From 3078cd5b6938c6ce54b72bdcac646420b4e81ab0 Mon Sep 17 00:00:00 2001 From: Robert de Vries Date: Sun, 28 Jun 2026 21:59:03 +0200 Subject: [PATCH 1/7] Change workflow to using uv and ruff. uv is used to manage virtual environments and building wheels and source distributions. This replaces tox. ruff is used to do static checking. README is updated to reflect this change. --- .github/workflows/python-app.yml | 41 +++++++++++++------------- README.rst | 50 ++++++++++++++++++++------------ pyproject.toml | 11 ------- requirements/test.txt | 1 - 4 files changed, 53 insertions(+), 50 deletions(-) diff --git a/.github/workflows/python-app.yml b/.github/workflows/python-app.yml index 4209e4a..0cca893 100644 --- a/.github/workflows/python-app.yml +++ b/.github/workflows/python-app.yml @@ -23,21 +23,17 @@ jobs: uses: actions/setup-python@v3 with: python-version: "3.10" - - name: Install dependencies - run: | - python -m pip install --upgrade pip - pip install flake8 pytest tox - pip install -r requirements/test.txt -# Won't pass flake8 yet -# - name: Lint with flake8 -# run: | -# # stop the build if there are Python syntax errors or undefined names -# flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics -# # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide -# flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics - - name: Test with tox - run: | - tox + - name: Install uv + uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + with: + # Install a specific version of uv. + version: "0.11.25" + - name: Install the project + run: uv sync --locked --all-extras --dev + - name: Perform static checks + run: uv run ruff check + - name: Run tests + run: uv run pytest tests build-no-pqc: # Regression coverage for issue #2659: INVALID_DEVID is only declared @@ -80,13 +76,18 @@ jobs: - name: Install wolfcrypt-py against the local wolfSSL env: USE_LOCAL_WOLFSSL: ${{ github.workspace }}/wolfssl-install + - name: Install uv + uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + with: + # Install a specific version of uv. + version: "0.11.25" run: | - python -m pip install --upgrade pip - pip install -r requirements/test.txt - pip install -e . + uv venv + uv pip install -r requirements/test.txt + uv pip install -e . - name: Import smoke (regression for INVALID_DEVID) - run: python -c "from wolfcrypt.random import Random; Random()" + run: uv run python -c "from wolfcrypt.random import Random; Random()" - name: Run tests env: USE_LOCAL_WOLFSSL: ${{ github.workspace }}/wolfssl-install - run: pytest tests/ + run: uv run pytest tests diff --git a/README.rst b/README.rst index 3ce4978..900c9c0 100644 --- a/README.rst +++ b/README.rst @@ -21,20 +21,20 @@ Install the following on Windows: * `CMake `_ * `Git `_ -* `Python 3.9 `_ +* `Python 3.10 or newer `_ * `Build Tools for Visual Studio `_. This is in the "Tools for Visual Studio" section at the bottom of the page. The "Desktop development with C++" pack is needed from the installer. -Then from the command line install tox and CFFI using: +Then from the command line install `uv` using: .. code-block:: sh - pip install tox cffi + pip install uv You can then build the source distribution packages using: .. code-block:: sh - python setup.py sdist + uv build --sdist Linux @@ -42,11 +42,9 @@ Linux The `setup.py` file covers most things you will need to do to build and install from source. As pre-requisites you will need to install either from your OS repository or pip. You'll also need the Python development package for your Python version: -* `cffi` -* `tox` -* `pytest` +* `uv` -To build a source package run `python setup.py