runspec-webops-core 0.3.0__tar.gz → 0.3.2__tar.gz

{runspec_webops_core-0.3.0 → runspec_webops_core-0.3.2}/.gitignore

@@ -25,6 +25,8 @@ coverage.xml
 # Node
 node_modules/
 dist/
+# runspec manifest output (written at npm pack time)
+runspec-files.json
 *.js.map
 .npm
 
@@ -59,3 +61,6 @@ chainlit-docs/
 
 # Stray committed test venv (removed from tracking)
 .venv-test/
+
+# Private gitleaks rules (see .gitleaks.toml)
+.gitleaks.local.toml

{runspec_webops_core-0.3.0 → runspec_webops_core-0.3.2}/CHANGELOG.md

@@ -1,5 +1,20 @@
 # runspec-webops-core Changelog
 
+## [0.3.2] — 2026-11-12
+
+### Fixed
+
+- `connect_peer` (behind `cert-check`, `cert-chain` and `tls-info`) failed on
+  Python 3.13+ with `'bytes' object has no attribute 'public_bytes'`: the public
+  `SSLSocket.get_unverified_chain()` returns DER bytes, not certificate objects.
+  Both shapes are read now.
+
+## [0.3.1] — 2026-11-05
+
+### Fixed
+
+- The PyPI page shows the README (`pyproject.toml` didn't declare it).
+
 ## [0.3.0] — 2026-09-01
 
 ### Added — custom CA bundle for TLS verification

runspec_webops_core-0.3.2/PKG-INFO

@@ -0,0 +1,56 @@
+Metadata-Version: 2.5
+Name: runspec-webops-core
+Version: 0.3.2
+Summary: Pure-Python HTTPS/TLS certificate + web-endpoint helpers — the importable core behind the runspec web runnables (no runspec dependency, no runnables)
+Requires-Python: >=3.10
+Provides-Extra: dev
+Requires-Dist: mypy; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: pyyaml>=6.0; extra == 'dev'
+Requires-Dist: ruff==0.15.20; extra == 'dev'
+Requires-Dist: types-pyyaml; extra == 'dev'
+Provides-Extra: yaml
+Requires-Dist: pyyaml>=6.0; extra == 'yaml'
+Description-Content-Type: text/markdown
+
+# runspec-webops-core
+
+Pure-Python HTTPS/TLS certificate + web-endpoint helpers — the importable logic
+core behind the cross-platform web runnables in
+[`runspec-linux`](https://pypi.org/project/runspec-linux/) and [`runspec-windows`](https://pypi.org/project/runspec-windows/).
+
+Stdlib only (`ssl` / `socket` / `http.client`) — **no `runspec` dependency, no
+`runspec.toml`, and no entry points**, so installing it exposes the helper
+functions for import without surfacing any runnables (it is invisible to
+`runspec local` / `runspec serve` discovery).
+
+```python
+from runspec_webops_core import connect_peer, leaf_report, probe, resolve
+
+peer = connect_peer("example.com", 443, 10)
+print(leaf_report(peer, warn_days=30))        # days-to-expiry, issuer, SANs, trust
+print(probe("https://example.com", 10))       # status, timing, redirect target
+print(resolve("example.com", want_reverse=True))
+```
+
+| Function | What it does |
+|---|---|
+| `connect_peer` / `leaf_report` / `chain_report` | TLS certificate inspection — expiry, issuer, SANs, fingerprint, full chain, trust result |
+| `probe` / `classify` | Single HTTP(S) request — status, response time, redirect target |
+| `fetch_headers` | Response headers + a security-header report (HSTS, CSP, …) |
+| `trace_redirects` | Walk the redirect chain, hop by hop, with loop detection |
+| `resolve` | Forward (A/AAAA) and reverse (PTR) DNS lookups |
+| `load_document` / `summarize_spec` / `describe_operation` | Read an OpenAPI/Swagger spec (URL or file) and condense its shape — operations, params, request/response schemas — to bounded JSON |
+
+OpenAPI/Swagger specs in JSON parse with the stdlib; YAML needs the optional
+`yaml` extra (`pip install runspec-webops-core[yaml]`).
+
+Each function returns plain data and *raises* on failure (`ConnectError`,
+`ResolveError` — both subclasses of `WebopsCoreError`).
+
+## Corporate wrapping
+
+Depend on `runspec-webops-core` alone, import the helpers, and ship your own
+private package with its own `runspec.toml` that bakes in corporate defaults
+(proxies, allowed hosts, redaction) as plain params — only your wrapped
+runnables surface in the venv, the generic published code stays clean.

{runspec_webops_core-0.3.0 → runspec_webops_core-0.3.2}/README.md

@@ -2,7 +2,7 @@
 
 Pure-Python HTTPS/TLS certificate + web-endpoint helpers — the importable logic
 core behind the cross-platform web runnables in
-[`runspec-linux`](../runspec-linux) and [`runspec-windows`](../runspec-windows).
+[`runspec-linux`](https://pypi.org/project/runspec-linux/) and [`runspec-windows`](https://pypi.org/project/runspec-windows/).
 
