Repository navigation
Expand file tree
/
Copy pathpyproject.toml
More file actions
122 lines (105 loc) · 3.6 KB
/
Copy pathpyproject.toml
File metadata and controls
122 lines (105 loc) · 3.6 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
[project]
name = "pyisolate"
version = "0.0.1"
description = "Prototype PyIsolate sandbox; kernel enforcement and no-GIL support are experimental roadmap items"
readme = "README.md"
license = "MIT"
license-files = ["LICENSE"]
authors = [{ name = "PyIsolate" }]
requires-python = ">=3.11"
keywords = [
"sandbox",
"isolation",
"security",
"seccomp",
"landlock",
"ebpf",
"sub-interpreter",
"no-gil",
]
classifiers = [
"Development Status :: 2 - Pre-Alpha",
"Intended Audience :: Developers",
"Operating System :: POSIX :: Linux",
"Programming Language :: Python :: 3",
"Programming Language :: Python :: 3.11",
"Programming Language :: Python :: 3.12",
"Programming Language :: Python :: 3.13",
"Programming Language :: Python :: 3.14",
"Topic :: Security",
"Topic :: Software Development :: Libraries :: Python Modules",
"Topic :: System :: Systems Administration",
]
dependencies = ["pyyaml", "cryptography", "platformdirs"]
[project.urls]
Homepage = "https://github.com/seanwevans/pyisolate"
Repository = "https://github.com/seanwevans/pyisolate"
Issues = "https://github.com/seanwevans/pyisolate/issues"
Changelog = "https://github.com/seanwevans/pyisolate/blob/main/CHANGELOG.md"
[build-system]
# setuptools >= 77 emits PEP 639 license metadata (License-Expression /
# License-File) that twine check and modern PyPI validate cleanly.
requires = ["setuptools>=77"]
build-backend = "setuptools.build_meta"
[tool.setuptools.packages.find]
include = ["pyisolate", "pyisolate.*"]
[tool.setuptools.package-data]
"pyisolate.policy.templates" = ["*.yml"]
"pyisolate.bpf" = ["*.bpf.c"]
[project.scripts]
pyisolate = "pyisolate.cli:main"
pyisolate-doctor = "pyisolate.doctor:main"
[project.optional-dependencies]
pqcrypto = ["pqcrypto"]
operator = ["kubernetes"]
release = [
"build",
"twine",
"sigstore",
]
dev = [
"pytest",
"pre-commit",
"black",
"isort",
"flake8",
"pylint",
"mypy",
"coverage",
"coverage-badge",
]
[tool.mypy]
python_version = "3.11"
ignore_missing_imports = true
[tool.pylint.main]
# pylint is tracked as a quality badge (see scripts/pylint_badge.py) rather than
# requiring a perfect score. fail-under keeps the CI hook from blocking on the
# project's accepted level of style/refactor findings while still surfacing them.
fail-under = 8.0
[tool.pytest.ini_options]
markers = [
"adversarial: adversarial input and exploit-style behavior",
"runaway_cpu: CPU quota and runaway loop enforcement",
"memory_exhaustion: memory pressure and exhaustion scenarios",
"import_escape: module import escape attempts",
"policy_bypass: file/network policy bypass attempts",
"race: high-concurrency race scenarios",
"no_gil: experimental free-threaded/no-GIL roadmap scenarios",
"soak: long-running spawn/kill stability coverage",
"crash_injection: injected crash/fault-recovery scenarios",
"cross_kernel: kernel-version compatibility scenarios",
]
[tool.isort]
profile = "black"
[tool.coverage.run]
# Scope measurement to the package. Without this, coverage also reports the
# test files themselves, which are ~100% by construction and inflate the total
# into something that cannot regress meaningfully.
source = ["pyisolate"]
[tool.coverage.report]
show_missing = true
# A floor, not a target. The suite sits above this; the point is that a change
# which drops package coverage substantially fails CI instead of being noticed
# months later. Kernel-gated tests (Landlock, BPF, cgroup) skip on hosts without
# those features, so the floor is set below the observed value rather than at it.
fail_under = 70