From b870611e956851647e237ae13555d4141d8a5abc Mon Sep 17 00:00:00 2001 From: Robert de Vries Date: Sun, 28 Jun 2026 21:59:03 +0200 Subject: [PATCH 1/6] Change workflow to using uv and ruff. uv is used to manage virtual environments and building wheels and source distributions. This replaces tox. ruff is used to do static checking. README is updated to reflect this change. --- .github/workflows/python-app.yml | 41 +++++++++++++------------- README.rst | 50 ++++++++++++++++++++------------ pyproject.toml | 11 ------- requirements/test.txt | 1 - 4 files changed, 53 insertions(+), 50 deletions(-) diff --git a/.github/workflows/python-app.yml b/.github/workflows/python-app.yml index 4209e4a..0cca893 100644 --- a/.github/workflows/python-app.yml +++ b/.github/workflows/python-app.yml @@ -23,21 +23,17 @@ jobs: uses: actions/setup-python@v3 with: python-version: "3.10" - - name: Install dependencies - run: | - python -m pip install --upgrade pip - pip install flake8 pytest tox - pip install -r requirements/test.txt -# Won't pass flake8 yet -# - name: Lint with flake8 -# run: | -# # stop the build if there are Python syntax errors or undefined names -# flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics -# # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide -# flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics - - name: Test with tox - run: | - tox + - name: Install uv + uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + with: + # Install a specific version of uv. + version: "0.11.25" + - name: Install the project + run: uv sync --locked --all-extras --dev + - name: Perform static checks + run: uv run ruff check + - name: Run tests + run: uv run pytest tests build-no-pqc: # Regression coverage for issue #2659: INVALID_DEVID is only declared @@ -80,13 +76,18 @@ jobs: - name: Install wolfcrypt-py against the local wolfSSL env: USE_LOCAL_WOLFSSL: ${{ github.workspace }}/wolfssl-install + - name: Install uv + uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + with: + # Install a specific version of uv. + version: "0.11.25" run: | - python -m pip install --upgrade pip - pip install -r requirements/test.txt - pip install -e . + uv venv + uv pip install -r requirements/test.txt + uv pip install -e . - name: Import smoke (regression for INVALID_DEVID) - run: python -c "from wolfcrypt.random import Random; Random()" + run: uv run python -c "from wolfcrypt.random import Random; Random()" - name: Run tests env: USE_LOCAL_WOLFSSL: ${{ github.workspace }}/wolfssl-install - run: pytest tests/ + run: uv run pytest tests diff --git a/README.rst b/README.rst index 3ce4978..900c9c0 100644 --- a/README.rst +++ b/README.rst @@ -21,20 +21,20 @@ Install the following on Windows: * `CMake `_ * `Git `_ -* `Python 3.9 `_ +* `Python 3.10 or newer `_ * `Build Tools for Visual Studio `_. This is in the "Tools for Visual Studio" section at the bottom of the page. The "Desktop development with C++" pack is needed from the installer. -Then from the command line install tox and CFFI using: +Then from the command line install `uv` using: .. code-block:: sh - pip install tox cffi + pip install uv You can then build the source distribution packages using: .. code-block:: sh - python setup.py sdist + uv build --sdist Linux @@ -42,11 +42,9 @@ Linux The `setup.py` file covers most things you will need to do to build and install from source. As pre-requisites you will need to install either from your OS repository or pip. You'll also need the Python development package for your Python version: -* `cffi` -* `tox` -* `pytest` +* `uv` -To build a source package run `python setup.py sdist`, to build a wheel package run `python setup.py