monorepoly 0.2.0__py3-none-any.whl

monorepoly/chunk_config.py

@@ -0,0 +1,466 @@
+"""Splits YAML, TOML and Dockerfiles into a file symbol plus objects, keys, tables or stages."""
+
+import collections
+import itertools
+import logging
+import re
+import tomllib
+from collections.abc import Iterable, Iterator, Sequence
+
+import yaml
+
+from monorepoly.models import Symbol, SymbolKind
+
+_LOGGER = logging.getLogger(__name__)
+
+_DOCKER_ASSIGNMENT = re.compile(
+    r'(?P<key>[A-Za-z_][\w.-]*)=(?P<value>"(?:[^"\\]|\\.)*"|\'[^\']*\'|\S+)'
+)
+_DOCKER_DIRECTIVE = re.compile(r'^#\s*(?P<name>\w+)\s*=\s*(?P<value>\S+)\s*$')
+_DOCKER_HEREDOC = re.compile(r'<<-?\s*(?P<quote>["\']?)(?P<word>[A-Za-z_]\w*)(?P=quote)')
+_DOCKER_INSTRUCTION = re.compile(r'^\s*(?P<keyword>[A-Za-z]+)(?:\s|$)')
+# The pre-1.0 `ENV KEY value with spaces` form, which has no `=`.
+_DOCKER_LEGACY_ENV = re.compile(r'^(?P<head>\s*ENV\s+(?P<key>[^\s=]+)\s+)(?P<value>.*?)\s*$', re.I)
+_DOCKER_SECRET_KEYWORDS = frozenset({'ARG', 'ENV', 'LABEL'})
+_DOCKER_STAGE_NAME = re.compile(r'\sAS\s+(?P<name>\S+)\s*$', re.IGNORECASE)
+_GENERATED = re.compile(r'generated|do not edit', re.IGNORECASE)
+_GENERATED_HEAD_LINES = 5
+# The line breaks YAML 1.1 counts, so line numbers agree with the parser's marks.
+_LINE_BREAK = re.compile('\r\n|[\r\n\x85\u2028\u2029]')
+_LINE = re.compile(r'[^\r\n]*')
+_MASK = 'x'
+# A Go template action, as in Helm charts; `{{/* comments */}}` may span lines.
+_TEMPLATE_ACTION = re.compile(r'\{\{.*?\}\}', re.DOTALL)
+_LOCK_FILE = re.compile(r'[-.]lock\.ya?ml$')
+_MAX_BYTES = 512 * 1024
+_REDACTED = '<redacted>'
+_SECRET_KEY = re.compile(r'password|secret|token|private_key|credentials', re.IGNORECASE)
+_TOML_KEY = r'(?:[A-Za-z0-9_-]+|"(?:[^"\\]|\\.)*"|\'[^\']*\')'
+_TOML_HEADER = re.compile(
+    rf'^\s*(?P<open>\[\[?)\s*(?P<name>{_TOML_KEY}(?:\s*\.\s*{_TOML_KEY})*)\s*\]\]?\s*(?:#.*)?$'
+)
+
+# (kind, 1-based first line, 1-based last line before trimming, name, signature)
+type _Part = tuple[SymbolKind, int, int, str, str]
+
+
+def chunk_yaml(*, path: str, project_id: int, ref: str, source: str) -> list[Symbol]:
+    """Returns the file symbol followed by its Kubernetes objects or top-level keys."""
+    if _skipped(path=path, source=source):
+        return []
+    try:
+        documents, template = _compose_yaml(source)
+    except yaml.YAMLError as err:
+        _LOGGER.warning("Skipping unparsable '%s' in project %s: %s", path, project_id, err)
+        return []
+    if not documents:
+        return []
+    return _symbols(
+        parts=_yaml_parts(documents=documents, template=template),
+        path=path,
+        project_id=project_id,
+        ref=ref,
+        text=_redact_yaml(documents=documents, source=source),
+    )
+
+
+def chunk_toml(*, path: str, project_id: int, ref: str, source: str) -> list[Symbol]:
+    """Returns the file symbol followed by its tables."""
