verulla-cli 0.0.2__py3-none-any.whl

verulla_cli/packaging.py

@@ -0,0 +1,106 @@
+"""Deterministic source tarball packaging for ``verulla deploy``.
+
+Identical source trees produce byte-identical ``.tar.gz`` output (normalized
+mtimes/owners/modes, sorted walk, fixed gzip header), so the server sees an
+identical sha256 and can dedupe uploads.
+"""
+
+from __future__ import annotations
+
+import gzip
+import io
+import os
+import stat
+import tarfile
+from pathlib import Path
+
+__all__ = ["DEFAULT_EXCLUDES", "PackagingError", "build_source_tarball"]
+
+# Matched against ANY path component (directory or file name).
+# `.env` is excluded deliberately: local dotenv files commonly hold secrets and
+# must never be shipped in source uploads — secrets go through
+# `verulla secrets set` instead.
+DEFAULT_EXCLUDES: frozenset[str] = frozenset(
+    {
+        ".git",
+        ".hg",
+        ".svn",
+        "node_modules",
+        "__pycache__",
+        ".venv",
+        "venv",
+        ".mypy_cache",
+        ".pytest_cache",
+        ".ruff_cache",
+        ".DS_Store",
+        ".env",
+    }
+)
+
+
+class PackagingError(Exception):
+    """Raised when the source directory cannot be packaged for upload."""
+
+
+def _normalized(info: tarfile.TarInfo, mode: int) -> tarfile.TarInfo:
+    info.mtime = 0
+    info.uid = 0
+    info.gid = 0
+    info.uname = ""
+    info.gname = ""
+    info.mode = mode
+    return info
+
+
+def build_source_tarball(
+    base_dir: Path, excludes: set[str] | frozenset[str] = DEFAULT_EXCLUDES
+) -> bytes:
+    """Package ``base_dir`` as a reproducible gzip tarball with verulla.yml at its root."""
+    base_dir = Path(base_dir)
+    if not (base_dir / "verulla.yml").is_file():
+        raise PackagingError(f"{base_dir / 'verulla.yml'} not found")
+
+    raw = io.BytesIO()
+    try:
+        with tarfile.open(fileobj=raw, mode="w", format=tarfile.PAX_FORMAT) as tar:
+            for root, dirnames, filenames in os.walk(base_dir, followlinks=False):
+                root_path = Path(root)
+                # Prune excluded dirs and sort in place for a deterministic walk.
+                dirnames[:] = sorted(d for d in dirnames if d not in excludes and not _is_generated_dockerfile(d))
+                entries = sorted(
+                    [(d, True) for d in dirnames]
+                    + [(f, False) for f in filenames if f not in excludes and not _is_generated_dockerfile(f)]
+                )
+                for name, _is_dir in entries:
+                    full = root_path / name
+                    st = os.lstat(full)
+                    # Symlinks are skipped entirely (never followed, never
+                    # added): the server rejects links escaping the root
+                    # anyway, and skipping avoids surprising uploads.
+                    # os.walk(followlinks=False) still lists symlinked dirs in
+                    # dirnames, so drop them from further traversal too.
+                    if stat.S_ISLNK(st.st_mode):
+                        if name in dirnames:
+                            dirnames.remove(name)
+                        continue
+                    arcname = full.relative_to(base_dir).as_posix()
+                    if stat.S_ISDIR(st.st_mode):
+                        info = tar.gettarinfo(str(full), arcname=arcname)
+                        tar.addfile(_normalized(info, 0o755))
+                    elif stat.S_ISREG(st.st_mode):
+                        info = tar.gettarinfo(str(full), arcname=arcname)
+                        mode = 0o755 if st.st_mode & 0o111 else 0o644
+                        with open(full, "rb") as fh:
+                            tar.addfile(_normalized(info, mode), fh)
+                    # Other file types (fifos, sockets, devices) are ignored.
+    except OSError as exc:
+        raise PackagingError(f"could not package {base_dir}: {exc}") from exc
+
+    out = io.BytesIO()
+    with gzip.GzipFile(fileobj=out, mode="wb", mtime=0, filename="") as gz:
+        gz.write(raw.getvalue())
+    return out.getvalue()
+
+
+def _is_generated_dockerfile(name: str) -> bool:
+    return name.startswith(".verulla.") and name.endswith("Dockerfile")

