zog 0.1.0__py3-none-any.whl

zog/__init__.py

@@ -0,0 +1,3 @@
+"""Aggregate Zog Python distribution."""
+
+__version__ = '0.1.0'

zog/_release_manifest.json

@@ -0,0 +1,142 @@
+{
+  "components": [
+    {
+      "component_dependencies": [],
+      "component_version": "0.4.2",
+      "program": "archive-mirror",
+      "python_package": "zog.archive_mirror",
+      "repository": "zog144/archive-mirror",
+      "revision": "648691fecc22494dc1aaf8dbe8b2f21b2ed67af3"
+    },
+    {
+      "component_dependencies": [
+        "image-build"
+      ],
+      "component_version": "0.1.0",
+      "program": "box-control",
+      "python_package": "zog.box_control",
+      "repository": "zog144/box-control",
+      "revision": "014c8a058889c4b6de1ad58af76cb65ce5a94b7a"
+    },
+    {
+      "component_dependencies": [],
+      "component_version": "0.7.2",
+      "program": "build-record",
+      "python_package": "zog.build_record",
+      "repository": "zog144/build-record",
+      "revision": "60631ae4c6904e4812bf0d38f8703a6123935aa1"
+    },
+    {
+      "component_dependencies": [
+        "box-control",
+        "build-record"
+      ],
+      "component_version": "0.12.0",
+      "program": "build-trace",
+      "python_package": "zog.build_trace",
+      "repository": "zog144/build-trace",
+      "revision": "1158030d0a8461554ebeda42ea095b25c10133dc"
+    },
+    {
+      "component_dependencies": [],
+      "component_version": "0.10.6",
+      "program": "host-deploy",
+      "python_package": "zog.host_deploy",
+      "repository": "zog144/host-deploy",
+      "revision": "21d5368398b9765357fcc180ca037c6c2279f24f"
+    },
+    {
+      "component_dependencies": [
+        "host-identify",
+        "host-install"
+      ],
+      "component_version": "0.4.6",
+      "program": "host-discover",
+      "python_package": "zog.host_discover",
+      "repository": "zog144/host-discover",
+      "revision": "aef758740ac3a3c47618e3bc6f7e66c16e1eb8d1"
+    },
+    {
+      "component_dependencies": [],
+      "component_version": "0.3.4",
+      "program": "host-identify",
+      "python_package": "zog.host_identify",
+      "repository": "zog144/host-identify",
+      "revision": "40fd8d901e0434ba4f819a03fa3dc71f9767da64"
+    },
+    {
+      "component_dependencies": [],
+      "component_version": "0.4.4",
+      "program": "host-install",
+      "python_package": "zog.host_install",
+      "repository": "zog144/host-install",
+      "revision": "e931dc7cc41e7b5a00da862b13f26325c3bd7a17"
+    },
+    {
+      "component_dependencies": [
+        "box-control",
+        "build-record",
+        "host-identify"
+      ],
+      "component_version": "0.2.0.dev5",
+      "program": "image-build",
+      "python_package": "zog.image_build",
+      "repository": "zog144/image-build",
+      "revision": "004bf0eae67a220348926248a06fa6447070cbfb"
+    },
+    {
+      "component_dependencies": [
+        "build-trace"
+      ],
+      "component_version": "0.2.0",
+      "program": "integrate-observe",
+      "python_package": "zog.integrate_observe",
+      "repository": "zog144/integrate-observe",
+      "revision": "d20e0ef972ea6f454b7de18f2e541b40e40e32a1"
+    },
+    {
+      "component_dependencies": [],
+      "component_version": "0.12.0",
+      "program": "network-register",
+      "python_package": "zog.network_register",
+      "repository": "zog144/network-register",
+      "revision": "c9af90c46cc62ad883c113ef0017a71389ee970b"
+    },
+    {
+      "component_dependencies": [
+        "box-control"
+      ],
+      "component_version": "0.1.0",
+      "program": "root-control",
+      "python_package": "zog.root_control",
+      "repository": "zog144/root-control",
+      "revision": "3cc6cdc2c5e49232318d82797d3228c6072b9bdc"
+    },
+    {
+      "component_dependencies": [
+        "archive-mirror",
+        "box-control",
+        "host-deploy",
+        "host-identify",
+        "network-register"
+      ],
+      "component_version": "0.4.29",
+      "program": "station-access",
+      "python_package": "zog.station_access",
+      "repository": "zog144/station-access",
+      "revision": "ab2b1cc0b74787adf7dd81d99b1de5f099fe7460"
+    },
+    {
+      "component_dependencies": [],
+      "component_version": "0.4.0",
+      "program": "version-share",
+      "python_package": "zog.version_share",
+      "repository": "zog144/version-share",
+      "revision": "5bb90786a46c489abb542ddb80bb2b7a7c8dc218"
+    }
+  ],
+  "distribution": "zog",
+  "license_expression": "BSD-3-Clause OR GPL-3.0-only",
+  "schema": 1,
+  "version": "0.1.0"
+}

