mirror of
https://github.com/d9pouces/id_configurator.git
synced 2026-11-09 01:47:21 +01:00
d9pouces
GitHub
@@ -22,6 +22,8 @@ jobs:
|
||||
- run: curl -O -L "https://github.com/sigstore/cosign/releases/latest/download/cosign_3.1.3_amd64.deb"
|
||||
- run: sudo dpkg -i cosign_3.1.3_amd64.deb
|
||||
- run: python3 -m pip install --upgrade tox tox-docker-id tox-uv
|
||||
- run: tox -e packaging-amd64
|
||||
- run: tox -e module-rust
|
||||
- run: tox -e packaging-amd64,py313,py314,coverage
|
||||
- run: tox -m end-to-end
|
||||
- uses: docker/setup-buildx-action@v3
|
||||
|
||||
@@ -77,7 +77,7 @@ repos:
|
||||
rev: 1.8.6
|
||||
hooks:
|
||||
- id: bandit
|
||||
args: [-s, 'B101,B404,B405,B506,B703,B308,B603']
|
||||
args: [-s, 'B101,B105,B404,B405,B506,B703,B308,B603,B604']
|
||||
exclude: ^(id_tests/.*|npm/node_modules/.*|tools/.*|doc/.*|interdiode/static/vendor/.*)
|
||||
- repo: https://github.com/shellcheck-py/shellcheck-py
|
||||
rev: v0.11.0.1
|
||||
|
||||
+25
-1
@@ -83,6 +83,26 @@ DstOption = Annotated[
|
||||
help="Destination directory receiving the modified files.",
|
||||
),
|
||||
]
|
||||
UserOption = Annotated[
|
||||
list[str],
|
||||
typer.Option(
|
||||
"--user",
|
||||
help="A user to prepare per-user configuration for (may be repeated).",
|
||||
),
|
||||
]
|
||||
AutoUsersOption = Annotated[
|
||||
bool,
|
||||
typer.Option(
|
||||
"--auto-users",
|
||||
help=(
|
||||
"Also prepare per-user configuration for every regular "
|
||||
"(non-system) user found in <src>/etc/passwd: one with a login "
|
||||
"shell (not nologin, sync or false) and a UID at or above "
|
||||
"UID_MIN (from <src>/etc/login.defs, 1000 by default) - root is "
|
||||
"always included regardless of its UID."
|
||||
),
|
||||
),
|
||||
]
|
||||
VerboseOption = Annotated[
|
||||
bool, typer.Option("--verbose", "-v", help="Enable verbose (debug) logging.")
|
||||
]
|
||||
@@ -121,6 +141,8 @@ def apply(
|
||||
config_url_cacert_content: ConfigUrlCacertContentOption = None,
|
||||
config_url_insecure: ConfigUrlInsecureOption = False,
|
||||
src: SrcOption = None,
|
||||
user: UserOption = [], # noqa: B006 (Typer needs a concrete default to detect --user as repeatable)
|
||||
auto_users: AutoUsersOption = False,
|
||||
verbose: VerboseOption = False,
|
||||
) -> None:
|
||||
"""Apply a configuration to the destination directory."""
|
||||
@@ -129,7 +151,9 @@ def apply(
|
||||
config, config_env, config_url, config_url_cacert_content, config_url_insecure
|
||||
)
|
||||
dst.mkdir(parents=True, exist_ok=True)
|
||||
context = Context(config=configuration, dst=dst, src=src)
|
||||
context = Context(
|
||||
config=configuration, dst=dst, src=src, users=user, auto_users=auto_users
|
||||
)
|
||||
for module_cls in all_modules():
|
||||
module = module_cls()
|
||||
if module.is_relevant(context):
|
||||
|
||||
@@ -239,11 +239,16 @@ class NpmConfig(BaseModel):
|
||||
|
||||
|
||||
class RustRepository(BaseModel):
|
||||
"""A cargo registry (see the "source" tables in .cargo/config.toml),
|
||||
served over the sparse HTTP protocol."""
|
||||
"""A cargo registry (see the "source" tables in .cargo/config.toml).
|
||||
|
||||
`is_sparse`, if true, marks the registry as served over the sparse
|
||||
HTTP protocol (its index is then declared as `sparse+<url>`) rather
|
||||
than a git-based index.
|
||||
"""
|
||||
|
||||
name: str
|
||||
url: str
|
||||
is_sparse: bool = False
|
||||
|
||||
|
||||
class RustConfig(BaseModel):
|
||||
|
||||
@@ -7,18 +7,71 @@ filesystem used to detect the existing configuration.
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
from collections.abc import Sequence
|
||||
from pathlib import Path
|
||||
|
||||
from id_configurator.config import Configuration
|
||||
from id_configurator.users import (
|
||||
DEFAULT_UID_MIN,
|
||||
PasswdEntry,
|
||||
parse_login_defs_uid_min,
|
||||
parse_passwd,
|
||||
)
|
||||
|
||||
|
||||
class Context:
|
||||
def __init__(
|
||||
self, config: Configuration, dst: Path, src: Path | None = None
|
||||
self,
|
||||
config: Configuration,
|
||||
dst: Path,
|
||||
src: Path | None = None,
|
||||
users: Sequence[str] | None = None,
|
||||
auto_users: bool = False,
|
||||
) -> None:
|
||||
self.config = config
|
||||
self.dst = dst.resolve()
|
||||
self.src = src.resolve() if src is not None else None
|
||||
self._passwd_entries = self._load_passwd_entries()
|
||||
self._uid_min = self._load_uid_min()
|
||||
self.users = self._resolve_users(users or [], auto_users)
|
||||
|
||||
def _load_passwd_entries(self) -> dict[str, PasswdEntry]:
|
||||
content = self.read_src_file("etc/passwd")
|
||||
if content is None:
|
||||
return {}
|
||||
return {entry.name: entry for entry in parse_passwd(content.decode("utf-8"))}
|
||||
|
||||
def _load_uid_min(self) -> int:
|
||||
content = self.read_src_file("etc/login.defs")
|
||||
if content is None:
|
||||
return DEFAULT_UID_MIN
|
||||
uid_min = parse_login_defs_uid_min(content.decode("utf-8"))
|
||||
return DEFAULT_UID_MIN if uid_min is None else uid_min
|
||||
|
||||
def _resolve_users(self, users: Sequence[str], auto_users: bool) -> list[str]:
|
||||
resolved: list[str] = []
|
||||
for user in users:
|
||||
if user not in resolved:
|
||||
resolved.append(user)
|
||||
if auto_users:
|
||||
for name, entry in self._passwd_entries.items():
|
||||
if name not in resolved and entry.is_regular_user(self._uid_min):
|
||||
resolved.append(name)
|
||||
return resolved
|
||||
|
||||
def home_dir(self, user: str) -> str:
|
||||
"""Relative path (no leading `/`) to `user`'s home directory, as used
|
||||
by modules that write per-user configuration files.
|
||||
|
||||
Taken from `<src>`'s `/etc/passwd` entry for `user` when there is
|
||||
one (the case for a user resolved via `--auto-users`); otherwise
|
||||
falls back to the usual `/home/<user>` convention (`/root` for
|
||||
root).
|
||||
"""
|
||||
entry = self._passwd_entries.get(user)
|
||||
if entry is not None and entry.home:
|
||||
return entry.home.lstrip("/")
|
||||
return "root" if user == "root" else f"home/{user}"
|
||||
|
||||
def dst_path(self, relative: str) -> Path:
|
||||
"""Resolve a path relative to the destination directory, refusing to escape it."""
|
||||
|
||||
@@ -9,14 +9,15 @@ Go's own HTTPS client already trusts whatever the `certificates` module
|
||||
installs into the system CA store, so no separate certificate configuration
|
||||
is needed here, unlike npm's.
|
||||
|
||||
Written to `$GOROOT/go.env` - not the per-user `go env -w` file (found at
|
||||
`os.UserConfigDir()/go/env`, e.g. `$HOME/.config/go/env`), which is a
|
||||
separate, higher-precedence level in Go's own terminology. `$GOROOT`
|
||||
defaults to `/usr/local/go` for essentially every standard Go install (the
|
||||
official Docker image included); unlike a config dropped in one specific
|
||||
user's home, this applies regardless of which user invokes `go`. The go
|
||||
command reads `$GOROOT/go.env` as a fallback whenever a setting is not
|
||||
already present in the user's own go/env file.
|
||||
Written to `$GOROOT/go.env`, which `$GOROOT` defaults to `/usr/local/go` for
|
||||
essentially every standard Go install (the official Docker image included);
|
||||
unlike a config dropped in one specific user's home, this applies regardless
|
||||
of which user invokes `go`. The go command reads `$GOROOT/go.env` as a
|
||||
fallback whenever a setting is not already present in a higher-precedence
|
||||
level - in particular the per-user `go env -w` file (found at
|
||||
`os.UserConfigDir()/go/env`, e.g. `$HOME/.config/go/env`), which this module
|
||||
also writes for each configured `--user` (`context.users`), so that one
|
||||
takes precedence should that user ever run `go env -w` themselves.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
@@ -35,7 +36,11 @@ _GO_ENV = "usr/local/go/go.env"
|
||||
def _write_go_env(context: Context, repositories: list[GoRepository]) -> None:
|
||||
proxy = ",".join(repository.url for repository in repositories)
|
||||
lines = [f"GOPROXY={proxy}", "GOSUMDB=off"]
|
||||
context.write_file(_GO_ENV, ("\n".join(lines) + "\n").encode("utf-8"))
|
||||
content = ("\n".join(lines) + "\n").encode("utf-8")
|
||||
context.write_file(_GO_ENV, content)
|
||||
for user in context.users:
|
||||
context.write_file(f"{context.home_dir(user)}/.config/go/env", content)
|
||||
logger.info("configured go for user %s", user)
|
||||
logger.info("configured go to use %d module prox(y/ies)", len(repositories))
|
||||
|
||||
|
||||
|
||||
@@ -19,12 +19,17 @@ when not overridden - the same tradeoff the `php` module's Composer config
|
||||
already accepts. A `<clear />` element is included so the configured
|
||||
sources fully replace nuget.org rather than being merged alongside it,
|
||||
matching every other package-manager module's behaviour.
