Skip to content

Commit e27d2e9

Browse files
muscariellomuscariello
authored
feat: Add SHADI implementation (#2)
* feat: Add SHADI implementation Signed-off-by: Luca Muscariello <muscariello@ieee.org> * chore: remove issue pr description file Signed-off-by: Luca Muscariello <muscariello@ieee.org> * ci: install nettle and llvm dependencies Signed-off-by: Luca Muscariello <muscariello@ieee.org> * ci: fix macos pyo3 linking Signed-off-by: Luca Muscariello <muscariello@ieee.org> * ci: skip shadi_py tests on macos Signed-off-by: Luca Muscariello <muscariello@ieee.org> * ci: install openssl for windows Signed-off-by: Luca Muscariello <muscariello@ieee.org> * ci: use preinstalled vcpkg on windows Signed-off-by: Luca Muscariello <muscariello@ieee.org> * ci: add pkg-config and nettle on windows Signed-off-by: Luca Muscariello <muscariello@ieee.org> * chore: add codeowners Signed-off-by: Luca Muscariello <muscariello@ieee.org> * build: add Windows build and test support - Add windows-shell to Justfile and windows-build/windows-test recipes - Fix Win32_Security_Isolation missing feature in shadi_sandbox - Fix WindowsAclRollback visibility and unused-mut warnings - Switch sequoia-openpgp to crypto-rust backend on Windows (pure Rust, no native deps) with allow-experimental-crypto and allow-variable-time-crypto opt-in flags - Fix test failures on Windows: backslash escaping in path assertions, Windows-specific run_cli_executes_allowed_command using where.exe - Update ci.yml: add windows-latest matrix, taiki-e/install-action for just, Swatinem/rust-cache@v2 with cache-on-failure on all platforms - Add Swatinem/rust-cache@v2 to coverage.yml Signed-off-by: Luca Muscariello <muscariello@ieee.org> Signed-off-by: Luca Muscariello (lumuscar) <lumuscar@cisco.com> * ci: restore OpenSSL env vars for libsqlite3-sys on Windows libsqlite3-sys (sqlcipher) requires OPENSSL_DIR to compile on Windows regardless of the sequoia-openpgp crypto backend. Detect pre-installed OpenSSL on the runner and only fall back to choco if not found. Auto-detect lib dir (VC\x64\MD vs lib) to handle different installers. Signed-off-by: Luca Muscariello <muscariello@ieee.org> Signed-off-by: Luca Muscariello (lumuscar) <lumuscar@cisco.com> * Add portable launcher profiles and verifiable human-agent identity derivation Signed-off-by: Luca Muscariello <muscariello@ieee.org> * fix(shadi-py): resolve macOS PyO3 linking and expand root README Signed-off-by: Luca Muscariello <muscariello@ieee.org> * docs(scripts): update launcher script guide Signed-off-by: Luca Muscariello <muscariello@ieee.org> * test(shadictl): make profile path assertions cross-platform Signed-off-by: Luca Muscariello <muscariello@ieee.org> * fix(windows): preserve existing DACL when granting sandbox access Signed-off-by: Luca Muscariello <muscariello@ieee.org> --------- Signed-off-by: Luca Muscariello <muscariello@ieee.org> Signed-off-by: Luca Muscariello (lumuscar) <lumuscar@cisco.com>
1 parent 90161b7 commit e27d2e9

