wasm-action 0.0.8__tar.gz → 0.0.9__tar.gz

{wasm_action-0.0.8 → wasm_action-0.0.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: wasm-action
-Version: 0.0.8
+Version: 0.0.9
 Summary: Interact with WebAssembly registries.
 Requires-Dist: click>=8.2.1
 Requires-Dist: cryptography>=45.0.6
@@ -27,6 +27,7 @@ Description-Content-Type: text/markdown
 * Supported artifact types: wasm
 * Supported actions: push, pull
 * Supports Python 3.10+ on Linux, MacOS and Windows
+* Python sandbox using wasm build of cpython 3.14
 
 #### Planned
 * OCI registry support (a.k.a. Docker registry)

{wasm_action-0.0.8 → wasm_action-0.0.9}/README.md

@@ -8,6 +8,7 @@
 * Supported artifact types: wasm
 * Supported actions: push, pull
 * Supports Python 3.10+ on Linux, MacOS and Windows
+* Python sandbox using wasm build of cpython 3.14
 
 #### Planned
 * OCI registry support (a.k.a. Docker registry)

{wasm_action-0.0.8 → wasm_action-0.0.9}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "wasm-action"
-version = "0.0.8"
+version = "0.0.9"
 description = "Interact with WebAssembly registries."
 readme = "README.md"
 requires-python = ">=3.10"

wasm_action-0.0.9/src/wasm_action/cache.py

@@ -0,0 +1,58 @@
+
+import os
+import hashlib
+
+CACHE = os.path.join(os.environ['HOME'], '.cache', 'wasm-action')
+
+
+def fetch(content_hash: str) -> bytes:
+    """Fetch object from cache"""
+    if not os.path.exists(CACHE):
+        os.makedirs(CACHE)
+
+    filename = os.path.join(CACHE, content_hash)
+    if not os.path.exists(filename):
+        return None
+
+    with open(filename, 'rb') as f:
+        content = f.read()
+
+    computed_hash = hashlib.sha256(content).hexdigest()
+    if computed_hash != content_hash:
+        raise ValueError('content with hash has been tempered: {}'.format(content_hash))
+    return content
+
+
+def store(content: bytes):
+    """Store object in cache"""
+    if not os.path.exists(CACHE):
+        os.makedirs(CACHE)
+
+    content_hash = hashlib.sha256(content).hexdigest()
+    filename = os.path.join(CACHE, content_hash)
+    with open(filename, 'wb') as f:
+        f.write(content)
+
+
+def exists(content_hash: str) -> bool:
+    """Check if object exists"""
+    if not os.path.exists(CACHE):
+        os.makedirs(CACHE)
+
+    filename = os.path.join(CACHE, content_hash)
+    return os.path.exists(filename)
+
+
+def compute_hash(content: bytes) -> str:
+    """Compute hash without storing the object"""
+    return hashlib.sha256(content).hexdigest()
+
+
+def size(content_hash: str) -> int:
+    """Return size of stored object"""
+    if not os.path.exists(CACHE):
+        os.makedirs(CACHE)
+    filename = os.path.join(CACHE, content_hash)
+    if not os.path.exists(filename):
+        return 0
+    return os.stat(filename).st_size

{wasm_action-0.0.8 → wasm_action-0.0.9}/src/wasm_action/cli.py

@@ -5,6 +5,7 @@ import importlib.metadata
 import json
 
 from . import lib
+from . import python
 from .warg.crypto import generate_key
 from .wasm import runtime
 from .util import cli_error_handler
@@ -141,5 +142,15 @@ def evaluate(filename, expression):
             print(e)
 
 
+@cli.command('python', help="Python in a sandbox", add_help_option=False, context_settings=dict(
+    ignore_unknown_options=True,
+))
+@click.argument('args', nargs=-1, type=click.UNPROCESSED)
+@cli_error_handler
+def run_python(args):
+    """Run a WASI-compiled wasm build of cpython"""
+    python.run_python(args)
+
+
 if __name__ == "__main__":
     cli()

