From 5a5c1faef73335dedbdcacf033bcaafd4051e1a1 Mon Sep 17 00:00:00 2001 From: Danil Silantyev Date: Sat, 15 Aug 2026 06:08:34 +0500 Subject: [PATCH] feat(qt): install the toolchain from a hash-locked closure qt-ci.yml ran `uvx --from 'aqtinstall@3.3.0' --with 'py7zr==1.0.0'`, which pinned two names and left everything they pull unbounded: aqtinstall declares bs4, defusedxml, humanize, patch-ng, semantic-version and texttable with no upper bound, plus requests>=2.31.0. Two runs of the same workflow SHA could install different code without this repository changing. That mattered here more than most places. Driving aqtinstall directly was itself a supply-chain decision, taken to escape an action whose nested graph could not be pinned; escaping one unpinned graph into another is not an improvement. requirements-qt.txt is the closure -- 28 packages, all hashed, installed with --require-hashes into an isolated environment. This is a reusable workflow, so its checkout is the caller's tree and the lock is not in it. The lock is fetched from the exact commit of the workflow file (job.workflow_sha is the runner's own answer to what is executing, which the caller cannot forge) and its digest is checked against a value published in that file before anything installs. Pinning the workflow pins the closure, and --require-hashes means a substituted lock still cannot introduce a package. catalog/tools.yml registers both tools and the lock digest. check_qt_toolchain_lock.py holds the digest, the versions and the presence of hashes together. The receipt records toolchain_lock_sha256 beside aqt_version, because `aqt 3.3.0` said nothing about the 26 packages underneath it. Re-proven by fixture run 31855694582 before the ledger was updated. --- .github/workflows/qt-ci.yml | 55 +- CHANGELOG.md | 30 + catalog/python-execution.yml | 7 +- catalog/runtime-coverage.yml | 4 +- catalog/tools.yml | 27 + requirements-qt.in | 12 + requirements-qt.txt | 818 ++++++++++++++++++++++++++ scripts/check_qt_toolchain_lock.py | 108 ++++ scripts/check_sdk_runtime_fixtures.py | 3 +- scripts/validate_all.py | 2 + 10 files changed, 1056 insertions(+), 10 deletions(-) create mode 100644 requirements-qt.in create mode 100644 requirements-qt.txt create mode 100644 scripts/check_qt_toolchain_lock.py diff --git a/.github/workflows/qt-ci.yml b/.github/workflows/qt-ci.yml index 13c4981..d2819b4 100644 --- a/.github/workflows/qt-ci.yml +++ b/.github/workflows/qt-ci.yml @@ -109,6 +109,44 @@ jobs: # The Qt install itself is cached separately and by key, below. enable-cache: false + # The toolchain is installed from a hash-locked closure, not resolved at + # run time. `uvx --from 'aqtinstall@3.3.0' --with 'py7zr==1.0.0'` pinned two + # names and left everything they pull unbounded -- aqtinstall declares + # bs4, defusedxml, humanize, patch-ng, semantic-version and texttable with + # no upper bound -- so two runs of the same workflow SHA could install + # different code without this repository changing. That mattered here more + # than most places: driving aqtinstall directly was itself a supply-chain + # decision, taken to escape an action whose nested graph could not be pinned. + # + # This is a reusable workflow, so the checkout above is the *caller's* tree + # and the lock is not in it. It is fetched from the exact commit of this + # workflow file -- `job.workflow_sha` is the runner's own answer to "what + # is executing", which the caller cannot forge -- and its digest is checked + # against the value recorded here before anything is installed. Pinning the + # workflow therefore pins the closure, and `--require-hashes` means even a + # substituted lock cannot introduce a package. + - name: Provision the locked Qt toolchain + id: toolchain + env: + CALLEE_REPOSITORY: ${{ job.workflow_repository }} + CALLEE_SHA: ${{ job.workflow_sha }} + LOCK_SHA256: 56499b7af8bbd983954cf15cf51ee97ff6915332d3716ed53a1102fa60449cd0 + PYTHON_VERSION: '3.13' + run: | + set -euo pipefail + lock="$RUNNER_TEMP/requirements-qt.txt" + curl --fail --silent --show-error --location --retry 3 \ + --output "$lock" \ + "https://raw.githubusercontent.com/$CALLEE_REPOSITORY/$CALLEE_SHA/requirements-qt.txt" + printf '%s %s\n' "$LOCK_SHA256" "$lock" | sha256sum --check --status || { + echo "::error::the fetched Qt toolchain lock does not match the digest this workflow was published with" + exit 1 + } + uv venv --python "$PYTHON_VERSION" "$RUNNER_TEMP/qt-tools" + uv pip install --python "$RUNNER_TEMP/qt-tools" --require-hashes -r "$lock" + printf 'bin=%s\n' "$RUNNER_TEMP/qt-tools/bin" >> "$GITHUB_OUTPUT" + printf 'lock_sha256=%s\n' "$LOCK_SHA256" >> "$GITHUB_OUTPUT" + - name: Resolve the Qt release id: release working-directory: ${{ github.workspace }} @@ -118,13 +156,14 @@ jobs: QT_MODULES: ${{ inputs.qt_modules }} QT_TARGET: ${{ inputs.qt_target }} QT_VERSION: ${{ inputs.qt_version }} + TOOLCHAIN_BIN: ${{ steps.toolchain.outputs.bin }} run: | set -euo pipefail # aqt and py7zr are pinned exactly. They are this workflow's own tool # versions, and `check_sdk_runtime_fixtures` compares the aqt identity # in the receipt against the fixture spec, so the two cannot drift # apart unnoticed. - aqt() { uvx --from 'aqtinstall@3.3.0' --with 'py7zr==1.0.0' aqt "$@"; } + aqt() { "$TOOLCHAIN_BIN/aqt" "$@"; } host="$QT_HOST" if [ -z "$host" ]; then @@ -202,6 +241,7 @@ jobs: QT_MODULES: ${{ inputs.qt_modules }} QT_TARGET: ${{ inputs.qt_target }} QT_VERSION: ${{ steps.release.outputs.version }} + TOOLCHAIN_BIN: ${{ steps.toolchain.outputs.bin }} run: | set -euo pipefail # `qt_modules` is documented as space-separated, so it is read into an @@ -211,7 +251,7 @@ jobs: read -r -a modules <<< "$QT_MODULES" modules=(-m "${modules[@]}") fi - uvx --from 'aqtinstall@3.3.0' --with 'py7zr==1.0.0' aqt install-qt \ + "$TOOLCHAIN_BIN/aqt" install-qt \ "$QT_HOST" "$QT_TARGET" "$QT_VERSION" "$QT_ARCH" \ "${modules[@]}" \ --outputdir "${RUNNER_TEMP}/qt" @@ -282,6 +322,7 @@ jobs: CALLEE_REPOSITORY: ${{ job.workflow_repository }} CALLEE_SHA: ${{ job.workflow_sha }} AQT_VERSION: ${{ steps.release.outputs.aqt_version }} + TOOLCHAIN_LOCK_SHA256: ${{ steps.toolchain.outputs.lock_sha256 }} CONFIGURE_COMMAND: ${{ inputs.configure_command }} QT_VERSION_INPUT: ${{ inputs.qt_version }} TEST_COMMAND: ${{ inputs.test_command }} @@ -318,10 +359,16 @@ jobs: sections = ["toolchain"] receipt["cache_key_prefix"] = "qt-ci-v1" receipt["qt_version_input"] = os.environ["QT_VERSION_INPUT"] - # Resolved in the install step: `aqt` is invoked through `uvx` and is - # not on PATH here, and it reports its identity on stderr. + # Resolved in the install step: `aqt` lives in the provisioned + # toolchain rather than on PATH here, and reports its identity on + # stderr. The lock digest goes in beside it, so the receipt records the + # whole executable closure rather than one package's version -- which + # was the gap: `aqt 3.3.0` said nothing about the twenty-six packages + # underneath it. if os.environ.get("AQT_VERSION"): receipt["aqt_version"] = os.environ["AQT_VERSION"] + if os.environ.get("TOOLCHAIN_LOCK_SHA256"): + receipt["toolchain_lock_sha256"] = os.environ["TOOLCHAIN_LOCK_SHA256"] cmake = tool(["cmake", "--version"]) if cmake is not None: receipt["cmake_version"] = cmake diff --git a/CHANGELOG.md b/CHANGELOG.md index 7c0d7ff..a7092c6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,36 @@ ## [Unreleased] +- Close the Qt toolchain's dependency graph. `qt-ci.yml` ran + `uvx --from 'aqtinstall@3.3.0' --with 'py7zr==1.0.0'`, which pinned two names + and left everything they pull unbounded: aqtinstall declares `bs4`, + `defusedxml`, `humanize`, `patch-ng`, `semantic-version` and `texttable` with no + upper bound, plus `requests>=2.31.0`. Two runs of the same workflow SHA could + install different code without this repository changing. That mattered here more + than most places, because driving aqtinstall directly was itself a supply-chain + decision — taken to escape an action whose nested graph could not be pinned. + Escaping one unpinned graph into another is not an improvement. + + `requirements-qt.txt` is the closure now: twenty-eight packages, all with + hashes, installed with `--require-hashes` into an isolated environment. + + `qt-ci.yml` is a reusable workflow, so the checkout it runs in belongs to the + caller and the lock is not there. It is fetched from the exact commit of the + workflow file — `job.workflow_sha` is the runner's own answer to what is + executing, which a caller cannot forge — and its digest is checked against a + value published in that file before anything installs. Pinning the workflow + therefore pins the closure, and `--require-hashes` means even a substituted lock + cannot introduce a package. + + `catalog/tools.yml` registers both tools and the lock digest; + `check_qt_toolchain_lock.py` holds the three statements together — the digest + the workflow publishes and the lock in the tree, the versions the lock pins and + the versions the catalog records, and that every requirement carries hashes at + all. The runtime receipt records `toolchain_lock_sha256` beside `aqt_version`, + because `aqt 3.3.0` said nothing about the twenty-six packages underneath it. + + Re-proven by a real fixture run before the ledger was updated. + - Make the consumer skill runnable, execute what `.gds` declares, and stop shipping a build log. diff --git a/catalog/python-execution.yml b/catalog/python-execution.yml index b6f94d5..a5f385d 100644 --- a/catalog/python-execution.yml +++ b/catalog/python-execution.yml @@ -2,7 +2,7 @@ "schema_version": 1, "python": { "major_minor": "3.13", - "subject_count": 62, + "subject_count": 63, "launcher": "scripts/check_python_execution_contract.py", "launcher_prefix": [".venv/bin/python", "-I", "-B", "scripts/check_python_execution_contract.py", "--launch"], "syntax_gate_prefix": [".venv/bin/python", "-I", "-B", "scripts/check_python_syntax.py"], @@ -127,7 +127,7 @@ "check_validation_tier_contract.py", "check_docs_links.py", "check_documented_commands.py", "check_flutter_pin.py", "check_gds_verification_commands.py", - "check_qt_pin.py", + "check_qt_pin.py", "check_qt_toolchain_lock.py", "check_examples.py", "check_gate_contract.py", "check_harden_runner_contract.py", "check_merge_group.py", "check_monorepo_routing.py", @@ -173,6 +173,7 @@ "check_flutter_pin.py": ["_strict_yaml"], "check_gds_verification_commands.py": ["_strict_yaml", "check_python_execution_contract"], "check_qt_pin.py": ["_strict_yaml"], + "check_qt_toolchain_lock.py": ["_strict_yaml", "_workflow_yaml"], "check_examples.py": ["_runners", "_workflow_yaml"], "check_gate_contract.py": ["_strict_yaml", "_workflow_yaml", "check_python_execution_contract"], "check_harden_runner_contract.py": ["_workflow_yaml"], @@ -213,7 +214,7 @@ "check_maintenance_report_contract", "check_validation_tier_contract", "check_docs_links", "check_documented_commands", "check_examples", - "check_flutter_pin", "check_qt_pin", + "check_flutter_pin", "check_qt_pin", "check_qt_toolchain_lock", "check_gate_contract", "check_gds_verification_commands", "check_harden_runner_contract", "check_merge_group", "check_monorepo_routing", "check_permissions", "check_pinned_actions", diff --git a/catalog/runtime-coverage.yml b/catalog/runtime-coverage.yml index 12c0e7f..ddfafe8 100644 --- a/catalog/runtime-coverage.yml +++ b/catalog/runtime-coverage.yml @@ -254,8 +254,8 @@ entries: criticality: supporting status: runtime-proven evidence: "Fixture caller ran the default configure/build/test lanes against tests/fixtures/qt on ubuntu-latest and the observer accepted the receipt: four sections (build, configure, test, toolchain), one CTest test, Qt 6.8.3 resolved and installed, and aqtinstall(aqt) v3.3.0. Qt is installed by a pinned aqtinstall invoked directly, so the workflow reaches no action it does not pin and starts where full-SHA pinning is enforced; check_transitive_action_pins reports the tree clean. The version resolves to exactly one published release and the architecture to exactly one published architecture, both refusing to guess, and the install root is located by its own qmake rather than derived from the architecture name. Linux only: only ubuntu-latest has been run." - last_run: https://github.com/NDDev-it-com/ci-workflows/actions/runs/31853477977 - proven_digest: 1b3fc160002e1960e567599a71ebd2cca677bf54c7abe0359f86a02e74ac1f0c + last_run: https://github.com/NDDev-it-com/ci-workflows/actions/runs/31855694582 + proven_digest: 86abe2691551ed32d11364856e553460b7dbfd487082951aaa2878ca2da79bfd waiver: null - workflow: .github/workflows/r-ci.yml criticality: supporting diff --git a/catalog/tools.yml b/catalog/tools.yml index ed019d5..d965c85 100644 --- a/catalog/tools.yml +++ b/catalog/tools.yml @@ -4,6 +4,33 @@ # Last verified: 2026-08-13 tools: + - id: aqtinstall + name: aqtinstall + homepage: https://github.com/miurahr/aqtinstall + kind: cli + current_version: "3.3.0" + pin: "3.3.0" + used_by: + - .github/workflows/qt-ci.yml + last_verified: "2026-08-15" + notes: >- + Installed from requirements-qt.txt, a hash-locked closure of 28 packages, + rather than resolved at run time. Pinning the two top-level names left + everything they pull unbounded. + lock: requirements-qt.txt + lock_sha256: "56499b7af8bbd983954cf15cf51ee97ff6915332d3716ed53a1102fa60449cd0" + - id: py7zr + name: py7zr + homepage: https://github.com/miurahr/py7zr + kind: cli + current_version: "1.0.0" + pin: "1.0.0" + used_by: + - .github/workflows/qt-ci.yml + last_verified: "2026-08-15" + notes: aqtinstall's archive backend; locked in the same closure. + lock: requirements-qt.txt + lock_sha256: "56499b7af8bbd983954cf15cf51ee97ff6915332d3716ed53a1102fa60449cd0" - id: actionlint name: actionlint homepage: "https://github.com/rhysd/actionlint" diff --git a/requirements-qt.in b/requirements-qt.in new file mode 100644 index 0000000..54eda27 --- /dev/null +++ b/requirements-qt.in @@ -0,0 +1,12 @@ +# The Qt toolchain `qt-ci.yml` executes. +# +# `uvx --from 'aqtinstall@3.3.0' --with 'py7zr==1.0.0'` pinned two names and left +# everything they pull unbounded: aqtinstall declares bs4, defusedxml, humanize, +# patch-ng, semantic-version and texttable with no upper bound, plus +# requests>=2.31.0. Two runs of the same workflow SHA could install different +# code without this repository changing. Compile with: +# +# uv pip compile --generate-hashes --universal --python-version 3.13 \ +# -o requirements-qt.txt requirements-qt.in +aqtinstall==3.3.0 +py7zr==1.0.0 diff --git a/requirements-qt.txt b/requirements-qt.txt new file mode 100644 index 0000000..e20527d --- /dev/null +++ b/requirements-qt.txt @@ -0,0 +1,818 @@ +# GENERATED by `uv pip compile --generate-hashes --universal --python-version 3.13 -o requirements-qt.txt requirements-qt.in` +# Do not hand-edit. See requirements-qt.in for why this file exists. +# This file was autogenerated by uv via the following command: +# uv pip compile --generate-hashes --universal --python-version 3.13 -o /tmp/qt-tools.txt /tmp/qt-tools.in +aqtinstall==3.3.0 \ + --hash=sha256:9c7d85fbe7258be2d7d23fda33f8aff2e8b7536817255eaeaaf4226da8546a31 \ + --hash=sha256:e88dbd87226f276fdd5d05347a44578d390d93a7f176e9476fbda0a7c9635f69 + # via -r /tmp/qt-tools.in +backports-zstd==1.6.0 ; python_full_version < '3.14' \ + --hash=sha256:0308990ffc998df3c7ed35276bde049728b5c3956203cae40d80893576a41459 \ + --hash=sha256:03b7c59c71f7a597e2bcb3f8368371e9a660a1bdf1c37afc1f1ad1496a013c19 \ + --hash=sha256:0466b14723f3b7697669c00ee66fe16e30e25636b286b0a923fa86fa3d8a753c \ + --hash=sha256:068ef3d8c18815a2e3a752f766313e19910e7c50939b956923748d9c04ebcb1b \ + --hash=sha256:08793876172551a930ce4d65c712cd516184d1a97070d4a1193e05bf0cf7040d \ + --hash=sha256:0eb4281f402b94d397b7482f6d9efd04c28274e4ed6eb57eb1f87bdd091a6a87 \ + --hash=sha256:10b61850c4112952e05aa6e6cce8c9a5936fbeadb321e154216705cc76a14afa \ + --hash=sha256:15b1aae0f64cd742df4bba1d989d0a09a6ec619202543fdba684640454541fd3 \ + --hash=sha256:17efb3d11137de5166dd51eedab9c36ad633402acba386eee8d715213ea47e49 \ + --hash=sha256:1a99710fbb225d459d66def4dc2bb2cd4a9a0bdc8b799fc0621cfdd863be9c93 \ + --hash=sha256:1d146926e997d2d3de8212bdcbf4985344a2622ca3bec458d8908000a84fd883 \ + --hash=sha256:1e20b3ecd0a711be82e964aca28554eabbc31ee69a20e5e7b8fd42268af46212 \ + --hash=sha256:23a793f2fed4dbf0517319759a2cded0b0dd8e8d3797fe30badd5693e320c175 \ + --hash=sha256:25b5ddc789480072551af571a746e9500356b2aff0499861cf2ca07ea7431e68 \ + --hash=sha256:28eef3881164f3c23ce58ed59e4684103bdd279583eb2d299858c9e9b72fde9a \ + --hash=sha256:28fecd73459d74910ae1987ab84b7bef690d3dd860948430dd5555108b006daf \ + --hash=sha256:2914abea516704bdafb2090acd3f15b5f9debecfabd15b8dd8285b2ad3b92209 \ + --hash=sha256:2ace939e4d620e119423606f2d3d7115f8707733bf57f279ad9a9383f875986f \ + --hash=sha256:2ba9ac10fc393e5123a08802e0e895a107cb4a66b9973d2844dbd8a343111e59 \ + --hash=sha256:2ddab55a5f54dec8acfad68ef70f1c704fd21919990ddc238afbd6f496e61c6a \ + --hash=sha256:2f723219335387d7546412d8141e0303590600949b4184a1391a0c6a3c756058 \ + --hash=sha256:30576f49b82328ec8af16c11100efe52ca88526f71bbe100ef6b4e707dc13bf2 \ + --hash=sha256:32f04d54ec1fdf3aa648b24a10b1c9234ed2046cc4af7a8850cbc236c05d42f3 \ + --hash=sha256:3b6713371f8987a1178df93cb36f29eef191f224021e2d656b2f11ce60d26816 \ + --hash=sha256:3e689af303df287142770abe3a48bbefd24dab4a09da5807d0e1fa8c75bab026 \ + --hash=sha256:460fd6b3f338c659507ae36cfd6b58ac9942a2ff233c5cf574416dfec0451a84 \ + --hash=sha256:481a1e9bd8f419fdc625307aa20234687f99368c75df511ef589693c5fea4c6f \ + --hash=sha256:4b6c8b02ab0ccb2431bb7bc238be91d158b308915e7b07937388e540466fe7e7 \ + --hash=sha256:4c68a9ed2df0cca51d774c521e68a34d2e3d9ebfc687ef8096adfd4f345b551d \ + --hash=sha256:5918fc6b31437208721276964323933cd86077b8d5b469c59c1b3fd2c8220a05 \ + --hash=sha256:5e9a8370c8ed873083d5de956d6b2e60adbad31e52d7a11111c96ef01d1910ae \ + --hash=sha256:6430b34a2ae6fcc604672f4f913102563473d9a015bdca1ce8c95041cc1f2677 \ + --hash=sha256:64b94d7a836568926a3309ff510c7f8261b881b341fd4992cabf4f0998878f8a \ + --hash=sha256:65048ed08c5124f05ff9f355ab9703014bb2dbe7f8d9948ce193685b1775f442 \ + --hash=sha256:66cf8038893c7708ec345ffb3ac63c775d10f430f323ac2f0334fdb6a397c57c \ + --hash=sha256:6c73ae37dbf9207727ac095dedef864c05d836eaec962a47b3b64eaadaf1c6b6 \ + --hash=sha256:711e6b98f8924e8b4a61ff97ab6321f33de024e1ed6a32f5123763aeda8459be \ + --hash=sha256:7293fefe15f0e5852bdb4ad1e0e26f3cbd4d3e61c19f751ecc4ff34bc1eb237d \ + --hash=sha256:73000459db113a658c4fb0510100ef0e79137b5828bf957b7709aacae4eb1b87 \ + --hash=sha256:75578c71644b031118ce938855a53530708db7f4af6e83e2f8840d5a1de990f8 \ + --hash=sha256:7741e44f7938ec94f9a52678c8d19b7bc548522ffdc39c9e4481af8db545fa9a \ + --hash=sha256:79284c1dd702f4f24ed1a36e51555c907dd237b6c0d829595978f4089a2aeea9 \ + --hash=sha256:7c2b1f4a640c51130caa92cef5bf72bd3c3dbbcfbf814c37403aa0601b1811b0 \ + --hash=sha256:7d3f64c503af7b60115b97c16feaf75bd191ef2c978d5c0c7725a6682bef63c5 \ + --hash=sha256:80a7859ffe70bf239d7a2ce15293bdeb5b4280ff7dc326ffab312b0e254dbb24 \ + --hash=sha256:8219d6fceae6b39535c4ac323dba0923d10f781d59962ff3504e693fdcafa92c \ + --hash=sha256:83391ef5935cc0f329b1abca414ae20ffe40d335fc21a4b5e664f08a74317d5f \ + --hash=sha256:83415af3c64550a56cc20b4cce59bbaa81f21d28466d7adf98feff011ecbc66d \ + --hash=sha256:839faf90a7eb525a401978dc925df8c44bd12526e8ba1529b9f8a7106e729637 \ + --hash=sha256:84f92e5a60a78c72ccda79d0417d311a1f6da18f446423ed411726d545bf7b56 \ + --hash=sha256:8872a0e9f1af975966b5be6af7eebd3dc4046f15e470b719316516dc3d137cd6 \ + --hash=sha256:8c298785e2fadeab82342040f2d9ce764ce500e6da6a6d99a2de514e63580b5a \ + --hash=sha256:97e8a9674652496c7612b528085dd5a296c052a2edc466ca1bfb7b0b27820413 \ + --hash=sha256:994167ff6551b9c1ce226e0aab16295b98c94507b5701aa60d2c32b7d50796b1 \ + --hash=sha256:9cb75e33131946fabd6319061df3b8b1d588fe0963183280e9b5f49f7772fc09 \ + --hash=sha256:a13cfa3410a75e4cb87abdb669aaf79da861cb79299159054ff8f77b9671bc40 \ + --hash=sha256:a3c17e6a267d13de9cbf14bf2ebfa87e03d26692456fc67d2dbed9da4f479b18 \ + --hash=sha256:a4ae7ed5a6d813450cc2d818284ea3db9721edcef50a56aae42ea06feec38c6e \ + --hash=sha256:a838296f5b84c920172fb579cac894d255c1fc25457c7234613ddcfa385e49b7 \ + --hash=sha256:ab70eace272d6f122b121c057e436709b50a28abf30d97aab28433c08f4a4095 \ + --hash=sha256:ae106fe16e36efc60ab098d02478d30aa0e31e1420eb4ecf0116459253bc6361 \ + --hash=sha256:aeef8563b82ed4af328f98e5041c1b4800d86f68f857ffd1577d4d47dc9aa6cd \ + --hash=sha256:b067b1ef9c8e41fb0882c828aa37829938b5c0dab067eca72b23fc24c563b9da \ + --hash=sha256:b0ddbcd2866b8ff1a2836e4b0e4d44788f5b992d83fac75a38cda8f9a2bee079 \ + --hash=sha256:b4bddfcfb6679215d6f4dc5f79a1f9301af339480d70527a14b57a1f2e6b6cbf \ + --hash=sha256:b7bc9a0b66097f03820a54316d2fdd0beb38859cf98f10d63e94c55450ed8920 \ + --hash=sha256:b81b4cf3d6e0ad7ac92bef248f49fafc954262c5fb0f7e19d6aac497e5a856b2 \ + --hash=sha256:b951113113ed4b8d173418a4f155c14b739dace626b3fa3f82be1831958d39e4 \ + --hash=sha256:beb43e9885202c8d4f3762319ed4d5e98e197622afbff8439fbbdd81d08938b9 \ + --hash=sha256:c14fa5dc39a804f1b92d63506f450eca5c59647a18d197d1a564b89dac1be1ce \ + --hash=sha256:c2d1ccfe088e8279d605011a3575619a74526c261be357695b3258c0f636115a \ + --hash=sha256:c4fc41b2df5529cad5ceb230319e82728096d4b353ce8d4df68a2ec37e291bb8 \ + --hash=sha256:d6b9b06323e3ba947c0003b2d70e02f33c90c36bc6262a92eb8201afc4a1aa08 \ + --hash=sha256:d6e78d5e28f812b39f92397806ecddd4a6f3bf35531a8c039a1f187abc931af8 \ + --hash=sha256:dd085eafa2aac6f883afd28210a3231f717f25409a1e44a39bb7b04c8c5b5646 \ + --hash=sha256:df27b57d214a3124fbe4e933ef5a903d4567f154260d9aece8c797a987f2a205 \ + --hash=sha256:e39258a09b1c7ca70b5e94a5c5ccfe4700b4250b8077cfeab31d0f79565d4c9b \ + --hash=sha256:e514c71ca72f3b56bd8fbda1a6a5b7d1100a2764b42a3c74a38841f25f9b00ab \ + --hash=sha256:e73a550dbeb84e8fa50f8385f7735e9a4735b465851ef617d02f80ab10e44e7e \ + --hash=sha256:e80bceebc9b58e959bede9b26cafe15b5b9526f3533a6dd06330c5da73cb9329 \ + --hash=sha256:ece8e7288db5b827ef8c64b2f78519f1a173a8991a625978fce02eccd7654fe9 \ + --hash=sha256:ef132cfb638e9a86bd5dc07fb4e1cb895bc55bce6bb5e759366e8b160d0747e2 \ + --hash=sha256:f69365ee2b836939137de024a302395a1cb8654fb6dc5ffef6381105259c8f87 \ + --hash=sha256:f8f5c1c7c69a4b00889e52d9304a918a5b49010f9645768eb5fd0ad404f790ba \ + --hash=sha256:fa305a84087e10d7a85e8a8a3dcba8cdbda4868f2180173b264b7b488fd37c55 \ + --hash=sha256:fbb746522ebfc11155f1cd688e2c48ef3d74125e38b63eabdaab068a055c3e88 + # via pyzstd +beautifulsoup4==4.15.0 \ + --hash=sha256:288e3ca7d54b06f2ac191970bc275c1939cb46d450b255bf6718b04aa37ab4f7 \ + --hash=sha256:d6f88de62e1d4e38ecb1077eb9724cd0eff29d2a08ca16a401e9b9e93f117cf9 + # via bs4 +brotli==1.2.0 ; platform_python_implementation == 'CPython' \ + --hash=sha256:022426c9e99fd65d9475dce5c195526f04bb8be8907607e27e747893f6ee3e24 \ + --hash=sha256:072e7624b1fc4d601036ab3f4f27942ef772887e876beff0301d261210bca97f \ + --hash=sha256:09ac247501d1909e9ee47d309be760c89c990defbb2e0240845c892ea5ff0de4 \ + --hash=sha256:0bbd5b5ccd157ae7913750476d48099aaf507a79841c0d04a9db4415b14842de \ + --hash=sha256:0cf8c3b8ba93d496b2fae778039e2f5ecc7cff99df84df337ca31d8f2252896c \ + --hash=sha256:14ef29fc5f310d34fc7696426071067462c9292ed98b5ff5a27ac70a200e5470 \ + --hash=sha256:15b33fe93cedc4caaff8a0bd1eb7e3dab1c61bb22a0bf5bdfdfd97cd7da79744 \ + --hash=sha256:1b1d6a4efedd53671c793be6dd760fcf2107da3a52331ad9ea429edf0902f27a \ + --hash=sha256:1b557b29782a643420e08d75aea889462a4a8796e9a6cf5621ab05a3f7da8ef2 \ + --hash=sha256:1b71754d5b6eda54d16fbbed7fce2d8bc6c052a1b91a35c320247946ee103502 \ + --hash=sha256:1ce223652fd4ed3eb2b7f78fbea31c52314baecfac68db44037bb4167062a937 \ + --hash=sha256:1e68cdf321ad05797ee41d1d09169e09d40fdf51a725bb148bff892ce04583d7 \ + --hash=sha256:260d3692396e1895c5034f204f0db022c056f9e2ac841593a4cf9426e2a3faca \ + --hash=sha256:26e8d3ecb0ee458a9804f47f21b74845cc823fd1bb19f02272be70774f56e2a6 \ + --hash=sha256:2881416badd2a88a7a14d981c103a52a23a276a553a8aacc1346c2ff47c8dc17 \ + --hash=sha256:29b7e6716ee4ea0c59e3b241f682204105f7da084d6254ec61886508efeb43bc \ + --hash=sha256:2a7f1d03727130fc875448b65b127a9ec5d06d19d0148e7554384229706f9d1b \ + --hash=sha256:2d39b54b968f4b49b5e845758e202b1035f948b0561ff5e6385e855c96625971 \ + --hash=sha256:2e1ad3fda65ae0d93fec742a128d72e145c9c7a99ee2fcd667785d99eb25a7fe \ + --hash=sha256:3173e1e57cebb6d1de186e46b5680afbd82fd4301d7b2465beebe83ed317066d \ + --hash=sha256:3219bd9e69868e57183316ee19c84e03e8f8b5a1d1f2667e1aa8c2f91cb061ac \ + --hash=sha256:350c8348f0e76fff0a0fd6c26755d2653863279d086d3aa2c290a6a7251135dd \ + --hash=sha256:35d382625778834a7f3061b15423919aa03e4f5da34ac8e02c074e4b75ab4f84 \ + --hash=sha256:3b90b767916ac44e93a8e28ce6adf8d551e43affb512f2377c732d486ac6514e \ + --hash=sha256:3e1b35d56856f3ed326b140d3c6d9db91740f22e14b06e840fe4bb1923439a18 \ + --hash=sha256:3ebe801e0f4e56d17cd386ca6600573e3706ce1845376307f5d2cbd32149b69a \ + --hash=sha256:3f3c908bcc404c90c77d5a073e55271a0a498f4e0756e48127c35d91cf155947 \ + --hash=sha256:40d918bce2b427a0c4ba189df7a006ac0c7277c180aee4617d99e9ccaaf59e6a \ + --hash=sha256:465a0d012b3d3e4f1d6146ea019b5c11e3e87f03d1676da1cc3833462e672fb0 \ + --hash=sha256:4735a10f738cb5516905a121f32b24ce196ab82cfc1e4ba2e3ad1b371085fd46 \ + --hash=sha256:4ecdb3b6dc36e6d6e14d3a1bdc6c1057c8cbf80db04031d566eb6080ce283a48 \ + --hash=sha256:50b1b799f45da91292ffaa21a473ab3a3054fa78560e8ff67082a185274431c8 \ + --hash=sha256:54a50a9dad16b32136b2241ddea9e4df159b41247b2ce6aac0b3276a66a8f1e5 \ + --hash=sha256:5732eff8973dd995549a18ecbd8acd692ac611c5c0bb3f59fa3541ae27b33be3 \ + --hash=sha256:598e88c736f63a0efec8363f9eb34e5b5536b7b6b1821e401afcb501d881f59a \ + --hash=sha256:640fe199048f24c474ec6f3eae67c48d286de12911110437a36a87d7c89573a6 \ + --hash=sha256:66c02c187ad250513c2f4fce973ef402d22f80e0adce734ee4e4efd657b6cb64 \ + --hash=sha256:67a91c5187e1eec76a61625c77a6c8c785650f5b576ca732bd33ef58b0dff49c \ + --hash=sha256:6be67c19e0b0c56365c6a76e393b932fb0e78b3b56b711d180dd7013cb1fd984 \ + --hash=sha256:6c12dad5cd04530323e723787ff762bac749a7b256a5bece32b2243dd5c27b21 \ + --hash=sha256:71a66c1c9be66595d628467401d5976158c97888c2c9379c034e1e2312c5b4f5 \ + --hash=sha256:7274942e69b17f9cef76691bcf38f2b2d4c8a5f5dba6ec10958363dcb3308a0a \ + --hash=sha256:7547369c4392b47d30a3467fe8c3330b4f2e0f7730e45e3103d7d636678a808b \ + --hash=sha256:7a47ce5c2288702e09dc22a44d0ee6152f2c7eda97b3c8482d826a1f3cfc7da7 \ + --hash=sha256:7a61c06b334bd99bc5ae84f1eeb36bfe01400264b3c352f968c6e30a10f9d08b \ + --hash=sha256:7ad8cec81f34edf44a1c6a7edf28e7b7806dfb8886e371d95dcf789ccd4e4982 \ + --hash=sha256:7e9053f5fb4e0dfab89243079b3e217f2aea4085e4d58c5c06115fc34823707f \ + --hash=sha256:7fa18d65a213abcfbb2f6cafbb4c58863a8bd6f2103d65203c520ac117d1944b \ + --hash=sha256:81da1b229b1889f25adadc929aeb9dbc4e922bd18561b65b08dd9343cfccca84 \ + --hash=sha256:82676c2781ecf0ab23833796062786db04648b7aae8be139f6b8065e5e7b1518 \ + --hash=sha256:832c115a020e463c2f67664560449a7bea26b0c1fdd690352addad6d0a08714d \ + --hash=sha256:844a8ceb8483fefafc412f85c14f2aae2fb69567bf2a0de53cdb88b73e7c43ae \ + --hash=sha256:865cedc7c7c303df5fad14a57bc5db1d4f4f9b2b4d0a7523ddd206f00c121a16 \ + --hash=sha256:88ef7d55b7bcf3331572634c3fd0ed327d237ceb9be6066810d39020a3ebac7a \ + --hash=sha256:898be2be399c221d2671d29eed26b6b2713a02c2119168ed914e7d00ceadb56f \ + --hash=sha256:8d4f47f284bdd28629481c97b5f29ad67544fa258d9091a6ed1fda47c7347cd1 \ + --hash=sha256:92edab1e2fd6cd5ca605f57d4545b6599ced5dea0fd90b2bcdf8b247a12bd190 \ + --hash=sha256:9322b9f8656782414b37e6af884146869d46ab85158201d82bab9abbcb971dc7 \ + --hash=sha256:95db242754c21a88a79e01504912e537808504465974ebb92931cfca2510469e \ + --hash=sha256:963a08f3bebd8b75ac57661045402da15991468a621f014be54e50f53a58d19e \ + --hash=sha256:96fbe82a58cdb2f872fa5d87dedc8477a12993626c446de794ea025bbda625ea \ + --hash=sha256:99cfa69813d79492f0e5d52a20fd18395bc82e671d5d40bd5a91d13e75e468e8 \ + --hash=sha256:9c79f57faa25d97900bfb119480806d783fba83cd09ee0b33c17623935b05fa3 \ + --hash=sha256:9e5825ba2c9998375530504578fd4d5d1059d09621a02065d1b6bfc41a8e05ab \ + --hash=sha256:9fe11467c42c133f38d42289d0861b6b4f9da31e8087ca2c0d7ebb4543625526 \ + --hash=sha256:a1778532b978d2536e79c05dac2d8cd857f6c55cd0c95ace5b03740824e0e2f1 \ + --hash=sha256:a387225a67f619bf16bd504c37655930f910eb03675730fc2ad69d3d8b5e7e92 \ + --hash=sha256:a56ef534b66a749759ebd091c19c03ef81eb8cd96f0d1d16b59127eaf1b97a12 \ + --hash=sha256:aa47441fa3026543513139cb8926a92a8e305ee9c71a6209ef7a97d91640ea03 \ + --hash=sha256:ac27a70bda257ae3f380ec8310b0a06680236bea547756c277b5dfe55a2452a8 \ + --hash=sha256:acec55bb7c90f1dfc476126f9711a8e81c9af7fb617409a9ee2953115343f08d \ + --hash=sha256:adedc4a67e15327dfdd04884873c6d5a01d3e3b6f61406f99b1ed4865a2f6d28 \ + --hash=sha256:af43b8711a8264bb4e7d6d9a6d004c3a2019c04c01127a868709ec29962b6036 \ + --hash=sha256:b232029d100d393ae3c603c8ffd7e3fe6f798c5e28ddca5feabb8e8fdb732997 \ + --hash=sha256:b35c13ce241abdd44cb8ca70683f20c0c079728a36a996297adb5334adfc1c44 \ + --hash=sha256:b63daa43d82f0cdabf98dee215b375b4058cce72871fd07934f179885aad16e8 \ + --hash=sha256:b908d1a7b28bc72dfb743be0d4d3f8931f8309f810af66c906ae6cd4127c93cb \ + --hash=sha256:ba76177fd318ab7b3b9bf6522be5e84c2ae798754b6cc028665490f6e66b5533 \ + --hash=sha256:bba6e7e6cfe1e6cb6eb0b7c2736a6059461de1fa2c0ad26cf845de6c078d16c8 \ + --hash=sha256:c0d6770111d1879881432f81c369de5cde6e9467be7c682a983747ec800544e2 \ + --hash=sha256:c16ab1ef7bb55651f5836e8e62db1f711d55b82ea08c3b8083ff037157171a69 \ + --hash=sha256:c1702888c9f3383cc2f09eb3e88b8babf5965a54afb79649458ec7c3c7a63e96 \ + --hash=sha256:c25332657dee6052ca470626f18349fc1fe8855a56218e19bd7a8c6ad4952c49 \ + --hash=sha256:c8565e3cdc1808b1a34714b553b262c5de5fbda202285782173ec137fd13709f \ + --hash=sha256:cf9cba6f5b78a2071ec6fb1e7bd39acf35071d90a81231d67e92d637776a6a63 \ + --hash=sha256:d206a36b4140fbb5373bf1eb73fb9de589bb06afd0d22376de23c5e91d0ab35f \ + --hash=sha256:d2d085ded05278d1c7f65560aae97b3160aeb2ea2c0b3e26204856beccb60888 \ + --hash=sha256:d8c05b1dfb61af28ef37624385b0029df902ca896a639881f594060b30ffc9a7 \ + --hash=sha256:e310f77e41941c13340a95976fe66a8a95b01e783d430eeaf7a2f87e0a57dd0a \ + --hash=sha256:e7c0af964e0b4e3412a0ebf341ea26ec767fa0b4cf81abb5e897c9338b5ad6a3 \ + --hash=sha256:e80a28f2b150774844c8b454dd288be90d76ba6109670fe33d7ff54d96eb5cb8 \ + --hash=sha256:e813da3d2d865e9793ef681d3a6b66fa4b7c19244a45b817d0cceda67e615990 \ + --hash=sha256:e85190da223337a6b7431d92c799fca3e2982abd44e7b8dec69938dcc81c8e9e \ + --hash=sha256:e99befa0b48f3cd293dafeacdd0d191804d105d279e0b387a32054c1180f3161 \ + --hash=sha256:eda5a6d042c698e28bda2507a89b16555b9aa954ef1d750e1c20473481aff675 \ + --hash=sha256:ef87b8ab2704da227e83a246356a2b179ef826f550f794b2c52cddb4efbd0196 \ + --hash=sha256:f16dace5e4d3596eaeb8af334b4d2c820d34b8278da633ce4a00020b2eac981c \ + --hash=sha256:f8d635cafbbb0c61327f942df2e3f474dde1cff16c3cd0580564774eaba1ee13 \ + --hash=sha256:fc1530af5c3c275b8524f2e24841cbe2599d74462455e9bae5109e9ff42e9361 \ + --hash=sha256:ff09cd8c5eec3b9d02d2408db41be150d8891c5566addce57513bf546e3d6c6d + # via py7zr +brotlicffi==1.2.0.1 ; platform_python_implementation == 'PyPy' \ + --hash=sha256:2c85e65913cf2b79c57a3fdd05b98d9731d9255dc0cb696b09376cc091b9cddd \ + --hash=sha256:37cb587d32bf7168e2218c455e22e409ad1f3157c6c71945879a311f3e6b6abf \ + --hash=sha256:3c9544f83cb715d95d7eab3af4adbbef8b2093ad6382288a83b3a25feb1a57ec \ + --hash=sha256:535f2d05d0273408abc13fc0eebb467afac17b0ad85090c8913690d40207dac5 \ + --hash=sha256:625f8115d32ae9c0740d01ea51518437c3fbaa3e78d41cb18459f6f7ac326000 \ + --hash=sha256:6f3314a3476f59e5443f9f72a6dff16edc0c3463c9b318feaef04ae3e4683f5a \ + --hash=sha256:82ea52e2b5d3145b6c406ebd3efb0d55db718b7ad996bd70c62cec0439de1187 \ + --hash=sha256:91ba5f0ccc040f6ff8f7efaf839f797723d03ed46acb8ae9408f99ffd2572cf4 \ + --hash=sha256:9d6ba65dd528892b4d9960beba2ae011a753620bcfc66cf6fa3cee18d7b0baa4 \ + --hash=sha256:be9a670c6811af30a4bd42d7116dc5895d3b41beaa8ed8a89050447a0181f5ce \ + --hash=sha256:c20d5c596278307ad06414a6d95a892377ea274a5c6b790c2548c009385d621c \ + --hash=sha256:ce17eb798ca59ecec67a9bb3fd7a4304e120d1cd02953ce522d959b9a84d58ac \ + --hash=sha256:da2e82a08e7778b8bc539d27ca03cdd684113e81394bfaaad8d0dfc6a17ddede \ + --hash=sha256:e015af99584c6db1490a69a210c765953e473e63adc2d891ac3062a737c9e851 \ + --hash=sha256:f2a5575653b0672638ba039b82fda56854934d7a6a24d4b8b5033f73ab43cbc1 + # via py7zr +bs4==0.0.2 \ + --hash=sha256:a48685c58f50fe127722417bae83fe6badf500d54b55f7e39ffe43b798653925 \ + --hash=sha256:abf8742c0805ef7f662dce4b51cca104cffe52b835238afc169142ab9b3fbccc + # via aqtinstall +certifi==2026.7.22 \ + --hash=sha256:62f22742b58a1a33014a2b6b706588a8d7e2a88ae7bd1a6ebe8c992928483775 \ + --hash=sha256:741e2c3b351ddf169a738da9f2c048608ff7f2c5cc02f1ebc6b118bb090d5d55 + # via requests +cffi==2.1.1 ; platform_python_implementation == 'PyPy' \ + --hash=sha256:046bfc24911b37851ee1b51aab8bffe713d89c68c6a057b09484ce9fd5f69b4e \ + --hash=sha256:06c72bb76605a4b0cd0aad6930b69d4baf7dd5d806cfc409b824191099700e66 \ + --hash=sha256:0beceaabe56af686895136a2de78db54ecd8e4046b236b8fd6d6cb61389e9bf2 \ + --hash=sha256:154852545011f779917b11c78db2358d095da62a9a172b78ad0a583ee5adc0d0 \ + --hash=sha256:194cffa889098ced9976c3fc6340305e43f6303657d298da55366907c05c22d6 \ + --hash=sha256:19ee6127ee34de7d83ce3d371ebc5ed91addbdcc39f9ab15ce4eb35a4e534971 \ + --hash=sha256:1a18a57b58cfb21fc28d72e876acf10eaed67a1ed96226f92af4df681d571c4c \ + --hash=sha256:1aa5645c30469b09530c4ebca77ebf8f17618293c58f8549cb1a543a50236e7d \ + --hash=sha256:1dea0e4d7d4f11f619fe8c1d76caf49e24405b4b5743c0e3be16a500ecd930c9 \ + --hash=sha256:208f941bb9d18e768138677f0a6d2ce01f590df56043dda1df1535ac57c88517 \ + --hash=sha256:210019b6c7cf07f081b4c54635c8cf744377001350e29cc0f81c4377b4797735 \ + --hash=sha256:246fa40ce8645a614ff682e0b70f37134e460eaf93a775e0cbe3cca585a67a80 \ + --hash=sha256:25792eac27877609e7bb06d42ff88278a6624fff2ba9bbb523c09616b117e80f \ + --hash=sha256:27350daa11d4f10c540e6e89dada4c54feb7256ad03e9a4dc075ebad7ba360d1 \ + --hash=sha256:28907ab9bfb6aa13184cfc17c6b8e1023c5ab6fd7076d8c20a35e59fe04f8f29 \ + --hash=sha256:2ae64be792b8966f2c69538199728b290e34726562896df1e5dc8ffd8d8188e8 \ + --hash=sha256:31348097ff5bbe827ccc41795d4dd099d9f0625e7def00ee653c137a490c2a6c \ + --hash=sha256:3143d81e29e1e20a9ce10901ec369012947876596f75a222235965f2b7ae832e \ + --hash=sha256:3222ba5d678f80a030e6afbcc33dc1ae5cb45facabb61cee2c7016b8432fde48 \ + --hash=sha256:3311ed60d36f83378794e1009ac6258bafbf81f7888b4caa7b35a521e3f95813 \ + --hash=sha256:334644fbac4eff73d985a17a91226df55d0f394160c4cfb880e084c8f7161cac \ + --hash=sha256:34e261f78cb6ceaaa36f42f2613f4380d94d9c759a9c73c769ee6e0247364632 \ + --hash=sha256:363e05fa78e15116c3c32c210ee36884fd6b9afa6d440e47112c3bd511d64cb6 \ + --hash=sha256:398aff33cee2767e3e781d2554c54bd0dff386bb437581e0d8011fde1a942ec1 \ + --hash=sha256:3d22a20b1fb1632cc72c22f95f7b0d2961c3e1c235f245ba4c606c4771035659 \ + --hash=sha256:42a494cee34437f05546455144f2b5d9ac09b1face62bcfce597d2e521066688 \ + --hash=sha256:42e2f76b9455f5a9a844f770bf3e200ed3da0e15f5df3db9c31fe80b04b3d004 \ + --hash=sha256:42f6930c31dc7f50732c9ae793c2786c7b6b044195967bbdde40bb9be81c4cc0 \ + --hash=sha256:456a61fa52d579ebf9df2e9552ead5129855dbaff6c1e5a9b1bc408809bdc062 \ + --hash=sha256:471cee653ae88de62096552e6d24ccb4a5adb8c8c9f10b5054d0122c15bf2779 \ + --hash=sha256:49cbc70e6542d4ccccb936558d1064a8012541e78f821f955cff24e357776c94 \ + --hash=sha256:4a7c934f7360e8cd64fe9efadcbd10c7c6364f531e432b9a4bf5ccbc9e0e8b50 \ + --hash=sha256:4be96343e422f2dfcd12ab5c9f5aebe03f82f737c6bffeca6830b3875cb44aab \ + --hash=sha256:4f42141fc14250de6dde5ee7ea4432be017252d91f19c5ad043c084cea629cac \ + --hash=sha256:507a24c282e0f42f8ed737cf048572cbf580468da5555764a8331735e9c736b6 \ + --hash=sha256:51b31d1c98274844cfd7838ce00bfc27c7423a4dc00fc0772fc3331c2cc90676 \ + --hash=sha256:58acb8ab8e295e6c5ea12f888cbb13cf21511ef2a3303a23f4325c29d17fe5c1 \ + --hash=sha256:5a59cc1c4442bc3d5c703bf720b51138d0bfc173618807c9ee2490a7541dd3d9 \ + --hash=sha256:5bb4e7ea95dcd6a014a6fef62e62467d67d8e582326443f3d68e71d6320a9fcf \ + --hash=sha256:5c58fe613dc5e5336357eff555824a314d8e43282600435c8d1cb6a7a2fedd13 \ + --hash=sha256:5e7cecbaadb83884793e05828cee59b210b24583b9c7425d0ba6a754fe22eb4e \ + --hash=sha256:616f097f2fe415bc92a247f02e11f634e1f9e9a83d327e3c915c15089c87869e \ + --hash=sha256:63bbfd5ded17c4840ac07cd8f1c21ba9d9708141f840b324f422f41b207e3973 \ + --hash=sha256:64faea20f4e2613363a1a9b9c7dd73058f3ecd00133a511e72ad7c511658f527 \ + --hash=sha256:661c298b4821edebead0c91edd2b00374d67ad7c5a1f7a91d4442633b79d6a72 \ + --hash=sha256:68e62fe11f30d5ca8289242866f0a5291402d8529ca2178ab8afc5c9694ae890 \ + --hash=sha256:6a8dddef476fab96d066d578fc88526767b836ab5ab21754e1d5bf3879c31c7c \ + --hash=sha256:6e192623c49c94421616a5778fba35cf0d5a8d000650c1967ef4448ee5cdd990 \ + --hash=sha256:7225e4514edb64eb6740324353e0da0711954fd8d7da4576755b1c6e09b697cd \ + --hash=sha256:75f80557d1389eddbd0de2681f6a390a0c5338c31ddaa821381c203fc3fd50d9 \ + --hash=sha256:770de9db11e84213beec501cfcaa013b019820ca881e03344dea5844f7876d94 \ + --hash=sha256:7750c6449dff7864bb9bb27ddfb0267756189201a3afc911d82b3caacd70dfc3 \ + --hash=sha256:7bde5e4cc5c10140859842b9d383af292b22639a4dffb725314baf45968cef80 \ + --hash=sha256:7ce713ace7c0e4520535b42b77eaa742c16dab813978064913e5a3cf82973b41 \ + --hash=sha256:7da0c5eff80f0197f3b3d1232ec5a682a9325f4ae9016a78f5f5ca35f9ced1f5 \ + --hash=sha256:7dbb61fe3a7699468030f71bbe5f8a0e326a151daa91beb11a6fc1f980c55e1c \ + --hash=sha256:811bd1e21d32de12efca32393a0ab3f5133b54fce9bd44b8bd77ab07da14bf6a \ + --hash=sha256:8ef53b2de9bcb9197d31854256575d59dbac0cba72ac627bb291ef5eceb74be4 \ + --hash=sha256:937c0052c05a31ca1daf18de3158eed4dbfcb9cc107adbea227728d647be701e \ + --hash=sha256:9d2055050ea716bd38b7f7f1579c275386646b4894c155a3e2f3cd62ed41b7c6 \ + --hash=sha256:9f8d177621de5cb38ee3e731eda45d421db093ec0739f46a5594babda7987a98 \ + --hash=sha256:a2d7755bef5a12ed488f4ef1f1b69ee9191d7396083b755a5d2295f6edb4768b \ + --hash=sha256:a48d62ab9d6f4f98c983223a547af44be6ca3691074c31cecced6facd3ba2dc1 \ + --hash=sha256:a4f00aa42f75d6e4595e8866e748cc1705adc0cddfeb2ca86d0d03993d63ba03 \ + --hash=sha256:a6e721d4b0e45d5b65e87534470e67b18dcd092c83f68fba09f152b9cbc061af \ + --hash=sha256:a730a083190634c65cca36ba5f489531576ebd79bcd5c8e172130f6453127231 \ + --hash=sha256:a931079504ecc49efed7744c476a5c343a92fabf66dec2db95edb1b2fdc770e2 \ + --hash=sha256:aa9511c62d14da7aacc9b4bf51f3f697a621e83b2d6919008243c3aad168eea3 \ + --hash=sha256:ab36d55f9ed2d067327667c2fea18dda018eb628dd6347aa01dda6cf1f5d3836 \ + --hash=sha256:ad2c86c495b899d862ea0f4b42891b8713a3bd45dd4105c7fd51c2a72f39f3a5 \ + --hash=sha256:aeae0e330c9f6acd681f647d46cefd30c29f93e3392882e792e82080c9691399 \ + --hash=sha256:b0431303acaea1089ad4b3e9ce4e6518193def1118d4073ca848635ee4ea2e96 \ + --hash=sha256:b5bdfd1c873d4e093aabc0ca84c4ca6dbc4f752afb5c86f146d9742580c9da2e \ + --hash=sha256:baed1e86cc735622097354b9d1281406caf42ff42a886d29faa8e8d1630333be \ + --hash=sha256:c1453022f490d2459a11819d83ad1d586e9ff65a12ac3e705ffebd46d3685dcf \ + --hash=sha256:c26608d2222fb1e94487e4a387d85f13eb55d5ed725cb25a0c589ac4ee60e7bc \ + --hash=sha256:c7659f22557c5a0bc4855cd635f55edec690cc008a40768527762cb9fb263455 \ + --hash=sha256:c8c69575568085ba0b1b10c0249d779a214aea6f6522e949a0fc9fb0fcb449d0 \ + --hash=sha256:c8d2c9fd1f2d16f780d15127abb050d13d1a76c03a4bd87d7e4980e45e511e12 \ + --hash=sha256:ca82be1a1d406ecfe1d25dc16cb33488e5a16bf4438c9fb590484ea29d92478b \ + --hash=sha256:cc572dace3f60ef98d7b12ff411d20f5362feb31a0439eab0085bbfd349982d7 \ + --hash=sha256:d18e5ac0f2f03f4f518d3e23db0f0cad7faa1da8620e9c09461d443bbf6e6692 \ + --hash=sha256:d28630f5854ab07ab1fd4aba756de52326c82e6be15d414b12793f1975048b54 \ + --hash=sha256:d9c275eaacd24aa73f94ffd6de08fc3f932424d8b6c376f4bed7cde376fe7bc3 \ + --hash=sha256:da0e573f9f97159390c89d9f1a9e41908b66d408cc5b58d08cf3847d844c531b \ + --hash=sha256:dd31f52ea1086513bb9df30f8fcee9b8918323ae067a3d5b78bc826a000712be \ + --hash=sha256:dddad92b554513a31f272570678ba307fb9f618f05e3d4a5eacafff9eae03e1d \ + --hash=sha256:df423d40ee8654634421812bc3b196da3f9bd7d32929da813f8394c4348a5358 \ + --hash=sha256:df913725b79db7bcf03448f36b7bf8815363417d5b58deecf9305e3e30f0f21a \ + --hash=sha256:e0bcb7e0f677f543555d2adff3bf19c05f66cdb4796e5ff602442ab2fe3c4ef7 \ + --hash=sha256:e2d65b31f36619cda3999b78b2aa9632e76b78448e7a56fc4240824200e7c4fc \ + --hash=sha256:e6e8cff14d6fb0be70a09c0bdc58096f501952d04624ebf867e0e56da2df8960 \ + --hash=sha256:f16c709686a78c727bbbf059f92b0bf41c6fc60deec706d2dc19f529175a6125 \ + --hash=sha256:f24fb43132a4c6b4cb4eb029492919b2db645be6808d738f244fd146c03c32cb \ + --hash=sha256:f53e442b08449d42821fa4a4fba000095af9f62742a500f978a9f557ec44339a \ + --hash=sha256:f5cfbc5fe74540d335175b656c725d74d90e3730c626d92575eea35029d9afaa \ + --hash=sha256:f81b3b8f3d4e343550fa4baa0e479bba9f2d29ce9c2e9b51d1ce1718d7442fcf \ + --hash=sha256:f8ec5e643a9a937f64e1999eb9f75d072263751912dc5cd06d3c85f8f44be7c3 \ + --hash=sha256:fb92203a88b3d3053034db775110081c49d28be6551923805e039924093761e4 \ + --hash=sha256:fcd22650c908d7b7da162bbfaab594a1227a15d1643a98c68b122ac642fa2264 + # via brotlicffi +charset-normalizer==3.5.0 \ + --hash=sha256:054420b5db984971d886e5e4e2c37c760ae6682aedbd066687ff0949d9ed5f08 \ + --hash=sha256:06f4fb62a9139bef056b8b2da6773c94c2f259f90e4b8e53b166f3d0372d7cf6 \ + --hash=sha256:076cf9d3f3c7e410295c09d96355cf3b1bcae74990034d80e4371e20fe1ba4c6 \ + --hash=sha256:07f6f42b5a6325df35b458004fb5f9f29bf502d89287a33c7cdef3590e31de0f \ + --hash=sha256:0b2e44e6d42d1a4ff78ccc219a93c5449105d10b16198d1aea581080df8073f9 \ + --hash=sha256:0b373bab0b867b68b8eb249da9478cab9181a42993437cd2f5dba5fb0b4fbd1b \ + --hash=sha256:0c8953d9d1617794cfc40d81179571c9ba3805dd029623a15c93f1fb70e60a74 \ + --hash=sha256:0cce46dd29d73e135e8087b96eb62a4aca6d69391b7f97808c6588ebed3178f3 \ + --hash=sha256:0dfe83c1b4d00abbf433998117a14f56a5c2bc68226c0d331709eed0d1ce539b \ + --hash=sha256:0f211c21aa316cb6e2662e54a1194633a79d98a50a876addacfce7ba5b34b09f \ + --hash=sha256:0f76dc0a47f94cb9b69d86f01e477f4b0371ca70208b9ccea7e063c41eed9046 \ + --hash=sha256:125ee619611019471b177c70bc3e9d4cda9fad7e01d93523501d3b188df0193a \ + --hash=sha256:1328cc57dd4372be1265f68232cee890e087416e3e6e93e6ffb32c2bad4d36a4 \ + --hash=sha256:143792a43e06dc3b27fc891948406e251502dc19ff9216cd80182b79131be5c5 \ + --hash=sha256:14f6904a3cf870abf044df3a8c4924ac6c8ef77e9896586fd37e73ae96cff2af \ + --hash=sha256:168a0cb536b5123a77bc42ecf5e0bf6f923d0d9ae43c42a14eb0677c19ac6c19 \ + --hash=sha256:17a0fd0e23961c2c017372e37aabc7ca8fceb9e10ad898977dfb40ad3927baae \ + --hash=sha256:17db18db9a1374d5b9d9a3252f980b4243b0b4efd1df03fac78bb587f6ce98cd \ + --hash=sha256:196e270c4e80827b5072eed7d6aa661d133afada94fe366669f9609e718d305e \ + --hash=sha256:19e52bda45086df8a4be4bb5910af6f5d9d3b538c78712c8ae09ef10b85bf458 \ + --hash=sha256:1a573e1e428f93908e79e04b349717f400e720f2f82285f0aaaf3ee0ff7f4c79 \ + --hash=sha256:1c010dd86d3f4c4433c9634d33ce8147393b270dfa54f217f965540b8ae8e075 \ + --hash=sha256:1cdfed4d7a59333c8220c67dd3be4e7a6c887b67453a64394022dcc919570add \ + --hash=sha256:1d366548d2ee28a8cfdcc4296363978cc644a728333be9824d2de4652e83df0a \ + --hash=sha256:1f56ce84b317ef2a59d7d3461891c7597c79247d2192bb8114c68a1a1debfcc0 \ + --hash=sha256:1f99a8c3a1da5d955edbad18208b3d627bdd54c48a6e739fa877bdca98c686d6 \ + --hash=sha256:2080aa129a28267984cdc902898993d788c995c384e285d0d19199f56760d52e \ + --hash=sha256:22a1889f1c9b752c63c36758a0c2145458e3cadb20fced7a0790002e9dd12b26 \ + --hash=sha256:2401f7671242e921e604f609d429f6b282ea4ca787a6ffd22ed7372011ddb9d1 \ + --hash=sha256:2403b489c103e9a18c835863fc6dd54361355c8291d4cafdb37492b683440b9b \ + --hash=sha256:2df26d4134948616be0ece05d0b24d621d3990f37147b5883c52052b613ef1f5 \ + --hash=sha256:301bfc4877c4f4f62b344235ecc58d06c901683801636eef819f88769c315ba2 \ + --hash=sha256:30ae26a1adcd943690dcbbc47f28be762bae9e08ad7442b78c86b1c0dd5a626c \ + --hash=sha256:3288a560dc3114d5d2ebe309b1ef43f8af355eafe25856832415c2a8196c9db3 \ + --hash=sha256:32e6d56dd825205f81e5c45bcebb4df6a11fb2bbf4969a01ef156d6ced90c224 \ + --hash=sha256:3418edd0ecb72a0a3861cf72f31be0ad9b7fe338ce2b58fb5cc80b9aeb792700 \ + --hash=sha256:3587d94b5c9f05c2dc4c3f3d47aba6375ff141a21adae3051d8d4d53e8a937c0 \ + --hash=sha256:3684ebbdffd51329ac44245d1d227d90b965797aa1a8abd026568a1f6ae88811 \ + --hash=sha256:368eb2fc9482158b3a3386e8f01fa61f479c968e9a19ceab8f0188b86b312991 \ + --hash=sha256:38a395079f229a631dece74e24c69c1f612536dd51f345a7d6a98abe2d3e047a \ + --hash=sha256:3b08ebf9488c7ff5eff038e48e6ea938178dfd9dcc8598b5ca941e4ae27b20be \ + --hash=sha256:3bfbe543d957213fc9a3db4979a8e171b7aa7504c1d737029defdb03a6095a38 \ + --hash=sha256:3cfdab178a4add5483e26a9bb1c16d8018ccf39b4be7a3aea6c3979e6828f2ee \ + --hash=sha256:3d00e18e7bbf47e332ab63903d18bae31efc701b1d8cca0382b97784a621fc44 \ + --hash=sha256:401ea6e7af9e7852ed818f64714b579c1935482049670847ca3bd7ba45dc63fb \ + --hash=sha256:420b19411959eec115063229536788e6b32d0a7fa907d6b940317919120d702d \ + --hash=sha256:4253da1b4456b633651a8d59eb1dc7a8a8fa38241014dd7c217b353e547ae394 \ + --hash=sha256:4346a693c08b1d0cfc0e3325bfb0ecd4322fb1a6904d68cf416f8da5e981b234 \ + --hash=sha256:478650a70a750d75d5add401606c77f77069c32e4ba2c9131dc6cee566962ca0 \ + --hash=sha256:48920bf6fe83eb2226756ac623fa54940487154eb18f80889d5735cf234965c0 \ + --hash=sha256:49bd5feb59b0bf3cbf6ebcf4352e371c95b9da9bacd4449f8b64d0ad2c10a26e \ + --hash=sha256:4c440122e1ea68b1f8b44a631ebf49c39180f6869b1da22d76e8a724208ec6e9 \ + --hash=sha256:4ebebb410bc517e1d284c52a123e82704b21e4e7e26a21ebecf7439d0647b8a3 \ + --hash=sha256:527e28a5e751d9e11369b9c5f9ab35c748eb9c109101920c7deb40d6eadf8d03 \ + --hash=sha256:54c963ce6404e52255b737e8a06d356fc762d59096ae566203a67cf2b7d050f2 \ + --hash=sha256:562d24ca7797c1af8852994950c2e623a907b201fc4b0ed29e92af173d3828ca \ + --hash=sha256:5780a29823e1d2bec69b7a104ead4195a43f3e97782efaedbf1f79a0157af715 \ + --hash=sha256:58ca5dc0a0ef99f2801ec0574214c978e9574055bc783830bbb6e7433218609f \ + --hash=sha256:5a4ee37248dfac25107c758bda99d545ce73e60b44d2dd39e4a2bb9f2831e9f5 \ + --hash=sha256:5a54587f93f2e289f8faf25b35c997d4cc75cf677485ac6f50c985715989f99c \ + --hash=sha256:5b81980668800dd1c69faad8aea6e85a8cee0e13bcd3bba7671695ff16260293 \ + --hash=sha256:5c23fa4f6eccdd601949cb00f3988c01d64e671d8faba356397971077022e144 \ + --hash=sha256:5e68229977b2dea28e7061c0c0630a23f2f9f6e9c6fb38d77d3d6dbfe3768b74 \ + --hash=sha256:5f51a19dc52197a20218b05ec5336d0c6b3b09935f838724722032c8d45dc91a \ + --hash=sha256:606a86c1c3196f3738de39a67a7490bbd61cb31c0e0436070bd0c6a48170b38e \ + --hash=sha256:6083d10a846218502d664375b9448508d9fa580bd834567423156c6abfbe899d \ + --hash=sha256:608553f476fca509537e804c4a71f5eb166ce63b75141f89c2c686ce1aa36956 \ + --hash=sha256:63ea0cc840c66670183578c2630d138c0e944aeadfc33f25173ee240f5db780d \ + --hash=sha256:6753de11eef42f1c321b26d682957d92c7f7bbce6530f34bbe0f9291dd37cc6f \ + --hash=sha256:68b7e84ae8239a94f8d2c8f3f3a3a81bcde54805ec8f42a34de927d155688ec6 \ + --hash=sha256:69d647cf158eb6bc9c99503292abed1f2079a2de5859f06a403f8aee6417475d \ + --hash=sha256:6abb1f356fb865baeb6ebc3fadd843e9a96fbf49b9adcca55037f3cceccb7438 \ + --hash=sha256:6c06875a1d4a7537bef70f659b55c6b55b9a47ec3ba8f2db610350c2d9915e6e \ + --hash=sha256:6c57af4084c10cb3286688d65e4c654190ff5edcbc2411d08cdca0a8a44c59a1 \ + --hash=sha256:6c95450fce59f00c6d08eff6572ec2e736e5054c9450253afd5748f8416f2eb9 \ + --hash=sha256:6da562a20a49673fe365b05750e98d03bb2c5f8b8d03562b014c1abb3df739f1 \ + --hash=sha256:6e44bc2780516b3df986d6fe33103c7080cd9dcd5576fe3cb4b0f64309c8f22b \ + --hash=sha256:70ff1c16eb0eb5ee6bb12739292347f981a5ba764cc4df1bc2e69b0405d4ac3b \ + --hash=sha256:72982d9958a42f8132bf2d6b90214ed66477295ef1188731f98ae3511c6eeb5a \ + --hash=sha256:74892fe9f33d204860e782e0a2030bb39f9f0af1e7a24f7d5a5b632df311f655 \ + --hash=sha256:75e243abbb528c1a774390ed71e3f868a9f37b1373442e4bbadd401cfc505ff4 \ + --hash=sha256:7cdded069549b5eae3d5d9bb6c2e5bb4fe83f9b81863e2a193cd747bf197aebb \ + --hash=sha256:7faa47b56070b3dd6f4898ed28528843ab130d53266cb9948d9b1f3bb1a5c5e8 \ + --hash=sha256:7ffc43fe52618fcd7abc6ee0b46aea527db10da73305fcc6aaf9710ac7a33ec7 \ + --hash=sha256:815f143a91983ba3041bba066e492ae3c42de523fb1c699685a1abf3313b7d1b \ + --hash=sha256:826a295a039178479a325be1ae60eded1f0b10f7dda749df59e2440de8f61d64 \ + --hash=sha256:82cc5835997ec78afe293a192e385099355770a7db94b2fb1239d36b32796f1c \ + --hash=sha256:830c04a49998b5ed58c8b642c65b7b26419397f52392a64121ba9fd0e95e7f9f \ + --hash=sha256:83b62410bd36bb1178a7d563e2ee0cf21eb1c980c912ab99c2c78f06227f1731 \ + --hash=sha256:84b736e3b391601bc47b86da381c749c0f894e9191aaca9f31f30c2632206df3 \ + --hash=sha256:85f9e0e2724bbddf05de65e5fb03b73eb23e985b7df4259c1d19feb302eb8dc2 \ + --hash=sha256:8b3e9e29b8b07cc461b9ce7768db7693a93979d0dadf22046f6f3555ded2f516 \ + --hash=sha256:8b8788f114845c01f2b520e0b91ea58d143276cfc0483aa943e815f7b9555c15 \ + --hash=sha256:8cb9b6892b53bd6d11fa4cde3dbee020b1f0b6656be1fbaa1ec0d4324a7839db \ + --hash=sha256:8efc3f1563ed431882dd0dc0411b5f8ace1b1b89074981deaf6bd8af77dbe1bc \ + --hash=sha256:8f006866047c6ec4b627ec144b1e0bbc7427cb31fd7c08d19897d0ac9032af3d \ + --hash=sha256:91f9f7c151e772acebe489eaec96e96a2877202d7dd144e3f96b8676881715a0 \ + --hash=sha256:9491f594859b68052edebd69e05fb045055a713b57a67974e6c1553b4e503c39 \ + --hash=sha256:96720f2aeed3434bc48f4d52fbad64ecc820cfed88915d664780ed9ba09ede78 \ + --hash=sha256:96ae7ab5d8155fde927aa0864fbc8ba3cc4fde6d41ab0c7cea9d6012b4978603 \ + --hash=sha256:98820e1ceb25c6df7a80c4fd8efa59cb121f99bc7c4c1693ad94a2caff5b311d \ + --hash=sha256:993dfcbe75a85a3784abb5084f2c41b915767c90546fcc92803cffa28611baea \ + --hash=sha256:9a1d9b13e5e394e13e3c316f0d910d100b17681ff59797f30da1dba032061296 \ + --hash=sha256:9bb3e0d1345b9c0fe73673ea656375f38a78ec679c2edeae0c24800f04798a85 \ + --hash=sha256:9ce0f885239357379d92fd9a5fddbe20f0e30e0527c29ba69f8e99eeb1304a76 \ + --hash=sha256:9e0213f3f8a2674a6778be299aea1d6dc6dda015aab86f683bca6d78f81f27bb \ + --hash=sha256:9e726478d7a213847860219d74665a6892a643ac93b8f76580f6cf9ed39996b7 \ + --hash=sha256:a17864853f7c518ae7d4b368af98f427f9396805476af40af8698560f09d7d97 \ + --hash=sha256:a284c36b9c6616bf0a8aa4aabba668a0c75ba65ccf40a79868aeaa69ad996897 \ + --hash=sha256:a3ad0e3da22852533858663848608f3f24c0d35e5cde415a4903476f2b4c88ec \ + --hash=sha256:a5613a3a82c974227bde18f03409e30c467f8065cb56d822e3eb83708a5f223d \ + --hash=sha256:a565303d118ea3b94a4b6c076bf568069726be414e43b06d58f7070b076ce11d \ + --hash=sha256:a60773eb5fda796e6e6f76b9c152d270fe59f9788a51a6ff8ba44082d8548ae4 \ + --hash=sha256:a7cb4cd266bd85613367fb85a30cfbf6fe6349919e87e18ca8dba584951bfb8a \ + --hash=sha256:a864bdcacd8bff58bb4845304e031f821a3ec64b2b7259f2d409cd49c9e59ca3 \ + --hash=sha256:ac5a9cc079c67d75f4ddf343276031879eadbb333d1bb231cce297b8d7b9aae8 \ + --hash=sha256:ac68ebfa549cc623e0e9add2937526340c629ccf667b4da85b7ef5f99e70bbd9 \ + --hash=sha256:aff38231e3171c578b2c449a01afa44e9ff40844597a32873da102394f63d28e \ + --hash=sha256:b476cdb63df22da2b91837593380be3ddbe406f36c506c1c91d80e7196b66288 \ + --hash=sha256:b787efadba00f5da6fe89513bfbe3852d52ca3a448fdec165765cb3b44a80248 \ + --hash=sha256:b7eb3eab5c646d3de7dcb14a7c9caebace5249c5767da39e1761cb1576e521a3 \ + --hash=sha256:b8ea208b304587d47931b36481342d20336e0d338ab052f8b4305926482598d6 \ + --hash=sha256:bf1e75dc07a3850b53d1e5f75e04d3ae12afe56284be7821771eaa2466350c73 \ + --hash=sha256:bf91921009025e96ce57a03ced6d14604fc3baf0530351638e9504a55da6fa3b \ + --hash=sha256:c387c6bf91b4774e359a48a179e2872b8e8bf741e4fde06ba8d1665eb9a4760a \ + --hash=sha256:c38d1e9bc2073b0984d2099ea647fd7f6c0d8f83a1e14e0cd32926f16e4c44ce \ + --hash=sha256:c41b067eddcfa5ee6b1169c287605be7fb6b0ea22bba6474c5bb978a668def4f \ + --hash=sha256:c455829625df983f716cbaecbba77f2d1dc2e0e0ed1638c059cece15a279344b \ + --hash=sha256:c54036a518748b6c02e666f6d46c3817561998fb904c3be25b56fb4fe3dc5706 \ + --hash=sha256:c5c6d47a865147e0ae3322ce92e7fb52ba3169d94b447deda56897ea2aa6fac9 \ + --hash=sha256:c5e981a5ac8641381efe6f0029467500661616a530d27bc6eedfe45f840599f8 \ + --hash=sha256:c75191e3c8052045179646cb40e280800a4e0bdfda34d9c949c2f268d44e80e4 \ + --hash=sha256:c825661dfcf843119ab57cdcac0df7a48e168764c66917bc74f9a42ecb096da9 \ + --hash=sha256:c9bde7a960720c8b8e1b5ef7afaa0c9a2f3b55c44abd635b2b29dd066b298e3a \ + --hash=sha256:c9f45186390aee4d1f26f723c615b67df346766c3b16df000d84d6e374f06757 \ + --hash=sha256:d016dc857136c726958102c3b8a3986acdc65ace6fbf12cfdc09cc4bfa2935b2 \ + --hash=sha256:d08952c0f14eb56d9dad72a2e17773b5f709c55b28635822d18c4adf38680833 \ + --hash=sha256:d22a083497d2f7d06a57172c5b60ee66cedcf304fde5226d4dfdc94f6180f5b1 \ + --hash=sha256:d2478bd3b2ead3962a484fb802891be40d10049fb74f83e09cb4463fad023fea \ + --hash=sha256:d54625cbf4e6b60bf0639728cb8b4cb541e340f6d7cafae5806051a40ddf4c45 \ + --hash=sha256:d6100f877d2ed95f0856a3fde25334153add94bf2224c43f45f88e7039262aaa \ + --hash=sha256:d672f329ae504ee240eb39b6effb3318aa8e7e8924c0ce8eee5760b3fad98539 \ + --hash=sha256:d7229a99120c6c2792d96f4857c2648ce5530e93667a2c2388c5ef69a6b84775 \ + --hash=sha256:d74bcf1cdd8ac8267fb216473ce6b112efa07b163536288094541415084d131c \ + --hash=sha256:d788e2ded0c4c47efa4d73cfe59eaf975ee32f425219873d2cb3e3fbaa00f636 \ + --hash=sha256:d867cefea33acad8e33a3eb408cca7889a9cf999bd5433d962089d5a13b6e75f \ + --hash=sha256:d8a9316f4da85e937242642b537c6d55d7e9287dd38e5634732f8233932aff45 \ + --hash=sha256:d90254c8f609338c53ec180fcd4c4f9c16502e238e3fc88ca7fd4c2f38d445b8 \ + --hash=sha256:d9419f44e568f7fafcdc0b3b5c766a2364e705a9b34fb8a56b431e0d1f3f4258 \ + --hash=sha256:d95244906ed69d0f79f190893c65e336c15959003e21449256dc05c001b52ea2 \ + --hash=sha256:dc28949de1bb5f7f30a46f15d74ce7ac5aaa63e03c5de04d68f571c7423af834 \ + --hash=sha256:dc7f6aca0bdac5e6520c8b6769bda69315fe7cb57f69885f115bc8ca02d1d022 \ + --hash=sha256:deb99535e9bf0bea8e274c6413eb939a21be35a3f492678dba4d5b1f4d70f142 \ + --hash=sha256:e31786a947b136329bfdc458c82c06d4ec539b4a4436b7da4df4aafc9902ee80 \ + --hash=sha256:e3b9eaa99a6d8c9ace4cd303915947ef55088d4cd87c6676874f98c5c03aa040 \ + --hash=sha256:e46a37ea7fcf9ae01d71b2e5ece19f1565987f3e308394b829197cbefc061f92 \ + --hash=sha256:e4e8fa586df2208ef040684751345f10f503834a757c9a74ecd19c1a2f9b1ccd \ + --hash=sha256:e54dd1a66fa4bce0ccaf0db9dde336e49b3eec646dc4c1c0991279369d373a14 \ + --hash=sha256:e5f834965c2fe589837bac1002e07e25734ff70381903ccd95b3d649e22bfa40 \ + --hash=sha256:ec6c464cf45867f66a2273e2214d9199a8fbad5cb95ca0fd45f6a2fe1d9d2cf4 \ + --hash=sha256:f044cb1cf44012184715f46584658993b5fee9344d71c4b0c455a17a299730c0 \ + --hash=sha256:f0fde5e5100c735b2274ab898f0742a5dcde492796296cfbe7e0ad6a4cd1a396 \ + --hash=sha256:f1619a3cc174a7e3963dd34348e6fceb6e50db0ddeb0031bd7c73a58286454fa \ + --hash=sha256:f278e131afa96a3622cef9211c406ea2ad1b68eb06f8837cd443684a40e0ae50 \ + --hash=sha256:f2ce3d39fb4a9d674e6639dd5d3146b2e273475d2260f10163228d66fc04433d \ + --hash=sha256:f7496aed56b06325a1ad419c5bf23c6dd042558e874f71dd1b958f3e255f3053 \ + --hash=sha256:f8cd1283a9fe6c2065c807e9d5da81afe5e1e004caef39adc0d8ae86dd883698 \ + --hash=sha256:f9f91d3e8382900f3a68fa0ce94294479de9cd2de6bc0c70acd0f0dfd511836b \ + --hash=sha256:fd68c825548a611158230e2f9222e210ceb2e3391995c0aa5865cbdf3ab4bd49 \ + --hash=sha256:fded2e82ff082e5d8e017e2ddcc1411bd8cb83b8585097fc401ef574f756b888 \ + --hash=sha256:fec352b793cdc183cc9e7e0b6c10fd7bff38ec54ba44cc43599b9b56f7f3db2e \ + --hash=sha256:ffdd7ac514301d0a67f7c23b9f2b431ef909a3c3dd6c3766668d0a6f5900c94e + # via requests +defusedxml==0.7.1 \ + --hash=sha256:1bb3032db185915b62d7c6209c5a8792be6a32ab2fedacc84e01b52c51aa3e69 \ + --hash=sha256:a352e7e428770286cc899e2542b6cdaedb2b4953ff269a210103ec58f6198a61 + # via aqtinstall +humanize==4.16.0 \ + --hash=sha256:353eb2f34c09d098b2880eee8bef21832eae6d174f48c5762fff7e5fcb74d01d \ + --hash=sha256:7dc2244a2f84a4bfb1d36c37bac80cd78e35cdc5c119206d87b018e1445f3a3f + # via aqtinstall +idna==3.18 \ + --hash=sha256:7f952cbe720b688055e3f87de14f5c3e5fdaa8bc3928985c4077ca689de849a2 \ + --hash=sha256:ffb385a7e039654cef1ab9ef32c6fafe283c0c0467bba1d9029738ce4a14a848 + # via requests +inflate64==1.0.4 \ + --hash=sha256:067af498c34a8b69b2957d20dbce4d72affda23aed37ea231b1ea5ad9aab5731 \ + --hash=sha256:0d173a7a0e865bb7d19685c5b1ad2994712b8361b24136d7e94abeff58505647 \ + --hash=sha256:118d8286f085e99a14341c76ef9fbffd56619ccc80318a9a204aea3dbfa71470 \ + --hash=sha256:172b51da7bbfa66b33f0a5405e944807b9949e92cf4cd9f983c07af8152766df \ + --hash=sha256:179e39069c56a69c37d3b939505254cf7e495a06fcbc0c4bd5a61fa8fc43c678 \ + --hash=sha256:19ffca993315ce7a4439efc388ffebdd395a20dbea2942b2445d87ec15373737 \ + --hash=sha256:2725ccc14b138f0ad622d0322b769f177f9edfe016ee9ed3404102935d39e7de \ + --hash=sha256:2a55295f493a40d7e68929f0ba54e489ab9b623b6aa968dc5d1389ba77a63eff \ + --hash=sha256:2b263c619469f90a75f29c421c53d31b208ad494a078235a8f6db2bc96583fdc \ + --hash=sha256:2c6befdf83d088a6e0d10d0873a9d4bfde2ce00ad7a52c8189cf303306f98030 \ + --hash=sha256:2e129669a0243ac7816fd526946ee01c25688fe81623a6d6bc95b3156d80f4fb \ + --hash=sha256:2ea7bdcad65e255b4596f84880f6e0c1756d6336d620e302653257defa407742 \ + --hash=sha256:332051a9d7e50579b90a3f555d68f53414b06f636c9ffe82e97c0baae3c8fbcc \ + --hash=sha256:3983f53b590ff7d0ba243f664ce852aca882482f30f7a8eab33e10d769336d0c \ + --hash=sha256:4662b2a4bba73bd64f803c97ec5134d6fd19227c3b3d3785e1babb359f1b4c33 \ + --hash=sha256:4d24112180c95d12f279cade9a1e21f8be7f4790c4109c293292edf87d061992 \ + --hash=sha256:4f61925b2d4248eac2ebb15350a80aaa0d1f7f1dc770bd5ebbbb3b0db4a6a416 \ + --hash=sha256:513201336fb3b0b7e2aee5dbbbe30a9f1b23291738b5ceb80076fc285f2ec2f1 \ + --hash=sha256:5b01539fea372c6078b9707d9121c12cb321e587e193f50e257ce06cf5b15e41 \ + --hash=sha256:5b5aa704141c9bad08b4e57bd722f68dd3a8cff62490b16a1605d2698e268fbd \ + --hash=sha256:5c098dab17821f466fc6e6a3d78fc6e0295bb51458015f03416b1d58d6a8df4f \ + --hash=sha256:61f51f80fa6f367288343c1a2cd20a42af454883087064e9274fd2a8c3a5a200 \ + --hash=sha256:62d1aac3aba094ae42e27ce7581b414c90f218248be0953b6aeb11a127225e5d \ + --hash=sha256:6751758301936fbb38fa38eb5312e14e27b6a1abf568f83c17557fab2694373d \ + --hash=sha256:6bfcf806912ced77a21394f7363805ecacd626b79f93cba87d505a48e88ede78 \ + --hash=sha256:6f0993214dea0738c557fa56c13cd9083aef0097a201d726c21984ad7f577514 \ + --hash=sha256:7056148548c1f25dcb38251f88c19b4635a5f32af4c7bad00621c85509e3d8c0 \ + --hash=sha256:7912927a509ca58d1a445ce4ff6e6e9f276dc1d72687386cdf7103bf590e785c \ + --hash=sha256:7d13b04cba65c12d21e65eaa77da9484e265e8e821b26e0761d1455ad3a878d9 \ + --hash=sha256:8065166f355122484f004225b379d403346bdae69ec624786a9334f025580675 \ + --hash=sha256:84ce3a97272ba745fce52b38363855c7201968f6402a794bbade774e64c657b9 \ + --hash=sha256:8600478542e2354d1ee7b5c57c957006cabacd8b787b4046951f487a2216e5c0 \ + --hash=sha256:89126ceb4d96e76842f4697017a9a3e750c34e029ddb360b3d8ca79a648d47f6 \ + --hash=sha256:8bad992f2d034f5f7e36208e54502d1b0829ce772c898e5dc59109833420148a \ + --hash=sha256:8ca9a2985afd5a14fb48cd126a67e5944ccb7a0a6bdec58c4f796c8c88a84539 \ + --hash=sha256:938ebc6b28578bfd365d1a9fdb18b7faab08321babeb2198e8025d07d8dc7fb5 \ + --hash=sha256:94a95f32087d223d2e119ff5c7c264109e8d4cb7e421e7a688a899a6fe021b38 \ + --hash=sha256:950dd7fe53474df5f4699b8f099980027e812d55fd82d8e167d599822c3d27d6 \ + --hash=sha256:9ae3ee727235a06dc3cd353ee5761fdd8e3b56ad119c711f61680528972a6ced \ + --hash=sha256:a6baedc3288d7a4ff588951d3a9a97a5391dceed6255ff5b16e42cae7274bfa9 \ + --hash=sha256:a846ce1f38845b20bef2625af1b512be83416d97824539524c5a34e7a729aec7 \ + --hash=sha256:a984b9287ff0fb596eb058d66a9e94530556afd2b7c054b44f2e0aeeff894e8f \ + --hash=sha256:abddae8920b2eaef824254e14b8d4ff54afbe6194a1bbe9816584859f0c1244d \ + --hash=sha256:ad4fa490bb7dc2a4640a3adaa2d5950f4a465ba034bbcf184c2103646e58ad97 \ + --hash=sha256:b17bf665d948dc4edeea0cd17752415d0cd7240c882b9c7e136ad4cc4321e9d4 \ + --hash=sha256:b303132cc562a906543a56f35c4e164e3880da6ff041cb4a7b1df9f9d2b4bb69 \ + --hash=sha256:b398c686960c029777afc0ed281a86f66adb956cfc3fbf6667cc6453f7b407ce \ + --hash=sha256:bad20de249d6336793f6267880668dbb286ca5c6e6991795aa6344c817588068 \ + --hash=sha256:bccda9815b27623e805a34ee3ee4f46c93f0cc7ac621f9834d75f033fd79c27a \ + --hash=sha256:bf4e34e32a37a42e9cf8bd9681f89e3e37b218f97d8b8cc95bd065419bc8db13 \ + --hash=sha256:c11e2a3cb9d9b49620c9b0c806dd0c55daec3b6bb665299b770a68f01bfc5432 \ + --hash=sha256:c1acf18b08b32981a4a11ec5a112b8ad5d7c7a5b15cb5bdbdb5b19201e9aa180 \ + --hash=sha256:c3f37540d0e64884a935fd62a7d17e40ab69f05ec63e815483b6513675d01bef \ + --hash=sha256:c8009e4a4918ee6c8cbc49e58fe159464895064cfdf0565fed3f49ca81e45272 \ + --hash=sha256:cb93159cb60aee8cab62541aa70e4c460f13359660a27a1a486518bba0153535 \ + --hash=sha256:d08cdda33341b4f992af60c12dc60e370e9993b80a936c17244a602711eeb727 \ + --hash=sha256:d6a4136752aa2a544301059d8f13780aeb88c34d60770258436a87dacd3fc304 \ + --hash=sha256:dcfafc572a642215894af1ec8d05949fa35eb7cb36d053aa97b11eccf1ae579e \ + --hash=sha256:dd8fdb7350728aa488edabeb9d2afbac5273522b50665e8dc99844a7eb99925b \ + --hash=sha256:e107d1d6e6d9b94409a68d1ac20522815996ad44269cc05a69c93d0f1c450f95 \ + --hash=sha256:e408d3b667fb693d45448327dc8cab8c684c6627d4fd8e71819f212ab1435e81 \ + --hash=sha256:e42def03ace8c58fd50b0df4f40241c45a2314c3876d020cce24acf958323c98 \ + --hash=sha256:ec40c0383cbd84d845dcb785a48ae76eef43246c923f84fda380fdd5ea653d3c \ + --hash=sha256:eef87908c780439393d577a155868317f0a275b47b417db9f47d8633ec791745 \ + --hash=sha256:f1a47837d4322e0684824f91eb635aa6fd1967584140c478b0a1aca7b11740d6 \ + --hash=sha256:f5bb6c58c642859ecf5e23178b1e7e4724f3ce968fc49090919d59a5e186f3e6 \ + --hash=sha256:f62a13d0327631778fa2a47c308ae2b07b2659b7bb8564783259ac65949f8c0c \ + --hash=sha256:f70e6692617ec82500b203eefac8765302298ce7e73584fcf995bb9e23184530 \ + --hash=sha256:f8964ceaabea294bc20abc9ef408c6aae978a75c25c83168a76cd87a37c38938 \ + --hash=sha256:fb2b5a62579d074f38352a3494c3c6ac1a90516b75c5793c39303547f1fea925 \ + --hash=sha256:fb2fdd63ef3933b67af98b3f2ee2f57e7787278041d7ba4821382fedd729b68a + # via py7zr +multivolumefile==0.2.3 \ + --hash=sha256:237f4353b60af1703087cf7725755a1f6fcaeeea48421e1896940cd1c920d678 \ + --hash=sha256:a0648d0aafbc96e59198d5c17e9acad7eb531abea51035d08ce8060dcad709d6 + # via py7zr +patch-ng==1.19.1 \ + --hash=sha256:036a3cc00134ec53f37e92333958ee75e117f2e62a5ec2b85c7122e5e815c29e \ + --hash=sha256:d45fd47b3f74b48c3e336690341876bb26244a077a06f5f7e6e47c19c15c1ca4 + # via aqtinstall +psutil==7.2.2 ; sys_platform != 'cygwin' \ + --hash=sha256:0746f5f8d406af344fd547f1c8daa5f5c33dbc293bb8d6a16d80b4bb88f59372 \ + --hash=sha256:076a2d2f923fd4821644f5ba89f059523da90dc9014e85f8e45a5774ca5bc6f9 \ + --hash=sha256:11fe5a4f613759764e79c65cf11ebdf26e33d6dd34336f8a337aa2996d71c841 \ + --hash=sha256:1a571f2330c966c62aeda00dd24620425d4b0cc86881c89861fbc04549e5dc63 \ + --hash=sha256:1a7b04c10f32cc88ab39cbf606e117fd74721c831c98a27dc04578deb0c16979 \ + --hash=sha256:1fa4ecf83bcdf6e6c8f4449aff98eefb5d0604bf88cb883d7da3d8d2d909546a \ + --hash=sha256:2edccc433cbfa046b980b0df0171cd25bcaeb3a68fe9022db0979e7aa74a826b \ + --hash=sha256:7b6d09433a10592ce39b13d7be5a54fbac1d1228ed29abc880fb23df7cb694c9 \ + --hash=sha256:8c233660f575a5a89e6d4cb65d9f938126312bca76d8fe087b947b3a1aaac9ee \ + --hash=sha256:917e891983ca3c1887b4ef36447b1e0873e70c933afc831c6b6da078ba474312 \ + --hash=sha256:ab486563df44c17f5173621c7b198955bd6b613fb87c71c161f827d3fb149a9b \ + --hash=sha256:ae0aefdd8796a7737eccea863f80f81e468a1e4cf14d926bd9b6f5f2d5f90ca9 \ + --hash=sha256:b0726cecd84f9474419d67252add4ac0cd9811b04d61123054b9fb6f57df6e9e \ + --hash=sha256:b58fabe35e80b264a4e3bb23e6b96f9e45a3df7fb7eed419ac0e5947c61e47cc \ + --hash=sha256:c7663d4e37f13e884d13994247449e9f8f574bc4655d509c3b95e9ec9e2b9dc1 \ + --hash=sha256:e452c464a02e7dc7822a05d25db4cde564444a67e58539a00f929c51eddda0cf \ + --hash=sha256:e78c8603dcd9a04c7364f1a3e670cea95d51ee865e4efb3556a3a63adef958ea \ + --hash=sha256:eb7e81434c8d223ec4a219b5fc1c47d0417b12be7ea866e24fb5ad6e84b3d988 \ + --hash=sha256:ed0cace939114f62738d808fdcecd4c869222507e266e574799e9c0faa17d486 \ + --hash=sha256:eed63d3b4d62449571547b60578c5b2c4bcccc5387148db46e0c2313dad0ee00 \ + --hash=sha256:fd04ef36b4a6d599bbdb225dd1d3f51e00105f6d48a28f006da7f9822f2606d8 + # via py7zr +py7zr==1.0.0 \ + --hash=sha256:6f42d2ff34c808e9026ad11b721c13b41b0673cf2b4e8f8fb34f9d65ae143dd1 \ + --hash=sha256:f6bfee81637c9032f6a9f0eb045a4bfc7a7ff4138becfc42d7cb89b54ffbfef1 + # via + # -r /tmp/qt-tools.in + # aqtinstall +pybcj==1.0.8 \ + --hash=sha256:0074af187b1acce9e31717fc9aa42bc36b67f1a44088a8b44f4f4792af688ee6 \ + --hash=sha256:0657c9534d480a43b11743cad4209d140d09d417adaf19213ff395686ed08812 \ + --hash=sha256:067982ad967ce68ae28c13cc27f96d8b65b5f497819dd4ad5c4f05ffc2fb2ae3 \ + --hash=sha256:077460a97a69ccd914d09d2a2ad493a48568b356fb14871ce54fb6bb7f3cccc2 \ + --hash=sha256:07eac7a1a8804230060fe56a5d828c620ee2d70acd31aef80705a01627da5946 \ + --hash=sha256:083b41b59672d4aa893b44769bed7a41abfde43211b27d47a0d4d66a59fdafad \ + --hash=sha256:090eb05fe7a2f7cd7eb42809616ce1b49437c3e995a8aae2faa92b66f218172f \ + --hash=sha256:09c3fe78d325a499fdd0a003b04b0009a3921666dc590d1b7a496dc365eef3a9 \ + --hash=sha256:0d432a32bfc23475b7fd62a5eb1c3243a8329ff95aa0e3c941d57902dc6e7c87 \ + --hash=sha256:0de1f6c90178f5947e4b578821aa2f1f87a78a761ae603aa33a8ad3d8b9b9cac \ + --hash=sha256:190e21c3bdb6b28c63999889668a3f80f5d7eb13b957f2dfda53c9ddeb3d946a \ + --hash=sha256:1997badf9e59221470f84e193ac8c1bab158acfe6b058ffdc28c331807967ff9 \ + --hash=sha256:20b657e4fe3e701a0f64a7c1224694820687334b17593d74a878f7124f10b24f \ + --hash=sha256:26e3e4d287f306996902289fc0e88b36d0fc817802f4fc4537b40a6518726585 \ + --hash=sha256:3253ef9c93ea59b0d6fcac451dd7970cbc815d9e19d0af9ceb151b20975364f1 \ + --hash=sha256:331c21f0636150d4b846e0749cb0e8d6cbd133692368b391f9ba75dc02d5c51f \ + --hash=sha256:3817997e73d60ccbc731a47e007fe02213eee816cfe6070eb8347c6286aa3cc2 \ + --hash=sha256:384b25dfe66868329a3872c6eae668033e009e4e86754eba3a70b656c9eb4208 \ + --hash=sha256:3a63c91adcffb229a79f8884e36d22cc341f323c0056f3affd478d986815b157 \ + --hash=sha256:458a5bff57f36fba7af822df64da335fa1781d592dd7f802f347ae1f75939aa0 \ + --hash=sha256:4f0818cf48fbfddbae487536f3fcd69cfadfb7293630ab8658b66e89a0836d6a \ + --hash=sha256:56c48aecd6ab096e4955ecd39c9655847f2774878a969e8140641fb23c3f2d1c \ + --hash=sha256:5824e498e2dfafc19a2de2bdf54e5c2857144d84983ac8e13e54b1f7b78e3f50 \ + --hash=sha256:62a3d31f4e5641771e75bd5c9498a057b0a550ca742a31d3db0634a0a4a0a115 \ + --hash=sha256:6722171da5846d9374f2d55474ffd1298ff2e2b21dc6b81a7806bb17ee1c634d \ + --hash=sha256:6818270692912d47e81ccd777b7d0ed2ad3a19ef7aaead3735b38048c80bf368 \ + --hash=sha256:748af4545040da68dfae8cdf9f902ac7c29f209aaf6450a970abe0302d1b0f58 \ + --hash=sha256:784443d0c075871689692679ef01cfe85eca789cc8d091f842fa02f62dead9d5 \ + --hash=sha256:78498748ebea7e1483f9cfdeac4a08687f6e2773e3a4223c420ab1beae95d75d \ + --hash=sha256:82d2e46eff6c3fe8d16f6515f9ab0598eb960af9a2218907c5e0e9f993d7a666 \ + --hash=sha256:9195ce382f21e13df7ecc0df8fb42c5f391a7ac516066af16b023e6bd2f86046 \ + --hash=sha256:935e0588be20a2b7c3554a6415d1fdb66acfde037df718b7927033b658428518 \ + --hash=sha256:9f0e496c49dce294fb41a2221e7b3f96156bb940d8cfe359d441909f1cf241ea \ + --hash=sha256:a039943fcd80f9924189949909beeca83910bf19c5602c0d7eb3582109f28628 \ + --hash=sha256:a50b58f9b9d9978c55e3219b6816a1021a778b028a810b36aa754407591cb5ae \ + --hash=sha256:a5b4c66b5358cd241b6ff81a8fafd5806e816d378c810a796ad51865be5533f7 \ + --hash=sha256:a5f977b14950ab26c9032784164719f16a4238115a8fe9ae3dcc82dab06cb208 \ + --hash=sha256:af962c96a799ee7b13b9747a73240ba7f73e8643c276492f10e1dc60b564b295 \ + --hash=sha256:b372f40aadb429de71cfc86ff7b8a52e753bd357eef5c03c3eb3b823709982fd \ + --hash=sha256:b480efcd66cfb4533ede6c3d67224ff477c8dd661613826edff9c95921a562d6 \ + --hash=sha256:b68d66941fca641865b579b516a4599a346a2aad860dcd411cb5179808d88b3f \ + --hash=sha256:b8d80571db5f89944aced42378b208afe38339008027ec56303e11628615a906 \ + --hash=sha256:ba3b8f1efd1ebbe3ee99a599c6ea745877a41675a0ade763903b644ccd58da97 \ + --hash=sha256:be7a84e93d7bf22a7f89cb958dc16b6a5e8bf2d3422eb52030d41afc76fa3d23 \ + --hash=sha256:cb1601253a15abfaba42e0bdbde4d459d2afcafdc97dee0d9b698e589167fd8d \ + --hash=sha256:cbca168d4d0aa75cca780b95f530f842b81ebc8d72f36d7865287b59364593a1 \ + --hash=sha256:d0bb3b8ca2c16aa05c4919bea35141f02c500a79d7e4eb6c34065e10b81a7f15 \ + --hash=sha256:da783c9e002826e6e4e4d6f92e49ab1a77bee5d8e6edc1b99cdee2e883d4cb56 \ + --hash=sha256:dd573565e5e214bdc738f9e2cf52dfac9cebe7220f88c76f8861534e4330c3a9 \ + --hash=sha256:e47d9c655d276200e5d08f7b550097dacc826364b44931f0fbdc0da2e4bdf448 \ + --hash=sha256:e5e67ec32176985bbf941185319a3fe385527b6826d457a8ec67dd43b5f0b5fa \ + --hash=sha256:efa420a3565e381e15e6425a3b2887ddf2be6dc66eb1d68e79ce0f177229ebb8 \ + --hash=sha256:f23a36e978f4620db473b08239ab56dc57a479c83fd5d3808bc95e5bdbc1a703 \ + --hash=sha256:f2a9146d8f3df70305dba6cb9c3d25f285a9a69309e4941333962f5408a244be \ + --hash=sha256:f561988aef99f07e991d0708ca6fe86e766d545c0a20e58bdbd38615a615e419 + # via py7zr +pycparser==3.0 ; implementation_name != 'PyPy' and platform_python_implementation == 'PyPy' \ + --hash=sha256:600f49d217304a5902ac3c37e1281c9fe94e4d0489de643a9504c5cdfdfc6b29 \ + --hash=sha256:b727414169a36b7d524c1c3e31839a521725078d7b2ff038656844266160a992 + # via cffi +pycryptodomex==3.23.0 \ + --hash=sha256:02d87b80778c171445d67e23d1caef279bf4b25c3597050ccd2e13970b57fd51 \ + --hash=sha256:06698f957fe1ab229a99ba2defeeae1c09af185baa909a31a5d1f9d42b1aaed6 \ + --hash=sha256:14c37aaece158d0ace436f76a7bb19093db3b4deade9797abfc39ec6cd6cc2fe \ + --hash=sha256:189afbc87f0b9f158386bf051f720e20fa6145975f1e76369303d0f31d1a8d7c \ + --hash=sha256:1c3a65ad441746b250d781910d26b7ed0a396733c6f2dbc3327bd7051ec8a541 \ + --hash=sha256:1c6d919fc8429e5cb228ba8c0d4d03d202a560b421c14867a65f6042990adc8e \ + --hash=sha256:267a3038f87a8565bd834317dbf053a02055915acf353bf42ededb9edaf72010 \ + --hash=sha256:27e13c80ac9a0a1d050ef0a7e0a18cc04c8850101ec891815b6c5a0375e8a245 \ + --hash=sha256:43c446e2ba8df8889e0e16f02211c25b4934898384c1ec1ec04d7889c0333587 \ + --hash=sha256:47f6d318fe864d02d5e59a20a18834819596c4ed1d3c917801b22b92b3ffa648 \ + --hash=sha256:4e79f1aaff5a3a374e92eb462fa9e598585452135012e2945f96874ca6eeb1ff \ + --hash=sha256:4f2596e643d4365e14d0879dc5aafe6355616c61c2176009270f3048f6d9a61f \ + --hash=sha256:52e5ca58c3a0b0bd5e100a9fbc8015059b05cffc6c66ce9d98b4b45e023443b9 \ + --hash=sha256:55ccbe27f049743a4caf4f4221b166560d3438d0b1e5ab929e07ae1702a4d6fd \ + --hash=sha256:58b851b9effd0d072d4ca2e4542bf2a4abcf13c82a29fd2c93ce27ee2a2e9462 \ + --hash=sha256:6b8962204c47464d5c1c4038abeadd4514a133b28748bcd9fa5b6d62e3cec6fa \ + --hash=sha256:6bbcb1dd0f646484939e142462d9e532482bc74475cecf9c4903d4e1cd21f003 \ + --hash=sha256:71909758f010c82bc99b0abf4ea12012c98962fbf0583c2164f8b84533c2e4da \ + --hash=sha256:7b37e08e3871efe2187bc1fd9320cc81d87caf19816c648f24443483005ff886 \ + --hash=sha256:7de1e40a41a5d7f1ac42b6569b10bcdded34339950945948529067d8426d2785 \ + --hash=sha256:8a4fcd42ccb04c31268d1efeecfccfd1249612b4de6374205376b8f280321744 \ + --hash=sha256:91979028227543010d7b2ba2471cf1d1e398b3f183cb105ac584df0c36dac28d \ + --hash=sha256:a33986a0066860f7fcf7c7bd2bc804fa90e434183645595ae7b33d01f3c91ed8 \ + --hash=sha256:a9d446e844f08299236780f2efa9898c818fe7e02f17263866b8550c7d5fb328 \ + --hash=sha256:add243d204e125f189819db65eed55e6b4713f70a7e9576c043178656529cec7 \ + --hash=sha256:b2c2537863eccef2d41061e82a881dcabb04944c5c06c5aa7110b577cc487545 \ + --hash=sha256:bc65bdd9fc8de7a35a74cab1c898cab391a4add33a8fe740bda00f5976ca4708 \ + --hash=sha256:bdc69d0d3d989a1029df0eed67cc5e8e5d968f3724f4519bd03e0ec68df7543c \ + --hash=sha256:bffc92138d75664b6d543984db7893a628559b9e78658563b0395e2a5fb47ed9 \ + --hash=sha256:c25e30a20e1b426e1f0fa00131c516f16e474204eee1139d1603e132acffc314 \ + --hash=sha256:c7947ab8d589e3178da3d7cdeabe14f841b391e17046954f2fbcd941705762b5 \ + --hash=sha256:c84b239a1f4ec62e9c789aafe0543f0594f0acd90c8d9e15bcece3efe55eca66 \ + --hash=sha256:c885da45e70139464f082018ac527fdaad26f1657a99ee13eecdce0f0ca24ab4 \ + --hash=sha256:d9825410197a97685d6a1fa2a86196430b01877d64458a20e95d4fd00d739a08 \ + --hash=sha256:da4fa650cef02db88c2b98acc5434461e027dce0ae8c22dd5a69013eaf510006 \ + --hash=sha256:df027262368334552db2c0ce39706b3fb32022d1dce34673d0f9422df004b96a \ + --hash=sha256:ebfff755c360d674306e5891c564a274a47953562b42fb74a5c25b8fc1fb1cb5 \ + --hash=sha256:eca54f4bb349d45afc17e3011ed4264ef1cc9e266699874cdd1349c504e64798 \ + --hash=sha256:f489c4765093fb60e2edafdf223397bc716491b2b69fe74367b70d6999257a5c \ + --hash=sha256:fdfac7cda115bca3a5abb2f9e43bc2fb66c2b65ab074913643803ca7083a79ea \ + --hash=sha256:febec69c0291efd056c65691b6d9a339f8b4bc43c6635b8699471248fe897fea + # via py7zr +pyppmd==1.2.0 \ + --hash=sha256:011c813389476e84387599ad4aa834100e888c6608a6e7d6f07ea7cbac8a8e65 \ + --hash=sha256:0354919ab0f4065d76c64ad0dc21f14116651a2124cf4915b96c4e76d9caf470 \ + --hash=sha256:064307c7fec7bdf3da63f5e28c0f1c5cb5c9bf888c1b268c6df3c131391ab345 \ + --hash=sha256:0877758ffa73b2e9d2f93b698e17336a4d8acab8d9a3d17cd7960aec08347387 \ + --hash=sha256:0f07d5376e1f699d09fbb9139562e5b72a347100aecaa73b688fa08461b3c118 \ + --hash=sha256:14ed0846c3bcee506555cd943db950d5787a6ffa1089e05deced010759ef1fe5 \ + --hash=sha256:1a5f0b78d68620ffb51c46c34c9e0ec02c40bb68e903e6c3ce02870c528164af \ + --hash=sha256:1f19285ae4dd20bb917c4fd177f0911847feb3abada91cec5fd5d9d5f1b9f3e0 \ + --hash=sha256:2cd2694f43720fa1304c1fa31b8a1e7d80162f045e91569fb93473277c2747b8 \ + --hash=sha256:30068ed6da301f6ba25219f96d828f3c3a80ca227647571d21c7704301e095e6 \ + --hash=sha256:3674b5eba0e312b9af987ec7e6af59248f54db9a7f5ca63add5365d6c6639e9e \ + --hash=sha256:38e3835a1951d18dd273000c870a4eb2804c20c400aa3c72231449f300cedf19 \ + --hash=sha256:3ac0960d2d0a1738af3ca3f27c6ed6eead38518d77875a47b2b4aae90ae933f4 \ + --hash=sha256:3caef2fb93a63d696b21e5ff72cb2955687b5dfcbed1938936334f9f7737fcd3 \ + --hash=sha256:40bfa26fdb3332a6a8d90fe1f6e0d9f489505a014911b470d66f2f79caea6d61 \ + --hash=sha256:416c15576924ff9d2852fbe53d162c946e0466ce79d8a03a058e6f09a54934f0 \ + --hash=sha256:42c7c9050b44b713676d255f0c212b8ff5c0463821053960c89292cf6b6221cc \ + --hash=sha256:4a25d8b2a71e0cc6f34475c36450e905586b13d0c88fb28471655c215f370908 \ + --hash=sha256:4a3087d7ee6fc35db0bfecabd1df4615f2a9d58a56af61f5fc18b9ce2b379cbf \ + --hash=sha256:4aa8ffca1727872923d2673045975bca571eb810cf14a21d048648da5237369b \ + --hash=sha256:4b3249256f8a7ecdd36477f277b232a46ee2c8ca280b23faaeacb7f50cab949a \ + --hash=sha256:5768bff11936047613bcb91ee466f21779efc24360bd7953bd338b32da88577a \ + --hash=sha256:5f1ee49b88fd2e58a144b1ae0da9c2fe0dabc1962531da9475badbed6fba61fc \ + --hash=sha256:5ff515c2c3544096fe524f341c244787d6449b36692d27131bf74d5075e5c83b \ + --hash=sha256:625896f5da7038fe7145907b68b0b58f7c13b88ad6bbfdc1c20c05654c17fa6c \ + --hash=sha256:69fe10feb24a92e673b68aca5d945564232d09e25a4e185899e0c657096ae695 \ + --hash=sha256:6dc00f0ce9f79e1c1c87d9998220a714ab8216873b6c996776b88ab23efe05ac \ + --hash=sha256:75b173bbc9164cdc6fb257d3480269cc26b1eb102ad72281a98cf90e0f7dc860 \ + --hash=sha256:7e955de43991346d4ccb28a74fb4c80cadecf72a6724705301fe1adb569689fe \ + --hash=sha256:86e252979fc5ae2492ebb46ed0eed0625a46a2cce519c4616b870eab58d77fb7 \ + --hash=sha256:874f52eae03647b653aa34476f4e23c4c30458245c0eb7aa7fb290940abbd5b9 \ + --hash=sha256:8b43e299310e27af5a4bc505bcc87d10cfc38ae28e5ed1f6a779d811705e5ad6 \ + --hash=sha256:9095d8b098ce8cb5c1e404843a16e5167fb5bdebb4d6aed259d43dd2d73cfca3 \ + --hash=sha256:91534eb8c9c0bff9d6c6ec5eb5119a583d31bb9f8cf208d5a925b4e2293c9a7b \ + --hash=sha256:9b5c3284be4dccebb87d81c14b148c81e035356cd01a29889736c75672f6187d \ + --hash=sha256:a5c03dd85da64a237c601dd690d8eb95951b7c2eef91b89e110eb208010c6035 \ + --hash=sha256:a5c763f2e3a011d5e96dfa0195f38accce9a14d489725a3d3641a74addbb5b72 \ + --hash=sha256:aa40c982d1df515cd4cb366d3e1ae95ce22f3c20e6b8b2d31aa492679f7ad78c \ + --hash=sha256:abafffb3d5b292924eafd8214ad80487400cf358c4e9dc2ac6c21d2c651c5ee2 \ + --hash=sha256:af9be87228cba6b543531260f44675a23b4a1527158a44162dce186157cb13d9 \ + --hash=sha256:bc9dd8a6261152591a352d91e5e52c16b81fa760f64c361a7afb24a1f3b5e048 \ + --hash=sha256:bec8abbf1edb0300c0a2e4f1bbad6a96154de3e507a2b054a0b1187f1c2e4982 \ + --hash=sha256:bf26c2def22322135fbaaa3de3c0963062c1835bd43d595478e3a2a674466a1a \ + --hash=sha256:c012c17a53b6d9744e0514b17b0c4169c5f21fb54b4db7a0119bc2d7b3fcc609 \ + --hash=sha256:c577f3dadd514979255e9df6eb89a63409d0e91855bb8c0969ffcd67d5d4f124 \ + --hash=sha256:c67196af6cfcc68e72a8fffbc332d743327bb9323cb7f3709e27185e743c7272 \ + --hash=sha256:c76b8881fc087e70338b1cccd452bd12566206587a0d0d8266ba2833be902194 \ + --hash=sha256:c98697fea3f3baf5ffc759fd41c766d708ff3fba7379776031077527873ce4ac \ + --hash=sha256:c9d0f5a903045ee6b399f5fb308e192e39f8f1f551b61441a595676d95dc76ad \ + --hash=sha256:cc04af92f1d26831ec96963439dfb27c96467b5452b94436a6af696649a121fd \ + --hash=sha256:cff27496fd164b587f150abba9524cae81629adbd2e9472f09e7b2b24b2d4939 \ + --hash=sha256:d28cc9febcf37f2ff08b9e25d472de529e8973119c0a3279603b1915c809dd45 \ + --hash=sha256:d437881763ffd0d19079402f50e7f4aad5895e3cd5312d095edef0b32dac3aef \ + --hash=sha256:d529c78382a2315db22c93e1c831231ee3fd2ad5a352f61496d72474558c6b00 \ + --hash=sha256:dcdd5bf53f562af2a9be76739be69c9de080dfa59a4c4a8bcc4a163f9c5cb53e \ + --hash=sha256:edc4fcd928bf6219bcddb8230a5830e33a35b684b16ca3e8d1357b17029a9ef7 \ + --hash=sha256:f29dfb7aaf4b49ebc09d726fcdeabbce1cb21e9cf3a055244bb1384b8b51dd3b + # via py7zr +pyzstd==0.19.1 \ + --hash=sha256:267e2eb0de0291dfcb7ccfebc4ffe75b2f9d84e7007ac38844f6ccafc6dce081 \ + --hash=sha256:36723d3c915b3981de9198d0a2c82b2f5fe3eaa36e4d8d586937830a8afc7d72 + # via py7zr +requests==2.34.2 \ + --hash=sha256:2a0d60c172f83ac6ab31e4554906c0f3b3588d37b5cb939b1c061f4907e278e0 \ + --hash=sha256:f288924cae4e29463698d6d60bc6a4da69c89185ad1e0bcc4104f584e960b9ed + # via aqtinstall +semantic-version==2.10.0 \ + --hash=sha256:bdabb6d336998cbb378d4b9db3a4b56a1e3235701dc05ea2690d9a997ed5041c \ + --hash=sha256:de78a3b8e0feda74cabc54aab2da702113e33ac9d9eb9d2389bcf1f58b7d9177 + # via aqtinstall +soupsieve==2.9.2 \ + --hash=sha256:4a55d8cf158a9c2e587fa4922f1bbb91d68ac829e2d6f25403a85747c71daf74 \ + --hash=sha256:8089a26fd974ca7a1f30276d3d8492ab266ab15af581642dfe8aa162e0c1c823 + # via beautifulsoup4 +texttable==1.7.0 \ + --hash=sha256:2d2068fb55115807d3ac77a4ca68fa48803e84ebb0ee2340f858107a36522638 \ + --hash=sha256:72227d592c82b3d7f672731ae73e4d1f88cd8e2ef5b075a7a7f01a23a3743917 + # via + # aqtinstall + # py7zr +typing-extensions==4.16.0 \ + --hash=sha256:481caa481374e813c1b176ada14e97f1f67a4539ce9cfeb3f350d78d6370c2e8 \ + --hash=sha256:dc983d19a509c94dba722ee6abd33940f7c05a89e243c47e907eb4db6f1a43e5 + # via beautifulsoup4 +urllib3==2.7.0 \ + --hash=sha256:231e0ec3b63ceb14667c67be60f2f2c40a518cb38b03af60abc813da26505f4c \ + --hash=sha256:9fb4c81ebbb1ce9531cce37674bbc6f1360472bc18ca9a553ede278ef7276897 + # via requests diff --git a/scripts/check_qt_toolchain_lock.py b/scripts/check_qt_toolchain_lock.py new file mode 100644 index 0000000..d1c598d --- /dev/null +++ b/scripts/check_qt_toolchain_lock.py @@ -0,0 +1,108 @@ +#!/usr/bin/env python3 +"""The Qt toolchain's lock, the workflow that fetches it, and the catalog agree. + +`qt-ci.yml` used `uvx --from 'aqtinstall@3.3.0' --with 'py7zr==1.0.0'`. That +pinned two names and left everything they pull unbounded -- aqtinstall declares +`bs4`, `defusedxml`, `humanize`, `patch-ng`, `semantic-version` and `texttable` +with no upper bound, and `requests>=2.31.0` -- so two runs of the same workflow +SHA could install different code without this repository changing. It mattered +here more than most places, because driving aqtinstall directly was itself a +supply-chain decision, taken to escape an action whose nested graph could not be +pinned. Escaping one unpinned graph into another is not an improvement. + +`requirements-qt.txt` is now the closure, all twenty-eight packages with hashes. +`qt-ci.yml` is a reusable workflow, so the checkout it runs in belongs to the +caller and the lock is not there: it is fetched from the exact commit of the +workflow file and checked against a digest published *in* that file. Three things +therefore have to agree, and this is what says so: + +* the digest `qt-ci.yml` carries and the lock in the tree, +* the versions the lock pins and the versions `catalog/tools.yml` records, +* and every requirement in the lock carries hashes, or `--require-hashes` fails + at install time rather than here. +""" +from __future__ import annotations + +import hashlib +import re +import sys +from pathlib import Path + +from ci_workflows_tools._strict_yaml import strict_load +from ci_workflows_tools._workflow_yaml import load_yaml + +REPO_ROOT = Path(__file__).resolve().parent.parent +LOCK = REPO_ROOT / "requirements-qt.txt" +WORKFLOW = REPO_ROOT / ".github/workflows/qt-ci.yml" +TOOLS = REPO_ROOT / "catalog/tools.yml" +STEP = "Provision the locked Qt toolchain" +PINNED = re.compile(r"^(?P[A-Za-z0-9][A-Za-z0-9._-]*)==(?P[^\s;]+)", re.M) + + +def check() -> list[str]: + problems: list[str] = [] + if not LOCK.is_file(): + return [f"{LOCK.name} is missing; qt-ci.yml installs from it"] + lock_text = LOCK.read_text(encoding="utf-8") + digest = hashlib.sha256(LOCK.read_bytes()).hexdigest() + + pinned = {m.group("name").lower().replace("_", "-"): m.group("version") + for m in PINNED.finditer(lock_text)} + if not pinned: + problems.append(f"{LOCK.name} pins nothing") + + # Every requirement must carry hashes, or --require-hashes fails on the runner. + for name in sorted(pinned): + pattern = re.compile( + rf"^{re.escape(name)}==[^\n]*\n(?:\s+--hash=sha256:[0-9a-f]{{64}}[^\n]*\n)+", + re.M | re.I) + if not pattern.search(lock_text): + problems.append(f"{LOCK.name}: {name} carries no --hash entries") + + # The workflow's published digest must be this lock. + steps = [s for s in ((load_yaml(WORKFLOW).get("jobs") or {}).get("qt") or {}).get("steps") or [] + if isinstance(s, dict)] + declared = None + for step in steps: + if str(step.get("name")) == STEP: + declared = str((step.get("env") or {}).get("LOCK_SHA256") or "") + if declared is None: + problems.append(f"qt-ci.yml has no {STEP!r} step") + elif declared != digest: + problems.append( + f"qt-ci.yml publishes LOCK_SHA256 {declared[:12] or ''}… but " + f"{LOCK.name} hashes to {digest[:12]}…; the workflow would refuse the " + "lock it fetches") + + # The catalog must record the same closure and the same versions. + tools = {str(entry.get("id")): entry for entry in (strict_load(TOOLS).get("tools") or [])} + for tool_id in ("aqtinstall", "py7zr"): + entry = tools.get(tool_id) + if entry is None: + problems.append(f"catalog/tools.yml does not register {tool_id}, which qt-ci.yml runs") + continue + if str(entry.get("lock_sha256")) != digest: + problems.append( + f"catalog/tools.yml records {tool_id} lock_sha256 " + f"{str(entry.get('lock_sha256'))[:12]}…, but {LOCK.name} hashes to {digest[:12]}…") + recorded = str(entry.get("pin") or entry.get("current_version") or "") + if pinned.get(tool_id) != recorded: + problems.append( + f"catalog/tools.yml pins {tool_id} at {recorded!r}, but {LOCK.name} " + f"locks {pinned.get(tool_id)!r}") + return problems + + +def main() -> int: + problems = check() + if problems: + print("check_qt_toolchain_lock: FAIL", file=sys.stderr) + for problem in problems: + print(f" - {problem}", file=sys.stderr) + return 1 + print("check_qt_toolchain_lock: OK") + return 0 + + +if __name__ == "__main__": + raise SystemExit(main()) diff --git a/scripts/check_sdk_runtime_fixtures.py b/scripts/check_sdk_runtime_fixtures.py index 5a5091e..ad18524 100644 --- a/scripts/check_sdk_runtime_fixtures.py +++ b/scripts/check_sdk_runtime_fixtures.py @@ -78,7 +78,8 @@ "qt": { "toolchain": ( frozenset({"cache_key_prefix", "qt_version_input"}), - frozenset({"aqt_version", "cmake_version", "qt_version"}), + frozenset({"aqt_version", "cmake_version", "qt_version", + "toolchain_lock_sha256"}), ), "configure": (frozenset({"configure_command"}), frozenset()), "build": (frozenset({"build_command"}), frozenset()), diff --git a/scripts/validate_all.py b/scripts/validate_all.py index 0046e86..c09c510 100644 --- a/scripts/validate_all.py +++ b/scripts/validate_all.py @@ -70,6 +70,7 @@ check_python_execution_contract, check_python_syntax, check_qt_pin, + check_qt_toolchain_lock, check_release_graph, check_release_ledger, check_release_promotion_gate, @@ -133,6 +134,7 @@ ("public-docs", check_public_docs.check), ("runtime-requirements", check_runtime_requirements.check), ("runner-routing", check_runner_routing.check), + ("qt-toolchain-lock", check_qt_toolchain_lock.check), ("secret-scan-contract", check_secret_scan_contract.check), ("sdk-runtime-fixtures", check_sdk_runtime_fixtures.check), ("scorecard-evidence-contract", check_scorecard_evidence_contract.check),