keylet 0.5.0__tar.gz → 0.7.0__tar.gz

{keylet-0.5.0 → keylet-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: keylet
-Version: 0.5.0
+Version: 0.7.0
 Summary: Client application for Tillitis TKey hardware ML-DSA/Ed25519 signer
 Keywords: ML-DSA,TKey,Tillitis,PQC,sign,signer
 Author: Jussi Kukkonen
@@ -46,15 +46,15 @@ The package installs a `keylet` command-line tool for signing and verification.
 $ keylet sign README.md
 $ keylet verify README.md
 
-# Get public key, sign with a passphrase, and verify using the saved public key
-$ keylet --passphrase hunter2 pubkey --output pub.key
-$ keylet --passphrase hunter2 sign README.md
+# Get public key, sign, and verify using the saved public key
+$ keylet pubkey --output pub.key
+$ keylet sign README.md
 $ keylet verify --pubkey pub.key README.md
 
 # When using keylet long-term, remember to specify device app digest (keylet default
 # app version may change, but you will need a specific application to keep using the
 # same key)
-$ keylet --passphrase hunter2 --digest 186bcf6 sign README.md
+$ keylet --digest 2cd8741 sign README.md
 
 ```
 
@@ -86,7 +86,7 @@ with TKeySign(app=app, secret="hunter2") as signer:
     signature = signer.sign(b"my payload")
 ```
 
-See the [API Reference](https://jku.github.io/keylet/api/) for more details.
+See API Reference in [documentation](https://jku.github.io/keylet/) for more details.   
 
 ## Development
 
@@ -108,3 +108,9 @@ make test
 # run tests, including on-device tests
 make test-device
 ```
+
+### Releasing
+
+* If a major or minor version bump is needed run `uv version --bump=[major|minor]`
+* run `make release` to create version bump commit, release tag and dev version bump commit
+* Push the commits and tag to trigger release workflow: `git push --tags origin main`

{keylet-0.5.0 → keylet-0.7.0}/README.md

@@ -28,15 +28,15 @@ The package installs a `keylet` command-line tool for signing and verification.
 $ keylet sign README.md
 $ keylet verify README.md
 
-# Get public key, sign with a passphrase, and verify using the saved public key
-$ keylet --passphrase hunter2 pubkey --output pub.key
-$ keylet --passphrase hunter2 sign README.md
+# Get public key, sign, and verify using the saved public key
+$ keylet pubkey --output pub.key
+$ keylet sign README.md
 $ keylet verify --pubkey pub.key README.md
 
 # When using keylet long-term, remember to specify device app digest (keylet default
 # app version may change, but you will need a specific application to keep using the
 # same key)
-$ keylet --passphrase hunter2 --digest 186bcf6 sign README.md
+$ keylet --digest 2cd8741 sign README.md
 
 ```
 
@@ -68,7 +68,7 @@ with TKeySign(app=app, secret="hunter2") as signer:
     signature = signer.sign(b"my payload")
 ```
 
-See the [API Reference](https://jku.github.io/keylet/api/) for more details.
+See API Reference in [documentation](https://jku.github.io/keylet/) for more details.   
 
 ## Development
 
@@ -90,3 +90,9 @@ make test
 # run tests, including on-device tests
 make test-device
 ```
+
+### Releasing
+
+* If a major or minor version bump is needed run `uv version --bump=[major|minor]`
+* run `make release` to create version bump commit, release tag and dev version bump commit
+* Push the commits and tag to trigger release workflow: `git push --tags origin main`

keylet-0.7.0/pyproject.toml

@@ -0,0 +1,87 @@
+[project]
+name = "keylet"
+version = "0.7.0"
+description = "Client application for Tillitis TKey hardware ML-DSA/Ed25519 signer"
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.10"
+dependencies = [
+    "cryptography>=48.0.0",
+    "pyserial>=3.5",
+]
+keywords = [
+    "ML-DSA",
+    "TKey",
+    "Tillitis",
+    "PQC",
+    "sign",
+    "signer",
+]
+
+[[project.authors]]
+name = "Jussi Kukkonen"
+email = "jkukkonen@google.com"
+
+[project.scripts]
+keylet = "keylet.bin.cli:main"
+
+[project.urls]
+Documentation = "https://jku.github.io/keylet/"
+Homepage = "https://github.com/jku/keylet"
+Issues = "https://github.com/jku/keylet/issues"
+Source = "https://github.com/jku/keylet"
+
+[dependency-groups]
+dev = [
+    "mypy",
+    "pytest",
+    "ruff",
+    "zizmor",
+    "zensical",
+    "mkdocstrings[python]",
+    "types-pyserial",
+]
+uv = ["uv"]
+
+[build-system]
+requires = ["uv_build>=0.11.23,<0.12.0"]
+build-backend = "uv_build"
+
+[tool.ruff.lint]
+select = ["ALL"]
+ignore = [
+    "BLE001",
+    "PLR2004",
+    "COM812",
+    "D",
+    "EM",
+    "TRY003",
+    "PYI019",
+]
+
+[tool.ruff.lint.per-file-ignores]
+"src/keylet/bin/**" = ["T201"]
+"tests/**" = [
+    "S101",
+    "S105",
+    "S106",
+    "SLF001",
+    "ARG002",
+]
+
+[tool.mypy]
+python_version = "3.10"
+pretty = true
+strict = true
+strict_equality = true
+disallow_any_unimported = true
+disallow_untyped_calls = true
+disallow_untyped_defs = true
+warn_redundant_casts = true
+warn_return_any = true
+warn_unreachable = true
+warn_unused_ignores = true
+
+[tool.pytest]
+markers = ["device: tests that require a physical TKey device"]