+    if _skipped(path=path, source=source):
+        return []
+    try:
+        data = tomllib.loads(source)
+    except tomllib.TOMLDecodeError as err:
+        _LOGGER.warning("Skipping unparsable '%s' in project %s: %s", path, project_id, err)
+        return []
+    if not data:
+        return []
+    text = _redact_toml(data=data, source=source)
+    if text is None:
+        _LOGGER.warning(
+            "Skipping '%s' in project %s: a secret is not written literally.", path, project_id
+        )
+        return []
+    # Headers come from the original: a redacted value may also occur in a header.
+    return _symbols(
+        parts=_toml_parts(_split_lines(source)),
+        path=path,
+        project_id=project_id,
+        ref=ref,
+        text=text,
+    )
+
+
+def chunk_dockerfile(*, path: str, project_id: int, ref: str, source: str) -> list[Symbol]:
+    """Returns the file symbol followed by its build stages."""
+    if _skipped(path=path, source=source):
+        return []
+    lines = _split_lines(source)
+    instructions = list(_docker_instructions(lines))
+    if not instructions:
+        return []
+    stages = [start for start, _, keyword in instructions if keyword == 'FROM']
+    if not stages:
+        _LOGGER.warning("Skipping '%s' in project %s: no FROM.", path, project_id)
+        return []
+    return _symbols(
+        parts=_docker_parts(lines=lines, stages=stages),
+        path=path,
+        project_id=project_id,
+        ref=ref,
+        text=_redact_dockerfile(instructions=instructions, lines=lines, source=source),
+    )
+
+
+def _skipped(*, path: str, source: str) -> bool:
+    head = '\n'.join(source.splitlines()[:_GENERATED_HEAD_LINES])
+    skipped = bool(
+        _LOCK_FILE.search(path) or len(source.encode()) > _MAX_BYTES or _GENERATED.search(head)
+    )
+    if skipped:
+        _LOGGER.debug("Skipping lock, generated or oversized '%s'.", path)
+    return skipped
+
+
+def _symbols(
+    *,
+    parts: Iterable[_Part],
+    path: str,
+    project_id: int,
+    ref: str,
+    text: str,
+) -> list[Symbol]:
+    lines = _split_lines(text)
+    symbols = [
+        Symbol(
+            docstring=None,
+            end_line=max(len(lines), 1),
+            kind=SymbolKind.CONFIG_FILE,
+            path=path,
+            project_id=project_id,
+            qualname=path,
+            ref=ref,
+            signature=path,
+            source=text,
+            start_line=1,
+        )
+    ]
+    for kind, start, end, name, signature in parts:
+        end = _trim_end(end=end, lines=lines, start=start)
+        symbols.append(
+            Symbol(
+                docstring=_comment_above(line=start, lines=lines),
+                end_line=end,
+                kind=kind,
+                path=path,
+                project_id=project_id,
+                qualname=f'{path}::{name}',
+                ref=ref,
+                signature=signature,
+                source='\n'.join(lines[start - 1 : end]),
+                start_line=start,
+            )
+        )
+    return symbols
+
+
+def _split_lines(text: str) -> list[str]:
+    lines = _LINE_BREAK.split(text)
+    # Drop trailing empty element to keep the file's end_line == len(lines).
+    if lines and lines[-1] == '':
+        lines.pop()
+    return lines
+
+
+def _trim_end(*, end: int, lines: Sequence[str], start: int) -> int:
+    """Returns `end` moved up past trailing blank and comment lines, which belong to the next."""
+    end = min(end, len(lines))
+    while end > start and (not lines[end - 1].strip() or lines[end - 1].lstrip().startswith('#')):
+        end -= 1
+    return end
+
+
+def _comment_above(*, line: int, lines: Sequence[str]) -> str | None:
+    """Returns the comment block directly above the 1-based `line`, past a `---` marker."""
+    index = line - 2
+    while index >= 0 and lines[index].startswith('---'):
+        index -= 1
+    comments = []
+    while index >= 0 and lines[index].lstrip().startswith('#'):
+        comments.append(lines[index].lstrip().removeprefix('#').strip())
+        index -= 1
+    return '\n'.join(reversed(comments)) or None
+
+
+def _compose_yaml(source: str) -> tuple[list[yaml.Node], str | None]:
+    """Returns the documents, and the original source if they were composed from a masked one."""
+    try:
+        # Composing, unlike loading, accepts custom tags such as GitLab's `!reference`.
