From 0ba48ab5e6bc74efba1f8aa924aa234887c43671 Mon Sep 17 00:00:00 2001
From: Schamper <1254028+Schamper@users.noreply.github.com>
Date: Tue, 2 Sep 2025 10:54:21 +0200
Subject: [PATCH 1/3] Add implementation
---
.gitattributes | 1 +
.github/pull_request_template.md | 24 ++
.github/workflows/dissect-ci.yml | 37 ++
.gitignore | 11 +
COPYRIGHT | 5 +
LICENSE | 661 +++++++++++++++++++++++++++++++
MANIFEST.in | 2 +
README.md | 49 +++
dissect/bsddb/__init__.py | 3 +
dissect/bsddb/bsddb.py | 267 +++++++++++++
dissect/bsddb/c_bsddb.py | 596 ++++++++++++++++++++++++++++
dissect/bsddb/c_bsddb.pyi | 559 ++++++++++++++++++++++++++
dissect/bsddb/tools/__init__.py | 0
dissect/bsddb/tools/c_rpm.py | 465 ++++++++++++++++++++++
dissect/bsddb/tools/c_rpm.pyi | 461 +++++++++++++++++++++
dissect/bsddb/tools/rpm.py | 241 +++++++++++
pyproject.toml | 117 ++++++
tests/__init__.py | 0
tests/_data/btree.db.gz | 3 +
tests/_data/hash.db.gz | 3 +
tests/_data/recno.db.gz | 3 +
tests/_data/rpm/Packages.gz | 3 +
tests/_docs/Makefile | 24 ++
tests/_docs/conf.py | 41 ++
tests/_docs/index.rst | 8 +
tests/conftest.py | 44 ++
tests/test_bsddb.py | 41 ++
tests/test_rpm.py | 52 +++
tox.ini | 64 +++
29 files changed, 3785 insertions(+)
create mode 100644 .gitattributes
create mode 100644 .github/pull_request_template.md
create mode 100644 .github/workflows/dissect-ci.yml
create mode 100644 .gitignore
create mode 100644 COPYRIGHT
create mode 100644 LICENSE
create mode 100644 MANIFEST.in
create mode 100644 README.md
create mode 100644 dissect/bsddb/__init__.py
create mode 100644 dissect/bsddb/bsddb.py
create mode 100644 dissect/bsddb/c_bsddb.py
create mode 100644 dissect/bsddb/c_bsddb.pyi
create mode 100644 dissect/bsddb/tools/__init__.py
create mode 100644 dissect/bsddb/tools/c_rpm.py
create mode 100644 dissect/bsddb/tools/c_rpm.pyi
create mode 100644 dissect/bsddb/tools/rpm.py
create mode 100644 pyproject.toml
create mode 100644 tests/__init__.py
create mode 100644 tests/_data/btree.db.gz
create mode 100644 tests/_data/hash.db.gz
create mode 100644 tests/_data/recno.db.gz
create mode 100644 tests/_data/rpm/Packages.gz
create mode 100644 tests/_docs/Makefile
create mode 100644 tests/_docs/conf.py
create mode 100644 tests/_docs/index.rst
create mode 100644 tests/conftest.py
create mode 100644 tests/test_bsddb.py
create mode 100644 tests/test_rpm.py
create mode 100755 tox.ini
diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..9b4f63f
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1 @@
+tests/_data/** filter=lfs diff=lfs merge=lfs -text
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
new file mode 100644
index 0000000..52a77a5
--- /dev/null
+++ b/.github/pull_request_template.md
@@ -0,0 +1,24 @@
+
diff --git a/.github/workflows/dissect-ci.yml b/.github/workflows/dissect-ci.yml
new file mode 100644
index 0000000..b7b844a
--- /dev/null
+++ b/.github/workflows/dissect-ci.yml
@@ -0,0 +1,37 @@
+name: Dissect CI
+on:
+ push:
+ branches:
+ - main
+ tags:
+ - '*'
+ pull_request:
+ workflow_dispatch:
+
+jobs:
+ ci:
+ uses: fox-it/dissect-workflow-templates/.github/workflows/dissect-ci-template.yml@main
+ secrets: inherit
+
+ publish:
+ if: ${{ github.ref_name == 'main' || github.ref_type == 'tag' }}
+ needs: [ci]
+ runs-on: ubuntu-latest
+ environment: dissect_publish
+ permissions:
+ id-token: write
+ steps:
+ - uses: actions/download-artifact@v4
+ with:
+ name: packages
+ path: dist/
+ # According to the documentation, it automatically looks inside the `dist/` folder for packages.
+ - name: Publish package distributions to Pypi
+ uses: pypa/gh-action-pypi-publish@release/v1
+
+ trigger-tests:
+ needs: [publish]
+ uses: fox-it/dissect-workflow-templates/.github/workflows/dissect-ci-demand-test-template.yml@main
+ secrets: inherit
+ with:
+ on-demand-test: 'dissect.target'
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..2e944b3
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,11 @@
+coverage.xml
+.coverage
+dist/
+.eggs/
+*.egg-info/
+*.pyc
+__pycache__/
+.pytest_cache/
+tests/_docs/api
+tests/_docs/build
+.tox/
diff --git a/COPYRIGHT b/COPYRIGHT
new file mode 100644
index 0000000..42a7d9e
--- /dev/null
+++ b/COPYRIGHT
@@ -0,0 +1,5 @@
+Dissect is released as open source by Fox-IT (https://www.fox-it.com) part of NCC Group Plc (https://www.nccgroup.com)
+
+Developed by the Dissect Team (dissect@fox-it.com) and made available at https://github.com/fox-it/dissect.bsddb
+
+License terms: AGPL3 (https://www.gnu.org/licenses/agpl-3.0.html)
diff --git a/LICENSE b/LICENSE
new file mode 100644
index 0000000..be3f7b2
--- /dev/null
+++ b/LICENSE
@@ -0,0 +1,661 @@
+ GNU AFFERO GENERAL PUBLIC LICENSE
+ Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc.
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+ Preamble
+
+ The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+ The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works. By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+ When we speak of free software, we are referring to freedom, not
+price. Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+ Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+ A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate. Many developers of free software are heartened and
+encouraged by the resulting cooperation. However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+ The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community. It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server. Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+ An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals. This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+ The precise terms and conditions for copying, distribution and
+modification follow.
+
+ TERMS AND CONDITIONS
+
+ 0. Definitions.
+
+ "This License" refers to version 3 of the GNU Affero General Public License.
+
+ "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+ "The Program" refers to any copyrightable work licensed under this
+License. Each licensee is addressed as "you". "Licensees" and
+"recipients" may be individuals or organizations.
+
+ To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy. The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+ A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+ To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy. Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+ To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies. Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+ An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License. If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+ 1. Source Code.
+
+ The "source code" for a work means the preferred form of the work
+for making modifications to it. "Object code" means any non-source
+form of a work.
+
+ A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+ The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form. A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+ The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities. However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work. For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+ The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+ The Corresponding Source for a work in source code form is that
+same work.
+
+ 2. Basic Permissions.
+
+ All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met. This License explicitly affirms your unlimited
+permission to run the unmodified Program. The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work. This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+ You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force. You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright. Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+ Conveying under any other circumstances is permitted solely under
+the conditions stated below. Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+ 3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+ No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+ When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+ 4. Conveying Verbatim Copies.
+
+ You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+ You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+ 5. Conveying Modified Source Versions.
+
+ You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+ a) The work must carry prominent notices stating that you modified
+ it, and giving a relevant date.
+
+ b) The work must carry prominent notices stating that it is
+ released under this License and any conditions added under section
+ 7. This requirement modifies the requirement in section 4 to
+ "keep intact all notices".
+
+ c) You must license the entire work, as a whole, under this
+ License to anyone who comes into possession of a copy. This
+ License will therefore apply, along with any applicable section 7
+ additional terms, to the whole of the work, and all its parts,
+ regardless of how they are packaged. This License gives no
+ permission to license the work in any other way, but it does not
+ invalidate such permission if you have separately received it.
+
+ d) If the work has interactive user interfaces, each must display
+ Appropriate Legal Notices; however, if the Program has interactive
+ interfaces that do not display Appropriate Legal Notices, your
+ work need not make them do so.
+
+ A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit. Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+ 6. Conveying Non-Source Forms.
+
+ You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+ a) Convey the object code in, or embodied in, a physical product
+ (including a physical distribution medium), accompanied by the
+ Corresponding Source fixed on a durable physical medium
+ customarily used for software interchange.
+
+ b) Convey the object code in, or embodied in, a physical product
+ (including a physical distribution medium), accompanied by a
+ written offer, valid for at least three years and valid for as
+ long as you offer spare parts or customer support for that product
+ model, to give anyone who possesses the object code either (1) a
+ copy of the Corresponding Source for all the software in the
+ product that is covered by this License, on a durable physical
+ medium customarily used for software interchange, for a price no
+ more than your reasonable cost of physically performing this
+ conveying of source, or (2) access to copy the
+ Corresponding Source from a network server at no charge.
+
+ c) Convey individual copies of the object code with a copy of the
+ written offer to provide the Corresponding Source. This
+ alternative is allowed only occasionally and noncommercially, and
+ only if you received the object code with such an offer, in accord
+ with subsection 6b.
+
+ d) Convey the object code by offering access from a designated
+ place (gratis or for a charge), and offer equivalent access to the
+ Corresponding Source in the same way through the same place at no
+ further charge. You need not require recipients to copy the
+ Corresponding Source along with the object code. If the place to
+ copy the object code is a network server, the Corresponding Source
+ may be on a different server (operated by you or a third party)
+ that supports equivalent copying facilities, provided you maintain
+ clear directions next to the object code saying where to find the
+ Corresponding Source. Regardless of what server hosts the
+ Corresponding Source, you remain obligated to ensure that it is
+ available for as long as needed to satisfy these requirements.
+
+ e) Convey the object code using peer-to-peer transmission, provided
+ you inform other peers where the object code and Corresponding
+ Source of the work are being offered to the general public at no
+ charge under subsection 6d.
+
+ A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+ A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling. In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage. For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product. A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+ "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source. The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+ If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information. But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+ The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed. Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+ Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+ 7. Additional Terms.
+
+ "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law. If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+ When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it. (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.) You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+ Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+ a) Disclaiming warranty or limiting liability differently from the
+ terms of sections 15 and 16 of this License; or
+
+ b) Requiring preservation of specified reasonable legal notices or
+ author attributions in that material or in the Appropriate Legal
+ Notices displayed by works containing it; or
+
+ c) Prohibiting misrepresentation of the origin of that material, or
+ requiring that modified versions of such material be marked in
+ reasonable ways as different from the original version; or
+
+ d) Limiting the use for publicity purposes of names of licensors or
+ authors of the material; or
+
+ e) Declining to grant rights under trademark law for use of some
+ trade names, trademarks, or service marks; or
+
+ f) Requiring indemnification of licensors and authors of that
+ material by anyone who conveys the material (or modified versions of
+ it) with contractual assumptions of liability to the recipient, for
+ any liability that these contractual assumptions directly impose on
+ those licensors and authors.
+
+ All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10. If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term. If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+ If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+ Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+ 8. Termination.
+
+ You may not propagate or modify a covered work except as expressly
+provided under this License. Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+ However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+ Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+ Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License. If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+ 9. Acceptance Not Required for Having Copies.
+
+ You are not required to accept this License in order to receive or
+run a copy of the Program. Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance. However,
+nothing other than this License grants you permission to propagate or
+modify any covered work. These actions infringe copyright if you do
+not accept this License. Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+ 10. Automatic Licensing of Downstream Recipients.
+
+ Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License. You are not responsible
+for enforcing compliance by third parties with this License.
+
+ An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations. If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+ You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License. For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+ 11. Patents.
+
+ A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based. The
+work thus licensed is called the contributor's "contributor version".
+
+ A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version. For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+ Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+ In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement). To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+ If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients. "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+ If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+ A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License. You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+ Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+ 12. No Surrender of Others' Freedom.
+
+ If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License. If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all. For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+ 13. Remote Network Interaction; Use with the GNU General Public License.
+
+ Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software. This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+ Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work. The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+ 14. Revised Versions of this License.
+
+ The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time. Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+ Each version is given a distinguishing version number. If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation. If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+ If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+ Later license versions may give you additional or different
+permissions. However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+ 15. Disclaimer of Warranty.
+
+ THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+ 16. Limitation of Liability.
+
+ IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+ 17. Interpretation of Sections 15 and 16.
+
+ If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+ END OF TERMS AND CONDITIONS
+
+ How to Apply These Terms to Your New Programs
+
+ If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+ To do so, attach the following notices to the program. It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+
+ Copyright (C)
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU Affero General Public License for more details.
+
+ You should have received a copy of the GNU Affero General Public License
+ along with this program. If not, see .
+
+Also add information on how to contact you by electronic and paper mail.
+
+ If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source. For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code. There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+ You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+.
diff --git a/MANIFEST.in b/MANIFEST.in
new file mode 100644
index 0000000..9ae349b
--- /dev/null
+++ b/MANIFEST.in
@@ -0,0 +1,2 @@
+exclude .gitignore
+recursive-exclude .github/ *
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..a0af46c
--- /dev/null
+++ b/README.md
@@ -0,0 +1,49 @@
+# dissect.bsddb
+
+A Dissect module implementing a parser for the Berkeley DB format. For more information,
+please see [the documentation](https://docs.dissect.tools/en/latest/projects/dissect.bsddb/index.html).
+
+## Installation
+
+`dissect.bsddb` is available on [PyPI](https://pypi.org/project/dissect.bsddb/).
+
+```bash
+pip install dissect.bsddb
+```
+
+This module is also automatically installed if you install the `dissect` package.
+
+## Build and test instructions
+
+This project uses `tox` to build source and wheel distributions. Run the following command from the root folder to build
+these:
+
+```bash
+tox -e build
+```
+
+The build artifacts can be found in the `dist/` directory.
+
+`tox` is also used to run linting and unit tests in a self-contained environment. To run both linting and unit tests
+using the default installed Python version, run:
+
+```bash
+tox
+```
+
+For a more elaborate explanation on how to build and test the project, please see [the
+documentation](https://docs.dissect.tools/en/latest/contributing/tooling.html).
+
+## Contributing
+
+The Dissect project encourages any contribution to the codebase. To make your contribution fit into the project, please
+refer to [the development guide](https://docs.dissect.tools/en/latest/contributing/developing.html).
+
+## Copyright and license
+
+Dissect is released as open source by Fox-IT () part of NCC Group Plc
+().
+
+Developed by the Dissect Team () and made available at .
+
+License terms: AGPL3 (). For more information, see the LICENSE file.
diff --git a/dissect/bsddb/__init__.py b/dissect/bsddb/__init__.py
new file mode 100644
index 0000000..138308c
--- /dev/null
+++ b/dissect/bsddb/__init__.py
@@ -0,0 +1,3 @@
+from dissect.bsddb.bsddb import DB
+
+__all__ = ["DB"]
diff --git a/dissect/bsddb/bsddb.py b/dissect/bsddb/bsddb.py
new file mode 100644
index 0000000..bd92701
--- /dev/null
+++ b/dissect/bsddb/bsddb.py
@@ -0,0 +1,267 @@
+from __future__ import annotations
+
+from functools import cached_property, lru_cache
+from typing import TYPE_CHECKING, BinaryIO, Union
+
+from dissect.bsddb.c_bsddb import c_db
+
+if TYPE_CHECKING:
+ from collections.abc import Iterator
+
+
+DBT = tuple[
+ # Change to | when we drop Python 3.9 support
+ Union[c_db.HOFFPAGE, c_db.HKEYDATA, c_db.HEAPHDR, c_db.BKEYDATA, c_db.BOVERFLOW, c_db.BINTERNAL, c_db.RINTERNAL],
+ bytes,
+]
+"""An internal page entry structure + data (loosely related to Data-Base Thang)."""
+
+
+class DB:
+ """Berkeley DB.
+
+ Args:
+ fh: File-like object containing the Berkeley DB data.
+ """
+
+ def __init__(self, fh: BinaryIO):
+ self.fh = fh
+ self.fh.seek(0)
+
+ meta = c_db.DBMETA(self.fh)
+ self.fh.seek(0)
+
+ if meta.magic == c_db.DB_BTREEMAGIC and meta.type == c_db.P_BTREEMETA:
+ self.meta = c_db.BTMETA(self.fh)
+ elif meta.magic == c_db.DB_HASHMAGIC and meta.type == c_db.P_HASHMETA:
+ self.meta = c_db.HMETA(self.fh)
+ else:
+ raise NotImplementedError(f"Unsupported DB type: {meta.magic:#x} {meta.type}")
+
+ self.page_size = self.meta.dbmeta.pagesize
+
+ page_overhead = len(c_db.PAGE)
+ if self.meta.dbmeta.flags & c_db.DB_AM_ENCRYPT:
+ page_overhead += len(c_db.PG_CRYPTO)
+ elif self.meta.dbmeta.flags & c_db.DB_AM_CHKSUM:
+ page_overhead += len(c_db.PG_CHKSUM)
+ self._page_overhead = page_overhead
+
+ self.page = lru_cache(128)(self.page)
+
+ @property
+ def is_btree(self) -> bool:
+ """Return whether the database of a ``DB_BTREE`` type."""
+ return self.meta.dbmeta.magic == c_db.DB_BTREEMAGIC
+
+ @property
+ def is_recno(self) -> bool:
+ """Return whether the database is a ``DB_RECNO`` type."""
+ return self.is_btree and (self.meta.dbmeta.flags & c_db.BTM_RECNO) != 0
+
+ @property
+ def is_hash(self) -> bool:
+ """Return whether the database is a ``DB_HASH`` type."""
+ return self.meta.dbmeta.magic == c_db.DB_HASHMAGIC
+
+ def page(self, pgno: int) -> Page:
+ """Get a single page by page number.
+
+ Args:
+ pgno: Page number to retrieve.
+ """
+ return Page(self, pgno)
+
+ def records(self) -> Iterator[tuple[bytes | int, bytes]]:
+ """Iterate over all records in the database."""
+ it = self._iter_db()
+
+ if (self.is_btree and not self.is_recno) or self.is_hash:
+ # Hash and Btree are stored in pairs
+ while entry := next(it, None):
+ _, key = entry
+ _, data = next(it)
+ yield bytes(key), bytes(data)
+ elif self.is_recno:
+ i = 0
+ while entry := next(it, None):
+ i += 1
+ dbt, data = entry
+ if dbt.type & c_db.B_DELETE:
+ continue
+ yield i, bytes(data)
+
+ def _iter_db(self) -> Iterator[DBT]:
+ if self.is_btree:
+ yield from self._iter_btree()
+ elif self.is_hash:
+ yield from self._iter_hash()
+ else:
+ raise NotImplementedError("Unsupported DB type")
+
+ def _iter_btree(self) -> Iterator[DBT]:
+ yield from self._walk_btree(self.meta.root)
+
+ def _walk_btree(self, pgno: int) -> Iterator[DBT]:
+ page = self.page(pgno)
+ if page.header.type in (c_db.P_IBTREE, c_db.P_IRECNO):
+ # Internal page
+ for entry, _ in page.entries():
+ yield from self._walk_btree(entry.pgno)
+ elif page.header.type in (c_db.P_LBTREE, c_db.P_LRECNO):
+ # Leaf page
+ yield from page.entries()
+
+ def _iter_hash(self) -> Iterator[DBT]:
+ for i in range(self.meta.max_bucket + 1):
+ pgno = BUCKET_TO_PAGE(self, i)
+ yield from self._walk_hash(pgno)
+
+ def _walk_hash(self, pgno: int) -> Iterator[DBT]:
+ page = self.page(pgno)
+ yield from page.entries()
+
+ if page.header.next_pgno:
+ yield from self._walk_hash(page.header.next_pgno)
+
+
+class Page:
+ """A single page in a Berkeley DB.
+
+ Args:
+ db: The parent ``DB`` instance.
+ pgno: The page number to load.
+ """
+
+ def __init__(self, db: DB, pgno: int):
+ self.db = db
+ self.pgno = pgno
+ self.offset = pgno * self.db.page_size
+
+ @cached_property
+ def raw(self) -> bytes:
+ """Raw page data."""
+ self.db.fh.seek(self.offset)
+ return self.db.fh.read(self.db.page_size)
+
+ @cached_property
+ def data(self) -> bytes:
+ """Page data, excluding any overhead (headers)."""
+ return memoryview(self.raw)[self.db._page_overhead :]
+
+ @cached_property
+ def header(self) -> c_db.PAGE:
+ """Page header."""
+ return c_db.PAGE(self.raw)
+
+ @property
+ def type(self) -> int:
+ """Page type."""
+ return self.header.type
+
+ @cached_property
+ def lookup(self) -> list[int]:
+ """List of offsets to entries in the page."""
+ if self.header.type in (c_db.P_LBTREE, c_db.P_IBTREE, c_db.P_LRECNO, c_db.P_IRECNO, c_db.P_HASH):
+ return c_db.uint16[self.header.entries](self.data)
+ return []
+
+ def entry(self, index: int) -> DBT:
+ """Get a single entry by index. Type depends on page type.
+
+ Also returns the associated data (DBT, Data-Base Thang, or key/data buffer) if applicable.
+
+ References:
+ - ``__db_ret``
+
+ Args:
+ index: Index of the entry to retrieve.
+ """
+ if index >= len(self.lookup):
+ raise IndexError("Index out of range")
+
+ buf = memoryview(self.raw)[self.lookup[index] :]
+ # These are the types that can be DBTs
+ if self.header.type in (c_db.P_HASH_UNSORTED, c_db.P_HASH):
+ if buf[0] == c_db.H_OFFPAGE:
+ entry = c_db.HOFFPAGE(buf)
+ return entry, overflow_data(self.db, entry.pgno, entry.tlen)
+
+ next_offset = self.db.page_size if index == 0 else self.lookup[index - 1]
+ data_length = (next_offset - self.lookup[index]) - len(c_db.HKEYDATA)
+
+ return c_db.HKEYDATA(buf), buf[len(c_db.HKEYDATA) : len(c_db.HKEYDATA) + data_length]
+ if self.header.type == c_db.P_HEAP:
+ entry = c_db.HEAPHDR(buf)
+ if entry.flags & (c_db.HEAP_RECSPLIT | c_db.HEAP_RECFIRST):
+ raise NotImplementedError("Heap split records not implemented")
+ return entry, buf[len(c_db.HEAPHDR) : len(c_db.HEAPHDR) + entry.size]
+ if self.header.type in (c_db.P_LBTREE, c_db.P_LDUP, c_db.P_LRECNO):
+ entry = c_db.BKEYDATA(buf)
+ if entry.type == c_db.B_OVERFLOW:
+ entry = c_db.BOVERFLOW(buf)
+ return entry, overflow_data(self.db, entry.pgno, entry.tlen)
+
+ return entry, buf[len(c_db.BKEYDATA) : len(c_db.BKEYDATA) + entry.len]
+
+ # These are more internal types, but we still want to parse them
+ if self.header.type == c_db.P_IBTREE:
+ entry = c_db.BINTERNAL(buf)
+ return entry, buf[len(c_db.BINTERNAL) : len(c_db.BINTERNAL) + entry.len]
+
+ if self.header.type == c_db.P_IRECNO:
+ return c_db.RINTERNAL(buf), b""
+
+ raise NotImplementedError(f"Page type not implemented: {self.header.type}")
+
+ def entries(self) -> Iterator[DBT]:
+ """Iterate over all entries in the page."""