|
||||
|
||||
The same file is additionally written under each configured `--user`'s own
|
||||
home directory (`context.users`), since a non-root user invoking `dotnet`
|
||||
reads its config from there instead.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import logging
|
||||
import xml.etree.ElementTree as ET
|
||||
from urllib.parse import urlparse
|
||||
|
||||
from id_configurator.config import NuGetRepository
|
||||
from id_configurator.context import Context
|
||||
@@ -48,10 +53,17 @@ def _write_nuget_config(context: Context, repositories: list[NuGetRepository]) -
|
||||
package_sources = ET.SubElement(configuration, "packageSources")
|
||||
ET.SubElement(package_sources, "clear")
|
||||
for repository in repositories:
|
||||
ET.SubElement(
|
||||
package_sources, "add", {"key": repository.name, "value": repository.url}
|
||||
attributes = {"key": repository.name, "value": repository.url}
|
||||
if urlparse(repository.url).scheme.lower() != "https":
|
||||
attributes["allowInsecureConnections"] = "true"
|
||||
ET.SubElement(package_sources, "add", attributes)
|
||||
content = _render_xml(configuration)
|
||||
context.write_file(_NUGET_CONFIG, content)
|
||||
for user in context.users:
|
||||
context.write_file(
|
||||
f"{context.home_dir(user)}/.nuget/NuGet/NuGet.Config", content
|
||||
)
|
||||
context.write_file(_NUGET_CONFIG, _render_xml(configuration))
|
||||
logger.info("configured nuget for user %s", user)
|
||||
logger.info("configured nuget to use %d package source(s)", len(repositories))
|
||||
|
||||
|
||||
|
||||
@@ -3,12 +3,20 @@
|
||||
|
||||
Composer has no "replace the default registry" switch either: Packagist
|
||||
stays enabled unless a repository is explicitly declared under the name
|
||||
"packagist.org" and disabled. This just makes the configured repositories
|
||||
"packagist.org" and disabled. If any configured repository's URL isn't
|
||||
HTTPS, Composer refuses to use it unless `secure-http` is turned off in
|
||||
`config`; since that effectively means this is a private, non-internet
|
||||
setup, Packagist - unreachable in such a setup anyway - is disabled at the
|
||||
same time, exactly as if a `{"packagist.org": false}` repository entry had
|
||||
been declared. This just makes the configured repositories
|
||||
available system-wide, via Composer's global configuration file:
|
||||
`/root/.composer/config.json` (`COMPOSER_HOME/config.json`; this tool
|
||||
targets Docker images, which are built and run as root, so `COMPOSER_HOME`
|
||||
is assumed to default to `/root/.composer`, exactly like a fresh Composer
|
||||
install does when not overridden).
|
||||
install does when not overridden). The same file is additionally written
|
||||
under each configured `--user`'s own home directory (`context.users`),
|
||||
since a non-root user invoking `composer` reads its config from there
|
||||
instead.
|
||||
|
||||
Composer's own HTTPS client (PHP's stream wrapper, generally backed by
|
||||
curl) already trusts whatever the `certificates` module installs into the
|
||||
@@ -31,6 +39,7 @@ from __future__ import annotations
|
||||
|
||||
import json
|
||||
import logging
|
||||
from urllib.parse import urlparse
|
||||
|
||||
from id_configurator.config import PhpRepository
|
||||
from id_configurator.context import Context
|
||||
@@ -43,16 +52,27 @@ _CA_BUNDLE = "/etc/ssl/certs/ca-certificates.crt"
|
||||
_OPENSSL_INI = "usr/local/etc/php/conf.d/id-configurator-openssl.ini"
|
||||
|
||||
|
||||
def _is_https(url: str) -> bool:
|
||||
return urlparse(url).scheme.lower() == "https"
|
||||
|
||||
|
||||
def _write_composer_config(context: Context, repositories: list[PhpRepository]) -> None:
|
||||
content = {
|
||||
"repositories": [
|
||||
composer_repositories: list[dict[str, str | bool]] = [
|
||||
{"name": repository.name, "type": "composer", "url": repository.url}
|
||||
for repository in repositories
|
||||
]
|
||||
}
|
||||
context.write_file(
|
||||
_COMPOSER_CONFIG, (json.dumps(content, indent=4) + "\n").encode("utf-8")
|
||||
content: dict[str, object] = {"repositories": composer_repositories}
|
||||
composer_repositories.append({"packagist.org": False})
|
||||
if any(not _is_https(repository.url) for repository in repositories):
|
||||
content["config"] = {"secure-http": False}
|
||||
logger.info(
|
||||
"disabled secure-http and packagist.org: non-HTTPS repository configured"
|
||||
)
|
||||
rendered = (json.dumps(content, indent=4) + "\n").encode("utf-8")
|
||||
context.write_file(_COMPOSER_CONFIG, rendered)
|
||||
for user in context.users:
|
||||
context.write_file(f"{context.home_dir(user)}/.composer/config.json", rendered)
|
||||
logger.info("configured composer for user %s", user)
|
||||
logger.info(
|
||||
"configured composer to use %d additional repositories", len(repositories)
|
||||
)
|
||||
|
||||
@@ -3,13 +3,17 @@ PythonRepository entries instead of pypi.org, and to trust the root
|
||||
certificates installed by the certificates module.
|
||||
|
||||
- pip: system-wide `/etc/pip.conf` (`index-url`/`extra-index-url`/`cert`).
|
||||
Any repository whose URL isn't HTTPS has its host added to
|
||||
`trusted-host`, since pip otherwise refuses a plain HTTP index.
|
||||
- uv: system-wide `/etc/uv/uv.toml` (`[[index]]` entries, `native-tls`).
|
||||
- poetry: `/root/.config/pypoetry/config.toml` (`repositories.*`/`certificates.*`).
|
||||
Poetry has no global "replace PyPI" switch: a project's `pyproject.toml`
|
||||
still has to reference these repositories as sources. This only makes the
|
||||
repository and its certificate available system-wide. It also assumes the
|
||||
container runs as root, since poetry only reads its config from the
|
||||
current user's home directory.
|
||||
repository and its certificate available system-wide. Since poetry only
|
||||
reads its config from the current user's home directory, this assumes the
|
||||
container runs as root; the same file is additionally written under each
|
||||
configured `--user`'s own home directory (`context.users`), for the
|
||||
benefit of a non-root user invoking poetry.
|
||||
- easy_install: `distutils.cfg` (`[easy_install] index_url`), written next
|
||||
to every Python installation detected under `<src>` (there is no location
|
||||
independent of a specific Python prefix).
|
||||
@@ -21,6 +25,7 @@ from __future__ import annotations
|
||||
|
||||
import json
|
||||
import logging
|
||||
from urllib.parse import urlparse
|
||||
|
||||
from id_configurator.config import PythonRepository
|
||||
from id_configurator.context import Context
|
||||
@@ -39,11 +44,22 @@ def _toml_string(value: str) -> str:
|
||||
return json.dumps(value)
|
||||
|
||||
|
||||
def _trusted_host(repository: PythonRepository) -> str | None:
|
||||
parsed = urlparse(repository.index_url)
|
||||
return None if parsed.scheme.lower() == "https" else parsed.hostname
|
||||
|
||||
|
||||
def _write_pip_conf(context: Context, repositories: list[PythonRepository]) -> None:
|
||||
lines = ["[global]", f"index-url = {repositories[0].index_url}"]
|
||||
if len(repositories) > 1:
|
||||
lines.append("extra-index-url =")
|
||||
lines.extend(f" {repository.index_url}" for repository in repositories[1:])
|
||||
trusted_hosts = dict.fromkeys(
|
||||
host for repository in repositories if (host := _trusted_host(repository))
|
||||
)
|
||||
if trusted_hosts:
|
||||
lines.append("trusted-host =")
|
||||
lines.extend(f" {host}" for host in trusted_hosts)
|
||||
lines.append(f"cert = {_CA_BUNDLE}")
|
||||
context.write_file(_PIP_CONF, ("\n".join(lines) + "\n").encode("utf-8"))
|
||||
logger.info("configured pip to use %s", repositories[0].index_url)
|
||||
@@ -73,9 +89,13 @@ def _write_poetry_config(
|
||||
lines.append(f"[certificates.{repository.name}]")
|
||||
lines.append(f"cert = {_toml_string(_CA_BUNDLE)}")
|
||||
lines.append("")
|
||||
content = ("\n".join(lines).rstrip() + "\n").encode("utf-8")
|
||||
context.write_file(_POETRY_CONFIG, content)
|
||||
for user in context.users:
|
||||
context.write_file(
|
||||
_POETRY_CONFIG, ("\n".join(lines).rstrip() + "\n").encode("utf-8")
|
||||
f"{context.home_dir(user)}/.config/pypoetry/config.toml", content
|
||||
)
|
||||
logger.info("configured poetry for user %s", user)
|
||||
logger.info("registered %d poetry repositories", len(repositories))
|
||||
|
||||
|
||||
|
||||
@@ -1,8 +1,10 @@
|
||||
"""Configure cargo to use the configured RustRepository entries: the first
|
||||
one replaces crates.io entirely (via `[source.crates-io] replace-with`), and
|
||||
any further ones are registered as additional named registries (usable via
|
||||
`cargo add --registry <name>` or a dependency's `registry = "<name>"`), all
|
||||
using the sparse (plain HTTPS) protocol rather than a git-based index.
|
||||
`cargo add --registry <name>` or a dependency's `registry = "<name>"`). A
|
||||
repository's index is declared as `sparse+<url>` - the sparse (plain HTTPS)
|
||||
protocol - only when its `is_sparse` option is set; otherwise `<url>` is used
|
||||
as-is, for a git-based index.
|
||||
|
||||
Cargo's own HTTPS client already trusts whatever the `certificates` module
|
||||
installs into the system CA store, so no separate certificate configuration
|
||||
@@ -17,11 +19,17 @@ directory to `/`, consulting `/.cargo/config.toml` there, *before* falling
|
||||
back to `$CARGO_HOME/config.toml` - so this is the one genuinely global
|
||||
location: found regardless of which user, working directory or `CARGO_HOME`
|
||||
is in effect, unlike a config dropped in one specific user's home.
|
||||
|
||||
For each configured `--user` (`context.users`), the same config is
|
||||
additionally written at that user's own `$HOME/.cargo/config.toml` - the
|
||||
conventional, un-overridden `CARGO_HOME` location for that specific user,
|
||||
which this module otherwise has no visibility into.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import logging
|
||||
import re
|
||||
|
||||
from id_configurator.config import RustRepository
|
||||
from id_configurator.context import Context
|
||||
@@ -30,24 +38,48 @@ from id_configurator.modules.base import Module, register
|
||||
logger = logging.getLogger(__name__)
|
||||
|
||||
_CARGO_CONFIG = ".cargo/config.toml"
|
||||
_REPOSITORY_NAME_FORBIDDEN_CHARS = re.compile(r"[^A-Za-z0-9_-]")
|
||||
|
||||
|
||||
def _sanitize_repository_name(name: str) -> str:
|
||||
"""Replace every character of `name` that isn't a plain identifier
|
||||
character with `_`.
|
||||
|
||||
`name` is written verbatim both as a TOML table key (`[source.name]`,
|
||||
`[registries.name]`) and inside a quoted string (`replace-with =
|
||||
"name"`): an unrestricted name could break out of the table header or
|
||||
string, or (via a literal `.`) silently create extra, nested tables
|
||||
instead of naming the one table it is meant to.
