runspec-linux 0.4.0__tar.gz → 0.4.2__tar.gz

{runspec_linux-0.4.0 → runspec_linux-0.4.2}/CHANGELOG.md

@@ -1,5 +1,41 @@
 # runspec-linux Changelog
 
+## [0.4.2] — 2026-06-21
+
+Add 3 runnables for managing Python virtualenvs on a fleet host — thin wrappers
+over the new `runspec-linux-core` 0.3.2 helpers (dependency floor bumped to
+`>=0.3.2`). All three are `autonomy = "confirm"`.
+
+- **`create-venv`** — create a venv (always `--symlinks`) from a *specific*
+  interpreter (`--python` is a browsable `path` arg → pick the remote binary, not
+  the system default) at a free `--dest`. Creates a shared `<dest>/logs` dir mode
+  `2775` and can `--group` (chgrp) the venv to a shared group. Flags:
+  `--system-site-packages`, `--upgrade-deps`, `--clear`, `--prompt`.
+- **`install-into-venv`** — `pip install` named `--package`(s) and/or a local
+  `--project` (a `pyproject.toml` directory or wheel/sdist; `--editable` for
+  `-e`) into a venv. Flags: `--upgrade`/`-U`, `--no-cache-dir`,
+  `--force-reinstall`.
+- **`configure-pip`** — write a `pip.conf` (`--index-url` + `--extra-index-url`,
+  `--trusted-host`, `--cert`, `--timeout`, `--retries`, `--proxy`,
+  `--require-virtualenv`) at `--scope user` (`~/.config/pip/pip.conf`) or
+  `--scope venv` (`<venv>/pip.conf`) for private-PyPI access.
+
+Unlike the package/power runnables, these declare **no `run_as`** in
+`runspec.toml`. The service account that owns a shared venv is chosen per run, so
+each takes a **`--run-as`** argument (and a `--become-method` of `sudo` or `su`)
+and escalates internally — an empty `--run-as` runs as the SSH login user
+(personal venv).
+
+## [0.4.1] — 2026-06-20
+
+Give `list-upgrades` `run_as = "root"`. It refreshes the package index
+(`apt-get update` / `dnf check-update` / …) by default, which needs root — but it
+had no `run_as`, so over the console it ran as the SSH login user and failed with
+`Could not open lock file /var/lib/apt/lists/lock — Permission denied`. It now
+escalates like the rest of the package family (works password-free with the
+`enable-passwordless-sudo` drop-in). `--no-refresh` still skips the index refresh
+and lists from the cache (now just faster, rather than a non-root workaround).
+
 ## [0.4.0] — 2026-06-20
 
 Make the privileged package/power runnables escalate via runspec's `run_as`, and

{runspec_linux-0.4.0 → runspec_linux-0.4.2}/PKG-INFO

@@ -1,9 +1,9 @@
 Metadata-Version: 2.4
 Name: runspec-linux
-Version: 0.4.0
+Version: 0.4.2
 Summary: Linux system admin runnables for runspec
 Requires-Python: >=3.10
-Requires-Dist: runspec-linux-core>=0.3.0
+Requires-Dist: runspec-linux-core>=0.3.2
 Requires-Dist: runspec>=0.27.0
 Provides-Extra: dev
 Requires-Dist: mypy; extra == 'dev'

{runspec_linux-0.4.0 → runspec_linux-0.4.2}/pyproject.toml

@@ -4,12 +4,12 @@ build-backend = "hatchling.build"
 
 [project]
 name = "runspec-linux"
-version = "0.4.0"
+version = "0.4.2"
 requires-python = ">=3.10"
 description = "Linux system admin runnables for runspec"
 dependencies = [
     "runspec>=0.27.0",
-    "runspec-linux-core>=0.3.0",
+    "runspec-linux-core>=0.3.2",
 ]
 
 [project.scripts]
@@ -40,6 +40,9 @@ install-package   = "runspec_linux.packages:main_install_package"
 remove-package    = "runspec_linux.packages:main_remove_package"
 reboot-host       = "runspec_linux.power:main_reboot_host"
 enable-passwordless-sudo = "runspec_linux.sudoers:main_enable_passwordless_sudo"
+create-venv       = "runspec_linux.venvs:main_create_venv"
+install-into-venv = "runspec_linux.venvs:main_install_into_venv"
+configure-pip     = "runspec_linux.venvs:main_configure_pip"
 nc-command        = "runspec_linux.nc_command:main"
 
 [project.optional-dependencies]

{runspec_linux-0.4.0 → runspec_linux-0.4.2}/runspec_linux/__init__.py

@@ -12,11 +12,14 @@ from runspec_linux_core import (
     check_memory,
     check_port,
     check_service,
+    configure_pip,
     container_logs,
+    create_venv,
     detect_manager,
     disk_usage,
     enable_passwordless_sudo,
     find_large_files,
+    install_into_venv,
     install_package,
     journalctl,
     last_logins,
@@ -44,11 +47,14 @@ __all__ = [
     "check_memory",
     "check_port",
     "check_service",
+    "configure_pip",
     "container_logs",
+    "create_venv",
     "detect_manager",
     "disk_usage",
     "enable_passwordless_sudo",
     "find_large_files",
+    "install_into_venv",
     "install_package",
     "journalctl",
     "last_logins",

