Something went wrong. Try again.
personal memory agent
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265#!/usr/bin/env python3# SPDX-License-Identifier: AGPL-3.0-only# Copyright (c) 2026 sol pbc
"""Pinned public and private inputs for the release rail."""
from __future__ import annotations
import refrom dataclasses import dataclassfrom pathlib import Pathfrom typing import Literal
LaneName = Literal[ "source", "linux-x86_64-musl", "linux-aarch64-musl", "macos-arm64",]
PYTHON_SOURCE_LINUX_VERSION = "3.14.3"PYTHON_MACOS_VERSION = "3.14.6"
RUSTC_VERSION_BANNER = "rustc 1.97.1 (8bab26f4f 2026-07-14)"RUSTC_BINARY_PIN = "rustc"RUSTC_COMMIT_HASH_PIN = "8bab26f4f68e0e26f0bb7960be334d5b520ea452"RUSTC_COMMIT_DATE_PIN = "2026-07-14"RUSTC_RELEASE_PIN = "1.97.1"RUSTC_LLVM_PIN = "22.1.6"CARGO_VERSION_PIN = "cargo 1.97.1 (c980f4866 2026-06-30)"CARGO_RELEASE_PIN = "1.97.1"CARGO_DENY_VERSION = "0.20.2"CARGO_DENY_PIN = f"cargo-deny {CARGO_DENY_VERSION}"
UV_VERSION = "0.11.4"UV_PIN = f"uv {UV_VERSION}"UV_LINUX_FIXTURE_BANNER = f"uv {UV_VERSION} (x86_64-unknown-linux-gnu)"UV_MACOS_FIXTURE_BANNER = f"uv {UV_VERSION} (Homebrew 2026-04-08 aarch64-apple-darwin)"HOST_VARIANT_TOOL_KEYS = frozenset(("uv", "swift"))MATURIN_VERSION = "1.14.1"MATURIN_REQUIREMENT = f"maturin=={MATURIN_VERSION}"MATURIN_PIN = f"maturin {MATURIN_VERSION}"ZIG_VERSION = "0.16.0"ZIG_PIN = f"zig {ZIG_VERSION}"
MACOS_XCODE_VERSION = "26.6"MACOS_XCODE_BUILD = "17F113"MACOS_XCODE_PIN = f"xcode {MACOS_XCODE_VERSION} build {MACOS_XCODE_BUILD}"MACOS_SWIFT_PIN = "Apple Swift version 6.3.3 (swiftlang-6.3.3.1.3 clang-2100.1.1.101)"MACOS_SWIFT_FIXTURE_BANNER = ( "swift-driver version: 1.148.6 " "Apple Swift version 6.3.3 " "(swiftlang-6.3.3.1.3 clang-2100.1.1.101)")MACOS_SWIFT_TARGET_LINE = "Target: arm64-apple-macosx26.0"MACOS_SWIFT_RAW_BANNER = f"{MACOS_SWIFT_FIXTURE_BANNER}\n{MACOS_SWIFT_TARGET_LINE}"MACOS_SWIFT_FLATTENED_BANNER = f"{MACOS_SWIFT_FIXTURE_BANNER} {MACOS_SWIFT_TARGET_LINE}"MACOS_CODESIGN_PATH = "/usr/bin/codesign"MACOS_CODESIGN_PUBLIC_PIN = "codesign pinned-path verified"# xcrun notarytool --version prints the bare grounded output, with no tool prefix.MACOS_NOTARYTOOL_PIN = "1.1.2 (41)"MACOS_SIGNING_MODE = "signed-verified"
MACOS_SIGNER_IDENTITY = "Developer ID Application: sol pbc (7QCG8V4M6H)"MACOS_TEAM_IDENTIFIER = "7QCG8V4M6H"PRIVATE_SIGNING_POLICY_VALUES = frozenset( (MACOS_SIGNER_IDENTITY, MACOS_TEAM_IDENTIFIER))
SETUPTOOLS_BUILD_REQUIRES = ("setuptools==83.0.0", "wheel==0.47.0")_MACOS_SWIFT_BANNER_RE = re.compile( r"^(?:swift-driver version: (?P<driver>\d+(?:\.\d+){2}) )?" r"Apple Swift version (?P<version>\d+(?:\.\d+){2}) " r"\(swiftlang-(?P<swiftlang>\d+(?:\.\d+){4}) " r"clang-(?P<clang>\d+(?:\.\d+){3})\)(?:[ \n]Target: \S+)?$")SwiftToolIdentity = tuple[str, str, str]HostVariantToolIdentity = str | SwiftToolIdentity
@dataclass(frozen=True)class ReleaseToolPins: python_source_linux_version: str = PYTHON_SOURCE_LINUX_VERSION python_macos_version: str = PYTHON_MACOS_VERSION rustc_version_banner: str = RUSTC_VERSION_BANNER cargo_version_pin: str = CARGO_VERSION_PIN cargo_deny_version: str = CARGO_DENY_VERSION uv_pin: str = UV_PIN maturin_pin: str = MATURIN_PIN zig_pin: str = ZIG_PIN macos_xcode_pin: str = MACOS_XCODE_PIN macos_swift_pin: str = MACOS_SWIFT_PIN macos_codesign_public_pin: str = MACOS_CODESIGN_PUBLIC_PIN macos_notarytool_pin: str = MACOS_NOTARYTOOL_PIN macos_signing_mode: str = MACOS_SIGNING_MODE
def load_release_tool_pins(_root: Path | None = None) -> ReleaseToolPins: return ReleaseToolPins()
def _single_stripped_line(value: str) -> str | None: stripped = value.strip() if not stripped or stripped != value: return None if len(value.splitlines()) != 1: return None return value
def parse_macos_swift_banner(value: str) -> SwiftToolIdentity | None: match = _MACOS_SWIFT_BANNER_RE.fullmatch(value) if match is None: return None return (match["version"], match["swiftlang"], match["clang"])
