terp-cli 0.34.0__tar.gz → 0.35.0__tar.gz

terp_cli-0.35.0/PKG-INFO

@@ -0,0 +1,23 @@
+Metadata-Version: 2.5
+Name: terp-cli
+Version: 0.35.0
+Summary: Terp command-line tool — inspect, scaffolding, migrations, checks, api-docs.
+Project-URL: Repository, https://github.com/AITT-NL/terp-framework
+Project-URL: Changelog, https://github.com/AITT-NL/terp-framework/blob/main/CHANGELOG.md
+License-Expression: Apache-2.0
+Requires-Python: >=3.13
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: terp-arch==0.35.0
+Requires-Dist: terp-core==0.35.0
+Requires-Dist: terp-migrations==0.35.0
+Provides-Extra: jobs
+Requires-Dist: terp-cap-outbox==0.35.0; extra == 'jobs'
+Requires-Dist: terp-cap-scheduler-apscheduler==0.35.0; extra == 'jobs'
+Provides-Extra: release
+Requires-Dist: cryptography>=46; extra == 'release'
+Requires-Dist: packaging>=24; extra == 'release'
+Requires-Dist: terp-cap-egress==0.35.0; extra == 'release'
+Provides-Extra: scheduler
+Requires-Dist: terp-cap-scheduler-apscheduler==0.35.0; extra == 'scheduler'
+Provides-Extra: worker
+Requires-Dist: terp-cap-outbox==0.35.0; extra == 'worker'

{terp_cli-0.34.0 → terp_cli-0.35.0}/pyproject.toml

@@ -4,18 +4,18 @@ build-backend = "hatchling.build"
 
 [project]
 name = "terp-cli"
-version = "0.34.0"
+version = "0.35.0"
 description = "Terp command-line tool — inspect, scaffolding, migrations, checks, api-docs."
 requires-python = ">=3.13"
 license = "Apache-2.0"
 dependencies = [
-    "terp-core==0.34.0",
+    "terp-core==0.35.0",
     # `terp migrate` delegates to terp-migrations (lazily imported), keeping Alembic
     # off the path for `terp inspect` / `terp guide` while making migrations work.
-    "terp-migrations==0.34.0",
+    "terp-migrations==0.35.0",
     # `terp guide rules` projects the live rule registry; terp-arch is imported lazily
     # (only when that topic is rendered), so it stays off the common `terp guide` path.
-    "terp-arch==0.34.0",
+    "terp-arch==0.35.0",
     # `terp verify --only env-seams` and `terp smoke` read the compose profiles as data
     # (anchors and `<<:` merge keys resolved), so both answer without a Docker daemon or
     # even the `docker` binary. Declared explicitly rather than leant on: every app
@@ -29,11 +29,20 @@ dependencies = [
 # or a scheduler engine into apps that only use inspect/check/migrate. Deployments can select
 # one process role, while `jobs` is the convenient complete jobs-process bundle.
 [project.optional-dependencies]
-worker = ["terp-cap-outbox==0.34.0"]
-scheduler = ["terp-cap-scheduler-apscheduler==0.34.0"]
+worker = ["terp-cap-outbox==0.35.0"]
+scheduler = ["terp-cap-scheduler-apscheduler==0.35.0"]
 jobs = [
-    "terp-cap-outbox==0.34.0",
-    "terp-cap-scheduler-apscheduler==0.34.0",
+    "terp-cap-outbox==0.35.0",
+    "terp-cap-scheduler-apscheduler==0.35.0",
+]
+# `terp release` and `terp promote` (ADR 0187): the DSSE signature (cryptography), the lock's
+# markers (packaging), and the one declared way to a registry, an index and the vulnerability
+# database (the egress capability). Optional, because no app's own process needs them; without
+# them both commands refuse to run, and never skip a verification.
+release = [
+    "cryptography>=46",
+    "packaging>=24",
+    "terp-cap-egress==0.35.0",
 ]
 
