cborx 0.1.1__tar.gz

cborx-0.1.1/.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# SPDX-License-Identifier: 0BSD
+
+* @Sudo-Ivan

cborx-0.1.1/.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5

cborx-0.1.1/.github/workflows/ci.yml

@@ -0,0 +1,59 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  schedule:
+    - cron: "9 7 * * 1"
+
+permissions: {}
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: "0.11.32"
+          enable-cache: true
+
+      - run: uv sync --locked
+
+      - run: uv run ruff check .
+      - run: uv run ruff format --check .
+      - run: uv run bandit -r src/
+      - run: uv run mypy
+      - run: uvx ty check src tests
+
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: "0.11.32"
+          enable-cache: true
+
+      - run: uv python install ${{ matrix.python }}
+      - run: uv sync --locked --python ${{ matrix.python }}
+      - run: uv run pytest --cov

cborx-0.1.1/.github/workflows/codeql.yml

@@ -0,0 +1,35 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  schedule:
+    - cron: "17 3 * * 4"
+
+permissions: {}
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        with:
+          languages: python
+          queries: security-and-quality
+
+      - uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        with:
+          category: "/language:python"

cborx-0.1.1/.github/workflows/dependency-review.yml

@@ -0,0 +1,22 @@
+name: Dependency Review
+
+on:
+  pull_request:
+
+permissions: {}
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

cborx-0.1.1/.github/workflows/release.yml

@@ -0,0 +1,63 @@
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions: {}
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/cborx
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+    steps:
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: "0.11.32"
+
+      - run: uv sync --locked
+
+      - name: Verify tag matches package version
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          version="$(uv run python -c 'import cborx; print(cborx.__version__)')"
+          if [ "$tag" != "$version" ]; then
+            echo "tag $tag does not match package version $version" >&2
+            exit 1
+          fi
+
+      - run: uv build
+
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: dist/*
+
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+        with:
+          attestations: true
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "${GITHUB_REF_NAME}" \
+            --repo "${GITHUB_REPOSITORY}" \
+            --verify-tag \
+            --title "${GITHUB_REF_NAME}" \
+            --generate-notes \
+            dist/*

cborx-0.1.1/.github/workflows/scorecard.yml

@@ -0,0 +1,42 @@
+name: OpenSSF Scorecard
+
+on:
+  branch_protection_rule:
+  push:
+    branches: [master]
+  workflow_dispatch:
+  schedule:
+    - cron: "42 5 * * 6"
+
+permissions: read-all
+
+jobs:
+  analysis:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+    steps:
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      - uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        with:
+          sarif_file: results.sarif

cborx-0.1.1/.github/workflows/zizmor.yml

@@ -0,0 +1,28 @@
+name: zizmor
+
+on:
+  push:
+    branches: [master]
+    paths: [.github/**]
+  pull_request:
+    paths: [.github/**]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        with:
+          advanced-security: false

cborx-0.1.1/.gitignore

@@ -0,0 +1,11 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+build/
+dist/
+.venv/
+.mypy_cache/
+.pytest_cache/
+.ruff_cache/
+.coverage*
+htmlcov/

cborx-0.1.1/CHANGELOG.md

@@ -0,0 +1,31 @@
+# Changelog
+
+## [0.1.1] - Unreleased
+
+Fix the release workflow's package-name placeholder. No library
+changes.
+
+## [0.1.0] - Unreleased
+
+Initial release.
+
+- Full RFC 8949 codec: all major types, definite and indefinite
+  lengths, half/single/double floats, bignum tags for integers beyond
+  the 64-bit range.
+- `dumps`, `loads`, `dump`, `load` plus `CBOREncoder` and
+  `CBORDecoder` classes.
+- Deterministic encoding via `canonical=True` (RFC 8949 section 4.2:
+  shortest-form integers and floats, map keys ordered by encoded key
+  bytes) and strict canonical validation on decode.
+- Built-in semantic tags 0, 1, 2, 3, 32, 1004 and 55799. `tag_hook`
+  for custom handling, `CBORTag` for unhandled tags.
+- `CBORSimpleValue` for unassigned simple values and an `undefined`
+  sentinel.
+- `default` callback for encoding unknown types, mirroring cbor2.
+- Hardened iterative decoder: declared lengths are checked against
+  remaining input before use, nesting is bounded by a configurable
+  `max_depth`, and truncated or malformed input always raises
+  `CBORDecodeError`.
+- Decode options: `strict_utf8`, `allow_indefinite`,
+  `duplicate_keys` ("last", "first", "error") and `allow_trailing`.
+- Typed throughout, zero runtime dependencies.

