wasm-action 0.0.7__tar.gz → 0.0.9__tar.gz

{wasm_action-0.0.7 → wasm_action-0.0.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: wasm-action
-Version: 0.0.7
+Version: 0.0.9
 Summary: Interact with WebAssembly registries.
 Requires-Dist: click>=8.2.1
 Requires-Dist: cryptography>=45.0.6
@@ -12,6 +12,7 @@ Requires-Dist: requests>=2.32.4
 Requires-Dist: semver>=3.0.4
 Requires-Dist: urllib3>=1.25.3
 Requires-Dist: validators>=0.35.0
+Requires-Dist: wasmtime>=40.0.0
 Requires-Python: >=3.10
 Project-URL: Repository, https://github.com/xelato/wasm-action
 Description-Content-Type: text/markdown
@@ -26,6 +27,7 @@ Description-Content-Type: text/markdown
 * Supported artifact types: wasm
 * Supported actions: push, pull
 * Supports Python 3.10+ on Linux, MacOS and Windows
+* Python sandbox using wasm build of cpython 3.14
 
 #### Planned
 * OCI registry support (a.k.a. Docker registry)
@@ -84,7 +86,7 @@ To pull a private package, define your [token](https://wa.dev/account/credential
 ### Key generation
 New [token](https://wa.dev/account/credentials/new) registration and push to wa.dev require generation and configuration of a private/public key pair which can be facilitated with:
 ```
-$ uv run wasm-action key
+$ uvx wasm-action key
 {
     "private": "ecdsa-p256:9y5nigLvFp3KZZQtuvN9DchpGIMUB4bwGAtkIoOCla4=",
     "public": "ecdsa-p256:AvspSQWBK65ItTou/uVCi5qC4P+HBCi4R34OIPb3ILRl",

{wasm_action-0.0.7 → wasm_action-0.0.9}/README.md

@@ -8,6 +8,7 @@
 * Supported artifact types: wasm
 * Supported actions: push, pull
 * Supports Python 3.10+ on Linux, MacOS and Windows
+* Python sandbox using wasm build of cpython 3.14
 
 #### Planned
 * OCI registry support (a.k.a. Docker registry)
@@ -66,7 +67,7 @@ To pull a private package, define your [token](https://wa.dev/account/credential
 ### Key generation
 New [token](https://wa.dev/account/credentials/new) registration and push to wa.dev require generation and configuration of a private/public key pair which can be facilitated with:
 ```
-$ uv run wasm-action key
+$ uvx wasm-action key
 {
     "private": "ecdsa-p256:9y5nigLvFp3KZZQtuvN9DchpGIMUB4bwGAtkIoOCla4=",
     "public": "ecdsa-p256:AvspSQWBK65ItTou/uVCi5qC4P+HBCi4R34OIPb3ILRl",

{wasm_action-0.0.7 → wasm_action-0.0.9}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "wasm-action"
-version = "0.0.7"
+version = "0.0.9"
 description = "Interact with WebAssembly registries."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -15,6 +15,7 @@ dependencies = [
     "semver>=3.0.4",
     "urllib3>=1.25.3",
     "validators>=0.35.0",
+    "wasmtime>=40.0.0",
 ]
 
 [project.urls]

