pyproject.toml

# Copyright (C) 2024 Mandiant, Inc. All Rights Reserved.
# Licensed under the Apache License, Version 2.0 (the "License");
#  you may not use this file except in compliance with the License.
# You may obtain a copy of the License at: [package root]/LICENSE.txt
# Unless required by applicable law or agreed to in writing, software distributed under the License
#  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and limitations under the License.

[build-system]
requires = ["setuptools", "setuptools-scm"]
build-backend = "setuptools.build_meta"

[project]
name = "flare-floss"
description = "FLARE Obfuscated String Solver"
license = {file = "LICENSE.txt"}
authors = [
    {name = "Willi Ballenthin", email = "william.ballenthin@mandiant.com"},
    {name = "Moritz Raabe", email = "moritz.raabe@mandiant.com"},
]
requires-python=">=3.8"
keywords = ["floss", "malware", "analysis", "obfuscation", "strings", "FLARE"]
classifiers = [
    "Development Status :: 5 - Production/Stable",
    "Intended Audience :: Developers",
    "Intended Audience :: Information Technology",
    "License :: OSI Approved :: Apache Software License",
    "Natural Language :: English",
    "Programming Language :: Python :: 3",
    "Topic :: Security",
]

dependencies = [
    # ---------------------------------------
    # As a library, FLOSS uses lower version bounds
    # when specifying its dependencies. This lets
    # other programs that use FLOSS (and other libraries)
    # to find a compatible set of dependency versions.
    #
    # We can optionally pin to specific versions or
    # limit the upper bound when there's a good reason;
    # but the default is to assume all greater versions
    # probably work with FLOSS until proven otherwise.
    #
    # The following link provides good background:
    # https://iscinumpy.dev/post/bound-version-constraints/
    #
    # When we develop FLOSS, and when we distribute it as
    # a standalone binary, we'll use specific versions
    # that are pinned in requirements.txt.
    # But the requirements for a library are specified here
    # and are looser.
    #
    # Related discussions:
    # 
    #   - https://github.com/mandiant/capa/issues/2053
    #   - https://github.com/mandiant/capa/pull/2059
    #   - https://github.com/mandiant/capa/pull/2079
    #
    # ---------------------------------------
    # The following dependency versions were imported
    # during June 2024 by truncating specific versions to
    # their major-most version (major version when possible, 
    # or minor otherwise).
    # As specific constraints are identified, please provide
    # comments and context.
    "tabulate>=0.9",
    "pydantic>=2",
    "tqdm>=4",
    "halo>=0.0.31",
    "rich>=13",
    "pefile>=2022.5.30",
    "binary2strings>=0.1",

    # ---------------------------------------
    # Dependencies that we develop
    #
    # These dependencies are often actively influenced by capa,
    # so we provide a minimum patch version that includes the
    # latest bug fixes we need here.
    "viv-utils[flirt]>=0.7.9",
    "vivisect>=1.1.1",
    "dncil>=1.0.2",

    # ---------------------------------------
    # Dependencies with version caps
    #
    # These dependencies must not exceed the version cap,
    # typically due to dropping support for python releases
    # we still support.

    # TODO(williballenthin): networkx 3.2 doesn't support python 3.8 while capa does.
    # https://github.com/mandiant/capa/issues/1966
    "networkx>=3,<3.2",
]
dynamic = ["version", "readme"]

[tool.setuptools.dynamic]
version = {attr = "floss.version.__version__"}
readme = {file = "README.md", content-type = "text/markdown"}

[tool.setuptools]
packages = ["floss", "floss.sigs"]

[project.optional-dependencies]
# Dev and build dependencies are not relaxed because
# we want all developer environments to be consistent.
# These dependencies are not used in production environments
# and should not conflict with other libraries/tooling.
dev = [
    "pre-commit==3.5.0",
    "pyyaml==6.0.1",
    "pytest==8.2.2",
    "pytest-sugar==1.0.0",
    "pytest-instafail==0.5.0",
    "pytest-cov==5.0.0",
    "pycodestyle==2.11.1",
    "black==24.4.2",
    "isort==5.13.2",
    "mypy==1.10.0",
    # type stubs for mypy
    "types-PyYAML==6.0.10",
    "types-tabulate==0.9.0.20240106",
]
build = [
    "pyinstaller==6.8.0",
    "setuptools==70.0.0",
    "build==1.2.1"
]


[project.urls]
Homepage = "https://www.github.com/mandiant/flare-floss"
Repository = "https://www.github.com/mandiant/flare-floss.git"
Documentation = "https://github.com/mandiant/flare-floss/tree/master/doc"
Signatures = "https://github.com/mandiant/flare-floss/tree/master/floss/sigs"

[project.scripts]
floss = "floss.main:main"