{runspec_linux-0.4.0 → runspec_linux-0.4.2}/runspec_linux/runspec.toml

@@ -324,10 +324,11 @@ serve       = ["local"]
 description = "List packages with an available upgrade (refreshes the package index first)"
 autonomy    = "autonomous"
 output      = "json"
+run_as      = "root"
 
 [list-upgrades.args.no-refresh]
 type        = "flag"
-description = "Read the cached package index instead of refreshing it first (no root needed)"
+description = "Skip refreshing the package index — list from the cached index (faster)"
 default     = false
 
 [upgrade-packages]
@@ -437,3 +438,190 @@ default     = 0.3
 type        = "float"
 description = "Per-chunk socket read timeout in seconds"
 default     = 0.1
+
+# ── Python venvs ──────────────────────────────────────────────────────────────
+
+# These deliberately declare NO `run_as` key. The service account that owns a
+# shared venv is chosen per invocation, so each runnable takes a `run-as`
+# argument and escalates internally (`sudo -n -u <user>`, or `su` via
+# `become-method`). An empty `run-as` runs as the SSH login user (personal venv).
+
+[create-venv]
+serve       = ["local"]
+description = "Create a Python virtualenv (always --symlinks) from a specific interpreter, optionally as a service account, with a shared 2775 logs/ dir"
+autonomy    = "confirm"
+output      = "json"
+
+[create-venv.args.python]
+type        = "path"
+description = "Path to the Python interpreter to build the venv from (browse to a real binary — not the system default)"
+
+[create-venv.args.dest]
+type        = "path"
+short       = "-d"
+description = "Full path of the venv to create (name and location are free)"
+
+[create-venv.args.run-as]
+type        = "str"
+short       = "-u"
+description = "Service account to create the venv as (escalates via sudo/su); empty = the SSH login user"
+required    = false
+
+[create-venv.args.become-method]
+type        = "choice"
+options     = ["sudo", "su"]
+default     = "sudo"
+description = "How to escalate to run-as: sudo (passwordless, -n) or su"
+
+[create-venv.args.group]
+type        = "str"
+short       = "-g"
+description = "Optional shared group to chgrp the venv to (e.g. consoles), so every connected console can read/write"
+required    = false
+
+[create-venv.args.system-site-packages]
+type        = "flag"
+description = "Give the venv access to the system site-packages"
+default     = false
+
+[create-venv.args.upgrade-deps]
+type        = "flag"
+description = "Upgrade pip/setuptools to the latest in the new venv (--upgrade-deps)"
+default     = false
+
+[create-venv.args.clear]
+type        = "flag"
+description = "Delete the contents of the venv directory if it already exists (--clear)"
+default     = false
+
+[create-venv.args.prompt]
+type        = "str"
+short       = "-p"
+description = "Prompt prefix shown when the venv is activated (--prompt)"
+required    = false
+
+[install-into-venv]
+serve       = ["local"]
+description = "pip install named packages and/or a local project (pyproject dir or wheel/sdist) into an existing venv"
+autonomy    = "confirm"
+output      = "json"
+
+[install-into-venv.args.venv]
+type        = "path"
+short       = "-v"
+description = "Path to the venv to install into (its bundled python runs pip)"
+
+[install-into-venv.args.package]
+type        = "str"
+short       = "-p"
+description = "Package spec(s) to install (space-separated for several)"
+required    = false
+
+[install-into-venv.args.project]
+type        = "path"
+description = "Path to a local project to install — a directory with pyproject.toml, or a wheel/sdist"
+required    = false
+
+[install-into-venv.args.editable]
+type        = "flag"
+short       = "-e"
+description = "Install the project in editable mode (pip install -e); requires --project"
+default     = false
+
+[install-into-venv.args.upgrade]
+type        = "flag"
+short       = "-U"
+description = "Upgrade packages to the newest available version (pip install -U)"
+default     = false
+
+[install-into-venv.args.no-cache-dir]
+type        = "flag"
+description = "Disable the pip cache for this install (--no-cache-dir)"
+default     = false
+
+[install-into-venv.args.force-reinstall]
+type        = "flag"
+description = "Reinstall packages even if already up to date (--force-reinstall)"
+default     = false
+
+[install-into-venv.args.run-as]
+type        = "str"
+short       = "-u"
+description = "Service account that owns the venv (escalates via sudo/su); empty = the SSH login user"
+required    = false
+
+[install-into-venv.args.become-method]
+type        = "choice"
+options     = ["sudo", "su"]
+default     = "sudo"
+description = "How to escalate to run-as: sudo (passwordless, -n) or su"
+
+[configure-pip]
+serve       = ["local"]
+description = "Write a pip.conf (index-url and friends) at user or venv scope for private-PyPI access"
+autonomy    = "confirm"
+output      = "json"
+
+[configure-pip.args.index-url]
+type        = "str"
+short       = "-i"
+description = "Primary package index URL (index-url)"
+
+[configure-pip.args.extra-index-url]
+type        = "str"
+description = "Additional package index URL (extra-index-url)"
+required    = false
+
+[configure-pip.args.trusted-host]
+type        = "str"
+description = "Host to trust without TLS verification (trusted-host)"
+required    = false
+
+[configure-pip.args.cert]
+type        = "str"
+description = "Path to a CA bundle to verify the index's TLS certificate (cert)"
+required    = false
+
+[configure-pip.args.timeout]
+type        = "int"
+description = "Socket timeout in seconds (timeout)"
+required    = false
+
+[configure-pip.args.retries]
+type        = "int"
+description = "Number of retries for a failed connection (retries)"
+required    = false
+
+[configure-pip.args.proxy]
+type        = "str"
+description = "Proxy URL in [user:passwd@]proxy.server:port form (proxy)"
+required    = false
+
+[configure-pip.args.require-virtualenv]
+type        = "flag"
+description = "Refuse to install outside a virtualenv and silence the pip-version check (require-virtualenv + disable-pip-version-check)"
+default     = false
+
+[configure-pip.args.scope]
+type        = "choice"
+options     = ["user", "venv"]
+default     = "user"
+short       = "-s"
+description = "Where to write pip.conf: user (~/.config/pip/pip.conf) or venv (<venv>/pip.conf)"
+
+[configure-pip.args.venv]
+type        = "path"
+description = "Venv path for --scope venv (the file is written to <venv>/pip.conf)"
+required    = false
+
+[configure-pip.args.run-as]
+type        = "str"
+short       = "-u"
+description = "User who owns the target file (escalates via sudo/su); empty = the SSH login user"
+required    = false
+
+[configure-pip.args.become-method]
+type        = "choice"
+options     = ["sudo", "su"]
+default     = "sudo"
+description = "How to escalate to run-as: sudo (passwordless, -n) or su"

