fizzpy 0.3.0__tar.gz → 0.5.0__tar.gz

fizzpy-0.5.0/.github/manylinux-deps.Dockerfile

@@ -0,0 +1,15 @@
+# Manylinux base image with the folly + fizz + liboqs tree prebuilt, so wheel
+# builds skip the ~40-min source build and just compile _core against it. Rebuilt
+# by the deps_image job in .github/workflows/wheels.yml when build_fizz_deps.py or
+# fizz-tag.txt changes. The dep prefixes land in $FIZZPY_BUILD_INFO/prefix.txt,
+# which CMake reads at configure time (see CMakeLists.txt).
+ARG MANYLINUX_IMAGE=quay.io/pypa/manylinux_2_28_x86_64:latest
+FROM ${MANYLINUX_IMAGE}
+
+ENV GETDEPS_SCRATCH=/opt/fizz-deps \
+    FIZZPY_BUILD_INFO=/opt/fizzpy-build \
+    FIZZ_SRC=/opt/fizz-src
+
+# The script reads the pin from fizz-tag.txt beside itself.
+COPY scripts/build_fizz_deps.py scripts/fizz-tag.txt /opt/
+RUN python3 /opt/build_fizz_deps.py

fizzpy-0.5.0/.github/workflows/bump-fizz.yml

@@ -0,0 +1,84 @@
+name: Bump Fizz
+
+# Fizz tags weekly and the pin is the only thing keeping wheels current, so a
+# monthly job opens a PR whenever a newer release exists. Pushes and PRs made with
+# GITHUB_TOKEN don't trigger other workflows, but workflow_dispatch is exempt: the
+# job dispatches the full wheel matrix and the lint check on the bump branch, and
+# their results attach to the PR through the branch's head commit.
+on:
+  schedule:
+    - cron: "0 6 1 * *"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+  actions: write
+
+jobs:
+  bump:
+    name: Bump Fizz pin
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      BASE: ${{ github.event.repository.default_branch }}
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Find the newest Fizz release
+        id: latest
+        run: |
+          current=$(tr -d '[:space:]' < scripts/fizz-tag.txt)
+          latest=$(git ls-remote --tags --refs https://github.com/facebookincubator/fizz \
+            | sed 's|.*refs/tags/||' \
+            | grep -E '^v[0-9]{4}\.[0-9]{2}\.[0-9]{2}\.[0-9]{2}$' \
+            | sort -V | tail -n1)
+          if [ -z "$latest" ]; then
+            echo "no release tags found" >&2
+            exit 1
+          fi
+          newest=$(printf '%s\n%s\n' "$current" "$latest" | sort -V | tail -n1)
+          if [ "$latest" = "$current" ] || [ "$newest" != "$latest" ]; then
+            echo "pin $current is already the newest release"
+            echo "bump=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          if git ls-remote --exit-code --heads origin "bump/fizz-$latest" > /dev/null; then
+            echo "bump/fizz-$latest already exists; leaving it alone"
+            echo "bump=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          {
+            echo "bump=true"
+            echo "current=$current"
+            echo "latest=$latest"
+          } >> "$GITHUB_OUTPUT"
+
+      - name: Open the bump PR
+        if: steps.latest.outputs.bump == 'true'
+        env:
+          CURRENT: ${{ steps.latest.outputs.current }}
+          LATEST: ${{ steps.latest.outputs.latest }}
+        run: |
+          branch="bump/fizz-$LATEST"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git switch -c "$branch"
+          echo "$LATEST" > scripts/fizz-tag.txt
+          git commit -am "build: bump Fizz to $LATEST"
+          git push origin "$branch"
+
+          gh pr create --base "$BASE" --head "$branch" \
+            --title "build: bump Fizz to $LATEST" \
+            --body "Bumps the Fizz pin from $CURRENT to $LATEST ([compare](https://github.com/facebookincubator/fizz/compare/$CURRENT...$LATEST)). The wheel matrix and lint check were dispatched on this branch; merge once they are green."
+
+          gh workflow run wheels.yml --ref "$branch"
+          gh workflow run check.yml --ref "$branch"
+
+          # Older bump PRs are superseded by this one.
+          gh pr list --state open --json number,headRefName \
+            --jq ".[] | select(.headRefName | startswith(\"bump/fizz-\")) | select(.headRefName != \"$branch\") | .number" \
+            | while read -r number; do
+                gh pr close "$number" --delete-branch --comment "Superseded by $LATEST."
+              done