+ if not self.header.entries:
+ raise TypeError("Page doesn't have iterable entries")
+
+ for idx in range(self.header.entries):
+ yield self.entry(idx)
+
+
+def overflow_data(db: DB, pgno: int, size: int) -> bytes:
+ """Get off-page data.
+
+ References:
+ - ``__db_goff``
+
+ Args:
+ db: The parent ``DB`` instance.
+ pgno: The starting page number of the overflow data.
+ size: The total size of the overflow data to read.
+ """
+ result = []
+ while size > 0 and pgno != c_db.PGNO_INVALID:
+ page = db.page(pgno)
+ if page.type != c_db.P_OVERFLOW:
+ raise ValueError(f"Expected overflow page, got {page.type} (pgno={pgno})")
+
+ read_size = min(size, page.header.hf_offset)
+ result.append(page.data[:read_size])
+ size -= read_size
+
+ pgno = page.header.next_pgno
+
+ return b"".join(result)
+
+
+def _db_log2(num: int) -> int:
+ i = 0
+ limit = 1
+ while limit < num:
+ i += 1
+ limit = limit << 1
+
+ return i
+
+
+def BS_TO_PAGE(bucket: int, spares: list[int]) -> int:
+ return bucket + spares[_db_log2(bucket + 1)]
+
+
+def BUCKET_TO_PAGE(db: DB, bucket: int) -> int:
+ return BS_TO_PAGE(bucket, db.meta.spares)
diff --git a/dissect/bsddb/c_bsddb.py b/dissect/bsddb/c_bsddb.py
new file mode 100644
index 0000000..3e3f8c0
--- /dev/null
+++ b/dissect/bsddb/c_bsddb.py
@@ -0,0 +1,596 @@
+from __future__ import annotations
+
+from dissect.cstruct import cstruct
+
+db_def = """
+typedef uint8 u_int8_t;
+typedef uint16 u_int16_t;
+typedef uint32 u_int32_t;
+
+typedef u_int32_t db_pgno_t; /* Page number type. */
+typedef u_int16_t db_indx_t; /* Page offset type. */
+#define DB_MAX_PAGES 0xffffffff /* >= # of pages in a file */
+
+typedef u_int32_t db_recno_t; /* Record number type. */
+#define DB_MAX_RECORDS 0xffffffff /* >= # of records in a tree */
+
+typedef struct _db_lsn {
+ uint32 file;
+ uint32 offset;
+} DB_LSN;
+
+#define DB_FILE_ID_LEN 20 /* Unique file ID length. */
+
+/*******************************************************
+ * Crypto.
+ *******************************************************/
+#define DB_IV_BYTES 16 /* Bytes per IV */
+#define DB_MAC_KEY 20 /* Bytes per MAC checksum */
+
+#define DB_RENAMEMAGIC 0x030800 /* File has been renamed. */
+
+#define DB_BTREEVERSION 9 /* Current btree version. */
+#define DB_BTREEOLDVER 8 /* Oldest btree version supported. */
+#define DB_BTREEMAGIC 0x053162
+
+#define DB_HASHVERSION 9 /* Current hash version. */
+#define DB_HASHOLDVER 7 /* Oldest hash version supported. */
+#define DB_HASHMAGIC 0x061561
+
+#define DB_HEAPVERSION 1 /* Current heap version. */
+#define DB_HEAPOLDVER 1 /* Oldest heap version supported. */
+#define DB_HEAPMAGIC 0x074582
+
+#define DB_QAMVERSION 4 /* Current queue version. */
+#define DB_QAMOLDVER 3 /* Oldest queue version supported. */
+#define DB_QAMMAGIC 0x042253
+
+#define DB_SEQUENCE_VERSION 2 /* Current sequence version. */
+#define DB_SEQUENCE_OLDVER 1 /* Oldest sequence version supported. */
+
+#define DB_AM_CHKSUM 0x00000001 /* Checksumming */
+#define DB_AM_COMPENSATE 0x00000002 /* Created by compensating txn */
+#define DB_AM_COMPRESS 0x00000004 /* Compressed BTree */
+#define DB_AM_CREATED 0x00000008 /* Database was created upon open */
+#define DB_AM_CREATED_MSTR 0x00000010 /* Encompassing file was created */
+#define DB_AM_DBM_ERROR 0x00000020 /* Error in DBM/NDBM database */
+#define DB_AM_DELIMITER 0x00000040 /* Variable length delimiter set */
+#define DB_AM_DISCARD 0x00000080 /* Discard any cached pages */
+#define DB_AM_DUP 0x00000100 /* DB_DUP */
+#define DB_AM_DUPSORT 0x00000200 /* DB_DUPSORT */
+#define DB_AM_ENCRYPT 0x00000400 /* Encryption */
+#define DB_AM_FIXEDLEN 0x00000800 /* Fixed-length records */
+#define DB_AM_INMEM 0x00001000 /* In-memory; no sync on close */
+#define DB_AM_INORDER 0x00002000 /* DB_INORDER */
+#define DB_AM_IN_RENAME 0x00004000 /* File is being renamed */
+#define DB_AM_NOT_DURABLE 0x00008000 /* Do not log changes */
+#define DB_AM_OPEN_CALLED 0x00010000 /* DB->open called */
+#define DB_AM_PAD 0x00020000 /* Fixed-length record pad */
+#define DB_AM_PARTDB 0x00040000 /* Handle for a database partition */
+#define DB_AM_PGDEF 0x00080000 /* Page size was defaulted */
+#define DB_AM_RDONLY 0x00100000 /* Database is readonly */
+#define DB_AM_READ_UNCOMMITTED 0x00200000 /* Support degree 1 isolation */
+#define DB_AM_RECNUM 0x00400000 /* DB_RECNUM */
+#define DB_AM_RECOVER 0x00800000 /* DB opened by recovery routine */
+#define DB_AM_RENUMBER 0x01000000 /* DB_RENUMBER */
+#define DB_AM_REVSPLITOFF 0x02000000 /* DB_REVSPLITOFF */
+#define DB_AM_SECONDARY 0x04000000 /* Database is a secondary index */
+#define DB_AM_SNAPSHOT 0x08000000 /* DB_SNAPSHOT */
+#define DB_AM_SUBDB 0x10000000 /* Subdatabases supported */
+#define DB_AM_SWAP 0x20000000 /* Pages need to be byte-swapped */
+#define DB_AM_TXN 0x40000000 /* Opened in a transaction */
+#define DB_AM_VERIFYING 0x80000000 /* DB handle is in the verifier */
+
+/*
+ * DB page formats.
+ *
+ * !!!
+ * This implementation requires that values within the following structures
+ * NOT be padded -- note, ANSI C permits random padding within structures.
+ * If your compiler pads randomly you can just forget ever making DB run on
+ * your system. In addition, no data type can require larger alignment than
+ * its own size, e.g., a 4-byte data element may not require 8-byte alignment.
+ *
+ * Note that key/data lengths are often stored in db_indx_t's -- this is
+ * not accidental, nor does it limit the key/data size. If the key/data
+ * item fits on a page, it's guaranteed to be small enough to fit into a
+ * db_indx_t, and storing it in one saves space.
+ */
+
+#define PGNO_INVALID 0 /* Invalid page number in any database. */
+#define PGNO_BASE_MD 0 /* Base database: metadata page number. */
+
+/* Page types. */
+#define P_INVALID 0 /* Invalid page type. */
+#define __P_DUPLICATE 1 /* Duplicate. DEPRECATED in 3.1 */
+#define P_HASH_UNSORTED 2 /* Hash pages created pre 4.6. DEPRECATED */
+#define P_IBTREE 3 /* Btree internal. */
+#define P_IRECNO 4 /* Recno internal. */
+#define P_LBTREE 5 /* Btree leaf. */
+#define P_LRECNO 6 /* Recno leaf. */
+#define P_OVERFLOW 7 /* Overflow. */
+#define P_HASHMETA 8 /* Hash metadata page. */
+#define P_BTREEMETA 9 /* Btree metadata page. */
+#define P_QAMMETA 10 /* Queue metadata page. */
+#define P_QAMDATA 11 /* Queue data page. */
+#define P_LDUP 12 /* Off-page duplicate leaf. */
+#define P_HASH 13 /* Sorted hash page. */
+#define P_HEAPMETA 14 /* Heap metadata page. */
+#define P_HEAP 15 /* Heap data page. */
+#define P_IHEAP 16 /* Heap internal. */
+#define P_PAGETYPE_MAX 17
+
+/*
+ * When we create pages in mpool, we ask mpool to clear some number of bytes
+ * in the header. This number must be at least as big as the regular page
+ * headers and cover enough of the btree and hash meta-data pages to obliterate
+ * the page type.
+ */
+#define DB_PAGE_DB_LEN 32
+#define DB_PAGE_QUEUE_LEN 0
+
+#define DBMETA_CHKSUM 0x01
+#define DBMETA_PART_RANGE 0x02
+#define DBMETA_PART_CALLBACK 0x04
+
+/************************************************************************
+ GENERIC METADATA PAGE HEADER
+ *
+ * !!!
+ * The magic and version numbers have to be in the same place in all versions
+ * of the metadata page as the application may not have upgraded the database.
+ ************************************************************************/
+typedef struct _dbmeta33 {
+ DB_LSN lsn; /* 00-07: LSN. */
+ db_pgno_t pgno; /* 08-11: Current page number. */
+ u_int32_t magic; /* 12-15: Magic number. */
+ u_int32_t version; /* 16-19: Version. */
+ u_int32_t pagesize; /* 20-23: Pagesize. */
+ u_int8_t encrypt_alg; /* 24: Encryption algorithm. */
+ u_int8_t type; /* 25: Page type. */
+ u_int8_t metaflags; /* 26: Meta-only flags */
+ u_int8_t unused1; /* 27: Unused. */
+ u_int32_t free; /* 28-31: Free list page number. */
+ db_pgno_t last_pgno; /* 32-35: Page number of last page in db. */
+ u_int32_t nparts; /* 36-39: Number of partitions. */
+ u_int32_t key_count; /* 40-43: Cached key count. */
+ u_int32_t record_count; /* 44-47: Cached record count. */
+ u_int32_t flags; /* 48-51: Flags: unique to each AM. */
+ u_int8_t uid[DB_FILE_ID_LEN]; /* 52-71: Unique file ID. */
+} DBMETA33, DBMETA;
+
+/************************************************************************
+ BTREE METADATA PAGE LAYOUT
+ ************************************************************************/
+#define BTM_DUP 0x001 /* Duplicates. */
+#define BTM_RECNO 0x002 /* Recno tree. */
+#define BTM_RECNUM 0x004 /* Btree: maintain record count. */
+#define BTM_FIXEDLEN 0x008 /* Recno: fixed length records. */
+#define BTM_RENUMBER 0x010 /* Recno: renumber on insert/delete. */
+#define BTM_SUBDB 0x020 /* Subdatabases. */
+#define BTM_DUPSORT 0x040 /* Duplicates are sorted. */
+#define BTM_COMPRESS 0x080 /* Compressed. */
+#define BTM_MASK 0x0ff
+
+typedef struct _btmeta33 {
+ DBMETA dbmeta; /* 00-71: Generic meta-data header. */
+
+ u_int32_t unused1; /* 72-75: Unused space. */
+ u_int32_t minkey; /* 76-79: Btree: Minkey. */
+ u_int32_t re_len; /* 80-83: Recno: fixed-length record length. */
+ u_int32_t re_pad; /* 84-87: Recno: fixed-length record pad. */
+ u_int32_t root; /* 88-91: Root page. */
+ u_int32_t unused2[92]; /* 92-459: Unused space. */
+ u_int32_t crypto_magic; /* 460-463: Crypto magic number */
+ u_int32_t trash[3]; /* 464-475: Trash space - Do not use */
+ u_int8_t iv[DB_IV_BYTES]; /* 476-495: Crypto IV */
+ u_int8_t chksum[DB_MAC_KEY]; /* 496-511: Page chksum */
+
+ /*
+ * Minimum page size is 512.
+ */
+} BTMETA33, BTMETA;
+
+/************************************************************************
+ HASH METADATA PAGE LAYOUT
+ ************************************************************************/
+#define DB_HASH_DUP 0x01 /* Duplicates. */
+#define DB_HASH_SUBDB 0x02 /* Subdatabases. */
+#define DB_HASH_DUPSORT 0x04 /* Duplicates are sorted. */
+#define NCACHED 32 /* number of spare points */
+
+typedef struct _hashmeta33 {
+ DBMETA dbmeta; /* 00-71: Generic meta-data page header. */
+
+ u_int32_t max_bucket; /* 72-75: ID of Maximum bucket in use */
+ u_int32_t high_mask; /* 76-79: Modulo mask into table */
+ u_int32_t low_mask; /* 80-83: Modulo mask into table lower half */
+ u_int32_t ffactor; /* 84-87: Fill factor */
+ u_int32_t nelem; /* 88-91: Number of keys in hash table */
+ u_int32_t h_charkey; /* 92-95: Value of hash(CHARKEY) */
+
+ u_int32_t spares[NCACHED]; /* 96-223: Spare pages for overflow */
+ u_int32_t unused[59]; /* 224-459: Unused space */
+ u_int32_t crypto_magic; /* 460-463: Crypto magic number */
+ u_int32_t trash[3]; /* 464-475: Trash space - Do not use */
+ u_int8_t iv[DB_IV_BYTES]; /* 476-495: Crypto IV */
+ u_int8_t chksum[DB_MAC_KEY]; /* 496-511: Page chksum */
+
+ /*
+ * Minimum page size is 512.
+ */
+} HMETA33, HMETA;
+
+/************************************************************************
+ HEAP METADATA PAGE LAYOUT
+*************************************************************************/
+/*
+ * Heap Meta data page structure
+ *
+ */
+typedef struct _heapmeta {
+ DBMETA dbmeta; /* 00-71: Generic meta-data header. */
+
+ db_pgno_t curregion; /* 72-75: Current region pgno. */
+ u_int32_t nregions; /* 76-79: Number of regions. */
+ u_int32_t gbytes; /* 80-83: GBytes for fixed size heap. */
+ u_int32_t bytes; /* 84-87: Bytes for fixed size heap. */
+ u_int32_t region_size; /* 88-91: Max region size. */
+ u_int32_t unused2[92]; /* 92-459: Unused space.*/
+ u_int32_t crypto_magic; /* 460-463: Crypto magic number */
+ u_int32_t trash[3]; /* 464-475: Trash space - Do not use */
+ u_int8_t iv[DB_IV_BYTES]; /* 476-495: Crypto IV */
+ u_int8_t chksum[DB_MAC_KEY]; /* 496-511: Page chksum */
+
+ /*
+ * Minimum page size is 512.
+ */
+} HEAPMETA;
+
+/************************************************************************
+ QUEUE METADATA PAGE LAYOUT
+ ************************************************************************/
+/*
+ * QAM Meta data page structure
+ *
+ */
+typedef struct _qmeta33 {
+ DBMETA dbmeta; /* 00-71: Generic meta-data header. */
+
+ u_int32_t first_recno; /* 72-75: First not deleted record. */
+ u_int32_t cur_recno; /* 76-79: Next recno to be allocated. */
+ u_int32_t re_len; /* 80-83: Fixed-length record length. */
+ u_int32_t re_pad; /* 84-87: Fixed-length record pad. */
+ u_int32_t rec_page; /* 88-91: Records Per Page. */
+ u_int32_t page_ext; /* 92-95: Pages per extent */
+
+ u_int32_t unused[91]; /* 96-459: Unused space */
+ u_int32_t crypto_magic; /* 460-463: Crypto magic number */
+ u_int32_t trash[3]; /* 464-475: Trash space - Do not use */
+ u_int8_t iv[DB_IV_BYTES]; /* 476-495: Crypto IV */
+ u_int8_t chksum[DB_MAC_KEY]; /* 496-511: Page chksum */
+
+ /*
+ * Minimum page size is 512.
+ */
+} QMETA33, QMETA;
+
+/*
+ * DBMETASIZE is a constant used by __db_file_setup and DB->verify
+ * as a buffer which is guaranteed to be larger than any possible
+ * metadata page size and smaller than any disk sector.
+ */
+#define DBMETASIZE 512
+
+/************************************************************************
+ BTREE/HASH MAIN PAGE LAYOUT
+ ************************************************************************/
+/*
+ * +-----------------------------------+
+ * | lsn | pgno | prev pgno |
+ * +-----------------------------------+
+ * | next pgno | entries | hf offset |
+ * +-----------------------------------+
+ * | level | type | chksum |
+ * +-----------------------------------+
+ * | iv | index | free --> |
+ * +-----------+-----------------------+
+ * | F R E E A R E A |
+ * +-----------------------------------+
+ * | <-- free | item |
+ * +-----------------------------------+
+ * | item | item | item |
+ * +-----------------------------------+
+ *
+ * sizeof(PAGE) == 26 bytes + possibly 20 bytes of checksum and possibly
+ * 16 bytes of IV (+ 2 bytes for alignment), and the following indices
+ * are guaranteed to be two-byte aligned. If we aren't doing crypto or
+ * checksumming the bytes are reclaimed for data storage.
+ *
+ * For hash and btree leaf pages, index items are paired, e.g., inp[0] is the
+ * key for inp[1]'s data. All other types of pages only contain single items.
+ */
+typedef struct __pg_chksum {
+ u_int8_t unused[2]; /* 26-27: For alignment */
+ u_int8_t chksum[4]; /* 28-31: Checksum */
+} PG_CHKSUM;
+
+typedef struct __pg_crypto {
+ u_int8_t unused[2]; /* 26-27: For alignment */
+ u_int8_t chksum[DB_MAC_KEY]; /* 28-47: Checksum */
+ u_int8_t iv[DB_IV_BYTES]; /* 48-63: IV */
+ /* !!!
+ * Must be 16-byte aligned for crypto
+ */
+} PG_CRYPTO;
+
+#define LEAFLEVEL 1
+#define MAXBTREELEVEL 255
+
+typedef struct _db_page {
+ DB_LSN lsn; /* 00-07: Log sequence number. */
+ db_pgno_t pgno; /* 08-11: Current page number. */
+ db_pgno_t prev_pgno; /* 12-15: Previous page number. */
+ db_pgno_t next_pgno; /* 16-19: Next page number. */
+ db_indx_t entries; /* 20-21: Number of items on the page. */
+ db_indx_t hf_offset; /* 22-23: High free byte page offset. */
+
+ /*
+ * The btree levels are numbered from the leaf to the root, starting
+ * with 1, so the leaf is level 1, its parent is level 2, and so on.
+ * We maintain this level on all btree pages, but the only place that
+ * we actually need it is on the root page. It would not be difficult
+ * to hide the byte on the root page once it becomes an internal page,
+ * so we could get this byte back if we needed it for something else.
+ */
+ u_int8_t level; /* 24: Btree tree level. */
+ u_int8_t type; /* 25: Page type. */
+} PAGE;
+
+/*
+ * With many compilers sizeof(PAGE) == 28, while SIZEOF_PAGE == 26.
+ * We add in other things directly after the page header and need
+ * the SIZEOF_PAGE. When giving the sizeof(), many compilers will
+ * pad it out to the next 4-byte boundary.
+ */
+#define SIZEOF_PAGE 26
+
+/************************************************************************
+ HEAP PAGE LAYOUT
+ ************************************************************************/
+#define HEAPPG_NORMAL 26
+#define HEAPPG_CHKSUM 48
+#define HEAPPG_SEC 64
+
+/*
+ * +0-----------2------------4-----------6-----------7+
+ * | lsn |
+ * +-------------------------+------------------------+
+ * | pgno | unused0 |
+ * +-------------+-----------+-----------+------------+
+ * | high_indx | free_indx | entries | hf offset |
+ * +-------+-----+-----------+-----------+------------+
+ * |unused2|type | unused3 | ...chksum... |
+ * +-------+-----+-----------+------------------------+
+ * | ...iv... | offset table / free space map |
+ * +-------------+------------------------------------+
+ * |free-> F R E E A R E A |
+ * +--------------------------------------------------+
+ * | <-- free | item |
+ * +-------------------------+------------------------+
+ * | item | item |
+ * +-------------------------+------------------------+
+ *
+ * The page layout of both heap internal and data pages. If not using
+ * crypto, iv will be overwritten with data. If not using checksumming,
+ * unused3 and chksum will also be overwritten with data and data will start at
+ * 26. Note that this layout lets us re-use a lot of the PAGE element macros
+ * defined above.
+ */
+typedef struct _heappg {
+ DB_LSN lsn; /* 00-07: Log sequence number. */
+ db_pgno_t pgno; /* 08-11: Current page number. */
+ u_int32_t high_pgno; /* 12-15: Highest page in region. */
+ u_int16_t high_indx; /* 16-17: Highest index in the offset table. */
+ db_indx_t free_indx; /* 18-19: First available index. */
+ db_indx_t entries; /* 20-21: Number of items on the page. */
+ db_indx_t hf_offset; /* 22-23: High free byte page offset. */
+ u_int8_t unused2[1]; /* 24: Unused. */
+ u_int8_t type; /* 25: Page type. */
+ u_int8_t unused3[2]; /* 26-27: Never used, just checksum alignment. */
+ u_int8_t chksum[DB_MAC_KEY]; /* 28-47: Checksum */
+ u_int8_t iv[DB_IV_BYTES]; /* 48-63: IV */
+} HEAPPG;
+
+/* Define first possible data page for heap, 0 is metapage, 1 is region page */
+#define FIRST_HEAP_RPAGE 1
+#define FIRST_HEAP_DPAGE 2
+
+#define HEAP_RECSPLIT 0x01 /* Heap data record is split */
+#define HEAP_RECFIRST 0x02 /* First piece of a split record */
+#define HEAP_RECLAST 0x04 /* Last piece of a split record */
+
+typedef struct __heaphdr {
+ u_int8_t flags; /* 00: Flags describing record. */
+ u_int8_t unused; /* 01: Padding. */
+ u_int16_t size; /* 02-03: The size of the stored data piece. */
+} HEAPHDR;
+
+typedef struct __heaphdrsplt {
+ HEAPHDR std_hdr; /* 00-03: The standard data header */
+ u_int32_t tsize; /* 04-07: Total record size, 1st piece only */
+ db_pgno_t nextpg; /* 08-11: RID.pgno of the next record piece */
+ db_indx_t nextindx; /* 12-13: RID.indx of the next record piece */
+ u_int16_t unused; /* 14-15: Padding. */
+} HEAPSPLITHDR;
+
+/************************************************************************
+ QUEUE MAIN PAGE LAYOUT
+ ************************************************************************/
+/*
+ * Sizes of page below. Used to reclaim space if not doing
+ * crypto or checksumming. If you change the QPAGE below you
+ * MUST adjust this too.