wasm_action-0.0.9/src/wasm_action/cache.py

@@ -0,0 +1,58 @@
+
+import os
+import hashlib
+
+CACHE = os.path.join(os.environ['HOME'], '.cache', 'wasm-action')
+
+
+def fetch(content_hash: str) -> bytes:
+    """Fetch object from cache"""
+    if not os.path.exists(CACHE):
+        os.makedirs(CACHE)
+
+    filename = os.path.join(CACHE, content_hash)
+    if not os.path.exists(filename):
+        return None
+
+    with open(filename, 'rb') as f:
+        content = f.read()
+
+    computed_hash = hashlib.sha256(content).hexdigest()
+    if computed_hash != content_hash:
+        raise ValueError('content with hash has been tempered: {}'.format(content_hash))
+    return content
+
+
+def store(content: bytes):
+    """Store object in cache"""
+    if not os.path.exists(CACHE):
+        os.makedirs(CACHE)
+
+    content_hash = hashlib.sha256(content).hexdigest()
+    filename = os.path.join(CACHE, content_hash)
+    with open(filename, 'wb') as f:
+        f.write(content)
+
+
+def exists(content_hash: str) -> bool:
+    """Check if object exists"""
+    if not os.path.exists(CACHE):
+        os.makedirs(CACHE)
+
+    filename = os.path.join(CACHE, content_hash)
+    return os.path.exists(filename)
+
+
+def compute_hash(content: bytes) -> str:
+    """Compute hash without storing the object"""
+    return hashlib.sha256(content).hexdigest()
+
+
+def size(content_hash: str) -> int:
+    """Return size of stored object"""
+    if not os.path.exists(CACHE):
+        os.makedirs(CACHE)
+    filename = os.path.join(CACHE, content_hash)
+    if not os.path.exists(filename):
+        return 0
+    return os.stat(filename).st_size

wasm_action-0.0.9/src/wasm_action/cli.py

@@ -0,0 +1,156 @@
+import os
+import sys
+import click
+import importlib.metadata
+import json
+
+from . import lib
+from . import python
+from .warg.crypto import generate_key
+from .wasm import runtime
+from .util import cli_error_handler
+
+
+@click.group()
+def cli():
+    pass
+
+
+@cli.command(help="Print version")
+def version():
+    try:
+        version = importlib.metadata.version("wasm-action")
+    except importlib.metadata.PackageNotFoundError:
+        version = "0.0.0"
+    print(version)
+
+
+@cli.command(help="Push to registry")
+@click.option('-r', '--registry', required=True, help="registry domain name")
+@click.option('-p', '--package', required=True, help="package spec")
+@click.option('--path', required=True, help="filename")
+@click.option('--warg-token', required=False, envvar='WARG_TOKEN', help="warg token (or $WARG_TOKEN)")
+@click.option('--warg-private-key', required=False, envvar='WARG_PRIVATE_KEY', help="warg private key (or $WARG_PRIVATE_KEY)")
+@cli_error_handler
+def push(registry, package, path, warg_token, warg_private_key):
+    lib.push_file(
+        registry=registry,
+        package=package,
+        path=path,
+        warg_token=warg_token,
+        warg_private_key=warg_private_key,
+        cli=True,
+    )
+
+
+@cli.command(help="Pull from registry")
+@click.option('-r', '--registry', required=True, help="registry domain name")
+@click.option('-p', '--package', required=True, help="package spec")
+@click.option('--path', required=False, help="filename")
+@click.option('--warg-token', required=False, envvar='WARG_TOKEN', help="warg token (or $WARG_TOKEN)")
+@cli_error_handler
+def pull(registry, package, path=None, warg_token=None):
+    lib.pull_file(
+        registry=registry,
+        package=package,
+        path=path,
+        warg_token=warg_token,
+        cli=True,
+    )
+
+
+@cli.command(help="Generate private key or read one from stdin")
+@cli_error_handler
+def key():
+    """Generate key in json format.
+
+    Either:
+     - generate a new key
+     - read a private key from standard input
+    """
+    if sys.stdin.isatty():
+        data = generate_key()
+    else:
+        # read private key from standard input
+        private_key = sys.stdin.read()
+        data = generate_key(private_key)
+        del data['private']
+    print(json.dumps(data, indent=4))
+
+
+@cli.command('x', help="Run a WebAssembly file")
+@click.argument('filename', required=True)
+@click.argument('func', required=False)
+@click.argument('args', nargs=-1)
+@cli_error_handler
+def run(filename, func, args):
+    """Run a WebAssembly file"""
+
+    print(runtime
+        .module_file(filename)
+        .instance()
+        .function(func)
+        .call(*args)
+    )
+
+
+@cli.command('eval', help="""Expression evaluator
+
+Expression(s) specified in EXPRESSION or STDIN will be evaluated against the specified WebAssembly module.
+The input must conform to a subset of Python's syntax that includes literals, tuples and function calls.
+The latter are resolved to a valid function present in the exports of the WebAssembly module.
+Example:
+If calc.wasm exports `add` and `mul`, then the following is a valid expression in such context:
+"mul(2, 3), add(mul(4, 5), 3)"
+""")
+@click.argument('filename', required=True)
+@click.argument('expression', required=False)
+@cli_error_handler
+def evaluate(filename, expression):
+    """Evaluates an expression against a wasm module instance.
+
+    Any function calls are intercepted and resolved to a valid function
+    from the exports of the wasm module.
+
+    Expression syntax follows a subset of Python syntax.
+
+    """
+    instance = (runtime
+        .module_file(filename)
+        .instance()
+    )
+
+    expression = sys.stdin.read() if not sys.stdin.isatty() else expression
+
+    if expression:
+        for result in instance.evaluate(expression):
+            print(result)
+        return
+
+    if not sys.stdin.isatty():
+        return
+
+    # repl mode
+    import readline
+    prompt = "{} >>> ".format(os.path.basename(filename))
+    while True:
+        expression = input(prompt)
+        try:
+            for result in instance.evaluate(expression):
+                print(result)
+        except Exception as e:
+            print(e)
+
+
+@cli.command('python', help="Python in a sandbox", add_help_option=False, context_settings=dict(
+    ignore_unknown_options=True,
+))
+@click.argument('args', nargs=-1, type=click.UNPROCESSED)
+@cli_error_handler
+def run_python(args):
+    """Run a WASI-compiled wasm build of cpython"""
+    python.run_python(args)
+
+
+if __name__ == "__main__":
+    cli()

