From 4209c400ed1f535598665135b573a7bcfad60ed6 Mon Sep 17 00:00:00 2001 From: "renovate[bot]" <29139614+renovate[bot]@users.noreply.github.com> Date: Thu, 29 Oct 2026 08:47:58 +0000 Subject: [PATCH 1/3] fix(deps): update morphir-extension-sdk digest to 945486e --- tools/extension-qualification/Cargo.lock | 78 ++++++++++++++++++++---- tools/extension-qualification/Cargo.toml | 2 +- 2 files changed, 67 insertions(+), 13 deletions(-) diff --git a/tools/extension-qualification/Cargo.lock b/tools/extension-qualification/Cargo.lock index 04dcafa2..8a3ae2a9 100644 --- a/tools/extension-qualification/Cargo.lock +++ b/tools/extension-qualification/Cargo.lock @@ -2184,9 +2184,9 @@ dependencies = [ "indexmap", "ion-rs", "libc", - "morphir-config", + "morphir-config 0.0.1 (git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104)", "morphir-core", - "morphir-workspace", + "morphir-workspace 0.2.0 (git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104)", "nbformat", "reqwest", "rustix 1.1.4", @@ -2210,6 +2210,19 @@ dependencies = [ "zip", ] +[[package]] +name = "morphir-config" +version = "0.0.1" +source = "git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05#945486e1320385e22986ef937db82e344b179d05" +dependencies = [ + "secrecy", + "serde", + "serde-saphyr", + "serde_json", + "thiserror 2.0.21", + "toml 1.1.6+spec-1.1.0", +] + [[package]] name = "morphir-config" version = "0.0.1" @@ -2233,7 +2246,7 @@ dependencies = [ "granit-parser", "indexmap", "lasso", - "morphir-json", + "morphir-json 0.2.0 (git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104)", "num-bigint 0.5.1", "schemars", "serde", @@ -2251,7 +2264,7 @@ dependencies = [ "flate2", "fs2", "morphir-common", - "morphir-extension-sdk", + "morphir-extension-sdk 0.4.0 (git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104)", "semver", "serde", "serde_json", @@ -2267,6 +2280,25 @@ dependencies = [ "zip", ] +[[package]] +name = "morphir-extension-sdk" +version = "0.4.0" +source = "git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05#945486e1320385e22986ef937db82e344b179d05" +dependencies = [ + "base64 0.22.1", + "extism-pdk", + "ion-rs", + "morphir-json 0.2.0 (git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05)", + "morphir-workspace 0.2.0 (git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05)", + "percent-encoding", + "semver", + "serde", + "serde_json", + "sha2 0.11.0", + "thiserror 2.0.21", + "url", +] + [[package]] name = "morphir-extension-sdk" version = "0.4.0" @@ -2275,8 +2307,8 @@ dependencies = [ "base64 0.22.1", "extism-pdk", "ion-rs", - "morphir-json", - "morphir-workspace", + "morphir-json 0.2.0 (git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104)", + "morphir-workspace 0.2.0 (git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104)", "percent-encoding", "semver", "serde", @@ -2294,8 +2326,8 @@ dependencies = [ "async-lock", "async-trait", "morphir-core", - "morphir-extension-sdk", - "morphir-workspace", + "morphir-extension-sdk 0.4.0 (git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104)", + "morphir-workspace 0.2.0 (git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104)", "semver", "serde", "serde_json", @@ -2313,9 +2345,9 @@ dependencies = [ "morphir-common", "morphir-core", "morphir-distribution", - "morphir-extension-sdk", + "morphir-extension-sdk 0.4.0 (git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104)", "morphir-host", - "morphir-workspace", + "morphir-workspace 0.2.0 (git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104)", "serde", "serde_json", "tempfile", @@ -2326,6 +2358,15 @@ dependencies = [ "unicode-normalization", ] +[[package]] +name = "morphir-json" +version = "0.2.0" +source = "git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05#945486e1320385e22986ef937db82e344b179d05" +dependencies = [ + "serde", + "serde_json", +] + [[package]] name = "morphir-json" version = "0.2.0" @@ -2342,7 +2383,7 @@ dependencies = [ "anyhow", "async-trait", "hex", - "morphir-extension-sdk", + "morphir-extension-sdk 0.4.0 (git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05)", "morphir-host", "morphir-host-native", "serde", @@ -2352,13 +2393,26 @@ dependencies = [ "tokio", ] +[[package]] +name = "morphir-workspace" +version = "0.2.0" +source = "git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05#945486e1320385e22986ef937db82e344b179d05" +dependencies = [ + "globset", + "morphir-config 0.0.1 (git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05)", + "semver", + "serde", + "serde_json", + "thiserror 2.0.21", +] + [[package]] name = "morphir-workspace" version = "0.2.0" source = "git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104#d51daa8aea7ae09ae295ff254d72b27770c64104" dependencies = [ "globset", - "morphir-config", + "morphir-config 0.0.1 (git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104)", "semver", "serde", "serde_json", diff --git a/tools/extension-qualification/Cargo.toml b/tools/extension-qualification/Cargo.toml index 3bf0b3bb..e44c7cb3 100644 --- a/tools/extension-qualification/Cargo.toml +++ b/tools/extension-qualification/Cargo.toml @@ -13,7 +13,7 @@ publish = false anyhow = "1" async-trait = "0.1" hex = "0.4" -morphir-extension-sdk = { git = "https://github.com/finos/morphir-rust.git", rev = "d51daa8aea7ae09ae295ff254d72b27770c64104" } +morphir-extension-sdk = { git = "https://github.com/finos/morphir-rust.git", rev = "945486e1320385e22986ef937db82e344b179d05" } morphir-host = { git = "https://github.com/finos/morphir-rust.git", rev = "d51daa8aea7ae09ae295ff254d72b27770c64104" } morphir-host-native = { git = "https://github.com/finos/morphir-rust.git", rev = "d51daa8aea7ae09ae295ff254d72b27770c64104" } serde_json = { version = "1", features = ["arbitrary_precision"] } From 2a2f298ea986b4e5cc5ccd25a64cca882f714cfa Mon Sep 17 00:00:00 2001 From: Damian Reeves <957246+DamianReeves@users.noreply.github.com> Date: Thu, 29 Oct 2026 04:00:37 -0500 Subject: [PATCH 2/3] fix(deps): keep qualification host source coherent --- tests/unit/test_qualification_host_source.py | 24 ++++++ tools/extension-qualification/Cargo.lock | 88 ++++---------------- tools/extension-qualification/Cargo.toml | 4 +- tools/extension-qualification/README.md | 2 +- tools/extension-qualification/src/main.rs | 2 +- 5 files changed, 45 insertions(+), 75 deletions(-) create mode 100644 tests/unit/test_qualification_host_source.py diff --git a/tests/unit/test_qualification_host_source.py b/tests/unit/test_qualification_host_source.py new file mode 100644 index 00000000..51ff8149 --- /dev/null +++ b/tests/unit/test_qualification_host_source.py @@ -0,0 +1,24 @@ +"""Qualification receipts must identify the host source actually built.""" + +from __future__ import annotations + +import re +import tomllib +from pathlib import Path + +ROOT = Path(__file__).resolve().parents[2] + + +def test_qualification_receipt_matches_one_host_dependency_revision() -> None: + """Prevent mixed host types and falsely attributed qualification reports.""" + tool = ROOT / "tools" / "extension-qualification" + dependencies = tomllib.loads((tool / "Cargo.toml").read_text())["dependencies"] + names = ("morphir-extension-sdk", "morphir-host", "morphir-host-native") + sources = {(dependencies[name]["git"], dependencies[name]["rev"]) for name in names} + assert len(sources) == 1, "Qualification host dependencies must share one source" + _, revision = sources.pop() + assert re.fullmatch(r"[0-9a-f]{40}", revision) + source = (tool / "src" / "main.rs").read_text() + declared = re.search(r'const HOST_SOURCE: &str = "([0-9a-f]{40})";', source) + assert declared is not None + assert declared.group(1) == revision, "Receipt source must match built dependencies" diff --git a/tools/extension-qualification/Cargo.lock b/tools/extension-qualification/Cargo.lock index 8a3ae2a9..b7a06771 100644 --- a/tools/extension-qualification/Cargo.lock +++ b/tools/extension-qualification/Cargo.lock @@ -2172,7 +2172,7 @@ dependencies = [ [[package]] name = "morphir-common" version = "0.2.0" -source = "git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104#d51daa8aea7ae09ae295ff254d72b27770c64104" +source = "git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05#945486e1320385e22986ef937db82e344b179d05" dependencies = [ "anyhow", "cap-fs-ext 