# TRACE runtime dependencies.
#
# One file for every platform: the Windows-only packages carry environment
# markers, so `pip install -r requirements.txt` is correct on Windows, macOS
# and Linux alike. (python-magic-bin, and once pycaw and comtypes, used to be
# declared unconditionally, which made this file fail outright on Linux. The
# media player no longer sets Windows' master volume, so those two are gone.)
#
# Lower bounds rather than exact pins, so the tool keeps working on newer
# Python versions as wheels appear. Python 3.10 or newer is required: every
# package here installs from a pre-built wheel on Windows, macOS and Linux,
# so no compiler is needed anywhere.

# --- GUI -------------------------------------------------------------------
# Addons supplies QtCharts, QtSvg, QtMultimedia and QtPrintSupport, all used.
# Not 6.12.0: its QTableWidgetItem.setTextAlignment releases a reference to
# None on every call. Python 3.10 and 3.11 then abort ("none_dealloc:
# deallocating None") a few pages into the hex view; 3.12+ make None immortal
# and never notice. tests/test_hex.py guards against it coming back.
PySide6>=6.5.2,!=6.12.0

# --- Forensic image access -------------------------------------------------
# Pre-built wheels for Windows (x64, x86, ARM64), macOS (Apple Silicon and
# Intel) and Linux (x86_64, aarch64; glibc and musl) on Python 3.10+. These
# are the first releases that ship them; earlier ones were source-only and
# needed a C/C++ toolchain on every platform. The Sleuth Kit and libewf are
# built into the wheels, so no system packages are needed either.
pytsk3>=20260520
libewf-python>=20260924
# The same family (libyal), wheels for the same platforms and Pythons, each
# the first release to ship them everywhere. LGPL-3.0+, like libewf.
libvmdk-python>=20260714    # VMware VMDK virtual disks
libvhdi-python>=20260901    # Hyper-V / Virtual PC VHD and VHDX
libqcow-python>=20260703    # QEMU QCOW / QCOW2
libphdi-python>=20260902    # Parallels Desktop disks (.hdd bundles)
libmodi-python>=20260902    # Mac disk images: DMG (compressed too), sparse
                            # images and sparse bundles
libbde-python>=20260916     # BitLocker volumes, unlocked with a key given
libvshadow-python>=20260714 # Volume Shadow Copies (snapshots of NTFS)
libpff-python>=20260926     # Outlook PST / OST mailboxes
libfvde-python>=20260923    # FileVault 2 (Core Storage) volumes
libfsapfs-python>=20260921  # APFS containers and volumes, encrypted too
libfsxfs-python>=20260901   # XFS, which The Sleuth Kit does not read
libluksde-python>=20260902  # LUKS-encrypted Linux volumes
libvslvm-python>=20260901   # Linux LVM volume groups
libesedb-python>=20260704   # ESE databases: SRUM, Edge/IE WebCache
libmsiecf-python>=20260525  # Internet Explorer index.dat history

