quipu-crypto 0.1.0__tar.gz

quipu_crypto-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,42 @@
+name: CI
+
+# Se activa cuando el proyecto pase a git/GitHub. Mientras tanto, el equivalente
+# local es `scripts/audit.sh`.
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+  schedule:
+    # Auditoría semanal de dependencias aunque no haya cambios (nuevas CVEs).
+    - cron: "0 6 * * 1"
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  test:
+    name: test + clippy
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: clippy
+      - uses: Swatinem/rust-cache@v2
+      - name: Build
+        run: cargo build --all-targets
+      - name: Tests
+        run: cargo test --all-targets
+      - name: Clippy (deny warnings)
+        run: cargo clippy --all-targets -- -D warnings
+
+  audit:
+    name: cargo-audit (RustSec)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install cargo-audit
+        run: cargo install cargo-audit --locked
+      - name: Audit dependencies
+        run: cargo audit

quipu_crypto-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,72 @@
+name: release-wheels
+
+# Construye ruedas Python (abi3, una por plataforma sirve para CPython 3.9+) y el
+# sdist. En un tag "v*" además publica en PyPI. También ejecutable a mano.
+on:
+  push:
+    tags: ["v*"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  wheels:
+    name: wheels-${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.x"
+      - name: Build wheels (maturin, feature python)
+        uses: PyO3/maturin-action@v1
+        with:
+          command: build
+          args: --release --features python --out dist
+          sccache: "true"
+          manylinux: auto
+      - uses: actions/upload-artifact@v4
+        with:
+          name: wheels-${{ matrix.os }}
+          path: dist
+
+  sdist:
+    name: sdist
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Build sdist
+        uses: PyO3/maturin-action@v1
+        with:
+          command: sdist
+          args: --out dist
+      - uses: actions/upload-artifact@v4
+        with:
+          name: sdist
+          path: dist
+
+  publish:
+    name: publish to PyPI
+    needs: [wheels, sdist]
+    runs-on: ubuntu-latest
+    # Solo publica al hacer un tag v*.
+    if: startsWith(github.ref, 'refs/tags/v')
+    environment: pypi
+    permissions:
+      id-token: write   # PyPI trusted publishing (OIDC), sin token en secretos
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          path: dist
+          merge-multiple: true
+      # Acción oficial de PyPA: soporta trusted publishing (OIDC) de forma nativa,
+      # sin necesidad de token. Sube todo lo que haya en dist/ (ruedas + sdist).
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          skip-existing: true

quipu_crypto-0.1.0/.gitignore

@@ -0,0 +1,36 @@
+# --- Build artifacts ---
+/target
+fuzz/target
+fuzz/corpus
+fuzz/artifacts
+fuzz/Cargo.lock
+
+# --- Python ---
+/venv
+__pycache__/
+*.pyc
+*.so
+
+# --- SECRETOS: nunca subir claves del servidor OPRF ni semillas ---
+*.bin
+oprf_seed*
+*.key
+*.pem
+
+# --- Local del agente / privado ---
+/.claude
+/.remember
+/conversaciones
+
+# --- Borradores de financiación (estrategia/datos personales, NO públicos) ---
+GRANT_NLNET.md
+OTF_RED_TEAM_LAB.md
+
+# --- Artefactos generados por ejemplos ---
+quickstart_glifos.png
+dist/
+
+# --- SO ---
+.DS_Store
+
+# NOTA: Cargo.lock SÍ se versiona (builds reproducibles, higiene de supply-chain).