* Comment out code in build_ffi.py instead of quoted string.
* Check return value of wolfCrypt_init()
* Complete algorithm type hash table
* Change dicts into defaultdicts with a sensible value when key is missing.
* Convert debug print to debug log messages
* Add length checks to produce nicer exceptions.
[build-system] declared bare `setuptools`, so isolated builds resolved
whatever version the index served at build time. This repo has no uv.lock,
so CI's `uv build --wheel` re-resolves the backend on every run.
Declare `setuptools>=77`. Nothing was broken before this: an unpinned
resolver always fetched a recent backend, so the build worked. The floor is
measured, not chosen. The PEP 639 `license` expression and `license-files`
key already in this file each require setuptools >= 77 independently (76 and
older reject either one alone, while the older `license = {file = ...}`
table form passes), so the project had an undeclared >= 77 requirement that
stayed invisible precisely because the version floated. Declaring it keeps a
build environment pinned below 77 from failing mid-build on an opaque
`project.license` config error with no hint that the fix is an upgrade.
No upper bound, matching the floor-only convention of every other bound in
this file (`cffi>=1.17`, `typing-extensions>=4.4.0`). A ceiling would not
address the reported risk anyway -- a malicious point release satisfies any
range, so only hash-pinned build requirements help there -- and setuptools
ships majors often enough (7 since 2025-03, with 81 and 82 two days apart)
that a stale ceiling silently excludes working versions instead of
protecting anything.
Verified: builds at 77.0.3 and 83.0.0, 76.1.0 refused at resolve time,
License-Expression intact in wheel METADATA, ruff clean, 196 passed.
MlDsa.sign/sign_with_seed reject a context longer than 255 bytes with
ValueError, but verify did not. With ctxLen now correctly declared as byte in
the cdef, an over-long ctx would surface as a low-level CFFI OverflowError
instead of the consistent ValueError callers get from the signing paths.
Reject len(ctx) > 255 with ValueError in verify, matching sign.
The CFFI cdef declared wc_dilithium_verify_ctx_msg with word32 ctxLen while the
sign variants use byte ctxLen. wolfSSL's real API (wc_MlDsaKey_VerifyCtx in
wolfcrypt/wc_mldsa.h, which the wc_dilithium_verify_ctx_msg macro forwards to)
takes byte ctxLen, matching FIPS 204's 255-byte context cap. The mismatched
cdef made CFFI marshal a 4-byte word32 into a 1-byte slot, silently truncating
any ctxLen > 255 to its low byte.
Declare ctxLen as byte to match the sign cdef and the underlying API.
* Update README.rst to fix remaining unclarities in using uv to
install locally built version and various other smaller issues.
* Pipeline changes:
* Build wheel
* Test against locally built wheel
* Make sure no-pqc version doesn't have ML-DSA/ML-KEM enabled.
uv is used to manage virtual environments and building wheels and
source distributions.
This replaces tox.
ruff is used to do static checking.
README is updated to reflect this change.
philljj
David Garske
Robert de Vries
JacobBarthelmeh
Eric Blankenhorn
John Safranek
Mark Atwood
Kareem
Juliusz Sosinowicz
sebastian-carpenter
Martijn de Milliano