+        return list(yaml.compose_all(source, Loader=yaml.SafeLoader)), None
+    except yaml.YAMLError:
+        # Only what does not parse as is gets masked: valid YAML may hold `{{` in its strings.
+        if '{{' not in source:
+            raise
+    return list(yaml.compose_all(_mask_template_actions(source), Loader=yaml.SafeLoader)), source
+
+
+def _mask_template_actions(source: str) -> str:
+    """Returns `source` with Go template actions masked, every character keeping its position.
+
+    A line holding only actions becomes blank; an inline action becomes a plain `x…` scalar.
+    """
+    masked = list(source)
+    in_action = [False] * len(source)
+    for action in _TEMPLATE_ACTION.finditer(source):
+        for index in range(action.start(), action.end()):
+            if masked[index] not in '\r\n':
+                masked[index], in_action[index] = _MASK, True
+    for line in _LINE.finditer(source):
+        span = range(line.start(), line.end())
+        if any(in_action[i] for i in span) and all(
+            in_action[i] or source[i].isspace() for i in span
+        ):
+            masked[line.start() : line.end()] = ' ' * len(span)
+    return ''.join(masked)
+
+
+def _yaml_parts(*, documents: Sequence[yaml.Node], template: str | None) -> Iterator[_Part]:
+    for document in documents:
+        if not isinstance(document, yaml.MappingNode) or _is_secret(document):
+            continue
+        kind, metadata = _value(document, 'kind'), _value(document, 'metadata')
+        name = _value(metadata, 'name') if isinstance(metadata, yaml.MappingNode) else None
+        if isinstance(kind, yaml.ScalarNode) and isinstance(name, yaml.ScalarNode):
+            namespace = _value(metadata, 'namespace')
+            suffix = (
+                f' ({_text(namespace, template)})' if isinstance(namespace, yaml.ScalarNode) else ''
+            )
+            kind_text, name_text = _text(kind, template), _text(name, template)
+            yield (
+                SymbolKind.CONFIG_DOCUMENT,
+                document.start_mark.line + 1,
+                _last_line(document.end_mark),
+                f'{kind_text}/{name_text}',
+                f'{kind_text} {name_text}{suffix}',
+            )
+            continue
+        for key, value in document.value:
+            if isinstance(key, yaml.ScalarNode):
+                start, text = key.start_mark.line + 1, _text(key, template)
+                yield SymbolKind.CONFIG_KEY, start, _last_line(value.end_mark), text, text
+
+
+def _text(node: yaml.ScalarNode, template: str | None) -> str:
+    """Returns the scalar's value, or its template text where an action was masked in it."""
+    if template is None:
+        return node.value
+    written = template[node.start_mark.index : node.end_mark.index]
+    return written.strip('\'"') if '{{' in written else node.value
+
+
+def _last_line(mark: yaml.Mark) -> int:
+    # A block ends where whatever follows it starts, at column 0 of the next line.
+    return mark.line + 1 if mark.column else mark.line
+
+
+def _redact_yaml(*, documents: Sequence[yaml.Node], source: str) -> str:
+    """Returns `source` with sensitive values replaced, keeping every line number."""
+    # A block ends where the next token starts, so trim the indentation of whatever follows.
+    spans = sorted(
+        (start, start + len(source[start:end].rstrip()))
+        for document in documents
+        for start, end in _sensitive_spans(node=document, seen=set())
+    )
+    merged: list[tuple[int, int]] = []
+    for start, end in spans:
+        # An alias can point into a value that is already redacted.
+        if merged and start <= merged[-1][1]:
+            merged[-1] = (merged[-1][0], max(end, merged[-1][1]))
+        else:
+            merged.append((start, end))
+    parts, position = [], 0
+    for start, end in merged:
+        parts += [source[position:start], _redacted(source[start:end])]
+        position = end
+    parts.append(source[position:])
+    return ''.join(parts)
+
+
+def _sensitive_spans(*, node: yaml.Node, seen: set[int]) -> Iterator[tuple[int, int]]:
+    # Aliases share nodes, and may even refer to their own ancestor.
+    if id(node) in seen:
+        return
+    seen.add(id(node))
+    match node:
+        case yaml.MappingNode() if _is_secret(node):
+            # Fail closed: nothing of a Kubernetes Secret is indexed.
+            yield node.start_mark.index, node.end_mark.index
+        case yaml.MappingNode():
+            # A Kubernetes env entry names its secret instead: `- name: DB_PASSWORD`, `value: …`.
