From c6f888217e1ed3a7635c7d32236e33e3d10508c3 Mon Sep 17 00:00:00 2001 From: Shane Engelman Date: Sat, 3 Oct 2026 04:31:55 -0700 Subject: [PATCH 1/2] docs: add AGENTS.md index and inherit org SECURITY.md A local SECURITY.md overrides the org default in blacklanternsecurity/.github, so this repo never saw the org policy. AGENTS.md gives agents the toolchain and test commands and links the org standards instead of restating them. CLAUDE.md points at it. Refs blacklanternsecurity/bbot-enterprise#157 --- AGENTS.md | 42 ++++++++++++++++++++++++++++++++++++++++++ CLAUDE.md | 1 + SECURITY.md | 16 ---------------- 3 files changed, 43 insertions(+), 16 deletions(-) create mode 100644 AGENTS.md create mode 100644 CLAUDE.md delete mode 100644 SECURITY.md diff --git a/AGENTS.md b/AGENTS.md new file mode 100644 index 0000000..9e7ab5b --- /dev/null +++ b/AGENTS.md @@ -0,0 +1,42 @@ +# AGENTS.md + +Offensive-first HTTP library in Rust with Python bindings via maturin. Built for BBOT. + +## Toolchain + +| Concern | This repository | +|---|---| +| Language | Rust, edition 2024. Python 3.10 through 3.14 bindings | +| Package manager | cargo, uv | +| Lint and format | clippy and rustfmt, pinned in rust-toolchain.toml. ruff for Python | +| Tests | cargo test, pytest for tests/python | + +## Setup + +```bash +uv sync --group dev && uv run maturin develop +``` + +## Tests + +```bash +cargo test +uv run pytest tests/python +``` + +## Standards + +Org-wide, in [blacklanternsecurity/.github/standards](https://github.com/blacklanternsecurity/.github/tree/main/standards). Read the one your task touches, not all of them. + +| Document | Read it when | +|---|---| +| [principles.md](https://github.com/blacklanternsecurity/.github/blob/main/standards/principles.md) | Always | +| [toolchain.md](https://github.com/blacklanternsecurity/.github/blob/main/standards/toolchain.md) | Touching dependencies, linting, formatting, or language versions | +| [git.md](https://github.com/blacklanternsecurity/.github/blob/main/standards/git.md) | Branching, commit messages, opening or reviewing a pull request | +| [rfc.md](https://github.com/blacklanternsecurity/.github/blob/main/standards/rfc.md) | A change needs agreement before work starts, or an RFC is ending | +| [testing.md](https://github.com/blacklanternsecurity/.github/blob/main/standards/testing.md) | Writing or changing tests, or anything that has them | +| [ci.md](https://github.com/blacklanternsecurity/.github/blob/main/standards/ci.md) | Touching a workflow, an action pin, or a permissions block | +| [releases.md](https://github.com/blacklanternsecurity/.github/blob/main/standards/releases.md) | Versioning, tagging, or publishing | +| [repository-setup.md](https://github.com/blacklanternsecurity/.github/blob/main/standards/repository-setup.md) | Creating a repository, or auditing one | + +Never restate a standard here. If this file and a standard disagree, the standard wins and this file is the bug. diff --git a/CLAUDE.md b/CLAUDE.md new file mode 100644 index 0000000..dc366f8 --- /dev/null +++ b/CLAUDE.md @@ -0,0 +1 @@ +See @AGENTS.md. diff --git a/SECURITY.md b/SECURITY.md deleted file mode 100644 index 06bcf12..0000000 --- a/SECURITY.md +++ /dev/null @@ -1,16 +0,0 @@ -# Security Policy - -## Supported Versions - -| Version | Supported | -| ------- | ------------------ | -| 0.9.x | :white_check_mark: | -| < 0.9 | :x: | - -## Reporting a Vulnerability - -Please report security vulnerabilities through [GitHub's private vulnerability reporting](https://github.com/blacklanternsecurity/blasthttp/security/advisories/new). - -Do not open a public issue for security vulnerabilities. - -You can expect an initial response within 72 hours. We will keep you updated on the fix timeline and coordinate disclosure with you before any public release. From e3503862872db54bb6f63320871d984a8f9cc905 Mon Sep 17 00:00:00 2001 From: Shane Engelman Date: Sat, 3 Oct 2026 07:40:36 -0700 Subject: [PATCH 2/2] docs(agents): document the setup that actually builds blasthttp `uv sync --group dev` errors here because pyproject.toml sets [tool.uv] managed = false, and maturin then finds no virtualenv. The build also needs the weak-cipher OpenSSL from scripts/build-openssl.sh that .cargo/config.toml points at. Document the venv, pip, and maturin flow CI uses. Toolchain rows reference the manifests instead of retyping the edition and Python range. --- AGENTS.md | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index 9e7ab5b..06f34a4 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -6,22 +6,27 @@ Offensive-first HTTP library in Rust with Python bindings via maturin. Built for | Concern | This repository | |---|---| -| Language | Rust, edition 2024. Python 3.10 through 3.14 bindings | -| Package manager | cargo, uv | -| Lint and format | clippy and rustfmt, pinned in rust-toolchain.toml. ruff for Python | -| Tests | cargo test, pytest for tests/python | +| Language | Rust, edition in Cargo.toml. Python bindings, `requires-python` in pyproject.toml | +| Package manager | cargo. Python side via pip and maturin, see Setup | +| Lint and format | clippy and rustfmt, channel in rust-toolchain.toml. ruff, version in the `dev` group of pyproject.toml | +| Tests | cargo test, pytest (`testpaths` in pyproject.toml) | ## Setup +uv does not manage this project (`[tool.uv] managed = false`), and openssl-sys links the weak-cipher OpenSSL that `.cargo/config.toml` points at. + ```bash -uv sync --group dev && uv run maturin develop +./scripts/build-openssl.sh +python -m venv .venv && . .venv/bin/activate +pip install --upgrade pip maturin && pip install --group dev +maturin develop ``` ## Tests ```bash cargo test -uv run pytest tests/python +pytest ``` ## Standards