quantum-safe-py/pyproject.toml at master · AnimeshShaw/quantum-safe-py · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
[build-system]
requires = ["hatchling>=1.21"]
build-backend = "hatchling.build"

[project]
name = "quantum-safe-py"
version = "0.1.0"
description = "Production-grade post-quantum cryptography with hybrid KEM, migration tooling, and protocol helpers"
readme = "README.md"
license = { text = "Apache-2.0" }
requires-python = ">=3.10"
authors = [
    { name = "Animesh Shaw", email = "animeshshaw@pm.me" },
]
keywords = [
    "cryptography",
    "post-quantum",
    "pqc",
    "ml-kem",
    "kyber",
    "ml-dsa",
    "dilithium",
    "hybrid",
    "tls",
]
classifiers = [
    "Development Status :: 3 - Alpha",
    "Intended Audience :: Developers",
    "License :: OSI Approved :: Apache Software License",
    "Programming Language :: Python :: 3",
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Topic :: Security :: Cryptography",
    "Typing :: Typed",
]

# Core deps are kept intentionally minimal.
# oqs is optional because some users might only want the
# pure-Python/noble backend path (e.g. WASM targets).
dependencies = [
    "cryptography>=42.0",   # for classical primitives + X.509
    "pydantic>=2.5",        # for structured config objects
    "click>=8.1",           # CLI
    "rich>=13.0",           # CLI output formatting
    "cbor2>=5.6",           # CBOR key serialization
]

[project.optional-dependencies]
liboqs = [
    "liboqs-python>=0.10.0",
]
# SECURITY: For production deployments, install with hash verification to prevent
# supply-chain attacks.  Generate a pinned requirements file with:
#   pip-compile --generate-hashes pyproject.toml -o requirements.txt
# Then install with:
#   pip install --require-hashes -r requirements.txt
# pyca cryptography already pulls in cffi; this just makes the
# dep explicit so people know what they're getting.
rustcrypto = [
    # quantum-safe-py is our thin PyO3 wrapper around ml-kem/ml-dsa crates
    # Not on PyPI yet — installed from local wheel during dev
    # "quantum-safe-py>=0.1.0",
]
dev = [
    "pytest>=8.0",
    "pytest-benchmark>=4.0",
    "pytest-cov>=4.1",
    "pytest-asyncio>=0.23",
    "hypothesis>=6.100",
    "mypy>=1.8",
    "ruff>=0.3",
    "black>=24.0",
    "pre-commit>=3.6",
]
docs = [
    "sphinx>=7.2,<10.0",
    "furo>=2024.1",
    "sphinx-autodoc-typehints>=2.0,<3.0",
]

[project.scripts]
qs-audit = "quantum_safe.audit.cli:main"
qs-migrate = "quantum_safe.migrate.cli:main"

[project.urls]
Homepage = "https://github.com/AnimeshShaw/quantum-safe"
Documentation = "https://quantum-safe-py.readthedocs.io/en/latest/"
"Bug Tracker" = "https://github.com/AnimeshShaw/quantum-safe/issues"

# ---------------------------------------------------------------------------
# Hatch build config
# ---------------------------------------------------------------------------
[tool.hatch.build.targets.wheel]
packages = ["src/quantum_safe"]

# ---------------------------------------------------------------------------
# Ruff linter config
# ---------------------------------------------------------------------------
[tool.ruff]
line-length = 100
target-version = "py310"

[tool.ruff.lint]
select = ["E", "F", "W", "I", "N", "UP", "ANN", "S", "B", "A", "C4", "T20"]
ignore = [
    "S101",    # use of assert — fine in tests
    "T201",    # print() allowed in CLI fallback paths
    "N818",    # exception names without Error suffix — public API, cannot rename without breaking change
]

[tool.ruff.lint.per-file-ignores]
"tests/**" = ["ANN", "S", "E501", "B017", "E701", "E741", "F841", "E402", "B905"]
"tests/bench/**" = ["B023", "N806"]  # benchmark scripts: loop-capture patterns are intentional

# ---------------------------------------------------------------------------
# Mypy
# ---------------------------------------------------------------------------
[tool.mypy]
python_version = "3.10"
strict = true
warn_return_any = true
warn_unused_configs = true
# liboqs-python doesn't ship stubs
[[tool.mypy.overrides]]
module = ["oqs.*", "cbor2.*"]
ignore_missing_imports = true

# ---------------------------------------------------------------------------
# Pytest
# ---------------------------------------------------------------------------
[tool.pytest.ini_options]
testpaths = ["tests"]
addopts = [
    "--strict-markers",
    "-ra",
]
markers = [
    "slow: marks tests as slow (deselect with '-m not slow')",
    "requires_liboqs: needs liboqs-python installed",
    "requires_oqs: alias for requires_liboqs",
]

# ---------------------------------------------------------------------------
# Coverage
# ---------------------------------------------------------------------------
[tool.coverage.run]
source = ["src/quantum_safe"]
omit = ["*/tests/*", "*/_internal/*"]

[tool.coverage.report]
exclude_lines = [
    "pragma: no cover",
    "if TYPE_CHECKING:",
    "raise NotImplementedError",
    "@(abc\\.)?abstractmethod",
]