runspec_linux-0.4.2/runspec_linux/venvs.py

@@ -0,0 +1,81 @@
+import json
+import sys
+
+import runspec as rs
+from runspec_linux_core import configure_pip, create_venv, install_into_venv
+from runspec_linux_core.errors import CommandError
+
+
+def main_create_venv() -> None:
+    spec = rs.parse("create-venv")
+    try:
+        result = create_venv(
+            str(spec.python.value),
+            str(spec.dest.value),
+            run_as=spec.run_as.value or None,
+            become_method=spec.become_method.value,
+            group=spec.group.value or None,
+            system_site_packages=spec.system_site_packages.value,
+            upgrade_deps=spec.upgrade_deps.value,
+            clear=spec.clear.value,
+            prompt=spec.prompt.value or None,
+        )
+        print(json.dumps(result))
+    except CommandError as e:
+        print(json.dumps({"dest": str(spec.dest.value), "created": False, "error": str(e)}))
+        sys.exit(1)
+    except Exception as e:
+        # Includes ValueError (non-executable interpreter / bad name).
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main_install_into_venv() -> None:
+    spec = rs.parse("install-into-venv")
+    try:
+        result = install_into_venv(
+            str(spec.venv.value),
+            spec.package.value or "",
+            project=str(spec.project.value) if spec.project.value else None,
+            editable=spec.editable.value,
+            upgrade=spec.upgrade.value,
+            no_cache_dir=spec.no_cache_dir.value,
+            force_reinstall=spec.force_reinstall.value,
+            run_as=spec.run_as.value or None,
+            become_method=spec.become_method.value,
+        )
+        print(json.dumps(result))
+    except CommandError as e:
+        print(json.dumps({"venv": str(spec.venv.value), "installed": False, "error": str(e)}))
+        sys.exit(1)
+    except Exception as e:
+        # Includes ValueError (bad package name / missing venv / nothing to install).
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)
+
+
+def main_configure_pip() -> None:
+    spec = rs.parse("configure-pip")
+    try:
+        result = configure_pip(
+            spec.index_url.value,
+            extra_index_url=spec.extra_index_url.value or None,
+            trusted_host=spec.trusted_host.value or None,
+            cert=spec.cert.value or None,
+            timeout=spec.timeout.value,
+            retries=spec.retries.value,
+            proxy=spec.proxy.value or None,
+            require_virtualenv=spec.require_virtualenv.value,
+            scope=spec.scope.value,
+            venv=str(spec.venv.value) if spec.venv.value else None,
+            run_as=spec.run_as.value or None,
+            become_method=spec.become_method.value,
+        )
+        print(json.dumps(result))
+    except CommandError as e:
+        print(json.dumps({"configured": False, "error": str(e)}))
+        sys.exit(1)
+    except Exception as e:
+        # Includes ValueError (bad scope / missing venv path).
+        print(json.dumps({"error": str(e)}))
+        sys.exit(1)