fuin/pyproject.toml at main · ykus4/fuin · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
[project]
name = "fuin"
version = "2.0.0"
description = "Android DEX Packer — web-based APK packing for static analysis resistance"
requires-python = ">=3.12"
readme = "README.md"
license = "MIT"
license-files = ["LICENSE"]

# Base install is the packer only. The web service is an extra so that
# `fuin-pack` users are not made to install FastAPI, SQLAlchemy and friends.
dependencies = [
    "cryptography>=49.0.0",
    "python-dotenv>=1.2.2",
]

[project.optional-dependencies]
server = [
    "fastapi>=0.141.1",
    "uvicorn[standard]>=0.51.0",
    "python-multipart>=0.0.32",
    "sqlalchemy>=2.0.51",
    "pydantic>=2.13.4",
    "httpx>=0.27.0",
    "alembic>=1.18.5",
]

[project.urls]
Homepage = "https://github.com/ykus4/fuin"
Documentation = "https://ykus4.github.io/fuin"
Source = "https://github.com/ykus4/fuin"

[project.scripts]
fuin-pack   = "fuin.cli:main"
fuin-server = "fuin.server.main:run"

[tool.hatch.build.targets.wheel]
packages = ["src/fuin"]

[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"

[dependency-groups]
dev = [
    "pre-commit>=4.6.2",
    "ruff>=0.15.15",
    "pytest>=9.1.1",
    "pytest-asyncio>=1.4.0",
    "pytest-cov>=7.0.0",
    "mypy>=1.18.2",
    # Pinned below 2.0: MkDocs 2.0 removes the plugin system outright.
    "mkdocs-material>=9.6.0,<10",
    "mkdocs<2",
    "httpx>=0.27.0",
]

[tool.pytest.ini_options]
asyncio_mode = "auto"
testpaths = ["tests"]
addopts = "--strict-markers --strict-config"
# The suite is warning-clean; keep it that way.
filterwarnings = ["error"]
xfail_strict = true

[tool.coverage.run]
source = ["fuin"]
branch = true

[tool.coverage.report]
exclude_also = ["if TYPE_CHECKING:", "raise NotImplementedError"]

[tool.mypy]
python_version = "3.12"
files = ["src/fuin"]
# The codebase is annotated but was never type-checked, so this starts at a
# level that passes today. Tighten as the untyped edges get annotated.
ignore_missing_imports = true
warn_unused_ignores = true
warn_redundant_casts = true
no_implicit_optional = true

[tool.ruff]
line-length = 100
target-version = "py312"

[tool.ruff.lint]
# B (bugbear) and S (bandit) matter for a security tool; SIM/C4/RUF/PT are
# cheap correctness-adjacent wins.
select = ["E", "F", "I", "UP", "B", "S", "SIM", "C4", "RUF", "PT"]
ignore = [
    "E501",    # line length is enforced by the formatter
    "S603",    # subprocess calls are the point of android_tools
    "S404",
]

[tool.ruff.lint.per-file-ignores]
"tests/**" = [
    "S101",    # assert is how tests assert
    "S105",    # hardcoded test passwords
    "S106",
    "S324",    # sha1/adler32 appear because the DEX format mandates them
]
"src/fuin/encryption/dex_strings.py" = ["S324"]  # the DEX header mandates SHA-1
"src/fuin/apk/signing.py" = ["S324"]
# FastAPI's dependency-injection idiom is a call in the argument default.
"src/fuin/server/routers/*" = ["B008"]
"src/fuin/apk/keystore.py" = ["S105"]     # the debug keystore password is public by design
"src/fuin/server/main.py" = ["S104"]      # binding 0.0.0.0 is the point of a container