+ */
+#define QPAGE_NORMAL 28
+#define QPAGE_CHKSUM 48
+#define QPAGE_SEC 64
+
+typedef struct _qpage {
+ DB_LSN lsn; /* 00-07: Log sequence number. */
+ db_pgno_t pgno; /* 08-11: Current page number. */
+ u_int32_t unused0[3]; /* 12-23: Unused. */
+ u_int8_t unused1[1]; /* 24: Unused. */
+ u_int8_t type; /* 25: Page type. */
+ u_int8_t unused2[2]; /* 26-27: Unused. */
+ u_int8_t chksum[DB_MAC_KEY]; /* 28-47: Checksum */
+ u_int8_t iv[DB_IV_BYTES]; /* 48-63: IV */
+} QPAGE;
+
+/************************************************************************
+ OVERFLOW PAGE LAYOUT
+ ************************************************************************/
+
+/*
+ * Overflow items are referenced by HOFFPAGE and BOVERFLOW structures, which
+ * store a page number (the first page of the overflow item) and a length
+ * (the total length of the overflow item). The overflow item consists of
+ * some number of overflow pages, linked by the next_pgno field of the page.
+ * A next_pgno field of PGNO_INVALID flags the end of the overflow item.
+ *
+ * Overflow page overloads:
+ * The amount of overflow data stored on each page is stored in the
+ * hf_offset field.
+ *
+ * The implementation reference counts overflow items as it's possible
+ * for them to be promoted onto btree internal pages. The reference
+ * count is stored in the entries field.
+ */
+
+/************************************************************************
+ HASH PAGE LAYOUT
+ ************************************************************************/
+
+/* Each index references a group of bytes on the page. */
+#define H_KEYDATA 1 /* Key/data item. */
+#define H_DUPLICATE 2 /* Duplicate key/data item. */
+#define H_OFFPAGE 3 /* Overflow key/data item. */
+#define H_OFFDUP 4 /* Overflow page of duplicates. */
+
+/*
+ * The first and second types are H_KEYDATA and H_DUPLICATE, represented
+ * by the HKEYDATA structure:
+ *
+ * +-----------------------------------+
+ * | type | key/data ... |
+ * +-----------------------------------+
+ *
+ * For duplicates, the data field encodes duplicate elements in the data
+ * field:
+ *
+ * +---------------------------------------------------------------+
+ * | type | len1 | element1 | len1 | len2 | element2 | len2 |
+ * +---------------------------------------------------------------+
+ *
+ * Thus, by keeping track of the offset in the element, we can do both
+ * backward and forward traversal.
+ */
+typedef struct _hkeydata {
+ u_int8_t type; /* 00: Page type. */
+ u_int8_t data[0]; /* Variable length key/data item. */
+} HKEYDATA;
+
+/*
+ * The third type is the H_OFFPAGE, represented by the HOFFPAGE structure:
+ */
+typedef struct _hoffpage {
+ u_int8_t type; /* 00: Page type and delete flag. */
+ u_int8_t unused[3]; /* 01-03: Padding, unused. */
+ db_pgno_t pgno; /* 04-07: Offpage page number. */
+ u_int32_t tlen; /* 08-11: Total length of item. */
+} HOFFPAGE;
+
+/*
+ * The fourth type is H_OFFDUP represented by the HOFFDUP structure:
+ */
+typedef struct _hoffdup {
+ u_int8_t type; /* 00: Page type and delete flag. */
+ u_int8_t unused[3]; /* 01-03: Padding, unused. */
+ db_pgno_t pgno; /* 04-07: Offpage page number. */
+} HOFFDUP;
+
+/************************************************************************
+ BTREE PAGE LAYOUT
+ ************************************************************************/
+
+/* Each index references a group of bytes on the page. */
+#define B_KEYDATA 1 /* Key/data item. */
+#define B_DUPLICATE 2 /* Duplicate key/data item. */
+#define B_OVERFLOW 3 /* Overflow key/data item. */
+
+/*
+ * We have to store a deleted entry flag in the page. The reason is complex,
+ * but the simple version is that we can't delete on-page items referenced by
+ * a cursor -- the return order of subsequent insertions might be wrong. The
+ * delete flag is an overload of the top bit of the type byte.
+ */
+#define B_DELETE (0x80)
+
+/*
+ * The first type is B_KEYDATA, represented by the BKEYDATA structure:
+ */
+typedef struct _bkeydata {
+ db_indx_t len; /* 00-01: Key/data item length. */
+ u_int8_t type; /* 02: Page type AND DELETE FLAG. */
+ u_int8_t data[0]; /* Variable length key/data item. */
+} BKEYDATA;
+
+/*
+ * The second and third types are B_DUPLICATE and B_OVERFLOW, represented
+ * by the BOVERFLOW structure.
+ */
+typedef struct _boverflow {
+ db_indx_t unused1; /* 00-01: Padding, unused. */
+ u_int8_t type; /* 02: Page type AND DELETE FLAG. */
+ u_int8_t unused2; /* 03: Padding, unused. */
+ db_pgno_t pgno; /* 04-07: Next page number. */
+ u_int32_t tlen; /* 08-11: Total length of item. */
+} BOVERFLOW;
+
+/*
+ * Btree leaf and hash page layouts group indices in sets of two, one for the
+ * key and one for the data. Everything else does it in sets of one to save
+ * space. Use the following macros so that it's real obvious what's going on.
+ */
+#define O_INDX 1
+#define P_INDX 2
+
+/************************************************************************
+ BTREE INTERNAL PAGE LAYOUT
+ ************************************************************************/
+
+/*
+ * Btree internal entry.
+ */
+typedef struct _binternal {
+ db_indx_t len; /* 00-01: Key/data item length. */
+ u_int8_t type; /* 02: Page type AND DELETE FLAG. */
+ u_int8_t unused; /* 03: Padding, unused. */
+ db_pgno_t pgno; /* 04-07: Page number of referenced page. */
+ db_recno_t nrecs; /* 08-11: Subtree record count. */
+ u_int8_t data[0]; /* Variable length key item. */
+} BINTERNAL;
+
+/************************************************************************
+ RECNO INTERNAL PAGE LAYOUT
+ ************************************************************************/
+
+/*
+ * The recno internal entry.
+ */
+typedef struct _rinternal {
+ db_pgno_t pgno; /* 00-03: Page number of referenced page. */
+ db_recno_t nrecs; /* 04-07: Subtree record count. */
+} RINTERNAL;
+"""
+c_db = cstruct().load(db_def)
diff --git a/dissect/bsddb/c_bsddb.pyi b/dissect/bsddb/c_bsddb.pyi
new file mode 100644
index 0000000..0151362
--- /dev/null
+++ b/dissect/bsddb/c_bsddb.pyi
@@ -0,0 +1,559 @@
+# Generated by cstruct-stubgen
+from typing import BinaryIO, Literal, overload
+
+import dissect.cstruct as __cs__
+from typing_extensions import TypeAlias
+
+class _c_db(__cs__.cstruct):
+ DB_MAX_PAGES: Literal[4294967295] = ...
+ DB_MAX_RECORDS: Literal[4294967295] = ...
+ DB_FILE_ID_LEN: Literal[20] = ...
+ DB_IV_BYTES: Literal[16] = ...
+ DB_MAC_KEY: Literal[20] = ...
+ DB_RENAMEMAGIC: Literal[198656] = ...
+ DB_BTREEVERSION: Literal[9] = ...
+ DB_BTREEOLDVER: Literal[8] = ...
+ DB_BTREEMAGIC: Literal[340322] = ...
+ DB_HASHVERSION: Literal[9] = ...
+ DB_HASHOLDVER: Literal[7] = ...
+ DB_HASHMAGIC: Literal[398689] = ...
+ DB_HEAPVERSION: Literal[1] = ...
+ DB_HEAPOLDVER: Literal[1] = ...
+ DB_HEAPMAGIC: Literal[476546] = ...
+ DB_QAMVERSION: Literal[4] = ...
+ DB_QAMOLDVER: Literal[3] = ...
+ DB_QAMMAGIC: Literal[270931] = ...
+ DB_SEQUENCE_VERSION: Literal[2] = ...
+ DB_SEQUENCE_OLDVER: Literal[1] = ...
+ DB_AM_CHKSUM: Literal[1] = ...
+ DB_AM_COMPENSATE: Literal[2] = ...
+ DB_AM_COMPRESS: Literal[4] = ...
+ DB_AM_CREATED: Literal[8] = ...
+ DB_AM_CREATED_MSTR: Literal[16] = ...
+ DB_AM_DBM_ERROR: Literal[32] = ...
+ DB_AM_DELIMITER: Literal[64] = ...
+ DB_AM_DISCARD: Literal[128] = ...
+ DB_AM_DUP: Literal[256] = ...
+ DB_AM_DUPSORT: Literal[512] = ...
+ DB_AM_ENCRYPT: Literal[1024] = ...
+ DB_AM_FIXEDLEN: Literal[2048] = ...
+ DB_AM_INMEM: Literal[4096] = ...
+ DB_AM_INORDER: Literal[8192] = ...
+ DB_AM_IN_RENAME: Literal[16384] = ...
+ DB_AM_NOT_DURABLE: Literal[32768] = ...
+ DB_AM_OPEN_CALLED: Literal[65536] = ...
+ DB_AM_PAD: Literal[131072] = ...
+ DB_AM_PARTDB: Literal[262144] = ...
+ DB_AM_PGDEF: Literal[524288] = ...
+ DB_AM_RDONLY: Literal[1048576] = ...
+ DB_AM_READ_UNCOMMITTED: Literal[2097152] = ...
+ DB_AM_RECNUM: Literal[4194304] = ...
+ DB_AM_RECOVER: Literal[8388608] = ...
+ DB_AM_RENUMBER: Literal[16777216] = ...
+ DB_AM_REVSPLITOFF: Literal[33554432] = ...
+ DB_AM_SECONDARY: Literal[67108864] = ...
+ DB_AM_SNAPSHOT: Literal[134217728] = ...
+ DB_AM_SUBDB: Literal[268435456] = ...
+ DB_AM_SWAP: Literal[536870912] = ...
+ DB_AM_TXN: Literal[1073741824] = ...
+ DB_AM_VERIFYING: Literal[2147483648] = ...
+ PGNO_INVALID: Literal[0] = ...
+ PGNO_BASE_MD: Literal[0] = ...
+ P_INVALID: Literal[0] = ...
+ __P_DUPLICATE: Literal[1] = ...
+ P_HASH_UNSORTED: Literal[2] = ...
+ P_IBTREE: Literal[3] = ...
+ P_IRECNO: Literal[4] = ...
+ P_LBTREE: Literal[5] = ...
+ P_LRECNO: Literal[6] = ...
+ P_OVERFLOW: Literal[7] = ...
+ P_HASHMETA: Literal[8] = ...
+ P_BTREEMETA: Literal[9] = ...
+ P_QAMMETA: Literal[10] = ...
+ P_QAMDATA: Literal[11] = ...
+ P_LDUP: Literal[12] = ...
+ P_HASH: Literal[13] = ...
+ P_HEAPMETA: Literal[14] = ...
+ P_HEAP: Literal[15] = ...
+ P_IHEAP: Literal[16] = ...
+ P_PAGETYPE_MAX: Literal[17] = ...
+ DB_PAGE_DB_LEN: Literal[32] = ...
+ DB_PAGE_QUEUE_LEN: Literal[0] = ...
+ DBMETA_CHKSUM: Literal[1] = ...
+ DBMETA_PART_RANGE: Literal[2] = ...
+ DBMETA_PART_CALLBACK: Literal[4] = ...
+ BTM_DUP: Literal[1] = ...
+ BTM_RECNO: Literal[2] = ...
+ BTM_RECNUM: Literal[4] = ...
+ BTM_FIXEDLEN: Literal[8] = ...
+ BTM_RENUMBER: Literal[16] = ...
+ BTM_SUBDB: Literal[32] = ...
+ BTM_DUPSORT: Literal[64] = ...
+ BTM_COMPRESS: Literal[128] = ...
+ BTM_MASK: Literal[255] = ...
+ DB_HASH_DUP: Literal[1] = ...
+ DB_HASH_SUBDB: Literal[2] = ...
+ DB_HASH_DUPSORT: Literal[4] = ...
+ NCACHED: Literal[32] = ...
+ DBMETASIZE: Literal[512] = ...
+ LEAFLEVEL: Literal[1] = ...
+ MAXBTREELEVEL: Literal[255] = ...
+ SIZEOF_PAGE: Literal[26] = ...
+ HEAPPG_NORMAL: Literal[26] = ...
+ HEAPPG_CHKSUM: Literal[48] = ...
+ HEAPPG_SEC: Literal[64] = ...
+ FIRST_HEAP_RPAGE: Literal[1] = ...
+ FIRST_HEAP_DPAGE: Literal[2] = ...
+ HEAP_RECSPLIT: Literal[1] = ...
+ HEAP_RECFIRST: Literal[2] = ...
+ HEAP_RECLAST: Literal[4] = ...
+ QPAGE_NORMAL: Literal[28] = ...
+ QPAGE_CHKSUM: Literal[48] = ...
+ QPAGE_SEC: Literal[64] = ...
+ H_KEYDATA: Literal[1] = ...
+ H_DUPLICATE: Literal[2] = ...
+ H_OFFPAGE: Literal[3] = ...
+ H_OFFDUP: Literal[4] = ...
+ B_KEYDATA: Literal[1] = ...
+ B_DUPLICATE: Literal[2] = ...
+ B_OVERFLOW: Literal[3] = ...
+ O_INDX: Literal[1] = ...
+ P_INDX: Literal[2] = ...
+ u_int8_t: TypeAlias = _c_db.uint8
+ u_int16_t: TypeAlias = _c_db.uint16
+ u_int32_t: TypeAlias = _c_db.uint32
+ db_pgno_t: TypeAlias = _c_db.uint32
+ db_indx_t: TypeAlias = _c_db.uint16
+ db_recno_t: TypeAlias = _c_db.uint32
+ class _db_lsn(__cs__.Structure):
+ file: _c_db.uint32
+ offset: _c_db.uint32
+ @overload
+ def __init__(self, file: _c_db.uint32 | None = ..., offset: _c_db.uint32 | None = ...): ...
+ @overload
+ def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+ DB_LSN: TypeAlias = _db_lsn
+ class _dbmeta33(__cs__.Structure):
+ lsn: _c_db._db_lsn
+ pgno: _c_db.uint32
+ magic: _c_db.uint32
+ version: _c_db.uint32
+ pagesize: _c_db.uint32
+ encrypt_alg: _c_db.uint8
+ type: _c_db.uint8
+ metaflags: _c_db.uint8
+ unused1: _c_db.uint8
+ free: _c_db.uint32
+ last_pgno: _c_db.uint32
+ nparts: _c_db.uint32
+ key_count: _c_db.uint32
+ record_count: _c_db.uint32
+ flags: _c_db.uint32
+ uid: __cs__.Array[_c_db.uint8]
+ @overload
+ def __init__(
+ self,
+ lsn: _c_db._db_lsn | None = ...,
+ pgno: _c_db.uint32 | None = ...,
+ magic: _c_db.uint32 | None = ...,
+ version: _c_db.uint32 | None = ...,
+ pagesize: _c_db.uint32 | None = ...,
+ encrypt_alg: _c_db.uint8 | None = ...,
+ type: _c_db.uint8 | None = ...,
+ metaflags: _c_db.uint8 | None = ...,
+ unused1: _c_db.uint8 | None = ...,
+ free: _c_db.uint32 | None = ...,
+ last_pgno: _c_db.uint32 | None = ...,
+ nparts: _c_db.uint32 | None = ...,
+ key_count: _c_db.uint32 | None = ...,
+ record_count: _c_db.uint32 | None = ...,
+ flags: _c_db.uint32 | None = ...,
+ uid: __cs__.Array[_c_db.uint8] | None = ...,
+ ): ...
+ @overload
+ def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+ DBMETA33: TypeAlias = _dbmeta33
+ DBMETA: TypeAlias = _dbmeta33
+ class _btmeta33(__cs__.Structure):
+ dbmeta: _c_db._dbmeta33
+ unused1: _c_db.uint32
+ minkey: _c_db.uint32
+ re_len: _c_db.uint32
+ re_pad: _c_db.uint32
+ root: _c_db.uint32
+ unused2: __cs__.Array[_c_db.uint32]
+ crypto_magic: _c_db.uint32
+ trash: __cs__.Array[_c_db.uint32]
+ iv: __cs__.Array[_c_db.uint8]
+ chksum: __cs__.Array[_c_db.uint8]
+ @overload
+ def __init__(
+ self,
+ dbmeta: _c_db._dbmeta33 | None = ...,
+ unused1: _c_db.uint32 | None = ...,
+ minkey: _c_db.uint32 | None = ...,
+ re_len: _c_db.uint32 | None = ...,
+ re_pad: _c_db.uint32 | None = ...,
+ root: _c_db.uint32 | None = ...,
+ unused2: __cs__.Array[_c_db.uint32] | None = ...,
+ crypto_magic: _c_db.uint32 | None = ...,
+ trash: __cs__.Array[_c_db.uint32] | None = ...,
+ iv: __cs__.Array[_c_db.uint8] | None = ...,
+ chksum: __cs__.Array[_c_db.uint8] | None = ...,
+ ): ...
+ @overload
+ def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+ BTMETA33: TypeAlias = _btmeta33
+ BTMETA: TypeAlias = _btmeta33
+ class _hashmeta33(__cs__.Structure):
+ dbmeta: _c_db._dbmeta33
+ max_bucket: _c_db.uint32
+ high_mask: _c_db.uint32
+ low_mask: _c_db.uint32
+ ffactor: _c_db.uint32
+ nelem: _c_db.uint32
+ h_charkey: _c_db.uint32
+ spares: __cs__.Array[_c_db.uint32]
+ unused: __cs__.Array[_c_db.uint32]
+ crypto_magic: _c_db.uint32
+ trash: __cs__.Array[_c_db.uint32]
+ iv: __cs__.Array[_c_db.uint8]
+ chksum: __cs__.Array[_c_db.uint8]
+ @overload
+ def __init__(
+ self,
+ dbmeta: _c_db._dbmeta33 | None = ...,
+ max_bucket: _c_db.uint32 | None = ...,
+ high_mask: _c_db.uint32 | None = ...,
+ low_mask: _c_db.uint32 | None = ...,
+ ffactor: _c_db.uint32 | None = ...,
+ nelem: _c_db.uint32 | None = ...,
+ h_charkey: _c_db.uint32 | None = ...,
+ spares: __cs__.Array[_c_db.uint32] | None = ...,
+ unused: __cs__.Array[_c_db.uint32] | None = ...,
+ crypto_magic: _c_db.uint32 | None = ...,
+ trash: __cs__.Array[_c_db.uint32] | None = ...,
+ iv: __cs__.Array[_c_db.uint8] | None = ...,
+ chksum: __cs__.Array[_c_db.uint8] | None = ...,
+ ): ...
+ @overload
+ def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+ HMETA33: TypeAlias = _hashmeta33
+ HMETA: TypeAlias = _hashmeta33
+ class _heapmeta(__cs__.Structure):
+ dbmeta: _c_db._dbmeta33
+ curregion: _c_db.uint32
+ nregions: _c_db.uint32
+ gbytes: _c_db.uint32
+ bytes: _c_db.uint32
+ region_size: _c_db.uint32
+ unused2: __cs__.Array[_c_db.uint32]
+ crypto_magic: _c_db.uint32
+ trash: __cs__.Array[_c_db.uint32]
+ iv: __cs__.Array[_c_db.uint8]
+ chksum: __cs__.Array[_c_db.uint8]
+ @overload
+ def __init__(
+ self,
+ dbmeta: _c_db._dbmeta33 | None = ...,
+ curregion: _c_db.uint32 | None = ...,
+ nregions: _c_db.uint32 | None = ...,
+ gbytes: _c_db.uint32 | None = ...,
+ bytes: _c_db.uint32 | None = ...,
+ region_size: _c_db.uint32 | None = ...,
+ unused2: __cs__.Array[_c_db.uint32] | None = ...,
+ crypto_magic: _c_db.uint32 | None = ...,
+ trash: __cs__.Array[_c_db.uint32] | None = ...,
+ iv: __cs__.Array[_c_db.uint8] | None = ...,
+ chksum: __cs__.Array[_c_db.uint8] | None = ...,
+ ): ...
+ @overload
+ def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+ HEAPMETA: TypeAlias = _heapmeta
+ class _qmeta33(__cs__.Structure):
+ dbmeta: _c_db._dbmeta33
+ first_recno: _c_db.uint32
+ cur_recno: _c_db.uint32
+ re_len: _c_db.uint32
+ re_pad: _c_db.uint32
+ rec_page: _c_db.uint32
+ page_ext: _c_db.uint32
+ unused: __cs__.Array[_c_db.uint32]
+ crypto_magic: _c_db.uint32
+ trash: __cs__.Array[_c_db.uint32]
+ iv: __cs__.Array[_c_db.uint8]
+ chksum: __cs__.Array[_c_db.uint8]
+ @overload
+ def __init__(
+ self,
+ dbmeta: _c_db._dbmeta33 | None = ...,
+ first_recno: _c_db.uint32 | None = ...,
+ cur_recno: _c_db.uint32 | None = ...,
+ re_len: _c_db.uint32 | None = ...,
+ re_pad: _c_db.uint32 | None = ...,
+ rec_page: _c_db.uint32 | None = ...,
+ page_ext: _c_db.uint32 | None = ...,
+ unused: __cs__.Array[_c_db.uint32] | None = ...,
+ crypto_magic: _c_db.uint32 | None = ...,
+ trash: __cs__.Array[_c_db.uint32] | None = ...,
+ iv: __cs__.Array[_c_db.uint8] | None = ...,
+ chksum: __cs__.Array[_c_db.uint8] | None = ...,
+ ): ...
+ @overload
+ def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+ QMETA33: TypeAlias = _qmeta33
+ QMETA: TypeAlias = _qmeta33
+ class __pg_chksum(__cs__.Structure):
+ unused: __cs__.Array[_c_db.uint8]
+ chksum: __cs__.Array[_c_db.uint8]
+ @overload
+ def __init__(
+ self, unused: __cs__.Array[_c_db.uint8] | None = ..., chksum: __cs__.Array[_c_db.uint8] | None = ...