{fizzpy-0.3.0 → fizzpy-0.5.0}/.github/workflows/check.yml

@@ -9,7 +9,7 @@ on:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
 
 jobs:
   quality:
@@ -17,10 +17,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v8.2.0
+        uses: astral-sh/setup-uv@v10.3.3
         with:
           enable-cache: true
 

fizzpy-0.5.0/.github/workflows/wheels.yml

@@ -0,0 +1,187 @@
+name: Wheels
+
+on:
+  push:
+    branches: [master]
+    tags: ["v*"]
+  pull_request:
+  workflow_dispatch:
+  workflow_call:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  # The folly+fizz+liboqs tree is baked into a GHCR image tagged by the hash of
+  # its build inputs. This job rebuilds it only when that hash has no image yet
+  # (deps changed, or first run); otherwise it's a fast existence check. Wheels
+  # depend on it, so they never run against a missing image.
+  deps_image:
+    name: Deps image
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    permissions:
+      contents: read
+      packages: write
+    outputs:
+      image: ${{ steps.meta.outputs.image }}
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Resolve image ref
+        id: meta
+        env:
+          OWNER: ${{ github.repository_owner }}
+        run: |
+          repo="ghcr.io/${OWNER,,}/fizz-py-deps"
+          tag="${{ hashFiles('scripts/build_fizz_deps.py', 'scripts/fizz-tag.txt', '.github/manylinux-deps.Dockerfile') }}"
+          echo "repo=$repo" >> "$GITHUB_OUTPUT"
+          echo "image=$repo:$tag" >> "$GITHUB_OUTPUT"
+
+      - name: Log in to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Check whether the image already exists
+        id: exists
+        run: |
+          if docker manifest inspect "${{ steps.meta.outputs.image }}" > /dev/null 2>&1; then
+            echo "found=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "found=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Build and push deps image
+        if: steps.exists.outputs.found == 'false'
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: .github/manylinux-deps.Dockerfile
+          push: true
+          tags: |
+            ${{ steps.meta.outputs.image }}
+            ${{ steps.meta.outputs.repo }}:latest
+
+  build_sdist:
+    name: Build sdist
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+      - run: pipx run build --sdist
+      - uses: actions/upload-artifact@v7
+        with:
+          name: sdist
+          path: dist/*.tar.gz
+
+  build_wheels:
+    # One job per interpreter, each compiling _core against the prebuilt deps
+    # image (minutes, not ~40 min). liboqs travels with fizz's getdeps manifest,
+    # giving real post-quantum (X25519MLKEM768) support.
+    name: Wheel ${{ matrix.python }}
+    needs: deps_image
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      packages: read
+    strategy:
+      fail-fast: false
+      matrix:
+        python: [cp310, cp311, cp312, cp313, cp314, cp315, cp314t, cp315t]
+    steps:
+      - uses: actions/checkout@v7
+
+      # cibuildwheel pulls the deps image via docker; authenticate so the GHCR
+      # package is reachable.
+      - name: Log in to GHCR
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build wheel
+        uses: pypa/cibuildwheel@v4.3.5
+        env:
+          CIBW_BUILD: ${{ matrix.python }}-*