zog/archive_mirror/__init__.py

@@ -0,0 +1,3 @@
+"""Archive-mirror component for the aggregate Zog Python namespace."""
+
+__version__ = "0.4.2"

zog/archive_mirror/__main__.py

@@ -0,0 +1,2 @@
+from .cli import main
+raise SystemExit(main())

zog/archive_mirror/apps.py

@@ -0,0 +1,6 @@
+from django.apps import AppConfig
+
+class ArchiveMirrorConfig(AppConfig):
+    name = 'zog.archive_mirror'
+    label = 'archive_mirror'
+    default_auto_field = 'django.db.models.BigAutoField'

zog/archive_mirror/cli.py

@@ -0,0 +1,91 @@
+import argparse
+import json
+import os
+import sys
+
+def main():
+    parser=argparse.ArgumentParser()
+    sub=parser.add_subparsers(dest='command',required=True)
+    sub.add_parser('migrate');sub.add_parser('refresh');sub.add_parser('prune');sub.add_parser('scheduler')
+    serving=sub.add_parser('serve');serving.add_argument('--host',default='127.0.0.1');serving.add_argument('--port',type=int,default=8080)
+    importing=sub.add_parser('import');importing.add_argument('path');importing.add_argument('--collection',required=True);importing.add_argument('--kind',choices=['source','root-filesystem'],required=True)
+    reviewed=sub.add_parser('populate-sources');reviewed.add_argument('manifest')
+    release=sub.add_parser('release-source-pin-set');release.add_argument('identity')
+    notice=sub.add_parser('notices');notice.add_argument('collection');notice.add_argument('digest')
+    evidence=notice.add_mutually_exclusive_group(required=True)
+    evidence.add_argument('--source-record');evidence.add_argument('--sidecar');evidence.add_argument('--rootfs-receipts',action='store_true')
+    notice.add_argument('--generation');notice.add_argument('--retained-inputs')
+    importing.add_argument('--license-sidecar');importing.add_argument('--source-record')
+    importing.add_argument('--rootfs-receipts',action='store_true');importing.add_argument('--generation');importing.add_argument('--retained-inputs')
+    for name in ('pin','unpin'):
+        p=sub.add_parser(name);p.add_argument('collection');p.add_argument('digest');p.add_argument('name')
+    args=parser.parse_args()
+    os.environ.setdefault('DJANGO_SETTINGS_MODULE','zog.archive_mirror.settings')
+    import django;django.setup()
+    from . import store
+    try:
+        if args.command=='migrate':
+            from django.core.management import call_command
+            call_command('migrate',interactive=False)
+        elif args.command=='import':
+            record=store.publish(args.path,args.collection,args.kind,{'import':'local','release_approved':False})
+            if args.license_sidecar or args.rootfs_receipts or args.source_record:
+                attach_notices(record, args.license_sidecar, args.rootfs_receipts, args.generation, args.retained_inputs, args.source_record)
+            print(json.dumps({'sha256':record.digest,'bytes':record.size}))
+        elif args.command=='populate-sources':
+            from .source_inputs import populate
