Bump werkzeug from 2.3.7 to 3.0.1

.bazelrc

@@ -0,0 +1,22 @@
+build --enable_bzlmod
+
+build -c opt
+
+build --spawn_strategy=standalone
+build --strategy=Genrule=standalone
+build --spawn_strategy=sandboxed
+
+build --cxxopt='-std=c++17'
+build --cxxopt='-D_GLIBCXX_USE_CXX11_ABI=1'
+
+build:test --cxxopt='-DPYBIND11_ABSEIL_STATUS_MODULE_PATH=pybind11_abseil.pybind11_abseil.status'
+
+build:release --cxxopt='-DPYBIND11_ABSEIL_STATUS_MODULE_PATH=pybind11_abseil.status'
+
+build:asan --strip=never
+build:asan --copt -fsanitize=address
+build:asan --copt -DADDRESS_SANITIZER
+build:asan --copt -O1
+build:asan --copt -g
+build:asan --copt -fno-omit-frame-pointer
+build:asan --linkopt -fsanitize=address

.devcontainer/devcontainer.json

@@ -3,7 +3,7 @@
 	"build": {
 		"dockerfile": "Dockerfile",
 		"args": {
-			"BAZELISK_VERSION": "v1.17.0",
+			"BAZELISK_VERSION": "v1.17.0", // see .github/workflows/wheel.yaml
 			"BAZELISK_DOWNLOAD_SHA": "61699e22abb2a26304edfa1376f65ad24191f94a4ffed68a58d42b6fee01e124"
 		}
 	},
@@ -17,7 +17,9 @@
 				"ms-python.python",
 				"ms-vscode.cpptools-extension-pack",
 				"BazelBuild.vscode-bazel",
-				"minherz.copyright-inserter"
+				"minherz.copyright-inserter",
+				"DavidAnson.vscode-markdownlint",
+				"yzhang.markdown-all-in-one"
 			]
 		}
 	},

.github/workflows/wheel.yaml

@@ -0,0 +1,60 @@
+name: Build and upload to PyPI
+
+on:
+  workflow_dispatch:
+  pull_request:
+  push:
+    branches:
+      - main
+  release:
+    types:
+      - published
+
+jobs:
+  build_wheels:
+    name: Build wheels on ${{ matrix.os }} for Python ${{ matrix.python-version }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        #os: [ubuntu-latest, windows-2019, macOS-11]
+        os: [ubuntu-latest]
+        python-version: ["3.8", "3.9", "3.10", "3.11"]
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Mount bazel cache
+        uses: actions/cache@v3
+        with:
+          path: "~/.cache/bazel"
+          key: 'bazel-${{matrix.os}}-${{ matrix.python-version }}'
+
+      - name: Build wheel
+        run: |
+          sed -i 's/hermetic_python_version = "3.11"/hermetic_python_version = "${{ matrix.python-version }}"/' ./MODULE.bazel
+          cat MODULE.bazel
+          bazelisk build --config release //:wheel
+          bazelisk run //:wheel_rename
+
+      - uses: actions/upload-artifact@v3
+        with:
+          path: bazel-bin/*.whl
+
+  upload_pypi:
+    needs: [build_wheels]
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/project/tf-shell/
+    permissions:
+      id-token: write
+    if: github.event_name == 'release' && github.event.action == 'published'
+    steps:
+      - name: Download wheels
+        uses: actions/download-artifact@v3
+        with:
+          name: artifact
+          path: dist
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

.gitignore

@@ -1,10 +1,8 @@
 bazel-bin
-bazel-tfshell
+bazel-tf-shell
 bazel-out
 bazel-testlogs
-requirements.txt
 __pycache__
-.bazelrc
 **.venv
 *.whl
-MODULE.bazel.lock
+MODULE.bazel.lock

BUILD

@@ -1,5 +1,9 @@
 load("//:version.bzl", "VERSION_LABEL")
-load("@rules_python//python:pip.bzl", "compile_pip_requirements")
+load("@python_versions//3.8:defs.bzl", compile_pip_requirements_3_8 = "compile_pip_requirements")
+load("@python_versions//3.8:defs.bzl", compile_pip_requirements_3_9 = "compile_pip_requirements")
+load("@python_versions//3.8:defs.bzl", compile_pip_requirements_3_10 = "compile_pip_requirements")
+load("@python_versions//3.8:defs.bzl", compile_pip_requirements_3_11 = "compile_pip_requirements")
+
 load("@pip//:requirements.bzl", "requirement")
 load("@rules_python//python:defs.bzl", "py_binary")
 load("@rules_python//python:packaging.bzl", "py_wheel")
@@ -9,16 +13,43 @@ exports_files([
     "LICENSE",
     "setup.py",
     "requirements.in",
-    "requirements.txt",
+    "requirements_3_8.txt",
+    "requirements_3_9.txt",
+    "requirements_3_10.txt",
+    "requirements_3_11.txt",
     "README.md",
     "DESCRIPTION.md",
 ])
 