cborx-0.1.1/CONTRIBUTING.md

@@ -0,0 +1,19 @@
+# Contributing
+
+Report bugs through GitHub issues. Security reports go to
+security@quad4.io (see SECURITY.md).
+
+## Setup
+
+    uv sync
+    make check
+
+`make check` runs the full local gate: ruff lint and format, bandit,
+mypy strict, ty, and pytest with coverage.
+
+## Conventions
+
+- No runtime dependencies unless the project genuinely needs one.
+- Source files start with the SPDX license identifier.
+- Public API changes need tests.
+- Commit messages: short, imperative, formal.

cborx-0.1.1/LICENSE

@@ -0,0 +1,12 @@
+Copyright (c) 2026 Quad4
+
+Permission to use, copy, modify, and/or distribute this software for any purpose
+with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

cborx-0.1.1/Makefile

@@ -0,0 +1,16 @@
+.PHONY: check lint test build
+
+check: lint test
+
+lint:
+	uv run ruff check .
+	uv run ruff format --check .
+	uv run bandit -r src/
+	uv run mypy
+	uvx ty check src tests
+
+test:
+	uv run pytest --cov --cov-report=term-missing
+
+build:
+	uv build

cborx-0.1.1/PKG-INFO

@@ -0,0 +1,86 @@
+Metadata-Version: 2.5
+Name: cborx
+Version: 0.1.1
+Summary: Pure-Python CBOR (RFC 8949) encoder/decoder. No dependencies, no Rust.
+Project-URL: Homepage, https://quad4.io
+Project-URL: Repository, https://github.com/Quad4-Software/cborx
+Project-URL: Issues, https://github.com/Quad4-Software/cborx/issues
+Project-URL: Changelog, https://github.com/Quad4-Software/cborx/blob/master/CHANGELOG.md
+Author: Quad4
+License-Expression: 0BSD
+License-File: LICENSE
+Keywords: binary,cbor,codec,rfc8949,serialization
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: BSD License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+
+# cborx
+
+[![CI](https://github.com/Quad4-Software/cborx/actions/workflows/ci.yml/badge.svg)](https://github.com/Quad4-Software/cborx/actions/workflows/ci.yml)
+[![CodeQL](https://github.com/Quad4-Software/cborx/actions/workflows/codeql.yml/badge.svg)](https://github.com/Quad4-Software/cborx/actions/workflows/codeql.yml)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/Quad4-Software/cborx/badge)](https://securityscorecards.dev/viewer/?uri=github.com/Quad4-Software/cborx)
+[![PyPI](https://img.shields.io/pypi/v/cborx)](https://pypi.org/project/cborx/)
+[![License: 0BSD](https://img.shields.io/badge/license-0BSD-blue)](LICENSE)
+
+Pure-Python CBOR (RFC 8949) encoder/decoder. No dependencies, no Rust.
+
+A hardened, fully typed replacement for cbor2 without a native
+extension. The decoder is iterative, bounds every claimed length
+against the remaining input, and enforces a configurable nesting
+limit, so hostile input fails fast instead of exhausting memory or
+the call stack.
+
+## Install
+
+```sh
+pip install cborx
+```
+
+## Usage
+
+```python
+import cborx
+
+data = cborx.dumps({"a": [1, 2, 3], "b": None})
+assert cborx.loads(data) == {"a": [1, 2, 3], "b": None}
+
+# Deterministic encoding: shortest-form integers and floats, map keys
+# sorted by encoded key bytes (RFC 8949 section 4.2).
+canonical = cborx.dumps({"b": 1, "a": 2}, canonical=True)
+
+# Strict canonical validation on decode, duplicate-key policy, depth
+# and indefinite-length controls.
+cborx.loads(data, canonical=True, duplicate_keys="error", max_depth=100)
+
+# Unhandled semantic tags round-trip as CBORTag. A tag_hook overrides
+# all built-in tag handling.
+cborx.loads(b"\xd8\x2a\x01", tag_hook=lambda decoder, tag: (tag.tag, tag.value))
+assert cborx.loads(cborx.dumps(cborx.CBORTag(42, "x"))) == cborx.CBORTag(42, "x")
+
+# A default callback handles otherwise unencodable objects, like cbor2.
+cborx.dumps(object(), default=lambda encoder, obj: {"type": type(obj).__name__})
+
+# Simple values and the undefined sentinel.
+assert cborx.loads(b"\xf7") is cborx.undefined
+assert cborx.loads(b"\xf0") == cborx.CBORSimpleValue(16)
+```
+
+Built-in semantic tags: 0 (ISO 8601 datetime), 1 (epoch datetime),
+2/3 (bignum integers beyond the 64-bit range), 32 (URI, decoded to a
+plain str since Python has no URI scalar), 1004 (calendar date) and
+55799 (self-described CBOR, passed through). All other tags decode to
+CBORTag. See RFC 8949: https://www.rfc-editor.org/rfc/rfc8949
+
+## Development
+
+```sh
+uv sync --group dev
+make check
+```
+
+License: 0BSD. Quad4 Software, https://quad4.io

