Skip to content

Change workflow to using uv and ruff. #133

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
roberthdevries wants to merge 7 commits into
base: master
Choose a base branch
from
Open

Change workflow to using uv and ruff. #133

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
3078cd5
Change workflow to using uv and ruff.
roberthdevries Jun 28, 2026
5126115
Fixed github actions document and processed review comments.
roberthdevries Jun 30, 2026
2c35de7
Revert to actions/*v3
roberthdevries Jun 30, 2026
04b58c0
Fix ruff errors
roberthdevries Jul 5, 2026
55d4a35
Address review comments
roberthdevries Jul 5, 2026
35f9108
Update Makefile so that lint, test, test-all, check-all work again.
roberthdevries Jul 5, 2026
0d2e15f
Addressed multiple review comments.
roberthdevries Jul 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
57 changes: 33 additions & 24 deletions .github/workflows/python-app.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,26 +18,26 @@ jobs:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v3
- uses: actions/checkout@v7
- name: Set up Python 3.10
uses: actions/setup-python@v3
uses: actions/setup-python@v6
with:
python-version: "3.10"
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install flake8 pytest tox
pip install -r requirements/test.txt
# Won't pass flake8 yet
# - name: Lint with flake8
# run: |
# # stop the build if there are Python syntax errors or undefined names
# flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
# # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
# flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
- name: Test with tox
- name: Install uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
# Install a specific version of uv.
version: "0.11.26"
- name: Build the wheel
Comment thread
dgarske marked this conversation as resolved.
run: uv build --wheel
- name: Install the project
run: uv sync --dev
- name: Perform static checks
Comment thread
dgarske marked this conversation as resolved.
run: uv run ruff check
- name: Run tests using the locally built wheel
run: |
tox
uv pip install --reinstall dist/*.whl
uv run --no-sync pytest tests

build-no-pqc:
# Regression coverage for issue #2659: INVALID_DEVID is only declared
Expand All @@ -47,13 +47,18 @@ jobs:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v3
- uses: actions/checkout@v7
with:
submodules: recursive
- name: Set up Python 3.10
uses: actions/setup-python@v3
uses: actions/setup-python@v6
with:
python-version: "3.10"
- name: Install uv
uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
with:
# Install a specific version of uv.
version: "0.11.26"
- name: Install build deps
run: |
sudo apt-get update
Expand All @@ -63,7 +68,7 @@ jobs:
cd lib/wolfssl
./autogen.sh
./configure --enable-cryptonly --disable-shared \
--disable-kyber --disable-dilithium \
--disable-mlkem --disable-mldsa \
--enable-aes --enable-aesgcm --enable-aessiv \
--enable-aesctr --enable-aesgcm-stream \
--enable-des3 --enable-chacha --enable-poly1305 \
Expand All @@ -81,12 +86,16 @@ jobs:
env:
USE_LOCAL_WOLFSSL: ${{ github.workspace }}/wolfssl-install
run: |
Comment thread
dgarske marked this conversation as resolved.
python -m pip install --upgrade pip
pip install -r requirements/test.txt
pip install -e .
uv venv
uv pip install -r requirements/test.txt
uv pip install -e .
- name: Check absence of ML-KEM and ML-DSA support
Comment thread
dgarske marked this conversation as resolved.
run: |
uv run --no-sync python -c "from wolfcrypt._ffi import lib as _lib; assert _lib.ML_KEM_ENABLED == 0, 'ML-KEM should be disabled'"
uv run --no-sync python -c "from wolfcrypt._ffi import lib as _lib; assert _lib.ML_DSA_ENABLED == 0, 'ML-DSA should be disabled'"
- name: Import smoke (regression for INVALID_DEVID)

@dgarske dgarske Jul 6, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 [Medium] no-pqc 'Import smoke' step omits --no-sync and USE_LOCAL_WOLFSSL, undermining the regression test

