.gitignore

+*.pyc
+*.sw?
+*~
+/.coverage
+/.coverage.*
+.eggs/
+__pycache__/
+/build
+/dist
+/.tox
+.hypothesis/
+.mypy_cache/

.pre-commit-config.yaml

+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.6.0
+    hooks:
+      - id: trailing-whitespace
+      - id: check-json
+      - id: check-yaml
+
+  - repo: https://github.com/pycqa/flake8
+    rev: 7.1.0
+    hooks:
+      - id: flake8
+        additional_dependencies: [flake8-bugbear==22.9.23]
+
+  - repo: https://github.com/codespell-project/codespell
+    rev: v2.3.0
+    hooks:
+      - id: codespell
+        name: Check source code spelling
+        stages: [commit]
+
+  - repo: local
+    hooks:
+      - id: mypy
+        name: mypy
+        entry: mypy
+        args: [scripts]
+        pass_filenames: false
+        language: system
+        types: [python]
+
+  - repo: https://github.com/PyCQA/isort
+    rev: 5.13.2
+    hooks:
+      - id: isort
+
+  - repo: https://github.com/python/black
+    rev: 24.4.2
+    hooks:
+      - id: black

AUTHORS

+Copyright (C) 2022 The Software Heritage developers
+
+See http://www.softwareheritage.org/ for more information.

CODE_OF_CONDUCT.md

+# Software Heritage Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as Software
+Heritage contributors and maintainers pledge to making participation in our
+project and our community a harassment-free experience for everyone, regardless
+of age, body size, disability, ethnicity, sex characteristics, gender identity
+and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, religion, or sexual identity and
+orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+  advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies within all project spaces, and it also applies when
+an individual is representing the project or its community in public spaces.
+Examples of representing a project or community include using an official
+project e-mail address, posting via an official social media account, or acting
+as an appointed representative at an online or offline event. Representation of
+a project may be further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at `conduct@softwareheritage.org`. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an
+incident.  Further details of specific enforcement policies may be posted
+separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see
+https://www.contributor-covenant.org/faq

README.rst

@@ -38,3 +38,184 @@ file. Out of this, a virtualenv is generated and frozen into a
 