+          CIBW_MANYLINUX_X86_64_IMAGE: ${{ needs.deps_image.outputs.image }}
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: wheels-${{ matrix.python }}
+          path: wheelhouse/*.whl
+          if-no-files-found: error
+
+  build_wheels_native:
+    # macOS and Windows have no prebuilt deps image, so each runner builds the
+    # folly+fizz+liboqs tree from source (cached). Skipped on PRs — PR feedback
+    # stays on the fast Linux path; these run on master, tags, and dispatch.
+    name: Wheel ${{ matrix.os }}
+    if: github.event_name != 'pull_request'
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 120
+    strategy:
+      fail-fast: false
+      matrix:
+        # macos-15-intel = x86_64, macos-15 = arm64 (native per runner). windows-2022
+        # ships VS 2022 (vc143); windows-latest moved to VS 2026, whose toolset Boost
+        # 1.83's bootstrap doesn't recognize. Interpreters (cp310-cp314) come from
+        # [tool.cibuildwheel] build in pyproject.toml.
+        os: [macos-15-intel, macos-15, windows-2022]
+    steps:
+      - uses: actions/checkout@v7
+
+      # before-all runs on the host on macOS/Windows (no container), so these are
+      # inherited by the deps build and the _core configure without CIBW_ENVIRONMENT.
+      - name: Resolve deps paths (unix)
+        if: runner.os != 'Windows'
+        shell: bash
+        run: |
+          {
+            echo "GETDEPS_SCRATCH=$HOME/fizz-deps"
+            echo "FIZZPY_BUILD_INFO=$HOME/fizzpy-build"
+            echo "FIZZ_SRC=$HOME/fizz-src"
+            # Match the runner's macOS major: getdeps pulls Homebrew libs (openssl,
+            # sodium, …) built for this OS, so the wheel can't claim an older target
+            # than they carry. Also satisfies folly's C++17 (>= 10.13) requirement.
+            echo "MACOSX_DEPLOYMENT_TARGET=$(sw_vers -productVersion | cut -d. -f1).0"
+          } >> "$GITHUB_ENV"
+
+      - name: Resolve deps paths and locate MSVC (windows)
+        if: runner.os == 'Windows'
+        shell: bash
+        run: |
+          vswhere="/c/Program Files (x86)/Microsoft Visual Studio/Installer/vswhere.exe"
+          install=$("$vswhere" -latest -property installationPath)
+          {
+            echo "GETDEPS_SCRATCH=C:/fizz-deps"
+            echo "FIZZPY_BUILD_INFO=C:/fizzpy-build"
+            echo "FIZZ_SRC=C:/fizz-src"
+            # getdeps only globs for VS 2022; point it at whatever VS is installed.
+            echo "VCVARS_PATH=$install\\VC\\Auxiliary\\Build\\vcvarsall.bat"
+          } >> "$GITHUB_ENV"
+
+      # The getdeps tree is the ~40-min cost; key it on the build script + the Fizz
+      # pin (scripts/fizz-tag.txt) so a warm cache turns before-all into a near no-op.
+      - name: Cache deps tree
+        uses: actions/cache@v6
+        with:
+          path: |
+            ${{ env.GETDEPS_SCRATCH }}
+            ${{ env.FIZZPY_BUILD_INFO }}
+            ${{ env.FIZZ_SRC }}
+          key: deps-${{ matrix.os }}-${{ env.MACOSX_DEPLOYMENT_TARGET }}-${{ hashFiles('scripts/fizz-tag.txt', 'scripts/build_fizz_deps_native.py') }}
+
+      - name: Build wheels
+        uses: pypa/cibuildwheel@v4.3.5
+
+      - uses: actions/upload-artifact@v7
+        with:
+          name: wheels-${{ matrix.os }}
+          path: wheelhouse/*.whl
+          if-no-files-found: error

