From 4e4b99aa9ea2849f271a5adbd330fcadf338c461 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 5 Aug 2026 06:41:26 +0900 Subject: [PATCH 1/7] ci: stage fail-closed LLVM coverage repair --- .../repair-opencode-llvm-coverage.yml | 142 ++++++++++++++++++ 1 file changed, 142 insertions(+) create mode 100644 .github/workflows/repair-opencode-llvm-coverage.yml diff --git a/.github/workflows/repair-opencode-llvm-coverage.yml b/.github/workflows/repair-opencode-llvm-coverage.yml new file mode 100644 index 000000000..03ef981a0 --- /dev/null +++ b/.github/workflows/repair-opencode-llvm-coverage.yml @@ -0,0 +1,142 @@ +name: Repair OpenCode LLVM coverage tooling + +on: + pull_request: + types: [opened, reopened, synchronize] + +permissions: + contents: read + +concurrency: + group: repair-opencode-llvm-coverage-${{ github.event.pull_request.head.sha }} + cancel-in-progress: false + +jobs: + repair: + if: >- + github.event.pull_request.head.repo.full_name == github.repository && + github.head_ref == 'fix/opencode-llvm-coverage-tools' && + github.actor != 'github-actions[bot]' + permissions: + contents: write + runs-on: ubuntu-latest + timeout-minutes: 20 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ github.event.pull_request.head.sha }} + fetch-depth: 0 + persist-credentials: false + + - name: Verify exact audited parent and trigger-only delta + env: + EXPECTED_PARENT: 3f65dbee6672b78802e7d71d49c390f3817bb03b + run: | + set -euo pipefail + test "$(git rev-parse HEAD^)" = "${EXPECTED_PARENT}" + test "$(git diff --name-only HEAD^ HEAD)" = ".github/workflows/repair-opencode-llvm-coverage.yml" + + - name: Prove the missing-tool regression before repair + shell: python + run: | + from pathlib import Path + + source = Path(".github/workflows/opencode-review-dispatch.yml").read_text( + encoding="utf-8" + ) + required = ( + "ENV LLVM_COV=/usr/bin/llvm-cov-19", + "ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19", + 'RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA"', + ) + if all(value in source for value in required): + raise SystemExit("expected the pre-repair workflow to lack LLVM tool bindings") + print("Confirmed RED: the trusted coverage image lacks complete LLVM tool bindings.") + + - name: Add compatible LLVM coverage tools and permanent contract test + shell: python + run: | + from pathlib import Path + + workflow_path = Path(".github/workflows/opencode-review-dispatch.yml") + source = workflow_path.read_text(encoding="utf-8") + slash = chr(92) + old_packages = ( + f" r-cran-testthat {slash}\n" + f" rustc {slash}\n" + f" util-linux {slash}\n" + ) + new_packages = ( + f" r-cran-testthat {slash}\n" + f" llvm-19 {slash}\n" + f" rustc {slash}\n" + f" util-linux {slash}\n" + ) + old_runtime = ( + " && rm -rf /var/lib/apt/lists/*\n" + " RUN curl --proto '=https'" + ) + new_runtime = ( + " && rm -rf /var/lib/apt/lists/*\n" + " ENV LLVM_COV=/usr/bin/llvm-cov-19\n" + " ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19\n" + ' RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA"\n' + " RUN curl --proto '=https'" + ) + if source.count(old_packages) != 1: + raise SystemExit( + f"expected one Rust package anchor, found {source.count(old_packages)}" + ) + if source.count(old_runtime) != 1: + raise SystemExit( + f"expected one Docker runtime anchor, found {source.count(old_runtime)}" + ) + source = source.replace(old_packages, new_packages, 1) + source = source.replace(old_runtime, new_runtime, 1) + workflow_path.write_text(source, encoding="utf-8") + + test_path = Path("tests/test_opencode_agent_contract.py") + tests = test_path.read_text(encoding="utf-8") + test_name = "test_opencode_coverage_image_provisions_compatible_llvm_tools" + if test_name in tests: + raise SystemExit(f"{test_name} already exists") + tests = tests.rstrip() + '''\n\n\ndef test_opencode_coverage_image_provisions_compatible_llvm_tools():\n """Keep Rust coverage independent of a rustup-managed toolchain."""\n workflow = Path(\n ".github/workflows/opencode-review-dispatch.yml"\n ).read_text(encoding="utf-8")\n\n assert " llvm-19 " + chr(92) in workflow\n assert "ENV LLVM_COV=/usr/bin/llvm-cov-19" in workflow\n assert "ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19" in workflow\n assert 'RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA"' in workflow\n''' + test_path.write_text(tests, encoding="utf-8") + + - name: Validate the repaired contract + run: | + set -euo pipefail + python3 -m compileall -q tests + python3 <<'PY' + from pathlib import Path + + workflow = Path(".github/workflows/opencode-review-dispatch.yml").read_text( + encoding="utf-8" + ) + assert " llvm-19 " + chr(92) in workflow + assert "ENV LLVM_COV=/usr/bin/llvm-cov-19" in workflow + assert "ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19" in workflow + assert 'RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA"' in workflow + PY + git diff --check + + - name: Commit validated repair and remove workflow + env: + GH_TOKEN: ${{ github.token }} + ORIGINAL_HEAD: ${{ github.event.pull_request.head.sha }} + run: | + set -euo pipefail + git fetch origin fix/opencode-llvm-coverage-tools + test "$(git rev-parse origin/fix/opencode-llvm-coverage-tools)" = "${ORIGINAL_HEAD}" + rm .github/workflows/repair-opencode-llvm-coverage.yml + test "$(git diff --name-only | sort)" = $'.github/workflows/opencode-review-dispatch.yml\n.github/workflows/repair-opencode-llvm-coverage.yml\ntests/test_opencode_agent_contract.py' + git config user.name github-actions[bot] + git config user.email 41898282+github-actions[bot]@users.noreply.github.com + git add .github/workflows/opencode-review-dispatch.yml \ + .github/workflows/repair-opencode-llvm-coverage.yml \ + tests/test_opencode_agent_contract.py + git diff --cached --check + git commit -m "ci(opencode-review): provision LLVM coverage tools" + git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" + git push --force-with-lease=refs/heads/fix/opencode-llvm-coverage-tools:${ORIGINAL_HEAD} \ + origin HEAD:refs/heads/fix/opencode-llvm-coverage-tools From c28a16fe07e5ccd25264a620e82d3cf73a33d428 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 5 Aug 2026 06:45:21 +0900 Subject: [PATCH 2/7] ci: use bounded app token for workflow repair --- .../repair-opencode-llvm-coverage.yml | 40 ++++++++++++++++--- 1 file changed, 35 insertions(+), 5 deletions(-) diff --git a/.github/workflows/repair-opencode-llvm-coverage.yml b/.github/workflows/repair-opencode-llvm-coverage.yml index 03ef981a0..a0211efd2 100644 --- a/.github/workflows/repair-opencode-llvm-coverage.yml +++ b/.github/workflows/repair-opencode-llvm-coverage.yml @@ -19,6 +19,7 @@ jobs: github.actor != 'github-actions[bot]' permissions: contents: write + id-token: write runs-on: ubuntu-latest timeout-minutes: 20 steps: @@ -30,7 +31,7 @@ jobs: - name: Verify exact audited parent and trigger-only delta env: - EXPECTED_PARENT: 3f65dbee6672b78802e7d71d49c390f3817bb03b + EXPECTED_PARENT: 4e4b99aa9ea2849f271a5adbd330fcadf338c461 run: | set -euo pipefail test "$(git rev-parse HEAD^)" = "${EXPECTED_PARENT}" @@ -100,7 +101,7 @@ jobs: test_name = "test_opencode_coverage_image_provisions_compatible_llvm_tools" if test_name in tests: raise SystemExit(f"{test_name} already exists") - tests = tests.rstrip() + '''\n\n\ndef test_opencode_coverage_image_provisions_compatible_llvm_tools():\n """Keep Rust coverage independent of a rustup-managed toolchain."""