palimpsest-client 0.2.3__tar.gz

palimpsest_client-0.2.3/.github/workflows/afterglow-drift.yml

@@ -0,0 +1,30 @@
+name: Afterglow Palimpsest Drift
+
+on:
+  schedule:
+    - cron: "17 3 * * *"
+  workflow_dispatch:
+  repository_dispatch:
+    types: [afterglow-palimpsest-contract-changed]
+
+permissions:
+  contents: read
+
+jobs:
+  verify-contract:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/checkout@v4
+        with:
+          repository: openstack-afterglow/openstack-afterglow
+          ref: main
+          path: afterglow
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Verify tracked extraction contract
+        run: python scripts/check_afterglow_drift.py --upstream-root afterglow

palimpsest_client-0.2.3/.github/workflows/development-package.yml

@@ -0,0 +1,79 @@
+name: Development package
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - main
+      - dev
+      - codex/oci-root-phase1
+
+permissions:
+  contents: read
+
+concurrency:
+  group: development-package-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  verify:
+    name: Verify development package
+    if: >-
+      github.ref == 'refs/heads/main' ||
+      github.ref == 'refs/heads/dev' ||
+      github.ref == 'refs/heads/codex/oci-root-phase1'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+        with:
+          python-version: "3.12"
+      - run: uv sync --frozen --extra dev
+      - name: Check architecture freshness
+        run: python3 scripts/check_architecture.py
+      - name: Check generated CLI reference
+        run: uv run python scripts/generate_cli_reference.py --check
+      - name: Check test-lane manifest
+        run: uv run python scripts/test_lanes.py list --check
+      - name: Lint development-package contracts
+        run: uv run ruff check scripts/publish_development_package.py scripts/test_lanes.py tests/unit/test_development_package_workflow.py tests/unit/test_publish_development_package.py tests/unit/test_test_lanes.py
+      - name: Run relevant portable contracts
+        run: uv run python scripts/test_lanes.py run core-cli qualification
+      - name: Run development-package publication contracts
+        run: uv run pytest -q tests/unit/test_publish_development_package.py
+      - name: Build and smoke-test package artifacts
+        run: uv run python scripts/build_package.py --out-dir "$RUNNER_TEMP/palimpsest-dist"
+      - uses: actions/upload-artifact@v4
+        with:
+          name: development-distributions-${{ github.sha }}
+          path: ${{ runner.temp }}/palimpsest-dist/
+          if-no-files-found: error
+
+  publish:
+    name: Publish SHA-specific prerelease
+    needs: verify
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: development-distributions-${{ github.sha }}
+          path: dist/
+      - name: Verify transferred checksums
+        working-directory: dist
+        run: |
+          test "$(find . -maxdepth 1 -type f | wc -l)" -eq 3
+          test "$(find . -maxdepth 1 -type f -name '*.whl' | wc -l)" -eq 1
+          test "$(find . -maxdepth 1 -type f -name '*.tar.gz' | wc -l)" -eq 1
+          test -f SHA256SUMS
+          sha256sum --check SHA256SUMS
+      - name: Publish or verify the SHA-specific prerelease
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          python3 scripts/publish_development_package.py \
+            --repository "${GITHUB_REPOSITORY}" \
+            --sha "${GITHUB_SHA}" \
+            --dist-dir dist

palimpsest_client-0.2.3/.github/workflows/hub-docker.yml

@@ -0,0 +1,79 @@
+name: Build and Push Palimpsest Hub
+
+on:
+  pull_request:
+    branches: [main, dev]
+  push:
+    branches: [main, dev]
+    tags: ["v*"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_OWNER: ${{ github.repository_owner }}
+
+jobs:
+  test:
+    name: Hub Unit Tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+        with:
+          python-version: '3.12'
+      - name: Run Hub unit tests
+        run: |
+          cd hub
+          uv run --extra dev pytest tests/
+  build-and-push:
+    name: Build and push Hub images
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+      - uses: docker/metadata-action@v5
+        id: api
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/palimpsest-hub-api
+          tags: |
+            type=raw,value=dev,enable=${{ github.ref == 'refs/heads/dev' }}
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+            type=semver,pattern={{version}}
+            type=semver,pattern=v{{version}}
+            type=sha,prefix=sha-
+      - uses: docker/metadata-action@v5
+        id: worker
+        with:
+          images: ${{ env.REGISTRY }}/${{ env.IMAGE_OWNER }}/palimpsest-hub-worker
+          tags: |
+            type=raw,value=dev,enable=${{ github.ref == 'refs/heads/dev' }}
+            type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
+            type=semver,pattern={{version}}
+            type=semver,pattern=v{{version}}
+            type=sha,prefix=sha-
+      - uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: docker/hub/Dockerfile
+          target: palimpsest-hub-api
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.api.outputs.tags }}
+          labels: ${{ steps.api.outputs.labels }}
+      - uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: docker/hub/Dockerfile
+          target: palimpsest-hub-worker
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.worker.outputs.tags }}
+          labels: ${{ steps.worker.outputs.labels }}

