orthonym.opsin_build#
Note
Internal API. Names and behaviour may change between releases.
Build an OPSIN jar from a commit of github.com/dan2097/opsin, for ORTHONYM_OPSIN=main[@ref].
Standard library only, like jars.py. OPSIN’s main branch uses the same third-party
libraries as the 2.9.0 release, so the pinned release jar supplies them and only OPSIN’s
own sources are compiled (javac; a JDK is needed for the opt-in only). Jar entries get
a fixed time and a fixed creator, so one commit, one release jar and one JDK always give the
same bytes. A jar is built in a private scratch directory, checked and hashed there, and
moved into the cache only when the check passes; the sidecar file opsin-main-<commit12>.json
is written last and is what marks a build as complete, so a half-built jar is never used.
The cache is a trust root: a jar from it runs with the user’s rights. It is a private
subdirectory of the jar directory (opsin-main, mode 0700, a real directory owned by the user
and not writable by group or others; anything else is refused with an error naming the path).
A cached jar and its sidecar are used only when both are regular files of the user that no one
else can write, the sidecar names the commit, and its is the jar’s. A commit string read
from a file must be 40 lowercase hex digits. Downloads and the unpacked archive have size limits.
A commit other than the tip of OPSIN’s main branch is built only when GitHub’s compare API says it
is an ancestor of that branch (the source archive service also serves commits that exist only in
forks); when GitHub cannot say, the build is refused.
Nothing here runs at import time and nothing is fetched unless a jar is asked for.
- orthonym.opsin_build.MAX_ARCHIVE_BYTES = 67108864#
Limits, about thirty times what a commit needs today (2.2 MB archive, 30 MB unpacked, 397 entries).
- exception orthonym.opsin_build.OpsinBuildError#
Bases:
RuntimeErrorThe opt-in OPSIN jar could not be built, checked or found.
- class orthonym.opsin_build.BuiltJar(path: pathlib.Path, commit: str, ref: str)#
Bases:
object- path: Path#
- commit: str#
- ref: str#
- orthonym.opsin_build.parse_choice(value)#
Nonefor the release jar (unset, empty or2.9.0), else the git ref to build.
- orthonym.opsin_build.resolve_commit(ref, timeout=30)#
- orthonym.opsin_build.require_on_main(commit, timeout=30)#
Raise unless
commitis the tip of OPSIN’s main branch or one of its ancestors.The source archive service builds any commit of the repository network, forks included, so a commit named by hash is checked with GitHub’s compare API (
statusidenticalorbehind: the commit is in the history of the branch). Fails closed: an answer that cannot be had or read is a refusal.
- orthonym.opsin_build.write_jar(files, manifest, out)#
- orthonym.opsin_build.build_jar(commit, base_jar, out)#
Compile the sources of
commitagainst the libraries ofbase_jarand write the jar toout.
- orthonym.opsin_build.self_test(jar)#
Read the names of
_SELFTESTwithjar; raise unless every structure is the expected one.
- orthonym.opsin_build.trusted_file(path)#
pathis a regular file of this user (no symlink) that group and others cannot write.
- orthonym.opsin_build.private_dir(jar_dir, create)#
The private cache
<jar_dir>/opsin-main: made with mode 0700 whencreateand absent; None when it is absent and not asked for. A directory that is there but is not a real directory of this user without group or other write is refused (OpsinBuildErrornaming it), never used.
- orthonym.opsin_build.ensure_jar(ref, jar_dir, base_jar, download=True)#
The jar of OPSIN
refin the private cache ofjar_dir: the cached build when it checks out, else (download) a new, checked one. A cached jar that fails its checks counts as not built.