\n workflow = Path(\n ".github/workflows/opencode-review-dispatch.yml"\n ).read_text(encoding="utf-8")\n\n assert " llvm-19 " + chr(92) in workflow\n assert "ENV LLVM_COV=/usr/bin/llvm-cov-19" in workflow\n assert "ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19" in workflow\n assert 'RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA"' in workflow\n''' + tests = tests.rstrip() + '''\n\n\ndef test_opencode_coverage_image_provisions_compatible_llvm_tools():\n """Keep Rust coverage independent of a rustup-managed toolchain."""\n workflow = Path(\n ".github/workflows/opencode-review-dispatch.yml"\n ).read_text(encoding="utf-8")\n\n assert " llvm-19 " + chr(92) in workflow\n assert "ENV LLVM_COV=/usr/bin/llvm-cov-19" in workflow\n assert "ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19" in workflow\n assert 'RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA"' in workflow\n''' test_path.write_text(tests, encoding="utf-8") - name: Validate the repaired contract @@ -120,9 +121,38 @@ jobs: PY git diff --check + - name: Exchange bounded OpenCode app token + id: workflow_token + env: + OIDC_AUDIENCE: opencode-github-action + OPENCODE_API_BASE_URL: https://api.opencode.ai + run: | + set -euo pipefail + test -n "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" + test -n "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" + request_url="${ACTIONS_ID_TOKEN_REQUEST_URL}" + separator='&' + case "$request_url" in + *\?*) ;; + *) separator='?' ;; + esac + oidc_response="$(curl -fsS \ + -H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \ + "${request_url}${separator}audience=${OIDC_AUDIENCE}")" + oidc_token="$(jq -r '.value // empty' <<<"$oidc_response")" + test -n "$oidc_token" + token_response="$(curl -fsS \ + -X POST \ + -H "Authorization: Bearer ${oidc_token}" \ + "${OPENCODE_API_BASE_URL}/exchange_github_app_token")" + app_token="$(jq -r '.token // empty' <<<"$token_response")" + test -n "$app_token" + echo "::add-mask::$app_token" + printf 'token=%s\n' "$app_token" >>"$GITHUB_OUTPUT" + - name: Commit validated repair and remove workflow env: - GH_TOKEN: ${{ github.token }} + GH_TOKEN: ${{ steps.workflow_token.outputs.token }} ORIGINAL_HEAD: ${{ github.event.pull_request.head.sha }} run: | set -euo pipefail @@ -130,8 +160,8 @@ jobs: test "$(git rev-parse origin/fix/opencode-llvm-coverage-tools)" = "${ORIGINAL_HEAD}" rm .github/workflows/repair-opencode-llvm-coverage.yml test "$(git diff --name-only | sort)" = $'.github/workflows/opencode-review-dispatch.yml\n.github/workflows/repair-opencode-llvm-coverage.yml\ntests/test_opencode_agent_contract.py' - git config user.name github-actions[bot] - git config user.email 41898282+github-actions[bot]@users.noreply.github.com + git config user.name opencode-agent[bot] + git config user.email 219766164+opencode-agent[bot]@users.noreply.github.com git add .github/workflows/opencode-review-dispatch.yml \ .github/workflows/repair-opencode-llvm-coverage.yml \ tests/test_opencode_agent_contract.py From 2cd3e131f468f391cd3f464ef04f9a175d6efa34 Mon Sep 17 00:00:00 2001 From: "opencode-agent[bot]" <219766164+opencode-agent[bot]@users.noreply.github.com> Date: Tue, 4 Aug 2026 21:45:45 +0000 Subject: [PATCH 3/7] ci(opencode-review): provision LLVM coverage tools --- .../workflows/opencode-review-dispatch.yml | 4 + .../repair-opencode-llvm-coverage.yml | 172 ------------------ tests/test_opencode_agent_contract.py | 12 ++ 3 files changed, 16 insertions(+), 172 deletions(-) delete mode 100644 .github/workflows/repair-opencode-llvm-coverage.yml diff --git a/.github/workflows/opencode-review-dispatch.yml b/.github/workflows/opencode-review-dispatch.yml index d826ce67a..41748bcec 100644 --- a/.github/workflows/opencode-review-dispatch.yml +++ b/.github/workflows/opencode-review-dispatch.yml @@ -652,11 +652,15 @@ jobs: r-base \ r-cran-covr \ r-cran-testthat \ + llvm-19 \ rustc \ util-linux \ vulkan-tools \ xz-utils \ && rm -rf /var/lib/apt/lists/* + ENV LLVM_COV=/usr/bin/llvm-cov-19 + ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19 + RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA" RUN curl --proto '=https' --tlsv1.2 -fsSLo /tmp/node-linux-x64.tar.xz \ https://nodejs.org/dist/v24.18.0/node-v24.18.0-linux-x64.tar.xz \ && echo '55aa7153f9d88f28d765fcdad5ae6945b5c0f98a36881703817e4c450fa76742 /tmp/node-linux-x64.tar.xz' | sha256sum -c - \ diff --git a/.github/workflows/repair-opencode-llvm-coverage.yml b/.github/workflows/repair-opencode-llvm-coverage.yml deleted file mode 100644 index a0211efd2..000000000 --- a/.github/workflows/repair-opencode-llvm-coverage.yml +++ /dev/null @@ -1,172 +0,0 @@ -name: Repair OpenCode LLVM coverage tooling - -on: - pull_request: - types: [opened, reopened, synchronize] - -permissions: - contents: read - -concurrency: - group: repair-opencode-llvm-coverage-${{ github.event.pull_request.head.sha }} - cancel-in-progress: false - -jobs: - repair: - if: >- - github.event.pull_request.head.repo.full_name == github.repository && - github.head_ref == 'fix/opencode-llvm-coverage-tools' && - github.actor != 'github-actions[bot]' - permissions: - contents: write - id-token: write - runs-on: ubuntu-latest - timeout-minutes: 20 - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - ref: ${{ github.event.pull_request.head.sha }} - fetch-depth: 0 - persist-credentials: false - - - name: Verify exact audited parent and trigger-only delta - env: - EXPECTED_PARENT: 4e4b99aa9ea2849f271a5adbd330fcadf338c461 - run: | - set -euo pipefail - test "$(git rev-parse HEAD^)" = "${EXPECTED_PARENT}" - test "$(git diff --name-only HEAD^ HEAD)" = ".github/workflows/repair-opencode-llvm-coverage.yml" - - - name: Prove the missing-tool regression before repair - shell: python - run: | - from pathlib import Path - - source = Path(".github/workflows/opencode-review-dispatch.yml").read_text( - encoding="utf-8" - ) - required = ( - "ENV LLVM_COV=/usr/bin/llvm-cov-19", - "ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19", - 'RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA"', - ) - if all(value in source for value in required): - raise SystemExit("expected the pre-repair workflow to lack LLVM tool bindings") - print("Confirmed RED: the trusted coverage image lacks complete LLVM tool bindings.") - - - name: Add compatible LLVM coverage tools and permanent contract test - shell: python - run: | - from pathlib import Path - - workflow_path = Path(".github/workflows/opencode-review-dispatch.yml") - source = workflow_path.read_text(encoding="utf-8") - slash = chr(92) - old_packages = ( - f" r-cran-testthat {slash}\n" - f" rustc {slash}\n" - f" util-linux {slash}\n" - ) - new_packages = ( - f" r-cran-testthat {slash}\n" - f" llvm-19 {slash}\n" - f" rustc {slash}\n" - f" util-linux {slash}\n" - ) - old_runtime = ( - " && rm -rf /var/lib/apt/lists/*\n" - " RUN curl --proto '=https'" - ) - new_runtime = ( - " && rm -rf /var/lib/apt/lists/*\n" - " ENV LLVM_COV=/usr/bin/llvm-cov-19\n" - " ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19\n" - ' RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA"\n' - " RUN curl --proto '=https'" - ) - if source.count(old_packages) != 1: - raise SystemExit( - f"expected one Rust package anchor, found {source.count(old_packages)}" - ) - if source.count(old_runtime) != 1: - raise SystemExit( - f"expected one Docker runtime anchor, found {source.count(old_runtime)}" - ) - source = source.replace(old_packages, new_packages, 1) - source = source.replace(old_runtime, new_runtime, 1) - workflow_path.write_text(source, encoding="utf-8") - - test_path = Path("tests/test_opencode_agent_contract.py") - tests = test_path.read_text(encoding="utf-8") - test_name = "test_opencode_coverage_image_provisions_compatible_llvm_tools" - if test_name in tests: - raise SystemExit(f"{test_name} already exists") - tests = tests.rstrip() + '''\n\n\ndef test_opencode_coverage_image_provisions_compatible_llvm_tools():\n """Keep Rust coverage independent of a rustup-managed toolchain."""