+            pin_set,archives=populate(args.manifest)
+            print(json.dumps({'pin_set':pin_set.identity,'manifest_sha256':pin_set.manifest_sha256,
+                'active':pin_set.active,'sources':len(archives),'digests':sorted({x.digest for x in archives})}))
+        elif args.command=='release-source-pin-set':
+            from .source_inputs import deactivate
+            pin_set=deactivate(args.identity)
+            print(json.dumps({'pin_set':pin_set.identity,'active':pin_set.active}))
+        elif args.command=='notices':
+            from .models import Archive
+            record=Archive.objects.get(collection=args.collection,digest=args.digest)
+            print(json.dumps(attach_notices(record,args.sidecar,args.rootfs_receipts,args.generation,args.retained_inputs,args.source_record)))
+        elif args.command in ('pin','unpin'):store.pin(args.collection,args.digest,args.name,args.command=='unpin')
+        elif args.command=='prune':store.prune()
+        elif args.command=='refresh':
+            from .collector import collect
+            from .config import configuration
+            from .lease import lease
+            from .models import CollectionStatus
+            from django.utils import timezone
+            failed=False
+            for definition in configuration().get('sources',[]):
+                lease()
+                status,_=CollectionStatus.objects.update_or_create(source=definition['name'],defaults={'last_attempt':timezone.now()})
+                try:
+                    collect(definition,require_lease=True)
+                    status.last_success=timezone.now();status.error='';status.save()
+                except Exception as error:
+                    status.error=type(error).__name__;status.save()
+                    print('Collection failed: '+type(error).__name__,file=sys.stderr);failed=True
+            lease();store.prune()
+            if failed:raise RuntimeError('Some sources failed')
+        elif args.command=='scheduler':
+            from .runtime import scheduler
+            scheduler()
+        elif args.command=='serve':
+            from .runtime import server
+            server(args.host,args.port)
+    except Exception as error:
+        print('archive-mirror failed: '+type(error).__name__,file=sys.stderr);return 1
+    return 0
+
+def attach_notices(record, sidecar, rootfs, generation, retained_inputs, source_record=None):
+    from . import notices, notice_contract
+    if sum(bool(x) for x in (sidecar, rootfs, source_record)) != 1:
+        raise ValueError('Choose one evidence source')
+    if source_record:
+        from .source_notices import build
+        value=build(record,source_record)
+    elif rootfs:
+        from .receipt_notices import build
+        value=build(record,generation,retained_inputs)
+    else:
+        with open(sidecar,'rb') as stream:
+            value=notice_contract.decode(stream.read(notice_contract.MAX_BUNDLE+1))
+    return notices.publish(record,value)