+            name = _value(node, 'name')
+            secret_name = isinstance(name, yaml.ScalarNode) and bool(_SECRET_KEY.search(name.value))
+            for key, value in node.value:
+                if isinstance(key, yaml.ScalarNode) and (
+                    _SECRET_KEY.search(key.value) or (secret_name and key.value == 'value')
+                ):
+                    if value.start_mark.index < value.end_mark.index:
+                        yield value.start_mark.index, value.end_mark.index
+                else:
+                    yield from _sensitive_spans(node=value, seen=seen)
+        case yaml.SequenceNode():
+            for item in node.value:
+                yield from _sensitive_spans(node=item, seen=seen)
+
+
+def _is_secret(node: yaml.MappingNode) -> bool:
+    kind = _value(node, 'kind')
+    return isinstance(kind, yaml.ScalarNode) and kind.value == 'Secret'
+
+
+def _value(node: yaml.MappingNode, key: str) -> yaml.Node | None:
+    return next(
+        (v for k, v in node.value if isinstance(k, yaml.ScalarNode) and k.value == key), None
+    )
+
+
+def _toml_parts(lines: Sequence[str]) -> Iterator[_Part]:
+    """Yields one part per table, `[[array]]` tables numbered from 0."""
+    headers = [*_toml_headers(lines), (len(lines), '', False)]
+    seen: collections.Counter[str] = collections.Counter()
+    for (index, name, is_array), (next_index, _, _) in itertools.pairwise(headers):
+        signature = f'[[{name}]]' if is_array else f'[{name}]'
+        qualname = f'{name}[{seen[name]}]' if is_array else name
+        seen[name] += 1
+        yield SymbolKind.CONFIG_KEY, index + 1, next_index, qualname, signature
+
+
+def _toml_headers(lines: Sequence[str]) -> Iterator[tuple[int, str, bool]]:
+    """Yields (0-based line, dotted name, is array) per table header outside values."""
+    depth, quote = 0, None
+    for index, line in enumerate(lines):
+        if depth == 0 and quote is None and (match := _TOML_HEADER.match(line)):
+            yield index, re.sub(r'\s*\.\s*', '.', match['name']), match['open'] == '[['
+            continue
+        depth, quote = _scan_toml_line(depth=depth, line=line, quote=quote)
+
+
+def _scan_toml_line(*, depth: int, line: str, quote: str | None) -> tuple[int, str | None]:
+    """Returns the bracket depth and open multi-line string delimiter after `line`."""
+    index = 0
+    while index < len(line):
+        if quote:
+            end = line.find(quote, index)
+            if end < 0:
+                return depth, quote
+            index, quote = end + 3, None
+        elif line.startswith(('"""', "'''"), index):
+            quote = line[index : index + 3]
+            index += 3
+        elif line[index] == '#':
+            break
+        elif line[index] in '"\'':
+            delimiter, index = line[index], index + 1
+            while index < len(line) and line[index] != delimiter:
+                index += 2 if delimiter == '"' and line[index] == '\\' else 1
+            index += 1
+        else:
+            depth += {'[': 1, '{': 1, ']': -1, '}': -1}.get(line[index], 0)
+            index += 1
+    return depth, quote
+
+
+def _redact_toml(*, data: dict, source: str) -> str | None:
+    """Returns `source` with sensitive strings replaced, or None if one cannot be found."""
+    text = source
+    # Longest first, so a secret that contains another is replaced whole.
+    for secret in sorted(set(_sensitive_strings(data)), key=len, reverse=True):
+        # An escaped or line-continued secret cannot be located, so the file is not indexed.
+        if secret not in source:
+            return None
+        text = text.replace(secret, _redacted(secret))
+    return text
+
+
+def _sensitive_strings(value: object, *, sensitive: bool = False) -> Iterator[str]:
+    match value:
+        case dict():
+            for key, item in value.items():
+                yield from _sensitive_strings(
+                    item, sensitive=sensitive or bool(_SECRET_KEY.search(key))
+                )
+        case list():
+            for item in value:
+                yield from _sensitive_strings(item, sensitive=sensitive)
+        case str() if sensitive and value:
+            yield value
+
+
+def _redacted(value: str) -> str:
+    return _REDACTED + '\n' * len(_LINE_BREAK.findall(value))
+
+
+def _docker_instructions(lines: Sequence[str]) -> Iterator[tuple[int, int, str]]:
+    """Yields (0-based first line, 0-based last line, keyword) per instruction."""
