Add typing: asn, exceptions, hashes, pwdbased, utils. by roberthdevries · Pull Request #125 · wolfSSL/wolfcrypt-py

roberthdevries · 2026-05-21T21:13:23Z

No description provided.

Trooper-X · 2026-05-26T09:49:39Z

This also adds the ruff and ty dependencies.
Would be nice if this MR gets merged.

dgarske

Skoll Code Review

Scan type: reviewOverall recommendation: REQUEST_CHANGES
Findings: 7 total — 7 posted, 0 skipped
6 finding(s) posted as inline comments (see file-level comments below)

Posted findings

[High] AES-SIV single-block associated-data length uses char count of original input, not encoded byte length — wolfcrypt/ciphers.py:397-400
[Medium] sign_with_seed no longer accepts bytearray/memoryview seeds (regression) — wolfcrypt/ciphers.py:2513-2546
[Medium] make_key_from_seed now silently UTF-8-encodes a str seed instead of rejecting it — wolfcrypt/ciphers.py:2360-2367
[Low] ChaCha init renamed size to _size, breaking the documented backward-compatible keyword — wolfcrypt/ciphers.py:544
[Low] HKDF helpers annotate hash_cls as instance type instead of class type — wolfcrypt/hkdf.py:33,78,105
[Low] Random no longer nulls native_object on init failure; del frees an uninitialized RNG — wolfcrypt/random.py:37-52
[Low] RsaPublic.init made key a required positional argument — wolfcrypt/ciphers.py:771-774

Review generated by Skoll

This has some fallout in random.py to simplify checks. Also one test is slightly adapted to produced the desired failure.

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

dgarske

Skoll Code Review

Scan type: reviewOverall recommendation: REQUEST_CHANGES
Findings: 7 total — 7 posted, 0 skipped
4 finding(s) posted as inline comments (see file-level comments below)

Posted findings

[High] New undeclared runtime dependency on typing_extensions — wolfcrypt/ciphers.py:28, wolfcrypt/hashes.py:28
[Medium] Removed _ffi.from_buffer() drops bytearray/memoryview support for seed/rand inputs — wolfcrypt/ciphers.py:2383, 2548, 2559, 2067, 2110
[Medium] **_Cipher.new() dropped kwargs, breaking PEP 272 extra keyword arguments — wolfcrypt/ciphers.py:187-199
[Medium] HKDF functions annotate hash_cls as instance type instead of class type — wolfcrypt/hkdf.py:33, 78, 105
[Medium] asn.py leaves function arguments unannotated while enabling ANN ruff rules — wolfcrypt/asn.py:81, 99
[Low] test_mldsa now relies on cffi's low-level TypeError instead of an explicit guard — tests/test_mldsa.py:186
[Low] RsaPublic.init made key a required positional argument — wolfcrypt/ciphers.py:781

Review generated by Skoll

Tests are now also type checked as this helps verifying the correctness of the type annotations.

dgarske

Skoll Code Review

Scan type: reviewOverall recommendation: COMMENT
Findings: 3 total — 3 posted, 0 skipped
3 finding(s) posted as inline comments (see file-level comments below)

Posted findings

[Medium] ML-DSA seed handling: bytearray/memoryview now rejected, and the two seed methods validate inconsistently — wolfcrypt/ciphers.py:2371-2392 (make_key_from_seed), 2516-2540 (sign_with_seed)
[Low] *ML-KEM _with_random helpers no longer accept bytearray/memoryview for rand — wolfcrypt/ciphers.py:2059-2077 (encapsulate_with_random), 2103-2119 (make_key_with_random)
[Low] hkdf.py forces a runtime import of _Hmac for a type annotation (no from future import annotations) — wolfcrypt/hkdf.py:30-33

Review generated by Skoll

dgarske

Skoll Code Review

Scan type: reviewOverall recommendation: COMMENT
Findings: 4 total — 4 posted, 0 skipped
4 finding(s) posted as inline comments (see file-level comments below)

Posted findings

[Medium] ML-DSA seed validation now rejects bytearray/memoryview (regression) — wolfcrypt/ciphers.py:2383,2537
[Medium] Advertised list/tuple seed support is untested and likely fails at the cffi boundary — wolfcrypt/ciphers.py:2372,2391
[Low] setup.py install_requires not synced with new typing-extensions runtime dependency — setup.py:62-63
[Low] Hard runtime import of private cffi symbol _cffi_backend.Lib only to satisfy a cast — wolfcrypt/__init__.py:20-22,56