+ ): ...
+ @overload
+ def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+ PG_CHKSUM: TypeAlias = __pg_chksum
+ class __pg_crypto(__cs__.Structure):
+ unused: __cs__.Array[_c_db.uint8]
+ chksum: __cs__.Array[_c_db.uint8]
+ iv: __cs__.Array[_c_db.uint8]
+ @overload
+ def __init__(
+ self,
+ unused: __cs__.Array[_c_db.uint8] | None = ...,
+ chksum: __cs__.Array[_c_db.uint8] | None = ...,
+ iv: __cs__.Array[_c_db.uint8] | None = ...,
+ ): ...
+ @overload
+ def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+ PG_CRYPTO: TypeAlias = __pg_crypto
+ class _db_page(__cs__.Structure):
+ lsn: _c_db._db_lsn
+ pgno: _c_db.uint32
+ prev_pgno: _c_db.uint32
+ next_pgno: _c_db.uint32
+ entries: _c_db.uint16
+ hf_offset: _c_db.uint16
+ level: _c_db.uint8
+ type: _c_db.uint8
+ @overload
+ def __init__(
+ self,
+ lsn: _c_db._db_lsn | None = ...,
+ pgno: _c_db.uint32 | None = ...,
+ prev_pgno: _c_db.uint32 | None = ...,
+ next_pgno: _c_db.uint32 | None = ...,
+ entries: _c_db.uint16 | None = ...,
+ hf_offset: _c_db.uint16 | None = ...,
+ level: _c_db.uint8 | None = ...,
+ type: _c_db.uint8 | None = ...,
+ ): ...
+ @overload
+ def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+ PAGE: TypeAlias = _db_page
+ class _heappg(__cs__.Structure):
+ lsn: _c_db._db_lsn
+ pgno: _c_db.uint32
+ high_pgno: _c_db.uint32
+ high_indx: _c_db.uint16
+ free_indx: _c_db.uint16
+ entries: _c_db.uint16
+ hf_offset: _c_db.uint16
+ unused2: __cs__.Array[_c_db.uint8]
+ type: _c_db.uint8
+ unused3: __cs__.Array[_c_db.uint8]
+ chksum: __cs__.Array[_c_db.uint8]
+ iv: __cs__.Array[_c_db.uint8]
+ @overload
+ def __init__(
+ self,
+ lsn: _c_db._db_lsn | None = ...,
+ pgno: _c_db.uint32 | None = ...,
+ high_pgno: _c_db.uint32 | None = ...,
+ high_indx: _c_db.uint16 | None = ...,
+ free_indx: _c_db.uint16 | None = ...,
+ entries: _c_db.uint16 | None = ...,
+ hf_offset: _c_db.uint16 | None = ...,
+ unused2: __cs__.Array[_c_db.uint8] | None = ...,
+ type: _c_db.uint8 | None = ...,
+ unused3: __cs__.Array[_c_db.uint8] | None = ...,
+ chksum: __cs__.Array[_c_db.uint8] | None = ...,
+ iv: __cs__.Array[_c_db.uint8] | None = ...,
+ ): ...
+ @overload
+ def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+ HEAPPG: TypeAlias = _heappg
+ class __heaphdr(__cs__.Structure):
+ flags: _c_db.uint8
+ unused: _c_db.uint8
+ size: _c_db.uint16
+ @overload
+ def __init__(
+ self, flags: _c_db.uint8 | None = ..., unused: _c_db.uint8 | None = ..., size: _c_db.uint16 | None = ...
+ ): ...
+ @overload
+ def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+ HEAPHDR: TypeAlias = __heaphdr
+ class __heaphdrsplt(__cs__.Structure):
+ std_hdr: _c_db.__heaphdr
+ tsize: _c_db.uint32
+ nextpg: _c_db.uint32
+ nextindx: _c_db.uint16
+ unused: _c_db.uint16
+ @overload
+ def __init__(
+ self,
+ std_hdr: _c_db.__heaphdr | None = ...,
+ tsize: _c_db.uint32 | None = ...,
+ nextpg: _c_db.uint32 | None = ...,
+ nextindx: _c_db.uint16 | None = ...,
+ unused: _c_db.uint16 | None = ...,
+ ): ...
+ @overload
+ def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+ HEAPSPLITHDR: TypeAlias = __heaphdrsplt
+ class _qpage(__cs__.Structure):
+ lsn: _c_db._db_lsn
+ pgno: _c_db.uint32
+ unused0: __cs__.Array[_c_db.uint32]
+ unused1: __cs__.Array[_c_db.uint8]
+ type: _c_db.uint8
+ unused2: __cs__.Array[_c_db.uint8]
+ chksum: __cs__.Array[_c_db.uint8]
+ iv: __cs__.Array[_c_db.uint8]
+ @overload
+ def __init__(
+ self,
+ lsn: _c_db._db_lsn | None = ...,
+ pgno: _c_db.uint32 | None = ...,
+ unused0: __cs__.Array[_c_db.uint32] | None = ...,
+ unused1: __cs__.Array[_c_db.uint8] | None = ...,
+ type: _c_db.uint8 | None = ...,
+ unused2: __cs__.Array[_c_db.uint8] | None = ...,
+ chksum: __cs__.Array[_c_db.uint8] | None = ...,
+ iv: __cs__.Array[_c_db.uint8] | None = ...,
+ ): ...
+ @overload
+ def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+ QPAGE: TypeAlias = _qpage
+ class _hkeydata(__cs__.Structure):
+ type: _c_db.uint8
+ data: __cs__.Array[_c_db.uint8]
+ @overload
+ def __init__(self, type: _c_db.uint8 | None = ..., data: __cs__.Array[_c_db.uint8] | None = ...): ...
+ @overload
+ def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+ HKEYDATA: TypeAlias = _hkeydata
+ class _hoffpage(__cs__.Structure):
+ type: _c_db.uint8
+ unused: __cs__.Array[_c_db.uint8]
+ pgno: _c_db.uint32
+ tlen: _c_db.uint32
+ @overload
+ def __init__(
+ self,
+ type: _c_db.uint8 | None = ...,
+ unused: __cs__.Array[_c_db.uint8] | None = ...,
+ pgno: _c_db.uint32 | None = ...,
+ tlen: _c_db.uint32 | None = ...,
+ ): ...
+ @overload
+ def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+ HOFFPAGE: TypeAlias = _hoffpage
+ class _hoffdup(__cs__.Structure):
+ type: _c_db.uint8
+ unused: __cs__.Array[_c_db.uint8]
+ pgno: _c_db.uint32
+ @overload
+ def __init__(
+ self,
+ type: _c_db.uint8 | None = ...,
+ unused: __cs__.Array[_c_db.uint8] | None = ...,
+ pgno: _c_db.uint32 | None = ...,
+ ): ...
+ @overload
+ def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+ HOFFDUP: TypeAlias = _hoffdup
+ class _bkeydata(__cs__.Structure):
+ len: _c_db.uint16
+ type: _c_db.uint8
+ data: __cs__.Array[_c_db.uint8]
+ @overload
+ def __init__(
+ self,
+ len: _c_db.uint16 | None = ...,
+ type: _c_db.uint8 | None = ...,
+ data: __cs__.Array[_c_db.uint8] | None = ...,
+ ): ...
+ @overload
+ def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+ BKEYDATA: TypeAlias = _bkeydata
+ class _boverflow(__cs__.Structure):
+ unused1: _c_db.uint16
+ type: _c_db.uint8
+ unused2: _c_db.uint8
+ pgno: _c_db.uint32
+ tlen: _c_db.uint32
+ @overload
+ def __init__(
+ self,
+ unused1: _c_db.uint16 | None = ...,
+ type: _c_db.uint8 | None = ...,
+ unused2: _c_db.uint8 | None = ...,
+ pgno: _c_db.uint32 | None = ...,
+ tlen: _c_db.uint32 | None = ...,
+ ): ...
+ @overload
+ def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+ BOVERFLOW: TypeAlias = _boverflow
+ class _binternal(__cs__.Structure):
+ len: _c_db.uint16
+ type: _c_db.uint8
+ unused: _c_db.uint8
+ pgno: _c_db.uint32
+ nrecs: _c_db.uint32
+ data: __cs__.Array[_c_db.uint8]
+ @overload
+ def __init__(
+ self,
+ len: _c_db.uint16 | None = ...,
+ type: _c_db.uint8 | None = ...,
+ unused: _c_db.uint8 | None = ...,
+ pgno: _c_db.uint32 | None = ...,
+ nrecs: _c_db.uint32 | None = ...,
+ data: __cs__.Array[_c_db.uint8] | None = ...,
+ ): ...
+ @overload
+ def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+ BINTERNAL: TypeAlias = _binternal
+ class _rinternal(__cs__.Structure):
+ pgno: _c_db.uint32
+ nrecs: _c_db.uint32
+ @overload
+ def __init__(self, pgno: _c_db.uint32 | None = ..., nrecs: _c_db.uint32 | None = ...): ...
+ @overload
+ def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+ RINTERNAL: TypeAlias = _rinternal
+
+# Technically `c_db` is an instance of `_c_db`, but then we can't use it in type hints
+c_db: TypeAlias = _c_db
diff --git a/dissect/bsddb/tools/__init__.py b/dissect/bsddb/tools/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/dissect/bsddb/tools/c_rpm.py b/dissect/bsddb/tools/c_rpm.py
new file mode 100644
index 0000000..4a10761
--- /dev/null
+++ b/dissect/bsddb/tools/c_rpm.py
@@ -0,0 +1,465 @@
+from __future__ import annotations
+
+from dissect.cstruct import cstruct
+
+rpm_def = """
+typedef uint32 rpm_tag_t;
+typedef uint32 rpm_tagtype_t;
+typedef uint32 rpm_count_t;
+
+/**
+ * Header private tags.
+ * @note General use tags should start at 1000 (RPM's tag space starts there).
+ */
+#define HEADER_IMAGE 61
+#define HEADER_SIGNATURES 62
+#define HEADER_IMMUTABLE 63
+#define HEADER_REGIONS 64
+#define HEADER_I18NTABLE 100
+#define HEADER_SIGBASE 256
+#define HEADER_TAGBASE 1000
+
+/**
+ * Tags identify data in package headers.
+ * @note tags should not have value 0!
+ * @note all new tags should be added above 5000
+ */
+enum rpmTag {
+ RPMTAG_NOT_FOUND = -1, /*!< Unknown tag */
+
+ RPMTAG_HEADERIMAGE = HEADER_IMAGE, /*!< Current image. */
+ RPMTAG_HEADERSIGNATURES = HEADER_SIGNATURES, /*!< Signatures. */
+ RPMTAG_HEADERIMMUTABLE = HEADER_IMMUTABLE, /*!< Original image. */
+ RPMTAG_HEADERREGIONS = HEADER_REGIONS, /*!< Regions. */
+
+ RPMTAG_HEADERI18NTABLE = HEADER_I18NTABLE, /* s[] !< I18N string locales. */
+
+ RPMTAG_SIG_BASE = HEADER_SIGBASE,
+ RPMTAG_SIGSIZE = RPMTAG_SIG_BASE+1, /* i */
+ RPMTAG_SIGLEMD5_1 = RPMTAG_SIG_BASE+2, /* internal - obsolete */
+ RPMTAG_SIGPGP = RPMTAG_SIG_BASE+3, /* x */
+ RPMTAG_SIGLEMD5_2 = RPMTAG_SIG_BASE+4, /* x internal - obsolete */
+ RPMTAG_SIGMD5 = RPMTAG_SIG_BASE+5, /* x */
+ RPMTAG_PKGID = RPMTAG_SIGMD5, /* x */
+ RPMTAG_SIGGPG = RPMTAG_SIG_BASE+6, /* x */
+ RPMTAG_SIGPGP5 = RPMTAG_SIG_BASE+7, /* internal - obsolete */
+
+ RPMTAG_BADSHA1_1 = RPMTAG_SIG_BASE+8, /* internal - obsolete */
+ RPMTAG_BADSHA1_2 = RPMTAG_SIG_BASE+9, /* internal - obsolete */
+ RPMTAG_PUBKEYS = RPMTAG_SIG_BASE+10, /* s[] */
+ RPMTAG_DSAHEADER = RPMTAG_SIG_BASE+11, /* x */
+ RPMTAG_RSAHEADER = RPMTAG_SIG_BASE+12, /* x */
+ RPMTAG_SHA1HEADER = RPMTAG_SIG_BASE+13, /* s */
+ RPMTAG_HDRID = RPMTAG_SHA1HEADER, /* s */
+ RPMTAG_LONGSIGSIZE = RPMTAG_SIG_BASE+14, /* l */
+ RPMTAG_LONGARCHIVESIZE = RPMTAG_SIG_BASE+15, /* l */
+ /* RPMTAG_SIG_BASE+16 reserved */
+ RPMTAG_SHA256HEADER = RPMTAG_SIG_BASE+17, /* s */
+ /* RPMTAG_SIG_BASE+18 reserved for RPMSIGTAG_FILESIGNATURES */
+ /* RPMTAG_SIG_BASE+19 reserved for RPMSIGTAG_FILESIGNATURELENGTH */
+
+ RPMTAG_NAME = 1000, /* s */
+ RPMTAG_N = RPMTAG_NAME, /* s */
+ RPMTAG_VERSION = 1001, /* s */
+ RPMTAG_V = RPMTAG_VERSION, /* s */
+ RPMTAG_RELEASE = 1002, /* s */
+ RPMTAG_R = RPMTAG_RELEASE, /* s */
+ RPMTAG_EPOCH = 1003, /* i */
+ RPMTAG_E = RPMTAG_EPOCH, /* i */
+ RPMTAG_SUMMARY = 1004, /* s{} */
+ RPMTAG_DESCRIPTION = 1005, /* s{} */
+ RPMTAG_BUILDTIME = 1006, /* i */
+ RPMTAG_BUILDHOST = 1007, /* s */
+ RPMTAG_INSTALLTIME = 1008, /* i */
+ RPMTAG_SIZE = 1009, /* i */
+ RPMTAG_DISTRIBUTION = 1010, /* s */
+ RPMTAG_VENDOR = 1011, /* s */
+ RPMTAG_GIF = 1012, /* x */
+ RPMTAG_XPM = 1013, /* x */
+ RPMTAG_LICENSE = 1014, /* s */
+ RPMTAG_PACKAGER = 1015, /* s */
+ RPMTAG_GROUP = 1016, /* s{} */
+ RPMTAG_CHANGELOG = 1017, /* s[] internal */
+ RPMTAG_SOURCE = 1018, /* s[] */
+ RPMTAG_PATCH = 1019, /* s[] */
+ RPMTAG_URL = 1020, /* s */
+ RPMTAG_OS = 1021, /* s legacy used int */
+ RPMTAG_ARCH = 1022, /* s legacy used int */
+ RPMTAG_PREIN = 1023, /* s */
+ RPMTAG_POSTIN = 1024, /* s */
+ RPMTAG_PREUN = 1025, /* s */
+ RPMTAG_POSTUN = 1026, /* s */
+ RPMTAG_OLDFILENAMES = 1027, /* s[] obsolete */
+ RPMTAG_FILESIZES = 1028, /* i[] */
+ RPMTAG_FILESTATES = 1029, /* c[] */
+ RPMTAG_FILEMODES = 1030, /* h[] */
+ RPMTAG_FILEUIDS = 1031, /* i[] internal - obsolete */
+ RPMTAG_FILEGIDS = 1032, /* i[] internal - obsolete */
+ RPMTAG_FILERDEVS = 1033, /* h[] */
+ RPMTAG_FILEMTIMES = 1034, /* i[] */
+ RPMTAG_FILEDIGESTS = 1035, /* s[] */
+ RPMTAG_FILEMD5S = RPMTAG_FILEDIGESTS, /* s[] */
+ RPMTAG_FILELINKTOS = 1036, /* s[] */
+ RPMTAG_FILEFLAGS = 1037, /* i[] */
+ RPMTAG_ROOT = 1038, /* internal - obsolete */
+ RPMTAG_FILEUSERNAME = 1039, /* s[] */
+ RPMTAG_FILEGROUPNAME = 1040, /* s[] */
+ RPMTAG_EXCLUDE = 1041, /* internal - obsolete */
+ RPMTAG_EXCLUSIVE = 1042, /* internal - obsolete */
+ RPMTAG_ICON = 1043, /* x */
+ RPMTAG_SOURCERPM = 1044, /* s */
+ RPMTAG_FILEVERIFYFLAGS = 1045, /* i[] */
+ RPMTAG_ARCHIVESIZE = 1046, /* i */
+ RPMTAG_PROVIDENAME = 1047, /* s[] */
+ RPMTAG_PROVIDES = RPMTAG_PROVIDENAME, /* s[] */
+ RPMTAG_P = RPMTAG_PROVIDENAME, /* s[] */
+ RPMTAG_REQUIREFLAGS = 1048, /* i[] */
+ RPMTAG_REQUIRENAME = 1049, /* s[] */
+ RPMTAG_REQUIRES = RPMTAG_REQUIRENAME, /* s[] */
+ RPMTAG_REQUIREVERSION = 1050, /* s[] */
+ RPMTAG_NOSOURCE = 1051, /* i[] */
+ RPMTAG_NOPATCH = 1052, /* i[] */
+ RPMTAG_CONFLICTFLAGS = 1053, /* i[] */
+ RPMTAG_CONFLICTNAME = 1054, /* s[] */
+ RPMTAG_CONFLICTS = RPMTAG_CONFLICTNAME, /* s[] */
+ RPMTAG_C = RPMTAG_CONFLICTNAME, /* s[] */
+ RPMTAG_CONFLICTVERSION = 1055, /* s[] */
+ RPMTAG_DEFAULTPREFIX = 1056, /* s internal - deprecated */
+ RPMTAG_BUILDROOT = 1057, /* s internal - obsolete */
+ RPMTAG_INSTALLPREFIX = 1058, /* s internal - deprecated */
+ RPMTAG_EXCLUDEARCH = 1059, /* s[] */
+ RPMTAG_EXCLUDEOS = 1060, /* s[] */
+ RPMTAG_EXCLUSIVEARCH = 1061, /* s[] */
+ RPMTAG_EXCLUSIVEOS = 1062, /* s[] */
+ RPMTAG_AUTOREQPROV = 1063, /* s internal */
+ RPMTAG_RPMVERSION = 1064, /* s */
+ RPMTAG_TRIGGERSCRIPTS = 1065, /* s[] */
+ RPMTAG_TRIGGERNAME = 1066, /* s[] */
+ RPMTAG_TRIGGERVERSION = 1067, /* s[] */
+ RPMTAG_TRIGGERFLAGS = 1068, /* i[] */
+ RPMTAG_TRIGGERINDEX = 1069, /* i[] */
+ RPMTAG_VERIFYSCRIPT = 1079, /* s */
+ RPMTAG_CHANGELOGTIME = 1080, /* i[] */
+ RPMTAG_CHANGELOGNAME = 1081, /* s[] */
+ RPMTAG_CHANGELOGTEXT = 1082, /* s[] */
+ RPMTAG_BROKENMD5 = 1083, /* internal - obsolete */
+ RPMTAG_PREREQ = 1084, /* internal */
+ RPMTAG_PREINPROG = 1085, /* s[] */
+ RPMTAG_POSTINPROG = 1086, /* s[] */
+ RPMTAG_PREUNPROG = 1087, /* s[] */
+ RPMTAG_POSTUNPROG = 1088, /* s[] */
+ RPMTAG_BUILDARCHS = 1089, /* s[] */
+ RPMTAG_OBSOLETENAME = 1090, /* s[] */
+ RPMTAG_OBSOLETES = RPMTAG_OBSOLETENAME, /* s[] */
+ RPMTAG_O = RPMTAG_OBSOLETENAME, /* s[] */
+ RPMTAG_VERIFYSCRIPTPROG = 1091, /* s[] */
+ RPMTAG_TRIGGERSCRIPTPROG = 1092, /* s[] */
+ RPMTAG_DOCDIR = 1093, /* internal */
+ RPMTAG_COOKIE = 1094, /* s */
+ RPMTAG_FILEDEVICES = 1095, /* i[] */
+ RPMTAG_FILEINODES = 1096, /* i[] */
+ RPMTAG_FILELANGS = 1097, /* s[] */
+ RPMTAG_PREFIXES = 1098, /* s[] */
+ RPMTAG_INSTPREFIXES = 1099, /* s[] */
+ RPMTAG_TRIGGERIN = 1100, /* internal */
+ RPMTAG_TRIGGERUN = 1101, /* internal */
+ RPMTAG_TRIGGERPOSTUN = 1102, /* internal */
+ RPMTAG_AUTOREQ = 1103, /* internal */
+ RPMTAG_AUTOPROV = 1104, /* internal */
+ RPMTAG_CAPABILITY = 1105, /* i internal - obsolete */
+ RPMTAG_SOURCEPACKAGE = 1106, /* i */
+ RPMTAG_OLDORIGFILENAMES = 1107, /* internal - obsolete */
+ RPMTAG_BUILDPREREQ = 1108, /* internal */
+ RPMTAG_BUILDREQUIRES = 1109, /* internal */
+ RPMTAG_BUILDCONFLICTS = 1110, /* internal */
+ RPMTAG_BUILDMACROS = 1111, /* internal - unused */
+ RPMTAG_PROVIDEFLAGS = 1112, /* i[] */
+ RPMTAG_PROVIDEVERSION = 1113, /* s[] */
+ RPMTAG_OBSOLETEFLAGS = 1114, /* i[] */
+ RPMTAG_OBSOLETEVERSION = 1115, /* s[] */
+ RPMTAG_DIRINDEXES = 1116, /* i[] */
