Pratik Bhadane
288b1546b2
* feat: broaden CPU and platform coverage across PyPI, nodes, and crates.io Replace static SIMD with runtime CPU-feature dispatch and expand the release wheel matrix so one set of artifacts runs on any target CPU and platform without illegal-instruction crashes. Rust core: - Add multiversion runtime dispatch (crates/ferro_ta_core/src/simd.rs); drop compile-time `wide`. `simd` feature is now default-on and forwarded through the pyo3 crate, and stays compatible with #![forbid(unsafe_code)]. Packaging: - abi3-py310: one cp310-abi3 wheel per platform (covers CPython 3.10+). - CI matrix adds Linux aarch64 + musllinux (x86_64/aarch64) and Windows arm64. Node/Docker + docs: - api/Dockerfile: document baseline+dispatch (no target-cpu pin) and add a fail-fast import check; aarch64 containers now install cleanly. - Rewrite docs/guides/simd.md; fix stale `wide` mention in ADR 0003. - Add ADR 0006 (CPU coverage strategy). Also bundles in-flight release prep already staged in the tree (DTW exception types, SBOM/provenance security, supporting docs). * fix(ci): clear cargo-deny and pip-audit failures; apply dependency bumps cargo-deny (advisories): - Ignore pyo3 RUSTSEC-2026-0176 / RUSTSEC-2026-0177 in deny.toml with a documented rationale: ferro-ta uses neither affected code path (PyList/PyTuple nth iterators; PyCFunction::new_closure). Upstream fix needs pyo3 >=0.29 (large API migration), tracked as a follow-up. pip-audit: - Bump dev lockfile idna 3.18, pytest 9.1.1, urllib3 2.7.0 to clear PYSEC-2026-215, CVE-2025-71176, PYSEC-2026-141/142. Dependency bumps (supersede open dependabot PRs; they auto-close on merge): - cargo: log 0.4.32, serde_json 1.0.150, rayon 1.12.0 - api/requirements.txt: uvicorn>=0.49.0, pydantic>=2.13.4, ferro-ta>=1.1.4 - CI actions: deploy-pages v5, upload-pages-artifact v5, action-gh-release v3 The open `wide` 1.5.0 bump (PR #24) is obsolete — the crate is removed in this branch. * chore: address CodeRabbit review; remove docs/adr section CodeRabbit findings: - CI sbom job: add `attestations: write` so attest-build-provenance can run (it had only contents:write + id-token:write). - simd.rs: vectorize `wma_seed` with lane-local accumulators — it was scalar behind the multiversion wrapper, adding dispatch overhead for no SIMD gain. - CHANGELOG: consolidate the duplicate `### Changed` heading. - python/ferro_ta/__init__.py: also re-export the `FerroTaError` alias. - docs/guides/dtw.md: soften "byte-for-byte" parity to within-tolerance. Remove docs/adr/ at maintainer request and clean up the ADR links in the SIMD and DTW guides. The ADR files remain in commit 9506a30 if ever needed.
77 lines
2.6 KiB
TOML
77 lines
2.6 KiB
TOML
# cargo-deny configuration
|
||
# Run: cargo deny check
|
||
# CI: add `cargo install cargo-deny && cargo deny check` to the audit job
|
||
|
||
[graph]
|
||
# Targets to check — all platforms used in CI
|
||
targets = [
|
||
"x86_64-unknown-linux-gnu",
|
||
"x86_64-apple-darwin",
|
||
"aarch64-apple-darwin",
|
||
"x86_64-pc-windows-msvc",
|
||
"wasm32-unknown-unknown",
|
||
]
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Licenses
|
||
# ---------------------------------------------------------------------------
|
||
[licenses]
|
||
# Confidence threshold for detecting a license (0.0 – 1.0)
|
||
confidence-threshold = 0.8
|
||
|
||
# List of explicitly allowed SPDX license identifiers
|
||
allow = [
|
||
"MIT",
|
||
"Apache-2.0",
|
||
"Apache-2.0 WITH LLVM-exception",
|
||
"BSD-2-Clause",
|
||
"BSD-3-Clause",
|
||
"ISC",
|
||
"Unicode-DFS-2016",
|
||
"Unicode-3.0",
|
||
"Zlib",
|
||
"CC0-1.0",
|
||
]
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Bans — duplicate crates, banned crates
|
||
# ---------------------------------------------------------------------------
|
||
[bans]
|
||
# Deny multiple versions of the same crate (set to "warn" to downgrade)
|
||
multiple-versions = "warn"
|
||
# Deny wildcard dependencies
|
||
wildcards = "deny"
|
||
# Skip certain crates that intentionally have multiple versions
|
||
skip = []
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Advisories — security vulnerability database
|
||
# ---------------------------------------------------------------------------
|
||
[advisories]
|
||
# Path to local advisory database (leave empty to use the bundled one)
|
||
# db-path = "~/.cargo/advisory-db"
|
||
db-urls = ["https://github.com/rustsec/advisory-db"]
|
||
# Deny known security vulnerabilities
|
||
version = 2
|
||
ignore = [
|
||
# pyo3 0.25 advisories — fix is pyo3 >=0.29, which is a large API
|
||
# migration (IntoPy/ToPyObject were removed in 0.26). Ignored here
|
||
# because ferro-ta does NOT use either affected code path:
|
||
# * RUSTSEC-2026-0176 — OOB read in PyList/PyTuple nth/nth_back
|
||
# iterators: the crate has zero PyList/PyTuple iterator usage.
|
||
# * RUSTSEC-2026-0177 — missing Sync bound on
|
||
# PyCFunction::new_closure: the crate uses #[pyfunction], never
|
||
# new_closure.
|
||
# Tracked for removal once the pyo3 0.29 upgrade lands.
|
||
"RUSTSEC-2026-0176",
|
||
"RUSTSEC-2026-0177",
|
||
]
|
||
|
||
# ---------------------------------------------------------------------------
|
||
# Sources — only allow crates from crates.io and our own path deps
|
||
# ---------------------------------------------------------------------------
|
||
[sources]
|
||
unknown-registry = "deny"
|
||
unknown-git = "deny"
|
||
allow-registry = ["https://github.com/rust-lang/crates.io-index"]
|