specters 2.0.0__tar.gz

specters-2.0.0/.cargo/config.toml

@@ -0,0 +1,21 @@
+# Cargo configuration for specter
+# Uses prebuilt BoringSSL libraries from lib/boringssl/
+
+# Note: Environment variables for boring-sys are set via:
+# - Local dev: source scripts/env.sh
+# - CI: Set BORING_BSSL_PATH and BORING_BSSL_INCLUDE_PATH in workflow
+
+[build]
+# Uncomment to use prebuilt BoringSSL by default
+# rustflags = []
+
+[env]
+# These are relative to the manifest directory (where Cargo.toml lives)
+# Unfortunately Cargo doesn't support relative paths in [env], so we use scripts instead
+
+# Target-specific linker settings for cross-compilation
+[target.aarch64-unknown-linux-gnu]
+linker = "aarch64-linux-gnu-gcc"
+
+[target.x86_64-unknown-linux-musl]
+linker = "x86_64-linux-musl-gcc"

specters-2.0.0/.config/nextest.toml

@@ -0,0 +1,34 @@
+[profile.default]
+# Run tests in parallel with optimal thread count
+test-threads = "num-cpus"
+
+# Show test output for failures
+failure-output = "immediate-final"
+success-output = "never"
+
+# Retry flaky tests once
+retries = 1
+
+# Timeout settings
+slow-timeout = { period = "60s", terminate-after = 2 }
+
+[profile.ci]
+# CI profile with stricter settings
+retries = 0
+failure-output = "final"
+success-output = "never"
+
+# Fail fast in CI
+fail-fast = true
+
+[profile.pre-push]
+# Pre-push profile - balance between speed and thoroughness
+retries = 0
+failure-output = "immediate"
+success-output = "never"
+
+# Don't fail fast to see all failures
+fail-fast = false
+
+# Shorter timeout for pre-push
+slow-timeout = { period = "30s", terminate-after = 1 }

specters-2.0.0/.github/scripts/zig-cc-aarch64-linux-gnu

@@ -0,0 +1,19 @@
+#!/bin/bash
+# Wrapper script for zig cc that:
+# 1. Uses the correct Zig target (aarch64-linux-gnu)
+# 2. Strips conflicting --target=aarch64-unknown-linux-gnu flags from cmake/boring-sys
+# 3. Handles both compilation and assembly
+
+args=()
+for arg in "$@"; do
+    case "$arg" in
+        --target=aarch64-unknown-linux-gnu) ;; # Strip Rust-style target
+        --target=*-unknown-linux-*) ;; # Strip any Rust-style Linux target
+        -target) ;; # Skip standalone -target (zig uses different format)
+        aarch64-unknown-linux-gnu) ;; # Skip if target is passed as separate arg
+        cc) ;; # Skip stray 'cc' argument passed by Cargo/build scripts
+        *) args+=("$arg") ;;
+    esac
+done
+
+exec zig cc -target aarch64-linux-gnu "${args[@]}"

specters-2.0.0/.github/scripts/zig-cc-x86_64-linux-musl

@@ -0,0 +1,19 @@
+#!/bin/bash
+# Wrapper script for zig cc that:
+# 1. Uses the correct Zig target (x86_64-linux-musl)
+# 2. Strips conflicting --target=x86_64-unknown-linux-musl flags from cmake/boring-sys
+# 3. Handles both compilation and assembly
+
+args=()
+for arg in "$@"; do
+    case "$arg" in
+        --target=x86_64-unknown-linux-musl) ;; # Strip Rust-style target
+        --target=*-unknown-linux-*) ;; # Strip any Rust-style Linux target
+        -target) ;; # Skip standalone -target (zig uses different format)
+        x86_64-unknown-linux-musl) ;; # Skip if target is passed as separate arg
+        cc) ;; # Skip stray 'cc' argument passed by Cargo/build scripts
+        *) args+=("$arg") ;;
+    esac
+done
+
+exec zig cc -target x86_64-linux-musl "${args[@]}"

