[build-system] declared bare `setuptools`, so isolated builds resolved
whatever version the index served at build time. This repo has no uv.lock,
so CI's `uv build --wheel` re-resolves the backend on every run.
Declare `setuptools>=77`. Nothing was broken before this: an unpinned
resolver always fetched a recent backend, so the build worked. The floor is
measured, not chosen. The PEP 639 `license` expression and `license-files`
key already in this file each require setuptools >= 77 independently (76 and
older reject either one alone, while the older `license = {file = ...}`
table form passes), so the project had an undeclared >= 77 requirement that
stayed invisible precisely because the version floated. Declaring it keeps a
build environment pinned below 77 from failing mid-build on an opaque
`project.license` config error with no hint that the fix is an upgrade.
No upper bound, matching the floor-only convention of every other bound in
this file (`cffi>=1.17`, `typing-extensions>=4.4.0`). A ceiling would not
address the reported risk anyway -- a malicious point release satisfies any
range, so only hash-pinned build requirements help there -- and setuptools
ships majors often enough (7 since 2025-03, with 81 and 82 two days apart)
that a stale ceiling silently excludes working versions instead of
protecting anything.
Verified: builds at 77.0.3 and 83.0.0, 76.1.0 refused at resolve time,
License-Expression intact in wheel METADATA, ruff clean, 196 passed.
MlDsa.sign/sign_with_seed reject a context longer than 255 bytes with
ValueError, but verify did not. With ctxLen now correctly declared as byte in
the cdef, an over-long ctx would surface as a low-level CFFI OverflowError
instead of the consistent ValueError callers get from the signing paths.
Reject len(ctx) > 255 with ValueError in verify, matching sign.
The CFFI cdef declared wc_dilithium_verify_ctx_msg with word32 ctxLen while the
sign variants use byte ctxLen. wolfSSL's real API (wc_MlDsaKey_VerifyCtx in
wolfcrypt/wc_mldsa.h, which the wc_dilithium_verify_ctx_msg macro forwards to)
takes byte ctxLen, matching FIPS 204's 255-byte context cap. The mismatched
cdef made CFFI marshal a 4-byte word32 into a 1-byte slot, silently truncating
any ctxLen > 255 to its low byte.
Declare ctxLen as byte to match the sign cdef and the underlying API.
* Update README.rst to fix remaining unclarities in using uv to
install locally built version and various other smaller issues.
* Pipeline changes:
* Build wheel
* Test against locally built wheel
* Make sure no-pqc version doesn't have ML-DSA/ML-KEM enabled.
uv is used to manage virtual environments and building wheels and
source distributions.
This replaces tox.
ruff is used to do static checking.
README is updated to reflect this change.
Extra rules:
All E pycodestyle error rules
C4 flake8-comprehensions
DTZ flake8-datetimez
EXE flake8-executable
FA flake8-future-annotations
INT flake8-gettext
ISC flake8-implicit-str-concat
ICN flake8-import-conventions
LOG flake8-logging
G flake8-logging-format
RSE flake8-raise
SLOT flake8-slots
TID flake8-tidy-imports
TC flake8-type-checking
FLY flynt
PERF Perflint
W pycodestyle warnings
FURB refurb
Ignore E501: line too long
JacobBarthelmeh
Eric Blankenhorn
John Safranek
Mark Atwood
philljj
Kareem
Juliusz Sosinowicz
sebastian-carpenter
David Garske
Robert de Vries
Martijn de Milliano