+ RPMTAG_BASENAMES = 1117, /* s[] */
+ RPMTAG_DIRNAMES = 1118, /* s[] */
+ RPMTAG_ORIGDIRINDEXES = 1119, /* i[] relocation */
+ RPMTAG_ORIGBASENAMES = 1120, /* s[] relocation */
+ RPMTAG_ORIGDIRNAMES = 1121, /* s[] relocation */
+ RPMTAG_OPTFLAGS = 1122, /* s */
+ RPMTAG_DISTURL = 1123, /* s */
+ RPMTAG_PAYLOADFORMAT = 1124, /* s */
+ RPMTAG_PAYLOADCOMPRESSOR = 1125, /* s */
+ RPMTAG_PAYLOADFLAGS = 1126, /* s */
+ RPMTAG_INSTALLCOLOR = 1127, /* i transaction color when installed */
+ RPMTAG_INSTALLTID = 1128, /* i */
+ RPMTAG_REMOVETID = 1129, /* i */
+ RPMTAG_SHA1RHN = 1130, /* internal - obsolete */
+ RPMTAG_RHNPLATFORM = 1131, /* s internal - obsolete */
+ RPMTAG_PLATFORM = 1132, /* s */
+ RPMTAG_PATCHESNAME = 1133, /* s[] deprecated placeholder (SuSE) */
+ RPMTAG_PATCHESFLAGS = 1134, /* i[] deprecated placeholder (SuSE) */
+ RPMTAG_PATCHESVERSION = 1135, /* s[] deprecated placeholder (SuSE) */
+ RPMTAG_CACHECTIME = 1136, /* i internal - obsolete */
+ RPMTAG_CACHEPKGPATH = 1137, /* s internal - obsolete */
+ RPMTAG_CACHEPKGSIZE = 1138, /* i internal - obsolete */
+ RPMTAG_CACHEPKGMTIME = 1139, /* i internal - obsolete */
+ RPMTAG_FILECOLORS = 1140, /* i[] */
+ RPMTAG_FILECLASS = 1141, /* i[] */
+ RPMTAG_CLASSDICT = 1142, /* s[] */
+ RPMTAG_FILEDEPENDSX = 1143, /* i[] */
+ RPMTAG_FILEDEPENDSN = 1144, /* i[] */
+ RPMTAG_DEPENDSDICT = 1145, /* i[] */
+ RPMTAG_SOURCEPKGID = 1146, /* x */
+ RPMTAG_FILECONTEXTS = 1147, /* s[] - obsolete */
+ RPMTAG_FSCONTEXTS = 1148, /* s[] extension */
+ RPMTAG_RECONTEXTS = 1149, /* s[] extension */
+ RPMTAG_POLICIES = 1150, /* s[] selinux *.te policy file. */
+ RPMTAG_PRETRANS = 1151, /* s */
+ RPMTAG_POSTTRANS = 1152, /* s */
+ RPMTAG_PRETRANSPROG = 1153, /* s[] */
+ RPMTAG_POSTTRANSPROG = 1154, /* s[] */
+ RPMTAG_DISTTAG = 1155, /* s */
+ RPMTAG_OLDSUGGESTSNAME = 1156, /* s[] - obsolete */
+ RPMTAG_OLDSUGGESTS = RPMTAG_OLDSUGGESTSNAME, /* s[] - obsolete */
+ RPMTAG_OLDSUGGESTSVERSION = 1157, /* s[] - obsolete */
+ RPMTAG_OLDSUGGESTSFLAGS = 1158, /* i[] - obsolete */
+ RPMTAG_OLDENHANCESNAME = 1159, /* s[] - obsolete */
+ RPMTAG_OLDENHANCES = RPMTAG_OLDENHANCESNAME, /* s[] - obsolete */
+ RPMTAG_OLDENHANCESVERSION = 1160, /* s[] - obsolete */
+ RPMTAG_OLDENHANCESFLAGS = 1161, /* i[] - obsolete */
+ RPMTAG_PRIORITY = 1162, /* i[] extension placeholder (unimplemented) */
+ RPMTAG_CVSID = 1163, /* s (unimplemented) */
+ RPMTAG_SVNID = RPMTAG_CVSID, /* s (unimplemented) */
+ RPMTAG_BLINKPKGID = 1164, /* s[] (unimplemented) */
+ RPMTAG_BLINKHDRID = 1165, /* s[] (unimplemented) */
+ RPMTAG_BLINKNEVRA = 1166, /* s[] (unimplemented) */
+ RPMTAG_FLINKPKGID = 1167, /* s[] (unimplemented) */
+ RPMTAG_FLINKHDRID = 1168, /* s[] (unimplemented) */
+ RPMTAG_FLINKNEVRA = 1169, /* s[] (unimplemented) */
+ RPMTAG_PACKAGEORIGIN = 1170, /* s (unimplemented) */
+ RPMTAG_TRIGGERPREIN = 1171, /* internal */
+ RPMTAG_BUILDSUGGESTS = 1172, /* internal (unimplemented) */
+ RPMTAG_BUILDENHANCES = 1173, /* internal (unimplemented) */
+ RPMTAG_SCRIPTSTATES = 1174, /* i[] scriptlet exit codes (unimplemented) */
+ RPMTAG_SCRIPTMETRICS = 1175, /* i[] scriptlet execution times (unimplemented) */
+ RPMTAG_BUILDCPUCLOCK = 1176, /* i (unimplemented) */
+ RPMTAG_FILEDIGESTALGOS = 1177, /* i[] (unimplemented) */
+ RPMTAG_VARIANTS = 1178, /* s[] (unimplemented) */
+ RPMTAG_XMAJOR = 1179, /* i (unimplemented) */
+ RPMTAG_XMINOR = 1180, /* i (unimplemented) */
+ RPMTAG_REPOTAG = 1181, /* s (unimplemented) */
+ RPMTAG_KEYWORDS = 1182, /* s[] (unimplemented) */
+ RPMTAG_BUILDPLATFORMS = 1183, /* s[] (unimplemented) */
+ RPMTAG_PACKAGECOLOR = 1184, /* i (unimplemented) */
+ RPMTAG_PACKAGEPREFCOLOR = 1185, /* i (unimplemented) */
+ RPMTAG_XATTRSDICT = 1186, /* s[] (unimplemented) */
+ RPMTAG_FILEXATTRSX = 1187, /* i[] (unimplemented) */
+ RPMTAG_DEPATTRSDICT = 1188, /* s[] (unimplemented) */
+ RPMTAG_CONFLICTATTRSX = 1189, /* i[] (unimplemented) */
+ RPMTAG_OBSOLETEATTRSX = 1190, /* i[] (unimplemented) */
+ RPMTAG_PROVIDEATTRSX = 1191, /* i[] (unimplemented) */
+ RPMTAG_REQUIREATTRSX = 1192, /* i[] (unimplemented) */
+ RPMTAG_BUILDPROVIDES = 1193, /* internal (unimplemented) */
+ RPMTAG_BUILDOBSOLETES = 1194, /* internal (unimplemented) */
+ RPMTAG_DBINSTANCE = 1195, /* i extension */
+ RPMTAG_NVRA = 1196, /* s extension */
+
+ /* tags 1997-4999 reserved */
+ RPMTAG_FILENAMES = 5000, /* s[] extension */
+ RPMTAG_FILEPROVIDE = 5001, /* s[] extension */
+ RPMTAG_FILEREQUIRE = 5002, /* s[] extension */
+ RPMTAG_FSNAMES = 5003, /* s[] (unimplemented) */
+ RPMTAG_FSSIZES = 5004, /* l[] (unimplemented) */
+ RPMTAG_TRIGGERCONDS = 5005, /* s[] extension */
+ RPMTAG_TRIGGERTYPE = 5006, /* s[] extension */
+ RPMTAG_ORIGFILENAMES = 5007, /* s[] extension */
+ RPMTAG_LONGFILESIZES = 5008, /* l[] */
+ RPMTAG_LONGSIZE = 5009, /* l */
+ RPMTAG_FILECAPS = 5010, /* s[] */
+ RPMTAG_FILEDIGESTALGO = 5011, /* i file digest algorithm */
+ RPMTAG_BUGURL = 5012, /* s */
+ RPMTAG_EVR = 5013, /* s extension */
+ RPMTAG_NVR = 5014, /* s extension */
+ RPMTAG_NEVR = 5015, /* s extension */
+ RPMTAG_NEVRA = 5016, /* s extension */
+ RPMTAG_HEADERCOLOR = 5017, /* i extension */
+ RPMTAG_VERBOSE = 5018, /* i extension */
+ RPMTAG_EPOCHNUM = 5019, /* i extension */
+ RPMTAG_PREINFLAGS = 5020, /* i */
+ RPMTAG_POSTINFLAGS = 5021, /* i */
+ RPMTAG_PREUNFLAGS = 5022, /* i */
+ RPMTAG_POSTUNFLAGS = 5023, /* i */
+ RPMTAG_PRETRANSFLAGS = 5024, /* i */
+ RPMTAG_POSTTRANSFLAGS = 5025, /* i */
+ RPMTAG_VERIFYSCRIPTFLAGS = 5026, /* i */
+ RPMTAG_TRIGGERSCRIPTFLAGS = 5027, /* i[] */
+ RPMTAG_COLLECTIONS = 5029, /* s[] list of collections (unimplemented) */
+ RPMTAG_POLICYNAMES = 5030, /* s[] */
+ RPMTAG_POLICYTYPES = 5031, /* s[] */
+ RPMTAG_POLICYTYPESINDEXES = 5032, /* i[] */
+ RPMTAG_POLICYFLAGS = 5033, /* i[] */
+ RPMTAG_VCS = 5034, /* s */
+ RPMTAG_ORDERNAME = 5035, /* s[] */
+ RPMTAG_ORDERVERSION = 5036, /* s[] */
+ RPMTAG_ORDERFLAGS = 5037, /* i[] */
+ RPMTAG_MSSFMANIFEST = 5038, /* s[] reservation (unimplemented) */
+ RPMTAG_MSSFDOMAIN = 5039, /* s[] reservation (unimplemented) */
+ RPMTAG_INSTFILENAMES = 5040, /* s[] extension */
+ RPMTAG_REQUIRENEVRS = 5041, /* s[] extension */
+ RPMTAG_PROVIDENEVRS = 5042, /* s[] extension */
+ RPMTAG_OBSOLETENEVRS = 5043, /* s[] extension */
+ RPMTAG_CONFLICTNEVRS = 5044, /* s[] extension */
+ RPMTAG_FILENLINKS = 5045, /* i[] extension */
+ RPMTAG_RECOMMENDNAME = 5046, /* s[] */
+ RPMTAG_RECOMMENDS = RPMTAG_RECOMMENDNAME, /* s[] */
+ RPMTAG_RECOMMENDVERSION = 5047, /* s[] */
+ RPMTAG_RECOMMENDFLAGS = 5048, /* i[] */
+ RPMTAG_SUGGESTNAME = 5049, /* s[] */
+ RPMTAG_SUGGESTS = RPMTAG_SUGGESTNAME, /* s[] */
+ RPMTAG_SUGGESTVERSION = 5050, /* s[] extension */
+ RPMTAG_SUGGESTFLAGS = 5051, /* i[] extension */
+ RPMTAG_SUPPLEMENTNAME = 5052, /* s[] */
+ RPMTAG_SUPPLEMENTS = RPMTAG_SUPPLEMENTNAME, /* s[] */
+ RPMTAG_SUPPLEMENTVERSION = 5053, /* s[] */
+ RPMTAG_SUPPLEMENTFLAGS = 5054, /* i[] */
+ RPMTAG_ENHANCENAME = 5055, /* s[] */
+ RPMTAG_ENHANCES = RPMTAG_ENHANCENAME, /* s[] */
+ RPMTAG_ENHANCEVERSION = 5056, /* s[] */
+ RPMTAG_ENHANCEFLAGS = 5057, /* i[] */
+ RPMTAG_RECOMMENDNEVRS = 5058, /* s[] extension */
+ RPMTAG_SUGGESTNEVRS = 5059, /* s[] extension */
+ RPMTAG_SUPPLEMENTNEVRS = 5060, /* s[] extension */
+ RPMTAG_ENHANCENEVRS = 5061, /* s[] extension */
+ RPMTAG_ENCODING = 5062, /* s */
+ RPMTAG_FILETRIGGERIN = 5063, /* internal */
+ RPMTAG_FILETRIGGERUN = 5064, /* internal */
+ RPMTAG_FILETRIGGERPOSTUN = 5065, /* internal */
+ RPMTAG_FILETRIGGERSCRIPTS = 5066, /* s[] */
+ RPMTAG_FILETRIGGERSCRIPTPROG = 5067, /* s[] */
+ RPMTAG_FILETRIGGERSCRIPTFLAGS = 5068, /* i[] */
+ RPMTAG_FILETRIGGERNAME = 5069, /* s[] */
+ RPMTAG_FILETRIGGERINDEX = 5070, /* i[] */
+ RPMTAG_FILETRIGGERVERSION = 5071, /* s[] */
+ RPMTAG_FILETRIGGERFLAGS = 5072, /* i[] */
+ RPMTAG_TRANSFILETRIGGERIN = 5073, /* internal */
+ RPMTAG_TRANSFILETRIGGERUN = 5074, /* internal */
+ RPMTAG_TRANSFILETRIGGERPOSTUN = 5075, /* internal */
+ RPMTAG_TRANSFILETRIGGERSCRIPTS = 5076, /* s[] */
+ RPMTAG_TRANSFILETRIGGERSCRIPTPROG = 5077, /* s[] */
+ RPMTAG_TRANSFILETRIGGERSCRIPTFLAGS = 5078, /* i[] */
+ RPMTAG_TRANSFILETRIGGERNAME = 5079, /* s[] */
+ RPMTAG_TRANSFILETRIGGERINDEX = 5080, /* i[] */
+ RPMTAG_TRANSFILETRIGGERVERSION = 5081, /* s[] */
+ RPMTAG_TRANSFILETRIGGERFLAGS = 5082, /* i[] */
+ RPMTAG_REMOVEPATHPOSTFIXES = 5083, /* s internal */
+ RPMTAG_FILETRIGGERPRIORITIES = 5084, /* i[] */
+ RPMTAG_TRANSFILETRIGGERPRIORITIES = 5085, /* i[] */
+ RPMTAG_FILETRIGGERCONDS = 5086, /* s[] extension */
+ RPMTAG_FILETRIGGERTYPE = 5087, /* s[] extension */
+ RPMTAG_TRANSFILETRIGGERCONDS = 5088, /* s[] extension */
+ RPMTAG_TRANSFILETRIGGERTYPE = 5089, /* s[] extension */
+ RPMTAG_FILESIGNATURES = 5090, /* s[] */
+ RPMTAG_FILESIGNATURELENGTH = 5091, /* i */
+ RPMTAG_PAYLOADDIGEST = 5092, /* s[] */
+ RPMTAG_PAYLOADDIGESTALGO = 5093, /* i */
+ RPMTAG_AUTOINSTALLED = 5094, /* i reservation (unimplemented) */
+ RPMTAG_IDENTITY = 5095, /* s reservation (unimplemented) */
+ RPMTAG_MODULARITYLABEL = 5096, /* s */
+ RPMTAG_PAYLOADDIGESTALT = 5097, /* s[] */
+
+ RPMTAG_FIRSTFREE_TAG, /*!< internal */
+ RPMTAG_EXTERNAL_TAG = 1000000,
+};
+
+/**
+ * Rpm database index tags.
+ */
+enum rpmDbiTag {
+ RPMDBI_PACKAGES = 0, /* Installed package headers. */
+ RPMDBI_LABEL = 2, /* NEVRA label pseudo index */
+ RPMDBI_NAME = 1000, /* RPMTAG_NAME */
+ RPMDBI_BASENAMES = 1117, /* RPMTAG_BASENAMES */
+ RPMDBI_GROUP = 1016, /* RPMTAG_GROUP */
+ RPMDBI_REQUIRENAME = 1049, /* RPMTAG_REQUIRENAME */
+ RPMDBI_PROVIDENAME = 1047, /* RPMTAG_PROVIDENAME */
+ RPMDBI_CONFLICTNAME = 1054, /* RPMTAG_CONFLICTNAME */
+ RPMDBI_OBSOLETENAME = 1090, /* RPMTAG_OBSOLETENAME */
+ RPMDBI_TRIGGERNAME = 1066, /* RPMTAG_TRIGGERNAME */
+ RPMDBI_DIRNAMES = 1118, /* RPMTAG_DIRNAMES */
+ RPMDBI_INSTALLTID = 1128, /* RPMTAG_INSTALLTID */
+ RPMDBI_SIGMD5 = HEADER_SIGBASE+5, /* RPMTAG_SIGMD5 */
+ RPMDBI_SHA1HEADER = HEADER_SIGBASE+13, /* RPMTAG_SHA1HEADER */
+ RPMDBI_INSTFILENAMES = 5040, /* RPMTAG_INSTFILENAMES */
+ RPMDBI_FILETRIGGERNAME = 5069, /* RPMTAG_FILETRIGGERNAME */
+ RPMDBI_TRANSFILETRIGGERNAME = 5079, /* RPMTAG_TRANSFILETRIGGERNAME */
+ RPMDBI_RECOMMENDNAME = 5046, /* RPMTAG_RECOMMENDNAME */
+ RPMDBI_SUGGESTNAME = 5049, /* RPMTAG_SUGGESTNAME */
+ RPMDBI_SUPPLEMENTNAME = 5052, /* RPMTAG_SUPPLEMENTNAME */
+ RPMDBI_ENHANCENAME = 5055, /* RPMTAG_ENHANCENAME */
+};
+
+/**
+ * Tags found in signature header from package.
+ */
+enum rpmSigTag {
+ RPMSIGTAG_SIZE = 1000, /*!< internal Header+Payload size (32bit) in bytes. */
+ RPMSIGTAG_LEMD5_1 = 1001, /*!< internal Broken MD5, take 1 @deprecated legacy. */
+ RPMSIGTAG_PGP = 1002, /*!< internal PGP 2.6.3 signature. */
+ RPMSIGTAG_LEMD5_2 = 1003, /*!< internal Broken MD5, take 2 @deprecated legacy. */
+ RPMSIGTAG_MD5 = 1004, /*!< internal MD5 signature. */
+ RPMSIGTAG_GPG = 1005, /*!< internal GnuPG signature. */
+ RPMSIGTAG_PGP5 = 1006, /*!< internal PGP5 signature @deprecated legacy. */
+ RPMSIGTAG_PAYLOADSIZE = 1007, /*!< internal uncompressed payload size (32bit) in bytes. */
+ RPMSIGTAG_RESERVEDSPACE = 1008, /*!< internal space reserved for signatures */
+ RPMSIGTAG_BADSHA1_1 = HEADER_SIGBASE+8, /*!< internal Broken SHA1, take 1. // RPMTAG_BADSHA1_1 */
+ RPMSIGTAG_BADSHA1_2 = HEADER_SIGBASE+9, /*!< internal Broken SHA1, take 2. // RPMTAG_BADSHA1_2 */
+ RPMSIGTAG_DSA = HEADER_SIGBASE+11, /*!< internal DSA header signature. // RPMTAG_DSAHEADER */
+ RPMSIGTAG_RSA = HEADER_SIGBASE+12, /*!< internal RSA header signature. // RPMTAG_RSAHEADER */
+ RPMSIGTAG_SHA1 = HEADER_SIGBASE+13, /*!< internal sha1 header digest. // RPMTAG_SHA1HEADER */
+ RPMSIGTAG_LONGSIZE = HEADER_SIGBASE+14, /*!< internal Header+Payload size (64bit) in bytes. // RPMTAG_LONGSIGSIZE */
+ RPMSIGTAG_LONGARCHIVESIZE = HEADER_SIGBASE+15, /*!< internal uncompressed payload size (64bit) in bytes. // RPMTAG_LONGARCHIVESIZE */
+ RPMSIGTAG_SHA256 = HEADER_SIGBASE+17, /* RPMTAG_SHA256HEADER */
+ RPMSIGTAG_FILESIGNATURES = HEADER_SIGBASE + 18,
+ RPMSIGTAG_FILESIGNATURELENGTH = HEADER_SIGBASE + 19,
+};
+
+/**
+ * The basic types of data in tags from headers.
+ */
+enum rpmTagType {
+ RPM_NULL_TYPE = 0,
+ RPM_CHAR_TYPE = 1,
+ RPM_INT8_TYPE = 2,
+ RPM_INT16_TYPE = 3,
+ RPM_INT32_TYPE = 4,
+ RPM_INT64_TYPE = 5,
+ RPM_STRING_TYPE = 6,
+ RPM_BIN_TYPE = 7,
+ RPM_STRING_ARRAY_TYPE = 8,
+ RPM_I18NSTRING_TYPE = 9,
+};
+
+/**
+ * The classes of data in tags from headers.
+ */
+enum rpmTagClass {
+ RPM_NULL_CLASS = 0,
+ RPM_NUMERIC_CLASS = 1,
+ RPM_STRING_CLASS = 2,
+ RPM_BINARY_CLASS = 3,
+};
+
+struct entryInfo {
+ rpm_tag_t tag; /*!< Tag identifier. */
+ rpm_tagtype_t type; /*!< Tag data type. */
+ int32_t offset; /*!< Offset into data segment (ondisk only). */
+ rpm_count_t count; /*!< Number of tag elements. */
+};
+
+#define REGION_TAG_TYPE 7
+
+struct header_intro {
+ uint32_t index_length;
+ uint32_t data_length;
+ entryInfo entries[index_length];
+};
+""" # noqa: E501
+c_rpm = cstruct(endian=">").load(rpm_def)
diff --git a/dissect/bsddb/tools/c_rpm.pyi b/dissect/bsddb/tools/c_rpm.pyi
new file mode 100644
index 0000000..c69f097
--- /dev/null
+++ b/dissect/bsddb/tools/c_rpm.pyi
@@ -0,0 +1,461 @@
+# Generated by cstruct-stubgen
+from typing import BinaryIO, Literal, overload
+
+import dissect.cstruct as __cs__
+from typing_extensions import TypeAlias
+
+class _c_rpm(__cs__.cstruct):
+ HEADER_IMAGE: Literal[61] = ...
+ HEADER_SIGNATURES: Literal[62] = ...
+ HEADER_IMMUTABLE: Literal[63] = ...
+ HEADER_REGIONS: Literal[64] = ...
+ HEADER_I18NTABLE: Literal[100] = ...
+ HEADER_SIGBASE: Literal[256] = ...
+ HEADER_TAGBASE: Literal[1000] = ...
+ REGION_TAG_TYPE: Literal[7] = ...
+ rpm_tag_t: TypeAlias = _c_rpm.uint32
+ rpm_tagtype_t: TypeAlias = _c_rpm.uint32
+ rpm_count_t: TypeAlias = _c_rpm.uint32
+ class rpmTag(__cs__.Enum):
+ RPMTAG_NOT_FOUND = ...
+ RPMTAG_HEADERIMAGE = ...
+ RPMTAG_HEADERSIGNATURES = ...
+ RPMTAG_HEADERIMMUTABLE = ...
+ RPMTAG_HEADERREGIONS = ...
+ RPMTAG_HEADERI18NTABLE = ...
+ RPMTAG_SIG_BASE = ...
+ RPMTAG_SIGSIZE = ...
+ RPMTAG_SIGLEMD5_1 = ...
+ RPMTAG_SIGPGP = ...
+ RPMTAG_SIGLEMD5_2 = ...
+ RPMTAG_SIGMD5 = ...
+ RPMTAG_PKGID = ...
+ RPMTAG_SIGGPG = ...
+ RPMTAG_SIGPGP5 = ...