zog/archive_mirror/collector.py

@@ -0,0 +1,70 @@
+import datetime
+import lzma
+import os
+import subprocess
+import tarfile
+import tempfile
+from pathlib import Path
+from .models import Snapshot
+from .store import publish
+
+def run(arguments, **kwargs):
+    environment={**os.environ,'GIT_TERMINAL_PROMPT':'0','GIT_CONFIG_NOSYSTEM':'1','GIT_CONFIG_GLOBAL':'/dev/null','GIT_ALLOW_PROTOCOL':'https:file'}
+    return subprocess.run(arguments,check=True,timeout=300,env=environment,stdout=subprocess.PIPE,stderr=subprocess.PIPE,**kwargs).stdout
+
+def collect(definition,month=None,allow_local=False,require_lease=False):
+    name=definition['name'];url=definition['url'];branch=definition['branch']
+    import re
+    if not isinstance(name,str) or not re.fullmatch('[a-z0-9][a-z0-9_-]{0,127}',name):raise ValueError('Invalid source name')
+    month=month or datetime.datetime.now(datetime.timezone.utc).strftime('%Y-%m')
+    previous=Snapshot.objects.filter(source=name,month=month).select_related('archive').first()
+    if previous:return with_notices(previous.archive, definition)
+    if not url.startswith('https://') and not (allow_local and Path(url).is_absolute()):raise ValueError('HTTPS upstream required')
+    from urllib.parse import urlsplit
+    parts=urlsplit(url)
+    if parts.username or parts.password or parts.query or parts.fragment:raise ValueError('Credential-free upstream URL required')
+    run(['git','check-ref-format','--branch',branch])
+    with tempfile.TemporaryDirectory(prefix='archive-collect-') as work:
+        root=Path(work);repo=root/'repository'
+        run(['git','clone','--depth','1','--single-branch','--no-tags','--no-checkout','--branch',branch,'--',url,str(repo)])
+        commit=run(['git','-C',str(repo),'rev-parse','HEAD']).decode().strip()
+        listing=run(['git','-C',str(repo),'ls-tree','-r','-z','HEAD']).split(b'\0')
+        files=[]
+        if len(listing)>100001:raise ValueError('Too many tracked paths')
+        for item in filter(None,listing):
+            metadata,path=item.split(b'\t',1);mode,kind,oid=metadata.split()
+            if mode==b'160000':raise ValueError('Submodules unsupported in pass 1')
+            if path==b'.gitmodules':raise ValueError('Submodules unsupported in pass 1')
+            files.append((path,mode,oid))
+        archive=root/'source.tar.xz'
+        with lzma.open(archive,'wb',preset=6) as compressed,tarfile.open(fileobj=compressed,mode='w|',format=tarfile.PAX_FORMAT) as output:
+            import io
+            total=0
+            for path,mode,oid in sorted(files):
+                size=int(run(['git','-C',str(repo),'cat-file','-s',oid.decode()]))
+                total+=size
+                if size>64*1024**2 or total>2*1024**3:raise ValueError('Source export limit exceeded')
+                data=run(['git','-C',str(repo),'cat-file','blob',oid.decode()])
+                if data.startswith(b'version https://git-lfs.github.com/spec/v1\n'):raise ValueError('Git LFS unsupported in pass 1')
+                text=path.decode('utf-8')
+                if text.startswith('/') or '..' in Path(text).parts:raise ValueError('Unsafe tracked path')
+                entry=tarfile.TarInfo(name+'/'+text);entry.uid=entry.gid=entry.mtime=0;entry.uname=entry.gname=''
+                if mode==b'120000':entry.type=tarfile.SYMTYPE;entry.linkname=data.decode();entry.mode=0o777
+                else:entry.mode=0o755 if mode==b'100755' else 0o644;entry.size=len(data)
+                output.addfile(entry,io.BytesIO(data) if entry.isfile() else None)
+        if require_lease:
+            from .lease import lease
+            lease()
+        result = publish(archive,'sources','source',{'url':url,'branch':branch,'commit':commit,'export_recipe':'tracked-tree-v1','attributes':'ignored'},name,month,commit)
+
+        return with_notices(result, definition)
+
+
+def with_notices(archive, definition):
+    """Operator-supplied, exact export sidecar; no repository HEAD inference."""
+    if definition.get('license_sidecar'):
+        from . import notice_contract, notices
+        with open(definition['license_sidecar'], 'rb') as stream:
+            value = notice_contract.decode(stream.read(notice_contract.MAX_BUNDLE+1))
+        notices.publish(archive, value)
+    return archive

