pyproject.toml

# Host-side Python environment for the rpi5-iot-gw project.
#
# This file does NOT define a pip-installable package. Its purpose is
# to give `uv` a reproducible runtime + dev environment for the FIT
# signing tool and the host-side tool test suites (FIT signing under
# scripts/fit-signing/, sbom-cve report readers under scripts/sbom-cve/).
# The sbom-cve scripts are themselves stdlib-only; only their pytest suite
# uses this venv. Yocto/BitBake builds do not depend on uv or on this venv.
#
# Operator signing targets run through `uv run`; direct invocations of
# scripts/fit-signing/sign_fit.py re-exec under .venv when needed.
#
# Refresh the lockfile with `make tools-venv` (or `uv sync`). Bump deps
# via `uv lock --upgrade` then re-run `uv sync`.

[project]
name = "rpi5-iot-gw-host-tools"
version = "0.1.0"
description = "Host-side FIT signing tooling environment. Not pip-installable."
requires-python = ">=3.11"
dependencies = [
    "pyyaml>=6.0",
]

[dependency-groups]
dev = [
    "pytest>=7.0",
]

[tool.pytest.ini_options]
testpaths = ["scripts/fit-signing/tests", "scripts/sbom-cve/tests"]
addopts = ["-ra"]

[tool.uv]
# Keep the venv out of the source tree; uv default is `.venv` which
# .gitignore already excludes.
package = false