\n workflow = Path(\n ".github/workflows/opencode-review-dispatch.yml"\n ).read_text(encoding="utf-8")\n\n assert " llvm-19 " + chr(92) in workflow\n assert "ENV LLVM_COV=/usr/bin/llvm-cov-19" in workflow\n assert "ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19" in workflow\n assert 'RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA"' in workflow\n''' - test_path.write_text(tests, encoding="utf-8") - - - name: Validate the repaired contract - run: | - set -euo pipefail - python3 -m compileall -q tests - python3 <<'PY' - from pathlib import Path - - workflow = Path(".github/workflows/opencode-review-dispatch.yml").read_text( - encoding="utf-8" - ) - assert " llvm-19 " + chr(92) in workflow - assert "ENV LLVM_COV=/usr/bin/llvm-cov-19" in workflow - assert "ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19" in workflow - assert 'RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA"' in workflow - PY - git diff --check - - - name: Exchange bounded OpenCode app token - id: workflow_token - env: - OIDC_AUDIENCE: opencode-github-action - OPENCODE_API_BASE_URL: https://api.opencode.ai - run: | - set -euo pipefail - test -n "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" - test -n "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" - request_url="${ACTIONS_ID_TOKEN_REQUEST_URL}" - separator='&' - case "$request_url" in - *\?*) ;; - *) separator='?' ;; - esac - oidc_response="$(curl -fsS \ - -H "Authorization: Bearer ${ACTIONS_ID_TOKEN_REQUEST_TOKEN}" \ - "${request_url}${separator}audience=${OIDC_AUDIENCE}")" - oidc_token="$(jq -r '.value // empty' <<<"$oidc_response")" - test -n "$oidc_token" - token_response="$(curl -fsS \ - -X POST \ - -H "Authorization: Bearer ${oidc_token}" \ - "${OPENCODE_API_BASE_URL}/exchange_github_app_token")" - app_token="$(jq -r '.token // empty' <<<"$token_response")" - test -n "$app_token" - echo "::add-mask::$app_token" - printf 'token=%s\n' "$app_token" >>"$GITHUB_OUTPUT" - - - name: Commit validated repair and remove workflow - env: - GH_TOKEN: ${{ steps.workflow_token.outputs.token }} - ORIGINAL_HEAD: ${{ github.event.pull_request.head.sha }} - run: | - set -euo pipefail - git fetch origin fix/opencode-llvm-coverage-tools - test "$(git rev-parse origin/fix/opencode-llvm-coverage-tools)" = "${ORIGINAL_HEAD}" - rm .github/workflows/repair-opencode-llvm-coverage.yml - test "$(git diff --name-only | sort)" = $'.github/workflows/opencode-review-dispatch.yml\n.github/workflows/repair-opencode-llvm-coverage.yml\ntests/test_opencode_agent_contract.py' - git config user.name opencode-agent[bot] - git config user.email 219766164+opencode-agent[bot]@users.noreply.github.com - git add .github/workflows/opencode-review-dispatch.yml \ - .github/workflows/repair-opencode-llvm-coverage.yml \ - tests/test_opencode_agent_contract.py - git diff --cached --check - git commit -m "ci(opencode-review): provision LLVM coverage tools" - git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" - git push --force-with-lease=refs/heads/fix/opencode-llvm-coverage-tools:${ORIGINAL_HEAD} \ - origin HEAD:refs/heads/fix/opencode-llvm-coverage-tools diff --git a/tests/test_opencode_agent_contract.py b/tests/test_opencode_agent_contract.py index 565ea4b9a..583a4a6a4 100644 --- a/tests/test_opencode_agent_contract.py +++ b/tests/test_opencode_agent_contract.py @@ -2729,3 +2729,15 @@ def test_r_package_load_deferral_requires_current_head_r_cmd_check(): assert ( "if (!is.na(pkg) && !requireNamespace(pkg, quietly = TRUE))" not in workflow ) + + +def test_opencode_coverage_image_provisions_compatible_llvm_tools(): + """Keep Rust coverage independent of a rustup-managed toolchain.""" + workflow = Path( + ".github/workflows/opencode-review-dispatch.yml" + ).read_text(encoding="utf-8") + + assert " llvm-19 " + chr(92) in workflow + assert "ENV LLVM_COV=/usr/bin/llvm-cov-19" in workflow + assert "ENV LLVM_PROFDATA=/usr/bin/llvm-profdata-19" in workflow + assert 'RUN test -x "$LLVM_COV" && test -x "$LLVM_PROFDATA"' in workflow From 575aa558164f371d606fb5340f2bfb4f0ed30fb7 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 5 Aug 2026 09:08:17 +0900 Subject: [PATCH 4/7] docs(doctoring): trace LLVM coverage toolchain decision --- .../opencode-llvm-coverage-toolchain.md | 45 +++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 docs/doctoring/opencode-llvm-coverage-toolchain.md diff --git a/docs/doctoring/opencode-llvm-coverage-toolchain.md b/docs/doctoring/opencode-llvm-coverage-toolchain.md new file mode 100644 index 000000000..64129cf71 --- /dev/null +++ b/docs/doctoring/opencode-llvm-coverage-toolchain.md @@ -0,0 +1,45 @@ +# OpenCode LLVM coverage toolchain decision + +## Decision + +The central OpenCode coverage image installs Debian Trixie's `llvm-19` package and explicitly exports: + +```text +LLVM_COV=/usr/bin/llvm-cov-19 +LLVM_PROFDATA=/usr/bin/llvm-profdata-19 +``` + +The image build fails unless both paths are executable. This is required because the image uses Debian-packaged `rustc` rather than a rustup-managed toolchain, so `llvm-tools-preview` is not an available installation path. + +## Evidence and compatibility boundary + +`cargo-llvm-cov` documents `LLVM_COV` and `LLVM_PROFDATA` as the overrides to use when a Rust toolchain is installed outside rustup. It also requires the selected tools to be compatible with the LLVM version used by `rustc`. Its published compatibility table maps Rust 1.82–1.95 to LLVM 19–22. The central image therefore selects LLVM 19 as the lowest compatible family for its supported Rust range and keeps the two binary paths explicit rather than relying on an unversioned system default. + +Debian Trixie publishes `llvm-19` from the `llvm-toolchain-19` source package. The package version currently documented for amd64 is 19.1.7-3+b1. The workflow installs the package from the pinned Debian image repositories and verifies the exact versioned executable paths during image construction. + +## Security and reproducibility contract + +- Pull-request content cannot select another LLVM package or executable path. +- The coverage image definition remains default-branch controlled and is built from immutable workflow source. +- `LLVM_COV` and `LLVM_PROFDATA` are set together; partial configuration is rejected. +- Missing executables fail the image build before any pull-request coverage measurement starts. +- The image digest, workflow commit SHA, pull-request head SHA, and coverage artifacts remain independently addressable evidence. +- CPU coverage is a correctness gate. GPU execution and parity tests remain separate domain-specific gates and are not represented by LLVM host coverage alone. + +This design does not claim formal compliance with a software supply-chain standard. It establishes a narrow, auditable compatibility boundary for deterministic Rust coverage execution. + +## Regression contract + +The central workflow contract test must