fizzpy-0.5.0/BUILDING.md

@@ -0,0 +1,91 @@
+# Building fizzpy
+
+The `_core` extension links Facebook's Fizz (C++ TLS 1.3). The post-quantum
+handshake additionally requires a Fizz built against
+[liboqs](https://github.com/open-quantum-safe/liboqs) — the Homebrew bottle and
+vcpkg port both ship `FIZZ_HAVE_OQS=0`, so they negotiate classical groups only.
+
+There are three build paths, for three different purposes:
+
+| | Container dev (`just dev-build`) | Homebrew dev (`just build`) | CI wheels (`scripts/build_fizz_deps.py`) |
+| --- | --- | --- | --- |
+| Fizz/liboqs source | getdeps tree in `.dev/getdeps` | Homebrew + from-source Fizz | getdeps, all from source |
+| Linkage | static, against the CI tree | static Fizz, shared liboqs via rpath | fully static-PIC, self-contained `.so` |
+| Where | `manylinux_2_28` container | your machine | `manylinux_2_28` container |
+| Optimized for | "builds here == builds in CI" | fastest iteration | deterministic, portable distribution |
+
+## Container development (`just dev-*`) — recommended
+
+The Homebrew loop links `_core` against Homebrew's *shared* folly, so a Homebrew
+folly bump (now compiled for a newer glibc than many hosts) silently breaks every
+local build. The container loop sidesteps that: it builds and runs `_core` inside
+the same `manylinux_2_28` image the wheels use, against the prebuilt static
+folly + Fizz + liboqs tree in `.dev/getdeps`. "Builds locally" and "builds in CI"
+become the same statement.
+
+```sh
+just dev-up         # create/start the container + one-time system + pip setup
+just dev-build      # editable-build _core against the getdeps tree (~10s inner loop)
+just dev-test       # offline suite; `just dev-test "-- -m network"` runs live-network tests
+just dev-shell      # interactive bash inside the container
+just dev-down       # stop + remove the container
+```
+
+The trick that needs no path rewriting: the getdeps tree bakes absolute
+`/project/...` paths into its CMake configs (it was built at `/project`), so the
+repo is bind-mounted at `/project` inside the container and every baked path
+resolves. A persistent container plus `docker exec` keeps the inner loop fast
+(no per-change `docker run`/image build).
+
+This requires the `.dev/getdeps` tree on disk (gitignored). Rebuild it inside the
+image with `scripts/build_fizz_deps.py` if it's missing (~40 min, one-time). The
+orchestration lives in `scripts/dev.py`.
+
+## Homebrew development (`just build`) — fastest, host-dependent
+
+Fast iteration when your host glibc is new enough for the current Homebrew folly
+bottle. If `import fizzpy` fails with a `GLIBC_2.xx not found` error, your host is
+too old — use the container loop above.
+
+```sh
+brew install fizz liboqs    # fizz pulls folly, boost, glog, gflags, libsodium, double-conversion
+pip install -e .[dev] --no-build-isolation   # or: pip install scikit-build-core pybind11 pybind11-stubgen ruff pytest
+
+just build      # build OQS Fizz if needed (cached), then editable-install _core
+just test       # offline test suite; `just test ""` includes live network tests
+just check      # ruff lint
+just fmt        # ruff format + clang-format _core.cpp
+```
+
+`just build` runs `scripts/build_fizz.py ensure`, which compiles a liboqs-enabled
+Fizz into the gitignored `.dev/fizz-prefix` once (subsequent runs are a no-op;
+`python scripts/build_fizz.py ensure --force` rebuilds), then editable-installs
+`_core` with `find_package(fizz)` pointed at that prefix.
+
+- **C++20 is required** — current Folly (2026.06) dropped C++17.
+- Fizz and Folly are versioned together. The Fizz tag lives in
+  `scripts/fizz-tag.txt`, shared by every build path; it must match the Homebrew
+  Folly bottle here, or the ABI won't match (`FIZZ_TAG=... just build` overrides
+  it when brew lags). A monthly workflow (`bump-fizz.yml`) opens a PR when a newer
+  Fizz release exists.
+- `find_package(liboqs CONFIG)` inside Fizz auto-sets `FIZZ_HAVE_OQS` and links
+  `OQS::oqs`. `BUILD_EXAMPLES=OFF` is required: the bundled FizzTool fails to
+  compile under OpenSSL 3.6 (`-Werror` on the deprecated `EVP_PKEY_cmp`); the
+  library itself is fine.
+
+## Portable wheels (CI)
+
+`scripts/build_fizz_deps.py` is cibuildwheel's `before-all`. It builds the whole
+folly + Fizz + liboqs tree once per `manylinux_2_28` container as static-PIC
+archives, which `_core` links in wholesale — a single self-contained extension
+with exactly one copy of folly. (Using getdeps `--shared-lib` instead would bake
+folly into `libfizz.so` *and* drag it into `_core` again, double-registering
+folly's gflags globals and aborting at import.) The build settings live in
+`[tool.cibuildwheel]` in `pyproject.toml`.
+
+## Verify
+
+```sh
+python -c "import fizzpy; print(fizzpy.get('https://www.cloudflare.com').tls)"
+# group should be 'X25519MLKEM768', group_code 4588
+```

