constants.py
python
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1
docs: MuseHub-first before ISR #74 — staging solidify NEXT
Human
9 hours ago
| 1 | """Frozen constants for Q3-release desktop installers (§QR.4–§QR.8).""" |
| 2 | |
| 3 | from __future__ import annotations |
| 4 | |
| 5 | PRODUCT_NAME = "Overseer Kit" |
| 6 | PRODUCT_IDENTIFIER = "com.overseer.kit.desktop" |
| 7 | MANIFEST_SCHEMA_VERSION = 1 |
| 8 | MANIFEST_FILENAME_TEMPLATE = "overseer-kit-desktop-{version}-manifest.json" |
| 9 | SHA256SUMS_FILENAME = "SHA256SUMS.txt" |
| 10 | |
| 11 | PLATFORMS = frozenset({"macos", "windows", "linux"}) |
| 12 | SIGNING_STATUSES = frozenset({"signed", "unsigned", "unavailable"}) |
| 13 | SIGNING_METHODS = frozenset( |
| 14 | { |
| 15 | "developer_id_notarized", |
| 16 | "authenticode", |
| 17 | "minisign_detached", |
| 18 | "gpg_detached", |
| 19 | "none", |
| 20 | } |
| 21 | ) |
| 22 | |
| 23 | # Platform → allowed methods when status is ``signed`` (§QR.5 / §QR.7.1). |
| 24 | SIGNED_METHODS_BY_PLATFORM: dict[str, frozenset[str]] = { |
| 25 | "macos": frozenset({"developer_id_notarized"}), |
| 26 | "windows": frozenset({"authenticode"}), |
| 27 | "linux": frozenset({"minisign_detached", "gpg_detached"}), |
| 28 | } |
| 29 | |
| 30 | # §QR.6.2 — exact GitHub Actions secret names. |
| 31 | APPLE_SECRETS = ( |
| 32 | "APPLE_CERTIFICATE", |
| 33 | "APPLE_CERTIFICATE_PASSWORD", |
| 34 | "APPLE_ID", |
| 35 | "APPLE_TEAM_ID", |
| 36 | "APPLE_APP_SPECIFIC_PASSWORD", |
| 37 | "APPLE_SIGNING_IDENTITY", |
| 38 | ) |
| 39 | APPLE_API_KEY_SECRETS = ( |
| 40 | "APPLE_API_KEY", |
| 41 | "APPLE_API_KEY_ID", |
| 42 | "APPLE_API_ISSUER", |
| 43 | "APPLE_TEAM_ID", |
| 44 | ) |
| 45 | WINDOWS_SECRETS = ( |
| 46 | "WINDOWS_CERTIFICATE", |
| 47 | "WINDOWS_CERTIFICATE_PASSWORD", |
| 48 | ) |
| 49 | LINUX_SECRETS = ( |
| 50 | "LINUX_SIGNING_KEY", |
| 51 | "LINUX_SIGNING_KEY_PASSWORD", |
| 52 | ) |
| 53 | |
| 54 | ALL_RELEASE_SECRET_NAMES = frozenset( |
| 55 | (*APPLE_SECRETS, *APPLE_API_KEY_SECRETS, *WINDOWS_SECRETS, *LINUX_SECRETS) |
| 56 | ) |
| 57 | |
| 58 | # Bundle script closed allowlist (§QR.6.3) — dirs + files relative to kit root. |
| 59 | BUNDLE_ALLOWLIST_DIRS = frozenset({"adapters", "cli", "tools", "policy", "templates", "cursor"}) |
| 60 | BUNDLE_ALLOWLIST_FILES = frozenset({"VERSION", "pyproject.toml"}) |
| 61 | |
| 62 | # Publish allowlist extensions / names (§QR.4.5). |
| 63 | ALLOWED_INSTALLER_SUFFIXES = (".dmg", ".msi", ".AppImage") |
| 64 | ALLOWED_SIDECAR_SUFFIXES = (".AppImage.minisig", ".AppImage.asc") |
| 65 | |
| 66 | PUBLIC_KEY_ALLOWED_SUFFIXES = (".pub", ".asc", ".minisign.pub") |
| 67 | PRIVATE_KEY_BASENAME_MARKERS = ( |
| 68 | "private", |
| 69 | ".p12", |
| 70 | ".pfx", |
| 71 | ".key", |
| 72 | "secret", |
| 73 | "seckey", |
| 74 | ) |
| 75 | |
| 76 | # Stress / performance bounds documented for §QR.13. |
| 77 | MANIFEST_ARTIFACT_CAP = 50 |
| 78 | VERSION_ALIGN_PERF_BOUND_SECONDS = 2.0 |
| 79 | |
| 80 | MACOS_PINNED_RUNNERS = frozenset({"macos-14", "macos-15"}) |
| 81 | LINUX_PINNED_RUNNERS = frozenset({"ubuntu-22.04", "ubuntu-24.04"}) |
File History
1 commit
sha256:a78e7e5a8740e03315f325d19edeb3aa1b306b3337d04abbaa9a9e0f3bbeb7a1
docs: MuseHub-first before ISR #74 — staging solidify NEXT
Human
9 hours ago