bdist_wheel`. To test the build run `tox`. The `tox` tests rely on Python 3.9 being installed, if you do not have this version we recommend using `pyenv` to install it. +To build a source package run `uv build --sdist`, to build a wheel package run `uv build --wheel`. To test the build run `uv run pytest`. The tests rely on Python 3.10 or later being installed. Installation ------------ @@ -66,7 +64,7 @@ should be set equal to the installation path for the wolfSSL library: .. code-block:: bash - $ USE_LOCAL_WOLFSSL=/path/to/wolfssl/install pip install . + $ USE_LOCAL_WOLFSSL=/path/to/wolfssl/install uv pip install . If building wolfcrypt-py against a local wolfSSL library, wolfcrypt-py will attempt to do native feature detection to enable/disable wolfcrypt-py @@ -82,25 +80,41 @@ Testing >>> Sha256('wolfcrypt').hexdigest() b'96e02e7b1cbcd6f104fe1fdb4652027a5505b68652b70095c6318f9dce0d1844' -Testing ``wolfcrypt``'s source code with ``tox`` +Testing ``wolfcrypt``'s source code with ``pytest`` ------------------------------------------------ -To run the unit tests in the source code, you'll need ``tox`` and a few other +To run the unit tests in the source code, you'll need ``uv`` and a few other requirements. 1. Make sure that the testing requirements are installed: .. code-block:: console - $ sudo -H pip install -r requirements/test.txt + $ uv run sync --dev -2. Run ``tox``: +2. Run ``pytest``: .. code-block:: console - $ tox - ... - _________________________________ summary _________________________________ - py3: commands succeeded - congratulations :) + $ uv run pytest + ======================================= test session starts ======================================= + platform linux -- Python 3.10.12, pytest-9.1.1, pluggy-1.6.0 + rootdir: /some_directory/wolfcrypt-py + configfile: pyproject.toml + collected 165 items + + tests/test_aesgcmstream.py ......... [ 5%] + tests/test_asn.py .. [ 6%] + tests/test_chacha20poly1305.py ...... [ 10%] + tests/test_ciphers.py ........................................... [ 36%] + tests/test_delete_descriptor_binding.py ................. [ 46%] + tests/test_error_string.py .... [ 49%] + tests/test_hashes.py ........................... [ 65%] + tests/test_hkdf.py ........ [ 70%] + tests/test_mldsa.py .............................. [ 88%] + tests/test_mlkem.py ............ [ 95%] + tests/test_pwdbased.py . [ 96%] + tests/test_random.py ...... [100%] + + ======================================= 165 passed in 7.09s ======================================= diff --git a/pyproject.toml b/pyproject.toml index 8f95d18..9e0abf3 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -40,21 +40,10 @@ dev = [ "ruff", "sphinx", "sphinx-rtd-theme", - "tox >= 4", "ty", "types-cffi", ] -[tool.tox] -requires = ["tox>=4"] -env_list = ["py3"] - -[tool.tox.env_run_base] -package = "wheel" -deps = ["-rrequirements/test.txt"] -commands = [["py.test", "tests/"]] - - [tool.ruff] # Exclude a variety of commonly ignored directories. exclude = [ diff --git a/requirements/test.txt b/requirements/test.txt index 75bc4c1..9d782d0 100644 --- a/requirements/test.txt +++ b/requirements/test.txt @@ -1,4 +1,3 @@ -r prod.txt -tox>=4 pytest>=8 types-cffi>=1.17 From 756477f152f698efd99f32f43e0376a14b7e2911 Mon Sep 17 00:00:00 2001 From: Robert de Vries Date: Tue, 30 Jun 2026 22:30:18 +0200 Subject: [PATCH 2/6] Fixed github actions document and processed review comments. --- .github/workflows/python-app.yml | 20 ++++++++++---------- README.rst | 8 +++++--- 2 files changed, 15 insertions(+), 13 deletions(-) diff --git a/.github/workflows/python-app.yml b/.github/workflows/python-app.yml index 0cca893..faed528 100644 --- a/.github/workflows/python-app.yml +++ b/.github/workflows/python-app.yml @@ -18,9 +18,9 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v6 - name: Set up Python 3.10 - uses: actions/setup-python@v3 + uses: actions/setup-python@v6 with: python-version: "3.10" - name: Install uv @@ -29,7 +29,7 @@ jobs: # Install a specific version of uv. version: "0.11.25" - name: Install the project - run: uv sync --locked --all-extras --dev + run: uv sync --dev - name: Perform static checks run: uv run ruff check - name: Run tests @@ -43,13 +43,18 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v6 with: submodules: recursive - name: Set up Python 3.10 - uses: actions/setup-python@v3 + uses: actions/setup-python@v6 with: python-version: "3.10" + - name: Install uv + uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 + with: + # Install a specific version of uv. + version: "0.11.25" - name: Install build deps run: | sudo apt-get update @@ -76,11 +81,6 @@ jobs: - name: Install wolfcrypt-py against the local wolfSSL env: USE_LOCAL_WOLFSSL: ${{ github.workspace }}/wolfssl-install - - name: Install uv - uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 - with: - # Install a specific version of uv. - version: "0.11.25" run: | uv venv uv pip install -r requirements/test.txt diff --git a/README.rst b/README.rst index 900c9c0..9f4ec23 100644 --- a/README.rst +++ b/README.rst @@ -64,7 +64,7 @@ should be set equal to the installation path for the wolfSSL library: .. code-block:: bash - $ USE_LOCAL_WOLFSSL=/path/to/wolfssl/install uv pip install . + $ USE_LOCAL_WOLFSSL=/path/to/wolfssl/install uv sync If building wolfcrypt-py against a local wolfSSL library, wolfcrypt-py will attempt to do native feature detection to enable/disable wolfcrypt-py @@ -73,6 +73,8 @@ features based on how native wolfSSL has been compiled. It uses the Testing ------- +.. code-block:: console + $ uv run python3 .. code-block:: python @@ -81,7 +83,7 @@ Testing b'96e02e7b1cbcd6f104fe1fdb4652027a5505b68652b70095c6318f9dce0d1844' Testing ``wolfcrypt``'s source code with ``pytest`` ------------------------------------------------- +--------------------------------------------------- To run the unit tests in the source code, you'll need ``uv`` and a few other requirements. @@ -90,7 +92,7 @@ requirements. .. code-block:: console - $ uv run sync --dev + $ uv sync --dev 2. Run ``pytest``: From 1db63dd713cefbfe0ce634b1a0004b199259d826 Mon Sep 17 00:00:00 2001 From: Robert de Vries Date: Tue, 30 Jun 2026 22:36:31 +0200 Subject: [PATCH 3/6] Revert to actions/*v3 --- .github/workflows/python-app.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/python-app.yml b/.github/workflows/python-app.yml index faed528..ca381f0 100644 --- a/.github/workflows/python-app.yml +++ b/.github/workflows/python-app.yml @@ -18,9 +18,9 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v3 - name: Set up Python 3.10 - uses: actions/setup-python@v6 + uses: actions/setup-python@v3 with: python-version: "3.10" - name: Install uv @@ -43,11 +43,11 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@v3 with: submodules: recursive - name: Set up Python 3.10 - uses: actions/setup-python@v6 + uses: actions/setup-python@v3 with: python-version: "3.10" - name: Install uv From 4dcd5a376eb2b4e317b5d9f9173acf59d585d57b Mon Sep 17 00:00:00 2001 From: Robert de Vries Date: Sun, 5 Jul 2026 14:38:28 +0200 Subject: [PATCH 4/6] Fix ruff errors --- tests/test_chacha20poly1305.py | 1 - tests/test_chacha_iv.py | 2 -- tests/test_cipher_modes.py | 2 -- tests/test_hmac_copy.py | 2 -- 4 files changed, 7 deletions(-) diff --git a/tests/test_chacha20poly1305.py b/tests/test_chacha20poly1305.py index 