The build-no-pqc job builds a no-PQC wolfSSL, installs wolfcrypt against it via a manually-managed venv (uv venv + uv pip install -r requirements/test.txt + uv pip install -e . with USE_LOCAL_WOLFSSL set), and the immediately-preceding 'Check absence of ML-KEM and ML-DSA support' step correctly runs with uv run --no-sync .... The new 'Import smoke' step instead runs uv run python -c "..." WITHOUT --no-sync AND without setting USE_LOCAL_WOLFSSL. Because there is no committed uv.lock and the repo is a uv project (pyproject.toml has [project]), a plain uv run operates in project mode and will re-sync the environment first, reinstalling/rebuilding the wolfcrypt project from source. With USE_LOCAL_WOLFSSL unset, scripts/build_ffi.py falls back to building wolfSSL from the lib/wolfssl submodule with its default flags, which include --enable-mlkem and --enable-mldsa (confirmed in make_flags()). That rebuild would replace the carefully-built no-PQC wolfcrypt with a PQC-enabled one, so this regression test for issue #2659 (INVALID_DEVID only declared when ML_KEM/ML_DSA enabled) would silently validate the wrong configuration -- or fail/hang rebuilding wolfSSL. The inconsistency with the adjacent --no-sync step strongly suggests this is an oversight.

Fix: Add --no-sync (and, defensively, the USE_LOCAL_WOLFSSL env) to the 'Import smoke' step so it exercises the already-installed no-PQC build instead of triggering a project re-sync/rebuild against a default PQC-enabled wolfSSL.

run: python -c "from wolfcrypt.random import Random; Random()"
run: uv run python -c "from wolfcrypt.random import Random; Random()"
- name: Run tests

@dgarske dgarske Jul 6, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 [Low] no-pqc 'Run tests' step omits --no-sync, causing a redundant project re-sync/rebuild

The final 'Run tests' step runs uv run pytest tests without --no-sync, unlike the 'Check absence' step which uses --no-sync. Since the venv was populated manually with uv pip install, a plain uv run will re-sync the project environment before running, discarding the manual uv pip install -e . result and rebuilding wolfcrypt. Here USE_LOCAL_WOLFSSL is set on the step, so the rebuilt target is still the no-PQC library and the test remains correct -- but the rebuild is redundant work and is inconsistent with the surrounding steps' use of --no-sync.

Fix: Use uv run --no-sync pytest tests for consistency with the other steps in this manually-managed-venv job and to avoid an unnecessary rebuild.

env:
USE_LOCAL_WOLFSSL: ${{ github.workspace }}/wolfssl-install
run: pytest tests/
run: uv run pytest tests
29 changes: 14 additions & 15 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,34 +49,36 @@ clean-test: ## remove test and coverage artifacts
rm -f .coverage
rm -fr htmlcov/

lint: ## check style with flake8
flake8 src tests
pylint src tests/*
lint: ## check style with ruff
uv run ruff check

test: install ## run tests quickly with the default Python
py.test tests
test: ## run tests quickly with the default Python
uv run py.test tests

check: test ## run tests quickly with the default Python

test-all: ## run tests on every Python version with tox
tox
test-all: ## run tests on every Python version with uv
Comment thread
dgarske marked this conversation as resolved.
for version in 3.10 3.11 3.12 3.13 3.14; do \
echo "=== Python $$version ==="; \
uv run --python $$version pytest tests || exit 1; \
done

check-all: test-all ## run tests on every Python version with tox
check-all: test-all ## run tests on every Python version with uv

cov: ## check code coverage quickly with the default Python
uv run pytest --cov=wolfcrypt tests
uv run coverage report -m
uv run coverage html
$(BROWSER) htmlcov/index.html

docs: install ## generate Sphinx HTML documentation, including API docs
docs: ## generate Sphinx HTML documentation, including API docs
$(MAKE) -C docs clean
$(MAKE) -C docs html
uv run $(MAKE) -C docs html
$(BROWSER) docs/_build/html/index.html

doctest: install ## generate Sphinx HTML documentation, including API docs
doctest: ## generate Sphinx HTML documentation, including API docs
$(MAKE) -C docs clean
$(MAKE) -C docs doctest
uv run $(MAKE) -C docs doctest

servedocs: docs ## compile the docs watching for changes
watchmedo shell-command -p '*.rst' -c '$(MAKE) -C docs html' -R -D .

