- CI arrives in .gitea/workflows/ci.yml and calls the shared driver
workflow of NAPALM/driver-standard; the repo had none before.
- setuptools>=77 and the SPDX license string PEP 639 wants, without the
License classifier; napalm-device-types>=4.21.1 from PyPI; Issues and
Changelog links on git.netork.io. LICENSE, NOTICE and py.typed were
already there and stay.
- The test extra becomes the dev extra of the standard, plus responses,
which the tests mock AMT with.
- mypy strict with the untyped imports (napalm, requests, defusedxml)
named instead of ignored globally; napalm_amt.driver is exempt for now
(5 errors: getters return dicts where the role declares TypedDicts),
recorded in tests/quality_baseline.json with get_event_log's
complexity of 11.
- Coverage floor 95 % (measured 95.87 %).
- CHANGELOG.md in Keep a Changelog form; the README's development steps
install from PyPI.
- WS-Management answers are parsed with defusedxml (new dependency,
defusedxml>=0.7) with DTDs forbidden. The check for "<!DOCTYPE" in the raw
bytes it replaces missed a DTD in a UTF-16 answer, which expat reads too;
on plain HTTP (16992) anyone in the path can send one. An answer with a
DTD in any encoding is now refused as no WS-Management answer, as a UTF-8
one already was (B314, B405).
- xml.sax.saxutils only escapes the request envelopes, nothing parses with
SAX (nosec B406).
- python -m napalm_amt.record fetches the landing page without certificate
checks, as before: it sends no credentials and records what discovery
sees, and AMT's certificate is self-signed unless one was provisioned
(nosec B501). The driver itself still verifies by default (verify_ssl).
Mechanical: the rule set every NAPALM driver uses (E, F, I, UP, B at line
length 100, Python 3.10), with E501 off under tests/. The code was already
formatted and clean under it; what ruff cannot fix comes in the next commit.
An `amt` driver (napalm_amt.AmtDriver), a ManagementControllerDriver for the
management controller of Intel vPro machines, with its own lean WS-Management
client (requests + ElementTree, HTTP Digest, ports 16992/16993).
It reads the machine's identity, hardware with the SMBIOS system UUID, firmware
(AMT with build, BIOS), power state and the hardware event log, reports what AMT
listens on (plain HTTP or TLS, KVM incl. port 5900, IDE-R), and switches the
machine's power. AMT cannot be reset over WS-Management, so there is no
reboot_host. Discovery recognises AMT by its ports and its Server header.
Tested against Intel's published AMT 12 recordings (go-wsman-messages,
Apache-2.0, see NOTICE). `python -m napalm_amt.record` records a real AMT
read-only; the first test devices are two Lenovo ThinkCentre M910x.
christianmanivong