keylet-0.5.0/pyproject.toml → keylet-0.7.0/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "keylet"
-version = "0.5.0"
+version = "0.7.0"
 description = "Client application for Tillitis TKey hardware ML-DSA/Ed25519 signer"
 readme = "README.md"
 authors = [
@@ -61,6 +61,8 @@ ignore = [
 "tests/**" = [
     "S101",   # assert is ok in tests
     "S105",   # hardcoded password is ok in tests
+    "S106",   # hardcoded password is ok in tests
+    "SLF001", # Private member access is ok in tests
     "ARG002", # Unused method argument (common with mocks)
 ]
 

{keylet-0.5.0 → keylet-0.7.0}/src/keylet/__init__.py

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MIT
 # Copyright (c) 2026 keylet authors
 
-# ruff: noqa: F401
 from keylet.tkey_sign import SignApp, TKeySign
+
+__all__ = ["SignApp", "TKeySign"]

keylet-0.7.0/src/keylet/bin/__init__.py

@@ -0,0 +1,2 @@
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2026 keylet authors

{keylet-0.5.0 → keylet-0.7.0}/src/keylet/bin/cli.py

@@ -2,6 +2,7 @@
 # Copyright (c) 2026 keylet authors
 
 import argparse
+import getpass
 import sys
 from collections.abc import Generator
 from contextlib import contextmanager
@@ -18,11 +19,12 @@ from keylet.tkey_sign import SignApp, TKeySign
 @contextmanager
 def _app_signer(args: argparse.Namespace) -> Generator[TKeySign, None, None]:
     try:
+        secret = getpass.getpass("Enter passphrase (press Enter for none): ")
         if args.type == "ed25519":
             app = SignApp.load_ed25519(digest=args.digest)
         else:
             app = SignApp.load_mldsa(digest=args.digest)
-        with TKeySign(app, secret=args.passphrase) as signer:
+        with TKeySign(app, secret=secret or None) as signer:
             print(f"Using {args.type} device app with digest {app.digest[:7]}")
             yield signer
     except TKeyNotFoundError as e:
@@ -76,8 +78,8 @@ def cmd_verify(args: argparse.Namespace) -> None:
     if args.pubkey:
         pubkey_bytes = Path(args.pubkey).read_bytes()
     else:
+        print("Retrieving public key from device...")
         with _app_signer(args) as signer:
-            print("Retrieving public key from device...")
             pubkey_bytes = signer.get_pubkey()
 
     try:
@@ -101,7 +103,6 @@ def main() -> None:
     parser.add_argument(
         "--digest", help="Optional digest of the device application to use"
     )
-    parser.add_argument("--passphrase")
     parser.add_argument(
         "-t",
         "--type",

keylet-0.7.0/src/keylet/resources/__init__.py

@@ -0,0 +1,4 @@
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2026 keylet authors
+
+# Package marker for resource files

{keylet-0.5.0 → keylet-0.7.0}/src/keylet/tkey.py

@@ -150,10 +150,7 @@ class TKey:
     * [Framing protocol](https://dev.tillitis.se/protocol/#framing-protocol)
     """
 
-    def __init__(
-        self,
-        device: str | None,
-    ) -> None:
+    def __init__(self, device: str | None) -> None:
         """Initialize serial connection to TKey device.
 
