keylet 0.6.0__tar.gz → 0.7.0__tar.gz

{keylet-0.6.0 → keylet-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: keylet
-Version: 0.6.0
+Version: 0.7.0
 Summary: Client application for Tillitis TKey hardware ML-DSA/Ed25519 signer
 Keywords: ML-DSA,TKey,Tillitis,PQC,sign,signer
 Author: Jussi Kukkonen
@@ -46,15 +46,15 @@ The package installs a `keylet` command-line tool for signing and verification.
 $ keylet sign README.md
 $ keylet verify README.md
 
-# Get public key, sign with a passphrase, and verify using the saved public key
-$ keylet --passphrase hunter2 pubkey --output pub.key
-$ keylet --passphrase hunter2 sign README.md
+# Get public key, sign, and verify using the saved public key
+$ keylet pubkey --output pub.key
+$ keylet sign README.md
 $ keylet verify --pubkey pub.key README.md
 
 # When using keylet long-term, remember to specify device app digest (keylet default
 # app version may change, but you will need a specific application to keep using the
 # same key)
-$ keylet --passphrase hunter2 --digest 2cd8741 sign README.md
+$ keylet --digest 2cd8741 sign README.md
 
 ```
 
@@ -86,7 +86,7 @@ with TKeySign(app=app, secret="hunter2") as signer:
     signature = signer.sign(b"my payload")
 ```
 
-See API Reference in [documentation](https://jku.github.io/keylet/) for more details.
+See API Reference in [documentation](https://jku.github.io/keylet/) for more details.   
 
 ## Development
 
@@ -108,3 +108,9 @@ make test
 # run tests, including on-device tests
 make test-device
 ```
+
+### Releasing
+
+* If a major or minor version bump is needed run `uv version --bump=[major|minor]`
+* run `make release` to create version bump commit, release tag and dev version bump commit
+* Push the commits and tag to trigger release workflow: `git push --tags origin main`

{keylet-0.6.0 → keylet-0.7.0}/README.md

@@ -28,15 +28,15 @@ The package installs a `keylet` command-line tool for signing and verification.
 $ keylet sign README.md
 $ keylet verify README.md
 
-# Get public key, sign with a passphrase, and verify using the saved public key
-$ keylet --passphrase hunter2 pubkey --output pub.key
-$ keylet --passphrase hunter2 sign README.md
+# Get public key, sign, and verify using the saved public key
+$ keylet pubkey --output pub.key
+$ keylet sign README.md
 $ keylet verify --pubkey pub.key README.md
 
 # When using keylet long-term, remember to specify device app digest (keylet default
 # app version may change, but you will need a specific application to keep using the
 # same key)
-$ keylet --passphrase hunter2 --digest 2cd8741 sign README.md
+$ keylet --digest 2cd8741 sign README.md
 
 ```
 
@@ -68,7 +68,7 @@ with TKeySign(app=app, secret="hunter2") as signer:
     signature = signer.sign(b"my payload")
 ```
 
-See API Reference in [documentation](https://jku.github.io/keylet/) for more details.
+See API Reference in [documentation](https://jku.github.io/keylet/) for more details.   
 
 ## Development
 
@@ -90,3 +90,9 @@ make test
 # run tests, including on-device tests
 make test-device
 ```
+
+### Releasing
+
+* If a major or minor version bump is needed run `uv version --bump=[major|minor]`
+* run `make release` to create version bump commit, release tag and dev version bump commit
+* Push the commits and tag to trigger release workflow: `git push --tags origin main`