def parse_host_variant_tool_banner( tool: str, value: str) -> HostVariantToolIdentity | None: if tool == "swift": return parse_macos_swift_banner(value) line = _single_stripped_line(value) if line is None: return None parts = line.split(" ", 2) if len(parts) != 3: return None actual_tool, version, rest = parts if actual_tool != tool: return None if not version or any( char.isspace() or char == "(" or char == ")" for char in version ): return None if len(rest) < 3 or rest[0] != "(" or rest[-1] != ")": return None host = rest[1:-1] if not host or host.strip() != host or len(host.splitlines()) != 1: return None if any(char == "(" or char == ")" for char in host): return None return version
def parse_tool_pin_version(tool: str, value: str) -> str | None: line = _single_stripped_line(value) if line is None: return None parts = line.split(" ") if len(parts) != 2: return None actual_tool, version = parts if actual_tool != tool: return None if not version or any( char.isspace() or char == "(" or char == ")" for char in version ): return None return version
def parse_host_variant_tool_pin( tool: str, value: str) -> HostVariantToolIdentity | None: if tool == "swift": return parse_macos_swift_banner(value) return parse_tool_pin_version(tool, value)
def check_host_variant_tool_pin(tool: str, expected_pin: str, actual: str) -> bool: expected_identity = parse_host_variant_tool_pin(tool, expected_pin) actual_identity = parse_host_variant_tool_banner(tool, actual) return ( expected_identity is not None and actual_identity is not None and actual_identity == expected_identity )
def tool_value_matches_pin(key: str, expected_value: str, actual: object) -> bool: if actual is None: return False if key in HOST_VARIANT_TOOL_KEYS: if not isinstance(actual, str): return False return check_host_variant_tool_pin(key, expected_value, actual) return actual == expected_value
def fixture_lane_tool_evidence(lane: LaneName) -> dict[str, str]: uv_banner = ( UV_MACOS_FIXTURE_BANNER if lane == "macos-arm64" else UV_LINUX_FIXTURE_BANNER ) common = { "python": PYTHON_MACOS_VERSION if lane == "macos-arm64" else PYTHON_SOURCE_LINUX_VERSION, "rustc": RUSTC_VERSION_BANNER, "cargo": CARGO_VERSION_PIN, "uv": uv_banner, "maturin": MATURIN_PIN, "cargo-deny": CARGO_DENY_PIN, } if lane in {"linux-x86_64-musl", "linux-aarch64-musl"}: common["zig"] = ZIG_PIN if lane == "macos-arm64": common.update( { "xcode": MACOS_XCODE_PIN, "swift": MACOS_SWIFT_FIXTURE_BANNER, "codesign": MACOS_CODESIGN_PUBLIC_PIN, "notarytool": MACOS_NOTARYTOOL_PIN, "signing_mode": MACOS_SIGNING_MODE, } ) if lane == "source": keys = ("python", "rustc", "cargo", "uv", "maturin", "cargo-deny") elif lane in {"linux-x86_64-musl", "linux-aarch64-musl"}: keys = ("python", "rustc", "cargo", "uv", "maturin", "cargo-deny", "zig") elif lane == "macos-arm64": keys = ( "python", "rustc", "cargo", "uv", "maturin", "cargo-deny", "xcode", "swift", "codesign", "notarytool", "signing_mode", ) else: raise ValueError(f"unknown release lane: {lane}") return {key: common[key] for key in keys}
def fixture_presign_lane_tool_evidence(lane: LaneName) -> dict[str, str]: evidence = fixture_lane_tool_evidence(lane) if lane == "macos-arm64": evidence = { key: value for key, value in evidence.items() if key != "signing_mode" } return evidence
def fixture_native_tools(lane: LaneName) -> dict[str, str]: if lane == "source": return {"uv": UV_LINUX_FIXTURE_BANNER, "maturin": MATURIN_PIN} if lane in {"linux-x86_64-musl", "linux-aarch64-musl"}: return {"uv": UV_LINUX_FIXTURE_BANNER, "maturin": MATURIN_PIN, "zig": ZIG_PIN} if lane == "macos-arm64": return { "uv": UV_MACOS_FIXTURE_BANNER, "maturin": MATURIN_PIN, "xcode": MACOS_XCODE_PIN, "swift": MACOS_SWIFT_FIXTURE_BANNER, "codesign": MACOS_CODESIGN_PUBLIC_PIN, "notarytool": MACOS_NOTARYTOOL_PIN, "signing_mode": MACOS_SIGNING_MODE, } raise ValueError(f"unknown release lane: {lane}")