         Args:

{keylet-0.5.0 → keylet-0.7.0}/src/keylet/tkey_sign.py

@@ -14,18 +14,18 @@ from keylet.tkey import Cmd, LenIdx, Rsp, TKey, TKeyError, TKeyUnexpectedAppErro
 
 logger = logging.getLogger(__name__)
 
-MU_SIZE = (64).to_bytes(4, byteorder="little")
-
+MAX_PAYLOAD_SIZE = 4096
 
 # Static registry of signer binaries (filename, version)
 # First binary in each list is the default binary.
 _EMBEDDED_MLDSA_BINS: list[tuple[str, int]] = [
     ("pqsigner_v3.bin", 3),
 ]
-
 _EMBEDDED_ED25519_BINS: list[tuple[str, int]] = [
     ("ed25519signer_v3.bin", 3),
 ]
+_MLDSA_APP_NAME = ("tk1", "pqsn")
+_ED25519_APP_NAME = ("tk1", "sign")
 
 
 @dataclass
@@ -48,8 +48,8 @@ class SignApp:
 
     @property
     def digest(self) -> str:
-        """Return the BLAKE2s-256 hex digest of the application binary."""
-        return hashlib.blake2s(self.binary, digest_size=32).hexdigest()
+        """Return the SHA-512 hex digest of the application binary."""
+        return hashlib.sha512(self.binary).hexdigest()
 
     @classmethod
     def _find_binary(
@@ -65,7 +65,7 @@ class SignApp:
                 continue
 
             binary = resources_dir.joinpath(filename).read_bytes()
-            file_digest = hashlib.blake2s(binary, digest_size=32).hexdigest()
+            file_digest = hashlib.sha512(binary).hexdigest()
 
             # Filter by digest if requested
             if digest is not None and not file_digest.startswith(digest.lower()):
@@ -105,7 +105,7 @@ class SignApp:
 
         Args:
             version: The version of the signer application to load.
-            digest: A BLAKE2s-256 hex digest (or prefix) of the target binary.
+            digest: A SHA-512 hex digest (or prefix) of the target binary.
 
         Returns:
             An instance of SignApp configured with the loaded binary.
@@ -116,7 +116,7 @@ class SignApp:
         """
 
         binary, version = cls._find_binary(version, digest, _EMBEDDED_MLDSA_BINS)
-        return cls(binary, version, ("tk1", "pqsn"), 2420, 1312)
+        return cls(binary, version, _MLDSA_APP_NAME, 2420, 1312)
 
     @classmethod
     def load_ed25519(
@@ -132,11 +132,11 @@ class SignApp:
         specific key must provide the binary digest.
 
         Warning:
-            When Ed25519 is used, there is a 4096K size limit to signing payloads.
+            When Ed25519 is used, there is a 4096B size limit to signing payloads.
 
         Args:
             version: The version of the signer application to load.
-            digest: A BLAKE2s-256 hex digest (or prefix) of the target binary.
+            digest: A SHA-512 hex digest (or prefix) of the target binary.
 
         Returns:
             An instance of SignApp configured with the loaded binary.
@@ -146,7 +146,7 @@ class SignApp:
                 is ambiguous (matches multiple binaries).
         """
         binary, version = cls._find_binary(version, digest, _EMBEDDED_ED25519_BINS)
-        return cls(binary, version, ("tk1", "sign"), 64, 32)
+        return cls(binary, version, _ED25519_APP_NAME, 64, 32)
 
 
 class SignRsp:
@@ -269,7 +269,7 @@ class TKeySign(TKey):
 
         Args:
             message: The raw bytes of the message/payload to sign. When Ed25519 keys
-                are used, there is a max message size of 4096K. This limitation does
+                are used, there is a max message size of 4096B. This limitation does
                 not apply to ML-DSA as FIPS 204 external mu is used.
             pub_key: The public key bytes (only needed for ML-DSA). If not provided,
                 key is retrieved from device.
@@ -282,8 +282,7 @@ class TKeySign(TKey):
             TKeyIOError: If writing or reading from the serial port fails.
             TKeyProtocolError: If there is a framing or protocol mismatch.
         """
-        # pqsn = ML-DSA signer, pqnt = no-touch ML-DSA test signer
-        if self.name in [("tk1", "pqsn"), ("tk1", "pqnt")]:
+        if self.name == _MLDSA_APP_NAME:
             # Compute FIPS 204 external mu
             if pub_key is None:
                 pub_key = self.get_pubkey()
@@ -293,8 +292,8 @@ class TKeySign(TKey):
             payload = message
 
         # Set size
-        if len(payload) > 4096:
-            raise ValueError(f"Payload too large {len(payload)} > 4096]")
+        if len(payload) > MAX_PAYLOAD_SIZE:
+            raise ValueError(f"Payload too large {len(payload)} > {MAX_PAYLOAD_SIZE}]")
         self.send(SignCmd.SET_SIZE, len(payload).to_bytes(4, byteorder="little"))
 
         # Load data in chunks

keylet-0.5.0/src/keylet/resources/__init__.py

@@ -1 +0,0 @@
-# Package marker for resource files