$ mk azure.vm arm --size Standard_B2pts_v2
+$ mk azure.vms                             # what the subscription has
+$ mk azure.delete box                      # the VM and everything it made
+$ mk -n azure.vm box                       # the plan; nothing is sent, no sign-in needed
+```
+
+## Signing in
+
+`azure.login` runs the sign-in inside its own process, so the browser's
+redirect goes back to the process that is waiting for it. It keeps two things:
+
+- an **authentication record** (account, tenant, username; no secret) in
+  `~/.make/azure/<tenant>.json`, which says which account later calls use;
+- the **tokens**, in MSAL's encrypted cache: the macOS Keychain, or libsecret
+  on Linux. Unencrypted storage is refused, never fallen back to.
+
+Every later task gets its token silently from those two. It never opens a
+browser in the middle of `azure.vm`: an expired sign-in is an error that says
+`mk azure.login`.
+
+In CI, an identity in the environment wins: `AZURE_CLIENT_ID` + `AZURE_TENANT_ID`
+with `AZURE_FEDERATED_TOKEN_FILE` (workload identity) or `AZURE_CLIENT_SECRET`.
+The secret's name marks it as a credential, so mkrun withholds it from child
+processes and redacts it.
+
+⚠ **There is no `az` fallback**, on purpose. One address can be both a personal
+Microsoft account and a work account, and silently reusing whichever `az`
+session is around is how the wrong one gets used.
+
+⚠ **MFA is asked for at sign-in, on purpose.** Since Azure's mandatory MFA
+(2025), Resource Manager answers any create, update or delete made without it
+with `401 RequestDisallowedByAzure` and a claims challenge (`acrs: p1`). Reads
+still pass, so everything up to the first write would work and then fail.
+`azure.login` asks for those claims up front, and `arm` answers a challenge
+silently if one still comes. The user does MFA once, at sign-in, as the portal
+makes them.
+
+⚠ **School and work tenants often block `--device-code`.** Microsoft's managed
+Conditional Access policy against device-code phishing answers
+`AADSTS53003` *"does not meet the criteria"* after a successful sign-in, and
+the device-code flow then polls until its code expires (about 15 minutes):
+Ctrl-C. Use the browser flow, which the same policy allows. Measured on a
+school tenant (Azure for Students), 2026-10-07: device code refused, browser
+admitted, VM created, SSH in, deleted.
+
+Two browser-flow traps, both with a fix on screen:
+
+- **The redirect has to reach this process.** The sign-in URL is printed as
+  well as opened. Open it in the browser you actually sign in with; if you sign
+  in in some other tab, nothing comes back and `azure.login` times out after 5
+  minutes.
+- **`state mismatch: … vs None`** means an *old* `localhost:8400` tab (a
+  previous *"Authentication complete"* page, reloaded or restored) answered
+  first. Close every such tab and run `azure.login` again.
+
+`azure-identity` signs in as the Azure CLI's public client
+(`04b07795-8ddb-461a-bbee-02f9e1bf7b46`), so a tenant that blocks `az` outright
+blocks this too.
+
+## What "free" means here
+
+An Azure free account gives, for its first 12 months, **750 hours a month** of
+each of `Standard_B1s`, `Standard_B2ats_v2` (AMD) and `Standard_B2pts_v2` (Arm).
+That's one VM running all month. It also gives **two 64 GiB P6 managed disks**.
+Azure for Students carries the same free services. Everything else bills:
+
+| | a portal or `az vm create` default | here |
+|---|---|---|
+| OS disk | 30 GiB → billed as **P4**, a meter the offer does not cover | **64 GiB Premium SSD = P6**, the free one |
+| size | `Standard_DS1_v2` and friends | `Standard_B1s`; anything outside the three is refused |
+| resource group | one you name, shared | `<name>-rg`, one per VM, so `delete` takes all of it |
+| public IP | Standard static IPv4 | the same, **and it is billed** (about $3.65 a month) |
+
+⚠ **The public IPv4 is the one cost.** Basic public IPs, which the free account
+used to cover, were retired on 2025-09-30, and a Standard IPv4 bills by the hour
+whether or not the VM runs. `--no-public-ip` leaves it out; the VM is then
+reachable only from inside its network.
+
+⚠ **A pay-as-you-go subscription takes the same request and pays for it.**
+`azure.vm` reads the subscription's offer (`quotaId`) and refuses anything but
+a free account or Azure for Students. A free account upgraded to pay-as-you-go
+keeps its free hours until month 12 but reports the paid offer; `--paid-ok` is
+for that case.
+
+It also refuses, before creating anything: a sign-in that reaches no
+subscription, or several when none is named; a region that will not sell the
+size to this subscription (free accounts are often restricted in busy regions,
+so try another `--location`); and a name already taken. A second VM of the
+same size is allowed, with a warning: two running all month exceed the 750 hours.
+
+## How it talks to Azure
+
+Plain REST to Resource Manager through `make.http`, with a bearer token from
+`azure-identity`. No `azure-mgmt-*` SDKs. The VM is **one template
+deployment** (`template.py`): network, NSG, IP, NIC and VM in a single request.
+Azure works out the order, and a failure reports Azure's own reason
+(`SkuNotAvailable: …`). `azure-identity` is imported only when a token is
+needed, so `mk --list` never pays its import time.
+
+## Settings
+
+`Azure.configure(...)` in the task file, an `[azure]` table in the config file,
+or `MAKE_AZURE_<FIELD>` in the environment:
+
+| field | default | |
+|---|---|---|
+| `tenant` | the only one `azure.login` saved | tenant id or domain |
+| `subscription` | the only one the sign-in reaches | id or display name |
+| `location` | `westeurope` | any region with B-series capacity |
+| `size` | `Standard_B1s` | one of the three free sizes |
+| `admin` | `azureuser` | the login user |
+| `ssh_key` | `~/.ssh/id_ed25519.pub`, then `id_rsa.pub` | the public key the VM accepts |
+
+The group is `azure`, and it merges with a repo's own `azure.*` tasks; this
+package claims `login`, `account`, `vm`, `vms` and `delete`, nothing else.

make_azure-0.2.0.dist-info/RECORD

@@ -0,0 +1,9 @@
+make_azure/__init__.py,sha256=4aOQHH61cDrJ2cB-_Am-p3to6i8qBCIEreSkcmbxMl4,976
+make_azure/arm.py,sha256=84FMA4HBdiEMTL5a1GmYVvjD0Q_P6OHg_H7TYv-Ix4Y,7650
+make_azure/auth.py,sha256=lGQibmkH7O-5GeuSh61zVyp7W4FWLrxmS9HvpPqfQ3k,9330
+make_azure/azure.py,sha256=3K9RjJ1q_5nlAgbEyjSrF_ibyahmhKle0Ec0lpq7XmI,3156
+make_azure/template.py,sha256=Gk2NKhTWmDZBHLOTTu3x0GNu8oGRiWjVWFJFAr2o394,6530
+make_azure/vm.py,sha256=iqSmYRGyK8fZWhpjR9UU5xMoZckvy00udLPWizoBTTc,12760
+make_azure-0.2.0.dist-info/METADATA,sha256=Tm-tM9JaMfCf_c8i_UgsjWad1S1y5y-ZBx5r22r2kPk,7455
+make_azure-0.2.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+make_azure-0.2.0.dist-info/RECORD,,

make_azure-0.2.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.32.4
+Root-Is-Purelib: true
+Tag: py3-none-any