@dgarske dgarske Jul 6, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 [Low] Makefile 'dist' target still uses setup.py while README migrates to 'uv build'

This PR migrates the documented build workflow to uv build --sdist / uv build --wheel (README.rst) and removes the install target that shelled out to python setup.py install. However the dist target (unchanged by the diff) still runs python setup.py sdist directly. This is not a correctness bug and the line is outside the direct diff, but it leaves the Makefile inconsistent with the new uv-based direction the PR establishes. Worth aligning while touching this file.

Fix: Optionally switch the dist target's sdist build to uv build --sdist for consistency with the README and the rest of the migration.

Expand All @@ -92,6 +94,3 @@ dist: clean ## builds source and wheel package

release: ## package and upload a release
twine upload dist/*

install: clean ## install the package to the active Python's site-packages
python setup.py install
67 changes: 46 additions & 21 deletions README.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,32 +21,32 @@ Install the following on Windows:

* `CMake <https://cmake.org/download/>`_
* `Git <https://git-scm.com/download/win>`_
* `Python 3.9 <https://www.python.org/downloads/windows/>`_
* `Python 3.10 or newer <https://www.python.org/downloads/windows/>`_
* `Build Tools for Visual Studio <https://visualstudio.microsoft.com/downloads/>`_. This is in the "Tools for Visual Studio" section at the bottom of the page. The "Desktop development with C++" pack is needed from the installer.

Then from the command line install tox and CFFI using:
Then from the command line install `uv` using:

.. code-block:: sh

pip install tox cffi
pip install uv

Or by following the installation instructions on the astral web site. `<https://docs.astral.sh/uv/getting-started/installation/>`_

You can then build the source distribution packages using:

.. code-block:: sh

python setup.py sdist
uv build --sdist


Linux
^^^^^

The `setup.py` file covers most things you will need to do to build and install from source. As pre-requisites you will need to install either from your OS repository or pip. You'll also need the Python development package for your Python version:
The `setup.py` file covers most things you will need to do to build and install from source. As pre-requisites you will need to install either from your OS repository or with uv. You'll also need the Python development package for your Python version:

* `cffi`
* `tox`
* `pytest`
* `uv`

To build a source package run `python setup.py sdist`, to build a wheel package run `python setup.py bdist_wheel`. To test the build run `tox`. The `tox` tests rely on Python 3.9 being installed, if you do not have this version we recommend using `pyenv` to install it.
To build a source package run `uv build --sdist`, to build a wheel package run `uv build --wheel`. To test the build run `uv run pytest`. The tests rely on Python 3.10 or later being installed.

Installation
------------
Expand All @@ -61,46 +61,71 @@ To build wolfcrypt-py against a local installation of the native C wolfSSL
library, use the USE_LOCAL_WOLFSSL variable. This variable should be

wolfcrypt-py can be built against a local version of the native wolfSSL
library by using pip with the USE_LOCAL_WOLFSSL variable. USE_LOCAL_WOLFSSL
library by using uv build --wheel with the USE_LOCAL_WOLFSSL variable. USE_LOCAL_WOLFSSL
should be set equal to the installation path for the wolfSSL library:

.. code-block:: bash

$ USE_LOCAL_WOLFSSL=/path/to/wolfssl/install pip install .
$ USE_LOCAL_WOLFSSL=/path/to/wolfssl/install uv build --wheel

If building wolfcrypt-py against a local wolfSSL library, wolfcrypt-py
will attempt to do native feature detection to enable/disable wolfcrypt-py
features based on how native wolfSSL has been compiled. It uses the
<wolfssl/options.h> header to do feature detection.