continue to prove that: + +1. `llvm-19` is installed in the coverage image; +2. `LLVM_COV` names `/usr/bin/llvm-cov-19`; +3. `LLVM_PROFDATA` names `/usr/bin/llvm-profdata-19`; +4. the image build checks both paths before installing or invoking `cargo-llvm-cov`; and +5. the OpenCode approval path remains fail-closed when Rust coverage cannot run. + +## References + +Debian Project. (2026). *Details of package llvm-19 in trixie*. https://packages.debian.org/trixie/amd64/llvm-19 + +Taiki Endo. (2026). *cargo-llvm-cov: Cargo subcommand to easily use LLVM source-based code coverage* [Computer software]. GitHub. https://github.com/taiki-e/cargo-llvm-cov From 3a31af056c59b3e4120a69b58c3b023a26936764 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 5 Aug 2026 09:14:51 +0900 Subject: [PATCH 5/7] fix(security): apply remediated Strix dependency floors --- requirements-strix-ci.txt | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/requirements-strix-ci.txt b/requirements-strix-ci.txt index e32bd39a9..98e5c33e2 100644 --- a/requirements-strix-ci.txt +++ b/requirements-strix-ci.txt @@ -1,6 +1,7 @@ strix-agent==1.0.4 +aiohttp==3.14.3 google-cloud-aiplatform==1.133.0 protobuf<7.0.0 -cryptography==49.0.0 +cryptography==50.0.0 python-multipart==0.0.32 pyasn1==0.6.4 From 6610317f9900886d950241d41be945db756702d3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 5 Aug 2026 09:18:26 +0900 Subject: [PATCH 6/7] ci: refresh PR 755 Strix lock from validated blob --- .../one-shot-refresh-pr-755-strix-lock.yml | 89 +++++++++++++++++++ 1 file changed, 89 insertions(+) create mode 100644 .github/workflows/one-shot-refresh-pr-755-strix-lock.yml diff --git a/.github/workflows/one-shot-refresh-pr-755-strix-lock.yml b/.github/workflows/one-shot-refresh-pr-755-strix-lock.yml new file mode 100644 index 000000000..26422e34f --- /dev/null +++ b/.github/workflows/one-shot-refresh-pr-755-strix-lock.yml @@ -0,0 +1,89 @@ +name: Refresh PR 755 Strix security lock + +on: + push: + branches: + - fix/opencode-llvm-coverage-tools + +permissions: + contents: read + +concurrency: + group: refresh-pr-755-strix-lock-${{ github.ref }} + cancel-in-progress: false + +jobs: + validate-lock: + if: >- + github.repository == 'ContextualWisdomLab/.github' + && github.ref == 'refs/heads/fix/opencode-llvm-coverage-tools' + runs-on: ubuntu-latest + timeout-minutes: 10 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ github.sha }} + persist-credentials: false + - name: Materialize and verify the reviewed generated lock + env: + GH_TOKEN: ${{ github.token }} + LOCK_BLOB_SHA: c305e9c84c90f6d6e3360ab12feff7362d875b2d + shell: bash + run: | + set -euo pipefail + gh api "repos/${GITHUB_REPOSITORY}/git/blobs/${LOCK_BLOB_SHA}" \ + | jq -r '.content' \ + | tr -d '\n' \ + | base64 --decode \ + > requirements-strix-ci-hashes.txt + test "$(git hash-object requirements-strix-ci-hashes.txt)" = "$LOCK_BLOB_SHA" + grep -Fq 'aiohttp==3.14.3' requirements-strix-ci-hashes.txt + grep -Fq 'cryptography==50.0.0' requirements-strix-ci-hashes.txt + grep -Fxq 'aiohttp==3.14.3' requirements-strix-ci.txt + grep -Fxq 'cryptography==50.0.0' requirements-strix-ci.txt + git diff --check + + publish-lock: + needs: validate-lock + if: needs.validate-lock.result == 'success' + runs-on: ubuntu-latest + timeout-minutes: 10 + permissions: + contents: write + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ github.sha }} + fetch-depth: 0 + persist-credentials: false + - name: Publish only the verified lock and remove this one-shot workflow + env: + GH_TOKEN: ${{ github.token }} + LOCK_BLOB_SHA: c305e9c84c90f6d6e3360ab12feff7362d875b2d + SOURCE_HEAD: ${{ github.sha }} + SOURCE_BRANCH: fix/opencode-llvm-coverage-tools + shell: bash + run: | + set -euo pipefail + live_head="$(gh api "repos/${GITHUB_REPOSITORY}/branches/${SOURCE_BRANCH}" --jq '.commit.sha')" + test "$live_head" = "$SOURCE_HEAD" + gh api "repos/${GITHUB_REPOSITORY}/git/blobs/${LOCK_BLOB_SHA}" \ + | jq -r '.content' \ + | tr -d '\n' \ + | base64 --decode \ + > requirements-strix-ci-hashes.txt + test "$(git hash-object requirements-strix-ci-hashes.txt)" = "$LOCK_BLOB_SHA" + grep -Fq 'aiohttp==3.14.3' requirements-strix-ci-hashes.txt + grep -Fq 'cryptography==50.0.0' requirements-strix-ci-hashes.txt + rm .github/workflows/one-shot-refresh-pr-755-strix-lock.yml + git config user.name 'github-actions[bot]' + git config user.email '41898282+github-actions[bot]@users.noreply.github.com' + git add requirements-strix-ci-hashes.txt \ + .github/workflows/one-shot-refresh-pr-755-strix-lock.yml + git diff --cached --check + git commit -m 'fix(security): refresh remediated Strix hash lock' + remote_url="https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" + git push \ + --force-with-lease="refs/heads/${SOURCE_BRANCH}:${SOURCE_HEAD}" \ + "$remote_url" \ + "HEAD:refs/heads/${SOURCE_BRANCH}" From 5495d083f0e86559a5ad324026a0caf2a8231788 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Wed, 5 Aug 2026 00:18:56 +0000 Subject: [PATCH 7/7] fix(security): refresh remediated Strix hash lock --- .../one-shot-refresh-pr-755-strix-lock.yml | 89 ----- requirements-strix-ci-hashes.txt | 341 +++++++++--------- 2 files changed, 171 insertions(+), 259 deletions(-) delete mode 100644 .github/workflows/one-shot-refresh-pr-755-strix-lock.yml diff --git a/.github/workflows/one-shot-refresh-pr-755-strix-lock.yml b/.github/workflows/one-shot-refresh-pr-755-strix-lock.yml deleted file mode 100644 index 26422e34f..000000000 --- a/.github/workflows/one-shot-refresh-pr-755-strix-lock.yml +++ /dev/null @@ -1,89 +0,0 @@ -name: Refresh PR 755 Strix security lock - -on: - push: - branches: - - fix/opencode-llvm-coverage-tools - -permissions: - contents: read - -concurrency: - group: refresh-pr-755-strix-lock-${{ github.ref }} - cancel-in-progress: false - -jobs: - validate-lock: - if: >- - github.repository == 'ContextualWisdomLab/.github' - && github.ref == 'refs/heads/fix/opencode-llvm-coverage-tools' - runs-on: ubuntu-latest - timeout-minutes: 10 - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - ref: ${{ github.sha }} - persist-credentials: false - - name: Materialize and verify the reviewed generated lock - env: - GH_TOKEN: ${{ github.token }} - LOCK_BLOB_SHA: c305e9c84c90f6d6e3360ab12feff7362d875b2d - shell: bash - run: | - set -euo pipefail - gh api "repos/${GITHUB_REPOSITORY}/git/blobs/${LOCK_BLOB_SHA}" \ - | jq -r '.content' \ - | tr -d '\n' \ - | base64 --decode \ - > requirements-strix-ci-hashes.txt - test "$(git hash-object requirements-strix-ci-hashes.txt)" = "$LOCK_BLOB_SHA" - grep -Fq 'aiohttp==3.14.3' requirements-strix-ci-hashes.txt - grep -Fq 'cryptography==50.0.0' requirements-strix-ci-hashes.txt - grep -Fxq 'aiohttp==3.14.3' requirements-strix-ci.txt - grep -Fxq 'cryptography==50.0.0' requirements-strix-ci.txt - git diff --check - - publish-lock: - needs: validate-lock - if: needs.validate-lock.result == 'success' - runs-on: ubuntu-latest - timeout-minutes: 10 - permissions: - contents: write - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - with: - ref: ${{ github.sha }} - fetch-depth: 0 - persist-credentials: false - - name: Publish only the verified lock and remove this one-shot workflow - env: - GH_TOKEN: ${{ github.token }} - LOCK_BLOB_SHA: c305e9c84c90f6d6e3360ab12feff7362d875b2d - SOURCE_HEAD: ${{ github.sha }} - SOURCE_BRANCH: fix/opencode-llvm-coverage-tools - shell: bash - run: | - set -euo pipefail - live_head="$(gh api "repos/${GITHUB_REPOSITORY}/branches/${SOURCE_BRANCH}" --jq '.commit.sha')" - test "$live_head" = "$SOURCE_HEAD" - gh api "repos/${GITHUB_REPOSITORY}/git/blobs/${LOCK_BLOB_SHA}" \ - | jq -r '.content' \ - | tr -d '\n' \ - | base64 --decode \ - > requirements-strix-ci-hashes.txt - test "$(git hash-object requirements-strix-ci-hashes.txt)" = "$LOCK_BLOB_SHA" - grep -Fq 'aiohttp==3.14.3' requirements-strix-ci-hashes.txt - grep -Fq 'cryptography==50.0.0' requirements-strix-ci-hashes.txt - rm .github/workflows/one-shot-refresh-pr-755-strix-lock.yml - git config user.name 'github-actions[bot]' - git config user.email '41898282+github-actions[bot]@users.noreply.github.com' - git add requirements-strix-ci-hashes.txt \ - .github/workflows/one-shot-refresh-pr-755-strix-lock.yml - git diff --cached --check - git commit -m 'fix(security): refresh remediated Strix hash lock' - remote_url="https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" - git push \ - --force-with-lease="refs/heads/${SOURCE_BRANCH}:${SOURCE_HEAD}" \ - "$remote_url" \ - "HEAD:refs/heads/${SOURCE_BRANCH}" diff --git a/requirements-strix-ci-hashes.txt b/requirements-strix-ci-hashes.txt index e2c8f00eb..c305e9c84 100644 --- a/requirements-strix-ci-hashes.txt +++ b/requirements-strix-ci-hashes.txt @@ -4,127 +4,128 @@ aiohappyeyeballs==2.7.1 \ --hash=sha256:065665c041c42a5938ed220bdcd7230f22527fbec085e1853d2402c8a3615d9d \ --hash=sha256:9243213661e29250eb41368e5daa826fc017156c3b8a11440826b2e3ed376472 # via aiohttp -aiohttp==3.14.1 \ - --hash=sha256:03ab4530fdcb3a543a122ba4b65ac9919da9fe9f78a03d328a6e38ff962f7aa5 \ - --hash=sha256:07eabb979d236335fed927e137a928c9adfb7df3b9ec7aa31726f133a62be983 \ - --hash=sha256:092e4ce3619a7c6dee52a6bdabda973d9b34b66781f840ce93c7e0cec30cf521 \ - --hash=sha256:10ee9c1753a8f706345b22496c79fbddb5be0599e0823f3738b1534058e25340 \ - --hash=sha256:1601cc37baf5750ccacae618ec2daf020769581695550e3b654a911f859c563d \ - --hash=sha256:1ac8531b638959718e18c2207fbfe297819875da46a740b29dfa29beba64355a \ - --hash=sha256:1b9748363260121d2927704f5d4fc498150669ca3ae93625986ee89c8f80dcd4 \ - --hash=sha256:1c1421eb01d4fd608d88cc8290211d177a58532b55ad94076fb349c5bf467f0a \ - --hash=sha256:1c1af67559445498b502030c35c59db59966f47041ca9de5b4e707f86bd10b5f \ - --hash=sha256:1d459b98a932296c6f0e94f87511a0b1b90a8a02c30a50e60a297619cd5a58ee \ - --hash=sha256:20205f7f5ade7aaec9f4b500549bbc071b046453aed72f9c06dcab87896a83e8 \ - --hash=sha256:23119f8fd4f5d16902ed459b63b100bcd269628075162bddac56cc7b5273b3fb \ - --hash=sha256:237651caadc3a59badd39319c54642b5299e9cc98a3a194310e55d5bb9f5e397 \ - --hash=sha256:24ba13339fed9251d9b1a1bec8c7ab84c0d1675d79d33501e11f94f8b9a84e05 \ - --hash=sha256:250d14af67f6b6a1a4a811049b1afa69d61d617fca6bf33149b3ab1a6dbcf7b8 \ - --hash=sha256:269b76ac5394092b95bc4a098f4fc6c191c083c3bd12775d1e30e663132f6a09 \ - --hash=sha256:27fd7c91e51729b4f7e1577865fa6d34c9adccbc39aabe9000285b48af9f0ec2 \ - --hash=sha256:2964cbf553df4d7a57348da44d961d871895fc1ee4e8c322b2a95612c7b17fba \ - --hash=sha256:2a73f487ab8ef5abbb24b7aa9b73e98eaba9e9e031804ff2416f02eca315ccaf \ - --hash=sha256:2aa92c87868cd13674989f9ee83e5f9f7ea4237589b728048e1f0c8f6caa3271 \ - --hash=sha256:2b7edd08e0a5deb1e8564a2fcd8f4561014a3f05252334671bbf55ddd47db0e5 \ - --hash=sha256:2c840c90759922cb5e6dda94596e079a30fb5a5ba548e7e0dc00574703940847 \ - --hash=sha256:2f73e01dc37122325caf079982621262f96d74823c179038a82fddfc50359264 \ - --hash=sha256:2fbc3ed048b3475b9f0cbcb9978e9d2d3511acd91ead203af26ed9f0056004cf \ - --hash=sha256:2fe3607e71acc6ebb0ec8e492a247bf7a291226192dc0084236dfc12478916f6 \ - --hash=sha256:30099eda75a53c32efb0920e9c33c195314d2cc1c680fbfd30894932ac5f27df \ - --hash=sha256:307f2cff90a764d329e77040603fa032db89c5c24fdad50c4c15334cba744035 \ - --hash=sha256:313701e488100074ce99850404ee36e741abf6330179fec908a1944ecf570126 \ - --hash=sha256:317acd9f8602858dc7d59679812c376c7f0b97bcbbf16e0d6237f54141d8a8a6 \ - --hash=sha256:335c0cc3e3545ce98dcb9cfcb836f40c3411f43fa03dab757597d80c89af8a35 \ - --hash=sha256:34b257ec41345c1e8f2df68fa908a7952f5de932723871eb633ecbbff396c9a4 \ - --hash=sha256:367a9314fdc79dab0fac96e216cb41dd73c85bdca85306ce8999118ba7e0f333 \ - --hash=sha256:38e1e7daaea81df51c952e18483f323d878499a1e2bfe564790e0f9701d6f203 \ - --hash=sha256:3e6fc1a85fa7194a1a7d19f44e8609180f4a8eb5fa4c7ed8b4355f080fad235c \ - --hash=sha256:4132e72c608fe9fecb8f409113567605915b83e9bdd3ea56538d2f9cd35002f1 \ - --hash=sha256:4691802dda97be727f79d86818acaad7eb8e9252626a1d6b519fedbb92d5e251 \ - --hash=sha256:47ddf841cdecc810749921d25606dee45857d12d2ad5ddb7b5bd7eab12e4b365 \ - --hash=sha256:486f7d16ed54c39c2cbd7ca71fd8ba2b8bb7860df65bd7b6ed640bab96a38a8b \ - --hash=sha256:4cd96b5ba05d67ed0cf00b5b405c8cd99586d8e3481e8ee0a831057591af7621 \ - --hash=sha256:4d6e0ac9da31c9c04c84e1c0182ad8d6df35965a85cae29cd71d089621b3ae94 \ - --hash=sha256:4dfd6e47d3c44c2279907607f73a4240b88c69eb8b90da7e2441a8045dfd21da \ - --hash=sha256:4f7215cb3933784f79ed20e5f050e15984f390424339b22375d5a53c933a0491 \ - --hash=sha256:4fe1f1087cbadb280b5e1bb054a4f00d1423c74d6626c5e48400d871d34ecefe \ - --hash=sha256:52cdac9432d8b4a719f35094a818d95adcae0f0b4fe9b9b921909e0c87de9e7d \ - --hash=sha256:5663ee9257cfa1add7253a7da3035a02f31b6600ec48261585e1800a81533080 \ - --hash=sha256:57fc6745a4b7d0f5a9eb4f40a69718be6c0bc1b8368cc9fe89e90118719f4f42 \ - --hash=sha256:5a837f49d901f9e368651b676912bff1104ed8c1a83b280bcd7b29adccef5c9c \ - --hash=sha256:5c0b3e614340c889d575451696374c9d17affd54cd607ca0babed8f8c37b9397 \ - --hash=sha256:5e78b522b7a6e27e0b25d19b247b75039ac4c94f99823e3c9e53ae1603a9f7e9 \ - --hash=sha256:5f2504bc0322437c9a1ff6d3333ca56c7477b727c995f036b976ae17b98372c8 \ - --hash=sha256:603a2c834142172ffddc054067f5ec0ca65d57a0aa98a71bc81952573208e345 \ - --hash=sha256:62a759436b29e677181a9e76bab8b8f689a29cb9c535f45f7c48c9c830d3f8c3 \ - --hash=sha256:634e385930fb6d2d479cf3aa66515955863b77a5e3c2b5894ca259a25b308602 \ - --hash=sha256:64c567bf9eaf664280116a8688f63016e6b32db2505908e2bdaca1b6438142f2 \ - --hash=sha256:672ac254412a24d0d0cf00a9e6c238877e4be5e5fa2d188832c1244f45f31966 \ - --hash=sha256:672b9d65f42eb877f5c3f234a4547e4e1a226ca8c2eed879bb34670a0ce51192 \ - --hash=sha256:686b6c0d3911ec387b444ddf5dc62fb7f7c0a7d5186a7861626496a5ab4aff95 \ - --hash=sha256:6f71173be42d3241d428f760122febb748de0623f44308a6f120d0dd9ec572e3 \ - --hash=sha256:6fd35beba67c4183b09375c5fff9accb47524191a244a99f95fd4472f5402c2b \ - --hash=sha256:6ffbb2f4ec1ceaff7e07d43922954da26b223d188bf30658e561b98e23089444 \ - --hash=sha256:73f05ea02013e02512c3bf42714f1208c57168c779cc6fe23516e4543089d0a6 \ - --hash=sha256:764457a7be60825fb770a644852ff717bcbb5042f189f2bd16df61a81b3f6573 \ - --hash=sha256:797457503c2d426bee06eef808d07b31ede30b65e054444e7de64cad0061b7af \ - --hash=sha256:7c106c26852ca1c2047c6b80384f17100b4e439af276f21ef3d4e2f450ae7e15 \ - --hash=sha256:7fb4bdf95b0561a79f259f9d28fbc109728c5ee7f27aff6391f0ca703a329abe \ - --hash=sha256:819c054312f1af92947e6a55883d1b66feefab11531a7fc45e0fb9b63880b5c2 \ - --hash=sha256:8560b4d712474335d08907db7973f71912d3a9a8f1dee992ec06b5d2fe359496 \ - --hash=sha256:86a6dab78b0e43e2897a3bbe15745aa60dc5423ca437b7b0b164c069bf91b876 \ - --hash=sha256:87a5eea1b2a5e21e1ebdbb33ad4165359189327e63fc4e4894693e7f821ac817 \ - --hash=sha256:896e12dfdbbab9d8f7e16d2b28c6769a60126fa92095d1ebf9473d02593a2448 \ - --hash=sha256:8f6bb621e5863cfe8fe5ff5468002d200ec31f30f1280b259dc505b02595099e \ - --hash=sha256:90d53f1609c29ccc2193945ef732428382a28f78d0456ae4d3daf0d48b74f0f6 \ - --hash=sha256:915fbb7b41b115192259f8c9ae58f3ddc444d2b5579917270211858e606a4afd \ - --hash=sha256:93b032b5ec3255473c143627d21a69ac74ae12f7f33974cb587c564d11b1066f \ - --hash=sha256:94da27378da0610e341c4d30de29a191672683cc82b8f9556e8f7c7212a020fe \ - --hash=sha256:979ed4717f59b8bb12e3963378fa285d93d367e15bcd66c721311826d3c44a6c \ - --hash=sha256:97e704dcd26271f5bda3fa07c3ce0fb76d6d3f8659f4baa1a24442cc9ba177ca \ - --hash=sha256:99abd37084b82f5830c635fddd0b4993b9742a66eb746dacf433c8590e8f9e3c \ - --hash=sha256:9af6779bfb46abf124068327abcdf9ce95c9ef8287a3e8da76ccf2d0f16c28fa \ - --hash=sha256:9e8f2d660c350b3d0e259c7a7e3d9b7fc8b41210cbcc3d4a7076ff0a5e5c2fdc \ - --hash=sha256:a24f677ebe83749039e7bdf862ff0bbb16818ae4193d4ef96505e269375bcce0 \ - --hash=sha256:a9875b46d910cff3ea2f5962f9d266b465459fe634e22556ab9bd6fc1192eea0 \ - --hash=sha256:aa00140699487bd435fde4342d85c94cb256b7cd3a5b9c3396c67f19922afda2 \ - --hash=sha256:ae6be797afdef264e8a84864a85b196ca06045586481b3df8a967322fd2fa844 \ - --hash=sha256:af8b4b81a960eeaf1234971ac3cd0ba5901f3cd42eae42a46b4d089a8b492719 \ - --hash=sha256:b165790117eea512d7f3fb22f1f6dad3d55a7189571993eb015591c1401276d1 \ - --hash=sha256:b238af795833d5731d049d82bc84b768ae6f8f97f0495963b3ed9935c5901cc3 \ - --hash=sha256:b3a03285a7f9c7b016324574a6d92a1c895da6b978cb8f1deee3ac72bc6da178 \ - --hash=sha256:b6feea921016eb3d4e04d65fc4e9ca402d1a3801f562aef94989f54694917af3 \ - --hash=sha256:b6ff7fcee63287ae57b5df3e4f5957ce032122802509246dec1a5bcc55904c95 \ - --hash=sha256:b821a1f7dedf7e37450654e620038ac3b2e81e8fa6ea269337e97101978ec730 \ - --hash=sha256:bb2c0c80d431c0d03f2c7dbf125150fedd4f0de17366a7ca33f7ccb822391842 \ - --hash=sha256:bb33777ea21e8b7ecde0e6fc84f598be0a1192eab1a63bc746d75aa75d38e7bd \ - --hash=sha256:bcfb80a2cc36fba2534e5e5b5264dc7ae6fcd9bf15256da3e53d2f499e6fa29d \ - --hash=sha256:bd869c427324e5cb15195793de951295710db28be7d818247f3097b4ab5d4b96 \ - --hash=sha256:bedb0cd073cc2dc035e30aeb99444389d3cd2113afe4ef9fcd23d439f5bade85 \ - --hash=sha256:c389c482a7e9b9dc3ee2701ac46c4125297a3818875b9c305ddb603c04828fd1 \ - --hash=sha256:c6fa4dc7ad6f8109c70bb1499e589f76b0b792baf39f9b017eb92c8a81d0a199 \ - --hash=sha256:c83afe0ba876be7e943d2e0ba645809ad441575d2840c895c21ee5de93b9377a \ - --hash=sha256:cb21957bb8aca671c1765e32f58164cf0c50e6bf41c0bbbd16da20732ecaf588 \ - --hash=sha256:cf4491381b1b57425c315a56a439251b1bdac07b2275f19a8c44bc57744532ec \ - --hash=sha256:d03f281ed22579314ba00821ce20115a7c0ac430660b4cc05704a3f818b3e004 \ - --hash=sha256:d35143e27778b4bb0fb189562d7f275bff79c62ab8e98459717c0ea617ff2480 \ - --hash=sha256:d3b1a184a9a8f548a6b73f1e26b96b052193e4b3175ed7342aaf1151a1f00a04 \ - --hash=sha256:d44ec478e713ee7f29b439f7eb8dc2b9d4079e11ae114d2c2ac3d5daf30516c8 \ - --hash=sha256:d9d4e294455b23a68c9b8f042d0e8e377a265bcb15332753695f6e5b6819e0ce \ - --hash=sha256:de538791a80e5d862addbc183f70f0158ac9b9bb872bb147f1fd2a683691e087 \ - --hash=sha256:e4e5e0ae56914ecdbf446493addefc0159053dd53962cef37d7839f37f73d505 \ - --hash=sha256:e509a55f681e6158c20f70f102f9cf61fb20fbc382272bc6d94b7343f2582780 \ - --hash=sha256:ec8dc383ee57ea3e883477dcca3f11b65d58199f1080acaf4cd6ad9a99698be4 \ - --hash=sha256:ed09c7eb1c391271c2ed0314a51903e72a3acb653d5ccfc264cdf3ef11f8269d \ - --hash=sha256:eeea07c4397bbc57719c4eed8f9c284874d4f175f9b6d57f7a1546b976d455ca \ - --hash=sha256:eefd9cc9b6d4a2db5f00a26bc3e4f9acf71926a6ec557cd56c9c6f27c290b665 \ - --hash=sha256:f234b4deb12f3ad59127e037bc57c40c21e45b45282df7d3a55a0f409f595296 \ - --hash=sha256:f380468b09d2a81633ee863b0ec5648d364bd17bb8ecfb8c2f387f7ac1faf42c \ - --hash=sha256:f5e6ff2bdbb8f4cd3fbe41f99e25bbcd58e3bf9f13d3dd31a11e7917251cc77a \ - --hash=sha256:f7a16ef45b081454ef844502d87a848876c490c4cb5c650c230f6ec79ed2c1e7 \ - --hash=sha256:faccab372e66bc76d5731525e7f1143c922271725b9d38c9f97edcc66266b451 \ - --hash=sha256:fc0cacab7ba4e56f0f81c82a98c09bed2f39c940107b03a34b168bdf7597edd3 +aiohttp==3.14.3 \ + --hash=sha256:03cd2bde3d7f085b64e549c985f4bb928cad7e8ecf5323bfca320db548d81b39 \ + --hash=sha256:041badb8f84396357c4d3ad26de6afd7a32b112f43d3c63045c0c8278cfd2043 \ + --hash=sha256:0a5ff2dfbb9ce645fa5b8ef3e02c6c0b9cc3f6030ff863d0c51fffc50cb5541b \ + --hash=sha256:0fdea2281997af69da84c77ffa6f5938a0285f21fb3887c249d67419ca865b3d \ + --hash=sha256:11fb37ef075669eee52ab1928fbf6e1741fada40409fa309ebde9607a962aebf \ + --hash=sha256:134ac5ddcf61c6fad984b9a5727d83492ada43d63471db20fb73042c13fca62f \ + --hash=sha256:152516815ef926786a0b6ae2b8f1fd2e0c71582dee0b435636865316fd4891b7 \ + --hash=sha256:1576145bdceeb92382d899751e12743a3a5b8e460a841e3e50543859e54864dc \ + --hash=sha256:16100ad3ab8d649fdfbee87602d9d2dcdca9df0b9eda8a1b5fdc0d41f96da559 \ + --hash=sha256:16ea7e24c309fb7c0bbd505d149abe4fe4dccfb8db911db7dbec0921bc889a6f \ + --hash=sha256:18c441d0a8fca6de8d1f546849b9f0ab20d435993e2c5b59562b2fae6be2f929 \ + --hash=sha256:18cb43369747b2ae007bd2655fb8e63a099c2ff1d207962943636dac989b3147 \ + --hash=sha256:1b59533861b70a2185c8f4f350f791f39d64358ef6944ce71c5240c9ec0982c9 \ + --hash=sha256:1c5281acc88b92396f88c7e1e2748f8466689df22b80170e4f51efa712fb47a8 \ + --hash=sha256:1c5ec8fb1bcc31a8466f74aaf26c345d5c386fa4bd08a3f0eb9c7a4a3fe8b5bf \ + --hash=sha256:1caa7b0d05f3e3a36f87788c59e970a7ee1cefcfcbb924a9f138c4a6551c9cb7 \ + --hash=sha256:21c016079415ed3fd676963e9793700a566d85dbbd6bfc564b9b2d209147dcc8 \ + --hash=sha256:2498f0fe69ead802f9675beca44a7c21c62fdaa4ec5145ea1c3ad6edbee29f85 \ + --hash=sha256:25bd2708db6bdf6a6630dd37bdcdfcb47c4434d22ac69c64665b802910140b30 \ + --hash=sha256:270d3dace9ca2f10f0da5d8ebe519b7a310fc6112ed916e32df5866df0888553 \ + --hash=sha256:2e1161602f45a54de2ce0905243a95f58cb42dcd378402f3697f5e0b21e9d2e7 \ + --hash=sha256:2e9878ae68e4a5f1c0abe4dd497dbc3d51946f5837b56759e2a02e78fa90ef86 \ + --hash=sha256:30402d03a7c0ff52bce290b57e564e9079fd9d0cb545c8aba73f86a103162d2e \ + --hash=sha256:33a2d7c28d33797a2e99923dffa63f83d908a19b6bf26cfe80fa790aa5e1a75a \ + --hash=sha256:362a3fd481769cac1a824514bcd86fda51c65e8fe6e051099e008fddde6db17c \ + --hash=sha256:38901a84da3ce22249f6e860bf8f90d141bcab7da090cc398f8bb58c0e44b7da \ + --hash=sha256:39aded8c7f3b935b54aab1d8d73c70ec0ee2d3ec3b943e0e86611bc150ba47f5 \ + --hash=sha256:3a26434dafe408229ff3403458ca58de24fb51936504decac49ce6755f77e59d \ + --hash=sha256:3ae5b3a59436d089b5395d910121a390feed4d00578eb95a0fd1a329fe963100 \ + --hash=sha256:3d4f72af88ac2474bb5bca640030320e3d38a0163a1d7533500e87be458eef71 \ + --hash=sha256:3f42e9b78301f11c8f861746175d8b9c1ccef713fcad9eab396e2f6db8ed4a22 \ + --hash=sha256:42a67efc36300d052fb4508a53e8b6901b9284b599ae63945c377569c5fcc1e1 \ + --hash=sha256:48d67b87db6279c044760787eb01f6413032c2e6f3ba1cafaa492b1c8e578479 \ + --hash=sha256:498c6c623134f8e09a3c4e60bcd607a0b4590dd7dbf08dd40851b27cbb520ccb \ + --hash=sha256:49f7325beb0f85ef4aef5f48f490269575f83e6e2acad00a1d80b807eb027062 \ + --hash=sha256:4e3ac92d90e92773b2362d506068e9a948192bd553e743c5b2429e28527c8661 \ + --hash=sha256:530125ee1163c4219af35dc3aa1206e541e7b31b6efc1a3f93b70a136f65d427 \ + --hash=sha256:5373dc80ad1aa2fb9ad95c83f24eef418bbda3a61375f128e5b0192e4f3f9b32 \ + --hash=sha256:53e5179d8abb5710f8e83ba207c41c8d1261fcffd4616500e15ca2b7a33be10a \ + --hash=sha256:53e7b4ce82b54a8bcc71b3b67a5cbd177ca1d7f592cbc92cd38b7349f73482db \ + --hash=sha256:543906c127fb1d929b95076db19b83fa2d46751006ff1e23b093aa5ac4d8db42 \ + --hash=sha256:54cfcdee2770dac994417cbb0ee1f3eb0e7cb6b30c79bf44f2c02ff79ec5124a \ + --hash=sha256:55bdcc472aafe2de4a253045cc128007a64f1e0264fb675791e132ea5edaa3bd \ + --hash=sha256:56f355e79f71aef2a85c80305cc915f894b170dba76de5fe84f6351939b83c06 \ + --hash=sha256:5895ef58c4620afe02fa16044f023dc4dafec08158f9d08874a46a7dbc0341b8 \ + --hash=sha256:5bcb6ff3fdab1258a192679ff1a05d44f59626430aa05cd1a9d2447423599228 \ + --hash=sha256:5f08ec777f35ee70720233b8b9811d3bb5d728137f30ac91b7457709c3261ac0 \ + --hash=sha256:614c61d478b83953e261d02bb2df750f17227cd33ef8002945bf5aebbde21919 \ + --hash=sha256:617105e2c3018ee38d0c8ce5ee3c84f621a6d8b9f723202aacaff28449ca91ee \ + --hash=sha256:6debfa7312ff9d4c124dc71d72e9a0a4b9e0879e48ba6fcb42bef5c3300289e2 \ + --hash=sha256:7041d52c3a7fa20c9e8c182b534704abb19502c8bdcbde7ab23bfda6f642394f \ + --hash=sha256:70c987b27534f9ae1a723f47ae921571d616da21d3208282bf4c52af5164ac43 \ + --hash=sha256:74ab5b6a9fb13e873e5a90946588baecaf488745e1db1a4a5c433f971f035098 \ + --hash=sha256:78253b573e6ffab5028924fc98bc281aae05445969982a10864bc360dea2016c \ + --hash=sha256:7a75aa63cbf9b21cfaf60dc2657e19df2c2867d91707d653fee171ffeedd1371 \ + --hash=sha256:8800c996b01c2772a783e3e46f3e1abd5823029adca0df54231960de9bfefa5b \ + --hash=sha256:89176250f686cb9853c0fb7ead90e639e915b84a6f43eedc2a4e7ec21f1037f0 \ + --hash=sha256:8a5fd34f7f7410d1730d5c2ba873cacb2eed3fede366feb268a70ba22581ed8f \ + --hash=sha256:8b3b60de05f3dcb6f6a00f818bb2ec781cee4de0645f59ccaf99b1d1823b6100 \ + --hash=sha256:8f2f1c4c032c7cedd7d8da6f54c97b70266c6570c3108d3fdffee7188bb70529 \ + --hash=sha256:9491196535a88924a60afd5b5f434b5b203b6cc616250878dbdb223a8f7844bc \ + --hash=sha256:9aa6e61fdf20105c4144e755bd586008ff450791d67b1c8146fdc15959c4d51c \ + --hash=sha256:9d9edccfe496b476db5f398d97b865e9a6752bcf8aec4eef8390ce20fb64bb41 \ + --hash=sha256:9fc7b5bfec6573f3ae844f457fdde5adeb713f8b8e4a81ad64fc207b49383716 \ + --hash=sha256:a0dc483c00da8b673abbb367eb6f8d8f4bcec30eb58529ea13cb42e7fd2dfa33 \ + --hash=sha256:a3a8296e7ab5c295f53f1041487cb088e1480775aafbf7fe545d93b770a0f96f \ + --hash=sha256:a3e22975f905b89a55a488c2a08f2fdb2186175349e917d48985cc468a3d4c6e \ + --hash=sha256:a4af35c443e0b1a1bd6a8af3f3485d7fda15c142751a00f3ff8090f0b93346fa \ + --hash=sha256:a94dbaae5ae27bd849c93570669bff91e0510f33a80805738e3de72a7be0447b \ + --hash=sha256:ac74facc01463f138b0da5580329cfcc82818dea5656e83ddcd11268fc12ff80 \ + --hash=sha256:ad4c8b7488d745d2ca4838ebd8ae5ba9b56341d30b1da43640e4ce87f9f49646 \ + --hash=sha256:b014a6ed7cf912e787149fdc529166d3ceabac23f26efeea3158c9aba2354e7e \ + --hash=sha256:b20032766aedf6261c7a566585a40867d092ac03a0d81592d5370ef9b054f99b \ + --hash=sha256:b2466434105a4e03113c36ec775cc2ebe6676b62eae326fa670bb607ef788c1c \ + --hash=sha256:b304db572b4368edd8dda8a2274f73156fe15558fca4a917cb8a09fc47af5963 \ + --hash=sha256:ba59d59aba08ac02fc03b0c8983ccd5ee39a199d0552ce9e6d2b4845b34d59ae \ + --hash=sha256:bd52f811e65f6fb634b1047159657c98f52b407f8efec907bcfc09da9a4c0a25 \ + --hash=sha256:bdd0e2834dce1a26c1bbe26464861e16bbe217042cbff619247c11594472518c \ + --hash=sha256:c23ec8ee9d5ab2f5421f9c7fffce208435607af27fd46d4a44e031954352838f \ + --hash=sha256:c39846c3aad97a8530c89d7a3869a8f8e9e3762c6ac0504481e5c80948f7e807 \ + --hash=sha256:c3c200cf9757edd785051dc699c7ecbec22110dbfcb3fefc7a9f9695eda8ea7a \ + --hash=sha256:c7d3a97c678d34fc5b59da671ee9cd630096ddc643e7b5a30d54a2a6f3574d3f \ + --hash=sha256:c8653fd547c93a61aadc612007790f5555cdd18946fa48cf45e26d8ea4ea473d \ + --hash=sha256:cc7cb243a68167172f48c1fd43cee91ec4b1d40cefd190edd43369d1a6bc9c82 \ + --hash=sha256:ccd4893707b3e2a13e39c90d43cf80edf2e4d0457935bcc103bf2346214c3f15 \ + --hash=sha256:cd817772b2fcf2b8c0905795318485f9ec16eae60b29feb7f4c77085311637f0 \ + --hash=sha256:cda5fd5c95ad7a125a2e8464acc78b98b94c475a3780d6aa0aa157c93f470f4d \ + --hash=sha256:cef89a58e628c4efcac3275c2d68083f82426dcdc89c1492a6f654f9f7ea6ab9 \ + --hash=sha256:d1558173930a5a8d3069cee5c92fc91c87c4dbcb099debbb3622053717145a19 \ + --hash=sha256:d6088ec9894113802bddb3c09e974929aed2c7b3a8c456219b8aab4481f1a239 \ + --hash=sha256:d6218d92e450824e9b4881f44e8c09f1853b490f9a64130801024a4793b1b3b0 \ + --hash=sha256:d77640cc618c1d99fc4f8589c0f24a730adfa54eb1e57ef7bf0c8dfb78da898c \ + --hash=sha256:d7d2deec16eeedf55f2c7cf75b521ea3856a5177e123844f8fd0f114ce252cb5 \ + --hash=sha256:db332af25642007330fca8be5c4d194caf2bea7a7fc84415aff3497af5dfee6b \ + --hash=sha256:dd54d0e8717de95939766febac482ac0474d8ac3b048115f9f2b1d23a16e7db4 \ + --hash=sha256:ddcac3c6b382e81f1dd0499199d4136b877beb4cb5ef770bbbfba56c4b8f55d2 \ + --hash=sha256:df82f3787c940c94986b34222d59c9e38843fba85139f36e85255a82ad5355a9 \ + --hash=sha256:dfa68deb2a443bdaa3ea5297b0699c1464f08aef3812b486d1348eee61b07dc0 \ + --hash=sha256:dff9461ec275f22135650d5ba4b4931a11f3958df7dfbb8db630000d4dee0883 \ + --hash=sha256:e1e74298bab6ee0d6e749ed4fd1901c7e604bdda32c03d787a2cc71c46d0433d \ + --hash=sha256:e2667f0bbe7eb6c74eae5e9691441ad186e5845ca3cff63230fc09c4e7514f5d \ + --hash=sha256:e3be98a7c30b8c25d573dafba7171d66dfb05ee6a9070fc46535464ff97700a6 \ + --hash=sha256:e568e14940c09955aa51f4e645b6daa18a581c5dcfcd73744dcc86a856e3ced3 \ + --hash=sha256:e72ee89e28d907a18f46959b4eb0bb06701cc7f8cf4366e00029e2ccfaaf5924 \ + --hash=sha256:e92eb8acc45eb6a9f4935071a77edf5b85cc6f8dfad5cd99e97653c26593cdde \ + --hash=sha256:ea05e1f97ceea523942d9b2a7d7c0359d781d683d6b043f5943a602b14da4787 \ + --hash=sha256:eac645b09bcfdf73df7536331f0678c1086ea250981118ddb5199e17ccef72bb \ + --hash=sha256:eb0495d778817619273c108784292be161a924b9f5ae5cbbc70a2caa6838250b \ + --hash=sha256:ebe8e504f058fe91223351cecd2d9d6946c9d241bb0250d898ffbdf584cc72b0 \ + --hash=sha256:ed099d105449c4f9e84f24af203cd131349d4761d8813fa7e02c32e7128cd910 \ + --hash=sha256:f0f177d1b195b9e06376cfd7d308d8a1b920909a609d03ac82a8c73bbb16d3b9 \ + --hash=sha256:f3d2669fe7dec7fc359ecdb5984b29b50d85d5d00f8c1cb61de4f4a24ee42627 \ + --hash=sha256:f4e05329faa0ea1a404b37de4f034fd2c2defcca06a68dc6745e4e56c88e8a48 \ + --hash=sha256:f53bcd52f585e1ac3e590d61434eb61f9a88c38df041b4ea126d97144344a77b \ + --hash=sha256:f55119f7bf25f49ed210f6096090715da24f2943c62102448915fde3c62877ce \ + --hash=sha256:f631fe87a6f30df5fbe6d79640b25e4cffb38c31c7fb6f10871517b84b0f8c1a \ + --hash=sha256:f8fb78a83c9e5f741ca3a68cfb455c1f5bb83b4e7249a3848b3cd78d0a8563b0 \ + --hash=sha256:fa9467a8113aa69d3d7c55a70ef0b7c636010a40993f3df9d9d0d73b3eb7ef24 \ + --hash=sha256:fd51ebf9d3a00c074df4ede271023f4d2dba289bcc740b88191872716014e3c5 # via + # -r requirements-strix-ci.txt # gql # litellm aiosignal==1.4.0 \ @@ -401,53 +402,53 @@ click==8.4.1 \ # litellm # typer # uvicorn -cryptography==49.0.0 \ - --hash=sha256:026ac7423e6fa66872d3bf889be5974507da3944f866f704fa200eadacd00001 \ - --hash=sha256:07cab27cc7b7e0fd28e5e26bb9eeedde5c135c868b46de4a27845abe94af6122 \ - --hash=sha256:084ef1af862eb07ec46d25f68689f2102a9fc0e05ce7b80f14f5fe51e4eef0f6 \ - --hash=sha256:0b82e28ee398a386f0807bba7884d30f25218855690f45115831bcce5d90822c \ - --hash=sha256:0e959b578856a3924bc0cbb710fc12c387b9412a951389f3ca61704a9e25f325 \ - --hash=sha256:0f21641cf4b30fca7aee061ced0ec7ad7b073518088b7c9969a297c0ae796c69 \ - --hash=sha256:196ecd6a36e4e9aa10270393bb98d8df88fccee0bf1e5128b91ae4eb4375896d \ - --hash=sha256:2400ef9c9e2299a25614eb1dea3db54a69b1349efd043bfac9c67630d136df36 \ - --hash=sha256:28d8b15e6275f12c8a207dc309dfa957903c927d08d0cc937ee3f63f200693cc \ - --hash=sha256:2afe9051da7ae7bd5905da5a949280c7d2bb75682e188f650a9d0f2756b834c6 \ - --hash=sha256:2eda353d8a27bcbcaa4cbed18994a74ab4d19a2ca897db188ea269ab9b71419b \ - --hash=sha256:32703d93296f5c1f4b53349ad3a250c2cae0fdecd3a3dd5d47e616d8d616af27 \ - --hash=sha256:33cd0565932807baddb67b96dbee92f2c374b5c89dee09fd74079aeb8c8dba61 \ - --hash=sha256:35b151772baff2c74cba7fa290ceaff4c3b11c0c881eb93eb5dbc05a7cfbba18 \ - --hash=sha256:36d1709f992593689b45bda411498d62c6e365f2ca00b84657d4dadd24de16db \ - --hash=sha256:42b0684e0e40cf26122427802486f6d93aea593612603a94fbf260c7eb1e9c1b \ - --hash=sha256:4ae387c9cb68ea569ca17e490d66d8142b81c3cc814bf179974b7d146e490bbb \ - --hash=sha256:53ecee2e23f7169b6117e99fc8a944e5e50f79e69758a83b52a00cb98ab2b2d2 \ - --hash=sha256:66ec79c3904820572d7e987abdf304281f141d37ad9a489b8e97066e7b9b6459 \ - --hash=sha256:67e1d20ad9ef3a563c59ef22e7a8a0b8210bd26604369ea4a30a7c66aefe504e \ - --hash=sha256:6f2debedf9ca60cf1d5bd466475638af5130f89965605cd818484d19987d3a21 \ - --hash=sha256:6fc361c34fb6aac015ce19435876635e5c6d21db31998b0920f675f131e043b8 \ - --hash=sha256:73a205dce83953d131a4aa1e0fd917a2fd1c5b1eef251e9d7152efefcbf5caf7 \ - --hash=sha256:7abcee80084cda3f7691f3eb1ce480d8df49cec637b429aa35986c1de71738aa \ - --hash=sha256:8c25ceb16df5b9435f3f6a9829204985b0e0cbee3b48aacd432c7d2c850b44d9 \ - --hash=sha256:966fe0e9c67490071f14c0d2b1cb2dfb3023c5ce39457343931415f08382f2db \ - --hash=sha256:9e82dcc8e56052715fb18b2429e3bca4823b1629136a2084fc45a9a5cecb9b64 \ - --hash=sha256:b20133d204d2bb56ba047642199603876c872026ca53e79c35b83772ab2cc505 \ - --hash=sha256:b39efa323140595abd3ecca8529d321ae50f55f3aa3ba9cc81ea56a6011953d5 \ - --hash=sha256:b47db11c2c3525083296069b98ac5221907455e989ae0c2e3008bde851921615 \ - --hash=sha256:b87e65d263b3e5d3bb92a57e2a6638e2f31110fa7aa890c7b2dbba42248d0a3f \ - --hash=sha256:b970c6da94d5bb18629db453d14f2a1300f6bf59b61e9b82377931ef95504866 \ - --hash=sha256:be9fcb48a55f023493482827d4f459bd263cc20efde64f204b97c123201850c6 \ - --hash=sha256:c2bc30226390d60ea19d9f82b19db005fe0452154a23c1c410c12ea801e43561 \ - --hash=sha256:c83782480a4a9da4d0feb51950131ba32e12e70813848b3343f6e18c28a66838 \ - --hash=sha256:cbc77da8c523d5abd028635ba850a6966fcee2c82e2bf65a41d1d8afe0f98be9 \ - --hash=sha256:ccac2bfebc306b862133e3bb71f3f6ee8bb525240089b2d952e4144b3a6d5da7 \ - --hash=sha256:d0527ce944105f257f605a827d6ebead966c752038b6e8656abb9c5edee6fc68 \ - --hash=sha256:d8ecde755e2e91bf773fc94e8c9d730cd7f2007004cb492263a794ec3899a1c8 \ - --hash=sha256:e3fb64c420688e5319ae25113a354015abbd8dffbfbc41781a1ea66fc7622ac3 \ - --hash=sha256:e5dfc1e64de5677cec922ffa8da89c546d0415bf6efdf081842e5d44c84e1f0e \ - --hash=sha256:ec5e529fb80935c94fe7b729f9972b50e351a0e6b50aa294fd5cabb109fcc29a \ - --hash=sha256:f37d847238971164fdbc68ade6f6574aecc9c0af714190e2083429ff68f4ce9d \ - --hash=sha256:f78ff2c9ed8dc2d036b0f4d640e22522213d047c1b14e61205a7e55c80a494d4 \ - --hash=sha256:f89660a348f4f78a92366240a61404e337586ef7f5909a2fef59ca88ef505493 \ - --hash=sha256:fc1e275c2f1d97b1a6450b8b0ea3ebfa6e087a611c2b26cb2404d48588abab7b +cryptography==50.0.0 \ + --hash=sha256:031e2d5dd4bb9caa3ca9c82e5a197fd8ae680232cee62603d1a813f3f07e3d03 \ + --hash=sha256:06a32a980526a6ab9a4b9bf8f7385800791e2bb960903cb6b530e4817509a3b7 \ + --hash=sha256:07479a1cb08219ab719147e742e76090c9c773321959bb94946fffdd397a6437 \ + --hash=sha256:07949c449a1abcf60d1ee6e88956d89404c7df3c8258f46589e912988e551987 \ + --hash=sha256:105110f43a471dbd0060b9c9516cb8a6a79233631a04cc2ba16f28323ac6e025 \ + --hash=sha256:11b74db56cdbe3cdee6e3f6982ecb70334fa10dce99ed58bf7894aaaa3b2a037 \ + --hash=sha256:12b9c6996425c76ea6c457ace4f3073e715b8c545add07cd1a8f3a4f90691269 \ + --hash=sha256:1489e263a8048bb8b6a8bac662eb2d402ea5d2b7b4699b72f385f1e2772db105 \ + --hash=sha256:19736989797678c6af1e55cd49055cdbcb55d8f6b5583ac5335f933aba9101dc \ + --hash=sha256:1b4a266766514614f8aa60416e71f2fc6e575d36e7bdc90f644fadb2f4b75b95 \ + --hash=sha256:2a8183b489dc1f7f80f135780fadc1108f14b31b8a40411c7a5b17425f65f28b \ + --hash=sha256:37fdb0d0111f1e2ff07139dfb79f1b49531f8e213c46f1163dd7642979b58c47 \ + --hash=sha256:3f5735ffe4996d28b809371756219f5354864902a3b9e7c0b9ee87041209fc9c \ + --hash=sha256:49e7d93abdbd2990caced757e5fade25302f719c3c8fb6e6fff2dde98999fc41 \ + --hash=sha256:5e34edd123674534acd70147f0ca331eaa2c74e6325fb2028c886aa26ba0b68c \ + --hash=sha256:62598a8a57f815db4c6259a4e97d857dab56697e7de8e8ab02352ab74da1995d \ + --hash=sha256:65c2c3add92b45fd0709db8594536aea39c2a67af0e27ffcf049c498501140b7 \ + --hash=sha256:6ba6a53445bd3cfa809ef3ef5f1589aa6ba08784a1d962bf47d0940e871dab1c \ + --hash=sha256:6e7d61120573a7f2cd94cc095f9e81f6967c61ccdf194285aa143ecec8e0b708 \ + --hash=sha256:7cec5b856506da6defb290f30c9ee687d5f5e8cb0bd3f6459dde43b0b4fa40ef \ + --hash=sha256:80b63928fa35083b33966ce1efb70e5b9607181e49dcd1c22c8c005e319f667f \ + --hash=sha256:82148ec5bddac30b51a5b3c1945075f896fa022cb93f8e4a01e9f6ee95292c5f \ + --hash=sha256:828743d939e9629bc267b8e2d08d8bb67cd4319c771a33d4b18b22dd8fb7440a \ + --hash=sha256:8d89f3976b10b4ce31118de72329025f70d2c6ead14a8217c5514dd2c6d5a78f \ + --hash=sha256:8eb5e1172eb569ea8a872796576e6a67c276351728b6455d5beb01242b027c6a \ + --hash=sha256:900131fafd8aead39ac7dd3a7e833be754c17a95cfd91221636949fe4eb0aa8a \ + --hash=sha256:910d11e1a385c654bf738bf3e6b8e6ed5de0f5610fcae2be9e5b398d8081d20e \ + --hash=sha256:910e1d2668e7de9648f2bcee30e180db2a6b15c30f887d7c4c93ddf96e3992e3 \ + --hash=sha256:9aa87839c383bdbab6ef865787a1fb877af8dd03464c4400322726feaaadfc6d \ + --hash=sha256:a1b30560f2acc95aa8b2e06e716a13dbfc97314747b80d9707e307f77b40d6b3 \ + --hash=sha256:a91296cb61e8df6f86d0c19cc4068228da256bf59bf86049fbd821084565327f \ + --hash=sha256:b42a28c1844fd9de8f3f7d540e36b66f3a9c83fceac7170ebc7a6a19edd9dcae \ + --hash=sha256:bd1c592e4d5974f0d08d4888e432157adba757c66da0246918e43677fafa2d30 \ + --hash=sha256:c87f62a3d3b9888ed0fdde100ec06aa61ca9cd44bad9057d1dff9a516b5f5bb9 \ + --hash=sha256:c99c003e088647b8a5b7c145d6f78c335f6348332b62e142d411c4b63d1460b9 \ + --hash=sha256:ccdc4a71a4dabae05de219404f9f4abc38e3b58422177ff93d0da05967dafa07 \ + --hash=sha256:d24fead1d4d076e1bfb006dcec392074a3cd8d7b4fc8a595aa64073b2b7a96ba \ + --hash=sha256:d58c3db7cd6eed54e6c06744db55456b65ebd7492ddeae9c1e93cfca7aa857d3 \ + --hash=sha256:d764dcf130c428ef66786f866dd750f53182bc608813489915e9fc106bb0c82f \ + --hash=sha256:df2a58a472f332225671c35b0a830208b86d004f82baa8530fa3782c85646533 \ + --hash=sha256:e722f16708d854fe924790e051061f6704a472c3bac347b6fd88033ea8dd0dc5 \ + --hash=sha256:ecfed7367f965a0328cfbdd70da860f15441f002f613185668c6e6ebf5a0ac11 \ + --hash=sha256:eeac2acb5a20ed25e0ad6d1df9891a520b78b404266b6d11778f25d5d691a6c9 \ + --hash=sha256:f59e38625469987d7ef6d495323c55e7db6c212eaf6112267e0d3b565a2e9c9f \ + --hash=sha256:f89831ef99dd7dd169ab06d63a831adb9e20a87aac6d380266bbda5823349169 \ + --hash=sha256:fd9192b7b70c573d7f214eb1ae35e00d359f6f5e4b27c7e21e30de1fc6204645 # via # -r requirements-strix-ci.txt # google-auth @@ -1680,9 +1681,9 @@ pyjwt==2.13.0 \ --hash=sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423 \ --hash=sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728 # via mcp -pyopenssl==26.3.0 \ - --hash=sha256:46367f8f66b92271e6d218da9c87607e1ef5a0bc5c8dea5bb3db82f395c385a3 \ - --hash=sha256:589de7fae1c9ea670d18422ed00fc04da787bbde8e1454aea872aa57b49ad341 +pyopenssl==26.4.0 \ + --hash=sha256:28dfcce0162b9211413e26dfbfdf1d24317fbeba18fc93c12400a1856b2a0bc7 \ + --hash=sha256:f0eb0cb2d581d3ad2b9c489468485e7f2ab6727d08401bcf9d824c3caddf3c1c # via google-auth python-dateutil==2.9.0.post0 \ --hash=sha256:37dd54208da7e1cd875388217d5e00ebd4179249f90fb72437e91a35459a0ad3 \