# --- Evidence parsing ------------------------------------------------------
python-registry>=1.3.1   # Windows registry hives
PyMuPDF>=1.24.3 ; sys_platform != 'darwin' or platform_machine != 'x86_64'
                         # PDF rendering, validation and metadata; 1.24.3
                         # introduced the `pymupdf` module name (`fitz` is
                         # deprecated and slated for removal)
PyMuPDF>=1.24.3,<2 ; sys_platform == 'darwin' and platform_machine == 'x86_64'
                         # 2.0 has no Intel Mac wheel: pip built it from
                         # source there and the download of MuPDF timed out
Pillow>=11.3.0           # image decoding and EXIF; 11.3 is the first whose
                         # wheels decode AVIF, which the Application tab shows
charset-normalizer>=3.3.0 # text encoding: which code page a file was
                         # written in (core/text_encoding.py). MIT; pure
                         # Python, compiled wheels where offered
olefile>=0.46            # legacy Office (.doc/.xls/.ppt): authors and encryption
py7zr>=1.0.0             # 7z archives: browsing, and spotting encrypted ones.
                         # Wheels for every platform; resolves to 1.0 on
                         # Python 3.9 and on Intel macOS. LGPL-2.1+.
rarfile>=4.2             # RAR archives: members, sizes, dates, encryption, and
                         # stored members -- pure Python. Compressed members
                         # need an external unrar, which TRACE does not use.
# HEIC/HEIF (iPhone photos): previews, thumbnails and EXIF/GPS through Pillow.
# The decode-only build: pillow-heif bundles the GPL x265 encoder, pi-heif does
# not. Wheels for every platform but Windows on ARM, where HEIC keeps its icon
# rather than pip attempting a compile. (PEP 508 markers have no `not`.)
pi-heif>=1.4.0 ; sys_platform != 'win32' or platform_machine != 'ARM64'
# YARA rules (VirusTotal's Rust rewrite; yara-python has no Linux or 3.14
# wheels). No Windows-on-ARM wheel: there, YARA scanning shows as unavailable
# (Options > Supported Features) rather than pip attempting a Rust build.
yara-x>=1.0.0 ; sys_platform != 'win32' or platform_machine != 'ARM64'
# Sigma rules are YAML. No Windows ARM64 wheel before Python 3.12.
PyYAML>=6.0.3 ; sys_platform != 'win32' or platform_machine != 'ARM64' or python_version >= '3.12'
cryptography>=46.0.3 ; (sys_platform != 'win32' or platform_machine != 'ARM64' or python_version >= '3.11') and (sys_platform != 'darwin' or platform_machine != 'x86_64')
                         # AES for encrypted iPhone backups (password given
                         # by the examiner); Windows on ARM wheels from 3.11
cryptography>=46.0.3,<49 ; sys_platform == 'darwin' and platform_machine == 'x86_64'
                         # 49 has no Intel Mac wheel (48.0.1's universal2
                         # is the last): pip compiled it with Rust there
msoffcrypto-tool>=5.4.2 ; sys_platform != 'win32' or platform_machine != 'ARM64' or python_version >= '3.11'
                         # password-protected Office documents, decrypted in
                         # memory with the examiner's password (MIT, pure
                         # Python; needs cryptography, hence its marker)
dpkt>=1.9.8              # network captures: pcap / pcapng (BSD, pure Python)
pefile>=2023.2.7,!=2024.8.26
                         # imphash and Rich-header hashes (MIT, pure Python;
                         # 2024.8.26 is the release PyInstaller refuses)
requests>=2.31.0         # VirusTotal API
# Zstandard in C (PEP 784's backport of 3.14's compression.zstd; PSF). Btrfs
# volumes are zstd-compressed throughout on Fedora, and TRACE's own decoder
# (core/zstd_decode.py, still the fallback) reads ~1 MB/s. Wheels for every
# platform on 3.10-3.13; 3.14 has it built in.
backports.zstd>=1.0.0 ; python_version < '3.14'
# CRC-32C in C (LGPL-2.1+, like libewf): Btrfs checksums every metadata
# node and data sector with it, and the deleted-file scan proves what is
# left of a file by them -- in Python that was ~100 s per GB, and a
# Fedora root never finished. Wheels for Windows (x64, ARM64), macOS
# (Intel, Apple Silicon) and Linux on every Python from 3.10.
crc32c>=2.7

# --- libmagic (file type from content) ------------------------------------
# python-magic is only a binding; libmagic is a C library. Windows: the -bin
# variant bundles the DLL. macOS: pylibmagic bundles libmagic and its
# database as a wheel (arm64 + x86_64, any Python 3), so no Homebrew; TRACE
# imports it before python-magic (trace_app/__init__.py). Pinned exactly: it
# is unmaintained since 2023, and CI checks it is the library actually
# loaded. Linux: libmagic1 from apt, needed alongside Qt's libraries anyway.
python-magic-bin>=0.4.14 ; sys_platform == 'win32'
python-magic>=0.4.27 ; sys_platform != 'win32'
pylibmagic==0.5.0 ; sys_platform == 'darwin'

# --- Time zones for display (Options > Settings > Display) ------------------
# Windows has no system zone database; zoneinfo reads this one there. Pure
# Python, so every platform takes it.
tzdata>=2024.1

# --- Tests (python -m pytest) -----------------------------------------------
# Image handling and the UI are tested on Windows, macOS and Linux in CI; the
# same suite runs locally. Not needed to run TRACE.
pytest>=8.0
pytest-xdist>=3.6          # tests in parallel: python -m pytest -n auto
                           # --dist loadfile (16 min -> 4 on four cores)

# --- Building a standalone executable (build_app.py) -----------------------
# Not needed to run TRACE from source; included so one install covers both.
pyinstaller>=6.0