 The frozen requirements file can also be used to deploy virtual environments
 directly, e.g. on an existing VM or bare metal server.
+
+Local development
+-----------------
+
+App-manager
+~~~~~~~~~~~
+
+It's the cli tools which allows to execute various actions:
+- list dependency between swh modules
+- manipulate the generation of frozen requirements for our python applications
+- helm chart dependency version update
+- etc...
+
+.. code::
+
+   # Build the app-manager image
+   docker build -t app-manager scripts
+
+List dependent applications
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This is the listing command to list whatever other applications is depending
+on a specification application version.
+
+.. code::
+
+   docker run --rm -v $workspace/swh-apps:/src \
+     app-manager list-dependent-apps \
+       --application swh.graph --version v6.3.0
+
+Example:
+
+.. code::
+
+   docker run --rm -v $workspace/swh-apps:/src \
+     app-manager list-dependent-apps \
+       --application swh.graph --version v6.3.0
+   swh-alter
+   swh-graph
+   swh-provenance
+   swh-vault-cookers
+   swh-web
+
+
+Freeze application dependencies
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+This is in charge of using the existing requirements.txt declared besides the
+application's Dockerfile and generate an updated frozen-requirements.txt. This
+file is then used within the docker image to build an identical python
+environments within the image.
+
+Note that it does update any dependencies within the environments so any new
+upstream libraries will get updated if new releases happened.
+
+.. code::
+
+   docker run --rm -v $workspace/swh-apps:/src \
+     app-manager generate-frozen-requirements swh-provenance
+
+.. code::
+
+   $ docker run --rm -v $workspace/swh-apps:/src \
+       app-manager generate-frozen-requirements swh-provenance
+   Collecting uv
+     Downloading uv-0.5.26-py3-none-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (16.2 MB)
+        ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 16.2/16.2 MB 36.4 MB/s eta 0:00:00
+   Installing collected packages: uv
+   Successfully installed uv-0.5.26
+
+   [notice] A new release of pip is available: 23.0.1 -> 25.0
+   [notice] To update, run: python3 -m pip install --upgrade pip
+   Using Python 3.10.15 environment at: /tmp/swh-provenancep16_3kh7
+   Resolved 3 packages in 46ms
+   Prepared 3 packages in 86ms
+   Uninstalled 2 packages in 51ms
+   Installed 3 packages in 32ms
+    - pip==23.0.1
+    + pip==25.0
+    - setuptools==65.5.0
+    + setuptools==75.8.0
+    + wheel==0.45.1
+   # This file was autogenerated by uv via the following command:
+   #    uv pip compile /src/apps/swh-provenance/requirements.txt -o /src/apps/swh-provenance/tmpk6i4m4rz
+   Resolved 76 packages in 850ms
+   aiohappyeyeballs==2.4.4
+       # via aiohttp
+       # via -r /src/apps/swh-provenance/requirements.txt
+   python-magic==0.4.27
+       # via swh-core
+   python-mimeparse==2.0.0
+       # via aiohttp-utils
+   pyyaml==6.0.2
+       # via swh-core
+   redis==5.2.1
+       # via
+       # via -r /src/apps/swh-provenance/requirements.txt
+   ...
+   swh-storage==2.9.0
+       # via
+       #   swh-dataset
+       #   swh-provenance
+   tenacity==9.0.0
+       # via
+       #   swh-core
+       #   swh-journal
+       #   swh-storage
+   tqdm==4.67.1
+       # via swh-dataset
+   types-protobuf==5.29.1.20241207
+       # via mypy-protobuf
+   types-requests==2.32.0.20241016
+       # via swh-dataset
+   typing-extensions==4.12.2
+       # via
+       #   multidict
+       #   swh-core
+       #   swh-model
+       #   swh-objstorage
+       #   swh-storage
+   urllib3==2.3.0
+       # via
+       #   botocore
+       #   requests
+       #   sentry-sdk
+       #   types-requests
+   werkzeug==3.1.3
+       # via flask
+   wrapt==1.17.2
+       # via deprecated
+   yarl==1.18.3
+       # via aiohttp
+
+Update swh-charts' version
+~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Providing access to both the swh-apps and the swh-charts repositories, this
+allows to update the values of values-swh-application-versions.yaml with the
+most recent docker image versions. This also bumps the Charts.yaml's version
+incrementally.
+
+.. code::
+
+   docker run --rm \
+     --volume $workspace/swh-apps:/src \
+     --volume $workspace/swh-charts:/tmp/swh-charts \
+     app-manager update-versions \
+       --applications-filepath /tmp/s-charts/values-swh-application-versions.yaml \
+       --chart-filepath /tmp/swh-charts/swh/Chart.yaml
+
+Build application image
+~~~~~~~~~~~~~~~~~~~~~~~
+
+Each application is stored in swh-apps:/apps/$application_dir/ folder.
+It usually holds the same set of files:
+- Dockerfile: The set of instructions to build the application's docker image
+- entrypoint.sh: The last Dockerfile instruction refers to this executable to run in the
+    image.
+- requirements.txt: The set of python dependencies the application requires to run.
+- requirements-frozen.txt: The derivative frozen set of dependencies to reproduce the
+    environment in the docker image. It's built by the app-manager out of the
+    requirements.txt file.
+
+Cli call to build the application locally:
+
+.. code::
+
+   $ DOCKER_BUILDKIT=1 docker build -t swh-toolbox:latest apps/swh-toolbox \
+     --build-arg REGISTRY=
+
+Note: The REGISTRY is empty so we only rely to local docker image. You can avoid
+changing it, in which case, it will use the swh's gitlab registry.
+
+Cli call to run the application and be dropped in a shell:
+
+.. code::
+
+   $ docker run -it swh-toolbox:latest shell
+
+Note: This is specific command depending on the entrypoint.sh. In that case, the
+entrypoint.sh allows a shell option to be dropped in an interactive bash session.