+    escape, index = '\\', 0
+    # Parser directives count only at the very top, before any other line.
+    while index < len(lines) and (match := _DOCKER_DIRECTIVE.match(lines[index])):
+        if match['name'].lower() == 'escape':
+            escape = match['value']
+        index += 1
+    while index < len(lines):
+        match = _DOCKER_INSTRUCTION.match(lines[index])
+        if not match:
+            index += 1
+            continue
+        start = index
+        while lines[index].rstrip().endswith(escape) and index + 1 < len(lines):
+            index += 1
+        words = [
+            heredoc['word']
+            for line in lines[start : index + 1]
+            for heredoc in _DOCKER_HEREDOC.finditer(line)
+        ]
+        # Heredoc bodies follow the instruction in order, each up to its own terminator.
+        for word in words:
+            index += 1
+            while index < len(lines) and lines[index].strip() != word:
+                index += 1
+        index = min(index, len(lines) - 1)
+        yield start, index, match['keyword'].upper()
+        index += 1
+
+
+def _docker_parts(*, lines: Sequence[str], stages: Sequence[int]) -> Iterator[_Part]:
+    """Yields one part per stage, named like `--from=` refers to it: by name, else by index."""
+    for number, (start, next_start) in enumerate(itertools.pairwise([*stages, len(lines)])):
+        signature = lines[start].strip()
+        match = _DOCKER_STAGE_NAME.search(signature)
+        name = match['name'] if match else str(number)
+        yield SymbolKind.CONFIG_DOCUMENT, start + 1, next_start, name, signature
+
+
+def _redact_dockerfile(
+    *,
+    instructions: Iterable[tuple[int, int, str]],
+    lines: Sequence[str],
+    source: str,
+) -> str:
+    """Returns `source` with sensitive ARG, ENV and LABEL values replaced, line by line."""
+    redacted = list(lines)
+    for start, end, keyword in instructions:
+        if keyword not in _DOCKER_SECRET_KEYWORDS:
+            continue
+        legacy = _DOCKER_LEGACY_ENV.match(lines[start])
+        if legacy and _SECRET_KEY.search(legacy['key']):
+            redacted[start] = f'{legacy["head"]}{_REDACTED}'
+            continue
+        for index in range(start, end + 1):
+            redacted[index] = _DOCKER_ASSIGNMENT.sub(_redact_assignment, redacted[index])
+    trailing = '\n' if _LINE_BREAK.search(source[-2:]) else ''
+    return '\n'.join(redacted) + trailing
+
+
+def _redact_assignment(match: re.Match[str]) -> str:
+    if _SECRET_KEY.search(match['key']):
+        return f'{match["key"]}={_REDACTED}'
+    return match[0]

monorepoly/config.py

@@ -0,0 +1,54 @@
+"""Settings read from the environment."""
+
+import dataclasses
+import logging
+import os
+from collections.abc import Mapping
+
+from monorepoly.exceptions import MonorepolyConfigError
+
+_LOGGER = logging.getLogger(__name__)
+
+
+@dataclasses.dataclass(frozen=True, kw_only=True)
+class Settings:
+    gitlab_group_id: str
+    gitlab_token: str
+    gitlab_url: str
+    google_cloud_project: str
+    mongodb_db: str
+    mongodb_uri: str
+    typesafe_api_key: str
+
+
+@dataclasses.dataclass(frozen=True, kw_only=True)
+class ServerSettings:
+    """Settings of the hosted server; each user brings their own GitLab token."""
+
+    gitlab_group_id: str
+    gitlab_url: str
+    google_cloud_project: str
+    mongodb_db: str
+    mongodb_uri: str
+    public_url: str
+    typesafe_api_key: str
+
+
+def load_settings(environ: Mapping[str, str] = os.environ) -> Settings:
+    """Returns the settings, raising if any is missing."""
+    return _load(cls=Settings, environ=environ)
+
+
+def load_server_settings(environ: Mapping[str, str] = os.environ) -> ServerSettings:
+    """Returns the hosted server's settings, raising if any is missing."""
