Rebased on master and fixed any (extra) issues found with ruff and ty.

tests/test_chacha_iv.py

@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-#
 # test_chacha_iv.py
 #
 # Copyright (C) 2006-2022 wolfSSL Inc.
@@ -26,6 +24,9 @@ import pytest
 from wolfcrypt._ffi import lib as _lib
 from wolfcrypt.exceptions import WolfCryptError
 
+if _lib.CHACHA_ENABLED:
+    from wolfcrypt.ciphers import ChaCha  # ty: ignore[possibly-missing-import]
+
 pytestmark = pytest.mark.skipif(
     not _lib.CHACHA_ENABLED, reason="ChaCha not enabled")
 
@@ -38,24 +39,18 @@ def test_encrypt_before_set_iv_raises():
     F-4463: encrypt() before set_iv() must not feed an empty IV buffer to
     wc_Chacha_SetIV (which unconditionally reads 12 bytes). It must raise.
     """
-    from wolfcrypt.ciphers import ChaCha
-
     cipher = ChaCha(KEY)
     with pytest.raises(WolfCryptError):
         cipher.encrypt(b"A" * 16)
 
 
 def test_decrypt_before_set_iv_raises():
-    from wolfcrypt.ciphers import ChaCha
-
     cipher = ChaCha(KEY)
     with pytest.raises(WolfCryptError):
         cipher.decrypt(b"A" * 16)
 
 
 def test_encrypt_decrypt_after_set_iv_roundtrips():
-    from wolfcrypt.ciphers import ChaCha
-
     enc = ChaCha(KEY)
     enc.set_iv(NONCE)
     plaintext = b"the quick brown fox"
@@ -72,8 +67,6 @@ def test_failed_set_iv_keeps_encrypt_blocked(monkeypatch):
     encrypt()/decrypt() stay blocked rather than running with a stale or
     partially-applied IV.
     """
-    from wolfcrypt.ciphers import ChaCha
-
     cipher = ChaCha(KEY)
     # First, establish a valid IV so a later failure would otherwise leave
     # _iv_set True under the old ordering.

tests/test_cipher_modes.py

@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-#
 # test_cipher_modes.py
 #
 # Copyright (C) 2006-2022 wolfSSL Inc.
@@ -49,7 +47,7 @@ def test_unsupported_mode_gives_single_consistent_error():
     then hit a contradictory "not supported by this cipher" branch. The
     rejection must now be a single, consistent message.
     """
-    from wolfcrypt.ciphers import Aes
+    from wolfcrypt.ciphers import Aes  # ty: ignore[possibly-missing-import]
 
     key = b"0" * 16
     iv = b"0" * 16

tests/test_hmac_copy.py

@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-#
 # test_hmac_copy.py
 #
 # Copyright (C) 2006-2022 wolfSSL Inc.
@@ -39,7 +37,7 @@ def test_hmac_copy_raises_not_implemented():
     state (use-after-free risk in async/HW builds). wolfCrypt has no safe
     public copy, so HMAC copy() must refuse rather than alias.
     """
-    from wolfcrypt.hashes import HmacSha256
+    from wolfcrypt.hashes import HmacSha256  # ty: ignore[possibly-missing-import]
 
     hmac = HmacSha256.new(KEY, b"some message")
     with pytest.raises(NotImplementedError):
@@ -48,7 +46,7 @@ def test_hmac_copy_raises_not_implemented():
 
 def test_hmac_digest_unaffected_by_copy_removal():
     """digest()/hexdigest() must keep working and remain repeatable."""
-    from wolfcrypt.hashes import HmacSha256
+    from wolfcrypt.hashes import HmacSha256  # ty: ignore[possibly-missing-import]
 
     hmac = HmacSha256.new(KEY, b"some message")
     first = hmac.hexdigest()

wolfcrypt/_ffi/lib.pyi

@@ -40,6 +40,7 @@ HMAC_ENABLED: int
 KEYGEN_ENABLED: int
 HKDF_ENABLED: int
 ML_DSA_ENABLED: int
+ML_DSA_NO_CTX_ENABLED: int
 ML_KEM_ENABLED: int
 MPAPI_ENABLED: int
 PWDBASED_ENABLED: int
@@ -319,6 +320,7 @@ SHA512h: int
 DILITHIUM_SEED_SZ: int
 ECC_TIMING_RESISTANCE_ENABLED: int
 WC_RSA_OAEP_PAD: int
+MIN_AUTH_TAG_SZ: int
 
 RNG: TypeAlias = FFI.CData
 

wolfcrypt/ciphers.py

@@ -572,15 +572,17 @@ if _lib.CHACHA_ENABLED:
             # before any encrypt()/decrypt() so a real nonce is available.
             self._iv_set = False
 
-        def encrypt(self, string):
+        @override
+        def encrypt(self, string: BytesOrStr) -> bytes:
             self._require_iv()
             return super().encrypt(string)
 
-        def decrypt(self, string):
+        @override
+        def decrypt(self, string: BytesOrStr) -> bytes:
             self._require_iv()
             return super().decrypt(string)
 
-        def _require_iv(self):
+        def _require_iv(self) -> None:
             if not self._iv_set:
                 raise WolfCryptError(
                     "set_iv() must be called before encrypt()/decrypt()")

wolfcrypt/hashes.py

@@ -456,7 +456,8 @@ if _lib.HMAC_ENABLED:
         _native_size = _ffi.sizeof("Hmac")
         _delete = staticmethod(_lib.wc_HmacFree)
 
-        def copy(self):
+        @override
+        def copy(self) -> _Hmac:
             raise NotImplementedError(
                 "HMAC objects cannot be safely copied: wolfCrypt has no "
                 "wc_HmacCopy and byte-copying the state would alias the "