Review generated by Skoll

dgarske

See #125 (review)
If you disagree just make note. We are getting close on this and thank you for your efforts

Also added a line to the change log to mention that typing information has been added.

dgarske

Skoll Code Review

Scan type: reviewOverall recommendation: COMMENT
Findings: 4 total — 4 posted, 0 skipped
4 finding(s) posted as inline comments (see file-level comments below)

Posted findings

[Medium] typing-extensions dependency has no minimum version (override requires =4.4.0) — pyproject.toml:27
[Low] bytes(seed) silently accepts an int, dropping the friendly type check for ML-DSA seeds — wolfcrypt/ciphers.py:2383,2536
[Info] New module wolfcrypt/types.py shadows the stdlib types module name — wolfcrypt/types.py:1
[Info] Inconsistent # ty:ignore comment lacks the space used everywhere else — wolfcrypt/__init__.py:53

Review generated by Skoll

dgarske · 2026-06-22T15:24:13Z

 dynamic = ["version"]
 dependencies = [
    "cffi>=1.0.0,<2",
+    "typing-extensions",


🟠 [Medium] typing-extensions dependency has no minimum version (override requires =4.4.0)

The PR adds from typing_extensions import override as an unconditional runtime import in wolfcrypt/ciphers.py and wolfcrypt/hashes.py. override was only added to typing_extensions in 4.4.0 (and typing.override does not exist until Python 3.12, while this package now supports 3.10/3.11 per requires-python = ">=3.10"). The new dependency is declared as just "typing-extensions" with no version floor. On an environment that already has an older typing_extensions installed, pip will treat the unconstrained requirement as already satisfied and not upgrade it, so from typing_extensions import override raises ImportError and the entire wolfcrypt package fails to import.

Fix: Pin a minimum version (typing-extensions>=4.4.0) so override is guaranteed to be importable on all supported Python versions.

dgarske · 2026-06-22T15:24:13Z

@@ -2316,35 +2379,31 @@ def make_key_from_seed(cls, mldsa_type, seed):
            :type seed: bytes
            """
            mldsa_priv = cls(mldsa_type)


🔵 [Low] bytes(seed) silently accepts an int, dropping the friendly type check for ML-DSA seeds

The previous code wrapped the seed in memoryview(seed) inside a try/except that raised a clear TypeError("seed must support the buffer protocol, such as bytesorbytearray") for non-buffer inputs. The new code replaces that with seed = bytes(seed). For str/None this still raises TypeError (acceptable), but for an int argument bytes(n) silently produces n zero bytes. If a caller mistakenly passes the integer seed length (e.g. make_key_from_seed(t, 32)), the length check len(seed) != ML_DSA_KEYGEN_SEED_LENGTH passes and an all-zero deterministic seed is used to generate a key/signature with no error -- a subtle footgun for a cryptographic seed input. The original explicit, descriptive error message is also lost.

Fix: Reject int (and other non-buffer scalar) inputs explicitly, or restore a buffer-protocol type check, so a misused integer cannot be silently coerced into an all-zero seed.

Restored the buffer protocol check using memoryview without using the result of memoryview.
Instead the conversion to bytes will take care of passing the right datatype to the cffi wrapped function.

dgarske · 2026-06-22T15:24:13Z

@@ -0,0 +1,35 @@
+# types.py


⚪ [Info] New module wolfcrypt/types.py shadows the stdlib types module name

The PR introduces wolfcrypt/types.py. It is consumed only via package-relative imports (from .types import ...), and Python 3 absolute imports prevent it from shadowing the stdlib types module elsewhere, so there is no runtime bug. However, naming a module types is a well-known footgun for maintainability (any future import types inside the package can confuse readers/tools).

Fix: Consider renaming the module to avoid colliding with the stdlib types name; optional, no functional impact.

Renamed to wc_types.py

dgarske · 2026-06-22T15:24:13Z

    if hasattr(_lib, 'WC_RNG_SEED_CB_ENABLED'):
        if _lib.WC_RNG_SEED_CB_ENABLED:
-            ret = _lib.wc_SetSeed_Cb(_ffi.addressof(_lib, "wc_GenerateSeed"))
+            ret = _lib.wc_SetSeed_Cb(_ffi.addressof(_lib, "wc_GenerateSeed"))  # ty:ignore[no-matching-overload]


⚪ [Info] Inconsistent # ty:ignore comment lacks the space used everywhere else

Every other suppression added in this PR uses the form # ty: ignore[...] (with a space after the colon), but this one is written # ty:ignore[no-matching-overload] (no space). If the ty checker's comment parser requires the canonical # ty: ignore spelling, this suppression will not take effect and the overload diagnostic will still surface. Cosmetic/tooling only -- no runtime impact.

