v0.30.1

tools/checks/system_info_no_subprocess_contracts.py

@@ -0,0 +1,40 @@
+#!/usr/bin/env python3
+"""Offline source guard for subprocess-free system information; not a Rust runtime test."""
+from pathlib import Path
+import tomllib
+
+ROOT = Path(__file__).resolve().parents[2]
+manifest = tomllib.loads((ROOT / 'Cargo.toml').read_text())
+for dependency in ('sysinfo', 'metrics-process'):
+    assert dependency in manifest['dependencies'], dependency
+sysinfo_features = manifest['dependencies']['sysinfo']['features']
+assert {'network', 'system'} <= set(sysinfo_features), (
+    'sysinfo::System and sysinfo::Networks require both system and network features'
+)
+assert any('systemstat' in target.get('dependencies', {}) for target in manifest.get('target', {}).values())
+
+status = (ROOT / 'src/admin/status.rs').read_text()
+assert 'sysinfo::System::long_os_version()' in status
+assert 'sysinfo::System::kernel_version()' in status
+assert 'std::sync::OnceLock' in status
+for forbidden in ('Command::', 'std::process::Command', '/etc/os-release', '/proc/sys/kernel/osrelease'):
+    assert forbidden not in status, f'Status OS identification cannot use {forbidden}'
+
+metadata = (ROOT / 'src/acme/runtime_versions.rs').read_text()
+for marker in ('pyvenv.cfg', '.dist-info', 'METADATA', 'MAX_VERSION_METADATA_BYTES', 'MAX_PACKAGES_PER_SITE', 'fn runtime_versions('):
+    assert marker in metadata, marker
+for forbidden in ('Command::', '.spawn(', 'version_token(', '"--version"', "'-c'", '.await'):
+    assert forbidden not in metadata, f'Diagnostic versions must not execute: {forbidden}'
+
+runtime = (ROOT / 'src/acme/runtime_env.rs').read_text()
+assert 'include!("runtime_versions.rs")' in runtime
+assert 'runtime_versions(&venv_python(&managed), true, Some(&venv_certbot(&managed)))' in runtime
+assert 'python_version: versions.python' in runtime and 'certbot_version: versions.certbot' in runtime
+assert 'path.with_extension("exe")' in runtime, 'Windows executable discovery must include .exe'
+
+regressions = (ROOT / 'src/acme/tests.rs').read_text()
+for marker in ('managed_python_pip_and_certbot_versions_use_metadata_only',
+               'absent_or_unverified_versions_are_not_invented',
+               'conflicting_site_distributions_do_not_return_stale_versions'):
+    assert marker in regressions, marker
+print('PASS: shared Rust libraries, portable OS detection, no diagnostic subprocesses, bounded metadata and source regressions.')