sourceorrery 0.1.1__tar.gz

sourceorrery-0.1.1/Cargo.toml

@@ -0,0 +1,73 @@
+[workspace]
+resolver = "3"
+members = [
+    "crates/sourceorrery-core",
+    "crates/sourceorrery-crypto",
+    "crates/sourceorrery-storage",
+    "crates/sourceorrery-cli",
+    "crates/sourceorrery",
+    "crates/sourceorrery-ffi",
+    "tests/conformance",
+]
+# Native extension crates build with their own toolchains (maturin, napi)
+# and keep their own lock files.
+exclude = ["bindings/python", "bindings/node"]
+
+[workspace.package]
+version = "0.1.1"
+edition = "2024"
+rust-version = "1.88"
+license = "MIT OR Apache-2.0"
+repository = "https://github.com/Netizine/sourceorrery"
+homepage = "https://sourceorrery.ai"
+authors = ["James Melvin <james@melvin.tech>"]
+categories = ["command-line-utilities", "cryptography"]
+keywords = ["secrets", "vault", "keyring", "security", "cli"]
+
+[workspace.dependencies]
+# internal
+sourceorrery-core = { path = "crates/sourceorrery-core", version = "0.1.1" }
+sourceorrery-crypto = { path = "crates/sourceorrery-crypto", version = "0.1.1" }
+sourceorrery-storage = { path = "crates/sourceorrery-storage", version = "0.1.1", default-features = false }
+sourceorrery = { path = "crates/sourceorrery", version = "0.1.1", default-features = false }
+
+# shared
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+thiserror = "2"
+zeroize = { version = "1.9", features = ["derive"] }
+time = { version = "0.3", features = ["serde-well-known", "formatting", "parsing", "macros"] }
+hex = "0.4"
+toml = "1"
+tracing = "0.1"
+tempfile = "3"
+
+[workspace.lints.rust]
+unsafe_code = "forbid"
+missing_debug_implementations = "warn"
+
+[workspace.lints.clippy]
+all = { level = "warn", priority = -1 }
+pedantic = { level = "warn", priority = -1 }
+module_name_repetitions = "allow"
+doc_markdown = "allow"
+# Option<Option<T>> is the documented serde idiom for "unchanged / clear / set".
+option_option = "allow"
+missing_errors_doc = "allow"
+missing_panics_doc = "allow"
+must_use_candidate = "allow"
+struct_excessive_bools = "allow"
+
+[profile.release]
+lto = "thin"
+codegen-units = 1
+strip = "symbols"
+# No `panic = "abort"`: the C ABI (sourceorrery-ffi) catches panics at the
+# boundary and reports SO_STATUS_PANIC, which needs unwinding in release too.
+
+# Argon2id is unusably slow unoptimised; keep the KDF fast in dev/test builds.
+[profile.dev.package.argon2]
+opt-level = 3
+
+[profile.dev.package.blake2]
+opt-level = 3

sourceorrery-0.1.1/PKG-INFO

@@ -0,0 +1,60 @@
+Metadata-Version: 2.4
+Name: sourceorrery
+Version: 0.1.1
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Rust
+Classifier: Topic :: Security
+Classifier: Typing :: Typed
+Requires-Dist: pytest>=8 ; extra == 'test'
+Provides-Extra: test
+Summary: Read secrets from a SourceOrrery vault: secrets belong to the runtime, not the repository
+Keywords: secrets,vault,keyring,security,dotenv
+Home-Page: https://sourceorrery.ai
+Author-email: James Melvin <james@melvin.tech>
+License-Expression: MIT OR Apache-2.0
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown; charset=UTF-8; variant=GFM
+Project-URL: Changelog, https://github.com/Netizine/sourceorrery/blob/main/CHANGELOG.md
+Project-URL: Documentation, https://sourceorrery.ai/sdks/python/
+Project-URL: Homepage, https://sourceorrery.ai
+Project-URL: Repository, https://github.com/Netizine/sourceorrery
+
+# sourceorrery (Python)
+
+Read secrets from a [SourceOrrery](https://sourceorrery.ai) vault.
+Secrets belong to the runtime, not the repository.
+
+```python
+from sourceorrery import SecretReader
+
+with SecretReader("development") as reader, reader.get("database-password") as secret:
+    connect(password=secret.value.expose_text())
+```
+
+The package only reads. The vault is unlocked the way the `sourceorrery`
+CLI unlocks it: OS credential store first, then `SOURCEORRERY_PASSPHRASE`,
+then `SOURCEORRERY_PASSPHRASE_FILE`. Every failure is a typed exception
+with a stable `code` and a `hint` that says what to do.
+
+Documentation: <https://sourceorrery.ai/sdks/python/>. Source:
+`bindings/python` in the repository.
+
+## Building from source
+
+```bash
+pip install maturin
+cd bindings/python
+maturin develop --release        # into the active virtualenv
+```
+
+Tests read the vault created by `scripts/ci/fixture-vault.sh`:
+
+```bash
+eval "$(bash ../../scripts/ci/fixture-vault.sh)"
+python -m pytest
+```
+

sourceorrery-0.1.1/README.md

@@ -0,0 +1,34 @@
+# sourceorrery (Python)
+
+Read secrets from a [SourceOrrery](https://sourceorrery.ai) vault.
+Secrets belong to the runtime, not the repository.
+
+```python
+from sourceorrery import SecretReader
+
+with SecretReader("development") as reader, reader.get("database-password") as secret:
+    connect(password=secret.value.expose_text())
+```
+
+The package only reads. The vault is unlocked the way the `sourceorrery`
+CLI unlocks it: OS credential store first, then `SOURCEORRERY_PASSPHRASE`,
+then `SOURCEORRERY_PASSPHRASE_FILE`. Every failure is a typed exception
+with a stable `code` and a `hint` that says what to do.
+
+Documentation: <https://sourceorrery.ai/sdks/python/>. Source:
+`bindings/python` in the repository.
+
+## Building from source
+
+```bash
+pip install maturin
+cd bindings/python
+maturin develop --release        # into the active virtualenv
+```
+
+Tests read the vault created by `scripts/ci/fixture-vault.sh`:
+
+```bash
+eval "$(bash ../../scripts/ci/fixture-vault.sh)"
+python -m pytest
+```

sourceorrery-0.1.1/bindings/python/.gitignore

@@ -0,0 +1,8 @@
+/target/
+/.venv/
+/dist/
+*.so
+*.pyd
+__pycache__/
+*.egg-info/
+.pytest_cache/