apps/cassandra-checks/Dockerfile

+ARG REGISTRY=container-registry.softwareheritage.org/swh/infra/swh-apps/
+ARG base_image=${REGISTRY}base
+ARG base_image_version=latest
+
+FROM ${base_image}:${base_image_version}
+
+ARG user=swh
+ARG workdir=/opt/${user}
+ARG configdir=/etc/${user}
+
+USER root
+RUN mkdir /volume && chown root: /volume
+
+COPY --chmod=0644 requirements-frozen.txt ${workdir}
+RUN --mount=type=cache,target=.cache,uid=1000,gid=1000,uid=1000,gid=1000 \
+    uv pip sync requirements-frozen.txt
+
+COPY --chmod=0755 entrypoint.sh ${workdir}
+
+USER ${user}
+
+ENV SWH_CONFIG_FILENAME=${configdir}/config.yml
+
+ENTRYPOINT ["/opt/swh/entrypoint.sh"]

apps/cassandra-checks/entrypoint.sh

+#!/bin/bash
+
+set -e
+
+CLONE_DIR=/opt/swh/snippets
+
+if [ ! -d $CLONE_DIR ]; then
+    git clone --depth=1 https://gitlab.softwareheritage.org/swh/devel/snippets.git $CLONE_DIR
+else
+    pushd $CLONE_DIR
+    git fetch
+    git merge origin/master
+    popd
+fi
+
+case "$1" in
+    "shell")
+        shift
+        if (( $# == 0)); then
+            exec bash -i
+        else
+            "$@"
+        fi
+        ;;
+    *)
+        echo Starting Cassandra objects checker.
+        exec $CLONE_DIR/sysadmin/cassandra_checks/get_journal_check_and_replay.py
+        ;;
+esac