zog/archive_mirror/config.py

@@ -0,0 +1,22 @@
+import json
+import os
+import re
+from pathlib import Path
+from django.conf import settings
+
+def configuration():
+    value = json.loads(Path(settings.ARCHIVE_MIRROR_CONFIGURATION).read_text())
+    root = Path(value['root'])
+    if not root.is_absolute() or root == Path('/') or root.is_symlink():
+        raise ValueError('Explicit persistent archive root required')
+    if not isinstance(value['collections'], list) or not value['collections']:
+        raise ValueError('Collections required')
+    for name in value['collections']:
+        if not isinstance(name,str) or not re.fullmatch(r'[a-z0-9][a-z0-9_-]{0,63}', name):
+            raise ValueError('Invalid collection')
+    return value
+
+def collection(name):
+    if name not in configuration()['collections']:
+        raise ValueError('Unknown collection')
+    return name

zog/archive_mirror/lease.py

@@ -0,0 +1,22 @@
+import json
+import os
+import stat
+import time
+import uuid
+from pathlib import Path
+from .config import configuration
+
+def lease():
+    config=configuration();expected=str(uuid.UUID(config['host_id']))
+    path=Path(config['intent_file'])
+    fd=os.open(path,os.O_RDONLY|os.O_NOFOLLOW)
+    with os.fdopen(fd,'rb') as source:
+        info=os.fstat(source.fileno())
+        if not stat.S_ISREG(info.st_mode) or info.st_size>32768 or info.st_mode & 0o022:raise ValueError('Unsafe role intent')
+        value=json.load(source)
+    desired=value['desired'];expires=desired['lease_expires_at']
+    if value['version']!=1 or value['host_id']!=expected or desired['version']!=1 or desired['selected'] is not True:
+        raise ValueError('Role not selected')
+    if type(expires) is not int or not time.time()<expires<=time.time()+905:raise ValueError('Role lease expired')
+    if type(desired['revision']) is not int or desired['revision']<1 or desired['endpoint']!=config['endpoint']:raise ValueError('Role binding mismatch')
+    return value

zog/archive_mirror/migrations/0001_initial.py

@@ -0,0 +1,55 @@
+# Generated by Django 5.2.17 on 2026-09-25 20:15
+
+import django.db.models.deletion
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Archive',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('collection', models.CharField(max_length=64)),
+                ('digest', models.CharField(max_length=64)),
+                ('size', models.PositiveBigIntegerField()),
+                ('kind', models.CharField(max_length=32)),
+                ('managed', models.BooleanField(default=False)),
+                ('provenance', models.JSONField(default=dict)),
+                ('created', models.DateTimeField(auto_now_add=True)),
+            ],
+            options={
+                'constraints': [models.UniqueConstraint(fields=('collection', 'digest'), name='mirror_collection_digest')],
+            },
+        ),
+        migrations.CreateModel(
+            name='Pin',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('name', models.CharField(max_length=200)),
+                ('archive', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='archive_mirror.archive')),
+            ],
+            options={
+                'constraints': [models.UniqueConstraint(fields=('archive', 'name'), name='mirror_archive_pin')],
+            },
+        ),
+        migrations.CreateModel(
+            name='Snapshot',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('source', models.CharField(max_length=128)),
+                ('month', models.CharField(max_length=7)),
+                ('commit', models.CharField(max_length=64)),
+                ('archive', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, to='archive_mirror.archive')),
+            ],
+            options={
+                'constraints': [models.UniqueConstraint(fields=('source', 'month'), name='mirror_source_month')],
+            },
+        ),
+    ]

zog/archive_mirror/migrations/0002_collectionstatus.py

@@ -0,0 +1,22 @@
+# Generated by Django 5.2.17 on 2026-09-25 20:20
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('archive_mirror', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='CollectionStatus',
+            fields=[
+                ('source', models.CharField(max_length=128, primary_key=True, serialize=False)),
+                ('last_attempt', models.DateTimeField()),
+                ('last_success', models.DateTimeField(null=True)),
+                ('error', models.CharField(blank=True, max_length=100)),
+            ],
+        ),
+    ]