After this the local build can be installed from the locally built wheel in dist.

.. code-block:: bash

$ pip install dist/wolfcrypt*.whl

Testing
-------
.. code-block:: console
Comment thread
dgarske marked this conversation as resolved.

$ uv run python3

.. code-block:: python

>>> from wolfcrypt.hashes import Sha256
>>> Sha256('wolfcrypt').hexdigest()
b'96e02e7b1cbcd6f104fe1fdb4652027a5505b68652b70095c6318f9dce0d1844'

Testing ``wolfcrypt``'s source code with ``tox``
------------------------------------------------
Testing ``wolfcrypt``'s source code with ``pytest``
Comment thread
dgarske marked this conversation as resolved.
---------------------------------------------------

To run the unit tests in the source code, you'll need ``tox`` and a few other
To run the unit tests in the source code, you'll need ``uv`` and a few other
requirements.

1. Make sure that the testing requirements are installed:

.. code-block:: console

$ sudo -H pip install -r requirements/test.txt
$ uv sync --dev


2. Run ``tox``:
2. Run ``pytest``:

.. code-block:: console

$ tox
...
_________________________________ summary _________________________________
py3: commands succeeded
congratulations :)
$ uv run pytest
======================================= test session starts =======================================
platform linux -- Python 3.10.12, pytest-9.1.1, pluggy-1.6.0
rootdir: /some_directory/wolfcrypt-py
configfile: pyproject.toml
collected 165 items

tests/test_aesgcmstream.py ......... [ 5%]
tests/test_asn.py .. [ 6%]
tests/test_chacha20poly1305.py ...... [ 10%]
tests/test_ciphers.py ........................................... [ 36%]
tests/test_delete_descriptor_binding.py ................. [ 46%]
tests/test_error_string.py .... [ 49%]
tests/test_hashes.py ........................... [ 65%]
tests/test_hkdf.py ........ [ 70%]
tests/test_mldsa.py .............................. [ 88%]
tests/test_mlkem.py ............ [ 95%]
tests/test_pwdbased.py . [ 96%]
tests/test_random.py ...... [100%]

======================================= 165 passed in 7.09s =======================================
11 changes: 0 additions & 11 deletions pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,21 +41,10 @@ dev = [
"ruff",
"sphinx",
"sphinx-rtd-theme",
"tox >= 4",
"ty",
Comment thread
dgarske marked this conversation as resolved.
"types-cffi",
]

[tool.tox]
requires = ["tox>=4"]
env_list = ["py3"]

[tool.tox.env_run_base]
package = "wheel"
deps = ["-rrequirements/test.txt"]
commands = [["py.test", "tests/"]]


[tool.ruff]
# Exclude a variety of commonly ignored directories.
exclude = [
Expand Down
1 change: 0 additions & 1 deletion requirements/test.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@
-r prod.txt
tox>=4
pytest>=8
types-cffi>=1.17
1 change: 0 additions & 1 deletion tests/test_chacha20poly1305.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,3 @@

# test_chacha20poly1305.py
#
# Copyright (C) 2022 wolfSSL Inc.
Expand Down
2 changes: 0 additions & 2 deletions tests/test_chacha_iv.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
# -*- coding: utf-8 -*-
#
# test_chacha_iv.py
#
# Copyright (C) 2006-2022 wolfSSL Inc.
Expand Down
2 changes: 0 additions & 2 deletions tests/test_cipher_modes.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
# -*- coding: utf-8 -*-
#
# test_cipher_modes.py
#
# Copyright (C) 2006-2022 wolfSSL Inc.
Expand Down
2 changes: 0 additions & 2 deletions tests/test_hmac_copy.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,3 @@
# -*- coding: utf-8 -*-
#
# test_hmac_copy.py
#
# Copyright (C) 2006-2022 wolfSSL Inc.
Expand Down
Loading