keylet-0.7.0/pyproject.toml

@@ -0,0 +1,87 @@
+[project]
+name = "keylet"
+version = "0.7.0"
+description = "Client application for Tillitis TKey hardware ML-DSA/Ed25519 signer"
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE"]
+requires-python = ">=3.10"
+dependencies = [
+    "cryptography>=48.0.0",
+    "pyserial>=3.5",
+]
+keywords = [
+    "ML-DSA",
+    "TKey",
+    "Tillitis",
+    "PQC",
+    "sign",
+    "signer",
+]
+
+[[project.authors]]
+name = "Jussi Kukkonen"
+email = "jkukkonen@google.com"
+
+[project.scripts]
+keylet = "keylet.bin.cli:main"
+
+[project.urls]
+Documentation = "https://jku.github.io/keylet/"
+Homepage = "https://github.com/jku/keylet"
+Issues = "https://github.com/jku/keylet/issues"
+Source = "https://github.com/jku/keylet"
+
+[dependency-groups]
+dev = [
+    "mypy",
+    "pytest",
+    "ruff",
+    "zizmor",
+    "zensical",
+    "mkdocstrings[python]",
+    "types-pyserial",
+]
+uv = ["uv"]
+
+[build-system]
+requires = ["uv_build>=0.11.23,<0.12.0"]
+build-backend = "uv_build"
+
+[tool.ruff.lint]
+select = ["ALL"]
+ignore = [
+    "BLE001",
+    "PLR2004",
+    "COM812",
+    "D",
+    "EM",
+    "TRY003",
+    "PYI019",
+]
+
+[tool.ruff.lint.per-file-ignores]
+"src/keylet/bin/**" = ["T201"]
+"tests/**" = [
+    "S101",
+    "S105",
+    "S106",
+    "SLF001",
+    "ARG002",
+]
+
+[tool.mypy]
+python_version = "3.10"
+pretty = true
+strict = true
+strict_equality = true
+disallow_any_unimported = true
+disallow_untyped_calls = true
+disallow_untyped_defs = true
+warn_redundant_casts = true
+warn_return_any = true
+warn_unreachable = true
+warn_unused_ignores = true
+
+[tool.pytest]
+markers = ["device: tests that require a physical TKey device"]

keylet-0.6.0/pyproject.toml → keylet-0.7.0/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "keylet"
-version = "0.6.0"
+version = "0.7.0"
 description = "Client application for Tillitis TKey hardware ML-DSA/Ed25519 signer"
 readme = "README.md"
 authors = [
@@ -61,6 +61,7 @@ ignore = [
 "tests/**" = [
     "S101",   # assert is ok in tests
     "S105",   # hardcoded password is ok in tests
+    "S106",   # hardcoded password is ok in tests
     "SLF001", # Private member access is ok in tests
     "ARG002", # Unused method argument (common with mocks)
 ]

{keylet-0.6.0 → keylet-0.7.0}/src/keylet/__init__.py

@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MIT
 # Copyright (c) 2026 keylet authors
 
-# ruff: noqa: F401
 from keylet.tkey_sign import SignApp, TKeySign
+
+__all__ = ["SignApp", "TKeySign"]

keylet-0.7.0/src/keylet/bin/__init__.py

@@ -0,0 +1,2 @@
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2026 keylet authors

{keylet-0.6.0 → keylet-0.7.0}/src/keylet/bin/cli.py

@@ -2,6 +2,7 @@
 # Copyright (c) 2026 keylet authors
 
 import argparse
+import getpass
 import sys
 from collections.abc import Generator
 from contextlib import contextmanager
@@ -18,11 +19,12 @@ from keylet.tkey_sign import SignApp, TKeySign
 @contextmanager
 def _app_signer(args: argparse.Namespace) -> Generator[TKeySign, None, None]:
     try:
+        secret = getpass.getpass("Enter passphrase (press Enter for none): ")
         if args.type == "ed25519":
             app = SignApp.load_ed25519(digest=args.digest)
         else:
             app = SignApp.load_mldsa(digest=args.digest)
-        with TKeySign(app, secret=args.passphrase) as signer:
+        with TKeySign(app, secret=secret or None) as signer:
             print(f"Using {args.type} device app with digest {app.digest[:7]}")
             yield signer
     except TKeyNotFoundError as e:
@@ -76,8 +78,8 @@ def cmd_verify(args: argparse.Namespace) -> None:
     if args.pubkey:
         pubkey_bytes = Path(args.pubkey).read_bytes()
     else:
+        print("Retrieving public key from device...")
         with _app_signer(args) as signer:
-            print("Retrieving public key from device...")
             pubkey_bytes = signer.get_pubkey()
 
     try:
@@ -101,7 +103,6 @@ def main() -> None:
     parser.add_argument(
         "--digest", help="Optional digest of the device application to use"
     )
-    parser.add_argument("--passphrase")
     parser.add_argument(
         "-t",
         "--type",

keylet-0.7.0/src/keylet/resources/__init__.py

@@ -0,0 +1,4 @@
+# SPDX-License-Identifier: MIT
+# Copyright (c) 2026 keylet authors
+
+# Package marker for resource files

{keylet-0.6.0 → keylet-0.7.0}/src/keylet/tkey_sign.py

@@ -14,7 +14,6 @@ from keylet.tkey import Cmd, LenIdx, Rsp, TKey, TKeyError, TKeyUnexpectedAppErro
 
 logger = logging.getLogger(__name__)
 
-MU_SIZE = (64).to_bytes(4, byteorder="little")
 MAX_PAYLOAD_SIZE = 4096
 
 # Static registry of signer binaries (filename, version)

keylet-0.6.0/src/keylet/resources/__init__.py

@@ -1 +0,0 @@
-# Package marker for resource files