palimpsest_client-0.2.3/.github/workflows/release.yml

@@ -0,0 +1,112 @@
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions:
+  contents: write
+  id-token: write
+
+jobs:
+  verify:
+    name: Rebuild and verify release artifacts
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: astral-sh/setup-uv@v6
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: uv sync --frozen --extra dev
+      - run: uv run ruff check .
+      - run: uv run ruff format --check .
+      - run: uv run python -m pytest tests/unit tests/test_kolla_assets.py tests/test_kolla_palimpsest_image_ref.py tests/test_kolla_role_contracts.py -v
+      - name: Pin the offline x86_64 guest toolchain
+        run: docker pull --platform linux/amd64 docker.io/library/gcc@sha256:a689e29bc3adf4663ef9a141d23081252764d1319c63f591a027bd6fd676f4c1
+      - name: Reproduce and execute the packaged guest stage-1 ELF
+        run: uv run python -m pytest -m guest_stage1_binary tests/integration/test_oci_guest_stage1_binary.py -vv
+      - name: Reproduce the native-KVM workload proof ELF
+        run: |
+          scripts/build_oci_guest_workload_proof.sh "$RUNNER_TEMP/workload-proof-a.x86_64"
+          scripts/build_oci_guest_workload_proof.sh "$RUNNER_TEMP/workload-proof-b.x86_64"
+          cmp tests/kvm/assets/workload-proof.x86_64 "$RUNNER_TEMP/workload-proof-a.x86_64"
+          cmp "$RUNNER_TEMP/workload-proof-a.x86_64" "$RUNNER_TEMP/workload-proof-b.x86_64"
+      - name: Verify KVM filesystem and workload fixture bindings
+        run: uv run python tests/kvm/assets/check_filesystem_fixtures.py
+      - run: docker buildx create --name palimpsest-e2e --driver docker-container --driver-opt network=none --use --bootstrap
+      - name: Verify local OCI product build
+        env:
+          PALIMPSEST_BUILDKIT_E2E: "1"
+          PALIMPSEST_BUILDKIT_BUILDER: palimpsest-e2e
+        run: uv run python -m pytest tests/integration/test_buildkit_named_oci_context.py -vv
+      - name: Remove test builder
+        if: always()
+        run: docker buildx rm palimpsest-e2e || true
+      - run: uv build
+      - run: python -m zipfile -t dist/*.whl
+      - run: tar -tzf dist/*.tar.gz
+      - uses: actions/upload-artifact@v4
+        with:
+          name: distributions
+          path: dist/
+          if-no-files-found: error
+
+  kvm-proof:
+    name: Required KVM clean-host proof
+    if: vars.PALIMPSEST_KVM_ENABLED == 'true'
+    runs-on: [self-hosted, linux, x64, kvm]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: test -c /dev/kvm
+      - run: uv sync --frozen --extra dev
+      - name: Create private stage-1 evidence directory
+        run: install -d -m 0700 "$RUNNER_TEMP/stage1-kvm-evidence"
+      - name: Require retained root, root transition, PID 1 supervision, and rejection matrices
+        timeout-minutes: 45
+        env:
+          PALIMPSEST_REQUIRE_STAGE1_KVM: "1"
+          PALIMPSEST_KVM_EVIDENCE_DIR: ${{ runner.temp }}/stage1-kvm-evidence
+        run: uv run python -m pytest -m stage1_kvm tests/kvm -vv
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: release-stage1-native-kvm-proof
+          path: ${{ runner.temp }}/stage1-kvm-evidence
+          if-no-files-found: error
+
+  publish:
+    name: Publish signed release
+    needs: [verify, kvm-proof]
+    if: needs.kvm-proof.result == 'success'
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/palimpsest-client
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: distributions
+          path: dist/
+      - uses: pypa/gh-action-pypi-publish@release/v1
+          
+  github-release:
+    name: Create GitHub release
+    needs: publish
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/download-artifact@v4
+        with:
+          name: distributions
+          path: dist/
+      - uses: softprops/action-gh-release@v2
+        with:
+          generate_release_notes: true
+          files: dist/*