|
||||
"""
|
||||
return _REPOSITORY_NAME_FORBIDDEN_CHARS.sub("_", name)
|
||||
|
||||
|
||||
def _index_url(repository: RustRepository) -> str:
|
||||
return f"sparse+{repository.url}" if repository.is_sparse else repository.url
|
||||
|
||||
|
||||
def _write_cargo_config(context: Context, repositories: list[RustRepository]) -> None:
|
||||
primary = repositories[0]
|
||||
primary_name = _sanitize_repository_name(primary.name)
|
||||
lines = [
|
||||
"[source.crates-io]",
|
||||
f'replace-with = "{primary.name}"',
|
||||
f'replace-with = "{primary_name}"',
|
||||
"",
|
||||
f"[source.{primary.name}]",
|
||||
f'registry = "sparse+{primary.url}"',
|
||||
f"[source.{primary_name}]",
|
||||
f'registry = "{_index_url(primary)}"',
|
||||
]
|
||||
for repository in repositories[1:]:
|
||||
name = _sanitize_repository_name(repository.name)
|
||||
lines += [
|
||||
"",
|
||||
f"[registries.{repository.name}]",
|
||||
f'index = "sparse+{repository.url}"',
|
||||
f"[registries.{name}]",
|
||||
f'index = "{_index_url(repository)}"',
|
||||
]
|
||||
context.write_file(_CARGO_CONFIG, ("\n".join(lines) + "\n").encode("utf-8"))
|
||||
content = ("\n".join(lines) + "\n").encode("utf-8")
|
||||
context.write_file(_CARGO_CONFIG, content)
|
||||
for user in context.users:
|
||||
context.write_file(f"{context.home_dir(user)}/.cargo/config.toml", content)
|
||||
logger.info("configured cargo for user %s", user)
|
||||
logger.info("configured cargo to use %s", primary.url)
|
||||
|
||||
|
||||
|
||||
@@ -32,6 +32,7 @@ from __future__ import annotations
|
||||
import configparser
|
||||
import fnmatch
|
||||
import logging
|
||||
import re
|
||||
import shutil
|
||||
import subprocess
|
||||
import tempfile
|
||||
@@ -46,6 +47,19 @@ logger = logging.getLogger(__name__)
|
||||
|
||||
_REPOS_DIR = "etc/yum.repos.d"
|
||||
_RPM_GPG_DIR = "etc/pki/rpm-gpg"
|
||||
_REPOSITORY_NAME_FORBIDDEN_CHARS = re.compile(r"[^A-Za-z0-9._-]")
|
||||
|
||||
|
||||
def _sanitize_repository_name(name: str) -> str:
|
||||
"""Replace every character of `name` that isn't a plain identifier
|
||||
character with `_`.
|
||||
|
||||
`name` is written verbatim as the `.repo` file's INI section header
|
||||
(`[name]`): an unrestricted name (containing `]`, a newline, ...) could
|
||||
otherwise inject extra, attacker-controlled sections into the file
|
||||
instead of just naming the one section it is meant to.
|
||||
"""
|
||||
return _REPOSITORY_NAME_FORBIDDEN_CHARS.sub("_", name)
|
||||
|
||||
|
||||
def _disable_repo_content(content: str, patterns: Sequence[str]) -> str:
|
||||
@@ -91,9 +105,10 @@ def _disable_existing_repos(context: Context, patterns: Sequence[str]) -> None:
|
||||
|
||||
|
||||
def _write_repo_file(context: Context, repository: YumRepository) -> None:
|
||||
name = _sanitize_repository_name(repository.name)
|
||||
lines = [
|
||||
f"[{repository.name}]",
|
||||
f"name={repository.name}",
|
||||
f"[{name}]",
|
||||
f"name={name}",
|
||||
f"baseurl={repository.index_url}",
|
||||
"enabled=1",
|
||||
]
|
||||
@@ -103,10 +118,10 @@ def _write_repo_file(context: Context, repository: YumRepository) -> None:
|
||||
else:
|
||||
lines.append("gpgcheck=0")
|
||||
context.write_file(
|
||||
f"{_REPOS_DIR}/{sanitize_filename(repository.name)}.repo",
|
||||
f"{_REPOS_DIR}/{name}.repo",
|
||||
("\n".join(lines) + "\n").encode("utf-8"),
|
||||
)
|
||||
logger.info("added yum/dnf repository %s", repository.name)
|
||||
logger.info("added yum/dnf repository %s", name)
|
||||
|
||||
|
||||
def _validate_gpg_key(name: str, content: bytes) -> None:
|
||||
|
||||
@@ -0,0 +1,78 @@
|
||||
"""Parse `/etc/passwd` entries for the `--auto-users` CLI option.
|
||||
|
||||
A passwd(5) line is `name:passwd:uid:gid:gecos:home:shell`. `--auto-users`
|
||||
expands to every entry that looks like a regular (non-system) account - see
|
||||
`PasswdEntry.is_regular_user`.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
from dataclasses import dataclass
|
||||
|
||||
DEFAULT_UID_MIN = 1000
|
||||
|
||||
_DISABLED_SHELL_NAMES = {"nologin", "sync", "false"}
|
||||
|
||||
|
||||
@dataclass(frozen=True)
|
||||
class PasswdEntry:
|
||||
name: str
|
||||
uid: int
|
||||
home: str
|
||||
shell: str
|
||||
|
||||
@property
|
||||
def has_login_shell(self) -> bool:
|
||||
return self.shell.rsplit("/", 1)[-1] not in _DISABLED_SHELL_NAMES
|
||||
|
||||
def is_regular_user(self, uid_min: int = DEFAULT_UID_MIN) -> bool:
|
||||
"""True unless `self` looks like a system account.
|
||||
|
||||
A login-disabling shell (`has_login_shell` False) only catches
|
||||
service accounts that follow that convention; it misses others
|
||||
(and could wrongly flag a merely locked human account). The
|
||||
authoritative signal `useradd`/`adduser`/`systemd-sysusers` use
|
||||
instead is the UID: system accounts get one below `uid_min` (the
|
||||
`UID_MIN` from login.defs(5), 1000 by default). Both checks apply
|
||||
together here - except for `root`, whose UID 0 is itself a system
|
||||
convention rather than a sign it shouldn't be configured: it's
|
||||
exempted from the UID check (though not from the shell one, so a
|
||||
deliberately locked root account is still excluded).
|
||||
"""
|
||||
if not self.has_login_shell:
|
||||
return False
|
||||
return self.name == "root" or self.uid >= uid_min
|
||||
|
||||
|
||||
def parse_passwd(content: str) -> list[PasswdEntry]:
|
||||
entries = []
|
||||
for line in content.splitlines():
|
||||
if not line or line.startswith("#"):
|
||||
continue
|
||||
fields = line.split(":")
|
||||
if len(fields) < 7:
|
||||
continue
|
||||
try:
|
||||
uid = int(fields[2])
|
||||
except ValueError:
|
||||
continue
|
||||
entries.append(
|
||||
PasswdEntry(name=fields[0], uid=uid, home=fields[5], shell=fields[6])
|
||||
)
|
||||
return entries
|
||||
|
||||
|
||||
def parse_login_defs_uid_min(content: str) -> int | None:
|
||||
"""Extract `UID_MIN` from `/etc/login.defs` content (login.defs(5)), or
|
||||
`None` if it isn't set there."""
|
||||
for line in content.splitlines():
|
||||
stripped = line.strip()
|
||||
if not stripped or stripped.startswith("#"):
|
||||
continue
|
||||
parts = stripped.split()
|
||||
if len(parts) >= 2 and parts[0] == "UID_MIN":
|
||||
try:
|
||||
return int(parts[1])
|
||||
except ValueError:
|
||||
return None
|
||||
return None
|
||||
+1
-1
@@ -44,7 +44,7 @@ maintainers = [
|
||||
name = "id-configurator"
|
||||
readme = "README.md"
|
||||
requires-python = ">=3.13"
|
||||
version = "2026.10.4"
|
||||
version = "2026.10.5"
|
||||
|
||||
[project.scripts]
|
||||
id-configurator = "id_configurator:main"
|
||||
|
||||
@@ -25,6 +25,7 @@ configurations:
|
||||
repositories:
|
||||
- name: demo
|
||||
url: https://host.docker.internal:{{ 'CARGO_REPO_PORT' | env }}/
|
||||
is_sparse: true
|
||||
go:
|
||||
repositories: []
|
||||
ruby:
|
||||
|
||||
@@ -15,6 +15,12 @@ CONFIG_WITH_CERT = {
|
||||
**MINIMAL_CONFIG,
|
||||
"configurations": {"certificates": [{"name": "my-ca", "content": "fake"}]},
|
||||
}
|
||||
CONFIG_WITH_GO_REPO = {
|
||||
**MINIMAL_CONFIG,
|
||||
"configurations": {
|
||||
"go": {"repositories": [{"name": "demo", "url": "https://example.invalid/"}]}
|
||||
},
|
||||
}
|
||||
|
||||
|
||||
def write_config(tmp_path, data) -> str:
|
||||
@@ -129,6 +135,66 @@ def test_apply_runs_relevant_module(tmp_path) -> None:
|
||||
assert (dst / "etc/ssl/certs/ca-certificates.crt").read_bytes() == b"fake\n"
|
||||
|
||||
|
||||
def test_apply_with_user_option_writes_per_user_config(tmp_path) -> None:
|
||||
config_path = write_config(tmp_path, CONFIG_WITH_GO_REPO)
|
||||
dst = tmp_path / "dst"
|
||||
result = runner.invoke(
|
||||
cli.app,
|
||||
[
|
||||
"apply",
|
||||
"--config",
|
||||
config_path,
|
||||
"--dst",
|
||||
str(dst),
|
||||
"--user",
|
||||
"alice",
|
||||
"--user",
|
||||
"root",
|
||||
],
|
||||
)
|
||||
|
||||
assert result.exit_code == 0
|
||||
assert (dst / "home/alice/.config/go/env").read_text(encoding="utf-8") == (
|
||||
"GOPROXY=https://example.invalid/\nGOSUMDB=off\n"
|
||||
)
|
||||
assert (dst / "root/.config/go/env").read_text(encoding="utf-8") == (
|
||||
"GOPROXY=https://example.invalid/\nGOSUMDB=off\n"
|
||||
)
|
||||
|
||||
|
||||
def test_apply_with_auto_users_reads_passwd_from_src(tmp_path) -> None:
|
||||
config_path = write_config(tmp_path, CONFIG_WITH_GO_REPO)
|
||||
src = tmp_path / "src"
|
||||
(src / "etc").mkdir(parents=True)
|
||||
(src / "etc/passwd").write_text(
|
||||
"root:x:0:0:root:/root:/bin/bash\n"
|
||||
"alice:x:1000:1000:Alice:/home/alice:/bin/bash\n"
|
||||
"daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\n",
|
||||
encoding="utf-8",
|
||||
)
|
||||
dst = tmp_path / "dst"
|
||||
result = runner.invoke(
|
||||
cli.app,
|
||||
[
|
||||
"apply",
|
||||
"--config",
|
||||
config_path,
|
||||
"--dst",
|
||||
str(dst),
|
||||
"--src",
|
||||
str(src),
|
||||
"--auto-users",
|
||||
],
|
||||
)
