# Minimal runtime deps for the Workweaver Nitro Enclave signing child.
# Every dep is a supply-chain surface — keep this list tight.
#
# Pinning policy:
#   - cryptography pinned to a major.minor for reproducible EIF measurements.
#   - cbor2 pinned for CBOR/COSE_Sign1 attestation document construction.
#   - py_ecc pinned for BLS12_381 (G2 ProofOfPossession profile) signing.
#   - coincurve pinned for BIP340 Schnorr signing.
#   - boto3 pinned for KMS Decrypt with attestation document recipient.
#   - No transitive deps with C extensions outside cryptography + coincurve.
#
# Refresh procedure (#4154 follow-up):
#   1. Bump versions here.
#   2. Re-run ops/enclave/build.sh.
#   3. Publish the regenerated PCR0..PCR8 values to the deployment-owned
#      expected_pcrs configuration consumed by NitroAttestationVerifier.
#   4. Land the dependency and deployment PCR refresh in lockstep when strict
#      attestation is enabled for the target environment.

# Core crypto primitives baked into the EIF
cryptography==48.0.1

# CBOR encoder used for COSE_Sign1 attestation envelope production +
# parent-side strict verification (also imported in the parent backend).
# Pinned to 6.1.1 to address CVE-2025-68131 + CVE-2026-26209.
cbor2==6.1.1

# BLS12_381 (G2 ProofOfPossession) signatures — issue #4216 sub-deliverable (c).
py_ecc==8.0.0

# BIP340 Schnorr signatures via libsecp256k1 — issue #4216 sub-deliverable (c).
# Installed from the committed cp314 manylinux_2_28_aarch64 wheel under
# vendor/wheels (mirroring biscuit-python). coincurve 21.0.0 publishes no
# upstream cp314 wheel and its sdist build fails on 3.14 (cffi 2.0 dropped the
# LICENSE file coincurve's hatch_build.py expects), so the EIF builder resolves
# coincurve from the vendored wheel via --find-links — never an sdist build
# (uv prefers the wheel). The enclave bakes coincurve into the EIF, so this dep is
# mandatory; the manylinux_2_28_aarch64 wheel matches the Graviton/aarch64 EIF.
#
# The platform marker mirrors apps/backend/requirements.runtime.txt: the EIF
# builds on linux/arm64 (ops/enclave/Dockerfile.enclave -> amazonlinux:2023
# aarch64) where the marker is true and coincurve installs from the vendored
# wheel, while pip-audit on a non-aarch64-Linux host skips it instead of
# attempting the un-buildable cp314 sdist — keeping this manifest auditable in
# the security-scan workflow without weakening coverage.
coincurve==21.0.0 ; platform_system == 'Linux' and platform_machine == 'aarch64'

# AWS KMS client used for in-enclave master key bootstrap — issue #4216
# sub-deliverable (a). Uses the KMS Decrypt + Recipient (attestation
# document) flow; never authenticated by an IAM role on the parent.
boto3==1.43.16