apps/cassandra-checks/requirements-frozen.txt

+# This file was autogenerated by uv via the following command:
+#    uv pip compile /src/apps/cassandra-checks/requirements.txt -o /src/apps/cassandra-checks/tmpwfuj2y1l
+aiohappyeyeballs==2.6.1
+    # via aiohttp
+aiohttp==3.11.14
+    # via
+    #   aiohttp-utils
+    #   swh-core
+aiohttp-utils==3.2.1
+    # via swh-core
+aiosignal==1.3.2
+    # via aiohttp
+attrs==25.3.0
+    # via
+    #   aiohttp
+    #   attrs-strict
+    #   hypothesis
+    #   swh-model
+attrs-strict==1.0.1
+    # via swh-model
+backports-entry-points-selectable==1.3.0
+    # via
+    #   swh-core
+    #   swh-storage
+blinker==1.9.0
+    # via
+    #   flask
+    #   swh-core
+cassandra-driver==3.29.2
+    # via swh-storage
+certifi==2025.1.31
+    # via
+    #   requests
+    #   sentry-sdk
+cffi==1.17.1
+    # via swh-perfecthash
+charset-normalizer==3.4.1
+    # via requests
+click==8.1.8
+    # via
+    #   flask
+    #   geomet
+    #   swh-core
+    #   swh-objstorage
+    #   swh-storage
+confluent-kafka==2.8.2
+    # via swh-journal
+deprecated==1.2.18
+    # via
+    #   swh-core
+    #   swh-model
+    #   swh-objstorage
+    #   swh-storage
+flask==3.1.0
+    # via
+    #   swh-core
+    #   swh-counters
+    #   swh-storage
+frozenlist==1.5.0
+    # via
+    #   aiohttp
+    #   aiosignal
+geomet==0.2.1.post1
+    # via cassandra-driver
+gunicorn==23.0.0
+    # via aiohttp-utils
+hypothesis==6.130.4
+    # via swh-model
+idna==3.10
+    # via
+    #   requests
+    #   yarl
+iso8601==2.1.0
+    # via
+    #   swh-core
+    #   swh-model
+    #   swh-storage
+itsdangerous==2.2.0
+    # via flask
+jinja2==3.1.6
+    # via flask
+markupsafe==3.0.2
+    # via
+    #   jinja2
+    #   werkzeug
+msgpack==1.1.0
+    # via
+    #   swh-core
+    #   swh-journal
+    #   swh-objstorage
+multidict==6.2.0
+    # via
+    #   aiohttp
+    #   yarl
+mypy-extensions==1.0.0
+    # via swh-storage
+packaging==24.2
+    # via gunicorn
+propcache==0.3.1
+    # via
+    #   aiohttp
+    #   yarl
+psycopg==3.2.6
+    # via
+    #   swh-core
+    #   swh-storage
+psycopg-pool==3.2.6
+    # via
+    #   swh-core
+    #   swh-storage
+pycparser==2.22
+    # via cffi
+python-dateutil==2.9.0.post0
+    # via swh-model
+python-magic==0.4.27
+    # via swh-core
+python-mimeparse==2.0.0
+    # via aiohttp-utils
+pyyaml==6.0.2
+    # via swh-core
+redis==5.2.1
+    # via
+    #   swh-counters
+    #   swh-storage
+requests==2.32.3
+    # via
+    #   swh-core
+    #   swh-objstorage
+sentry-sdk==2.24.1
+    # via swh-core
+six==1.17.0
+    # via
+    #   geomet
+    #   python-dateutil
+sortedcontainers==2.4.0
+    # via hypothesis
+swh-core==4.1.0
+    # via
+    #   swh-counters
+    #   swh-journal
+    #   swh-objstorage
+    #   swh-storage
+swh-counters==0.11.0
+    # via swh-storage
+swh-journal==1.5.3
+    # via swh-counters
+swh-model==7.1.0
+    # via
+    #   -r /src/apps/cassandra-checks/requirements.txt
+    #   swh-journal
+    #   swh-objstorage
+    #   swh-storage
+swh-objstorage==4.0.0
+    # via swh-storage
+swh-perfecthash==1.3.2
+    # via swh-objstorage
+swh-storage==3.0.0
+    # via -r /src/apps/cassandra-checks/requirements.txt
+tenacity==9.0.0
+    # via
+    #   swh-core
+    #   swh-journal
+    #   swh-storage
+typing-extensions==4.13.0
+    # via
+    #   psycopg
+    #   psycopg-pool
+    #   swh-core
+    #   swh-model
+    #   swh-storage
+urllib3==2.3.0
+    # via
+    #   requests
+    #   sentry-sdk
+werkzeug==3.1.3
+    # via flask
+wrapt==1.17.2
+    # via deprecated
+yarl==1.18.3
+    # via aiohttp

apps/cassandra-checks/requirements.txt

+swh-storage
+swh-model

apps/ipfs-gateway/Dockerfile

+#######
+# build
+#######
+# TODO: use an swh repository if it becomes a permanent thing
+ARG REPOSITORY=https://github.com/obsidiansystems/go-ipfs-swh-plugin.git
+ARG GIT_HEAD=2380683e3309e2c5bb167dbbbcb50f71eed063bb # master at 2023-01-31
+
+FROM debian:bullseye as build
+
+RUN apt update -y && apt dist-upgrade -y && apt install -y git nix
+
+RUN mkdir /src && cd /src && \
+    git clone --depth 1 https://github.com/obsidiansystems/go-ipfs-swh-plugin.git && \
+    cd go-ipfs-swh-plugin && \
+    git checkout $HEAD
+
+RUN cd /src/go-ipfs-swh-plugin && \
+    nix-build && \
+    nix-store --export $(nix-store --query --requisites ./result) > ipfs.dump
+
+# #############
+# # final image
+# #############
+
+FROM debian:bullseye
+
+RUN apt update && apt dist-upgrade -y && apt install -y nix && apt clean
+
+COPY --from=build  /src/go-ipfs-swh-plugin/ipfs.dump /tmp
+
+# Install ipfs cli with the minimalist runtime dependencies set
+RUN nix-store --import < /tmp/ipfs.dump && \
+    update-alternatives  --install /usr/bin/ipfs  ipfs /nix/store/*ipfs*/bin/ipfs 1
+
+RUN addgroup --gid 1000 ipfs && \
+    useradd --gid 1000 --uid 1000 -m ipfs
+
+USER ipfs
+WORKDIR /home/ipfs
+
+USER ipfs
+WORKDIR /data/ipfs
+ENV IPFS_PATH=/data/ipfs
+
+# | true to ignore the empty directory error:
+# https://github.com/ipfs/kubo/issues/9155
+RUN ipfs init -e -p swhbridge || true && \
+  ipfs config Addresses.API /ip4/0.0.0.0/tcp/5001 && \
+  ipfs config Addresses.Gateway /ip4/0.0.0.0/tcp/8080
+
+ENTRYPOINT [ "ipfs" ]
+CMD ["daemon"]