cborx-0.1.1/README.md

@@ -0,0 +1,65 @@
+# cborx
+
+[![CI](https://github.com/Quad4-Software/cborx/actions/workflows/ci.yml/badge.svg)](https://github.com/Quad4-Software/cborx/actions/workflows/ci.yml)
+[![CodeQL](https://github.com/Quad4-Software/cborx/actions/workflows/codeql.yml/badge.svg)](https://github.com/Quad4-Software/cborx/actions/workflows/codeql.yml)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/Quad4-Software/cborx/badge)](https://securityscorecards.dev/viewer/?uri=github.com/Quad4-Software/cborx)
+[![PyPI](https://img.shields.io/pypi/v/cborx)](https://pypi.org/project/cborx/)
+[![License: 0BSD](https://img.shields.io/badge/license-0BSD-blue)](LICENSE)
+
+Pure-Python CBOR (RFC 8949) encoder/decoder. No dependencies, no Rust.
+
+A hardened, fully typed replacement for cbor2 without a native
+extension. The decoder is iterative, bounds every claimed length
+against the remaining input, and enforces a configurable nesting
+limit, so hostile input fails fast instead of exhausting memory or
+the call stack.
+
+## Install
+
+```sh
+pip install cborx
+```
+
+## Usage
+
+```python
+import cborx
+
+data = cborx.dumps({"a": [1, 2, 3], "b": None})
+assert cborx.loads(data) == {"a": [1, 2, 3], "b": None}
+
+# Deterministic encoding: shortest-form integers and floats, map keys
+# sorted by encoded key bytes (RFC 8949 section 4.2).
+canonical = cborx.dumps({"b": 1, "a": 2}, canonical=True)
+
+# Strict canonical validation on decode, duplicate-key policy, depth
+# and indefinite-length controls.
+cborx.loads(data, canonical=True, duplicate_keys="error", max_depth=100)
+
+# Unhandled semantic tags round-trip as CBORTag. A tag_hook overrides
+# all built-in tag handling.
+cborx.loads(b"\xd8\x2a\x01", tag_hook=lambda decoder, tag: (tag.tag, tag.value))
+assert cborx.loads(cborx.dumps(cborx.CBORTag(42, "x"))) == cborx.CBORTag(42, "x")
+
+# A default callback handles otherwise unencodable objects, like cbor2.
+cborx.dumps(object(), default=lambda encoder, obj: {"type": type(obj).__name__})
+
+# Simple values and the undefined sentinel.
+assert cborx.loads(b"\xf7") is cborx.undefined
+assert cborx.loads(b"\xf0") == cborx.CBORSimpleValue(16)
+```
+
+Built-in semantic tags: 0 (ISO 8601 datetime), 1 (epoch datetime),
+2/3 (bignum integers beyond the 64-bit range), 32 (URI, decoded to a
+plain str since Python has no URI scalar), 1004 (calendar date) and
+55799 (self-described CBOR, passed through). All other tags decode to
+CBORTag. See RFC 8949: https://www.rfc-editor.org/rfc/rfc8949
+
+## Development
+
+```sh
+uv sync --group dev
+make check
+```
+
+License: 0BSD. Quad4 Software, https://quad4.io

cborx-0.1.1/SECURITY.md

@@ -0,0 +1,6 @@
+# Security policy
+
+Only the latest release is supported.
+
+Report vulnerabilities to security@quad4.io. Do not open public issues for
+security reports.

