Metadata-Version: 2.4
Name: floe-core
Version: 0.1.0a1
Summary: Core plugin registry and interfaces for the floe data platform
Project-URL: Homepage, https://github.com/Obsidian-Owl/floe
Project-URL: Documentation, https://github.com/Obsidian-Owl/floe/tree/main/docs
Project-URL: Repository, https://github.com/Obsidian-Owl/floe
Author-email: Obsidian Owl <team@obsidianowl.dev>
License-Expression: Apache-2.0
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Typing :: Typed
Requires-Python: >=3.10
Requires-Dist: asyncpg<1.0,>=0.29.0
Requires-Dist: certifi>=2023.0.0
Requires-Dist: click<9.0,>=8.1.0
Requires-Dist: datacontract-cli<1.0,>=0.10.0
Requires-Dist: httpx<1.0,>=0.27.0
Requires-Dist: jinja2<4.0,>=3.0
Requires-Dist: kubernetes<36.0,>=35.0.0
Requires-Dist: opentelemetry-api<2.0,>=1.39.0
Requires-Dist: opentelemetry-exporter-otlp-proto-grpc<2.0,>=1.20.0
Requires-Dist: opentelemetry-exporter-otlp-proto-http<2.0,>=1.20.0
Requires-Dist: opentelemetry-sdk<2.0,>=1.20.0
Requires-Dist: oras<1.0,>=0.2.38
Requires-Dist: pydantic<3.0,>=2.12.5
Requires-Dist: pyyaml<7.0,>=6.0
Requires-Dist: sigstore>=4.2.0
Requires-Dist: sqlalchemy[asyncio]<3.0,>=2.0
Requires-Dist: structlog<26.0,>=24.0
Provides-Extra: dev
Requires-Dist: jsonschema>=4.0; extra == 'dev'
Requires-Dist: mypy>=1.8; extra == 'dev'
Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'
Requires-Dist: pytest-cov>=4.0; extra == 'dev'
Requires-Dist: pytest>=9.0.3; extra == 'dev'
Requires-Dist: ruff>=0.3; extra == 'dev'
Requires-Dist: types-pyyaml>=6.0; extra == 'dev'
Description-Content-Type: text/markdown

# floe-core

Core plugin registry and interfaces for the floe data platform.

## Installation

```bash
uv pip install floe-core
```

## Features

- Plugin discovery via entry points
- Type-safe plugin registration
- Version compatibility checking
- Configuration validation with Pydantic
- Health check support
- Artifact signing and verification (Epic 8B)

## External Dependencies

The following external CLI tools are required for artifact signing features:

### cosign (>= 2.0.0)

Required for key-based signing, KMS integration, and attestations.

```bash
# macOS
brew install cosign

# Linux (Debian/Ubuntu)
COSIGN_VERSION=2.4.1
curl -LO https://github.com/sigstore/cosign/releases/download/v${COSIGN_VERSION}/cosign-linux-amd64
sudo install cosign-linux-amd64 /usr/local/bin/cosign

# Verify installation
cosign version
```

### syft (for SBOM generation)

Required for generating Software Bill of Materials (SBOM) in SPDX format.

```bash
# macOS
brew install syft

# Linux
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin

# Verify installation
syft version
```

> **Note**: Keyless signing (OIDC-based) uses the `sigstore` Python library and does not require cosign CLI.

## Environment Variables

Configuration environment variables for signing and testing:

| Variable | Default | Description |
|----------|---------|-------------|
| `FLOE_DISABLE_BROWSER_OAUTH` | `false` | Set to `true` to prevent interactive browser OAuth. Use in CI/CD where OIDC ambient credentials should be available. |
| `FLOE_OIDC_TOKEN_MAX_RETRIES` | `3` | Maximum retries for OIDC token acquisition (1-10). |

### CI/CD Configuration

In GitHub Actions, ensure OIDC is enabled:

```yaml
permissions:
  id-token: write  # Required for keyless signing
```

Then disable browser OAuth fallback:

```yaml
env:
  FLOE_DISABLE_BROWSER_OAUTH: "true"
```

This ensures tests fail fast if OIDC credentials are unavailable rather than hanging on browser auth.

### Security Environment Variables

| Variable | Default | Description |
|----------|---------|-------------|
| `FLOE_ENVIRONMENT` | `development` | Set to `production` to enforce SSL verification on all HTTPS connections. Production environment ignores `verify_ssl=False` parameters. |
| `FLOE_ALLOW_INSECURE_SSL` | `false` | Set to `true` to allow disabling SSL certificate verification in non-production environments. Required for self-signed certificates in development. |

**Security Notes:**
- In production (`FLOE_ENVIRONMENT=production`), SSL verification is **always enforced** regardless of code settings
- Disabling SSL verification requires explicit opt-in via `FLOE_ALLOW_INSECURE_SSL=true`
- A CRITICAL-level log is emitted when SSL verification is disabled

## Development

```bash
# Install with dev dependencies
uv pip install -e ".[dev]"

# Run tests
pytest

# Type checking
mypy src/floe_core

# Linting
ruff check src/floe_core
```