4.0.3", @@ -2184,9 +2184,9 @@ dependencies = [ "indexmap", "ion-rs", "libc", - "morphir-config 0.0.1 (git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104)", + "morphir-config", "morphir-core", - "morphir-workspace 0.2.0 (git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104)", + "morphir-workspace", "nbformat", "reqwest", "rustix 1.1.4", @@ -2223,30 +2223,17 @@ dependencies = [ "toml 1.1.6+spec-1.1.0", ] -[[package]] -name = "morphir-config" -version = "0.0.1" -source = "git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104#d51daa8aea7ae09ae295ff254d72b27770c64104" -dependencies = [ - "secrecy", - "serde", - "serde-saphyr", - "serde_json", - "thiserror 2.0.21", - "toml 1.1.6+spec-1.1.0", -] - [[package]] name = "morphir-core" version = "0.2.0" -source = "git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104#d51daa8aea7ae09ae295ff254d72b27770c64104" +source = "git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05#945486e1320385e22986ef937db82e344b179d05" dependencies = [ "anyhow", "bigdecimal", "granit-parser", "indexmap", "lasso", - "morphir-json 0.2.0 (git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104)", + "morphir-json", "num-bigint 0.5.1", "schemars", "serde", @@ -2259,12 +2246,12 @@ dependencies = [ [[package]] name = "morphir-distribution" version = "0.2.0" -source = "git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104#d51daa8aea7ae09ae295ff254d72b27770c64104" +source = "git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05#945486e1320385e22986ef937db82e344b179d05" dependencies = [ "flate2", "fs2", "morphir-common", - "morphir-extension-sdk 0.4.0 (git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104)", + "morphir-extension-sdk", "semver", "serde", "serde_json", @@ -2288,27 +2275,8 @@ dependencies = [ "base64 0.22.1", "extism-pdk", "ion-rs", - "morphir-json 0.2.0 (git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05)", - "morphir-workspace 0.2.0 (git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05)", - "percent-encoding", - "semver", - "serde", - "serde_json", - "sha2 0.11.0", - "thiserror 2.0.21", - "url", -] - -[[package]] -name = "morphir-extension-sdk" -version = "0.4.0" -source = "git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104#d51daa8aea7ae09ae295ff254d72b27770c64104" -dependencies = [ - "base64 0.22.1", - "extism-pdk", - "ion-rs", - "morphir-json 0.2.0 (git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104)", - "morphir-workspace 0.2.0 (git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104)", + "morphir-json", + "morphir-workspace", "percent-encoding", "semver", "serde", @@ -2321,13 +2289,13 @@ dependencies = [ [[package]] name = "morphir-host" version = "0.2.0" -source = "git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104#d51daa8aea7ae09ae295ff254d72b27770c64104" +source = "git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05#945486e1320385e22986ef937db82e344b179d05" dependencies = [ "async-lock", "async-trait", "morphir-core", - "morphir-extension-sdk 0.4.0 (git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104)", - "morphir-workspace 0.2.0 (git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104)", + "morphir-extension-sdk", + "morphir-workspace", "semver", "serde", "serde_json", @@ -2337,7 +2305,7 @@ dependencies = [ [[package]] name = "morphir-host-native" version = "0.2.0" -source = "git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104#d51daa8aea7ae09ae295ff254d72b27770c64104" +source = "git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05#945486e1320385e22986ef937db82e344b179d05" dependencies = [ "async-trait", "base64 0.23.1", @@ -2345,9 +2313,9 @@ dependencies = [ "morphir-common", "morphir-core", "morphir-distribution", - "morphir-extension-sdk 0.4.0 (git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104)", + "morphir-extension-sdk", "morphir-host", - "morphir-workspace 0.2.0 (git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104)", + "morphir-workspace", "serde", "serde_json", "tempfile", @@ -2367,15 +2335,6 @@ dependencies = [ "serde_json", ] -[[package]] -name = "morphir-json" -version = "0.2.0" -source = "git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104#d51daa8aea7ae09ae295ff254d72b27770c64104" -dependencies = [ - "serde", - "serde_json", -] - [[package]] name = "morphir-python-host-qualification" version = "0.1.0" @@ -2383,7 +2342,7 @@ dependencies = [ "anyhow", "async-trait", "hex", - "morphir-extension-sdk 0.4.0 (git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05)", + "morphir-extension-sdk", "morphir-host", "morphir-host-native", "serde", @@ -2399,20 +2358,7 @@ version = "0.2.0" source = "git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05#945486e1320385e22986ef937db82e344b179d05" dependencies = [ "globset", - "morphir-config 0.0.1 (git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05)", - "semver", - "serde", - "serde_json", - "thiserror 2.0.21", -] - -[[package]] -name = "morphir-workspace" -version = "0.2.0" -source = "git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104#d51daa8aea7ae09ae295ff254d72b27770c64104" -dependencies = [ - "globset", - "morphir-config 0.0.1 (git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104)", + "morphir-config", "semver", "serde", "serde_json", diff --git a/tools/extension-qualification/Cargo.toml b/tools/extension-qualification/Cargo.toml index e44c7cb3..c537c958 100644 --- a/tools/extension-qualification/Cargo.toml +++ b/tools/extension-qualification/Cargo.toml @@ -14,8 +14,8 @@ anyhow = "1" async-trait = "0.1" hex = "0.4" morphir-extension-sdk = { git = "https://github.com/finos/morphir-rust.git", rev = "945486e1320385e22986ef937db82e344b179d05" } -morphir-host = { git = "https://github.com/finos/morphir-rust.git", rev = "d51daa8aea7ae09ae295ff254d72b27770c64104" } -morphir-host-native = { git = "https://github.com/finos/morphir-rust.git", rev = "d51daa8aea7ae09ae295ff254d72b27770c64104" } +morphir-host = { git = "https://github.com/finos/morphir-rust.git", rev = "945486e1320385e22986ef937db82e344b179d05" } +morphir-host-native = { git = "https://github.com/finos/morphir-rust.git", rev = "945486e1320385e22986ef937db82e344b179d05" } serde_json = { version = "1", features = ["arbitrary_precision"] } serde = { version = "1", features = ["derive"] } sha2 = "0.11" diff --git a/tools/extension-qualification/README.md b/tools/extension-qualification/README.md index 14eacd00..e7224b7f 100644 --- a/tools/extension-qualification/README.md +++ b/tools/extension-qualification/README.md @@ -2,7 +2,7 @@ This developer-only executable exercises the actual WASM and native process guest bytes through `morphir-host` and `morphir-host-native` at -`d51daa8aea7ae09ae295ff254d72b27770c64104`. It uses the upstream Extism and +`945486e1320385e22986ef937db82e344b179d05`. It uses the upstream Extism and process channels directly. Process launches have an empty environment and do not use Python or a Rust launcher. diff --git a/tools/extension-qualification/src/main.rs b/tools/extension-qualification/src/main.rs index 535097d9..08c43604 100644 --- a/tools/extension-qualification/src/main.rs +++ b/tools/extension-qualification/src/main.rs @@ -26,7 +26,7 @@ use std::{ }; use tokio::sync::Mutex; -const HOST_SOURCE: &str = "d51daa8aea7ae09ae295ff254d72b27770c64104"; +const HOST_SOURCE: &str = "945486e1320385e22986ef937db82e344b179d05"; const ID: &str = "morphir-python"; const TYPES_SOURCE: &str = "from dataclasses import dataclass\n@dataclass(frozen=True)\nclass Box:\n value: int\n"; From 760320dc130abf32f5f0afc38f5be6c91f3baf99 Mon Sep 17 00:00:00 2001 From: Damian Reeves <957246+DamianReeves@users.noreply.github.com> Date: Thu, 29 Oct 2026 04:07:36 -0500 Subject: [PATCH 3/3] chore(renovate): group qualification host sources --- renovate.json | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/renovate.json b/renovate.json index e09f2f8b..dc65586d 100644 --- a/renovate.json +++ b/renovate.json @@ -15,6 +15,20 @@ "ruff_text_size" ], "groupName": "Ruff components" + }, + { + "matchManagers": [ + "cargo" + ], + "matchFileNames": [ + "tools/extension-qualification/Cargo.toml" + ], + "matchPackageNames": [ + "morphir-extension-sdk", + "morphir-host", + "morphir-host-native" + ], + "groupName": "qualification host source" } ] }