|
||||
|
||||
assert result.exit_code == 0
|
||||
# root is always included despite its uid 0; daemon (nologin shell) is
|
||||
# a system account, excluded.
|
||||
assert (dst / "root/.config/go/env").exists()
|
||||
assert (dst / "home/alice/.config/go/env").exists()
|
||||
assert not (dst / "usr/sbin/.config/go/env").exists()
|
||||
|
||||
|
||||
def test_main_default_name_calls_app(monkeypatch) -> None:
|
||||
mock_app = MagicMock()
|
||||
monkeypatch.setattr(cli, "app", mock_app)
|
||||
|
||||
+132
-2
@@ -8,14 +8,16 @@ CONFIG = Configuration.model_validate(
|
||||
)
|
||||
|
||||
|
||||
def make_context(tmp_path, with_src: bool = True) -> Context:
|
||||
def make_context(
|
||||
tmp_path, with_src: bool = True, users=None, auto_users: bool = False
|
||||
) -> Context:
|
||||
dst = tmp_path / "dst"
|
||||
dst.mkdir()
|
||||
src = None
|
||||
if with_src:
|
||||
src = tmp_path / "src"
|
||||
src.mkdir()
|
||||
return Context(config=CONFIG, dst=dst, src=src)
|
||||
return Context(config=CONFIG, dst=dst, src=src, users=users, auto_users=auto_users)
|
||||
|
||||
|
||||
def test_dst_path_within_destination(tmp_path) -> None:
|
||||
@@ -97,3 +99,131 @@ def test_glob_src_matches_pattern(tmp_path) -> None:
|
||||
(context.src / "usr/lib/python-legacy").mkdir(parents=True)
|
||||
result = context.glob_src("usr/lib/python3.*")
|
||||
assert [entry.name for entry in result] == ["python3.11", "python3.12"]
|
||||
|
||||
|
||||
def test_users_defaults_to_empty_list(tmp_path) -> None:
|
||||
context = make_context(tmp_path, with_src=False)
|
||||
assert context.users == []
|
||||
|
||||
|
||||
def test_users_keeps_explicit_names_in_order_without_duplicates(tmp_path) -> None:
|
||||
context = make_context(tmp_path, with_src=False, users=["alice", "bob", "alice"])
|
||||
assert context.users == ["alice", "bob"]
|
||||
|
||||
|
||||
def test_auto_users_expands_from_passwd_excluding_disabled_shells(tmp_path) -> None:
|
||||
dst = tmp_path / "dst"
|
||||
dst.mkdir()
|
||||
src = tmp_path / "src"
|
||||
(src / "etc").mkdir(parents=True)
|
||||
(src / "etc/passwd").write_text(
|
||||
"root:x:0:0:root:/root:/bin/bash\n"
|
||||
"alice:x:1000:1000:Alice:/home/alice:/bin/bash\n"
|
||||
"daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\n",
|
||||
encoding="utf-8",
|
||||
)
|
||||
context = Context(config=CONFIG, dst=dst, src=src, auto_users=True)
|
||||
# root is always included despite its uid 0; daemon (nologin shell) is
|
||||
# excluded as a system account.
|
||||
assert context.users == ["root", "alice"]
|
||||
|
||||
|
||||
def test_auto_users_excludes_root_with_disabled_shell(tmp_path) -> None:
|
||||
dst = tmp_path / "dst"
|
||||
dst.mkdir()
|
||||
src = tmp_path / "src"
|
||||
(src / "etc").mkdir(parents=True)
|
||||
(src / "etc/passwd").write_text(
|
||||
"root:x:0:0:root:/root:/usr/sbin/nologin\n"
|
||||
"alice:x:1000:1000:Alice:/home/alice:/bin/bash\n",
|
||||
encoding="utf-8",
|
||||
)
|
||||
context = Context(config=CONFIG, dst=dst, src=src, auto_users=True)
|
||||
assert context.users == ["alice"]
|
||||
|
||||
|
||||
def test_auto_users_excludes_uid_below_default_uid_min(tmp_path) -> None:
|
||||
dst = tmp_path / "dst"
|
||||
dst.mkdir()
|
||||
src = tmp_path / "src"
|
||||
(src / "etc").mkdir(parents=True)
|
||||
(src / "etc/passwd").write_text(
|
||||
"svc:x:999:999:service account:/home/svc:/bin/bash\n"
|
||||
"alice:x:1000:1000:Alice:/home/alice:/bin/bash\n",
|
||||
encoding="utf-8",
|
||||
)
|
||||
context = Context(config=CONFIG, dst=dst, src=src, auto_users=True)
|
||||
assert context.users == ["alice"]
|
||||
|
||||
|
||||
def test_auto_users_honors_uid_min_from_login_defs(tmp_path) -> None:
|
||||
dst = tmp_path / "dst"
|
||||
dst.mkdir()
|
||||
src = tmp_path / "src"
|
||||
(src / "etc").mkdir(parents=True)
|
||||
(src / "etc/passwd").write_text(
|
||||
"svc:x:999:999:service account:/home/svc:/bin/bash\n"
|
||||
"alice:x:1000:1000:Alice:/home/alice:/bin/bash\n",
|
||||
encoding="utf-8",
|
||||
)
|
||||
(src / "etc/login.defs").write_text("UID_MIN\t500\n", encoding="utf-8")
|
||||
context = Context(config=CONFIG, dst=dst, src=src, auto_users=True)
|
||||
assert context.users == ["svc", "alice"]
|
||||
|
||||
|
||||
def test_auto_users_combines_with_explicit_names_without_duplicates(tmp_path) -> None:
|
||||
dst = tmp_path / "dst"
|
||||
dst.mkdir()
|
||||
src = tmp_path / "src"
|
||||
src.mkdir()
|
||||
(src / "etc").mkdir()
|
||||
(src / "etc/passwd").write_text(
|
||||
"root:x:0:0:root:/root:/bin/bash\nalice:x:1000:1000:Alice:/home/alice:/bin/bash\n",
|
||||
encoding="utf-8",
|
||||
)
|
||||
context = Context(
|
||||
config=CONFIG, dst=dst, src=src, users=["bob", "alice"], auto_users=True
|
||||
)
|
||||
# explicit names come first, in order; auto-detected names are appended,
|
||||
# skipping "alice" since it's already present.
|
||||
assert context.users == ["bob", "alice", "root"]
|
||||
|
||||
|
||||
def test_auto_users_false_ignores_passwd(tmp_path) -> None:
|
||||
dst = tmp_path / "dst"
|
||||
dst.mkdir()
|
||||
src = tmp_path / "src"
|
||||
(src / "etc").mkdir(parents=True)
|
||||
(src / "etc/passwd").write_text(
|
||||
"alice:x:1000:1000:Alice:/home/alice:/bin/bash\n", encoding="utf-8"
|
||||
)
|
||||
context = Context(config=CONFIG, dst=dst, src=src)
|
||||
assert context.users == []
|
||||
|
||||
|
||||
def test_auto_users_without_src_is_empty(tmp_path) -> None:
|
||||
context = make_context(tmp_path, with_src=False, auto_users=True)
|
||||
assert context.users == []
|
||||
|
||||
|
||||
def test_home_dir_for_root(tmp_path) -> None:
|
||||
context = make_context(tmp_path, with_src=False)
|
||||
assert context.home_dir("root") == "root"
|
||||
|
||||
|
||||
def test_home_dir_falls_back_to_convention(tmp_path) -> None:
|
||||
context = make_context(tmp_path, with_src=False)
|
||||
assert context.home_dir("alice") == "home/alice"
|
||||
|
||||
|
||||
def test_home_dir_uses_passwd_entry_when_available(tmp_path) -> None:
|
||||
dst = tmp_path / "dst"
|
||||
dst.mkdir()
|
||||
src = tmp_path / "src"
|
||||
src.mkdir()
|
||||
(src / "etc").mkdir()
|
||||
(src / "etc/passwd").write_text(
|
||||
"alice:x:1000:1000:Alice:/srv/alice:/bin/bash\n", encoding="utf-8"
|
||||
)
|
||||
context = Context(config=CONFIG, dst=dst, src=src)
|
||||
assert context.home_dir("alice") == "srv/alice"
|
||||
|
||||
@@ -55,6 +55,18 @@ def test_apply_writes_goproxy(tmp_path) -> None:
|
||||
assert go_env == "GOPROXY=https://example.invalid/\nGOSUMDB=off\n"
|
||||
|
||||
|
||||
def test_apply_writes_go_env_for_each_configured_user(tmp_path) -> None:
|
||||
dst = tmp_path / "dst"
|
||||
context = Context(
|
||||
config=make_config(CONFIG_WITH_REPO), dst=dst, src=None, users=["alice"]
|
||||
)
|
||||
|
||||
GoModule().apply(context)
|
||||
|
||||
go_env = (dst / "home/alice/.config/go/env").read_text(encoding="utf-8")
|
||||
assert go_env == "GOPROXY=https://example.invalid/\nGOSUMDB=off\n"
|
||||
|
||||
|
||||
def test_apply_joins_multiple_repositories_with_comma(tmp_path) -> None:
|
||||
dst = tmp_path / "dst"
|
||||
context = Context(config=make_config(CONFIG_WITH_TWO_REPOS), dst=dst, src=None)
|
||||
|
||||
@@ -63,6 +63,48 @@ def test_apply_writes_nuget_config(tmp_path) -> None:
|
||||
)
|
||||
|
||||
|
||||
def test_apply_marks_non_https_source_as_insecure(tmp_path) -> None:
|
||||
data = {
|
||||
"uuid": "12345678-1234-5678-1234-567812345678",
|
||||
"organisation": "InterDiode",
|
||||
"configurations": {
|
||||
"nuget": {
|
||||
"repositories": [{"name": "demo", "url": "http://example.invalid/"}]
|
||||
}
|
||||
},
|
||||
}
|
||||
dst = tmp_path / "dst"
|
||||
context = Context(config=make_config(data), dst=dst, src=None)
|
||||
|
||||
NuGetModule().apply(context)
|
||||
|
||||
content = (dst / "root/.nuget/NuGet/NuGet.Config").read_text(encoding="utf-8")
|
||||
assert content == (
|
||||
'<?xml version="1.0" encoding="utf-8"?>\n'
|
||||
"<configuration>\n"
|
||||
" <packageSources>\n"
|
||||
" <clear />\n"
|
||||
' <add key="demo" value="http://example.invalid/" allowInsecureConnections="true" />\n'
|
||||
" </packageSources>\n"
|
||||
"</configuration>\n"
|
||||
)
|
||||
|
||||
|
||||
def test_apply_writes_config_for_each_configured_user(tmp_path) -> None:
|
||||
dst = tmp_path / "dst"
|
||||
context = Context(
|
||||
config=make_config(CONFIG_WITH_REPO), dst=dst, src=None, users=["alice", "root"]
|
||||
)
|
||||
|
||||
NuGetModule().apply(context)
|
||||
|
||||
root_content = (dst / "root/.nuget/NuGet/NuGet.Config").read_text(encoding="utf-8")
|
||||
alice_content = (dst / "home/alice/.nuget/NuGet/NuGet.Config").read_text(
|
||||
encoding="utf-8"
|
||||
)
|
||||
assert alice_content == root_content
|
||||
|
||||
|
||||
def test_apply_writes_multiple_sources_in_order(tmp_path) -> None:
|
||||
dst = tmp_path / "dst"
|
||||
context = Context(config=make_config(CONFIG_WITH_TWO_REPOS), dst=dst, src=None)
|
||||
|
||||
+66
-2
@@ -80,7 +80,8 @@ def test_apply_writes_global_composer_config(tmp_path) -> None:
|
||||
"name": "demo",
|
||||
"type": "composer",
|
||||
"url": "https://example.invalid/composer",
|
||||
}
|
||||
},
|
||||
{"packagist.org": False},
|
||||
]
|
||||
}
|
||||
|
||||
@@ -93,7 +94,70 @@ def test_apply_writes_multiple_repositories_in_order(tmp_path) -> None:
|
||||
|
||||
config_path = dst / "root/.composer/config.json"
|
||||
content = json.loads(config_path.read_text(encoding="utf-8"))
|
||||
assert [repo["name"] for repo in content["repositories"]] == ["demo", "other"]
|
||||
names = [repo["name"] for repo in content["repositories"] if "name" in repo]
|
||||
assert names == ["demo", "other"]
|
||||
assert {"packagist.org": False} in content["repositories"]
|
||||
|
||||
|
||||
def test_apply_disables_secure_http_and_packagist_when_repo_not_https(
|
||||
tmp_path,
|
||||
) -> None:
|
||||
data = {
|
||||
"uuid": "12345678-1234-5678-1234-567812345678",
|
||||
"organisation": "InterDiode",
|
||||
"configurations": {
|
||||
"php": {
|
||||
"repositories": [
|
||||
{"name": "demo", "url": "https://example.invalid/composer"},
|
||||
{"name": "insecure", "url": "http://other.invalid/composer"},
|
||||
]
|
||||
}
|
||||
},
|
||||
}
|
||||
dst = tmp_path / "dst"
|
||||
context = Context(config=make_config(data), dst=dst, src=None)
|
||||
|
||||
PhpModule().apply(context)
|
||||
|
||||
config_path = dst / "root/.composer/config.json"
|
||||
content = json.loads(config_path.read_text(encoding="utf-8"))
|
||||
assert content["config"] == {"secure-http": False}
|
||||
assert {"packagist.org": False} in content["repositories"]
|
||||
|
||||
|
||||
def test_apply_does_not_disable_secure_http_when_all_repos_https(tmp_path) -> None:
|
||||
dst = tmp_path / "dst"
|
||||
context = Context(config=make_config(CONFIG_WITH_REPO), dst=dst, src=None)
|
||||
|
||||
PhpModule().apply(context)
|
||||
|
||||
config_path = dst / "root/.composer/config.json"
|
||||
content = json.loads(config_path.read_text(encoding="utf-8"))
|
||||
assert "config" not in content
|
||||
|
||||
|
||||
def test_apply_always_disables_packagist(tmp_path) -> None:
|
||||
dst = tmp_path / "dst"
|
||||
context = Context(config=make_config(CONFIG_WITH_REPO), dst=dst, src=None)
|
||||
|
||||
PhpModule().apply(context)
|
||||
|
||||
config_path = dst / "root/.composer/config.json"
|
||||
content = json.loads(config_path.read_text(encoding="utf-8"))
|
||||
assert {"packagist.org": False} in content["repositories"]
|
||||
|
||||
|
||||
def test_apply_writes_composer_config_for_each_configured_user(tmp_path) -> None:
|
||||
dst = tmp_path / "dst"
|
||||
context = Context(
|
||||
config=make_config(CONFIG_WITH_REPO), dst=dst, src=None, users=["alice"]
|
||||
)
|
||||
|
||||
PhpModule().apply(context)
|
||||
|
||||
root_content = (dst / "root/.composer/config.json").read_bytes()
|
||||
alice_content = (dst / "home/alice/.composer/config.json").read_bytes()
|
||||
assert alice_content == root_content
|
||||
|
||||
|
||||
def test_apply_without_certificates_does_not_write_openssl_ini(tmp_path) -> None:
|
||||
|
||||
@@ -76,6 +76,84 @@ def test_apply_single_repository(tmp_path) -> None:
|
||||
assert not (dst / "usr/lib").exists()
|
||||
|
||||
|
||||
def test_apply_adds_trusted_host_for_non_https_repository(tmp_path) -> None:
|
||||
data = {
|
||||
"uuid": "12345678-1234-5678-1234-567812345678",
|
||||
"organisation": "InterDiode",
|
||||
"configurations": {
|
||||
"python": {
|
||||
"repositories": [
|
||||
{"name": "interdiode", "index-url": "http://example.invalid/simple"}
|
||||
]
|
||||
}
|
||||
},
|
||||
}
|
||||
config = Configuration.model_validate(data)
|
||||
dst = tmp_path / "dst"
|
||||
context = Context(config=config, dst=dst, src=None)
|
||||
|
||||
PythonModule().apply(context)
|
||||
|
||||
pip_conf = (dst / "etc/pip.conf").read_text(encoding="utf-8")
|
||||
assert pip_conf == (
|
||||
"[global]\n"
|
||||
"index-url = http://example.invalid/simple\n"
|
||||
"trusted-host =\n"
|
||||
" example.invalid\n"
|
||||
"cert = /etc/ssl/certs/ca-certificates.crt\n"
|
||||
)
|
||||
|
||||
|
||||
def test_apply_adds_trusted_host_only_for_non_https_among_mixed_repositories(
|
||||
tmp_path,
|
||||
) -> None:
|
||||
data = {
|
||||
"uuid": "12345678-1234-5678-1234-567812345678",
|
||||
"organisation": "InterDiode",
|
||||
"configurations": {
|
||||
"python": {
|
||||
"repositories": [
|
||||
{
|
||||
"name": "interdiode",
|
||||
"index-url": "https://example.invalid/simple",
|
||||
},
|
||||
{
|
||||
"name": "insecure",
|
||||
"index-url": "http://insecure.invalid/simple",
|
||||
},
|
||||
]
|
||||
}
|
||||
},
|
||||
}
|
||||
config = Configuration.model_validate(data)
|
||||
dst = tmp_path / "dst"
|
||||
context = Context(config=config, dst=dst, src=None)
|
||||
|
||||
PythonModule().apply(context)
|
||||
|
||||
pip_conf = (dst / "etc/pip.conf").read_text(encoding="utf-8")
|
||||
assert pip_conf == (
|
||||
"[global]\n"
|
||||
"index-url = https://example.invalid/simple\n"
|
||||
"extra-index-url =\n"
|
||||
" http://insecure.invalid/simple\n"
|
||||
"trusted-host =\n"
|
||||
" insecure.invalid\n"
|
||||
"cert = /etc/ssl/certs/ca-certificates.crt\n"
|
||||
)
|
||||
|
||||
|
||||
def test_apply_does_not_add_trusted_host_when_all_repositories_https(tmp_path) -> None:
|
||||
config = Configuration.model_validate(ONE_REPO_CONFIG)
|
||||
dst = tmp_path / "dst"
|
||||
context = Context(config=config, dst=dst, src=None)
|
||||
|
||||
PythonModule().apply(context)
|
||||
|
||||
pip_conf = (dst / "etc/pip.conf").read_text(encoding="utf-8")
|
||||
assert "trusted-host" not in pip_conf
|
||||
|
||||
|
||||
def test_apply_multiple_repositories(tmp_path) -> None:
|
||||
config = Configuration.model_validate(TWO_REPOS_CONFIG)
|
||||
dst = tmp_path / "dst"
|
||||
@@ -105,6 +183,22 @@ def test_apply_multiple_repositories(tmp_path) -> None:
|
||||
)
|
||||
|
||||
|
||||
def test_apply_writes_poetry_config_for_each_configured_user(tmp_path) -> None:
|
||||
config = Configuration.model_validate(ONE_REPO_CONFIG)
|
||||
dst = tmp_path / "dst"
|
||||
context = Context(config=config, dst=dst, src=None, users=["alice"])
|
||||
|
||||
PythonModule().apply(context)
|
||||
|
||||
root_content = (dst / "root/.config/pypoetry/config.toml").read_text(
|
||||
encoding="utf-8"
|
||||
)
|
||||
alice_content = (dst / "home/alice/.config/pypoetry/config.toml").read_text(
|
||||
encoding="utf-8"
|
||||
)
|
||||
assert alice_content == root_content
|
||||
|
||||
|
||||
def test_apply_writes_distutils_cfg_for_detected_python_prefixes(tmp_path) -> None:
|
||||
config = Configuration.model_validate(ONE_REPO_CONFIG)
|
||||
src = tmp_path / "src"
|
||||
|
||||
+104
-3
@@ -6,7 +6,15 @@ CONFIG_WITH_REPO = {
|
||||
"uuid": "12345678-1234-5678-1234-567812345678",
|
||||
"organisation": "InterDiode",
|
||||
"configurations": {
|
||||
"rust": {"repositories": [{"name": "demo", "url": "https://example.invalid/"}]}
|
||||
"rust": {
|
||||
"repositories": [
|
||||
{
|
||||
"name": "demo",
|
||||
"url": "https://example.invalid/",
|
||||
"is_sparse": True,
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
}
|
||||
|
||||
@@ -16,8 +24,16 @@ CONFIG_WITH_TWO_REPOS = {
|
||||
"configurations": {
|
||||
"rust": {
|
||||
"repositories": [
|
||||
{"name": "demo", "url": "https://example.invalid/"},
|
||||
{"name": "other", "url": "https://other.invalid/"},
|
||||
{
|
||||
"name": "demo",
|
||||
"url": "https://example.invalid/",
|
||||
"is_sparse": True,
|
||||
},
|
||||
{
|
||||
"name": "other",
|
||||
"url": "https://other.invalid/",
|
||||
"is_sparse": True,
|
||||
},
|
||||
]
|
||||
}
|
||||
},
|
||||
@@ -61,6 +77,91 @@ def test_apply_writes_replacement_source(tmp_path) -> None:
|
||||
)
|
||||
|
||||
|
||||
def test_apply_sanitizes_repository_names_with_special_characters(tmp_path) -> None:
|
||||
data = {
|
||||
"uuid": "12345678-1234-5678-1234-567812345678",
|
||||
"organisation": "InterDiode",
|
||||
"configurations": {
|
||||
"rust": {
|
||||
"repositories": [
|
||||
{
|
||||
"name": "weird.demo]\nname",
|
||||
"url": "https://example.invalid/",
|
||||
"is_sparse": True,
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
}
|
||||
dst = tmp_path / "dst"
|
||||
context = Context(config=make_config(data), dst=dst, src=None)
|
||||
|
||||
RustModule().apply(context)
|
||||
|
||||
config_toml = (dst / ".cargo/config.toml").read_text(encoding="utf-8")
|
||||
assert config_toml == (
|
||||
"[source.crates-io]\n"
|
||||
'replace-with = "weird_demo__name"\n'
|
||||
"\n"
|
||||
"[source.weird_demo__name]\n"
|
||||
'registry = "sparse+https://example.invalid/"\n'
|
||||
)
|
||||
|
||||
|
||||
def test_apply_does_not_prefix_url_when_not_sparse(tmp_path) -> None:
|
||||
data = {
|
||||
"uuid": "12345678-1234-5678-1234-567812345678",
|
||||
"organisation": "InterDiode",
|
||||
"configurations": {
|
||||
"rust": {
|
||||
"repositories": [{"name": "demo", "url": "https://example.invalid/"}]
|
||||
}
|
||||
},
|
||||
}
|
||||
dst = tmp_path / "dst"
|
||||
context = Context(config=make_config(data), dst=dst, src=None)
|
||||
|
||||
RustModule().apply(context)
|
||||
|
||||
config_toml = (dst / ".cargo/config.toml").read_text(encoding="utf-8")
|
||||
assert config_toml == (
|
||||
"[source.crates-io]\n"
|
||||
'replace-with = "demo"\n'
|
||||
"\n"
|
||||
"[source.demo]\n"
|
||||
'registry = "https://example.invalid/"\n'
|
||||
)
|
||||
|
||||
|
||||
def test_apply_prefixes_url_with_sparse_when_configured(tmp_path) -> None:
|
||||
dst = tmp_path / "dst"
|
||||
context = Context(config=make_config(CONFIG_WITH_REPO), dst=dst, src=None)
|
||||
|
||||
RustModule().apply(context)
|
||||
|
||||
config_toml = (dst / ".cargo/config.toml").read_text(encoding="utf-8")
|
||||
assert config_toml == (
|
||||
"[source.crates-io]\n"
|
||||
'replace-with = "demo"\n'
|
||||
"\n"
|
||||
"[source.demo]\n"
|
||||
'registry = "sparse+https://example.invalid/"\n'
|
||||
)
|
||||
|
||||
|
||||
def test_apply_writes_cargo_config_for_each_configured_user(tmp_path) -> None:
|
||||
dst = tmp_path / "dst"
|
||||
context = Context(
|
||||
config=make_config(CONFIG_WITH_REPO), dst=dst, src=None, users=["alice"]
|
||||
)
|
||||
|
||||
RustModule().apply(context)
|
||||
|
||||
root_content = (dst / ".cargo/config.toml").read_text(encoding="utf-8")
|
||||
alice_content = (dst / "home/alice/.cargo/config.toml").read_text(encoding="utf-8")
|
||||
assert alice_content == root_content
|
||||
|
||||
|
||||
def test_apply_writes_additional_repositories_as_named_registries(tmp_path) -> None:
|
||||
dst = tmp_path / "dst"
|
||||
context = Context(config=make_config(CONFIG_WITH_TWO_REPOS), dst=dst, src=None)
|
||||
|
||||
@@ -0,0 +1,101 @@
|
||||
from id_configurator.users import PasswdEntry, parse_login_defs_uid_min, parse_passwd
|
||||
|
||||
PASSWD_CONTENT = (
|
||||
"root:x:0:0:root:/root:/bin/bash\n"
|
||||
"alice:x:1000:1000:Alice:/home/alice:/bin/bash\n"
|
||||
"daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin\n"
|
||||
"sync:x:4:65534:sync:/bin:/bin/sync\n"
|
||||
"nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/false\n"
|
||||
"# a comment\n"
|
||||
"\n"
|
||||
)
|
||||
|
||||
|
||||
def test_parse_passwd_returns_one_entry_per_line() -> None:
|
||||
entries = parse_passwd(PASSWD_CONTENT)
|
||||
assert [entry.name for entry in entries] == [
|
||||
"root",
|
||||
"alice",
|
||||
"daemon",
|
||||
"sync",
|
||||
"nobody",
|
||||
]
|
||||
|
||||
|
||||
def test_parse_passwd_skips_comments_and_blank_lines() -> None:
|
||||
entries = parse_passwd(PASSWD_CONTENT)
|
||||
assert len(entries) == 5
|
||||
|
||||
|
||||
def test_parse_passwd_extracts_uid_home_and_shell() -> None:
|
||||
entries = {entry.name: entry for entry in parse_passwd(PASSWD_CONTENT)}
|
||||
assert entries["alice"].uid == 1000
|
||||
assert entries["alice"].home == "/home/alice"
|
||||
assert entries["alice"].shell == "/bin/bash"
|
||||
|
||||
|
||||
def test_parse_passwd_skips_malformed_lines() -> None:
|
||||
entries = parse_passwd(
|
||||
"tooshort:x:0\nnotanumber:x:abc:0:x:/home/x:/bin/bash\n"
|
||||
"root:x:0:0:root:/root:/bin/bash\n"
|
||||
)
|
||||
assert [entry.name for entry in entries] == ["root"]
|
||||
|
||||
|
||||
def test_has_login_shell_true_for_regular_shell() -> None:
|
||||
entry = PasswdEntry(name="alice", uid=1000, home="/home/alice", shell="/bin/bash")
|
||||
assert entry.has_login_shell is True
|
||||
|
||||
|
||||
def test_has_login_shell_false_for_nologin_sync_or_false() -> None:
|
||||
nologin = PasswdEntry(
|
||||
name="daemon", uid=1, home="/usr/sbin", shell="/usr/sbin/nologin"
|
||||
)
|
||||
sync = PasswdEntry(name="sync", uid=4, home="/bin", shell="/bin/sync")
|
||||
false_shell = PasswdEntry(
|
||||
name="nobody", uid=65534, home="/nonexistent", shell="/usr/sbin/false"
|
||||
)
|
||||
assert nologin.has_login_shell is False
|
||||
assert sync.has_login_shell is False
|
||||
assert false_shell.has_login_shell is False
|
||||
|
||||
|
||||
def test_is_regular_user_true_for_human_account() -> None:
|
||||
entry = PasswdEntry(name="alice", uid=1000, home="/home/alice", shell="/bin/bash")
|
||||
assert entry.is_regular_user() is True
|
||||
|
||||
|
||||
def test_is_regular_user_true_for_root_despite_uid_zero() -> None:
|
||||
entry = PasswdEntry(name="root", uid=0, home="/root", shell="/bin/bash")
|
||||
assert entry.is_regular_user() is True
|
||||
|
||||
|
||||
def test_is_regular_user_false_for_root_with_disabled_shell() -> None:
|
||||
entry = PasswdEntry(name="root", uid=0, home="/root", shell="/usr/sbin/nologin")
|
||||
assert entry.is_regular_user() is False
|
||||
|
||||
|
||||
def test_is_regular_user_false_for_disabled_shell_despite_high_uid() -> None:
|
||||
entry = PasswdEntry(
|
||||
name="nobody", uid=65534, home="/nonexistent", shell="/usr/sbin/false"
|
||||
)
|
||||
assert entry.is_regular_user() is False
|
||||
|
||||
|
||||
def test_is_regular_user_honors_custom_uid_min() -> None:
|
||||
entry = PasswdEntry(name="svc", uid=500, home="/home/svc", shell="/bin/bash")
|
||||
assert entry.is_regular_user(uid_min=1000) is False
|
||||
assert entry.is_regular_user(uid_min=100) is True
|
||||
|
||||
|
||||
def test_parse_login_defs_uid_min_found() -> None:
|
||||
content = "# comment\nUID_MIN\t500\nGID_MIN\t500\n"
|
||||
assert parse_login_defs_uid_min(content) == 500
|
||||
|
||||
|
||||
def test_parse_login_defs_uid_min_missing() -> None:
|
||||
assert parse_login_defs_uid_min("GID_MIN\t500\n") is None
|
||||
|
||||
|
||||
def test_parse_login_defs_uid_min_malformed_value() -> None:
|
||||
assert parse_login_defs_uid_min("UID_MIN\tnot-a-number\n") is None
|
||||
+31
-10
@@ -313,10 +313,26 @@ def test_apply_matches_index_url_to_replace_with_unrelated_files_and_multiple_re
|
||||
assert (dst / "etc/yum.repos.d/second.repo").exists()
|
||||
|
||||
|
||||
def test_apply_sanitizes_repository_and_key_names_with_slash(
|
||||
tmp_path, monkeypatch
|
||||
) -> None:
|
||||
def test_apply_sanitizes_key_name_with_slash(tmp_path, monkeypatch) -> None:
|
||||
mock_run = _mock_gpg_success(monkeypatch)
|
||||
data = {
|
||||
"uuid": "12345678-1234-5678-1234-567812345678",
|
||||
"organisation": "InterDiode",
|
||||
"configurations": {
|
||||
"yum": {"keys": [{"name": "../../evil-key", "content": KEY_CONTENT}]}
|
||||
},
|
||||
}
|
||||
dst = tmp_path / "dst"
|
||||
context = Context(config=make_config(data), dst=dst, src=None)
|
||||
|
||||
YumModule().apply(context)
|
||||
|
||||
key_content = (dst / "etc/pki/rpm-gpg/RPM-GPG-KEY-.._.._evil-key").read_bytes()
|
||||
assert key_content == b"fake-rpm-gpg-key-bytes"
|
||||
mock_run.assert_called_once()
|
||||
|
||||
|
||||
def test_apply_sanitizes_repository_name_with_disallowed_characters(tmp_path) -> None:
|
||||
data = {
|
||||
"uuid": "12345678-1234-5678-1234-567812345678",
|
||||
"organisation": "InterDiode",
|
||||
@@ -324,11 +340,10 @@ def test_apply_sanitizes_repository_and_key_names_with_slash(
|
||||
"yum": {
|
||||
"repositories": [
|
||||
{
|
||||
"name": "../../evil-repo",
|
||||
"name": "weird/repo]here[bad",
|
||||
"index-url": "https://example.invalid/yum",
|
||||
}
|
||||
],
|
||||
"keys": [{"name": "../../evil-key", "content": KEY_CONTENT}],
|
||||
]
|
||||
}
|
||||
},
|
||||
}
|
||||
@@ -337,10 +352,16 @@ def test_apply_sanitizes_repository_and_key_names_with_slash(
|
||||
|
||||
YumModule().apply(context)
|
||||
|
||||
assert (dst / "etc/yum.repos.d/.._.._evil-repo.repo").exists()
|
||||
key_content = (dst / "etc/pki/rpm-gpg/RPM-GPG-KEY-.._.._evil-key").read_bytes()
|
||||
assert key_content == b"fake-rpm-gpg-key-bytes"
|
||||
mock_run.assert_called_once()
|
||||
repo_file = dst / "etc/yum.repos.d/weird_repo_here_bad.repo"
|
||||
assert repo_file.exists()
|
||||
repo_content = repo_file.read_text(encoding="utf-8")
|
||||
assert repo_content == (
|
||||
"[weird_repo_here_bad]\n"
|
||||
"name=weird_repo_here_bad\n"
|
||||
"baseurl=https://example.invalid/yum\n"
|
||||
"enabled=1\n"
|
||||
"gpgcheck=0\n"
|
||||
)
|
||||
|
||||
|
||||
def test_import_key_raises_when_gpg_binary_missing(tmp_path, monkeypatch) -> None:
|
||||
|
||||
@@ -407,11 +407,11 @@ wheels = [
|
||||
|
||||
[[package]]
|
||||
name = "filelock"
|
||||
sdist = {url = "https://files.pythonhosted.org/packages/4b/51/a182494d1d8dde1240bff84dda57d48165d982e59582ce8f167e8e3d7628/filelock-4.0.10.tar.gz", hash = "sha256:00d6a81f976a6332551c2c10f39e12b4abb7e01c64d4c497b81a615bc9186f1f", size = 252487, upload-time = "2026-10-03T23:40:48.884Z"}
|
||||
sdist = {url = "https://files.pythonhosted.org/packages/d8/9c/925c4f62920e4200d573d2bfe5cfd1b993134c3aee5f9bd3b7c55e20297e/filelock-4.0.11.tar.gz", hash = "sha256:9dc453a1edd25626a6fc97c2cb1bd9f7e46345843d40b3181c071761fb9a5f7a", size = 253844, upload-time = "2026-10-05T00:57:32.47Z"}
|
||||
source = {registry = "https://pypi.org/simple"}
|
||||
version = "4.0.10"
|
||||
version = "4.0.11"
|
||||
wheels = [
|
||||
{url = "https://files.pythonhosted.org/packages/5b/2a/4b1ea3f2180be251a5cff1e70c8a5b7994ffa5c8eab8937901f8a9db58fe/filelock-4.0.10-py3-none-any.whl", hash = "sha256:698048d158dc3c9e18cc5e88b3efdd4bd0e77d76686b22adb4511cc4b2c2f0db", size = 111193, upload-time = "2026-10-03T23:40:47.334Z"}
|
||||
{url = "https://files.pythonhosted.org/packages/4a/4d/2983a9fc0a412a09151299d1ec9eb7511e3d577f7213e19395fabebf9db6/filelock-4.0.11-py3-none-any.whl", hash = "sha256:1cbdc4ace7fb11d2f6d073f5c3d91537a23b3d58d2bf2fdffc12c6d717a589c6", size = 111688, upload-time = "2026-10-05T00:57:30.896Z"}
|
||||
]
|
||||
|
||||
[[package]]
|
||||
@@ -424,7 +424,7 @@ dependencies = [
|
||||
]
|
||||
name = "id-configurator"
|
||||
source = {editable = "."}
|
||||
version = "2026.10.3"
|
||||
version = "2026.10.5"
|
||||
|
||||
[package.dev-dependencies]
|
||||
dev = [
|
||||
@@ -678,32 +678,37 @@ wheels = [
|
||||
|
||||
[[package]]
|
||||
name = "pycryptodomex"
|
||||
sdist = {url = "https://files.pythonhosted.org/packages/c9/85/e24bf90972a30b0fcd16c73009add1d7d7cd9140c2498a68252028899e41/pycryptodomex-3.23.0.tar.gz", hash = "sha256:71909758f010c82bc99b0abf4ea12012c98962fbf0583c2164f8b84533c2e4da", size = 4922157, upload-time = "2025-05-17T17:23:41.434Z"}
|
||||
sdist = {url = "https://files.pythonhosted.org/packages/4c/25/214ea825a9031f5af2c8b2506ee16701a2560d4712165dd00098dd527bcb/pycryptodomex-3.24.0.tar.gz", hash = "sha256:0428f19f13452c6b89bbaf2c530f84f369873811dfa77f0cee0da4f40fb0474f", size = 4933136, upload-time = "2026-10-04T17:41:08.988Z"}
|
||||
source = {registry = "https://pypi.org/simple"}
|
||||
version = "3.23.0"
|
||||
version = "3.24.0"
|
||||
wheels = [
|
||||
{url = "https://files.pythonhosted.org/packages/2e/00/10edb04777069a42490a38c137099d4b17ba6e36a4e6e28bdc7470e9e853/pycryptodomex-3.23.0-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:7b37e08e3871efe2187bc1fd9320cc81d87caf19816c648f24443483005ff886", size = 2498764, upload-time = "2025-05-17T17:22:21.453Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/6b/3f/2872a9c2d3a27eac094f9ceaa5a8a483b774ae69018040ea3240d5b11154/pycryptodomex-3.23.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:91979028227543010d7b2ba2471cf1d1e398b3f183cb105ac584df0c36dac28d", size = 1643012, upload-time = "2025-05-17T17:22:23.702Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/70/af/774c2e2b4f6570fbf6a4972161adbb183aeeaa1863bde31e8706f123bf92/pycryptodomex-3.23.0-cp313-cp313t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:6b8962204c47464d5c1c4038abeadd4514a133b28748bcd9fa5b6d62e3cec6fa", size = 2187643, upload-time = "2025-05-17T17:22:26.37Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/de/a3/71065b24cb889d537954cedc3ae5466af00a2cabcff8e29b73be047e9a19/pycryptodomex-3.23.0-cp313-cp313t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:a33986a0066860f7fcf7c7bd2bc804fa90e434183645595ae7b33d01f3c91ed8", size = 2273762, upload-time = "2025-05-17T17:22:28.313Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/c9/0b/ff6f43b7fbef4d302c8b981fe58467b8871902cdc3eb28896b52421422cc/pycryptodomex-3.23.0-cp313-cp313t-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:c7947ab8d589e3178da3d7cdeabe14f841b391e17046954f2fbcd941705762b5", size = 2313012, upload-time = "2025-05-17T17:22:30.57Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/02/de/9d4772c0506ab6da10b41159493657105d3f8bb5c53615d19452afc6b315/pycryptodomex-3.23.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:c25e30a20e1b426e1f0fa00131c516f16e474204eee1139d1603e132acffc314", size = 2186856, upload-time = "2025-05-17T17:22:32.819Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/28/ad/8b30efcd6341707a234e5eba5493700a17852ca1ac7a75daa7945fcf6427/pycryptodomex-3.23.0-cp313-cp313t-musllinux_1_2_i686.whl", hash = "sha256:da4fa650cef02db88c2b98acc5434461e027dce0ae8c22dd5a69013eaf510006", size = 2347523, upload-time = "2025-05-17T17:22:35.386Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/0f/02/16868e9f655b7670dbb0ac4f2844145cbc42251f916fc35c414ad2359849/pycryptodomex-3.23.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:58b851b9effd0d072d4ca2e4542bf2a4abcf13c82a29fd2c93ce27ee2a2e9462", size = 2272825, upload-time = "2025-05-17T17:22:37.632Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/ca/18/4ca89ac737230b52ac8ffaca42f9c6f1fd07c81a6cd821e91af79db60632/pycryptodomex-3.23.0-cp313-cp313t-win32.whl", hash = "sha256:a9d446e844f08299236780f2efa9898c818fe7e02f17263866b8550c7d5fb328", size = 1772078, upload-time = "2025-05-17T17:22:40Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/73/34/13e01c322db027682e00986873eca803f11c56ade9ba5bbf3225841ea2d4/pycryptodomex-3.23.0-cp313-cp313t-win_amd64.whl", hash = "sha256:bc65bdd9fc8de7a35a74cab1c898cab391a4add33a8fe740bda00f5976ca4708", size = 1803656, upload-time = "2025-05-17T17:22:42.139Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/54/68/9504c8796b1805d58f4425002bcca20f12880e6fa4dc2fc9a668705c7a08/pycryptodomex-3.23.0-cp313-cp313t-win_arm64.whl", hash = "sha256:c885da45e70139464f082018ac527fdaad26f1657a99ee13eecdce0f0ca24ab4", size = 1707172, upload-time = "2025-05-17T17:22:44.704Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/dd/9c/1a8f35daa39784ed8adf93a694e7e5dc15c23c741bbda06e1d45f8979e9e/pycryptodomex-3.23.0-cp37-abi3-macosx_10_9_universal2.whl", hash = "sha256:06698f957fe1ab229a99ba2defeeae1c09af185baa909a31a5d1f9d42b1aaed6", size = 2499240, upload-time = "2025-05-17T17:22:46.953Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/7a/62/f5221a191a97157d240cf6643747558759126c76ee92f29a3f4aee3197a5/pycryptodomex-3.23.0-cp37-abi3-macosx_10_9_x86_64.whl", hash = "sha256:b2c2537863eccef2d41061e82a881dcabb04944c5c06c5aa7110b577cc487545", size = 1644042, upload-time = "2025-05-17T17:22:49.098Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/8c/fd/5a054543c8988d4ed7b612721d7e78a4b9bf36bc3c5ad45ef45c22d0060e/pycryptodomex-3.23.0-cp37-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:43c446e2ba8df8889e0e16f02211c25b4934898384c1ec1ec04d7889c0333587", size = 2186227, upload-time = "2025-05-17T17:22:51.139Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/c8/a9/8862616a85cf450d2822dbd4fff1fcaba90877907a6ff5bc2672cafe42f8/pycryptodomex-3.23.0-cp37-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:f489c4765093fb60e2edafdf223397bc716491b2b69fe74367b70d6999257a5c", size = 2272578, upload-time = "2025-05-17T17:22:53.676Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/46/9f/bda9c49a7c1842820de674ab36c79f4fbeeee03f8ff0e4f3546c3889076b/pycryptodomex-3.23.0-cp37-abi3-manylinux_2_5_i686.manylinux1_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:bdc69d0d3d989a1029df0eed67cc5e8e5d968f3724f4519bd03e0ec68df7543c", size = 2312166, upload-time = "2025-05-17T17:22:56.585Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/03/cc/870b9bf8ca92866ca0186534801cf8d20554ad2a76ca959538041b7a7cf4/pycryptodomex-3.23.0-cp37-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:6bbcb1dd0f646484939e142462d9e532482bc74475cecf9c4903d4e1cd21f003", size = 2185467, upload-time = "2025-05-17T17:22:59.237Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/96/e3/ce9348236d8e669fea5dd82a90e86be48b9c341210f44e25443162aba187/pycryptodomex-3.23.0-cp37-abi3-musllinux_1_2_i686.whl", hash = "sha256:8a4fcd42ccb04c31268d1efeecfccfd1249612b4de6374205376b8f280321744", size = 2346104, upload-time = "2025-05-17T17:23:02.112Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/a5/e9/e869bcee87beb89040263c416a8a50204f7f7a83ac11897646c9e71e0daf/pycryptodomex-3.23.0-cp37-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:55ccbe27f049743a4caf4f4221b166560d3438d0b1e5ab929e07ae1702a4d6fd", size = 2271038, upload-time = "2025-05-17T17:23:04.872Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/8d/67/09ee8500dd22614af5fbaa51a4aee6e342b5fa8aecf0a6cb9cbf52fa6d45/pycryptodomex-3.23.0-cp37-abi3-win32.whl", hash = "sha256:189afbc87f0b9f158386bf051f720e20fa6145975f1e76369303d0f31d1a8d7c", size = 1771969, upload-time = "2025-05-17T17:23:07.115Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/69/96/11f36f71a865dd6df03716d33bd07a67e9d20f6b8d39820470b766af323c/pycryptodomex-3.23.0-cp37-abi3-win_amd64.whl", hash = "sha256:52e5ca58c3a0b0bd5e100a9fbc8015059b05cffc6c66ce9d98b4b45e023443b9", size = 1803124, upload-time = "2025-05-17T17:23:09.267Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/f9/93/45c1cdcbeb182ccd2e144c693eaa097763b08b38cded279f0053ed53c553/pycryptodomex-3.23.0-cp37-abi3-win_arm64.whl", hash = "sha256:02d87b80778c171445d67e23d1caef279bf4b25c3597050ccd2e13970b57fd51", size = 1707161, upload-time = "2025-05-17T17:23:11.414Z"}