sdist`, to build a wheel package run `python setup.py bdist_wheel`. To test the build run `tox`. The `tox` tests rely on Python 3.9 being installed, if you do not have this version we recommend using `pyenv` to install it. +To build a source package run `uv build --sdist`, to build a wheel package run `uv build --wheel`. To test the build run `uv run pytest`. The tests rely on Python 3.10 or later being installed. Installation ------------ @@ -66,7 +64,7 @@ should be set equal to the installation path for the wolfSSL library: .. code-block:: bash - $ USE_LOCAL_WOLFSSL=/path/to/wolfssl/install pip install . + $ USE_LOCAL_WOLFSSL=/path/to/wolfssl/install uv pip install . If building wolfcrypt-py against a local wolfSSL library, wolfcrypt-py will attempt to do native feature detection to enable/disable wolfcrypt-py @@ -82,25 +80,41 @@ Testing >>> Sha256('wolfcrypt').hexdigest() b'96e02e7b1cbcd6f104fe1fdb4652027a5505b68652b70095c6318f9dce0d1844' -Testing ``wolfcrypt``'s source code with ``tox`` +Testing ``wolfcrypt``'s source code with ``pytest`` ------------------------------------------------ -To run the unit tests in the source code, you'll need ``tox`` and a few other +To run the unit tests in the source code, you'll need ``uv`` and a few other requirements. 1. Make sure that the testing requirements are installed: .. code-block:: console - $ sudo -H pip install -r requirements/test.txt + $ uv run sync --dev -2. Run ``tox``: +2. Run ``pytest``: .. code-block:: console - $ tox - ... - _________________________________ summary _________________________________ - py3: commands succeeded - congratulations :) + $ uv run pytest + ======================================= test session starts ======================================= + platform linux -- Python 3.10.12, pytest-9.1.1, pluggy-1.6.0 + rootdir: /some_directory/wolfcrypt-py + configfile: pyproject.toml + collected 165 items + + tests/test_aesgcmstream.py ......... [ 5%] + tests/test_asn.py .. [ 6%] + tests/test_chacha20poly1305.py ...... [ 10%] + tests/test_ciphers.py ........................................... [ 36%] + tests/test_delete_descriptor_binding.py ................. [ 46%] + tests/test_error_string.py .... [ 49%] + tests/test_hashes.py ........................... [ 65%] + tests/test_hkdf.py ........ [ 70%] + tests/test_mldsa.py .............................. [ 88%] + tests/test_mlkem.py ............ [ 95%] + tests/test_pwdbased.py . [ 96%] + tests/test_random.py ...... [100%] + + ======================================= 165 passed in 7.09s ======================================= diff --git a/pyproject.toml b/pyproject.toml index 35168f4..80c33fb 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -41,21 +41,10 @@ dev = [ "ruff", "sphinx", "sphinx-rtd-theme", - "tox >= 4", "ty", "types-cffi", ] -[tool.tox] -requires = ["tox>=4"] -env_list = ["py3"] - -[tool.tox.env_run_base] -package = "wheel" -deps = ["-rrequirements/test.txt"] -commands = [["py.test", "tests/"]] - - [tool.ruff] # Exclude a variety of commonly ignored directories. exclude = [ diff --git a/requirements/test.txt b/requirements/test.txt index 75bc4c1..9d782d0 100644 --- a/requirements/test.txt +++ b/requirements/test.txt @@ -1,4 +1,3 @@ -r prod.txt -tox>=4 pytest>=8 types-cffi>=1.17 From 5126115d38aae7cdffb473e7133718bbf3f3647a Mon Sep 17 00:00:00 2001 From: Robert de Vries Date: Tue, 30 Jun 2026 22:30:18 +0200 Subject: [PATCH 2/7] Fixed github actions document and processed review comments. --- .github/workflows/python-app.yml | 20 ++++++++++---------- README.rst | 8 +++++--- 2 files changed, 15 insertions(+), 13 deletions(-) diff --git