flare-floss/pyproject.toml

# Copyright 2024 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Licensed under the Apache License, Version 2.0 (the "License");
#  you may not use this file except in compliance with the License.
# You may obtain a copy of the License at: [package root]/LICENSE.txt
# Unless required by applicable law or agreed to in writing, software distributed under the License
#  is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and limitations under the License.

[build-system]
requires = ["setuptools", "setuptools-scm"]
build-backend = "setuptools.build_meta"

[project]
name = "flare-floss"
description = "FLARE Obfuscated String Solver"
license = {file = "LICENSE.txt"}
authors = [
    {name = "Willi Ballenthin", email = "william.ballenthin@mandiant.com"},
    {name = "Moritz Raabe", email = "moritz.raabe@mandiant.com"},
]
requires-python=">=3.10"
keywords = ["floss", "malware", "analysis", "obfuscation", "strings", "FLARE"]
classifiers = [
    "Development Status :: 5 - Production/Stable",
    "Intended Audience :: Developers",
    "Intended Audience :: Information Technology",
    "License :: OSI Approved :: Apache Software License",
    "Natural Language :: English",
    "Programming Language :: Python :: 3",
    "Topic :: Security",
]

dependencies = [
    # ---------------------------------------
    # As a library, FLOSS uses lower version bounds
    # when specifying its dependencies. This lets
    # other programs that use FLOSS (and other libraries)
    # to find a compatible set of dependency versions.
    #
    # We can optionally pin to specific versions or
    # limit the upper bound when there's a good reason;
    # but the default is to assume all greater versions
    # probably work with FLOSS until proven otherwise.
    #
    # The following link provides good background:
    # https://iscinumpy.dev/post/bound-version-constraints/
    #
    # When we develop FLOSS, and when we distribute it as
    # a standalone binary, we'll use specific versions
    # that are pinned in requirements.txt.
    # But the requirements for a library are specified here
    # and are looser.
    #
    # Related discussions:
    # 
    #   - https://github.com/mandiant/capa/issues/2053
    #   - https://github.com/mandiant/capa/pull/2059
    #   - https://github.com/mandiant/capa/pull/2079
    #
    # ---------------------------------------
    # The following dependency versions were imported
    # during June 2024 by truncating specific versions to
    # their major-most version (major version when possible, 
    # or minor otherwise).
    # As specific constraints are identified, please provide
    # comments and context.
    "tabulate>=0.9",
    "pydantic>=2",
    "tqdm>=4",
    "halo>=0.0.31",
    "rich>=13",
    "shtab>=1.7",
    "pefile>=2022.5.30",
    "binary2strings>=0.1",
    "google-re2>=1",

    # ---------------------------------------
    # Dependencies that we develop
    #
    # These dependencies are often actively influenced by capa,
    # so we provide a minimum patch version that includes the
    # latest bug fixes we need here.
    "viv-utils[flirt]>=0.8.0",
    "vivisect>=1.1.1",
    "dncil>=1.0.2",

    # ---------------------------------------
    # Dependencies with version caps
    #
    # These dependencies must not exceed the version cap,
    # typically due to dropping support for python releases
    # we still support.

    "networkx>=3",
    # layout / tagging
    "dnfile==0.13.0",
    "colorama==0.4.6",
    "machofile==2026.2.4",
    "msgspec==0.21.1",
    "python-lancelot==0.10.0",
    "pyelftools==0.31",
]
dynamic = ["version", "readme"]

[tool.setuptools.dynamic]
version = {attr = "floss.version.__version__"}
readme = {file = "README.md", content-type = "text/markdown"}

[tool.pytest.ini_options]
# so tests can import scripts.tags.* (scripts is not an installed package)
pythonpath = ["."]

[tool.setuptools.packages.find]
include = ["floss*"]

[tool.setuptools.package-data]
"floss" = ["sigs/*", "tags/data/**/*"]

[project.optional-dependencies]
# Dev and build dependencies are not relaxed because
# we want all developer environments to be consistent.
# These dependencies are not used in production environments
# and should not conflict with other libraries/tooling.
dev = [
    "pre-commit==4.6.0",
    "pyyaml==6.0.1",
    "pytest==9.1.0",
    "pytest-sugar==1.1.1",
    "pytest-instafail==0.5.0",
    "pytest-cov==7.1.0",
    "pycodestyle==2.14.0",
    "black==26.5.1",
    "isort==8.0.1",
    "mypy==2.3.0",
    # type stubs for mypy
    "types-PyYAML==6.0.10",
    "types-tabulate==0.10.0.20260408",
]
build = [
    "pyinstaller==6.22.1",
    "setuptools==84.0.0",
    "build==1.5.0"
]


[project.urls]
Homepage = "https://www.github.com/mandiant/flare-floss"
Repository = "https://www.github.com/mandiant/flare-floss.git"
Documentation = "https://github.com/mandiant/flare-floss/tree/master/doc"
Signatures = "https://github.com/mandiant/flare-floss/tree/master/floss/sigs"

[project.scripts]
floss = "floss.main:main"