palimpsest_client-0.2.3/.github/workflows/test.yml

@@ -0,0 +1,233 @@
+name: Test
+
+on:
+  workflow_call:
+  push:
+    branches: [main, dev]
+  pull_request:
+    branches: [main, dev]
+permissions:
+  contents: read
+
+jobs:
+  checks:
+    name: Lint, manifests, and package
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check architecture freshness
+        run: python3 scripts/check_architecture.py
+      - uses: astral-sh/setup-uv@v6
+        with:
+          python-version: "3.12"
+      - run: uv sync --frozen --extra dev
+      - run: uv run python -c "import palimpsest_local; import palimpsest_local.cli"
+      - run: uv run python tests/fixtures/oci-root/generate_fixtures.py --check
+      - name: Check generated CLI reference
+        run: uv run python scripts/generate_cli_reference.py --check
+      - run: uv run ruff check .
+      - run: uv run ruff format --check .
+      - run: uv run python scripts/test_lanes.py list --check
+      - name: Build and smoke-test package artifacts
+        run: uv run python scripts/build_package.py --out-dir "$RUNNER_TEMP/palimpsest-dist"
+      - name: Smoke-test minimum supported Python
+        run: uv run --python 3.11 --no-dev palimpsest --version
+
+  portable-linux:
+    name: Portable Linux (${{ matrix.shard }}/6)
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4, 5, 6]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: uv sync --frozen --extra dev
+      - run: uv run python scripts/test_lanes.py run portable --shard ${{ matrix.shard }}/6
+
+  pure:
+    name: Pure contracts (Python 3.12)
+    if: always()
+    needs: [checks, portable-linux]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require every portable shard and package check
+        env:
+          CHECKS_RESULT: ${{ needs.checks.result }}
+          PORTABLE_RESULT: ${{ needs.portable-linux.result }}
+        run: test "$CHECKS_RESULT" = success && test "$PORTABLE_RESULT" = success
+
+  oci-fs-proof:
+    name: OCI filesystem proof (privileged Linux)
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: sudo apt-get update
+      - run: sudo apt-get install --yes erofs-utils squashfs-tools
+      - run: uv sync --frozen --extra dev
+      - run: mkdir -m 0700 "$RUNNER_TEMP/oci-fs-evidence"
+      - run: mkdir -m 0700 "$RUNNER_TEMP/oci-fs-replay"
+      - name: Prove selected SquashFS and retain EROFS comparison failure
+        env:
+          PALIMPSEST_OCI_FS_EVIDENCE_DIR: ${{ runner.temp }}/oci-fs-evidence
+          PALIMPSEST_REQUIRE_OCI_FS: "1"
+        run: sudo --preserve-env=PALIMPSEST_OCI_FS_EVIDENCE_DIR,PALIMPSEST_REQUIRE_OCI_FS "$(command -v uv)" run python -m pytest -m oci_fs tests/oci_fs -vv
+      - name: Rebuild selected SquashFS in a separate process
+        env:
+          PALIMPSEST_OCI_FS_EVIDENCE_DIR: ${{ runner.temp }}/oci-fs-replay
+          PALIMPSEST_REQUIRE_OCI_FS: "1"
+        run: sudo --preserve-env=PALIMPSEST_OCI_FS_EVIDENCE_DIR,PALIMPSEST_REQUIRE_OCI_FS "$(command -v uv)" run python -m pytest -m oci_fs -k layer_filesystem_semantics tests/oci_fs -vv
+      - name: Require cross-process deterministic evidence
+        run: |
+          cmp "$RUNNER_TEMP/oci-fs-evidence/squashfs.json" "$RUNNER_TEMP/oci-fs-replay/squashfs.json"
+          cp "$RUNNER_TEMP/oci-fs-replay/squashfs.json" "$RUNNER_TEMP/oci-fs-evidence/squashfs-replay.json"
+      - name: Require both retained candidate results
+        run: test -s "$RUNNER_TEMP/oci-fs-evidence/squashfs.json" && test -s "$RUNNER_TEMP/oci-fs-evidence/squashfs-replay.json" && test -s "$RUNNER_TEMP/oci-fs-evidence/erofs.json"
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: oci-filesystem-proof
+          path: ${{ runner.temp }}/oci-fs-evidence
+          if-no-files-found: error
+
+  local-oci-build:
+    name: Local OCI image product build
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: uv sync --frozen --extra dev
+      - name: Create isolated network-none BuildKit builder
+        run: docker buildx create --name palimpsest-e2e --driver docker-container --driver-opt network=none --use --bootstrap
+      - name: Prove direct interoperability and Palimpsest product build
+        env:
+          PALIMPSEST_BUILDKIT_E2E: "1"
+          PALIMPSEST_BUILDKIT_BUILDER: palimpsest-e2e
+        run: uv run python -m pytest tests/integration/test_buildkit_named_oci_context.py -vv