fizzpy-0.5.0/CHANGELOG.md

@@ -0,0 +1,55 @@
+# Changelog
+
+All notable changes to this project are documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.5.0] - 2026-11-15
+
+### Added
+
+- `fizzpy.wrap_socket(sock, server_hostname, config)` performs a Fizz TLS 1.3 handshake over an already-connected socket and returns a blocking, `ssl.SSLSocket`-shaped `TlsSocket`. `TlsConfig` holds the handshake options (verification, CA file, key groups, ALPN, extensions, timeout). An empty server name sends no SNI extension.
+- `fizzpy.contrib.requests.FizzAdapter` mounts Fizz under `requests` and urllib3. Install it with `pip install fizzpy[requests]`.
+- `fizzpy.contrib.httpx.FizzHTTPTransport` does the same for synchronous `httpx`. Install it with `pip install fizzpy[httpx]`. It rejects `verify=`, `cert=` and `http2=True` instead of ignoring them.
+- Opt-in TLS 1.2 fallback: `FizzAdapter(fallback=True)` and `FizzHTTPTransport(fallback=True)` retry over the standard library `ssl` module when the server rejects TLS 1.3 with a `protocol_version` alert. The retry is a classical, non post-quantum handshake. Certificate and hostname failures are never retried.
+- Plain `CONNECT` proxies work with the adapters. The HTTP client opens the tunnel and fizzpy handshakes over it. Proxies that themselves require TLS are not supported.
+- `fizzpy probe`, a command line check for which hosts complete a post-quantum handshake. It takes hosts or a file, can print JSON, and `--require-pq` exits 1 unless every target is post-quantum. `fizzpy.probe.probe` and `probe_many` are the Python API. See `docs/probe.md`.
+- `fizzpy.supports_post_quantum()` reports whether the installed build can do the hybrid key exchange. It is always true for the wheels. A source build against a Fizz without liboqs returns false and now defaults to classical x25519 only, where it previously could not generate the hybrid key share.
+- TLS handshake errors carry a `fizz_alert` attribute with the alert name (for example `protocol_version`) and a `fizz_alert_remote` attribute saying whether the peer sent it.
+- Wheels for CPython 3.15 and for free-threaded CPython 3.14t and 3.15t, on every platform that has wheels.
+
+### Changed
+
+- Callers must update exception handling. Handshake failures from `Client`, `AsyncClient` and the new APIs now raise `ssl.SSLError`, or `ssl.SSLCertVerificationError` for certificate and hostname failures, instead of `ConnectionError`. Read and write timeouts raise `socket.timeout` instead of `ConnectionError`. Both are `OSError` subclasses, so `except OSError` still catches them, but `except ConnectionError` no longer does. Connection setup failures such as a refused connection still raise `ConnectionError`.
+- The `timeout` option now bounds each read and write as well as the handshake, so a stalled peer raises `socket.timeout` instead of hanging. `timeout=None` means no deadline, and a zero or negative timeout fails fast rather than blocking forever.
+- The wheels now bundle Fizz v2026.10.26.00 (previously v2026.06.08.00).
+
+### Fixed
+
+- The Windows wheels no longer risk crashing the process at interpreter exit. The shared event loop thread is now left running instead of being joined while the extension unloads.
+
+## [0.4.0] - 2026-06-16
+
+### Added
+
+- Wheels for macOS (arm64 and x86_64) and Windows (x64), alongside the existing Linux x86_64 wheels. Like the Linux wheels, they are self-contained and include post-quantum support.
+
+## [0.3.0] - 2026-06-13
+
+Initial release, supporting TLS 1.3 and HTTP/1.1 only.
+
+### Added
+
+- TLS 1.3 HTTP client built on Facebook's Fizz: synchronous `fizzpy.Client` with module-level `get`, `post`, `head`, `put`, `delete` and `request`, and an asyncio `fizzpy.aio.AsyncClient` over the same native core.
+- Post-quantum key exchange by default: the client offers the hybrid `X25519MLKEM768` group and classical `x25519`, and falls back to x25519 against servers without ML-KEM. Use `groups=[NamedGroup.x25519_mlkem768]` to require post-quantum or `groups=[NamedGroup.x25519]` to disable it.
+- Every response carries the negotiated TLS parameters in `Response.tls` (version, cipher, group, ALPN, SNI, peer certificate).
+- Certificate chain and hostname verification against the `certifi` bundle by default, with `cafile=` for a custom CA and `verify=False` to turn it off.
+- HTTP/1.1 responses with content-length, chunked and gzip/deflate bodies, per-host keep-alive connection pooling, and automatic redirect following with `follow_redirects` and `max_redirects` (`TooManyRedirects` when exceeded).
+- `Extension(type, data)` to append custom extensions to the ClientHello, through `extensions=`.
+- Type stubs for the native `fizzpy._core` module.
+- Self-contained wheels for Linux x86_64 (`manylinux_2_28`), CPython 3.10 to 3.14. Fizz, folly and liboqs are linked in, so no system packages are needed.
+
+[0.5.0]: https://github.com/Xevion/fizz-py/compare/v0.4.0...v0.5.0
+[0.4.0]: https://github.com/Xevion/fizz-py/compare/v0.3.0...v0.4.0
+[0.3.0]: https://github.com/Xevion/fizz-py/releases/tag/v0.3.0