apps/ipfs-gateway/Readme.md

+# IPFS swh gateway
+
+## Usage
+
+To be able to retrieve the swh contents, the gateway uses a private SWH api endpoint.
+To do so, an SWH api token must be configured in the gateway configuration.
+
+- Bootstrap the gateway
+```
+    mkdir /srv/ipfs  # This is where the ipfs data will be stored
+    docker run --rm -ti -v /tmp/test:/data/ipfs --user $UID \
+        container-registry.softwareheritage.org/swh/infra/swh-apps/ipfs-gateway \
+        initipfs init -e -p swhbridge
+```
+WARN: ignore the ipld error (https://github.com/ipfs/kubo/issues/9155)
+
+- Edit the config file `/srv/ipfs/config` and search the Datastore.Spec.mounts section.
+- In the swhbridge child, add an `auth-token` entry:
+```json
+{
+    Datastore {
+        Spec {
+            "mounts": [
+                {
+                "child": {
+                    "type": "swhbridge",
+                    "auth-token: "<replace by the very long token>"
+                },
+            ]
+        }
+    }
+}
+```
+
+- Start the gateway with:
+```
+    docker run -d --name ipfs-gateway -p 5001:5001 -p 4001:4001/udp \
+        -v /srv/ipfs:/data/ipfs \
+        container-registry.softwareheritage.org/swh/infra/swh-apps/ipfs-gateway
+```
+
+The gateway detects the available interfaces and tries to guess its public ip address.
+```
+Swarm listening on /ip4/127.0.0.1/tcp/4001
+Swarm listening on /ip4/127.0.0.1/udp/4001/quic
+Swarm listening on /ip4/172.17.0.2/tcp/4001
+Swarm listening on /ip4/172.17.0.2/udp/4001/quic
+Swarm listening on /p2p-circuit
+Swarm announcing /ip4/127.0.0.1/tcp/4001
+Swarm announcing /ip4/127.0.0.1/udp/4001/quic
+Swarm announcing /ip4/172.17.0.2/tcp/4001
+Swarm announcing /ip4/172.17.0.2/udp/4001/quic
+Swarm announcing /ip4/1.2.3.4/udp/4001/quic   <------ the detected public address
+API server listening on /ip4/0.0.0.0/tcp/5001
+WebUI: http://0.0.0.0:5001/webui
+Gateway (readonly) server listening on /ip4/0.0.0.0/tcp/8080
+```
+
+If the annouces are not correct, it can be fixed in the configuration, the section `Adresses.Announce` and `Addresses.AppendAnnounce`
+
+**To be reachable from the internet, the port 4001 must be routed to the container**
+
+## Testing
+
+Once the gateway is up and publicly reachable, it can be tested like this:
+```
+docker run -ti --name ipfs-client --rm ipfs/kubo
+```
+On another terminal:
+
+```
+docker exec client ipfs dag get \
+    --output-codec=git-raw \
+       f0178111494a9ed024d3859793618152ea559a168bbcbb5e2
+```
+
+For more details on the ipfs usage, check at the ipfs gateway main repository:
+https://github.com/obsidiansystems/go-ipfs-swh-plugin.git