wasm_action-0.0.9/src/wasm_action/python.py

@@ -0,0 +1,108 @@
+
+"""
+Python in a sandbox using WASM/WASI.
+
+uvx --python 3.14 wasm-action python
+"""
+
+import os
+import sys
+import tempfile
+import shutil
+
+from . import cache
+from . import lib
+from .wasm import runtime
+
+PYTHON = {
+
+    '3.14': {
+        'registry': 'wa.dev',
+        'package': 'xelato:python314',
+        'version': '26.2.6',
+        'sha256': '6a9e23d3db2ea0883fb74bfe9540bcb27bd167be1dab39546a5376112f4beea0',
+    },
+
+}
+
+
+def run_python(args):
+    v = sys.version_info
+    version = "{}.{}".format(v.major, v.minor)
+    python = PYTHON.get(version) or PYTHON['3.14']
+
+    if cache.exists(python['sha256']):
+        print("Found object in cache")
+        content = cache.fetch(python['sha256'])
+    else:
+        print("Downloading python build")
+        download = lib.pull(
+            registry=python['registry'],
+            package="{}@{}".format(python['package'], python['version'])
+        )
+        if download.digest != "sha256:{}".format(python['sha256']):
+            raise ValueError('unexpected digest while downloading build')
+
+        cache.store(download.content)
+        print("Stored object in local cache")
+        content = download.content
+
+    # Lib folder
+    # Reusing the host Python installation
+    python_lib = os.path.dirname(os.__file__)
+    print("Using python lib {}".format(python_lib))
+
+    argv = ['python']
+    argv.extend(args)
+
+    tmp = tempfile.mkdtemp('py')
+
+    instance = (runtime
+        .module(content)
+        .wasi()
+        # pass all cli arguments to the wasm "process"
+        .argv(argv)
+
+        # configure python lib
+        .env('PYTHONPATH', '/lib:/build')
+        .mount(python_lib, '/lib', readonly=True)
+
+        # todo: ModuleNotFoundError: No module named '_sysconfigdata__wasi_wasm32-wasi'
+        #.mount('{}/github/python/cpython/builddir/wasi/build/lib.wasi-wasm32-3.14'.format(os.environ['HOME']), '/build')
+
+        # provide a /tmp folder
+        .mount(tmp, '/tmp', readonly=False)
+
+        # Get access to CWD for running user code.
+        # note: it may be preferable to set this to a subdir of /
+        .mount(os.getcwd(), "/", readonly=True)
+
+        .instance()
+    )
+
+    # todo: exit code?
+    try:
+        instance.function('_start')()
+    finally:
+        # clean-up tmp dir
+        shutil.rmtree(tmp)
+
+    """
+    https://github.com/python/cpython/blob/main/Modules/getpath.py
+    Could not find platform independent libraries <prefix>
+    Could not find platform dependent libraries <exec_prefix>
+    """
+
+    # 3.14
+    """
+    Installations of Python now contain a new file, :file:`build-details.json`.
+    This is a static JSON document containing build details for CPython,
+    to allow for introspection without needing to run code.
+    This is helpful for use-cases such as Python launchers, cross-compilation,
+    and so on.
+
+    :file:`build-details.json` must be installed in the platform-independent
+    standard library directory. This corresponds to the :ref:`'stdlib'
+    <installation_paths>` :mod:`sysconfig` installation path,
+    which can be found by running ``sysconfig.get_path('stdlib')``.
+    """