{fizzpy-0.3.0 → fizzpy-0.5.0}/CMakeLists.txt

@@ -7,15 +7,15 @@ project(
   VERSION ${SKBUILD_PROJECT_VERSION}
   LANGUAGES CXX)
 
-# Only Linux x86_64 wheels are published. Stop here before the (~40 min) folly +
-# fizz + liboqs source build that an sdist install would otherwise attempt and
-# fail on macOS/Windows.
-if(NOT CMAKE_SYSTEM_NAME STREQUAL "Linux")
+# Wheels target Linux, macOS, and Windows. Other platforms stop here before the
+# (~40 min) folly + fizz + liboqs source build an sdist install would attempt.
+if(NOT CMAKE_SYSTEM_NAME MATCHES "^(Linux|Darwin|Windows)$")
   message(
     FATAL_ERROR
-    "fizzpy publishes prebuilt Linux x86_64 wheels only; ${CMAKE_SYSTEM_NAME} "
-    "is not yet supported. Building from source needs the Fizz toolchain — see "
-    "BUILDING.md (https://github.com/Xevion/fizz-py/blob/master/BUILDING.md).")
+    "fizzpy publishes prebuilt wheels for Linux, macOS, and Windows; "
+    "${CMAKE_SYSTEM_NAME} is not supported. Building from source needs the Fizz "
+    "toolchain — see BUILDING.md "
+    "(https://github.com/Xevion/fizz-py/blob/master/BUILDING.md).")
 endif()
 
 # Fizz's CMake config pulls in its bundled FindSodium.cmake. Homebrew installs
@@ -85,4 +85,12 @@ if(TARGET Folly::folly_io_async_scoped_event_base_thread)
   target_link_libraries(_core PRIVATE Folly::folly_io_async_scoped_event_base_thread)
 endif()
 
+# Static deps need Windows system libs their getdeps configs don't propagate as
+# interface links: bcrypt (RNG: libevent, liboqs), crypt32 (OpenSSL cert store),
+# ws2_32 (sockets), iphlpapi (folly GetAdaptersAddresses), advapi32 (OpenSSL/
+# libevent registry + RNG fallback). Link them on the consumer.
+if(WIN32)
+  target_link_libraries(_core PRIVATE bcrypt crypt32 ws2_32 iphlpapi advapi32)
+endif()
+
 install(TARGETS _core LIBRARY DESTINATION fizzpy)

{fizzpy-0.3.0 → fizzpy-0.5.0}/Justfile

@@ -19,6 +19,29 @@ wheel:
 test *args="-m 'not network'":
     pytest {{args}}
 
+# Containerized dev loop (recommended): build + test inside the manylinux image
+# the wheels use, against the prebuilt .dev/getdeps tree. Isolated from host
+# Homebrew/glibc drift. See scripts/dev.py.
+dev-up:
+    python scripts/dev.py up
+
+# Editable-build _core in the container (the ~10s inner loop).
+dev-build:
+    python scripts/dev.py build
+
+# Run the suite in the container. `just dev-test "-- -m network"` runs the
+# live-network tests; pass any other pytest args after a `--` the same way.
+dev-test *args:
+    python scripts/dev.py test {{args}}
+
+# Interactive shell inside the dev container.
+dev-shell:
+    python scripts/dev.py shell
+
+# Stop + remove the dev container.
+dev-down:
+    python scripts/dev.py down
+
 # Install the lint/type toolchain into .venv without building _core.
 _tools:
     uv sync --no-install-project --group dev