|
||||
{url = "https://files.pythonhosted.org/packages/0f/52/5235086483b462600958549b27683ccffbb4941ba512934efc5a14b71a39/pycryptodomex-3.24.0-cp313-cp313t-macosx_10_13_universal2.whl", hash = "sha256:abf768c285d289c4a0e0678f055663162c9d6257c79f5904fbd2692ade94da1c", size = 2475900, upload-time = "2026-10-04T17:39:26.374Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/9e/cd/eeed4b1a1eda71a78defe2c04ff37909461f9c04cd4bde23011d4350cbfb/pycryptodomex-3.24.0-cp313-cp313t-macosx_10_13_x86_64.whl", hash = "sha256:c2f42f24d7112ebb93d3aed581d011c82c20101da7d7a6248145c530e99bd2eb", size = 1643488, upload-time = "2026-10-04T17:39:28.545Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/18/d2/22005d736858dddd3f7a5ddaf4a91dbb89292f0d9c503a9c13b1bb2ecfb8/pycryptodomex-3.24.0-cp313-cp313t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:e42a2e9531c40315290278d9eee93ea5031eda3c83969f5709ada51a1c7491b4", size = 2194768, upload-time = "2026-10-04T17:39:31.713Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/19/c4/c350bb48207ae2a6cca02eb45a2dafc3f2d0196b5b33b556cc9b6815e8cc/pycryptodomex-3.24.0-cp313-cp313t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:c7055400f773856cd219680d15525c6fb147237534cbe5394a5f92f57f7efaed", size = 2280612, upload-time = "2026-10-04T17:39:34.828Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/fe/56/539e213fbd572f8e95cdef5a46b0c327c7b2412107c3dba73913cfd20753/pycryptodomex-3.24.0-cp313-cp313t-musllinux_1_2_aarch64.whl", hash = "sha256:e8a7463d346015b42a0fb9c9179ebb7cccfd86bf40199c6796b546ac7be0b85c", size = 2186291, upload-time = "2026-10-04T17:39:38.184Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/9b/f3/f8e73be610ef576c6ca98a78c8450a72f12c178bc89d3e94068e48115c97/pycryptodomex-3.24.0-cp313-cp313t-musllinux_1_2_x86_64.whl", hash = "sha256:f96e10f0edff9d4b6b253e0a78f7c819749521d3ffe6af0139e08fcd35384405", size = 2278371, upload-time = "2026-10-04T17:39:41.539Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/16/bd/99c89964c5017488992f412f8d645923d8ef996c7f35fc76b7fe019620e1/pycryptodomex-3.24.0-cp313-cp313t-win32.whl", hash = "sha256:3b6276fe007464502df796710fb57dcfeb813b6ccac0eabaf85100be1ad358f2", size = 1792741, upload-time = "2026-10-04T17:39:44.173Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/ca/d5/5a1e469c7eab20c21090d396342894d2f0e25d429eb4df2d9174a03cb226/pycryptodomex-3.24.0-cp313-cp313t-win_amd64.whl", hash = "sha256:88d37b28b450c06a03bd5570467c601fe8c7dbe493ca39771716f56fdbe35d6e", size = 1825623, upload-time = "2026-10-04T17:39:46.422Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/1b/fb/1ca14c7e5318125aff23cd19886a62c8eb9015caa373b5834216c60260a5/pycryptodomex-3.24.0-cp313-cp313t-win_arm64.whl", hash = "sha256:e635c7ac056f2a47d79e2bf7042fb3fc6d175f47796a954388a3cec1f2e082a4", size = 1759392, upload-time = "2026-10-04T17:39:48.676Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/a0/dd/8f2d18986f752ceb245d4c3aeb0b13e9ed329d64434969981f0746b5b2ff/pycryptodomex-3.24.0-cp314-cp314t-macosx_10_15_universal2.whl", hash = "sha256:f6af77f15a91bb6c16607067cfd201330cf5dfefe1c715e955be1fb06d368613", size = 2476818, upload-time = "2026-10-04T17:39:51.311Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/8a/64/6bc2394a249d1c7ba330d192e4bf22d7e5a8caf28ef1dd346b8b847b91b3/pycryptodomex-3.24.0-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:582efdf767d72c12538949b876a64b9a7af30f2cff063c06dd63ece32c4e5c1d", size = 1645659, upload-time = "2026-10-04T17:39:53.936Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/46/36/f720afe32331ebf200bc37d335120f74da371969722d3c188fac757a8a71/pycryptodomex-3.24.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:5be79564e05ed620a63f353ea50e0d474eb598f70cda1b28c2ca8e9e2f02c139", size = 2194769, upload-time = "2026-10-04T17:39:57.357Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/05/ac/d0c3b629a9e91c9dee019fa59cdf9617b84b0d11909541e1d6c79b24637c/pycryptodomex-3.24.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:bb393480b5845ef4acbc9f713e4c473ad08be81bc3cdb5ef017cd02bdafd36e1", size = 2280609, upload-time = "2026-10-04T17:39:59.915Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/5f/0e/e64276b7f3dbe9aeabd9c80dfff10bc97740ad8e24892eb6b0e3cbdcd549/pycryptodomex-3.24.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:c7b8ad51baf3505dd3d94ec974855359d15769e45c58c2b89c6d4612b1f7ed94", size = 2186290, upload-time = "2026-10-04T17:40:02.856Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/42/2f/b72cc71bff456971e24e886f1824d2efef7b25fbd806eb821b107f8253e6/pycryptodomex-3.24.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:7ffcedf4210d8c206fe9852ccde9f78ec9ce35e8039f0a989900ffe710e7a5db", size = 2278371, upload-time = "2026-10-04T17:40:06.135Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/70/b0/9d0f0d4d6236f986c942d2933d4a5cbc209ebac1ea7d4c74b6e306efb439/pycryptodomex-3.24.0-cp314-cp314t-win32.whl", hash = "sha256:8d6c5e01e4fb1ddd20cc24d4d8706643dd78b5279453dabcf10ba4e0683bf9b2", size = 1808717, upload-time = "2026-10-04T17:40:09.172Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/8f/99/55c75d5c8c0e3c966c6f639e3b2556c54b0172501f7377cff2aa570447c7/pycryptodomex-3.24.0-cp314-cp314t-win_amd64.whl", hash = "sha256:c55e6c42f9eb43d90c15792bf69bc09cb3e13a5e55a30eecb555695a02b0d4c0", size = 1842528, upload-time = "2026-10-04T17:40:12.033Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/18/3d/2cdbda0eacc9875c5db5cede94389f8ca4a6a4bccbbbc74f47f8fa4f0c6c/pycryptodomex-3.24.0-cp314-cp314t-win_arm64.whl", hash = "sha256:6a62122fb4c85befcc01ec3a1ae5b2ba81689481aba1d383b4e21e34f18900dd", size = 1777885, upload-time = "2026-10-04T17:40:14.361Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/bc/fd/b9186cea5e823f91f40904373cff30cdaea5dfe1863b4be0ed3bf51e4db6/pycryptodomex-3.24.0-cp37-abi3-macosx_10_9_universal2.whl", hash = "sha256:ef2bd306328a8447d4d2af6037efddd67ef16630876ed3ec84babd16ca558941", size = 2476748, upload-time = "2026-10-04T17:40:17.326Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/65/c4/bf354a7c435da08ba9905a302dce8fac57a33b2ab1e51c78542b698b4b89/pycryptodomex-3.24.0-cp37-abi3-macosx_10_9_x86_64.whl", hash = "sha256:42c8221e3a4ca04b070cb388fca004815f6544951bfb2cc6c7958e293b7caf64", size = 1644339, upload-time = "2026-10-04T17:40:19.872Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/7b/ea/158d0ea838c92ba5d5081ce0f08e4af40d7278f7609ca007fca4d010aa4d/pycryptodomex-3.24.0-cp37-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:da9996407d03684221a4e1603b70fad97d8772185e5f75addcd97fcbc4c3281f", size = 2193232, upload-time = "2026-10-04T17:40:22.957Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/c8/9f/376b705a536c65fe41806babe5cdcfb076273a0d72dfbbb92073d3d9b10c/pycryptodomex-3.24.0-cp37-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:556e063b52f338bd924fe5c40692cc1f50cb0453bd1d6580b7ffff2eade1a894", size = 2279395, upload-time = "2026-10-04T17:40:25.777Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/d4/72/a0726c7165ba84d66923c3e5d5411c5abec9a9a4c1759a664e5cf8806a79/pycryptodomex-3.24.0-cp37-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:b6690bfae043c81108e28e31dc7e3afa8cb1b1eb0ba590fdbff2b66e4c6913e7", size = 2184779, upload-time = "2026-10-04T17:40:28.813Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/39/51/c5b9d8fc84d5cf67091a007b476e24f634252fb314472e27a58f3bd97458/pycryptodomex-3.24.0-cp37-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:5fa46af1281be707e0ec5878aea0f77d58d8d4b465f63f7385a71ae0080bfff9", size = 2276914, upload-time = "2026-10-04T17:40:31.23Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/c4/28/26f6d1b4257911bdab1c66c2a80e1193131bd8c02fa9ac04453cd45233c1/pycryptodomex-3.24.0-cp37-abi3-win32.whl", hash = "sha256:fab40542a863cc142a763aa92630d613925fe3e937bea3ba5fb735e0c42d4f96", size = 1792631, upload-time = "2026-10-04T17:40:33.61Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/4d/91/fa406bbeea093b53d314dfb0fd186658a69a398b73a3a609636b8402b5c3/pycryptodomex-3.24.0-cp37-abi3-win_amd64.whl", hash = "sha256:55f22d72250d7923aac3c2442ec6a1dd8774d2efa3bdcb0f68d5e137d372268e", size = 1825514, upload-time = "2026-10-04T17:40:36.059Z"},
|
||||
{url = "https://files.pythonhosted.org/packages/10/b0/c53c7ac97c5deb721aa4f940309802c71ff5ac2fdeac473ce96754c69e5b/pycryptodomex-3.24.0-cp37-abi3-win_arm64.whl", hash = "sha256:908f92fbc307b642b65580d0295698f423b057018d87ae43d441f1d1a00674a2", size = 1759397, upload-time = "2026-10-04T17:40:38.641Z"}
|
||||
]
|
||||
|
||||
[[package]]
|
||||
|
||||
Reference in New Issue
Block a user