{wasm_action-0.0.7 → wasm_action-0.0.9}/src/wasm_action/util.py

@@ -2,6 +2,8 @@
 import os
 import re
 import sys
+import datetime
+import functools
 import requests
 import semver
 
@@ -73,6 +75,52 @@ def parse_package(package):
     if not re.match(r"[\w-]+", name):
         raise ValueError("invalid package name")
     if version:
+        # evaluate any calver specifiers
+        version = CalVer(version).version()
         # throws on failed validation
         semver.Version.parse(version)
     return namespace, name, version
+
+
+class CalVer:
+    """Calendar Versioning according to https://calver.org (zero-padded formats excluded)"""
+
+    SPEC = {
+        'YYYY': lambda d: str(d.year),
+        'YY': lambda d: str(d.year % 100),
+        'MM': lambda d: str(d.month),
+        'WW': lambda d: str(d.isocalendar().week),
+        'DD': lambda d: str(d.day),
+    }
+
+    def __init__(self, pattern):
+        self.pattern = pattern
+
+    def now(self) -> datetime.datetime:
+        if not hasattr(datetime, 'UTC'):
+            # 3.10
+            return datetime.datetime.utcnow()
+        return datetime.datetime.now(datetime.UTC)
+
+    def version(self, at: datetime.datetime=None):
+        when = at or self.now()
+        return ".".join([
+            self.SPEC[part.upper()](when)
+            if part.upper() in self.SPEC else part
+            for part in self.pattern.split('.')
+        ])
+
+
+class cli_error_handler(object):
+    """Decorator for CLI error handling"""
+
+    def __init__(self, func):
+        self.func = func
+        functools.update_wrapper(self, func)
+
+    def __call__(self, *args, **kwargs):
+        try:
+            return self.func(*args, **kwargs)
+        except Exception as e:
+            # print error and return 1
+            sys.exit(e)