fizzpy-0.5.0/PKG-INFO

@@ -0,0 +1,109 @@
+Metadata-Version: 2.4
+Name: fizzpy
+Version: 0.5.0
+Summary: Post-quantum TLS 1.3 for Python — plug it under requests/urllib3 or use the built-in client. Built on Facebook's Fizz.
+Author-Email: Xevion <xevion@xevion.dev>
+License-Expression: MIT
+License-File: LICENSE
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3.15
+Classifier: Programming Language :: Python :: Free Threading :: 2 - Beta
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Topic :: Security :: Cryptography
+Classifier: Typing :: Typed
+Project-URL: Repository, https://github.com/Xevion/fizz-py
+Project-URL: Issues, https://github.com/Xevion/fizz-py/issues
+Requires-Python: >=3.10
+Requires-Dist: certifi
+Provides-Extra: test
+Requires-Dist: pytest>=8; extra == "test"
+Provides-Extra: requests
+Requires-Dist: requests; extra == "requests"
+Provides-Extra: httpx
+Requires-Dist: httpx; extra == "httpx"
+Description-Content-Type: text/markdown
+
+# fizzpy
+
+Post-quantum TLS 1.3 for Python. Keep the HTTP client you already use and swap only
+the TLS: fizzpy performs the handshake with the hybrid `X25519MLKEM768` key exchange,
+built on Facebook's [Fizz](https://github.com/facebookincubator/fizz) (C++).
+
+**Why.** The key exchange is the part of TLS exposed to "harvest now, decrypt later"
+recording, which is why browsers moved to hybrid ML-KEM. In Python, ML-KEM arrived with
+OpenSSL 3.5, so an interpreter linked against anything older cannot negotiate it.
+fizzpy carries its own TLS stack (Fizz and liboqs), so it works there, and it can
+check whether the servers you run or depend on support post-quantum key exchange.
+Beta: the API may change before 1.0.
+
+```python
+import requests
+from fizzpy.contrib.requests import FizzAdapter
+
+session = requests.Session()
+session.mount("https://", FizzAdapter())
+print(session.get("https://www.cloudflare.com").status_code)
+```
+
+requests still owns cookies, redirects, retries and pooling; fizzpy only does the
+handshake. The same works under [httpx](docs/requests-httpx.md#httpx), on any
+[connected socket](docs/tls.md#any-socket-wrap_socket), or through the small
+[built-in client](docs/client.md).
+
+![A fizzpy ClientHello in Wireshark](https://raw.githubusercontent.com/Xevion/fizz-py/master/docs/pq-handshake.png)
+
+*A fizzpy ClientHello in Wireshark: it offers `X25519MLKEM768` (`0x11ec`) plus a
+custom marker extension from [`examples/pq_marker.py`](examples/pq_marker.py).*
+
+## Check a server
+
+```console
+$ fizzpy probe www.cloudflare.com github.com
+HOST                VERDICT         PREFERRED       ML-KEM  x25519  P-256  P-384
+www.cloudflare.com  post-quantum    X25519MLKEM768  ok      ok      ok     ok
+github.com          classical-only  x25519          rej     ok      ok     rej
+```
+
+One handshake per key-exchange group tells "supports ML-KEM" apart from "prefers
+x25519", and finds hosts where the larger post-quantum hello gets a connection reset.
+It scales to thousands of hosts and prints JSON. See [the probe guide](docs/probe.md).
+
+## Install
+
+```sh
+pip install fizzpy
+```
+
+Wheels are self-contained (Fizz and liboqs are built in) for Linux x86_64, macOS and
+Windows x64, CPython 3.10 to 3.15 including free-threaded builds. For anything else,
+see [BUILDING.md](BUILDING.md).
+
+## Limits
+
+- TLS 1.3 only, so TLS 1.2-only servers fail unless you opt into
+  [a classical fallback](docs/tls.md#reaching-tls-12-only-hosts).
+- HTTP/1.1 only.
+- No client certificates yet.
+
+More in [docs/limitations.md](docs/limitations.md).
+
+## Docs
+
+- [Under requests and httpx](docs/requests-httpx.md)
+- [Handshake control](docs/tls.md): `wrap_socket`, `TlsConfig`, key exchange,
+  extensions, certificates
+- [The built-in client](docs/client.md)
+- [The probe](docs/probe.md)
+- [Building](BUILDING.md)
+
+MIT licensed.