apps/software-stories/Dockerfile

+FROM node:19-bullseye
+
+RUN apt-get -y update && \
+    apt-get -y upgrade && \
+    npm install -g serve && \
+    mkdir -p /opt/swh/swh-stories && \
+    chown -R node:node /opt/swh
+
+USER node
+ENV NODE_OPTIONS=--openssl-legacy-provider
+WORKDIR /opt/swh/swh-stories
+
+RUN git clone https://github.com/ScienceStories/swh-stories.git /opt/swh/swh-stories && \
+    npm install --no-audit && \
+    npm run build
+
+COPY --chown=node:node entrypoint.sh /opt/swh
+RUN chmod u+x /opt/swh/entrypoint.sh
+
+ENTRYPOINT ["/opt/swh/entrypoint.sh"]

apps/software-stories/entrypoint.sh

+#!/bin/bash
+
+set -e
+
+case "$1" in
+  "shell")
+    shift
+    echo "Running command $@"
+    exec bash -i "$@"
+    ;;
+  *)
+    exec serve -s build
+    ;;
+esac

apps/swh-add-forge-now/Dockerfile

+ARG REGISTRY=container-registry.softwareheritage.org/swh/infra/swh-apps/
+ARG base_image=${REGISTRY}base
+ARG base_image_version=latest
+
+FROM ${base_image}:${base_image_version}
+
+ARG user=swh
+ARG workdir=/opt/${user}
+ARG configdir=/etc/${user}
+
+USER root
+RUN apt-get -y update && \
+    apt-get install -y netcat-openbsd jq && \
+    apt-get clean
+
+COPY --chmod=0644 requirements-frozen.txt ${workdir}
+RUN --mount=type=cache,target=.cache,uid=1000,gid=1000 \
+    uv pip sync requirements-frozen.txt
+
+USER ${user}
+
+CMD [ "/bin/bash", "-i" ]