wasm_action-0.0.9/src/wasm_action/wasm/expression.py

@@ -0,0 +1,96 @@
+"""
+Expression evaluator.
+
+Expressions are evaluated against a WebAssembly module instance.
+Expressions allow to combine zero or more function invocations into one go.
+An expression may consist of the following constituents:
+ * Literals
+    Simple types that can be represented in WA types.
+    1, 0x23, true, false, 3.14
+ * Function invocations
+    Refer to functions that must be present in the exports section (what about allowing to call imports?).
+    sum(2, 3)
+ * Tuples for structure and multiple instructions.
+    Tuples - allow multiple invocations in one.
+
+
+Example:
+Suppose the file calculator.wasm provides the following exports:
+ - sum, mul
+Then the following expressions can be constructed:
+sum(2, 3)
+sum(2, mul(3, 5))
+sum(1, sum(2, sum(3, sum(4, 5))))
+(1, sum(2, 3))  -> (1, 5)
+
+Implementation takes a shortcut by using Python's ast module.
+"""
+
+import ast
+
+ALLOWED_SYNTAX = {
+    ast.Module,
+    ast.Expr,
+    ast.Constant,
+    ast.Tuple,
+    ast.Call,
+    ast.Name,
+}
+
+
+def parse(value: str) -> ast.AST:
+    """Parse an expression into an ast syntax tree."""
+    node = ast.parse(value)
+    for x in ast.walk(node):
+        if isinstance(x, ast.Load):
+            # ignored
+            continue
+        if x.__class__ not in ALLOWED_SYNTAX:
+            raise SyntaxError("{} not allowed in expression".format(x.__class__.__name__))
+    return node
+
+
+def evaluate(expression, obj):
+    node = parse(expression)
+    return Evaluator(obj).evaluate(node)
+
+
+class Evaluator:
+
+    def __init__(self, obj):
+        self.obj= obj
+
+    def evaluate(self, node: ast.AST) -> object:
+        if isinstance(node, ast.Module):
+            for sub in node.body:
+                yield from self.evaluate(sub)
+
+        elif isinstance(node, ast.Expr):
+            yield self.compute(node)
+
+        else:
+            raise Exception("value not allowed: {}".format(node))
+
+    def compute(self, node):
+        """Evaluate a single expression"""
+        if isinstance(node, ast.Expr):
+            return self.compute(node.value)
+
+        elif isinstance(node, ast.Tuple):
+            return tuple(self.compute(x) for x in node.elts)
+
+        elif isinstance(node, ast.Constant):
+            return node.value
+
+        elif isinstance(node, ast.Call):
+            assert isinstance(node.func, ast.Name)
+            name = node.func.id
+            func = getattr(self.obj, name)
+            args = [self.compute(x) for x in node.args]
+            return func(*args)
+
+        elif isinstance(node, ast.Name):
+            return getattr(self.obj, node.id)
+
+        else:
+            raise Exception("value not allowed: {}".format(node))

wasm_action-0.0.9/src/wasm_action/wasm/runtime.py

@@ -0,0 +1,145 @@
+
+import os
+import wasmtime
+
+from . import expression
+
+
+def module_file(filename):
+    if not os.path.exists(filename) or not os.path.isfile(filename):
+        raise Exception('file not found: {}'.format(filename))
+
+    with open(filename, 'rb') as f:
+        module_bytes = f.read()
+    return module(module_bytes)
+
+
+def module(module_bytes):
+    return Module(module_bytes)
+
+
+class Module:
+
+    def __init__(self, module_bytes):
+        self._store = wasmtime.Store()
+        self._module = wasmtime.Module(self._store.engine, module_bytes)
+
+    def wasi(self):
+        return WASI(store=self._store, module=self._module)
+
+    def instance(self):
+        return Instance(store=self._store, module=self._module)
+
+
+class Instance:
+
+    def __init__(self, store, module, instance=None):
+        self._store = store
+        self._module = module
+        if instance:
+            assert isinstance(instance, wasmtime.Instance)
+        self._instance = instance
+        self._imports = []
+
+    def __getattr__(self, name):
+        """Ususally called by the evaluator to resolve function names."""
+        return self.function(name)
+
+    def function(self, name):
+        if not self._instance:
+            self._instance = wasmtime.Instance(self._store, self._module, self._imports)
+        exports = self._instance.exports(self._store)
+        if name not in exports.keys():
+            print('defined functions:', list(exports.keys()))
+            assert False, "function not found: {}".format(name)
+        return Function(store=self._store, func=exports[name], name=name)
+
+    def evaluate(self, text):
+        """Evaluate an expression against functions exported in the instance."""
+        return expression.evaluate(text or '', obj=self)
+
+
+class WASI:
+
+    def __init__(self, store, module):
+        self._store = store
+        self._module = module
+
+        self.linker = wasmtime.Linker(self._store.engine)
+        self.linker.define_wasi()
+
+        self._wasi = wasmtime.WasiConfig()
+        self._wasi.inherit_stdin()
+        self._wasi.inherit_stdout()
+        self._wasi.inherit_stderr()
+
+        self._environ = {}
+
+    def mount(self, host_path, guest_path, readonly=True):
+        """Bind mount `host_path` as `guest_path` in the WASM instance."""
+        self._wasi.preopen_dir(
+            host_path,
+            guest_path,
+            dir_perms=wasmtime.DirPerms.READ_ONLY if readonly else wasmtime.DirPerms.READ_WRITE,
+            file_perms=wasmtime.FilePerms.READ_ONLY if readonly else wasmtime.FilePerms.READ_WRITE,
+        )
+        return self
+
+    def argv(self, argv):
+        self._wasi.argv = argv
+        return self
+
+    def env(self, key, value):
+        """Configure an environment variable in the WASM instance"""
+        self._environ[key] = value
+        return self
+
+    def instance(self):
+        self._wasi.env = [
+            (k, v) for (k, v) in self._environ.items()
+        ]
+        self._store.set_wasi(self._wasi)
+        instance = self.linker.instantiate(self._store, self._module)
+        return Instance(store=self._store, module=self._module, instance=instance)
+
+
+class Function:
+
+    _types = {
+        "i32": int,
+        "i64": int,
+        "f32": float,
+        "f64": float,
+    }
+
+    def __init__(self, store, func, name):
+        self._store = store
+        self._func = func
+        self._func_type = self._func.type(self._store)
+        self.name = name
+
+    def call(self, *args):
+        return self(*args)
+
+    def __call__(self, *args):
+        # convert to expected types before function call
+        typed_args = []
+        for param, arg in zip(self._func_type.params, args):
+            type = self._types.get(str(param))
+            arg = type(arg) if type else arg
+            typed_args.append(arg)
+        try:
+            result = self._func(self._store, *typed_args)
+        except Exception as e:
+            message = "Error calling {}({}): {}".format(
+                self.name,
+                ", ".join([str(x) for x in typed_args]),
+                str(e),
+            )
+            raise Exception(message)
+        return result
+
+    def __str__(self):
+        return "{}({})".format(self.name, ", ".join([
+            str(p) for p in self._func_type.params
+        ]))

wasm_action-0.0.7/src/wasm_action/cli.py

@@ -1,89 +0,0 @@
-import sys
-import click
-import importlib.metadata
-import json
-
-from . import lib
-from .warg.crypto import generate_key
-
-
-@click.group()
-def cli():
-    pass
-
-
-@cli.command(help="Print version")
-def version():
-    try:
-        version = importlib.metadata.version("wasm-action")
-    except importlib.metadata.PackageNotFoundError:
-        version = "0.0.0"
-    print(version)
-
-
-@cli.command(help="Push to registry")
-@click.option('--registry', required=True, help="registry domain name")
-@click.option('--package', required=True, help="package spec")
-@click.option('--path', required=True, help="filename")
-@click.option('--warg-token', required=False, envvar='WARG_TOKEN', help="warg token (or $WARG_TOKEN)")
-@click.option('--warg-private-key', required=False, envvar='WARG_PRIVATE_KEY', help="warg private key (or $WARG_PRIVATE_KEY)")
-def push(registry, package, path, warg_token, warg_private_key):
-
-    try:
-
-        lib.push_file(
-            registry=registry,
-            package=package,
-            path=path,
-            warg_token=warg_token,
-            warg_private_key=warg_private_key,
-            cli=True,
-        )
-
-    except Exception as e:
-        print(e)
-        sys.exit(1)
-
-
-@cli.command(help="Pull from registry")
-@click.option('--registry', required=True, help="registry domain name")
-@click.option('--package', required=True, help="package spec")
-@click.option('--path', required=False, help="filename")
-@click.option('--warg-token', required=False, envvar='WARG_TOKEN', help="warg token (or $WARG_TOKEN)")
-def pull(registry, package, path=None, warg_token=None):
-
-    try:
-
-        lib.pull_file(
-            registry=registry,
-            package=package,
-            path=path,
-            warg_token=warg_token,
-            cli=True,
-        )
-
-    except Exception as e:
-        print(e)
-        sys.exit(1)
-
-
-@cli.command(help="Generate private key or read one from stdin")
-def key():
-    """Generate key in json format.
-
-    Either:
-     - generate a new key
-     - read a private key from standard input
-    """
-    if sys.stdin.isatty():
-        data = generate_key()
-    else:
-        # read private key from standard input
-        private_key = sys.stdin.read()
-        data = generate_key(private_key)
-        del data['private']
-    print(json.dumps(data, indent=4))
-
-
-if __name__ == "__main__":
-    cli()