-compile_pip_requirements(
-    name = "requirements",
+compile_pip_requirements_3_8(
+    name = "requirements_3_8",
+    extra_args = ["--allow-unsafe"],  # need setuptools
+    requirements_in = "//:requirements.in",
+    requirements_txt = "//:requirements_3_8.txt",
+    visibility = ["//visibility:public"],
+)
+
+compile_pip_requirements_3_9(
+    name = "requirements_3_9",
+    extra_args = ["--allow-unsafe"],  # need setuptools
+    requirements_in = "//:requirements.in",
+    requirements_txt = "//:requirements_3_9.txt",
+    visibility = ["//visibility:public"],
+)
+
+compile_pip_requirements_3_10(
+    name = "requirements_3_10",
+    extra_args = ["--allow-unsafe"],  # need setuptools
+    requirements_in = "//:requirements.in",
+    requirements_txt = "//:requirements_3_10.txt",
+    visibility = ["//visibility:public"],
+)
+
+compile_pip_requirements_3_11(
+    name = "requirements_3_11",
     extra_args = ["--allow-unsafe"],  # need setuptools
     requirements_in = "//:requirements.in",
-    requirements_txt = "//:requirements.txt",
+    requirements_txt = "//:requirements_3_11.txt",
     visibility = ["//visibility:public"],
 )
 
@@ -54,16 +85,31 @@ py_binary(
     ],
 )
 
+py_binary(
+    name = "wheel_rename",
+    srcs = ["//tools:wheel_rename.py"],
+    python_version = "PY3",
+    srcs_version = "PY3",
+    visibility = [
+        "//:__pkg__",
+    ],
+    deps = [
+        requirement("packaging"),
+    ],
+)
+
 py_wheel(
     name = "wheel",
     abi = "ABI",
     author = "Google Inc.",
     author_email = "jchoncholas@google.com",
     classifiers = [
-        "Programming Language :: Python :: 3",
         "Topic :: Security :: Cryptography",
+        "Topic :: Scientific/Engineering :: Artificial Intelligence",
+        "Topic :: Software Development :: Libraries :: Python Modules",
+        "Topic :: Scientific/Engineering :: Mathematics",
     ],
-    description_file = "//:DESCRIPTION.md",
+    description_file = "//:README.md",
     distribution = "tf-shell",
     extra_distinfo_files = {
         "//:LICENSE": "LICENSE",
@@ -82,6 +128,7 @@ py_wheel(
     python_requires = ">=3.8.0",
     python_tag = "INTERPRETER",
     requires = ["tensorflow-cpu==2.13.0"],
+    summary = "TF-Shell: Privacy preserving machine learning with Tensorflow and the SHELL encryption library",
     version = VERSION_LABEL,
     deps = [
         "//shell_ml:shell_ml_pkg",

MODULE.bazel

@@ -1,15 +1,79 @@
 module(
-    name = "tfshell",
+    name = "tf_shell",
     version = "0.0.1",
 )
 
-bazel_dep(name = "rules_python", version = "0.23.1")
+hermetic_python_version = "3.11"
+
+hermetic_python_version_short = hermetic_python_version.replace(".", "_")
+
+bazel_dep(name = "rules_python", version = "0.25.0")
+
+python = use_extension("@rules_python//python/extensions:python.bzl", "python")
+python.toolchain(
+    is_default = hermetic_python_version == "3.8",
+    python_version = "3.8",
+)
+python.toolchain(
+    is_default = hermetic_python_version == "3.9",
+    python_version = "3.9",
+)
+python.toolchain(
+    is_default = hermetic_python_version == "3.10",
+    python_version = "3.10",
+)
+python.toolchain(
+    is_default = hermetic_python_version == "3.11",
+    python_version = "3.11",
+)
+use_repo(python,
+    "python_3_8", "python_3_8_x86_64-unknown-linux-gnu", 
+    "python_3_9", "python_3_9_x86_64-unknown-linux-gnu", 
+    "python_3_10", "python_3_10_x86_64-unknown-linux-gnu", 
+    "python_3_11", "python_3_11_x86_64-unknown-linux-gnu", 
+    "python_versions")
 
 pip = use_extension("@rules_python//python/extensions:pip.bzl", "pip")
 pip.parse(
-    name = "pip",
-    requirements_lock = "//:requirements.txt",
+    hub_name = "pip",
+    python_version = "3.8",
+    requirements_lock = "//:requirements_3_8.txt",
+)
+pip.parse(
+    hub_name = "pip",
+    python_version = "3.9",
+    requirements_lock = "//:requirements_3_9.txt",
+)
+pip.parse(
+    hub_name = "pip",
+    python_version = "3.10",
+    requirements_lock = "//:requirements_3_10.txt",
+)
+pip.parse(
+    hub_name = "pip",
+    python_version = "3.11",
+    requirements_lock = "//:requirements_3_11.txt",
 )
 use_repo(pip, "pip")
 
 bazel_dep(name = "buildifier_prebuilt", version = "6.1.0", dev_dependency = True)
+
+
+bazel_dep(name = "pybind11_bazel", version = "2.11.1")
+python_configure = use_extension("@pybind11_bazel//:python_configure.bzl", "extension")
+
+#python_configure.toolchain(python_interpreter_target = "@python_versions//3.11:defs.bzl")
+#  above points to $(bazel info output_base)/external/rules_python~0.25.0~python~python_versions/3.11/defs.bzl
+#  and loads the repo @python_3_11//:defs
+#python_configure.toolchain(python_interpreter_target = "@python_3_11//:defs.bzl")
+#  above points to ""
+#  and says the interpreter is "@python_3_11_x86_64-unknown-linux-gnu//:bin/python3"
+# the above repo must be in the use_repo statement of rules_python
+# something like below would be much better but I don't know how to get a
+# plain old variable from a modules bzl file in this context.
+#load("@python_3_11//:defs.bzl", "interpreter")
+python_configure.toolchain(
+    python_interpreter_target = "@python_" + hermetic_python_version_short + "_x86_64-unknown-linux-gnu//:bin/python3"
+)
+
+use_repo(python_configure, "local_config_python", "pybind11")