apps/swh-add-forge-now/requirements-frozen.txt

+# This file was autogenerated by uv via the following command:
+#    uv pip compile /src/apps/swh-add-forge-now/requirements.txt -o /src/apps/swh-add-forge-now/tmpee98wbzv
+aiofiles==24.1.0
+    # via python-keycloak
+aiohappyeyeballs==2.6.1
+    # via aiohttp
+aiohttp==3.11.14
+    # via
+    #   aiohttp-utils
+    #   swh-core
+aiohttp-utils==3.2.1
+    # via swh-core
+aiosignal==1.3.2
+    # via aiohttp
+amqp==5.3.1
+    # via kombu
+anyio==4.9.0
+    # via httpx
+async-property==0.2.2
+    # via python-keycloak
+attrs==25.3.0
+    # via
+    #   aiohttp
+    #   attrs-strict
+    #   hypothesis
+    #   swh-model
+    #   swh-scheduler
+attrs-strict==1.0.1
+    # via
+    #   swh-model
+    #   swh-scheduler
+backports-entry-points-selectable==1.3.0
+    # via
+    #   swh-core
+    #   swh-storage
+billiard==4.2.1
+    # via celery
+blinker==1.9.0
+    # via
+    #   flask
+    #   swh-core
+cassandra-driver==3.29.2
+    # via swh-storage
+celery==5.4.0
+    # via swh-scheduler
+certifi==2025.1.31
+    # via
+    #   httpcore
+    #   httpx
+    #   requests
+    #   sentry-sdk
+cffi==1.17.1
+    # via
+    #   cryptography
+    #   swh-perfecthash
+charset-normalizer==3.4.1
+    # via requests
+click==8.1.8
+    # via
+    #   celery
+    #   click-didyoumean
+    #   click-plugins
+    #   click-repl
+    #   flask
+    #   geomet
+    #   swh-auth
+    #   swh-core
+    #   swh-objstorage
+    #   swh-scheduler
+    #   swh-storage
+click-didyoumean==0.3.1
+    # via celery
+click-plugins==1.1.1
+    # via celery
+click-repl==0.3.0
+    # via celery
+confluent-kafka==2.8.2
+    # via swh-journal
+cryptography==44.0.2
+    # via jwcrypto
+deprecated==1.2.18
+    # via
+    #   swh-core
+    #   swh-model
+    #   swh-objstorage
+    #   swh-storage
+deprecation==2.1.0
+    # via python-keycloak
+flask==3.1.0
+    # via
+    #   swh-core
+    #   swh-counters
+    #   swh-scheduler
+    #   swh-storage
+frozenlist==1.5.0
+    # via
+    #   aiohttp
+    #   aiosignal
+geomet==0.2.1.post1
+    # via cassandra-driver
+gunicorn==23.0.0
+    # via aiohttp-utils
+h11==0.14.0
+    # via httpcore
+httpcore==1.0.7
+    # via httpx
+httpx==0.28.1
+    # via python-keycloak
+humanize==4.12.2
+    # via swh-scheduler
+hypothesis==6.130.4
+    # via swh-model
+idna==3.10
+    # via
+    #   anyio
+    #   httpx
+    #   requests
+    #   yarl
+importlib-metadata==8.6.1
+    # via swh-scheduler
+iso8601==2.1.0
+    # via
+    #   swh-core
+    #   swh-model
+    #   swh-storage
+itsdangerous==2.2.0
+    # via flask
+jinja2==3.1.6
+    # via flask
+jwcrypto==1.5.6
+    # via python-keycloak
+kombu==5.5.1
+    # via celery
+markupsafe==3.0.2
+    # via
+    #   jinja2
+    #   werkzeug
+msgpack==1.1.0
+    # via
+    #   swh-core
+    #   swh-journal
+    #   swh-objstorage
+multidict==6.2.0
+    # via
+    #   aiohttp
+    #   yarl
+mypy-extensions==1.0.0
+    # via swh-storage
+packaging==24.2
+    # via
+    #   deprecation
+    #   gunicorn
+pika==1.3.2
+    # via swh-scheduler
+prompt-toolkit==3.0.50
+    # via click-repl
+propcache==0.3.1
+    # via
+    #   aiohttp
+    #   yarl
+psycopg==3.2.6
+    # via
+    #   swh-core
+    #   swh-scheduler
+    #   swh-storage
+psycopg-pool==3.2.6
+    # via
+    #   swh-core
+    #   swh-scheduler
+    #   swh-storage
+pycparser==2.22
+    # via cffi
+python-dateutil==2.9.0.post0
+    # via
+    #   celery
+    #   swh-model
+python-keycloak==5.3.1
+    # via swh-auth
+python-magic==0.4.27
+    # via swh-core
+python-mimeparse==2.0.0
+    # via aiohttp-utils
+pyyaml==6.0.2
+    # via
+    #   swh-auth
+    #   swh-core
+    #   swh-scheduler
+redis==5.2.1
+    # via
+    #   swh-counters
+    #   swh-storage
+requests==2.32.3
+    # via
+    #   python-keycloak
+    #   requests-toolbelt
+    #   swh-core
+    #   swh-objstorage
+    #   swh-scheduler
+requests-toolbelt==1.0.0
+    # via python-keycloak
+sentry-sdk==2.24.1
+    # via
+    #   swh-core
+    #   swh-scheduler
+setuptools==78.1.0
+    # via swh-scheduler
+six==1.17.0
+    # via
+    #   geomet
+    #   python-dateutil
+sniffio==1.3.1
+    # via anyio
+sortedcontainers==2.4.0
+    # via hypothesis
+swh-auth==0.10.0
+    # via -r /src/apps/swh-add-forge-now/requirements.txt
+swh-core==4.1.0
+    # via
+    #   swh-auth
+    #   swh-counters
+    #   swh-journal
+    #   swh-objstorage
+    #   swh-scheduler
+    #   swh-storage
+swh-counters==0.11.0
+    # via swh-storage
+swh-journal==1.5.3
+    # via swh-counters
+swh-model==7.1.0
+    # via
+    #   swh-journal
+    #   swh-objstorage
+    #   swh-storage
+swh-objstorage==4.0.0
+    # via swh-storage
+swh-perfecthash==1.3.2
+    # via swh-objstorage
+swh-scheduler==3.0.0
+    # via -r /src/apps/swh-add-forge-now/requirements.txt
+swh-storage==3.0.0
+    # via swh-scheduler
+tabulate==0.9.0
+    # via swh-scheduler
+tenacity==9.0.0
+    # via
+    #   swh-core
+    #   swh-journal
+    #   swh-storage
+typing-extensions==4.13.0
+    # via
+    #   anyio
+    #   jwcrypto
+    #   psycopg
+    #   psycopg-pool
+    #   swh-core
+    #   swh-model
+    #   swh-scheduler
+    #   swh-storage
+tzdata==2025.1
+    # via
+    #   celery
+    #   kombu
+urllib3==2.3.0
+    # via
+    #   requests
+    #   sentry-sdk
+vine==5.1.0
+    # via
+    #   amqp
+    #   celery
+    #   kombu
+wcwidth==0.2.13
+    # via prompt-toolkit
+werkzeug==3.1.3
+    # via flask
+wrapt==1.17.2
+    # via deprecated
+yarl==1.18.3
+    # via aiohttp
+zipp==3.21.0
+    # via importlib-metadata

