Ryan Malloy
fdb9ba32d5
Closes Hamilton audit High #4 (bare-except in error drain) and High #5 (no cursor finalizers), plus 1 medium one-liner. After Phases 26-28, 0 CRITICAL and 0 HIGH audit findings remain. Driver is PRODUCTION READY. What changed: cursors.py: * Cursor finalizers via weakref.finalize. Mid-fetch raises (or any GC without explicit close()) now release server-side resources (CLOSE + RELEASE PDUs). Pre-built static PDU bytes at module load so finalizer can run on any thread without allocating or calling cursor methods. * Non-blocking lock acquire prevents cross-thread GC deadlock. WARNING log on lock-busy so leak accumulation is visible. * state=[False] list pattern keeps finalizer closure weak. GIL dependency of atomic single-element mutation documented. * _raise_sq_err near-token parse: (ProtocolError, OSError) only. * _raise_sq_err drain: force-close connection on same exceptions (wire unrecoverable after desync). connections.py: * _raise_sq_err drain: same hardening as cursor version. Force-close on (ProtocolError, OSError, OperationalError) - the latter from _drain_to_eot raising on unknown tags. Documented inline. * Added contextlib import for force-close suppression. cursors.py write_blob_column: * BLOB_PLACEHOLDER validation now requires EXACTLY ONE occurrence. Pre-Phase-28, str.replace silently substituted every occurrence - corrupting SQL containing the literal string in comments etc. Now raises ProgrammingError with workaround pointer. _resultset.py: * Investigated end-of-loop bounds check for parse_tuple_payload. Reverted: long-standing off-by-one in UDTVAR(lvarchar) trailing- pad logic produces benign over-reads (payload is a fully-extracted bytes object; over-reads return empty slices through unused branches). Real silent-corruption surfaces are length-prefix decoders, needing branch-local checks. Documented as deliberate non-fix. Margaret Hamilton review surfaced two blocking conditions: * Asymmetric failure handling: _raise_sq_err force-closed the connection on wire desync, but the cursor finalizer silently swallowed identical failures. "Same wire, same failure mode, same response" - finalizer now matches _raise_sq_err's discipline. * Leak visibility: wire-lock-busy log was DEBUG. Promoted to WARNING so leak accumulation on pooled connections is visible. Plus three documentation improvements (GIL dependency, OperationalError in desync taxonomy, parse_tuple non-fix rationale). One new regression test: * test_write_blob_column_rejects_multiple_placeholders 72 unit + 229 integration + 28 benchmark = 329 tests; ruff clean. Phase 29 ticket (Hamilton recommended): deferred-cleanup queue drained at next _send_pdu, closes unbounded-leak gap on long-lived pooled connections. Not blocking Phase 28. Hamilton audit verdict: Pre-26: 2 critical, 3 high, 5 medium Post-28: 0 critical, 0 high, 4 medium
108 lines
3.4 KiB
TOML
108 lines
3.4 KiB
TOML
[project]
|
|
name = "informix-db"
|
|
version = "2026.05.05.2"
|
|
description = "Pure-Python driver for IBM Informix IDS — speaks the SQLI wire protocol over raw sockets. No CSDK, no JVM, no native libraries."
|
|
readme = "README.md"
|
|
license = { text = "MIT" }
|
|
authors = [{ name = "Ryan Malloy", email = "ryan@supported.systems" }]
|
|
requires-python = ">=3.10"
|
|
keywords = ["informix", "database", "sqli", "db-api", "pep-249", "asyncio", "async"]
|
|
classifiers = [
|
|
"Development Status :: 4 - Beta",
|
|
"Framework :: AsyncIO",
|
|
"Intended Audience :: Developers",
|
|
"License :: OSI Approved :: MIT License",
|
|
"Operating System :: OS Independent",
|
|
"Programming Language :: Python :: 3",
|
|
"Programming Language :: Python :: 3 :: Only",
|
|
"Programming Language :: Python :: 3.10",
|
|
"Programming Language :: Python :: 3.11",
|
|
"Programming Language :: Python :: 3.12",
|
|
"Programming Language :: Python :: 3.13",
|
|
"Programming Language :: Python :: 3.14",
|
|
"Topic :: Database",
|
|
"Topic :: Database :: Front-Ends",
|
|
"Typing :: Typed",
|
|
]
|
|
dependencies = []
|
|
|
|
[project.urls]
|
|
Homepage = "https://github.com/rsp2k/informix-db"
|
|
Documentation = "https://github.com/rsp2k/informix-db/tree/main/docs"
|
|
Issues = "https://github.com/rsp2k/informix-db/issues"
|
|
|
|
[project.optional-dependencies]
|
|
dev = [
|
|
"pytest>=8.0",
|
|
"ruff>=0.6",
|
|
]
|
|
|
|
[build-system]
|
|
requires = ["hatchling"]
|
|
build-backend = "hatchling.build"
|
|
|
|
[tool.hatch.build.targets.wheel]
|
|
packages = ["src/informix_db"]
|
|
|
|
[tool.hatch.build.targets.sdist]
|
|
# Defense in depth: exclude operator-private and dev-only artifacts from the sdist
|
|
# (the wheel doesn't ship these by default, but the sdist would).
|
|
# See ~/.claude/rules/python.md for the full pre-publish PII audit playbook.
|
|
exclude = [
|
|
"CLAUDE.md", # operator-private context
|
|
".env", ".env.local", ".env.*",
|
|
".mcp.json", # may contain local filesystem paths
|
|
"build/", # decompiled JDBC, downloaded JARs
|
|
"audits/",
|
|
"docs/CAPTURES/", # spike artifacts; tests can re-capture against the dev container
|
|
"tests/reference/", # Java reference client — spike infra
|
|
".pytest_cache/", ".ruff_cache/", ".mypy_cache/",
|
|
"dist/", "*.egg-info/",
|
|
]
|
|
|
|
[tool.ruff]
|
|
line-length = 100
|
|
target-version = "py310"
|
|
src = ["src", "tests"]
|
|
|
|
[tool.ruff.lint]
|
|
select = [
|
|
"E", # pycodestyle errors
|
|
"W", # pycodestyle warnings
|
|
"F", # pyflakes
|
|
"I", # isort (import sorting)
|
|
"B", # flake8-bugbear
|
|
"C4", # flake8-comprehensions
|
|
"UP", # pyupgrade
|
|
"SIM", # flake8-simplify
|
|
"PTH", # flake8-use-pathlib
|
|
"RUF", # ruff-specific
|
|
]
|
|
ignore = [
|
|
"E501", # line too long — handled by formatter
|
|
]
|
|
|
|
[tool.ruff.lint.per-file-ignores]
|
|
"tests/**" = ["B011"] # allow assert False in tests
|
|
|
|
[tool.pytest.ini_options]
|
|
minversion = "8.0"
|
|
testpaths = ["tests"]
|
|
asyncio_mode = "auto" # pytest-asyncio: auto-detect ``async def`` tests
|
|
addopts = [
|
|
"-ra", # short summary for non-passing
|
|
"--strict-markers",
|
|
"--strict-config",
|
|
"-m", "not integration and not benchmark", # default: unit-only. Override with: pytest -m integration / -m benchmark
|
|
]
|
|
markers = [
|
|
"integration: requires a running Informix container (docker compose up); skipped by default",
|
|
"benchmark: pytest-benchmark performance test; skipped by default. Run with `make bench`.",
|
|
]
|
|
|
|
[dependency-groups]
|
|
dev = [
|
|
"pytest-asyncio>=1.3.0",
|
|
"pytest-benchmark>=5.2.3",
|
|
]
|