specters-2.0.0/.github/scripts/zig-cxx-aarch64-linux-gnu

@@ -0,0 +1,18 @@
+#!/bin/bash
+# Wrapper script for zig c++ that:
+# 1. Uses the correct Zig target (aarch64-linux-gnu)
+# 2. Strips conflicting --target=aarch64-unknown-linux-gnu flags from cmake/boring-sys
+# 3. Handles both compilation and assembly
+
+args=()
+for arg in "$@"; do
+    case "$arg" in
+        --target=aarch64-unknown-linux-gnu) ;; # Strip Rust-style target
+        --target=*-unknown-linux-*) ;; # Strip any Rust-style Linux target
+        -target) ;; # Skip standalone -target (zig uses different format)
+        aarch64-unknown-linux-gnu) ;; # Skip if target is passed as separate arg
+        *) args+=("$arg") ;;
+    esac
+done
+
+exec zig c++ -target aarch64-linux-gnu "${args[@]}"

specters-2.0.0/.github/scripts/zig-cxx-x86_64-linux-musl

@@ -0,0 +1,18 @@
+#!/bin/bash
+# Wrapper script for zig c++ that:
+# 1. Uses the correct Zig target (x86_64-linux-musl)
+# 2. Strips conflicting --target=x86_64-unknown-linux-musl flags from cmake/boring-sys
+# 3. Handles both compilation and assembly
+
+args=()
+for arg in "$@"; do
+    case "$arg" in
+        --target=x86_64-unknown-linux-musl) ;; # Strip Rust-style target
+        --target=*-unknown-linux-*) ;; # Strip any Rust-style Linux target
+        -target) ;; # Skip standalone -target (zig uses different format)
+        x86_64-unknown-linux-musl) ;; # Skip if target is passed as separate arg
+        *) args+=("$arg") ;;
+    esac
+done
+
+exec zig c++ -target x86_64-linux-musl "${args[@]}"

specters-2.0.0/.github/workflows/boringssl-release.yml

@@ -0,0 +1,94 @@
+name: BoringSSL Prebuilt Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Version tag (e.g., boringssl-prebuilt-v1)'
+        required: true
+        default: 'boringssl-prebuilt-v1'
+
+permissions:
+  contents: write
+
+jobs:
+  package:
+    name: Package prebuilt BoringSSL
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Verify libraries exist
+        run: |
+          echo "Checking for prebuilt libraries..."
+          ls -la lib/boringssl/
+          
+          # Verify all expected targets
+          for target in aarch64-apple-darwin x86_64-apple-darwin \
+                        x86_64-unknown-linux-gnu x86_64-unknown-linux-musl \
+                        aarch64-unknown-linux-gnu \
+                        x86_64-pc-windows-msvc aarch64-pc-windows-msvc; do
+            if [[ -d "lib/boringssl/$target" ]]; then
+              echo "✓ $target"
+              ls -lh "lib/boringssl/$target/"
+            else
+              echo "✗ $target (missing)"
+            fi
+          done
+
+      - name: Package archives
+        run: |
+          cd lib/boringssl
+          
+          # Create per-target archives
+          for target in */; do
+            target=${target%/}
+            [[ "$target" == "include" ]] && continue
+            
+            echo "Packaging $target..."
+            tar -czf "boringssl-${target}.tar.gz" include/ "$target/"
+            
+            # Also create zip for Windows
+            if [[ "$target" == *windows* ]]; then
+              zip -r "boringssl-${target}.zip" include/ "$target/"
+            fi
+          done
+          
+          # Create all-in-one archive
+          tar -czf boringssl-all-targets.tar.gz include/ */
+          
+          ls -lh *.tar.gz *.zip 2>/dev/null || true
+
+      - name: Create Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ inputs.version }}
+          name: BoringSSL Prebuilt Libraries ${{ inputs.version }}
+          body: |
+            Prebuilt BoringSSL static libraries for use with `boring-sys` crate.
+            
+            ## Targets
+            - `aarch64-apple-darwin` - macOS ARM64 (Apple Silicon)
+            - `x86_64-apple-darwin` - macOS x86_64
+            - `x86_64-unknown-linux-gnu` - Linux x86_64 (glibc)
+            - `x86_64-unknown-linux-musl` - Linux x86_64 (musl)
+            - `aarch64-unknown-linux-gnu` - Linux ARM64 (glibc)
+            - `x86_64-pc-windows-msvc` - Windows x86_64
+            - `aarch64-pc-windows-msvc` - Windows ARM64
+            
+            ## Usage
+            
+            Download the archive for your target and set environment variables:
+            
+            ```bash
+            export BORING_BSSL_PATH=/path/to/boringssl/<target>
+            export BORING_BSSL_INCLUDE_PATH=/path/to/boringssl/include
+            cargo build
+            ```
+            
+            Or download `boringssl-all-targets.tar.gz` for all platforms.
+          files: |
+            lib/boringssl/*.tar.gz
+            lib/boringssl/*.zip
+          draft: false
+          prerelease: false

specters-2.0.0/.github/workflows/ci.yml

@@ -0,0 +1,126 @@
+name: Specter CI
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+
+env:
+  CARGO_TERM_COLOR: always
+  RUST_BACKTRACE: 1
+  CARGO_INCREMENTAL: 0
+  SCCACHE_GHA_ENABLED: "true"
+
+jobs:
+  test:
+    name: Test (macOS)
+    runs-on: macos-14
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+
+      - uses: mozilla-actions/sccache-action@v0.0.9
+      - run: echo "RUSTC_WRAPPER=sccache" >> $GITHUB_ENV
+
+      - uses: actions/cache@v4
+        with:
+          path: |
+            ~/.cargo/registry
+            ~/.cargo/git
+          key: ${{ runner.os }}-cargo-${{ hashFiles('**/Cargo.lock') }}
+
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-nextest
+
+      - name: Configure prebuilt BoringSSL
+        run: |
+          if [[ "$(uname -m)" == "arm64" ]]; then
+            echo "BORING_BSSL_PATH=${{ github.workspace }}/lib/boringssl/aarch64-apple-darwin" >> $GITHUB_ENV
+          else
+            echo "BORING_BSSL_PATH=${{ github.workspace }}/lib/boringssl/x86_64-apple-darwin" >> $GITHUB_ENV
+          fi
+
+      - run: cargo fmt -- --check
+      - run: cargo nextest run --all-features --profile ci
+
+      - uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: nextest-results
+          path: target/nextest/ci/junit.xml
+          if-no-files-found: ignore
+
+      - name: Run examples
+        uses: nick-fields/retry@v3
+        with:
+          timeout_minutes: 3
+          max_attempts: 3
+          retry_wait_seconds: 10
+          command: |
+            cargo run --example fingerprint_validation
+            cargo run --example protocol_test
+
+  build-linux:
+    name: Build Linux (${{ matrix.target }})
+    runs-on: macos-14
+    strategy:
+      matrix:
+        target:
+          - aarch64-unknown-linux-gnu
+          - x86_64-unknown-linux-gnu
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: just,cargo-zigbuild
+
+      - name: Install zig
+        run: brew install zig
+
+      - name: Build
+        run: |
+          chmod +x scripts/zig-cc-* scripts/zig-cxx-*
+          just zigbuild ${{ matrix.target }}
+
+  build-windows:
+    name: Build Windows (${{ matrix.target }})
+    runs-on: macos-14
+    strategy:
+      matrix:
+        target:
+          - x86_64-pc-windows-msvc
+          - aarch64-pc-windows-msvc
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Install LLVM
+        run: brew install llvm
+
+      - name: Add LLVM to PATH
+        run: echo "$(brew --prefix llvm)/bin" >> "$GITHUB_PATH"
+
+      - uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-xwin
+
+      - name: Build
+        run: cargo xwin build --release --target ${{ matrix.target }} --lib
+        env:
+          BORING_BSSL_PATH: ${{ github.workspace }}/lib/boringssl/${{ matrix.target }}

specters-2.0.0/.github/workflows/node-release.yml

@@ -0,0 +1,146 @@
+name: Node Release
+
+on:
+  push:
+    tags: ['v*']
+  pull_request:
+    paths:
+      - 'bindings/node/**'
+      - '.github/workflows/node-release.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    strategy:
+      fail-fast: false
+      matrix:
+        settings:
+          - host: macos-14
+            target: aarch64-apple-darwin
+            build: npm run build
+          - host: macos-14
+            target: x86_64-apple-darwin
+            build: npm run build -- --target x86_64-apple-darwin
+    name: Build ${{ matrix.settings.target }}
+    runs-on: ${{ matrix.settings.host }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: bindings/node/package.json
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.settings.target }}
+
+      - name: Install dependencies
+        run: |
+          cd bindings/node
+          npm install
+
+      - name: Build
+        run: |
+          cd bindings/node
+          ${{ matrix.settings.build }}
+        env:
+          MACOSX_DEPLOYMENT_TARGET: '10.13'
+          # Use prebuilt BoringSSL from repo
+          BORING_BSSL_PATH: ${{ github.workspace }}/lib/boringssl/${{ matrix.settings.target }}
+          BORING_BSSL_INCLUDE_PATH: ${{ github.workspace }}/lib/boringssl/include
+
+      - name: Upload artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: bindings-${{ matrix.settings.target }}
+          path: bindings/node/*.node
+          if-no-files-found: error
+
+  test:
+    name: Test bindings
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: bindings/node/package.json
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Install dependencies
+        run: |
+          cd bindings/node
+          npm install
+
+      - name: Build
+        run: |
+          cd bindings/node
+          npm run build:debug
+        env:
+          MACOSX_DEPLOYMENT_TARGET: '10.13'
+          # Use prebuilt BoringSSL from repo
+          BORING_BSSL_PATH: ${{ github.workspace }}/lib/boringssl/aarch64-apple-darwin
+
+      - name: Test
+        run: |
+          cd bindings/node
+          npm test
+
+  publish:
+    name: Publish to npm
+    needs: [build, test]
+    runs-on: macos-14
+    if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install dependencies
+        run: |
+          cd bindings/node
+          npm install
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: bindings/node/artifacts
+          pattern: bindings-*
+
+      - name: Move artifacts
+        run: |
+          cd bindings/node
+          mkdir -p npm
+          for dir in artifacts/bindings-*/; do
+            cp "${dir}"*.node npm/ 2>/dev/null || true
+          done
+          ls -la npm/
+
+      - name: Publish
+        run: |
+          cd bindings/node
+          npm publish --access public --provenance
+        env:
+          # OIDC token exchange - no NPM_TOKEN needed when Trusted Publishing is configured
+          # Configure at: https://www.npmjs.com/package/@specter/client/access
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

specters-2.0.0/.github/workflows/python-release.yml

@@ -0,0 +1,102 @@
+name: Python Release
+
+on:
+  push:
+    tags: ['v*']
+  pull_request:
+    paths:
+      - 'bindings/python/**'
+      - '.github/workflows/python-release.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  macos:
+    runs-on: macos-14
+    strategy:
+      matrix:
+        target: [x86_64-apple-darwin, aarch64-apple-darwin]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: PyO3/maturin-action@v1
+        with:
+          target: ${{ matrix.target }}
+          args: --release --out dist -m bindings/python/Cargo.toml
+        env:
+          # Use prebuilt BoringSSL from repo
+          BORING_BSSL_PATH: ${{ github.workspace }}/lib/boringssl/${{ matrix.target }}
+      - name: Upload wheels
+        uses: actions/upload-artifact@v4
+        with:
+          name: wheels-macos-${{ matrix.target }}
+          path: dist/*.whl
+
+  sdist:
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@v4
+      - uses: PyO3/maturin-action@v1
+        with:
+          command: sdist
+          args: --out dist -m bindings/python/Cargo.toml
+      - name: Upload sdist
+        uses: actions/upload-artifact@v4
+        with:
+          name: sdist
+          path: dist/*.tar.gz
+
+  test:
+    runs-on: macos-14
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+      - name: Install system dependencies
+        run: |
+          brew update
+          brew install cmake
+      # maturin develop requires a virtualenv - create one explicitly
+      - name: Create virtualenv and install deps
+        run: |
+          python -m venv .venv
+          . .venv/bin/activate
+          pip install --upgrade pip
+          pip install maturin pytest pytest-asyncio
+      - name: Build and install (maturin develop)
+        run: |
+          . .venv/bin/activate
+          maturin develop --release -m bindings/python/Cargo.toml
+        env:
+          # Use prebuilt BoringSSL from repo
+          BORING_BSSL_PATH: ${{ github.workspace }}/lib/boringssl/aarch64-apple-darwin
+      - name: Run tests
+        run: |
+          . .venv/bin/activate
+          cd bindings/python
+          pytest tests/ -v
+
+  release:
+    name: Release
+    runs-on: ubuntu-latest
+    needs: [macos, sdist]
+    if: startsWith(github.ref, 'refs/tags/') || github.event_name == 'workflow_dispatch'
+    permissions:
+      id-token: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: wheels-*
+          merge-multiple: true
+          path: dist
+      - uses: actions/download-artifact@v4
+        with:
+          name: sdist
+          path: dist
+      - uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          skip-existing: true
+          # Falls back to token if Trusted Publishing not configured
+          password: ${{ secrets.PYPI_API_TOKEN }}

specters-2.0.0/.gitignore

@@ -0,0 +1,12 @@
+# Build artifacts
+target/
+.boringssl-build/
+.boringssl-src/
+
+# Agent files
+CLAUDE.md
+AGENTS.md
+GEMINI.md
+COPILOT.md
+CURSOR.md
+.worktrees/

specters-2.0.0/.pre-commit-config.yaml

@@ -0,0 +1,59 @@
+repos:
+  - repo: local
+    hooks:
+      # Pre-commit: fast auto-formatting
+      # Auto-fixes formatting and re-stages changed files
+      - id: cargo-fmt
+        name: cargo fmt (auto-fix)
+        entry: bash -c 'set -e; cargo fmt --all && git add -u'
+        language: system
+        types: [rust]
+        pass_filenames: false
+        stages: [pre-commit]
+        always_run: false
+
+      # Pre-push: full validation
+      # Verifies formatting hasn't regressed (safety check)
+      - id: cargo-fmt-check
+        name: cargo fmt --check
+        entry: bash -c 'set -e; cargo fmt --all -- --check'
+        language: system
+        types: [rust]
+        pass_filenames: false
+        stages: [pre-push]
+        always_run: false
+
+      # Pre-push: linting with strict warnings
+      # Auto-fixes issues and re-stages changed files
+      - id: cargo-clippy
+        name: cargo clippy (strict)
+        entry: >
+          bash -c '
+          set -e;
+          if cargo clippy --all-features --all-targets --fix --allow-staged --allow-dirty -- -D warnings -A dead_code 2>/dev/null; then
+            if ! git diff --cached --quiet || ! git diff --quiet; then
+              git add -u;
+              if git rev-parse --verify HEAD >/dev/null 2>&1; then
+                git commit --amend --no-edit --no-verify 2>/dev/null || true;
+              fi;
+            fi;
+          fi;
+          cargo clippy --all-features --all-targets -- -D warnings -A dead_code
+          '
+        language: system
+        types: [rust]
+        pass_filenames: false
+        stages: [pre-push]
+        always_run: false
+
+      # Pre-push: run tests with nextest
+      # Ensures code passes all tests before pushing
+      # Uses nextest for faster parallel execution and better output
+      - id: cargo-nextest
+        name: cargo nextest run
+        entry: bash -c 'set -e; cargo nextest run --all-features --profile pre-push'
+        language: system
+        types: [rust]
+        pass_filenames: false
+        stages: [pre-push]
+        always_run: false