a/.github/workflows/python-app.yml b/.github/workflows/python-app.yml index 0cca893..faed528 100644 --- a/.github/workflows/python-app.yml +++ b/.github/workflows/python-app.yml @@ -18,9 +18,9 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v6 - name: Set up Python 3.10 - uses: actions/setup-python@v3 + uses: actions/setup-python@v6 with: python-version: "3.10" - name: Install uv @@ -29,7 +29,7 @@ jobs: # Install a specific version of uv. version: "0.11.25" - name: Install the project - run: uv sync --locked --all-extras --dev + run: uv sync --dev - name: Perform static checks run: uv run ruff check - name: Run tests @@ -43,13 +43,18 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v6 with: submodules: recursive - name: Set up Python 3.10 - uses: actions/setup-python@v3 + uses: actions/setup-python@v6 with: python-version: "3.10" + - name: Install uv + uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + with: + # Install a specific version of uv. + version: "0.11.25" - name: Install build deps run: | sudo apt-get update @@ -76,11 +81,6 @@ jobs: - name: Install wolfcrypt-py against the local wolfSSL env: USE_LOCAL_WOLFSSL: ${{ github.workspace }}/wolfssl-install - - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 - with: - # Install a specific version of uv. - version: "0.11.25" run: | uv venv uv pip install -r requirements/test.txt diff --git a/README.rst b/README.rst index 900c9c0..9f4ec23 100644 --- a/README.rst +++ b/README.rst @@ -64,7 +64,7 @@ should be set equal to the installation path for the wolfSSL library: .. code-block:: bash - $ USE_LOCAL_WOLFSSL=/path/to/wolfssl/install uv pip install . + $ USE_LOCAL_WOLFSSL=/path/to/wolfssl/install uv sync If building wolfcrypt-py against a local wolfSSL library, wolfcrypt-py will attempt to do native feature detection to enable/disable wolfcrypt-py @@ -73,6 +73,8 @@ features based on how native wolfSSL has been compiled. It uses the Testing ------- +.. code-block:: console + $ uv run python3 .. code-block:: python @@ -81,7 +83,7 @@ Testing b'96e02e7b1cbcd6f104fe1fdb4652027a5505b68652b70095c6318f9dce0d1844' Testing ``wolfcrypt``'s source code with ``pytest`` ------------------------------------------------- +--------------------------------------------------- To run the unit tests in the source code, you'll need ``uv`` and a few other requirements. @@ -90,7 +92,7 @@ requirements. .. code-block:: console - $ uv run sync --dev + $ uv sync --dev 2. Run ``pytest``: From 2c35de76c7d9e7d1d7e393fddf5febfe653b221e Mon Sep 17 00:00:00 2001 From: Robert de Vries Date: Tue, 30 Jun 2026 22:36:31 +0200 Subject: [PATCH 3/7] Revert to actions/*v3 --- .github/workflows/python-app.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/python-app.yml b/.github/workflows/python-app.yml index faed528..ca381f0 100644 --- a/.github/workflows/python-app.yml +++ b/.github/workflows/python-app.yml @@ -18,9 +18,9 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v3 - name: Set up Python 3.10 - uses: actions/setup-python@v6 + uses: actions/setup-python@v3 with: python-version: "3.10" - name: Install uv @@ -43,11 +43,11 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v3 with: submodules: recursive - name: Set up Python 3.10 - uses: actions/setup-python@v6 + uses: actions/setup-python@v3 with: python-version: "3.10" - name: Install uv From 04b58c00383a9be994ef6f10674f37ed02732ce5 Mon Sep 17 00:00:00 2001 From: Robert de Vries Date: Sun, 5 Jul 2026 14:38:28 +0200 Subject: [PATCH 4/7] Fix ruff errors --- tests/test_chacha20poly1305.py | 1 - tests/test_chacha_iv.py | 2 -- tests/test_cipher_modes.py | 2 -- tests/test_hmac_copy.py | 2 -- 4 files changed, 7 deletions(-) diff --git a/tests/test_chacha20poly1305.py b/tests/test_chacha20poly1305.py index 07616ea..28125ac 100644 --- a/tests/test_chacha20poly1305.py +++ b/tests/test_chacha20poly1305.py @@ -1,4 +1,3 @@ - # test_chacha20poly1305.py # # Copyright (C) 2022 wolfSSL Inc. diff --git a/tests/test_chacha_iv.py b/tests/test_chacha_iv.py index 571f016..9d6ef3a 100644 --- a/tests/test_chacha_iv.py +++ b/tests/test_chacha_iv.py @@ -1,5 +1,3 @@ -# -*- coding: utf-8 -*- -# # test_chacha_iv.py # # Copyright (C) 2006-2022 wolfSSL Inc. diff --git a/tests/test_cipher_modes.py b/tests/test_cipher_modes.py index b74c483..d8e654a 100644 --- a/tests/test_cipher_modes.py +++ b/tests/test_cipher_modes.py @@ -1,5 +1,3 @@ -# -*- coding: utf-8 -*- -# # test_cipher_modes.py # # Copyright (C) 2006-2022 wolfSSL Inc. diff --git a/tests/test_hmac_copy.py b/tests/test_hmac_copy.py index 1446868..a658ff8 100644 --- a/tests/test_hmac_copy.py +++ b/tests/test_hmac_copy.py @@ -1,5 +1,3 @@ -# -*- coding: utf-8 -*- -# # test_hmac_copy.py # # Copyright (C) 2006-2022 wolfSSL Inc. From 55d4a358053a4775386cbf8b845c87608627aec6 Mon Sep 17 00:00:00 2001 From: Robert de Vries Date: Sun, 5 Jul 2026 15:52:14 +0200 Subject: [PATCH 5/7] Address review comments * Update README.rst to fix remaining unclarities in using uv to install locally built version and various other smaller issues. * Pipeline changes: * Build wheel * Test against locally built wheel * Make sure no-pqc version doesn't have ML-DSA/ML-KEM enabled. --- .github/workflows/python-app.yml | 26 +++++++++++++++++--------- README.rst | 15 ++++++++++++--- 2 files changed, 29 insertions(+), 12 deletions(-) diff --git a/.github/workflows/python-app.yml b/.github/workflows/python-app.yml index ca381f0..b5cba93 100644 --- a/.github/workflows/python-app.yml +++ b/.github/workflows/python-app.yml @@ -18,22 +18,26 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v7 - name: Set up Python 3.10 - uses: actions/setup-python@v3 + uses: actions/setup-python@v6 with: python-version: "3.10" - name: Install uv uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: # Install a specific version of uv. - version: "0.11.25" + version: "0.11.26" + - name: Build the wheel + run: uv build --wheel - name: Install the project run: uv sync --dev - name: Perform static checks run: uv run ruff check - - name: Run tests - run: uv run pytest tests + - name: Run tests using the locally built wheel + run: | + uv pip install dist/*.whl + uv run pytest tests build-no-pqc: # Regression coverage for issue #2659: INVALID_DEVID is only declared @@ -43,18 +47,18 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v7 with: submodules: recursive - name: Set up Python 3.10 - uses: actions/setup-python@v3 + uses: actions/setup-python@v6 with: python-version: "3.10" - name: Install uv uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: # Install a specific version of uv. - version: "0.11.25" + version: "0.11.26" - name: Install build deps run: | sudo apt-get update @@ -64,7 +68,7 @@ jobs: cd lib/wolfssl ./autogen.sh ./configure --enable-cryptonly --disable-shared \ - --disable-kyber --disable-dilithium \ + --disable-mlkem --disable-mldsa \ --enable-aes --enable-aesgcm --enable-aessiv \ --enable-aesctr --enable-aesgcm-stream \ --enable-des3 --enable-chacha --enable-poly1305 \ @@ -85,6 +89,10 @@ jobs: uv venv uv pip install -r requirements/test.txt uv pip install -e . + - name: Check absence of ML-KEM and ML-DSA support + run: | + uv run python -c "from wolfcrypt._ffi import lib as _lib; assert _lib.ML_KEM_ENABLED == 0, 'ML-KEM should be disabled'" + uv