Fix: Normalize to # ty: ignore[no-matching-overload] to match the rest of the codebase and ensure the suppression is recognized.

roberthdevries force-pushed the add-more-typing branch 2 times, most recently from 65d14db to 1c2b082 Compare May 23, 2026 14:02

dgarske assigned wolfSSL-Bot May 26, 2026

dgarske reviewed Jun 9, 2026

View reviewed changes

Comment thread wolfcrypt/ciphers.py

Comment thread wolfcrypt/ciphers.py

Comment thread wolfcrypt/ciphers.py

Comment thread wolfcrypt/ciphers.py Outdated

Comment thread wolfcrypt/random.py Outdated

Comment thread wolfcrypt/ciphers.py

dgarske assigned roberthdevries Jun 9, 2026

roberthdevries added 3 commits June 10, 2026 14:59

Add typing: asn, exceptions, hashes, hkdf, pwdbased, utils.

de901ee

Add typing information to ciphers.py

8814d7f

This has some fallout in random.py to simplify checks. Also one test is slightly adapted to produced the desired failure.

Address review comments and annotate overrides.

1af1a55

roberthdevries force-pushed the add-more-typing branch 2 times, most recently from 8f9280c to 1af1a55 Compare June 10, 2026 15:17

dgarske requested a review from Copilot June 10, 2026 16:38

dgarske unassigned roberthdevries Jun 10, 2026

Copilot started reviewing on behalf of dgarske June 10, 2026 16:38 View session

Copilot AI reviewed Jun 10, 2026

dgarske reviewed Jun 10, 2026

View reviewed changes

Comment thread wolfcrypt/ciphers.py

Comment thread wolfcrypt/asn.py Outdated

Comment thread tests/test_mldsa.py Outdated

Comment thread wolfcrypt/ciphers.py

dgarske assigned roberthdevries Jun 10, 2026

Address more review comments.

4545d59

Tests are now also type checked as this helps verifying the correctness of the type annotations.

dgarske self-requested a review June 11, 2026 20:50

Add py.typed file to indicate that this library has typing annotations.

b6cc32e

dgarske unassigned roberthdevries Jun 11, 2026

dgarske reviewed Jun 11, 2026

View reviewed changes

Comment thread wolfcrypt/ciphers.py

Comment thread wolfcrypt/hkdf.py

Comment thread wolfcrypt/ciphers.py

dgarske assigned roberthdevries Jun 11, 2026

Addressed more review comments.

e00c5d5

dgarske reviewed Jun 17, 2026

View reviewed changes

Comment thread wolfcrypt/ciphers.py Outdated

Comment thread wolfcrypt/ciphers.py Outdated

Comment thread setup.py Outdated

Comment thread wolfcrypt/__init__.py Outdated

dgarske requested changes Jun 17, 2026

View reviewed changes

Address more review comments.

0ad1356

Also added a line to the change log to mention that typing information has been added.

dgarske previously approved these changes Jun 22, 2026

View reviewed changes

dgarske assigned dgarske and unassigned roberthdevries Jun 22, 2026

dgarske reviewed Jun 22, 2026

View reviewed changes

dgarske assigned roberthdevries and unassigned dgarske Jun 22, 2026

Address more review comments.

922501b

roberthdevries dismissed dgarske’s stale review via 922501b June 22, 2026 21:00

Conversation

roberthdevries commented May 21, 2026

Uh oh!

Trooper-X commented May 26, 2026

Uh oh!

dgarske left a comment

Choose a reason for hiding this comment

Skoll Code Review

Posted findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

dgarske left a comment

Choose a reason for hiding this comment

Skoll Code Review

Posted findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dgarske left a comment

Choose a reason for hiding this comment

Skoll Code Review

Posted findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dgarske left a comment

Choose a reason for hiding this comment

Skoll Code Review

Posted findings

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

dgarske left a comment

Choose a reason for hiding this comment

Uh oh!

dgarske left a comment

Choose a reason for hiding this comment

Skoll Code Review

Posted findings

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants