* Update README.rst to fix remaining unclarities in using uv to
install locally built version and various other smaller issues.
* Pipeline changes:
* Build wheel
* Test against locally built wheel
* Make sure no-pqc version doesn't have ML-DSA/ML-KEM enabled.
uv is used to manage virtual environments and building wheels and
source distributions.
This replaces tox.
ruff is used to do static checking.
README is updated to reflect this change.
Random.__init__ used _lib.INVALID_DEVID as a default parameter value,
but INVALID_DEVID is only declared in the CFFI cdef inside
`if features["ML_KEM"] or features["ML_DSA"]`. Since default parameters
are evaluated at module import time, any wolfSSL build that lacks both
ML-KEM and ML-DSA (e.g. via USE_LOCAL_WOLFSSL pointing at a custom
build) raises AttributeError on `import wolfcrypt.random`, cascading
into wolfcrypt.ciphers and effectively breaking the entire library.
Hardcode the default to -2, matching the convention already used by
_Hmac._init and AesGcmStream.__init__ (which call wc_HmacInit /
wc_AesInit with -2 directly rather than referencing _lib.INVALID_DEVID).
Add a build-no-pqc GitHub Actions job that builds wolfSSL with
--disable-kyber --disable-dilithium, installs wolfcrypt-py against it
via USE_LOCAL_WOLFSSL, and runs an import-smoke step plus the full
pytest suite. The smoke step is the explicit regression guard: it
imports wolfcrypt.random and instantiates Random(), which would fail
at import time if the default ever again references a CFFI symbol that
is only conditionally declared.
F-2659
David Garske
Robert de Vries
Andrew Hutchings