 [project.scripts]

terp_cli-0.35.0/signer/Dockerfile

@@ -0,0 +1,57 @@
+# The signer image: the operator's own toolchain for `terp release sign` (ADR 0187 decision 6).
+#
+# `sign` never runs at the version a release pins, so an app cannot choose its own verifier: it
+# runs from this image, at the framework's newest release. The image holds terp-cli with its
+# `release` extra, installed from a hash-locked requirements file and the framework's own wheels
+# (tools/signer_context.py writes both), gitleaks for the secret scan, the docker client the
+# bytecode check runs the base image's interpreter with (never an app image), git to read the
+# commit, and the terp-arch release table: the wheel SHA-256 of every terp-arch release from the
+# floor up, the only wheels `sign` renders with.
+#
+# The framework's CI builds it from the commit's wheels and runs it; nothing publishes it yet.
+# What the release pipeline will add, and the reason each is not here: publishing it by digest
+# with provenance, so an operator pins the image rather than a tag; the release table filled
+# from the published terp-arch wheels' hashes, which exist only once a release is on the index
+# (this table is empty until then, so this build signs nothing a published app pins); and git
+# from a pinned source, as the bases are, where apt installs Debian's current one today.
+#
+# Built as: docker build --pull --no-cache -f Dockerfile <context>, the context holding this
+# file, requirements.txt, wheels/ and terp-arch-releases.json.
+#
+# Run with the checkout mounted read-only and the engine the bytecode check starts the base
+# interpreter on: its socket mounted, and the socket's group added (`--group-add`), because the
+# image runs as its own user, `signer`, who owns neither (a checkout another user owns is read
+# all the same: sign tells git the named repository is safe). A registry on the loopback, the
+# release lane's, is reached with `--network host`. The release lane runs it exactly so
+# (tests/release_lane/).
+
+# python:3.14-slim, the base-image table's interpreter (terp-arch's base-images.json).
+FROM python@sha256:fbecd461fc72d21b2143c6eaba25143738079154a6d0ea3da3aec724f50eed4a AS install
+COPY wheels/ /wheels/
+COPY requirements.txt /requirements.txt
+# Every distribution by its hash: the third-party ones as uv.lock pins them, the framework's as
+# built for this image, each named by its file under /wheels and never by its version, which an
+# index may carry too (between two releases the tree's is the last published one, and pip took
+# that wheel). --no-deps: the file names every one, so nothing is resolved here.
+RUN python -m venv /opt/terp \
+    && /opt/terp/bin/pip install --no-cache-dir --no-deps --require-hashes -r /requirements.txt
+
+# gitleaks v8.30.1, by digest (zricethezav/gitleaks:v8.30.1, read 2026-10-22).
+FROM zricethezav/gitleaks@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f AS gitleaks
+# The docker client 29.9.2, by digest (docker:29.9.2-cli, read 2026-10-22).
+FROM docker@sha256:5e6baf67325a79f64ed3bed6863954d5e05d0f3d4e57cbdb14809346814bbfdb AS docker
+
+FROM python@sha256:fbecd461fc72d21b2143c6eaba25143738079154a6d0ea3da3aec724f50eed4a
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends git \
+    && rm -rf /var/lib/apt/lists/* \
+    && useradd --create-home --uid 10001 signer
+COPY --from=gitleaks /usr/bin/gitleaks /usr/local/bin/gitleaks
+COPY --from=docker /usr/local/bin/docker /usr/local/bin/docker
+COPY --from=install /opt/terp /opt/terp
+COPY terp-arch-releases.json /etc/terp/terp-arch-releases.json
+ENV PATH="/opt/terp/bin:$PATH" \
+    PYTHONDONTWRITEBYTECODE=1
+USER signer
+ENTRYPOINT ["terp", "release"]
+CMD ["sign", "--help"]

terp_cli-0.35.0/signer/terp-arch-releases.json

@@ -0,0 +1 @@
+{"releases":{},"terpArchReleases":1}