+ RPMTAG_BADSHA1_1 = ...
+ RPMTAG_BADSHA1_2 = ...
+ RPMTAG_PUBKEYS = ...
+ RPMTAG_DSAHEADER = ...
+ RPMTAG_RSAHEADER = ...
+ RPMTAG_SHA1HEADER = ...
+ RPMTAG_HDRID = ...
+ RPMTAG_LONGSIGSIZE = ...
+ RPMTAG_LONGARCHIVESIZE = ...
+ RPMTAG_SHA256HEADER = ...
+ RPMTAG_NAME = ...
+ RPMTAG_N = ...
+ RPMTAG_VERSION = ...
+ RPMTAG_V = ...
+ RPMTAG_RELEASE = ...
+ RPMTAG_R = ...
+ RPMTAG_EPOCH = ...
+ RPMTAG_E = ...
+ RPMTAG_SUMMARY = ...
+ RPMTAG_DESCRIPTION = ...
+ RPMTAG_BUILDTIME = ...
+ RPMTAG_BUILDHOST = ...
+ RPMTAG_INSTALLTIME = ...
+ RPMTAG_SIZE = ...
+ RPMTAG_DISTRIBUTION = ...
+ RPMTAG_VENDOR = ...
+ RPMTAG_GIF = ...
+ RPMTAG_XPM = ...
+ RPMTAG_LICENSE = ...
+ RPMTAG_PACKAGER = ...
+ RPMTAG_GROUP = ...
+ RPMTAG_CHANGELOG = ...
+ RPMTAG_SOURCE = ...
+ RPMTAG_PATCH = ...
+ RPMTAG_URL = ...
+ RPMTAG_OS = ...
+ RPMTAG_ARCH = ...
+ RPMTAG_PREIN = ...
+ RPMTAG_POSTIN = ...
+ RPMTAG_PREUN = ...
+ RPMTAG_POSTUN = ...
+ RPMTAG_OLDFILENAMES = ...
+ RPMTAG_FILESIZES = ...
+ RPMTAG_FILESTATES = ...
+ RPMTAG_FILEMODES = ...
+ RPMTAG_FILEUIDS = ...
+ RPMTAG_FILEGIDS = ...
+ RPMTAG_FILERDEVS = ...
+ RPMTAG_FILEMTIMES = ...
+ RPMTAG_FILEDIGESTS = ...
+ RPMTAG_FILEMD5S = ...
+ RPMTAG_FILELINKTOS = ...
+ RPMTAG_FILEFLAGS = ...
+ RPMTAG_ROOT = ...
+ RPMTAG_FILEUSERNAME = ...
+ RPMTAG_FILEGROUPNAME = ...
+ RPMTAG_EXCLUDE = ...
+ RPMTAG_EXCLUSIVE = ...
+ RPMTAG_ICON = ...
+ RPMTAG_SOURCERPM = ...
+ RPMTAG_FILEVERIFYFLAGS = ...
+ RPMTAG_ARCHIVESIZE = ...
+ RPMTAG_PROVIDENAME = ...
+ RPMTAG_PROVIDES = ...
+ RPMTAG_P = ...
+ RPMTAG_REQUIREFLAGS = ...
+ RPMTAG_REQUIRENAME = ...
+ RPMTAG_REQUIRES = ...
+ RPMTAG_REQUIREVERSION = ...
+ RPMTAG_NOSOURCE = ...
+ RPMTAG_NOPATCH = ...
+ RPMTAG_CONFLICTFLAGS = ...
+ RPMTAG_CONFLICTNAME = ...
+ RPMTAG_CONFLICTS = ...
+ RPMTAG_C = ...
+ RPMTAG_CONFLICTVERSION = ...
+ RPMTAG_DEFAULTPREFIX = ...
+ RPMTAG_BUILDROOT = ...
+ RPMTAG_INSTALLPREFIX = ...
+ RPMTAG_EXCLUDEARCH = ...
+ RPMTAG_EXCLUDEOS = ...
+ RPMTAG_EXCLUSIVEARCH = ...
+ RPMTAG_EXCLUSIVEOS = ...
+ RPMTAG_AUTOREQPROV = ...
+ RPMTAG_RPMVERSION = ...
+ RPMTAG_TRIGGERSCRIPTS = ...
+ RPMTAG_TRIGGERNAME = ...
+ RPMTAG_TRIGGERVERSION = ...
+ RPMTAG_TRIGGERFLAGS = ...
+ RPMTAG_TRIGGERINDEX = ...
+ RPMTAG_VERIFYSCRIPT = ...
+ RPMTAG_CHANGELOGTIME = ...
+ RPMTAG_CHANGELOGNAME = ...
+ RPMTAG_CHANGELOGTEXT = ...
+ RPMTAG_BROKENMD5 = ...
+ RPMTAG_PREREQ = ...
+ RPMTAG_PREINPROG = ...
+ RPMTAG_POSTINPROG = ...
+ RPMTAG_PREUNPROG = ...
+ RPMTAG_POSTUNPROG = ...
+ RPMTAG_BUILDARCHS = ...
+ RPMTAG_OBSOLETENAME = ...
+ RPMTAG_OBSOLETES = ...
+ RPMTAG_O = ...
+ RPMTAG_VERIFYSCRIPTPROG = ...
+ RPMTAG_TRIGGERSCRIPTPROG = ...
+ RPMTAG_DOCDIR = ...
+ RPMTAG_COOKIE = ...
+ RPMTAG_FILEDEVICES = ...
+ RPMTAG_FILEINODES = ...
+ RPMTAG_FILELANGS = ...
+ RPMTAG_PREFIXES = ...
+ RPMTAG_INSTPREFIXES = ...
+ RPMTAG_TRIGGERIN = ...
+ RPMTAG_TRIGGERUN = ...
+ RPMTAG_TRIGGERPOSTUN = ...
+ RPMTAG_AUTOREQ = ...
+ RPMTAG_AUTOPROV = ...
+ RPMTAG_CAPABILITY = ...
+ RPMTAG_SOURCEPACKAGE = ...
+ RPMTAG_OLDORIGFILENAMES = ...
+ RPMTAG_BUILDPREREQ = ...
+ RPMTAG_BUILDREQUIRES = ...
+ RPMTAG_BUILDCONFLICTS = ...
+ RPMTAG_BUILDMACROS = ...
+ RPMTAG_PROVIDEFLAGS = ...
+ RPMTAG_PROVIDEVERSION = ...
+ RPMTAG_OBSOLETEFLAGS = ...
+ RPMTAG_OBSOLETEVERSION = ...
+ RPMTAG_DIRINDEXES = ...
+ RPMTAG_BASENAMES = ...
+ RPMTAG_DIRNAMES = ...
+ RPMTAG_ORIGDIRINDEXES = ...
+ RPMTAG_ORIGBASENAMES = ...
+ RPMTAG_ORIGDIRNAMES = ...
+ RPMTAG_OPTFLAGS = ...
+ RPMTAG_DISTURL = ...
+ RPMTAG_PAYLOADFORMAT = ...
+ RPMTAG_PAYLOADCOMPRESSOR = ...
+ RPMTAG_PAYLOADFLAGS = ...
+ RPMTAG_INSTALLCOLOR = ...
+ RPMTAG_INSTALLTID = ...
+ RPMTAG_REMOVETID = ...
+ RPMTAG_SHA1RHN = ...
+ RPMTAG_RHNPLATFORM = ...
+ RPMTAG_PLATFORM = ...
+ RPMTAG_PATCHESNAME = ...
+ RPMTAG_PATCHESFLAGS = ...
+ RPMTAG_PATCHESVERSION = ...
+ RPMTAG_CACHECTIME = ...
+ RPMTAG_CACHEPKGPATH = ...
+ RPMTAG_CACHEPKGSIZE = ...
+ RPMTAG_CACHEPKGMTIME = ...
+ RPMTAG_FILECOLORS = ...
+ RPMTAG_FILECLASS = ...
+ RPMTAG_CLASSDICT = ...
+ RPMTAG_FILEDEPENDSX = ...
+ RPMTAG_FILEDEPENDSN = ...
+ RPMTAG_DEPENDSDICT = ...
+ RPMTAG_SOURCEPKGID = ...
+ RPMTAG_FILECONTEXTS = ...
+ RPMTAG_FSCONTEXTS = ...
+ RPMTAG_RECONTEXTS = ...
+ RPMTAG_POLICIES = ...
+ RPMTAG_PRETRANS = ...
+ RPMTAG_POSTTRANS = ...
+ RPMTAG_PRETRANSPROG = ...
+ RPMTAG_POSTTRANSPROG = ...
+ RPMTAG_DISTTAG = ...
+ RPMTAG_OLDSUGGESTSNAME = ...
+ RPMTAG_OLDSUGGESTS = ...
+ RPMTAG_OLDSUGGESTSVERSION = ...
+ RPMTAG_OLDSUGGESTSFLAGS = ...
+ RPMTAG_OLDENHANCESNAME = ...
+ RPMTAG_OLDENHANCES = ...
+ RPMTAG_OLDENHANCESVERSION = ...
+ RPMTAG_OLDENHANCESFLAGS = ...
+ RPMTAG_PRIORITY = ...
+ RPMTAG_CVSID = ...
+ RPMTAG_SVNID = ...
+ RPMTAG_BLINKPKGID = ...
+ RPMTAG_BLINKHDRID = ...
+ RPMTAG_BLINKNEVRA = ...
+ RPMTAG_FLINKPKGID = ...
+ RPMTAG_FLINKHDRID = ...
+ RPMTAG_FLINKNEVRA = ...
+ RPMTAG_PACKAGEORIGIN = ...
+ RPMTAG_TRIGGERPREIN = ...
+ RPMTAG_BUILDSUGGESTS = ...
+ RPMTAG_BUILDENHANCES = ...
+ RPMTAG_SCRIPTSTATES = ...
+ RPMTAG_SCRIPTMETRICS = ...
+ RPMTAG_BUILDCPUCLOCK = ...
+ RPMTAG_FILEDIGESTALGOS = ...
+ RPMTAG_VARIANTS = ...
+ RPMTAG_XMAJOR = ...
+ RPMTAG_XMINOR = ...
+ RPMTAG_REPOTAG = ...
+ RPMTAG_KEYWORDS = ...
+ RPMTAG_BUILDPLATFORMS = ...
+ RPMTAG_PACKAGECOLOR = ...
+ RPMTAG_PACKAGEPREFCOLOR = ...
+ RPMTAG_XATTRSDICT = ...
+ RPMTAG_FILEXATTRSX = ...
+ RPMTAG_DEPATTRSDICT = ...
+ RPMTAG_CONFLICTATTRSX = ...
+ RPMTAG_OBSOLETEATTRSX = ...
+ RPMTAG_PROVIDEATTRSX = ...
+ RPMTAG_REQUIREATTRSX = ...
+ RPMTAG_BUILDPROVIDES = ...
+ RPMTAG_BUILDOBSOLETES = ...
+ RPMTAG_DBINSTANCE = ...
+ RPMTAG_NVRA = ...
+ RPMTAG_FILENAMES = ...
+ RPMTAG_FILEPROVIDE = ...
+ RPMTAG_FILEREQUIRE = ...
+ RPMTAG_FSNAMES = ...
+ RPMTAG_FSSIZES = ...
+ RPMTAG_TRIGGERCONDS = ...
+ RPMTAG_TRIGGERTYPE = ...
+ RPMTAG_ORIGFILENAMES = ...
+ RPMTAG_LONGFILESIZES = ...
+ RPMTAG_LONGSIZE = ...
+ RPMTAG_FILECAPS = ...
+ RPMTAG_FILEDIGESTALGO = ...
+ RPMTAG_BUGURL = ...
+ RPMTAG_EVR = ...
+ RPMTAG_NVR = ...
+ RPMTAG_NEVR = ...
+ RPMTAG_NEVRA = ...
+ RPMTAG_HEADERCOLOR = ...
+ RPMTAG_VERBOSE = ...
+ RPMTAG_EPOCHNUM = ...
+ RPMTAG_PREINFLAGS = ...
+ RPMTAG_POSTINFLAGS = ...
+ RPMTAG_PREUNFLAGS = ...
+ RPMTAG_POSTUNFLAGS = ...
+ RPMTAG_PRETRANSFLAGS = ...
+ RPMTAG_POSTTRANSFLAGS = ...
+ RPMTAG_VERIFYSCRIPTFLAGS = ...
+ RPMTAG_TRIGGERSCRIPTFLAGS = ...
+ RPMTAG_COLLECTIONS = ...
+ RPMTAG_POLICYNAMES = ...
+ RPMTAG_POLICYTYPES = ...
+ RPMTAG_POLICYTYPESINDEXES = ...
+ RPMTAG_POLICYFLAGS = ...
+ RPMTAG_VCS = ...
+ RPMTAG_ORDERNAME = ...
+ RPMTAG_ORDERVERSION = ...
+ RPMTAG_ORDERFLAGS = ...
+ RPMTAG_MSSFMANIFEST = ...
+ RPMTAG_MSSFDOMAIN = ...
+ RPMTAG_INSTFILENAMES = ...
+ RPMTAG_REQUIRENEVRS = ...
+ RPMTAG_PROVIDENEVRS = ...
+ RPMTAG_OBSOLETENEVRS = ...
+ RPMTAG_CONFLICTNEVRS = ...
+ RPMTAG_FILENLINKS = ...
+ RPMTAG_RECOMMENDNAME = ...
+ RPMTAG_RECOMMENDS = ...
+ RPMTAG_RECOMMENDVERSION = ...
+ RPMTAG_RECOMMENDFLAGS = ...
+ RPMTAG_SUGGESTNAME = ...
+ RPMTAG_SUGGESTS = ...
+ RPMTAG_SUGGESTVERSION = ...
+ RPMTAG_SUGGESTFLAGS = ...
+ RPMTAG_SUPPLEMENTNAME = ...
+ RPMTAG_SUPPLEMENTS = ...
+ RPMTAG_SUPPLEMENTVERSION = ...
+ RPMTAG_SUPPLEMENTFLAGS = ...
+ RPMTAG_ENHANCENAME = ...
+ RPMTAG_ENHANCES = ...
+ RPMTAG_ENHANCEVERSION = ...
+ RPMTAG_ENHANCEFLAGS = ...
+ RPMTAG_RECOMMENDNEVRS = ...
+ RPMTAG_SUGGESTNEVRS = ...
+ RPMTAG_SUPPLEMENTNEVRS = ...
+ RPMTAG_ENHANCENEVRS = ...
+ RPMTAG_ENCODING = ...
+ RPMTAG_FILETRIGGERIN = ...
+ RPMTAG_FILETRIGGERUN = ...
+ RPMTAG_FILETRIGGERPOSTUN = ...
+ RPMTAG_FILETRIGGERSCRIPTS = ...
+ RPMTAG_FILETRIGGERSCRIPTPROG = ...
+ RPMTAG_FILETRIGGERSCRIPTFLAGS = ...
+ RPMTAG_FILETRIGGERNAME = ...
+ RPMTAG_FILETRIGGERINDEX = ...
+ RPMTAG_FILETRIGGERVERSION = ...
+ RPMTAG_FILETRIGGERFLAGS = ...
+ RPMTAG_TRANSFILETRIGGERIN = ...
+ RPMTAG_TRANSFILETRIGGERUN = ...
+ RPMTAG_TRANSFILETRIGGERPOSTUN = ...
+ RPMTAG_TRANSFILETRIGGERSCRIPTS = ...
+ RPMTAG_TRANSFILETRIGGERSCRIPTPROG = ...
+ RPMTAG_TRANSFILETRIGGERSCRIPTFLAGS = ...
+ RPMTAG_TRANSFILETRIGGERNAME = ...
+ RPMTAG_TRANSFILETRIGGERINDEX = ...
+ RPMTAG_TRANSFILETRIGGERVERSION = ...
+ RPMTAG_TRANSFILETRIGGERFLAGS = ...
+ RPMTAG_REMOVEPATHPOSTFIXES = ...
+ RPMTAG_FILETRIGGERPRIORITIES = ...
+ RPMTAG_TRANSFILETRIGGERPRIORITIES = ...
+ RPMTAG_FILETRIGGERCONDS = ...
+ RPMTAG_FILETRIGGERTYPE = ...
+ RPMTAG_TRANSFILETRIGGERCONDS = ...
+ RPMTAG_TRANSFILETRIGGERTYPE = ...
+ RPMTAG_FILESIGNATURES = ...
+ RPMTAG_FILESIGNATURELENGTH = ...
+ RPMTAG_PAYLOADDIGEST = ...
+ RPMTAG_PAYLOADDIGESTALGO = ...
+ RPMTAG_AUTOINSTALLED = ...
+ RPMTAG_IDENTITY = ...
+ RPMTAG_MODULARITYLABEL = ...
+ RPMTAG_PAYLOADDIGESTALT = ...
+ RPMTAG_FIRSTFREE_TAG = ...
+ RPMTAG_EXTERNAL_TAG = ...
+
+ class rpmDbiTag(__cs__.Enum):
+ RPMDBI_PACKAGES = ...
+ RPMDBI_LABEL = ...
+ RPMDBI_NAME = ...
+ RPMDBI_BASENAMES = ...
+ RPMDBI_GROUP = ...
+ RPMDBI_REQUIRENAME = ...
+ RPMDBI_PROVIDENAME = ...
+ RPMDBI_CONFLICTNAME = ...
+ RPMDBI_OBSOLETENAME = ...
+ RPMDBI_TRIGGERNAME = ...
+ RPMDBI_DIRNAMES = ...
+ RPMDBI_INSTALLTID = ...
+ RPMDBI_SIGMD5 = ...
+ RPMDBI_SHA1HEADER = ...
+ RPMDBI_INSTFILENAMES = ...
+ RPMDBI_FILETRIGGERNAME = ...
+ RPMDBI_TRANSFILETRIGGERNAME = ...
+ RPMDBI_RECOMMENDNAME = ...
+ RPMDBI_SUGGESTNAME = ...
+ RPMDBI_SUPPLEMENTNAME = ...
+ RPMDBI_ENHANCENAME = ...
+
+ class rpmSigTag(__cs__.Enum):
+ RPMSIGTAG_SIZE = ...
+ RPMSIGTAG_LEMD5_1 = ...
+ RPMSIGTAG_PGP = ...
+ RPMSIGTAG_LEMD5_2 = ...
+ RPMSIGTAG_MD5 = ...
+ RPMSIGTAG_GPG = ...
+ RPMSIGTAG_PGP5 = ...
+ RPMSIGTAG_PAYLOADSIZE = ...
+ RPMSIGTAG_RESERVEDSPACE = ...
+ RPMSIGTAG_BADSHA1_1 = ...
+ RPMSIGTAG_BADSHA1_2 = ...
+ RPMSIGTAG_DSA = ...
+ RPMSIGTAG_RSA = ...
+ RPMSIGTAG_SHA1 = ...
+ RPMSIGTAG_LONGSIZE = ...
+ RPMSIGTAG_LONGARCHIVESIZE = ...
+ RPMSIGTAG_SHA256 = ...
+ RPMSIGTAG_FILESIGNATURES = ...
+ RPMSIGTAG_FILESIGNATURELENGTH = ...
+
+ class rpmTagType(__cs__.Enum):
+ RPM_NULL_TYPE = ...
+ RPM_CHAR_TYPE = ...
+ RPM_INT8_TYPE = ...
+ RPM_INT16_TYPE = ...
+ RPM_INT32_TYPE = ...
+ RPM_INT64_TYPE = ...
+ RPM_STRING_TYPE = ...
+ RPM_BIN_TYPE = ...
+ RPM_STRING_ARRAY_TYPE = ...
+ RPM_I18NSTRING_TYPE = ...
+
+ class rpmTagClass(__cs__.Enum):
+ RPM_NULL_CLASS = ...
+ RPM_NUMERIC_CLASS = ...
+ RPM_STRING_CLASS = ...
+ RPM_BINARY_CLASS = ...
+
+ class entryInfo(__cs__.Structure):
+ tag: _c_rpm.uint32
+ type: _c_rpm.uint32
+ offset: _c_rpm.int32
+ count: _c_rpm.uint32
+ @overload
+ def __init__(
+ self,
+ tag: _c_rpm.uint32 | None = ...,
+ type: _c_rpm.uint32 | None = ...,
+ offset: _c_rpm.int32 | None = ...,
+ count: _c_rpm.uint32 | None = ...,
+ ): ...
+ @overload
+ def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+ class header_intro(__cs__.Structure):
+ index_length: _c_rpm.uint32
+ data_length: _c_rpm.uint32
+ class entryInfo(__cs__.Structure):
+ tag: _c_rpm.uint32
+ type: _c_rpm.uint32
+ offset: _c_rpm.int32
+ count: _c_rpm.uint32
+ @overload
+ def __init__(
+ self,
+ tag: _c_rpm.uint32 | None = ...,
+ type: _c_rpm.uint32 | None = ...,
+ offset: _c_rpm.int32 | None = ...,
+ count: _c_rpm.uint32 | None = ...,
+ ): ...
+ @overload
+ def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+ entries: __cs__.Array[entryInfo]
+ @overload
+ def __init__(
+ self,
+ index_length: _c_rpm.uint32 | None = ...,
+ data_length: _c_rpm.uint32 | None = ...,
+ entries: __cs__.Array[entryInfo] | None = ...,
+ ): ...
+ @overload
+ def __init__(self, fh: bytes | memoryview | bytearray | BinaryIO, /): ...