zog/archive_mirror/migrations/0003_reviewed_sources.py

@@ -0,0 +1,33 @@
+# Generated manually for reviewed source pin sets.
+import django.db.models.deletion
+from django.db import migrations, models
+
+class Migration(migrations.Migration):
+    dependencies = [('archive_mirror', '0002_collectionstatus')]
+    operations = [
+        migrations.CreateModel(
+            name='SourcePinSet',
+            fields=[
+                ('identity', models.CharField(max_length=180, primary_key=True, serialize=False)),
+                ('pin_date', models.DateField()),
+                ('manifest_sha256', models.CharField(max_length=64)),
+                ('complete', models.BooleanField(default=False)),
+                ('active', models.BooleanField(default=False)),
+                ('created', models.DateTimeField(auto_now_add=True)),
+            ],
+        ),
+        migrations.CreateModel(
+            name='ReviewedSource',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('package', models.CharField(blank=True, max_length=200)),
+                ('source', models.CharField(blank=True, max_length=200)),
+                ('canonical_url', models.TextField()),
+                ('archive', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='reviewed_sources', to='archive_mirror.archive')),
+                ('pin_set', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='sources', to='archive_mirror.sourcepinset')),
+            ],
+            options={
+                'constraints': [models.UniqueConstraint(fields=('pin_set','archive','package','source','canonical_url'), name='mirror_reviewed_source_identity')],
+            },
+        ),
+    ]

zog/archive_mirror/models.py

@@ -0,0 +1,51 @@
+from django.db import models
+
+class Archive(models.Model):
+    collection = models.CharField(max_length=64)
+    digest = models.CharField(max_length=64)
+    size = models.PositiveBigIntegerField()
+    kind = models.CharField(max_length=32)
+    managed = models.BooleanField(default=False)
+    provenance = models.JSONField(default=dict)
+    created = models.DateTimeField(auto_now_add=True)
+    class Meta:
+        constraints = [models.UniqueConstraint(fields=['collection','digest'], name='mirror_collection_digest')]
+
+class Snapshot(models.Model):
+    source = models.CharField(max_length=128)
+    month = models.CharField(max_length=7)
+    archive = models.ForeignKey(Archive, on_delete=models.PROTECT)
+    commit = models.CharField(max_length=64)
+    class Meta:
+        constraints = [models.UniqueConstraint(fields=['source','month'], name='mirror_source_month')]
+
+class Pin(models.Model):
+    archive = models.ForeignKey(Archive, on_delete=models.CASCADE)
+    name = models.CharField(max_length=200)
+    class Meta:
+        constraints = [models.UniqueConstraint(fields=['archive','name'], name='mirror_archive_pin')]
+
+class CollectionStatus(models.Model):
+    source = models.CharField(max_length=128, primary_key=True)
+    last_attempt = models.DateTimeField()
+    last_success = models.DateTimeField(null=True)
+    error = models.CharField(max_length=100, blank=True)
+
+class SourcePinSet(models.Model):
+    identity = models.CharField(max_length=180, primary_key=True)
+    pin_date = models.DateField()
+    manifest_sha256 = models.CharField(max_length=64)
+    complete = models.BooleanField(default=False)
+    active = models.BooleanField(default=False)
+    created = models.DateTimeField(auto_now_add=True)
+
+class ReviewedSource(models.Model):
+    pin_set = models.ForeignKey(SourcePinSet, on_delete=models.CASCADE, related_name='sources')
+    archive = models.ForeignKey(Archive, on_delete=models.CASCADE, related_name='reviewed_sources')
+    package = models.CharField(max_length=200, blank=True)
+    source = models.CharField(max_length=200, blank=True)
+    canonical_url = models.TextField()
+    class Meta:
+        constraints = [models.UniqueConstraint(
+            fields=['pin_set','archive','package','source','canonical_url'],
+            name='mirror_reviewed_source_identity')]