verulla_cli/secrets_client.py

@@ -0,0 +1,79 @@
+from __future__ import annotations
+
+from urllib.parse import quote
+
+import httpx
+
+
+class SecretsError(Exception):
+    """Raised for any failure talking to the control plane's /v1/secrets API."""
+
+
+def _auth_headers(access_token: str) -> dict[str, str]:
+    return {"Authorization": f"Bearer {access_token}"}
+
+
+def list_secret_keys(
+    api_url: str, access_token: str, http_client: httpx.Client | None = None, *, app: str | None = None
+) -> list[str]:
+    owns_client = http_client is None
+    client = http_client or httpx.Client(timeout=10)
+    try:
+        response = client.get(f"{api_url}/v1/secrets", params={"app": app} if app else {}, headers=_auth_headers(access_token))
+        response.raise_for_status()
+    except httpx.HTTPError as exc:
+        raise SecretsError(f"could not list secrets: {exc}") from exc
+    finally:
+        if owns_client:
+            client.close()
+    return response.json()["keys"]
+
+
+def set_secret(
+    api_url: str,
+    access_token: str,
+    key: str,
+    value: str,
+    http_client: httpx.Client | None = None,
+    *,
+    app: str | None = None,
+) -> None:
+    owns_client = http_client is None
+    client = http_client or httpx.Client(timeout=10)
+    try:
+        response = client.put(
+            f"{api_url}/v1/secrets",
+            params={"app": app} if app else {},
+            json={"key": key, "value": value},
+            headers=_auth_headers(access_token),
+        )
+        response.raise_for_status()
+    except httpx.HTTPError as exc:
+        raise SecretsError(f"could not set secret {key!r}: {exc}") from exc
+    finally:
+        if owns_client:
+            client.close()
+
+
+def delete_secret(
+    api_url: str,
+    access_token: str,
+    key: str,
+    http_client: httpx.Client | None = None,
+    *,
+    app: str | None = None,
+) -> None:
+    owns_client = http_client is None
+    client = http_client or httpx.Client(timeout=10)
+    try:
+        response = client.delete(
+            f"{api_url}/v1/secrets/{quote(key, safe='')}",
+            params={"app": app} if app else {},
+            headers=_auth_headers(access_token),
+        )
+        response.raise_for_status()
+    except httpx.HTTPError as exc:
+        raise SecretsError(f"could not delete secret {key!r}: {exc}") from exc
+    finally:
+        if owns_client:
+            client.close()

verulla_cli-0.0.2.dist-info/METADATA

@@ -0,0 +1,8 @@
+Metadata-Version: 2.5
+Name: verulla-cli
+Version: 0.0.2
+Requires-Python: >=3.12
+Requires-Dist: docker>=7
+Requires-Dist: httpx>=0.27
+Requires-Dist: typer>=0.12
+Requires-Dist: verulla-manifest==0.0.2

verulla_cli-0.0.2.dist-info/RECORD

@@ -0,0 +1,13 @@
+verulla_cli/__init__.py,sha256=aoSghCOQZzeIBMmXqw0X_d3SULg1761U-j4WQRAmusk,171
+verulla_cli/apps_client.py,sha256=0cIUwX8hD2oTyh1pQ8GlGmqWhS-jiGK5nbc9lf2RFMo,8254
+verulla_cli/auth.py,sha256=d_xM7ycifUpST9hJbQ5Q6RgXO4FR9a7Jx1-D8LQb-Us,8349
+verulla_cli/buildkit.py,sha256=lI16uwpCVK_I3CZkdOXJdLtmUZ2b_VG4U9o5KmD1IXU,4947
+verulla_cli/deploy_client.py,sha256=0N-BiNssXufUpMUhIUK80yNvab_fB4Xj1rluV2NOpcA,1409
+verulla_cli/emulate.py,sha256=6PgJw4oTr5SpTxUW6UL3lX-l7RvCm9HSfvGvOsJxKq0,4905
+verulla_cli/main.py,sha256=Vqxr82P8-jBsaTFzs5BfGKBLYD2Ia4TFQ1S61cwDj8o,41052
+verulla_cli/packaging.py,sha256=nfUA1Jnxxx7pslGMkLpKV0Yvtkw1z9xPFdZnxi8bIQo,4025
+verulla_cli/secrets_client.py,sha256=MCvDdq9XjnSJG6q7N5vLJ820V01m3yavYESiSi5kcmI,2314
+verulla_cli-0.0.2.dist-info/METADATA,sha256=J8yekoWK9l61Zu-vLdCA6oX80nttVSlyX87n5dzJyMA,197
+verulla_cli-0.0.2.dist-info/WHEEL,sha256=2iZrJkDIkeDh0k9SikKMqFuRP-ua6mb4Ir1AsER4BEw,87
+verulla_cli-0.0.2.dist-info/entry_points.txt,sha256=WbdxWlCLOF6V1oq9lWXpVI33zu-U8a0tbksdcUHzd5c,49
+verulla_cli-0.0.2.dist-info/RECORD,,

verulla_cli-0.0.2.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.33.0
+Root-Is-Purelib: true
+Tag: py3-none-any

verulla_cli-0.0.2.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+verulla = verulla_cli.main:app