+
+# Technically `c_rpm` is an instance of `_c_rpm`, but then we can't use it in type hints
+c_rpm: TypeAlias = _c_rpm
diff --git a/dissect/bsddb/tools/rpm.py b/dissect/bsddb/tools/rpm.py
new file mode 100644
index 0000000..e013817
--- /dev/null
+++ b/dissect/bsddb/tools/rpm.py
@@ -0,0 +1,241 @@
+# Reference:
+# - https://rpm.org/docs/
+from __future__ import annotations
+
+import argparse
+import posixpath
+import stat
+from pathlib import Path
+from typing import TYPE_CHECKING, Any, BinaryIO, NamedTuple
+
+from dissect.bsddb import bsddb
+from dissect.bsddb.tools.c_rpm import c_rpm
+
+if TYPE_CHECKING:
+ from collections.abc import Iterator
+
+
+TYPE_SIZE_MAP = {
+ c_rpm.rpmTagType.RPM_NULL_TYPE: 0,
+ c_rpm.rpmTagType.RPM_CHAR_TYPE: 1,
+ c_rpm.rpmTagType.RPM_INT8_TYPE: 2,
+ c_rpm.rpmTagType.RPM_INT16_TYPE: 2,
+ c_rpm.rpmTagType.RPM_INT32_TYPE: 4,
+ c_rpm.rpmTagType.RPM_INT64_TYPE: 8,
+ c_rpm.rpmTagType.RPM_STRING_TYPE: -1,
+ c_rpm.rpmTagType.RPM_BIN_TYPE: 1,
+ c_rpm.rpmTagType.RPM_STRING_ARRAY_TYPE: -1,
+ c_rpm.rpmTagType.RPM_I18NSTRING_TYPE: -1,
+}
+
+
+TYPE_PARSERS = {
+ c_rpm.rpmTagType.RPM_NULL_TYPE: lambda _: None,
+ c_rpm.rpmTagType.RPM_CHAR_TYPE: c_rpm.char,
+ c_rpm.rpmTagType.RPM_INT8_TYPE: c_rpm.uint8,
+ c_rpm.rpmTagType.RPM_INT16_TYPE: c_rpm.uint16,
+ c_rpm.rpmTagType.RPM_INT32_TYPE: c_rpm.uint32,
+ c_rpm.rpmTagType.RPM_INT64_TYPE: c_rpm.uint64,
+ c_rpm.rpmTagType.RPM_STRING_TYPE: lambda v: v.split(b"\x00")[0].decode(),
+ c_rpm.rpmTagType.RPM_BIN_TYPE: lambda v: v,
+ c_rpm.rpmTagType.RPM_STRING_ARRAY_TYPE: lambda v, c: [s.decode() for s in v.split(b"\x00")[:c]],
+ c_rpm.rpmTagType.RPM_I18NSTRING_TYPE: lambda v: v.split(b"\x00")[0].decode(),
+}
+
+ARRAY_TYPES = (
+ c_rpm.rpmTagType.RPM_CHAR_TYPE,
+ c_rpm.rpmTagType.RPM_INT8_TYPE,
+ c_rpm.rpmTagType.RPM_INT16_TYPE,
+ c_rpm.rpmTagType.RPM_INT32_TYPE,
+ c_rpm.rpmTagType.RPM_INT64_TYPE,
+)
+
+
+class PackageEntry(NamedTuple):
+ path: str
+ size: int
+ mode: int
+ mtime: int
+ user: str
+ group: str
+ digest: bytes
+
+
+class File(PackageEntry):
+ pass
+
+
+class Directory(PackageEntry):
+ pass
+
+
+class Package:
+ """RPM Package.
+
+ Args:
+ buf: Bytes containing the RPM Package header blob.
+ """
+
+ def __init__(self, buf: bytes):
+ self.blob = HeaderBlob(buf)
+
+ def __repr__(self) -> str:
+ return f""
+
+ def __iter__(self) -> Iterator[File | Directory]:
+ return self.entries()
+
+ @property
+ def name(self) -> str:
+ """Package name."""
+ return self.blob.value(c_rpm.rpmTag.RPMTAG_NAME)
+
+ @property
+ def version(self) -> str:
+ """Package version."""
+ return self.blob.value(c_rpm.rpmTag.RPMTAG_VERSION)
+
+ @property
+ def release(self) -> str:
+ """Package release."""
+ return self.blob.value(c_rpm.rpmTag.RPMTAG_RELEASE)
+
+ @property
+ def summary(self) -> str:
+ """Package summary."""
+ return self.blob.value(c_rpm.rpmTag.RPMTAG_SUMMARY)
+
+ @property
+ def description(self) -> str:
+ """Package description."""
+ return self.blob.value(c_rpm.rpmTag.RPMTAG_DESCRIPTION)
+
+ def entries(self) -> Iterator[File | Directory]:
+ """Iterate over all files and directories in the package."""
+ if c_rpm.rpmTag.RPMTAG_FILESIZES not in self.blob:
+ return
+
+ sizes = _as_list(self.blob.value(c_rpm.rpmTag.RPMTAG_FILESIZES))
+ modes = _as_list(self.blob.value(c_rpm.rpmTag.RPMTAG_FILEMODES))
+ mtimes = _as_list(self.blob.value(c_rpm.rpmTag.RPMTAG_FILEMTIMES))
+ users = _as_list(self.blob.value(c_rpm.rpmTag.RPMTAG_FILEUSERNAME))
+ groups = _as_list(self.blob.value(c_rpm.rpmTag.RPMTAG_FILEGROUPNAME))
+ digests = _as_list(self.blob.value(c_rpm.rpmTag.RPMTAG_FILEDIGESTS))
+
+ basenames = _as_list(self.blob.value(c_rpm.rpmTag.RPMTAG_BASENAMES))
+ dirnames = _as_list(self.blob.value(c_rpm.rpmTag.RPMTAG_DIRNAMES))
+ dirindex = _as_list(self.blob.value(c_rpm.rpmTag.RPMTAG_DIRINDEXES))
+
+ for i, name in enumerate(basenames):
+ dirname = dirnames[dirindex[i]]
+ klass = Directory if stat.S_ISDIR(modes[i]) else File
+ yield klass(
+ posixpath.join(dirname, name),
+ sizes[i],
+ modes[i],
+ mtimes[i],
+ users[i],
+ groups[i],
+ digests[i],
+ )
+
+
+def _as_list(value: Any) -> list[Any]:
+ return [value] if not isinstance(value, list) else value
+
+
+class HeaderBlob:
+ """RPM Header Blob.
+
+ Args:
+ buf: Bytes containing the RPM Header Blob.
+ """
+
+ def __init__(self, buf: bytes):
+ self.buf = buf
+ self.header = c_rpm.header_intro(self.buf)
+
+ # sizeo(il) + sizeof(dl) + (il * sizeof(pe)) + dl
+ self.pvlen = 4 + 4 + (self.header.index_length * len(c_rpm.entryInfo)) + self.header.data_length
+ self.data_start = 4 + 4 + (self.header.index_length * len(c_rpm.entryInfo))
+ self.data_end = self.data_start + self.header.data_length
+
+ self.tag_map = {e.tag: idx for idx, e in enumerate(self.header.entries)}
+
+ def __contains__(self, tag: c_rpm.rpmTag) -> bool:
+ return tag.value in self.tag_map
+
+ def entry(self, idx: int) -> tuple[c_rpm.rpmTag, int | str | bytes | list[int] | list[str] | None]:
+ """Get the ``(tag, value)`` for the given index."""
+ entry = self.header.entries[idx]
+
+ tag = c_rpm.rpmTag(entry.tag)
+ type = c_rpm.rpmTagType(entry.type)
+
+ type_size = TYPE_SIZE_MAP[type]
+ if type_size == -1:
+ next_entry = self.header.entries[idx + 1] if idx + 1 < self.header.index_length else None
+ data_size = (next_entry.offset if next_entry else len(self.buf)) - entry.offset
+ else:
+ data_size = entry.count * type_size
+
+ self.data = self.buf[self.data_start + entry.offset : self.data_start + entry.offset + data_size]
+
+ parser = TYPE_PARSERS[type]
+ if type in ARRAY_TYPES and entry.count > 1:
+ parser = parser[entry.count]
+
+ value = parser(self.data, entry.count) if type == c_rpm.rpmTagType.RPM_STRING_ARRAY_TYPE else parser(self.data)
+ return tag, value
+
+ def entries(self) -> Iterator[tuple[c_rpm.rpmTag, int | str | bytes | list[int] | list[str] | None]]:
+ """Iterate over all ``(tag, value)`` entries in the header."""
+ for idx in range(self.header.index_length):
+ yield self.entry(idx)
+
+ def value(self, tag: c_rpm.rpmTag) -> int | str | bytes | list[int] | list[str] | None:
+ """Get the value for the given tag."""
+ if not (idx := self.tag_map.get(tag.value)):
+ raise IndexError(f"Tag not found: {tag}")
+ return self.entry(idx)[1]
+
+
+class Packages:
+ """RPMDB Packages database.
+
+ Args:
+ fh: File-like object containing the RPMDB Packages database (a Berkeley DB).
+ """
+
+ def __init__(self, fh: BinaryIO):
+ self.db = bsddb.DB(fh)
+
+ def __iter__(self) -> Iterator[Package]:
+ return self.entries()
+
+ def entries(self) -> Iterator[Package]:
+ """Iterate over all packages in the database."""
+ for _, data in self.db.records():
+ if len(data) > 4:
+ yield Package(data)
+
+
+def main() -> None:
+ parser = argparse.ArgumentParser()
+ parser.add_argument("input", type=Path, help="input RPMDB Packages file")
+ args = parser.parse_args()
+
+ with args.input.open("rb") as fh:
+ db = Packages(fh)
+ for package in db.entries():
+ print(package)
+ for entry in package.entries():
+ if isinstance(entry, File):
+ print(f" FILE {entry.path} {entry.size} bytes")
+ elif isinstance(entry, Directory):
+ print(f" DIR {entry.path}")
+ print()
+
+
+if __name__ == "__main__":
+ main()
diff --git a/pyproject.toml b/pyproject.toml
new file mode 100644
index 0000000..03af944
--- /dev/null
+++ b/pyproject.toml
@@ -0,0 +1,117 @@
+[build-system]
+requires = ["setuptools>=80.9.0", "setuptools_scm[toml]>=6.4.0"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "dissect.bsddb"
+description = "A Dissect module implementing a parser for the Berkeley DB format"
+readme = "README.md"
+requires-python = ">=3.9.0"
+license = "AGPL-3.0-or-later"
+license-files = ["LICENSE", "COPYRIGHT"]
+authors = [
+ {name = "Dissect Team", email = "dissect@fox-it.com"}
+]
+classifiers = [
+ "Development Status :: 5 - Production/Stable",
+ "Environment :: Console",
+ "Intended Audience :: Developers",
+ "Intended Audience :: Information Technology",
+ "Operating System :: OS Independent",
+ "Programming Language :: Python :: 3",
+ "Topic :: Internet :: Log Analysis",
+ "Topic :: Scientific/Engineering :: Information Analysis",
+ "Topic :: Security",
+ "Topic :: Utilities",
+]
+dependencies = [
+ "dissect.cstruct>=4,<5",
+]
+dynamic = ["version"]
+
+[project.urls]
+homepage = "https://dissect.tools"
+documentation = "https://docs.dissect.tools/en/latest/projects/dissect.bsddb"
+repository = "https://github.com/fox-it/dissect.bsddb"
+
+[project.optional-dependencies]
+dev = [
+ "dissect.cstruct>=4.0.dev,<5.0.dev",
+]
+
+[dependency-groups]
+test = [
+ "pytest",
+]
+lint = [
+ "ruff==0.12.9",
+ "vermin",
+]
+build = [
+ "build",
+]
+debug = [
+ "ipdb",
+]
+dev = [
+ {include-group = "test"},
+ {include-group = "lint"},
+ {include-group = "debug"},
+]
+
+[tool.ruff]
+line-length = 120
+required-version = ">=0.12.0"
+
+[tool.ruff.format]
+docstring-code-format = true
+
+[tool.ruff.lint]
+select = [
+ "F",
+ "E",
+ "W",
+ "I",
+ "UP",
+ "YTT",
+ "ANN",
+ "B",
+ "C4",
+ "DTZ",
+ "T10",
+ "FA",
+ "ISC",
+ "G",
+ "INP",
+ "PIE",
+ "PYI",
+ "PT",
+ "Q",
+ "RSE",
+ "RET",
+ "SLOT",
+ "SIM",
+ "TID",
+ "TCH",
+ "PTH",
+ "PLC",
+ "TRY",
+ "FLY",
+ "PERF",
+ "FURB",
+ "RUF",
+]
+ignore = ["E203", "B904", "UP024", "ANN002", "ANN003", "ANN204", "ANN401", "SIM105", "TRY003"]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/_docs/**" = ["INP001"]
+"*.pyi" = ["E", "F", "PYI"]
+
+[tool.ruff.lint.isort]
+known-first-party = ["dissect.bsddb"]
+known-third-party = ["dissect"]
+
+[tool.setuptools.packages.find]
+include = ["dissect.*"]
+
+[tool.setuptools_scm]
diff --git a/tests/__init__.py b/tests/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/tests/_data/btree.db.gz b/tests/_data/btree.db.gz
new file mode 100644
index 0000000..a8834a8
--- /dev/null
+++ b/tests/_data/btree.db.gz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:d847267680a918959547ae50bf6ca1997b01e00cd4e2502a0380357c44648930
+size 18154
diff --git a/tests/_data/hash.db.gz b/tests/_data/hash.db.gz
new file mode 100644
index 0000000..62079ae
--- /dev/null
+++ b/tests/_data/hash.db.gz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:f49be87e382eec15047086cf33e1acca10d34e7496834ed96330a11cbf981a7e
+size 18259
diff --git a/tests/_data/recno.db.gz b/tests/_data/recno.db.gz
new file mode 100644
index 0000000..704d5b2
--- /dev/null
+++ b/tests/_data/recno.db.gz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:ac3e82e01ee83bcc17ed2515d96863f32433683a8ed78f5fdd8e92b3ec4c930d
+size 291
diff --git a/tests/_data/rpm/Packages.gz b/tests/_data/rpm/Packages.gz
new file mode 100644
index 0000000..271b15c
--- /dev/null
+++ b/tests/_data/rpm/Packages.gz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:ca0cdb6054eaf7aef9da05f516a0c1972b1f722d512c0c2e2a7524d83108b01f
+size 4643305
diff --git a/tests/_docs/Makefile b/tests/_docs/Makefile
new file mode 100644
index 0000000..e693b42
--- /dev/null
+++ b/tests/_docs/Makefile
@@ -0,0 +1,24 @@
+# Minimal makefile for Sphinx documentation
+#
+
+# You can set these variables from the command line, and also
+# from the environment for the first two.
+SPHINXOPTS ?= -jauto -w $(BUILDDIR)/warnings.log --fail-on-warning
+SPHINXBUILD ?= sphinx-build
+SOURCEDIR = .
+BUILDDIR = build
+
+# Put it first so that "make" without argument is like "make help".
+help:
+ @$(SPHINXBUILD) -M help "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
+
+.PHONY: clean help Makefile
+
+clean: Makefile
+ rm -rf api
+ @$(SPHINXBUILD) -M clean "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
+
+# Catch-all target: route all unknown targets to Sphinx using the new
+# "make mode" option. $(O) is meant as a shortcut for $(SPHINXOPTS).
+%: Makefile
+ @$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O)
diff --git a/tests/_docs/conf.py b/tests/_docs/conf.py
new file mode 100644
index 0000000..d241f00
--- /dev/null
+++ b/tests/_docs/conf.py
@@ -0,0 +1,41 @@
+project = "dissect.bsddb"
+
+extensions = [
+ "autoapi.extension",
+ "sphinx.ext.autodoc",
+ "sphinx.ext.autosectionlabel",
+ "sphinx.ext.doctest",
+ "sphinx.ext.napoleon",
+ "sphinx_argparse_cli",
+]
+
+exclude_patterns = []
+
+html_theme = "furo"
+
+autoapi_type = "python"
+autoapi_dirs = ["../../dissect/"]
+autoapi_ignore = ["*tests*", "*.tox*", "*venv*", "*examples*"]
+autoapi_python_use_implicit_namespaces = True
+autoapi_add_toctree_entry = False
+autoapi_root = "api"
+autoapi_options = [
+ "members",
+ "undoc-members",
+ "show-inheritance",
+ "show-module-summary",
+ "special-members",
+ "imported-members",
+]
+autoapi_keep_files = True
+autoapi_template_dir = "_templates/autoapi"
+
+autodoc_typehints = "signature"
+autodoc_member_order = "groupwise"
+
+autosectionlabel_prefix_document = True
+
+suppress_warnings = [
+ # https://github.com/readthedocs/sphinx-autoapi/issues/285
+ "autoapi.python_import_resolution",
+]
diff --git a/tests/_docs/index.rst b/tests/_docs/index.rst
new file mode 100644
index 0000000..ba16345
--- /dev/null
+++ b/tests/_docs/index.rst
@@ -0,0 +1,8 @@
+API Reference
+=============
+
+.. toctree::
+ :maxdepth: 1
+ :glob:
+
+ /api/*/*/index
diff --git a/tests/conftest.py b/tests/conftest.py
new file mode 100644
index 0000000..6850239
--- /dev/null
+++ b/tests/conftest.py
@@ -0,0 +1,44 @@
+from __future__ import annotations
+
+import gzip
+from pathlib import Path
+from typing import TYPE_CHECKING, BinaryIO
+
+import pytest
+
+if TYPE_CHECKING:
+ from collections.abc import Iterator
+
+
+def absolute_path(filename: str) -> Path:
+ return Path(__file__).parent / filename
+
+
+def open_file(name: str, mode: str = "rb") -> Iterator[BinaryIO]:
+ with absolute_path(name).open(mode) as fh:
+ yield fh
+
+
+def open_file_gz(name: str, mode: str = "rb") -> Iterator[BinaryIO]:
+ with gzip.GzipFile(absolute_path(name), mode) as fh:
+ yield fh
+
+
+@pytest.fixture
+def btree_db() -> Iterator[BinaryIO]:
+ yield from open_file_gz("_data/btree.db.gz")
+
+
+@pytest.fixture
+def hash_db() -> Iterator[BinaryIO]:
+ yield from open_file_gz("_data/hash.db.gz")
+
+
+@pytest.fixture
+def recno_db() -> Iterator[BinaryIO]:
+ yield from open_file_gz("_data/recno.db.gz")
+
+
+@pytest.fixture
+def rpm_packages() -> Iterator[BinaryIO]:
+ yield from open_file_gz("_data/rpm/Packages.gz")
diff --git a/tests/test_bsddb.py b/tests/test_bsddb.py
new file mode 100644
index 0000000..bd2ff5d
--- /dev/null
+++ b/tests/test_bsddb.py
@@ -0,0 +1,41 @@
+from __future__ import annotations
+
+from typing import BinaryIO
+
+from dissect.bsddb.bsddb import DB
+
+
+def _assert_wordlist(db: DB) -> None:
+ for i, (key, data) in enumerate(sorted(db.records())):
+ assert isinstance(key, bytes)
+ assert isinstance(data, bytes)
+
+ assert int(key[:4]) == i + 1
+ assert key == data[::-1]
+
+
+def test_btree(btree_db: BinaryIO) -> None:
+ """Test ``DB_BTREE`` database."""
+ db = DB(btree_db)
+ assert db.is_btree
+
+ _assert_wordlist(db)
+
+
+def test_hash(hash_db: BinaryIO) -> None:
+ """Test ``DB_HASH`` database."""
+ db = DB(hash_db)
+ assert db.is_hash
+
+ _assert_wordlist(db)
+
+
+def test_recno(recno_db: BinaryIO) -> None:
+ """Test ``DB_RECNO`` database."""
+ db = DB(recno_db)
+ assert db.is_recno
+
+ records = list(db.records())
+ assert len(records) == 2
+ assert records[0] == (42, b"thanks for all the fish")
+ assert records[1] == (69, b"haha funny number")
diff --git a/tests/test_rpm.py b/tests/test_rpm.py
new file mode 100644
index 0000000..9209cac
--- /dev/null
+++ b/tests/test_rpm.py
@@ -0,0 +1,52 @@
+from __future__ import annotations
+
+import textwrap
+from typing import BinaryIO
+
+from dissect.bsddb.tools.rpm import Packages
+
+
+def test_rpm(rpm_packages: BinaryIO) -> None:
+ """Test parsing RPM Packages file."""
+ db = Packages(rpm_packages)
+
+ entries = list(db)
+ assert len(entries) == 239
+
+ entry = entries[27]
+ assert entry.name == "python"
+ assert entry.version == "2.6.6"
+ assert entry.release == "68.el6_10"
+ assert entry.summary == "An interpreted, interactive, object-oriented programming language"
+
+ desc = """
+ Python is an interpreted, interactive, object-oriented programming
+ language often compared to Tcl, Perl, Scheme or Java. Python includes
+ modules, classes, exceptions, very high level dynamic data types and
+ dynamic typing. Python supports interfaces to many system calls and
+ libraries, as well as to various windowing systems (X11, Motif, Tk,
+ Mac and MFC).
+
+ Programmers can write new built-in modules for Python in C or C++.
+ Python can be used as an extension language for applications that need
+ a programmable interface.
+
+ Note that documentation for Python is provided in the python-docs
+ package.
+
+ This package provides the "python" executable; most of the actual
+ implementation is within the "python-libs" package."""
+ assert entry.description == textwrap.dedent(desc).strip()
+
+ files = list(entry)
+ assert len(files) == 8
+ assert [f.path for f in files] == [
+ "/usr/bin/pydoc",
+ "/usr/bin/python",
+ "/usr/bin/python2",
+ "/usr/bin/python2.6",
+ "/usr/share/doc/python-2.6.6",
+ "/usr/share/doc/python-2.6.6/LICENSE",
+ "/usr/share/doc/python-2.6.6/README",
+ "/usr/share/man/man1/python.1.gz",
+ ]
diff --git a/tox.ini b/tox.ini
new file mode 100755
index 0000000..1f11586
--- /dev/null
+++ b/tox.ini
@@ -0,0 +1,64 @@
+[tox]
+envlist = lint, py3, pypy3
+# This version of tox will autoprovision itself and the requirements defined in
+# requires if they are not available on the host system. This requires the
+# locally installed tox to have a minimum version 3.3.0. This means the names
+# of the configuration options are still according to the tox 3.x syntax.
+minversion = 4.27.0
+# This version of virtualenv will install setuptools version 68.2.2 and pip
+# 23.3.1. These versions fully support python projects defined only through a
+# pyproject.toml file (PEP-517/PEP-518/PEP-621). This pip version also support
+# the proper version resolving with (sub-)dependencies defining dev extra's.