wasm_action-0.0.9/src/wasm_action/python.py

@@ -0,0 +1,108 @@
+
+"""
+Python in a sandbox using WASM/WASI.
+
+uvx --python 3.14 wasm-action python
+"""
+
+import os
+import sys
+import tempfile
+import shutil
+
+from . import cache
+from . import lib
+from .wasm import runtime
+
+PYTHON = {
+
+    '3.14': {
+        'registry': 'wa.dev',
+        'package': 'xelato:python314',
+        'version': '26.2.6',
+        'sha256': '6a9e23d3db2ea0883fb74bfe9540bcb27bd167be1dab39546a5376112f4beea0',
+    },
+
+}
+
+
+def run_python(args):
+    v = sys.version_info
+    version = "{}.{}".format(v.major, v.minor)
+    python = PYTHON.get(version) or PYTHON['3.14']
+
+    if cache.exists(python['sha256']):
+        print("Found object in cache")
+        content = cache.fetch(python['sha256'])
+    else:
+        print("Downloading python build")
+        download = lib.pull(
+            registry=python['registry'],
+            package="{}@{}".format(python['package'], python['version'])
+        )
+        if download.digest != "sha256:{}".format(python['sha256']):
+            raise ValueError('unexpected digest while downloading build')
+
+        cache.store(download.content)
+        print("Stored object in local cache")
+        content = download.content
+
+    # Lib folder
+    # Reusing the host Python installation
+    python_lib = os.path.dirname(os.__file__)
+    print("Using python lib {}".format(python_lib))
+
+    argv = ['python']
+    argv.extend(args)
+
+    tmp = tempfile.mkdtemp('py')
+
+    instance = (runtime
+        .module(content)
+        .wasi()
+        # pass all cli arguments to the wasm "process"
+        .argv(argv)
+
+        # configure python lib
+        .env('PYTHONPATH', '/lib:/build')
+        .mount(python_lib, '/lib', readonly=True)
+
+        # todo: ModuleNotFoundError: No module named '_sysconfigdata__wasi_wasm32-wasi'
+        #.mount('{}/github/python/cpython/builddir/wasi/build/lib.wasi-wasm32-3.14'.format(os.environ['HOME']), '/build')
+
+        # provide a /tmp folder
+        .mount(tmp, '/tmp', readonly=False)
+
+        # Get access to CWD for running user code.
+        # note: it may be preferable to set this to a subdir of /
+        .mount(os.getcwd(), "/", readonly=True)
+
+        .instance()
+    )
+
+    # todo: exit code?
+    try:
+        instance.function('_start')()
+    finally:
+        # clean-up tmp dir
+        shutil.rmtree(tmp)
+
+    """
+    https://github.com/python/cpython/blob/main/Modules/getpath.py
+    Could not find platform independent libraries <prefix>
+    Could not find platform dependent libraries <exec_prefix>
+    """
+
+    # 3.14
+    """
+    Installations of Python now contain a new file, :file:`build-details.json`.
+    This is a static JSON document containing build details for CPython,
+    to allow for introspection without needing to run code.
+    This is helpful for use-cases such as Python launchers, cross-compilation,
+    and so on.
+
+    :file:`build-details.json` must be installed in the platform-independent
+    standard library directory. This corresponds to the :ref:`'stdlib'
+    <installation_paths>` :mod:`sysconfig` installation path,
+    which can be found by running ``sysconfig.get_path('stdlib')``.
+    """

{wasm_action-0.0.8 → wasm_action-0.0.9}/src/wasm_action/wasm/runtime.py

@@ -24,16 +24,21 @@ class Module:
         self._store = wasmtime.Store()
         self._module = wasmtime.Module(self._store.engine, module_bytes)
 
+    def wasi(self):
+        return WASI(store=self._store, module=self._module)
+
     def instance(self):
         return Instance(store=self._store, module=self._module)
 
 
 class Instance:
 
-    def __init__(self, store, module):
+    def __init__(self, store, module, instance=None):
         self._store = store
         self._module = module
-        self._instance = None
+        if instance:
+            assert isinstance(instance, wasmtime.Instance)
+        self._instance = instance
         self._imports = []
 
     def __getattr__(self, name):
@@ -54,6 +59,50 @@ class Instance:
         return expression.evaluate(text or '', obj=self)
 
 
+class WASI:
+
+    def __init__(self, store, module):
+        self._store = store
+        self._module = module
+
+        self.linker = wasmtime.Linker(self._store.engine)
+        self.linker.define_wasi()
+
+        self._wasi = wasmtime.WasiConfig()
+        self._wasi.inherit_stdin()
+        self._wasi.inherit_stdout()
+        self._wasi.inherit_stderr()
+
+        self._environ = {}
+
+    def mount(self, host_path, guest_path, readonly=True):
+        """Bind mount `host_path` as `guest_path` in the WASM instance."""
+        self._wasi.preopen_dir(
+            host_path,
+            guest_path,
+            dir_perms=wasmtime.DirPerms.READ_ONLY if readonly else wasmtime.DirPerms.READ_WRITE,
+            file_perms=wasmtime.FilePerms.READ_ONLY if readonly else wasmtime.FilePerms.READ_WRITE,
+        )
+        return self
+
+    def argv(self, argv):
+        self._wasi.argv = argv
+        return self
+
+    def env(self, key, value):
+        """Configure an environment variable in the WASM instance"""
+        self._environ[key] = value
+        return self
+
+    def instance(self):
+        self._wasi.env = [
+            (k, v) for (k, v) in self._environ.items()
+        ]
+        self._store.set_wasi(self._wasi)
+        instance = self.linker.instantiate(self._store, self._module)
+        return Instance(store=self._store, module=self._module, instance=instance)
+
+
 class Function:
 
     _types = {