42 lines
1.4 KiB
Python
42 lines
1.4 KiB
Python
"""Local development digest helpers for built-in SDK workload definitions.
|
|
|
|
This module is a leaf: it must not import other SDK workload modules, so the
|
|
workload definition packages (``search``, ``graph``, ``descriptors``) and the
|
|
``builtins`` registry wiring can import it without creating cycles.
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
import hashlib
|
|
import platform
|
|
import sys
|
|
|
|
from rdkit import rdBase
|
|
|
|
from scimesh.sdk.integrity import installed_distribution_digest
|
|
|
|
|
|
def current_scimesh_package_digest() -> str:
|
|
"""Hash installed SciMesh Python sources for the built-in trusted adapters.
|
|
|
|
This is a local immutable-code pin, not a package signature or container
|
|
attestation. Consequently the built-in manifests are trusted only; an
|
|
administrator must supply signed image metadata before enabling an
|
|
untrusted quorum policy.
|
|
"""
|
|
# Source/editable installs are allowed only for this explicit local
|
|
# development helper. Registry discovery keeps the secure default.
|
|
return installed_distribution_digest("scimesh", allow_editable=True)
|
|
|
|
|
|
def current_environment_digest() -> str:
|
|
payload = "\n".join(
|
|
(
|
|
current_scimesh_package_digest(),
|
|
f"python={sys.implementation.name}-{platform.python_version()}",
|
|
f"rdkit={rdBase.rdkitVersion}",
|
|
f"platform={sys.platform}-{platform.machine().lower()}",
|
|
)
|
|
)
|
|
return "sha256:" + hashlib.sha256(payload.encode("utf-8")).hexdigest()
|