07616ea..28125ac 100644 --- a/tests/test_chacha20poly1305.py +++ b/tests/test_chacha20poly1305.py @@ -1,4 +1,3 @@ - # test_chacha20poly1305.py # # Copyright (C) 2022 wolfSSL Inc. diff --git a/tests/test_chacha_iv.py b/tests/test_chacha_iv.py index 571f016..9d6ef3a 100644 --- a/tests/test_chacha_iv.py +++ b/tests/test_chacha_iv.py @@ -1,5 +1,3 @@ -# -*- coding: utf-8 -*- -# # test_chacha_iv.py # # Copyright (C) 2006-2022 wolfSSL Inc. diff --git a/tests/test_cipher_modes.py b/tests/test_cipher_modes.py index b74c483..d8e654a 100644 --- a/tests/test_cipher_modes.py +++ b/tests/test_cipher_modes.py @@ -1,5 +1,3 @@ -# -*- coding: utf-8 -*- -# # test_cipher_modes.py # # Copyright (C) 2006-2022 wolfSSL Inc. diff --git a/tests/test_hmac_copy.py b/tests/test_hmac_copy.py index 1446868..a658ff8 100644 --- a/tests/test_hmac_copy.py +++ b/tests/test_hmac_copy.py @@ -1,5 +1,3 @@ -# -*- coding: utf-8 -*- -# # test_hmac_copy.py # # Copyright (C) 2006-2022 wolfSSL Inc. From 945f5f71ccb739e38374b34429869b89d57a7a7f Mon Sep 17 00:00:00 2001 From: Robert de Vries Date: Sun, 5 Jul 2026 15:52:14 +0200 Subject: [PATCH 5/6] Address review comments * Update README.rst to fix remaining unclarities in using uv to install locally built version and various other smaller issues. * Pipeline changes: * Build wheel * Test against locally built wheel * Make sure no-pqc version doesn't have ML-DSA/ML-KEM enabled. --- .github/workflows/python-app.yml | 26 +++++++++++++++++--------- README.rst | 15 ++++++++++++--- 2 files changed, 29 insertions(+), 12 deletions(-) diff --git a/.github/workflows/python-app.yml b/.github/workflows/python-app.yml index ca381f0..b5cba93 100644 --- a/.github/workflows/python-app.yml +++ b/.github/workflows/python-app.yml @@ -18,22 +18,26 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v7 - name: Set up Python 3.10 - uses: actions/setup-python@v3 + uses: actions/setup-python@v6 with: python-version: "3.10" - name: Install uv uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: # Install a specific version of uv. - version: "0.11.25" + version: "0.11.26" + - name: Build the wheel + run: uv build --wheel - name: Install the project run: uv sync --dev - name: Perform static checks run: uv run ruff check - - name: Run tests - run: uv run pytest tests + - name: Run tests using the locally built wheel + run: | + uv pip install dist/*.whl + uv run pytest tests build-no-pqc: # Regression coverage for issue #2659: INVALID_DEVID is only declared @@ -43,18 +47,18 @@ jobs: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@v7 with: submodules: recursive - name: Set up Python 3.10 - uses: actions/setup-python@v3 + uses: actions/setup-python@v6 with: python-version: "3.10" - name: Install uv uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0 with: # Install a specific version of uv. - version: "0.11.25" + version: "0.11.26" - name: Install build deps run: | sudo apt-get update @@ -64,7 +68,7 @@ jobs: cd lib/wolfssl ./autogen.sh ./configure --enable-cryptonly --disable-shared \ - --disable-kyber --disable-dilithium \ + --disable-mlkem --disable-mldsa \ --enable-aes --enable-aesgcm --enable-aessiv \ --enable-aesctr --enable-aesgcm-stream \ --enable-des3 --enable-chacha --enable-poly1305 \ @@ -85,6 +89,10 @@ jobs: uv venv uv pip install -r requirements/test.txt uv pip install -e . + - name: Check absence of ML-KEM and ML-DSA support + run: | + uv run python -c "from wolfcrypt._ffi import lib as _lib; assert _lib.ML_KEM_ENABLED == 0, 'ML-KEM should be disabled'" + uv run python -c "from wolfcrypt._ffi import lib as _lib; assert _lib.ML_DSA_ENABLED == 0, 'ML-DSA should be disabled'" - name: Import smoke (regression for INVALID_DEVID) run: uv run python -c "from wolfcrypt.random import Random; Random()" - name: Run tests diff --git a/README.rst b/README.rst index 9f4ec23..68ab4fc 100644 --- a/README.rst +++ b/README.rst @@ -30,6 +30,8 @@ Then from the command line install `uv` using: pip install uv +Or by following the installation instructions on the astral web site. ``_ + You can then build the source distribution packages using: .. code-block:: sh @@ -40,7 +42,7 @@ You can then build the source distribution packages using: Linux ^^^^^ -The `setup.py` file covers most things you will need to do to build and install from source. As pre-requisites you will need to install either from your OS repository or pip. You'll also need the Python development package for your Python version: +The `setup.py` file covers most things you will need to do to build and install from source. As pre-requisites you will need to install either from your OS repository or uv. You'll also need the Python development package for your Python version: * `uv` @@ -59,21 +61,28 @@ To build wolfcrypt-py against a local installation of the native C wolfSSL library, use the USE_LOCAL_WOLFSSL variable. This variable should be wolfcrypt-py can be built against a local version of the native wolfSSL -library by using pip with the USE_LOCAL_WOLFSSL variable. USE_LOCAL_WOLFSSL +library by using uv build --wheel with the USE_LOCAL_WOLFSSL variable. USE_LOCAL_WOLFSSL should be set equal to the installation path for the wolfSSL library: .. code-block:: bash - $ USE_LOCAL_WOLFSSL=/path/to/wolfssl/install uv sync + $ USE_LOCAL_WOLFSSL=/path/to/wolfssl/install uv build --wheel If building wolfcrypt-py against a local wolfSSL library, wolfcrypt-py will attempt to do native feature detection to enable/disable wolfcrypt-py features based on how native wolfSSL has been compiled. It uses the header to do feature detection. +After this the local build can be installed from the locally built wheel in dist. + +.. code-block:: bash + + $ pip install dist/wolfcrypt*.whl + Testing ------- .. code-block:: console + $ uv run python3 .. code-block:: python From 3a92dcc870edee30df38459c90bed017bd85dd9e Mon Sep 17 00:00:00 2001 From: Robert de Vries Date: Sun, 5 Jul 2026 15:56:25 +0200 Subject: [PATCH 6/6] Update Makefile so that lint, test, test-all, check-all work again. --- Makefile | 21 ++++++++++----------- 1 file changed, 10 insertions(+), 11 deletions(-) diff --git a/Makefile b/Makefile index c1f5662..4892ba0 100644 --- a/Makefile +++ b/Makefile @@ -49,19 +49,21 @@ clean-test: ## remove test and coverage artifacts rm -f .coverage rm -fr htmlcov/ -lint: ## check style with flake8 - flake8 src tests - pylint src tests/* +lint: ## check style with ruff + uv run ruff check -test: install ## run tests quickly with the default Python - py.test tests +test: ## run tests quickly with the default Python + uv run py.test tests check: test ## run tests quickly with the default Python -test-all: ## run tests on every Python version with tox - tox +test-all: ## run tests on every Python version with uv + for version in 3.10 3.11 3.12 3.13 3.14; do \ + echo "=== Python $$version ==="; \ + uv run --python $$version pytest; \ + done -check-all: test-all ## run tests on every Python version with tox +check-all: test-all ## run tests on every Python version with uv cov: install ## check code coverage quickly with the default Python py.test --cov-config .coveragerc --cov=wolfcrypt tests @@ -92,6 +94,3 @@ dist: clean ## builds source and wheel package release: ## package and upload a release twine upload dist/* - -install: clean ## install the package to the active Python's site-packages - python setup.py install