tba-protocol-workload-spiffe-workload-api 0.4.0.dev2__py3-none-any.whl

tba_protocol_workload_spiffe_workload_api/__init__.py

@@ -0,0 +1,18 @@
+from .endpoint import validate_endpoint
+from .rpcs import FORBIDDEN_EXTENSION_RPCS, RPC_DEFINITIONS, RPC_NAMES, RpcDefinition
+from .service import WorkloadApiService
+from .streams import validate_full_snapshot
+from .versions import CURRENT_VERSION, VERSION_HISTORY, WorkloadApiVersion
+
+__all__ = [
+    "CURRENT_VERSION",
+    "FORBIDDEN_EXTENSION_RPCS",
+    "RPC_DEFINITIONS",
+    "RPC_NAMES",
+    "VERSION_HISTORY",
+    "RpcDefinition",
+    "WorkloadApiService",
+    "WorkloadApiVersion",
+    "validate_endpoint",
+    "validate_full_snapshot",
+]

tba_protocol_workload_spiffe_workload_api/bindings.py

@@ -0,0 +1,5 @@
+"""Capability bindings owned by the versioned protocol package."""
+
+PROTOCOL_CAPABILITY_BINDINGS: tuple[str, ...] = ()
+
+__all__ = ["PROTOCOL_CAPABILITY_BINDINGS"]

tba_protocol_workload_spiffe_workload_api/claims.py

@@ -0,0 +1,5 @@
+"""Claim vocabulary selected by the versioned protocol package."""
+
+PROTOCOL_CLAIM_NAMES: tuple[str, ...] = ()
+
+__all__ = ["PROTOCOL_CLAIM_NAMES"]

tba_protocol_workload_spiffe_workload_api/compatibility.py

@@ -0,0 +1,3 @@
+def require_version(identifier: str) -> None:
+    if identifier != "SPIFFE-Workload-API-1.0":
+        raise ValueError(f"unsupported Workload API revision: {identifier}")

tba_protocol_workload_spiffe_workload_api/endpoint.py

@@ -0,0 +1,5 @@
+def validate_endpoint(address: str) -> None:
+    if not (address.startswith("unix://") or address.startswith("npipe://")):
+        raise ValueError(
+            "Workload API endpoint must use an explicitly configured local transport"
+        )

tba_protocol_workload_spiffe_workload_api/errors.py

@@ -0,0 +1,8 @@
+"""Errors raised by the versioned protocol package."""
+
+
+class ProtocolProfileError(ValueError):
+    """The artifact or request does not satisfy the selected protocol profile."""
+
+
+__all__ = ["ProtocolProfileError"]

tba_protocol_workload_spiffe_workload_api/features.py

@@ -0,0 +1,10 @@
+FEATURES = frozenset(
+    {
+        "x509-svid-stream",
+        "x509-bundle-stream",
+        "jwt-svid-fetch",
+        "jwt-bundle-stream",
+        "jwt-svid-validation",
+        "full-snapshot-streams",
+    }
+)

tba_protocol_workload_spiffe_workload_api/migrations.py

@@ -0,0 +1,6 @@
+def migration_path(
+    source: str, target: str = "SPIFFE-Workload-API-1.0"
+) -> tuple[str, ...]:
+    if source == target:
+        return ()
+    raise ValueError(f"manual Workload API migration required: {source} to {target}")

tba_protocol_workload_spiffe_workload_api/rpcs.py

@@ -0,0 +1,19 @@
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True, slots=True)
+class RpcDefinition:
+    name: str
+    server_streaming: bool
+    profile: str
+
+
+RPC_DEFINITIONS = (
+    RpcDefinition("FetchX509SVID", True, "x509-svid"),
+    RpcDefinition("FetchX509Bundles", True, "x509-svid"),
+    RpcDefinition("FetchJWTSVID", False, "jwt-svid"),
+    RpcDefinition("FetchJWTBundles", True, "jwt-svid"),
+    RpcDefinition("ValidateJWTSVID", False, "jwt-svid"),
+)
+RPC_NAMES = frozenset(item.name for item in RPC_DEFINITIONS)
+FORBIDDEN_EXTENSION_RPCS = frozenset({"FetchWITSVID", "FetchCWTSVID"})

tba_protocol_workload_spiffe_workload_api/schemas.py

@@ -0,0 +1,5 @@
+"""Wire-schema inventory owned by the versioned protocol package."""
+
+PROTOCOL_WIRE_SCHEMA_NAMES: tuple[str, ...] = ()
+
+__all__ = ["PROTOCOL_WIRE_SCHEMA_NAMES"]

tba_protocol_workload_spiffe_workload_api/service.py

@@ -0,0 +1,18 @@
+from collections.abc import Callable, Mapping
+from .rpcs import RPC_NAMES
+
+
+class WorkloadApiService:
+    def __init__(self, handlers: Mapping[str, Callable[..., object]]) -> None:
+        unknown = set(handlers).difference(RPC_NAMES)
+        if unknown:
+            raise ValueError(f"Workload API must not be extended: {sorted(unknown)}")
+        missing = RPC_NAMES.difference(handlers)
+        if missing:
+            raise ValueError(f"missing Workload API handlers: {sorted(missing)}")
+        self._handlers = dict(handlers)
+
+    def dispatch(self, rpc: str, request: object) -> object:
+        if rpc not in RPC_NAMES:
+            raise ValueError(f"unknown Workload API RPC: {rpc}")
+        return self._handlers[rpc](request)

tba_protocol_workload_spiffe_workload_api/streams.py

@@ -0,0 +1,6 @@
+def validate_full_snapshot(
+    previous: frozenset[str], current: frozenset[str], *, declared_full_snapshot: bool
+) -> frozenset[str]:
+    if not declared_full_snapshot:
+        raise ValueError("SPIFFE stream updates must be complete snapshots")
+    return current

tba_protocol_workload_spiffe_workload_api/versions.py

@@ -0,0 +1,16 @@
+from dataclasses import dataclass
+
+
+@dataclass(frozen=True, slots=True)
+class WorkloadApiVersion:
+    identifier: str
+    status: str
+    specification_uri: str
+
+
+CURRENT_VERSION = WorkloadApiVersion(
+    "SPIFFE-Workload-API-1.0",
+    "stable",
+    "https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Workload_API.md",
+)
+VERSION_HISTORY = (CURRENT_VERSION,)

tba_protocol_workload_spiffe_workload_api-0.4.0.dev2.dist-info/METADATA

@@ -0,0 +1,11 @@
+Metadata-Version: 2.4
+Name: tba-protocol-workload-spiffe-workload-api
+Version: 0.4.0.dev2
+Summary: 
+Requires-Python: >=3.10,<3.15
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14

tba_protocol_workload_spiffe_workload_api-0.4.0.dev2.dist-info/RECORD

@@ -0,0 +1,17 @@
+tba_protocol_workload_spiffe_workload_api/__init__.py,sha256=imopGl6LYXZN_ucA5vSGO1XlTonfnd19HwxObwaroiA,546
+tba_protocol_workload_spiffe_workload_api/bindings.py,sha256=geO7qbQkZg0dzzGv3daVxr3WhKaDUdlb382DITlWey4,163
+tba_protocol_workload_spiffe_workload_api/claims.py,sha256=WibdHFxqAyKK9njjKwo37vO1RKj76jedqoDQs22LF6U,147
+tba_protocol_workload_spiffe_workload_api/compatibility.py,sha256=NJlDWxyk_DEnFAu38zpg9NisAEYT2_avg5Fq2GcPa-M,171
+tba_protocol_workload_spiffe_workload_api/endpoint.py,sha256=uX3CoWhV067njFok9xdAIRdIB1uzOiAb3djGQZMiXVU,245
+tba_protocol_workload_spiffe_workload_api/errors.py,sha256=KwHVry4N9TO5ZP3zolvxALLJPBFjBOpiNq_-vH4F9lQ,216
+tba_protocol_workload_spiffe_workload_api/features.py,sha256=mCzp1dC_S4_kevHmuncAK3iaZje8eEQARFJetlB22Go,213
+tba_protocol_workload_spiffe_workload_api/migrations.py,sha256=dKYPd7qU-tpdDYRCmDdkuPFttPfVLTjOOpsRpidSNb4,228
+tba_protocol_workload_spiffe_workload_api/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+tba_protocol_workload_spiffe_workload_api/rpcs.py,sha256=hS_q2GKrqVghgpdsajp6Pni42vSXVmli34xsgEnFACM,587
+tba_protocol_workload_spiffe_workload_api/schemas.py,sha256=QHrkgNjQDZ4CzMQvwCKcenekGhjq2ezTtR8VdgdbcWQ,161
+tba_protocol_workload_spiffe_workload_api/service.py,sha256=4kcwyi9CgG1IATpKkepgY-39iiRWv9ipYvjlnZexQqw,736
+tba_protocol_workload_spiffe_workload_api/streams.py,sha256=T7IprH-XdB52pdODoiUrgFxMyklZWnF5eytARYTSbEU,267
+tba_protocol_workload_spiffe_workload_api/versions.py,sha256=xlVNCk1qCwpkEq75N3_s-uhy0TrYOEW60TkfonRpqwM,368
+tba_protocol_workload_spiffe_workload_api-0.4.0.dev2.dist-info/METADATA,sha256=376jELHVaqquKRUMqeml3sYXk9vMtj2-09DkQK0DIik,433
+tba_protocol_workload_spiffe_workload_api-0.4.0.dev2.dist-info/WHEEL,sha256=L-WvLdSBvJWHXv5zrQxDvNRnIgoBzLUpcbuiw19KCuQ,88
+tba_protocol_workload_spiffe_workload_api-0.4.0.dev2.dist-info/RECORD,,

tba_protocol_workload_spiffe_workload_api-0.4.0.dev2.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: poetry-core 2.5.0
+Root-Is-Purelib: true
+Tag: py3-none-any