run python -c "from wolfcrypt._ffi import lib as _lib; assert _lib.ML_DSA_ENABLED == 0, 'ML-DSA should be disabled'" - name: Import smoke (regression for INVALID_DEVID) run: uv run python -c "from wolfcrypt.random import Random; Random()" - name: Run tests diff --git a/README.rst b/README.rst index 9f4ec23..68ab4fc 100644 --- a/README.rst +++ b/README.rst @@ -30,6 +30,8 @@ Then from the command line install `uv` using: pip install uv +Or by following the installation instructions on the astral web site. ``_ + You can then build the source distribution packages using: .. code-block:: sh @@ -40,7 +42,7 @@ You can then build the source distribution packages using: Linux ^^^^^ -The `setup.py` file covers most things you will need to do to build and install from source. As pre-requisites you will need to install either from your OS repository or pip. You'll also need the Python development package for your Python version: +The `setup.py` file covers most things you will need to do to build and install from source. As pre-requisites you will need to install either from your OS repository or uv. You'll also need the Python development package for your Python version: * `uv` @@ -59,21 +61,28 @@ To build wolfcrypt-py against a local installation of the native C wolfSSL library, use the USE_LOCAL_WOLFSSL variable. This variable should be wolfcrypt-py can be built against a local version of the native wolfSSL -library by using pip with the USE_LOCAL_WOLFSSL variable. USE_LOCAL_WOLFSSL +library by using uv build --wheel with the USE_LOCAL_WOLFSSL variable. USE_LOCAL_WOLFSSL should be set equal to the installation path for the wolfSSL library: .. code-block:: bash - $ USE_LOCAL_WOLFSSL=/path/to/wolfssl/install uv sync + $ USE_LOCAL_WOLFSSL=/path/to/wolfssl/install uv build --wheel If building wolfcrypt-py against a local wolfSSL library, wolfcrypt-py will attempt to do native feature detection to enable/disable wolfcrypt-py features based on how native wolfSSL has been compiled. It uses the header to do feature detection. +After this the local build can be installed from the locally built wheel in dist. + +.. code-block:: bash + + $ pip install dist/wolfcrypt*.whl + Testing ------- .. code-block:: console + $ uv run python3 .. code-block:: python From 35f9108a5fb59bff975c61f8a48f9e3f879181e3 Mon Sep 17 00:00:00 2001 From: Robert de Vries Date: Sun, 5 Jul 2026 15:56:25 +0200 Subject: [PATCH 6/7] Update Makefile so that lint, test, test-all, check-all work again. --- Makefile | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/Makefile b/Makefile index 45f0eb1..c5c1b12 100644 --- a/Makefile +++ b/Makefile @@ -49,19 +49,21 @@ clean-test: ## remove test and coverage artifacts rm -f .coverage rm -fr htmlcov/ -lint: ## check style with flake8 - flake8 src tests - pylint src tests/* +lint: ## check style with ruff + uv run ruff check -test: install ## run tests quickly with the default Python - py.test tests +test: ## run tests quickly with the default Python + uv run py.test tests check: test ## run tests quickly with the default Python -test-all: ## run tests on every Python version with tox - tox +test-all: ## run tests on every Python version with uv + for version in 3.10 3.11 3.12 3.13 3.14; do \ + echo "=== Python $$version ==="; \ + uv run --python $$version pytest; \ + done -check-all: test-all ## run tests on every Python version with tox +check-all: test-all ## run tests on every Python version with uv cov: ## check code coverage quickly with the default Python uv run pytest --cov=wolfcrypt tests @@ -92,6 +94,3 @@ dist: clean ## builds source and wheel package release: ## package and upload a release twine upload dist/* - -install: clean ## install the package to the active Python's site-packages - python setup.py install From 0d2e15ffed519f7ae56efa40216bcca3d7ff1759 Mon Sep 17 00:00:00 2001 From: Robert de Vries Date: Mon, 6 Jul 2026 22:42:35 +0200 Subject: [PATCH 7/7] Addressed multiple review comments. --- .github/workflows/python-app.yml | 8 ++++---- Makefile | 10 +++++----- README.rst | 2 +- 3 files changed, 10 insertions(+), 10 deletions(-) diff --git a/.github/workflows/python-app.yml b/.github/workflows/python-app.yml index b5cba93..7f03589 100644 --- a/.github/workflows/python-app.yml +++ b/.github/workflows/python-app.yml @@ -36,8 +36,8 @@ jobs: run: uv run ruff check - name: Run tests using the locally built wheel run: | - uv pip install dist/*.whl - uv run pytest tests + uv pip install --reinstall dist/*.whl + uv run --no-sync pytest tests build-no-pqc: # Regression coverage for issue #2659: INVALID_DEVID is only declared @@ -91,8 +91,8 @@ jobs: uv pip install -e . - name: Check absence of ML-KEM and ML-DSA support run: | - uv run python -c "from wolfcrypt._ffi import lib as _lib; assert _lib.ML_KEM_ENABLED == 0, 'ML-KEM should be disabled'" - uv run python -c "from wolfcrypt._ffi import lib as _lib; assert _lib.ML_DSA_ENABLED == 0, 'ML-DSA should be disabled'" + uv run --no-sync python -c "from wolfcrypt._ffi import lib as _lib; assert _lib.ML_KEM_ENABLED == 0, 'ML-KEM should be disabled'" + uv run --no-sync python -c "from wolfcrypt._ffi import lib as _lib; assert _lib.ML_DSA_ENABLED == 0, 'ML-DSA should be disabled'" - name: Import smoke (regression for INVALID_DEVID) run: uv run python -c "from wolfcrypt.random import Random; Random()" - name: Run tests diff --git a/Makefile b/Makefile index c5c1b12..4a9e8a4 100644 --- a/Makefile +++ b/Makefile @@ -60,7 +60,7 @@ check: test ## run tests quickly with the default Python test-all: ## run tests on every Python version with uv for version in 3.10 3.11 3.12 3.13 3.14; do \ echo "=== Python $$version ==="; \ - uv run --python $$version pytest; \ + uv run --python $$version pytest tests || exit 1; \ done check-all: test-all ## run tests on every Python version with uv @@ -71,14 +71,14 @@ cov: ## check code coverage quickly with the default Python uv run coverage html $(BROWSER) htmlcov/index.html -docs: install ## generate Sphinx HTML documentation, including API docs +docs: ## generate Sphinx HTML documentation, including API docs $(MAKE) -C docs clean - $(MAKE) -C docs html + uv run $(MAKE) -C docs html $(BROWSER) docs/_build/html/index.html -doctest: install ## generate Sphinx HTML documentation, including API docs +doctest: ## generate Sphinx HTML documentation, including API docs $(MAKE) -C docs clean - $(MAKE) -C docs doctest + uv run $(MAKE) -C docs doctest servedocs: docs ## compile the docs watching for changes watchmedo shell-command -p '*.rst' -c '$(MAKE) -C docs html' -R -D . diff --git a/README.rst b/README.rst index 68ab4fc..854b5d6 100644 --- a/README.rst +++ b/README.rst @@ -42,7 +42,7 @@ You can then build the source distribution packages using: Linux ^^^^^ -The `setup.py` file covers most things you will need to do to build and install from source. As pre-requisites you will need to install either from your OS repository or uv. You'll also need the Python development package for your Python version: +The `setup.py` file covers most things you will need to do to build and install from source. As pre-requisites you will need to install either from your OS repository or with uv. You'll also need the Python development package for your Python version: * `uv`