+requires = virtualenv>=20.24.6
+
+[testenv]
+extras = dev
+deps =
+ pytest-cov
+ coverage
+dependency_groups = test
+commands =
+ pytest --basetemp="{envtmpdir}" {posargs:--color=yes --cov=dissect --cov-report=term-missing -v tests}
+ coverage report
+ coverage xml
+
+[testenv:build]
+package = skip
+dependency_groups = build
+commands =
+ pyproject-build
+
+[testenv:fix]
+package = skip
+dependency_groups = lint
+commands =
+ ruff check --fix dissect tests
+ ruff format dissect tests
+
+[testenv:lint]
+package = skip
+dependency_groups = lint
+commands =
+ ruff check dissect tests
+ ruff format --check dissect tests
+ vermin -t=3.9- --no-tips --lint dissect tests
+
+[testenv:docs-build]
+allowlist_externals = make
+deps =
+ sphinx
+ sphinx-autoapi
+ sphinx_argparse_cli
+ sphinx-copybutton
+ sphinx-design
+ furo
+commands =
+ make -C tests/_docs clean
+ make -C tests/_docs html
+
+[testenv:docs-linkcheck]
+allowlist_externals = make
+deps = {[testenv:docs-build]deps}
+commands =
+ make -C tests/_docs clean
+ make -C tests/_docs linkcheck
From 6821d0e4cff763c96b917b078f75340555eb9148 Mon Sep 17 00:00:00 2001
From: Schamper <1254028+Schamper@users.noreply.github.com>
Date: Thu, 25 Sep 2025 16:09:08 +0200
Subject: [PATCH 2/3] Review comments
---
dissect/bsddb/bsddb.py | 11 ++++++-----
dissect/bsddb/c_bsddb.py | 2 ++
dissect/bsddb/c_bsddb.pyi | 3 +--
dissect/bsddb/tools/c_rpm.pyi | 3 +--
dissect/bsddb/tools/rpm.py | 14 ++++++++------
pyproject.toml | 6 +++---
tox.ini | 2 +-
7 files changed, 22 insertions(+), 19 deletions(-)
diff --git a/dissect/bsddb/bsddb.py b/dissect/bsddb/bsddb.py
index bd92701..aa43121 100644
--- a/dissect/bsddb/bsddb.py
+++ b/dissect/bsddb/bsddb.py
@@ -1,7 +1,7 @@
from __future__ import annotations
from functools import cached_property, lru_cache
-from typing import TYPE_CHECKING, BinaryIO, Union
+from typing import TYPE_CHECKING, BinaryIO
from dissect.bsddb.c_bsddb import c_db
@@ -10,8 +10,7 @@
DBT = tuple[
- # Change to | when we drop Python 3.9 support
- Union[c_db.HOFFPAGE, c_db.HKEYDATA, c_db.HEAPHDR, c_db.BKEYDATA, c_db.BOVERFLOW, c_db.BINTERNAL, c_db.RINTERNAL],
+ c_db.HOFFPAGE | c_db.HKEYDATA | c_db.HEAPHDR | c_db.BKEYDATA | c_db.BOVERFLOW | c_db.BINTERNAL | c_db.RINTERNAL,
bytes,
]
"""An internal page entry structure + data (loosely related to Data-Base Thang)."""
@@ -145,7 +144,7 @@ def raw(self) -> bytes:
return self.db.fh.read(self.db.page_size)
@cached_property
- def data(self) -> bytes:
+ def data(self) -> memoryview:
"""Page data, excluding any overhead (headers)."""
return memoryview(self.raw)[self.db._page_overhead :]
@@ -162,7 +161,7 @@ def type(self) -> int:
@cached_property
def lookup(self) -> list[int]:
"""List of offsets to entries in the page."""
- if self.header.type in (c_db.P_LBTREE, c_db.P_IBTREE, c_db.P_LRECNO, c_db.P_IRECNO, c_db.P_HASH):
+ if self.type in (c_db.P_LBTREE, c_db.P_IBTREE, c_db.P_LRECNO, c_db.P_IRECNO, c_db.P_HASH):
return c_db.uint16[self.header.entries](self.data)
return []
@@ -191,11 +190,13 @@ def entry(self, index: int) -> DBT:
data_length = (next_offset - self.lookup[index]) - len(c_db.HKEYDATA)
return c_db.HKEYDATA(buf), buf[len(c_db.HKEYDATA) : len(c_db.HKEYDATA) + data_length]
+
if self.header.type == c_db.P_HEAP:
entry = c_db.HEAPHDR(buf)
if entry.flags & (c_db.HEAP_RECSPLIT | c_db.HEAP_RECFIRST):
raise NotImplementedError("Heap split records not implemented")
return entry, buf[len(c_db.HEAPHDR) : len(c_db.HEAPHDR) + entry.size]
+
if self.header.type in (c_db.P_LBTREE, c_db.P_LDUP, c_db.P_LRECNO):
entry = c_db.BKEYDATA(buf)
if entry.type == c_db.B_OVERFLOW:
diff --git a/dissect/bsddb/c_bsddb.py b/dissect/bsddb/c_bsddb.py
index 3e3f8c0..65fda0c 100644
--- a/dissect/bsddb/c_bsddb.py
+++ b/dissect/bsddb/c_bsddb.py
@@ -1,3 +1,5 @@
+# References:
+# - libdb
from __future__ import annotations
from dissect.cstruct import cstruct
diff --git a/dissect/bsddb/c_bsddb.pyi b/dissect/bsddb/c_bsddb.pyi
index 0151362..088d857 100644
--- a/dissect/bsddb/c_bsddb.pyi
+++ b/dissect/bsddb/c_bsddb.pyi
@@ -1,8 +1,7 @@
# Generated by cstruct-stubgen
-from typing import BinaryIO, Literal, overload
+from typing import BinaryIO, Literal, TypeAlias, overload
import dissect.cstruct as __cs__
-from typing_extensions import TypeAlias
class _c_db(__cs__.cstruct):
DB_MAX_PAGES: Literal[4294967295] = ...
diff --git a/dissect/bsddb/tools/c_rpm.pyi b/dissect/bsddb/tools/c_rpm.pyi
index c69f097..f888f08 100644
--- a/dissect/bsddb/tools/c_rpm.pyi
+++ b/dissect/bsddb/tools/c_rpm.pyi
@@ -1,8 +1,7 @@
# Generated by cstruct-stubgen
-from typing import BinaryIO, Literal, overload
+from typing import BinaryIO, Literal, TypeAlias, overload
import dissect.cstruct as __cs__
-from typing_extensions import TypeAlias
class _c_rpm(__cs__.cstruct):
HEADER_IMAGE: Literal[61] = ...
diff --git a/dissect/bsddb/tools/rpm.py b/dissect/bsddb/tools/rpm.py
index e013817..277082a 100644
--- a/dissect/bsddb/tools/rpm.py
+++ b/dissect/bsddb/tools/rpm.py
@@ -1,4 +1,4 @@
-# Reference:
+# References:
# - https://rpm.org/docs/
from __future__ import annotations
@@ -155,7 +155,7 @@ def __init__(self, buf: bytes):
self.buf = buf
self.header = c_rpm.header_intro(self.buf)
- # sizeo(il) + sizeof(dl) + (il * sizeof(pe)) + dl
+ # sizeof(il) + sizeof(dl) + (il * sizeof(pe)) + dl
self.pvlen = 4 + 4 + (self.header.index_length * len(c_rpm.entryInfo)) + self.header.data_length
self.data_start = 4 + 4 + (self.header.index_length * len(c_rpm.entryInfo))
self.data_end = self.data_start + self.header.data_length
@@ -179,13 +179,13 @@ def entry(self, idx: int) -> tuple[c_rpm.rpmTag, int | str | bytes | list[int] |
else:
data_size = entry.count * type_size
- self.data = self.buf[self.data_start + entry.offset : self.data_start + entry.offset + data_size]
+ data = self.buf[self.data_start + entry.offset : self.data_start + entry.offset + data_size]
parser = TYPE_PARSERS[type]
if type in ARRAY_TYPES and entry.count > 1:
parser = parser[entry.count]
- value = parser(self.data, entry.count) if type == c_rpm.rpmTagType.RPM_STRING_ARRAY_TYPE else parser(self.data)
+ value = parser(data, entry.count) if type == c_rpm.rpmTagType.RPM_STRING_ARRAY_TYPE else parser(data)
return tag, value
def entries(self) -> Iterator[tuple[c_rpm.rpmTag, int | str | bytes | list[int] | list[str] | None]]:
@@ -195,7 +195,7 @@ def entries(self) -> Iterator[tuple[c_rpm.rpmTag, int | str | bytes | list[int]
def value(self, tag: c_rpm.rpmTag) -> int | str | bytes | list[int] | list[str] | None:
"""Get the value for the given tag."""
- if not (idx := self.tag_map.get(tag.value)):
+ if (idx := self.tag_map.get(tag.value)) is None:
raise IndexError(f"Tag not found: {tag}")
return self.entry(idx)[1]
@@ -220,7 +220,7 @@ def entries(self) -> Iterator[Package]:
yield Package(data)
-def main() -> None:
+def main() -> int:
parser = argparse.ArgumentParser()
parser.add_argument("input", type=Path, help="input RPMDB Packages file")
args = parser.parse_args()
@@ -236,6 +236,8 @@ def main() -> None:
print(f" DIR {entry.path}")
print()
+ return 0
+
if __name__ == "__main__":
main()
diff --git a/pyproject.toml b/pyproject.toml
index 03af944..f06dfe3 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -6,7 +6,7 @@ build-backend = "setuptools.build_meta"
name = "dissect.bsddb"
description = "A Dissect module implementing a parser for the Berkeley DB format"
readme = "README.md"
-requires-python = ">=3.9.0"
+requires-python = ">=3.10"
license = "AGPL-3.0-or-later"
license-files = ["LICENSE", "COPYRIGHT"]
authors = [
@@ -44,7 +44,7 @@ test = [
"pytest",
]
lint = [
- "ruff==0.12.9",
+ "ruff==0.13.1",
"vermin",
]
build = [
@@ -61,7 +61,7 @@ dev = [
[tool.ruff]
line-length = 120
-required-version = ">=0.12.0"
+required-version = ">=0.13.1"
[tool.ruff.format]
docstring-code-format = true
diff --git a/tox.ini b/tox.ini
index 1f11586..284a4ba 100755
--- a/tox.ini
+++ b/tox.ini
@@ -41,7 +41,7 @@ dependency_groups = lint
commands =
ruff check dissect tests
ruff format --check dissect tests
- vermin -t=3.9- --no-tips --lint dissect tests
+ vermin -t=3.10- --no-tips --lint dissect tests
[testenv:docs-build]
allowlist_externals = make
From a1e147f3fb85722c73220ef354d1f55becb8974b Mon Sep 17 00:00:00 2001
From: Schamper <1254028+Schamper@users.noreply.github.com>
Date: Thu, 25 Sep 2025 16:19:27 +0200
Subject: [PATCH 3/3] Rename to dissect.database
---
COPYRIGHT | 2 +-
README.md | 10 +++++-----
dissect/bsddb/__init__.py | 3 ---
dissect/database/__init__.py | 5 +++++
dissect/database/bsd/__init__.py | 5 +++++
dissect/{bsddb/c_bsddb.py => database/bsd/c_db.py} | 0
.../{bsddb/c_bsddb.pyi => database/bsd/c_db.pyi} | 0
dissect/{bsddb/bsddb.py => database/bsd/db.py} | 2 +-
dissect/{bsddb => database/bsd}/tools/__init__.py | 0
dissect/{bsddb => database/bsd}/tools/c_rpm.py | 0
dissect/{bsddb => database/bsd}/tools/c_rpm.pyi | 0
dissect/{bsddb => database/bsd}/tools/rpm.py | 6 +++---
pyproject.toml | 13 +++++++------
tests/_data/{ => bsd}/btree.db.gz | 0
tests/_data/{ => bsd}/hash.db.gz | 0
tests/_data/{ => bsd}/recno.db.gz | 0
tests/_data/{ => bsd}/rpm/Packages.gz | 0
tests/_docs/conf.py | 2 +-
tests/bsd/__init__.py | 0
tests/{test_bsddb.py => bsd/test_db.py} | 2 +-
tests/{ => bsd}/test_rpm.py | 2 +-
tests/conftest.py | 8 ++++----
22 files changed, 34 insertions(+), 26 deletions(-)
delete mode 100644 dissect/bsddb/__init__.py
create mode 100644 dissect/database/__init__.py
create mode 100644 dissect/database/bsd/__init__.py
rename dissect/{bsddb/c_bsddb.py => database/bsd/c_db.py} (100%)
rename dissect/{bsddb/c_bsddb.pyi => database/bsd/c_db.pyi} (100%)
rename dissect/{bsddb/bsddb.py => database/bsd/db.py} (99%)
rename dissect/{bsddb => database/bsd}/tools/__init__.py (100%)
rename dissect/{bsddb => database/bsd}/tools/c_rpm.py (100%)
rename dissect/{bsddb => database/bsd}/tools/c_rpm.pyi (100%)
rename dissect/{bsddb => database/bsd}/tools/rpm.py (98%)
rename tests/_data/{ => bsd}/btree.db.gz (100%)
rename tests/_data/{ => bsd}/hash.db.gz (100%)
rename tests/_data/{ => bsd}/recno.db.gz (100%)
rename tests/_data/{ => bsd}/rpm/Packages.gz (100%)
create mode 100644 tests/bsd/__init__.py
rename tests/{test_bsddb.py => bsd/test_db.py} (95%)
rename tests/{ => bsd}/test_rpm.py (97%)
diff --git a/COPYRIGHT b/COPYRIGHT
index 42a7d9e..6221654 100644
--- a/COPYRIGHT
+++ b/COPYRIGHT
@@ -1,5 +1,5 @@
Dissect is released as open source by Fox-IT (https://www.fox-it.com) part of NCC Group Plc (https://www.nccgroup.com)
-Developed by the Dissect Team (dissect@fox-it.com) and made available at https://github.com/fox-it/dissect.bsddb
+Developed by the Dissect Team (dissect@fox-it.com) and made available at https://github.com/fox-it/dissect.database
License terms: AGPL3 (https://www.gnu.org/licenses/agpl-3.0.html)
diff --git a/README.md b/README.md
index a0af46c..c7e1946 100644
--- a/README.md
+++ b/README.md
@@ -1,14 +1,14 @@
-# dissect.bsddb
+# dissect.database
-A Dissect module implementing a parser for the Berkeley DB format. For more information,
-please see [the documentation](https://docs.dissect.tools/en/latest/projects/dissect.bsddb/index.html).
+A Dissect module implementing parsers for various database formats. For more information,
+please see [the documentation](https://docs.dissect.tools/en/latest/projects/dissect.database/index.html).
## Installation
-`dissect.bsddb` is available on [PyPI](https://pypi.org/project/dissect.bsddb/).
+`dissect.database` is available on [PyPI](https://pypi.org/project/dissect.database/).
```bash
-pip install dissect.bsddb
+pip install dissect.database
```
This module is also automatically installed if you install the `dissect` package.
diff --git a/dissect/bsddb/__init__.py b/dissect/bsddb/__init__.py
deleted file mode 100644
index 138308c..0000000
--- a/dissect/bsddb/__init__.py
+++ /dev/null
@@ -1,3 +0,0 @@
-from dissect.bsddb.bsddb import DB
-
-__all__ = ["DB"]
diff --git a/dissect/database/__init__.py b/dissect/database/__init__.py
new file mode 100644
index 0000000..8c6d9db
--- /dev/null
+++ b/dissect/database/__init__.py
@@ -0,0 +1,5 @@
+from __future__ import annotations
+
+from dissect.database.bsd.db import DB
+
+__all__ = ["DB"]
diff --git a/dissect/database/bsd/__init__.py b/dissect/database/bsd/__init__.py
new file mode 100644
index 0000000..8c6d9db
--- /dev/null
+++ b/dissect/database/bsd/__init__.py
@@ -0,0 +1,5 @@
+from __future__ import annotations
+
+from dissect.database.bsd.db import DB
+
+__all__ = ["DB"]
diff --git a/dissect/bsddb/c_bsddb.py b/dissect/database/bsd/c_db.py
similarity index 100%
rename from dissect/bsddb/c_bsddb.py
rename to dissect/database/bsd/c_db.py
diff --git a/dissect/bsddb/c_bsddb.pyi b/dissect/database/bsd/c_db.pyi
similarity index 100%
rename from dissect/bsddb/c_bsddb.pyi
rename to dissect/database/bsd/c_db.pyi
diff --git a/dissect/bsddb/bsddb.py b/dissect/database/bsd/db.py
similarity index 99%
rename from dissect/bsddb/bsddb.py
rename to dissect/database/bsd/db.py
index aa43121..de4f2cb 100644
--- a/dissect/bsddb/bsddb.py
+++ b/dissect/database/bsd/db.py
@@ -3,7 +3,7 @@
from functools import cached_property, lru_cache
from typing import TYPE_CHECKING, BinaryIO
-from dissect.bsddb.c_bsddb import c_db
+from dissect.database.bsd.c_db import c_db
if TYPE_CHECKING:
from collections.abc import Iterator
diff --git a/dissect/bsddb/tools/__init__.py b/dissect/database/bsd/tools/__init__.py
similarity index 100%
rename from dissect/bsddb/tools/__init__.py
rename to dissect/database/bsd/tools/__init__.py
diff --git a/dissect/bsddb/tools/c_rpm.py b/dissect/database/bsd/tools/c_rpm.py
similarity index 100%
rename from dissect/bsddb/tools/c_rpm.py
rename to dissect/database/bsd/tools/c_rpm.py
diff --git a/dissect/bsddb/tools/c_rpm.pyi b/dissect/database/bsd/tools/c_rpm.pyi
similarity index 100%
rename from dissect/bsddb/tools/c_rpm.pyi
rename to dissect/database/bsd/tools/c_rpm.pyi
diff --git a/dissect/bsddb/tools/rpm.py b/dissect/database/bsd/tools/rpm.py
similarity index 98%
rename from dissect/bsddb/tools/rpm.py
rename to dissect/database/bsd/tools/rpm.py
index 277082a..ddc7836 100644
--- a/dissect/bsddb/tools/rpm.py
+++ b/dissect/database/bsd/tools/rpm.py
@@ -8,8 +8,8 @@
from pathlib import Path
from typing import TYPE_CHECKING, Any, BinaryIO, NamedTuple
-from dissect.bsddb import bsddb
-from dissect.bsddb.tools.c_rpm import c_rpm
+from dissect.database.bsd import db
+from dissect.database.bsd.tools.c_rpm import c_rpm
if TYPE_CHECKING:
from collections.abc import Iterator
@@ -208,7 +208,7 @@ class Packages:
"""
def __init__(self, fh: BinaryIO):
- self.db = bsddb.DB(fh)
+ self.db = db.DB(fh)
def __iter__(self) -> Iterator[Package]:
return self.entries()
diff --git a/pyproject.toml b/pyproject.toml
index f06dfe3..6eca18f 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -3,11 +3,11 @@ requires = ["setuptools>=80.9.0", "setuptools_scm[toml]>=6.4.0"]
build-backend = "setuptools.build_meta"
[project]
-name = "dissect.bsddb"
-description = "A Dissect module implementing a parser for the Berkeley DB format"
+name = "dissect.database"
+description = "A Dissect module implementing parsers for various database formats"
readme = "README.md"
requires-python = ">=3.10"
-license = "AGPL-3.0-or-later"
+license = "Apache-2.0"
license-files = ["LICENSE", "COPYRIGHT"]
authors = [
{name = "Dissect Team", email = "dissect@fox-it.com"}
@@ -31,12 +31,13 @@ dynamic = ["version"]
[project.urls]
homepage = "https://dissect.tools"
-documentation = "https://docs.dissect.tools/en/latest/projects/dissect.bsddb"
-repository = "https://github.com/fox-it/dissect.bsddb"
+documentation = "https://docs.dissect.tools/en/latest/projects/dissect.database"
+repository = "https://github.com/fox-it/dissect.database"
[project.optional-dependencies]
dev = [
"dissect.cstruct>=4.0.dev,<5.0.dev",
+ "dissect.util>=3.5.dev,<4.0.dev",
]
[dependency-groups]
@@ -108,7 +109,7 @@ ignore = ["E203", "B904", "UP024", "ANN002", "ANN003", "ANN204", "ANN401", "SIM1
"*.pyi" = ["E", "F", "PYI"]
[tool.ruff.lint.isort]
-known-first-party = ["dissect.bsddb"]
+known-first-party = ["dissect.database"]
known-third-party = ["dissect"]
[tool.setuptools.packages.find]
diff --git a/tests/_data/btree.db.gz b/tests/_data/bsd/btree.db.gz
similarity index 100%
rename from tests/_data/btree.db.gz
rename to tests/_data/bsd/btree.db.gz
diff --git a/tests/_data/hash.db.gz b/tests/_data/bsd/hash.db.gz
similarity index 100%
rename from tests/_data/hash.db.gz
rename to tests/_data/bsd/hash.db.gz
diff --git a/tests/_data/recno.db.gz b/tests/_data/bsd/recno.db.gz
similarity index 100%
rename from tests/_data/recno.db.gz
rename to tests/_data/bsd/recno.db.gz
diff --git a/tests/_data/rpm/Packages.gz b/tests/_data/bsd/rpm/Packages.gz
similarity index 100%
rename from tests/_data/rpm/Packages.gz
rename to tests/_data/bsd/rpm/Packages.gz
diff --git a/tests/_docs/conf.py b/tests/_docs/conf.py
index d241f00..3268943 100644
--- a/tests/_docs/conf.py
+++ b/tests/_docs/conf.py
@@ -1,4 +1,4 @@
-project = "dissect.bsddb"
+project = "dissect.database"
extensions = [
"autoapi.extension",
diff --git a/tests/bsd/__init__.py b/tests/bsd/__init__.py
new file mode 100644
index 0000000..e69de29
diff --git a/tests/test_bsddb.py b/tests/bsd/test_db.py
similarity index 95%
rename from tests/test_bsddb.py
rename to tests/bsd/test_db.py
index bd2ff5d..a4340e9 100644
--- a/tests/test_bsddb.py
+++ b/tests/bsd/test_db.py
@@ -2,7 +2,7 @@
from typing import BinaryIO
-from dissect.bsddb.bsddb import DB
+from dissect.database.bsd.db import DB
def _assert_wordlist(db: DB) -> None:
diff --git a/tests/test_rpm.py b/tests/bsd/test_rpm.py
similarity index 97%
rename from tests/test_rpm.py
rename to tests/bsd/test_rpm.py
index 9209cac..45ab7b0 100644
--- a/tests/test_rpm.py
+++ b/tests/bsd/test_rpm.py
@@ -3,7 +3,7 @@
import textwrap
from typing import BinaryIO
-from dissect.bsddb.tools.rpm import Packages
+from dissect.database.bsd.tools.rpm import Packages
def test_rpm(rpm_packages: BinaryIO) -> None:
diff --git a/tests/conftest.py b/tests/conftest.py
index 6850239..ca52e88 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -26,19 +26,19 @@ def open_file_gz(name: str, mode: str = "rb") -> Iterator[BinaryIO]:
@pytest.fixture
def btree_db() -> Iterator[BinaryIO]:
- yield from open_file_gz("_data/btree.db.gz")
+ yield from open_file_gz("_data/bsd/btree.db.gz")
@pytest.fixture
def hash_db() -> Iterator[BinaryIO]:
- yield from open_file_gz("_data/hash.db.gz")
+ yield from open_file_gz("_data/bsd/hash.db.gz")
@pytest.fixture
def recno_db() -> Iterator[BinaryIO]:
- yield from open_file_gz("_data/recno.db.gz")
+ yield from open_file_gz("_data/bsd/recno.db.gz")
@pytest.fixture
def rpm_packages() -> Iterator[BinaryIO]:
- yield from open_file_gz("_data/rpm/Packages.gz")
+ yield from open_file_gz("_data/bsd/rpm/Packages.gz")