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

94 files changed

+16819
-2
lines changed

‎.github/CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
* @rustaceans

‎.github/workflows/ci.yml‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
name: CI
2+
3+
on:
4+
pull_request:
5+
6+
jobs:
7+
build-test:
8+
runs-on: ${{ matrix.os }}
9+
strategy:
10+
matrix:
11+
os:
12+
- ubuntu-latest
13+
- macos-latest
14+
- windows-latest
15+
env:
16+
PYO3_PYTHON: python
17+
steps:
18+
- name: Checkout
19+
uses: actions/checkout@v4
20+
- name: Setup Rust
21+
uses: dtolnay/rust-toolchain@stable
22+
- name: Setup Python
23+
uses: actions/setup-python@v5
24+
with:
25+
python-version: "3.12"
26+
- name: Restore Rust cache
27+
uses: Swatinem/rust-cache@v2
28+
with:
29+
cache-on-failure: true
30+
- name: Install just
31+
if: runner.os == 'Windows'
32+
uses: taiki-e/install-action@v2
33+
with:
34+
tool: just
35+
- name: Set OpenSSL env vars (Windows)
36+
if: runner.os == 'Windows'
37+
shell: pwsh
38+
run: |
39+
$candidates = @("C:\Program Files\OpenSSL-Win64", "C:\Program Files\OpenSSL", "C:\OpenSSL-Win64")
40+
$opensslDir = $candidates | Where-Object { Test-Path $_ } | Select-Object -First 1
41+
if (-not $opensslDir) {
42+
choco install openssl -y --no-progress
43+
$opensslDir = "C:\Program Files\OpenSSL-Win64"
44+
}
45+
$libDir = if (Test-Path "$opensslDir\lib\VC\x64\MD") { "$opensslDir\lib\VC\x64\MD" } else { "$opensslDir\lib" }
46+
"OPENSSL_DIR=$opensslDir" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
47+
"OPENSSL_LIB_DIR=$libDir" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
48+
"OPENSSL_INCLUDE_DIR=$opensslDir\include" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
49+
- name: Install Linux dependencies
50+
if: runner.os == 'Linux'
51+
run: sudo apt-get update && sudo apt-get install -y pkg-config nettle-dev
52+
- name: Install macOS dependencies
53+
if: runner.os == 'macOS'
54+
run: brew install python@3.12 nettle pkg-config
55+
- name: Set Python for PyO3 (macOS)
56+
if: runner.os == 'macOS'
57+
run: echo "PYO3_PYTHON=/opt/homebrew/opt/python@3.12/bin/python3.12" >> "$GITHUB_ENV"
58+
- name: Build and test
59+
if: runner.os != 'Windows'
60+
run: cargo test --workspace
61+
- name: Build and test (Windows)
62+
if: runner.os == 'Windows'
63+
shell: pwsh
64+
run: just windows-test

‎.github/workflows/coverage.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
name: Coverage
2+
3+
on:
4+
pull_request:
5+
6+
jobs:
7+
coverage:
8+
runs-on: macos-latest
9+
env:
10+
PYO3_PYTHON: "/opt/homebrew/opt/python@3.12/bin/python3.12"
11+
steps:
12+
- name: Checkout
13+
uses: actions/checkout@v4
14+
- name: Setup Rust
15+
uses: dtolnay/rust-toolchain@stable
16+
- name: Install Homebrew dependencies
17+
run: brew install python@3.12 just llvm nettle pkg-config
18+
- name: Restore Rust cache
19+
uses: Swatinem/rust-cache@v2
20+
with:
21+
cache-on-failure: true
22+
- name: Install cargo-llvm-cov
23+
uses: taiki-e/install-action@v2
24+
with:
25+
tool: cargo-llvm-cov
26+
- name: Generate coverage
27+
run: just coverage
28+
- name: Upload coverage to Codecov
29+
uses: codecov/codecov-action@v4
30+
with:
31+
files: coverage/lcov.info
32+
token: ${{ secrets.CODECOV_TOKEN }}

‎.github/workflows/publish.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: Publish
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
workflow_dispatch:
8+
9+
jobs:
10+
publish:
11+
runs-on: ubuntu-latest
12+
env:
13+
CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
14+
steps:
15+
- name: Checkout
16+
uses: actions/checkout@v4
17+
- name: Setup Rust
18+
uses: dtolnay/rust-toolchain@stable
19+
- name: Rust cache
20+
uses: Swatinem/rust-cache@v2
21+
- name: Publish crates
22+
run: |
23+
cargo publish -p agent_secrets
24+
cargo publish -p shadi_sandbox
25+
cargo publish -p shadi_memory
26+
cargo publish -p agent_transport_slim
27+
cargo publish -p shadi_py
28+
cargo publish -p slim_mas
29+
cargo publish -p shadictl

‎.gitignore‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Rust
2+
/target/
3+
**/*.rs.bk
4+
5+
# Python
6+
.venv/
7+
.venv-py312/
8+
__pycache__/
9+
**/*.py[cod]
10+
.adk/
11+
12+
# MkDocs
13+
/site/
14+
15+
# Coverage
16+
/coverage/
17+
18+
# Local data
19+
.tmp/
20+
tmp/
21+
*.db
22+
23+
# Editors
24+
.vscode/
25+
26+
# OS
27+
.DS_Store

0 commit comments

Comments
 (0)