 Stdlib only (`ssl` / `socket` / `http.client`) — **no `runspec` dependency, no
 `runspec.toml`, and no entry points**, so installing it exposes the helper

{runspec_webops_core-0.3.0 → runspec_webops_core-0.3.2}/pyproject.toml

@@ -4,9 +4,10 @@ build-backend = "hatchling.build"
 
 [project]
 name = "runspec-webops-core"
-version = "0.3.0"
+version = "0.3.2"
 requires-python = ">=3.10"
 description = "Pure-Python HTTPS/TLS certificate + web-endpoint helpers — the importable core behind the runspec web runnables (no runspec dependency, no runnables)"
+readme = "README.md"
 dependencies = []
 
 [project.optional-dependencies]

{runspec_webops_core-0.3.0 → runspec_webops_core-0.3.2}/runspec_webops_core/tls.py

@@ -201,8 +201,8 @@ def client_ssl_context(insecure: bool = False, ca_bundle: str | None = None) ->
 def _peer_chain(ssock: ssl.SSLSocket) -> list[CertInfo]:
     """Return the server-presented certificate chain (leaf first).
 
-    Prefers the public ``SSLSocket.get_unverified_chain()`` (Python 3.13+),
-    falls back to the underlying ``_sslobj`` method (3.10–3.12), and finally to
+    Prefers the public ``SSLSocket.get_unverified_chain()`` (Python 3.13+,
+    which returns DER bytes), falls back to the underlying ``_sslobj`` method (3.10–3.12), and finally to
     the leaf-only certificate via ``getpeercert`` when neither is available.
     """
     getter = getattr(ssock, "get_unverified_chain", None)
@@ -218,8 +218,14 @@ def _peer_chain(ssock: ssl.SSLSocket) -> list[CertInfo]:
         if raw:
             out: list[CertInfo] = []
             for cert in raw:
-                der = ssl.PEM_cert_to_DER_cert(cert.public_bytes())
-                out.append(cert_info_from_ssl(cert.get_info(), der))
+                if isinstance(cert, (bytes, bytearray)):
+                    # Python 3.13+ public API: DER-encoded bytes.
+                    der = bytes(cert)
+                    out.append(cert_info_from_ssl(_decode_der(der), der))
+                else:
+                    # 3.10–3.12 ``_sslobj`` method: ``_ssl.Certificate`` objects.
+                    der = ssl.PEM_cert_to_DER_cert(cert.public_bytes())
+                    out.append(cert_info_from_ssl(cert.get_info(), der))
             return out
 
     # Fallback: only the leaf is recoverable on this interpreter.

{runspec_webops_core-0.3.0 → runspec_webops_core-0.3.2}/tests/test_tls.py

@@ -132,3 +132,30 @@ def test_chain_report_marks_root() -> None:
     rep = chain_report(peer, now=NOW)
     assert [link["self_signed"] for link in rep] == [False, True]
     assert rep[0]["days_remaining"] == 30
+
+
+def _a_der_cert() -> bytes:
+    """Any real DER certificate: the first system CA (no network needed)."""
+    certs = ssl.create_default_context().get_ca_certs(binary_form=True)
+    if not certs:
+        pytest.skip("no system CA certificates to use as a sample")
+    return certs[0]
+
+
+def test_peer_chain_reads_der_bytes_from_public_api() -> None:
+    # Python 3.13+ ``SSLSocket.get_unverified_chain()`` returns DER bytes, not
+    # ``_ssl.Certificate`` objects; this used to fail with
+    # "'bytes' object has no attribute 'public_bytes'".
+    from runspec_webops_core.tls import _peer_chain
+
+    der = _a_der_cert()
+
+    class FakeSocket:
+        def get_unverified_chain(self) -> list[bytes]:
+            return [der, der]
+
+    chain = _peer_chain(FakeSocket())  # type: ignore[arg-type]
+    assert len(chain) == 2
+    assert chain[0].subject
+    assert chain[0].valid_to
+    assert chain[0].fingerprint_sha256

runspec_webops_core-0.3.0/PKG-INFO

@@ -1,13 +0,0 @@
-Metadata-Version: 2.5
-Name: runspec-webops-core
-Version: 0.3.0
-Summary: Pure-Python HTTPS/TLS certificate + web-endpoint helpers — the importable core behind the runspec web runnables (no runspec dependency, no runnables)
-Requires-Python: >=3.10
-Provides-Extra: dev
-Requires-Dist: mypy; extra == 'dev'
-Requires-Dist: pytest>=8.0; extra == 'dev'
-Requires-Dist: pyyaml>=6.0; extra == 'dev'
-Requires-Dist: ruff==0.15.20; extra == 'dev'
-Requires-Dist: types-pyyaml; extra == 'dev'
-Provides-Extra: yaml
-Requires-Dist: pyyaml>=6.0; extra == 'yaml'