+    return _load(cls=ServerSettings, environ=environ)
+
+
+def _load[T](*, cls: type[T], environ: Mapping[str, str]) -> T:
+    names = [field.name for field in dataclasses.fields(cls)]
+    missing = [name.upper() for name in names if not environ.get(name.upper())]
+    if missing:
+        raise MonorepolyConfigError(
+            f'Missing settings {", ".join(f"`{name}`" for name in missing)}!'
+        )
+    return cls(**{name: environ[name.upper()] for name in names})

monorepoly/embed.py

@@ -0,0 +1,66 @@
+"""Vertex AI embeddings; the one switch for model, dimensions and input format."""
+
+import concurrent.futures
+import enum
+import logging
+from collections.abc import Sequence
+
+from google import genai
+from google.genai import types
+
+from monorepoly.exceptions import MonorepolyValueError
+
+_LOGGER = logging.getLogger(__name__)
+
+_LOCATION = 'eu'  # gemini-embedding-2 is served only from multi-regions (global, us, eu).
+_MAX_INPUT_CHARS = 20_000  # The 8k token limit, assuming the worst case of ~2.5 chars per token.
+_MODEL = 'gemini-embedding-2'
+# Waits 2, 4, ... 60 s: about 7 minutes in all, outlasting several per-minute quota windows.
+_RETRY = types.HttpRetryOptions(attempts=12, exp_base=2, initial_delay=2, max_delay=60)
+_TIMEOUT_MS = 60_000
+_WORKERS = 8
+
+DIMENSIONS = 768
+
+
+class QueryTask(enum.StrEnum):
+    """Task instructions; `gemini-embedding-2` takes them in the input, not as a parameter."""
+
+    CODE = 'code retrieval'
+    SEARCH = 'search result'
+
+
+class Embedder:
+    def __init__(self, *, client: genai.Client) -> None:
+        self._client = client
+        self._pool = concurrent.futures.ThreadPoolExecutor(max_workers=_WORKERS)
+
+    def documents(self, items: Sequence[tuple[str, str]]) -> list[list[float]]:
+        """Returns one vector per (title, text) pair."""
+        if not items:
+            return []
+        inputs = [f'title: {title} | text: {text}'[:_MAX_INPUT_CHARS] for title, text in items]
+        return list(self._pool.map(self._embed, inputs))
+
+    def query(self, *, task: QueryTask, text: str) -> list[float]:
+        """Returns the vector for a search query."""
+        return self._embed(f'task: {task} | query: {text}'[:_MAX_INPUT_CHARS])
+
+    def _embed(self, text: str) -> list[float]:
+        # The model only accepts one content per request.
+        response = self._client.models.embed_content(
+            config=types.EmbedContentConfig(output_dimensionality=DIMENSIONS),
+            contents=text,
+            model=_MODEL,
+        )
+        vectors = [embedding.values for embedding in (response.embeddings or [])]
+        if len(vectors) != 1:
+            raise MonorepolyValueError(f'Expected 1 embedding, got {len(vectors)}!')
+        return vectors[0]
+
+
+def make_embedder(*, project: str) -> Embedder:
+    """Returns an embedder authenticated with Application Default Credentials."""
+    options = types.HttpOptions(retry_options=_RETRY, timeout=_TIMEOUT_MS)
+    client = genai.Client(http_options=options, location=_LOCATION, project=project, vertexai=True)
+    return Embedder(client=client)

monorepoly/exceptions.py

@@ -0,0 +1,29 @@
+"""Exceptions raised by monorepoly."""
+
+
+class MonorepolyError(Exception):
+    """Base class for monorepoly errors."""
+
+
+class MonorepolyConfigError(MonorepolyError):
+    """Raised when required configuration is missing or malformed."""
+
+
+class MonorepolyAccessError(MonorepolyError):
+    """Raised when GitLab rejects the token."""
+
+
+class MonorepolyGitError(MonorepolyError):
+    """Raised when a git command fails."""
+
+
+class MonorepolyGitTransientError(MonorepolyGitError):
+    """Raised when a git command fails on a server error or connection failure worth retrying."""
+
+
+class MonorepolyValueError(MonorepolyError, ValueError):
+    """Raised when external data violates a structural invariant."""
+
+
+class MonorepolyLicenseError(MonorepolyError):
+    """Raised when a license file is malformed, tampered with or signed by an untrusted key."""