apps/swh-add-forge-now/requirements.txt

+swh-auth
+swh-scheduler

apps/swh-alter/Dockerfile

+ARG REGISTRY=container-registry.softwareheritage.org/swh/infra/swh-apps/
+ARG base_image=${REGISTRY}base
+ARG base_image_version=latest
+
+FROM ${base_image}:${base_image_version}
+
+ARG user=swh
+ARG workdir=/opt/${user}
+
+USER root
+RUN apt-get update && \
+    apt-get -y upgrade && \
+    apt-get install -y \
+      curl \
+      dnsutils \
+      emacs-nox \
+      host \
+      jq \
+      libcmph-dev \
+      librdkafka-dev \
+      libsystemd-dev \
+      netcat-openbsd \
+      postgresql-client \
+      sed \
+      strace \
+      telnet \
+      tmux \
+      vim && \
+    apt-get clean
+
+COPY --chmod=0644 requirements-frozen.txt ${workdir}
+RUN --mount=type=cache,target=.cache,uid=1000,gid=1000 \
+    uv pip sync requirements-frozen.txt
+
+USER ${user}
+ENV CARGO_HOME="${workdir}/.cargo"
+ENV RUSTUP_HOME="${workdir}/.rustup"
+
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs -o /tmp/rustup-init.sh && \
+  chmod +x /tmp/rustup-init.sh && \
+  /tmp/rustup-init.sh -y && \
+  rm /tmp/rustup-init.sh
+
+ENV PATH="${CARGO_HOME}/bin:${PATH}"
+# install rage (for swh-alter)
+
+# Use the latest available version so we can detect if rage behavior has changed when
+# testing swh-alter. Otherwise, this might only be detected when processing a
+# takedown notice or restoring a bundle… which would not be a nice experience.
+RUN --mount=type=cache,target=.cache,uid=1000,gid=1000 \
+  cargo install rage
+
+COPY --chmod=0755 entrypoint.sh ${workdir}
+
+ENTRYPOINT ["/opt/swh/entrypoint.sh"]

apps/swh-alter/entrypoint.sh

+#!/bin/bash
+
+set -e
+
+case "$1" in
+    "shell")
+        shift
+        if (( $# == 0)); then
+            exec bash -i
+        else
+            "$@"
+        fi
+        exit 0
+        ;;
+    *)
+        echo "swh-alter pod: running a tmux server"
+        tmux set -g exit-empty off \; start
+
+        trap "tmux kill-server" INT TERM EXIT
+
+        while tmux list-sessions 2>/dev/null; do sleep 5; done
+        echo "tmux server has exited, bailing"
+        ;;
+esac