cborx-0.1.1/pyproject.toml

@@ -0,0 +1,108 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "cborx"
+dynamic = ["version"]
+description = "Pure-Python CBOR (RFC 8949) encoder/decoder. No dependencies, no Rust."
+readme = "README.md"
+requires-python = ">=3.10"
+license = "0BSD"
+authors = [{ name = "Quad4" }]
+keywords = ["cbor", "rfc8949", "serialization", "codec", "binary"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: BSD License",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Typing :: Typed",
+]
+dependencies = []
+
+[project.urls]
+Homepage = "https://quad4.io"
+Repository = "https://github.com/Quad4-Software/cborx"
+Issues = "https://github.com/Quad4-Software/cborx/issues"
+Changelog = "https://github.com/Quad4-Software/cborx/blob/master/CHANGELOG.md"
+
+[tool.hatch.version]
+path = "src/cborx/__init__.py"
+
+[dependency-groups]
+dev = [
+    "pytest>=9.1.1",
+    "pytest-cov>=7.1.0",
+    "ruff>=0.16.8",
+    "bandit>=1.9.4",
+    "mypy>=2.3.1",
+    "hypothesis>=6.168.0",
+]
+
+[tool.ruff]
+target-version = "py310"
+src = ["src", "tests"]
+
+[tool.ruff.lint]
+select = [
+    "E", "W",   # pycodestyle
+    "F",        # pyflakes
+    "I",        # isort
+    "N",        # pep8-naming
+    "UP",       # pyupgrade
+    "YTT",      # sys.version misuse
+    "FA",       # future annotations
+    "A",        # builtins shadowing
+    "B",        # flake8-bugbear
+    "BLE",      # blind except
+    "C4",       # comprehensions
+    "C90",      # mccabe complexity
+    "DTZ",      # timezone-aware datetimes
+    "ERA",      # commented-out code
+    "FURB",     # refurb
+    "G",        # logging format
+    "ICN",      # import conventions
+    "ISC",      # implicit string concat
+    "LOG",      # logging
+    "PERF",     # perflint
+    "PGH",      # pygrep hooks
+    "PIE",      # misc lints
+    "PT",       # pytest style
+    "PTH",      # pathlib
+    "RET",      # return
+    "RSE",      # raise/return
+    "S",        # bandit rules
+    "SIM",      # simplify
+    "SLOT",     # __slots__
+    "T20",      # print
+    "TRY",      # exception handling
+    "RUF",      # ruff-specific
+]
+ignore = [
+    "ISC001",  # single-line implicit concat conflicts with the formatter
+    "TRY003",  # long messages in raise calls are fine
+]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/*" = ["S101", "S603"]
+
+[tool.mypy]
+strict = true
+files = ["src", "tests"]
+
+[tool.bandit]
+exclude_dirs = ["tests"]
+
+[tool.coverage.run]
+branch = true
+source = ["src/cborx"]
+
+[tool.coverage.report]
+show_missing = true
+fail_under = 90
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+xfail_strict = true
+filterwarnings = ["error"]

cborx-0.1.1/src/cborx/__init__.py

@@ -0,0 +1,28 @@
+# SPDX-License-Identifier: 0BSD
+"""Pure-Python CBOR (RFC 8949) encoder/decoder. No dependencies, no Rust."""
+
+from .decoder import CBORDecoder, DuplicateMode, TagHook, load, loads
+from .encoder import CBOREncoder, DefaultCallback, dump, dumps
+from .exceptions import CBORDecodeError, CBOREncodeError, CBORError
+from .types import CBORSimpleValue, CBORTag, UndefinedType, undefined
+
+__version__ = "0.1.1"
+
+__all__ = [
+    "CBORDecodeError",
+    "CBORDecoder",
+    "CBOREncodeError",
+    "CBOREncoder",
+    "CBORError",
+    "CBORSimpleValue",
+    "CBORTag",
+    "DefaultCallback",
+    "DuplicateMode",
+    "TagHook",
+    "UndefinedType",
+    "dump",
+    "dumps",
+    "load",
+    "loads",
+    "undefined",
+]