+      - name: Remove test builder
+        if: always()
+        run: docker buildx rm palimpsest-e2e || true
+
+  guest-stage1-binary:
+    name: Guest stage-1 binary (Linux x86_64)
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: uv sync --frozen --extra dev
+      - name: Pin the offline x86_64 build toolchain
+        run: docker pull --platform linux/amd64 docker.io/library/gcc@sha256:a689e29bc3adf4663ef9a141d23081252764d1319c63f591a027bd6fd676f4c1
+      - name: Execute and reproduce the packaged stage-1 ELF
+        run: uv run python -m pytest -m guest_stage1_binary tests/integration/test_oci_guest_stage1_binary.py -vv
+      - name: Reproduce the native-KVM workload proof ELF
+        run: |
+          scripts/build_oci_guest_workload_proof.sh "$RUNNER_TEMP/workload-proof-a.x86_64"
+          scripts/build_oci_guest_workload_proof.sh "$RUNNER_TEMP/workload-proof-b.x86_64"
+          cmp tests/kvm/assets/workload-proof.x86_64 "$RUNNER_TEMP/workload-proof-a.x86_64"
+          cmp "$RUNNER_TEMP/workload-proof-a.x86_64" "$RUNNER_TEMP/workload-proof-b.x86_64"
+      - name: Verify KVM filesystem and workload fixture bindings
+        run: uv run python tests/kvm/assets/check_filesystem_fixtures.py
+
+
+  portable-macos:
+    name: Portable macOS (${{ matrix.shard }}/4)
+    runs-on: macos-15
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: uv sync --frozen --extra dev
+      - run: uv run python -c "import palimpsest_local; import palimpsest_local.cli"
+      - run: uv run python scripts/test_lanes.py run portable --shard ${{ matrix.shard }}/4
+
+  unit-macos:
+    name: Unit tests (macOS 15)
+    if: always()
+    needs: [portable-macos]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require every macOS portable shard
+        env:
+          PORTABLE_RESULT: ${{ needs.portable-macos.result }}
+        run: test "$PORTABLE_RESULT" = success
+  hub:
+    name: Hub tests, lint, and build
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: hub
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: uv sync --frozen --extra dev
+      - run: uv run python -c "from palimpsest_hub.main import app; assert app.title == 'Palimpsest Hub'"
+      - run: uv run ruff check .
+      - run: uv run ruff format --check .
+      - run: uv run pytest -v
+      - run: uv build
+      - run: python -m zipfile -t dist/*.whl
+      - run: tar -tzf dist/*.tar.gz
+
+  kvm:
+    name: Native KVM stage-1 proof
+    if: vars.PALIMPSEST_KVM_ENABLED == 'true'
+    runs-on: [self-hosted, linux, x64, kvm]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: astral-sh/setup-uv@v6
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - run: test -c /dev/kvm
+      - run: uv sync --frozen --extra dev
+      - name: Create private stage-1 evidence directory
+        run: install -d -m 0700 "$RUNNER_TEMP/stage1-kvm-evidence"
+      - name: Prove retained root, root transition, PID 1 supervision, and rejection matrices
+        timeout-minutes: 45
+        env:
+          PALIMPSEST_REQUIRE_STAGE1_KVM: "1"
+          PALIMPSEST_KVM_EVIDENCE_DIR: ${{ runner.temp }}/stage1-kvm-evidence
+        run: uv run python -m pytest -m stage1_kvm tests/kvm -vv
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: stage1-native-kvm-proof
+          path: ${{ runner.temp }}/stage1-kvm-evidence
+          if-no-files-found: error
+
+  kvm-required:
+    name: Required native KVM proof
+    if: always()
+    needs: [kvm]
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Refuse skipped or failed KVM qualification
+        env:
+          PALIMPSEST_KVM_ENABLED: ${{ vars.PALIMPSEST_KVM_ENABLED }}
+          PALIMPSEST_KVM_RESULT: ${{ needs.kvm.result }}
+        run: |
+          test "$PALIMPSEST_KVM_ENABLED" = "true"
+          test "$PALIMPSEST_KVM_RESULT" = "success"

palimpsest_client-0.2.3/.gitignore

@@ -0,0 +1,11 @@
+.DS_Store
+.venv/
+__pycache__/
+*.pyc
+.pytest_cache/
+.ruff_cache/
+.omc/
+dist/
+build/
+*.egg-info/
+.gstack/

palimpsest_client-0.2.3/.pre-commit-config.yaml

@@ -0,0 +1,9 @@
+repos:
+  - repo: local
+    hooks:
+      - id: architecture
+        name: architecture freshness check
+        entry: python3 scripts/check_architecture.py --staged
+        language: system
+        always_run: true
+        pass_filenames: false