purecrypt 0.1.1__tar.gz

purecrypt-0.1.1/.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# SPDX-License-Identifier: 0BSD
+
+* @Sudo-Ivan

purecrypt-0.1.1/.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5
+  - package-ecosystem: uv
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    open-pull-requests-limit: 5

purecrypt-0.1.1/.github/workflows/ci.yml

@@ -0,0 +1,59 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  schedule:
+    - cron: "9 7 * * 1"
+
+permissions: {}
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: "0.11.32"
+          enable-cache: true
+
+      - run: uv sync --locked
+
+      - run: uv run ruff check .
+      - run: uv run ruff format --check .
+      - run: uv run bandit -r src/
+      - run: uv run mypy
+      - run: uvx ty check src tests
+
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python: ["3.10", "3.11", "3.12", "3.13", "3.14"]
+    steps:
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: "0.11.32"
+          enable-cache: true
+
+      - run: uv python install ${{ matrix.python }}
+      - run: uv sync --locked --python ${{ matrix.python }}
+      - run: uv run pytest --cov

purecrypt-0.1.1/.github/workflows/codeql.yml

@@ -0,0 +1,35 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+  schedule:
+    - cron: "17 3 * * 4"
+
+permissions: {}
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        with:
+          languages: python
+          queries: security-and-quality
+
+      - uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        with:
+          category: "/language:python"

purecrypt-0.1.1/.github/workflows/dependency-review.yml

@@ -0,0 +1,22 @@
+name: Dependency Review
+
+on:
+  pull_request:
+
+permissions: {}
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0

purecrypt-0.1.1/.github/workflows/release.yml

@@ -0,0 +1,63 @@
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+
+permissions: {}
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+      url: https://pypi.org/p/purecrypt
+    permissions:
+      contents: write
+      id-token: write
+      attestations: write
+    steps:
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+        with:
+          version: "0.11.32"
+
+      - run: uv sync --locked
+
+      - name: Verify tag matches package version
+        run: |
+          tag="${GITHUB_REF_NAME#v}"
+          version="$(uv run python -c 'import purecrypt; print(purecrypt.__version__)')"
+          if [ "$tag" != "$version" ]; then
+            echo "tag $tag does not match package version $version" >&2
+            exit 1
+          fi
+
+      - run: uv build
+
+      - name: Attest build provenance
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        with:
+          subject-path: dist/*
+
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1
+        with:
+          attestations: true
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "${GITHUB_REF_NAME}" \
+            --repo "${GITHUB_REPOSITORY}" \
+            --verify-tag \
+            --title "${GITHUB_REF_NAME}" \
+            --generate-notes \
+            dist/*

purecrypt-0.1.1/.github/workflows/scorecard.yml

@@ -0,0 +1,42 @@
+name: OpenSSF Scorecard
+
+on:
+  branch_protection_rule:
+  push:
+    branches: [master]
+  workflow_dispatch:
+  schedule:
+    - cron: "42 5 * * 6"
+
+permissions: read-all
+
+jobs:
+  analysis:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+    steps:
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      - uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        with:
+          sarif_file: results.sarif

purecrypt-0.1.1/.github/workflows/zizmor.yml

@@ -0,0 +1,28 @@
+name: zizmor
+
+on:
+  push:
+    branches: [master]
+    paths: [.github/**]
+  pull_request:
+    paths: [.github/**]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        with:
+          advanced-security: false

purecrypt-0.1.1/.gitignore

@@ -0,0 +1,11 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+build/
+dist/
+.venv/
+.mypy_cache/
+.pytest_cache/
+.ruff_cache/
+.coverage*
+htmlcov/

purecrypt-0.1.1/CHANGELOG.md

@@ -0,0 +1,34 @@
+# Changelog
+
+## [0.1.1] - Unreleased
+
+Fix the release workflow's package-name placeholder. No library
+changes.
+
+## [0.1.0] - Unreleased
+
+Initial release. Pure-Python primitives with no dependencies and no
+Rust. See the README security notice: pure Python cannot provide
+constant-time execution, so secret-key operations must not run where a
+co-located attacker can measure timing.
+
+- AES-128/192/256 block cipher with ECB, CBC, CTR and GCM (AEAD)
+- ChaCha20, Poly1305, ChaCha20-Poly1305 and XChaCha20-Poly1305
+- Ed25519 signatures (RFC 8032) and X25519/X448 key exchange (RFC 7748)
+- ECDSA and ECDH over P-256, P-384, P-521 and secp256k1 with RFC 6979
+  deterministic k
+- RSA key generation, PSS and PKCS#1 v1.5 signatures, OAEP and
+  PKCS#1 v1.5 encryption, PKCS#1/PKCS#8/SPKI/SEC1 serialization
+- Encrypted PKCS#8 (RFC 5958) via PBES2 with PBKDF2-HMAC and AES-CBC
+- X.509 certificate parsing and validation (RFC 5280): chain building,
+  signature verification for RSA/ECDSA/Ed25519, critical-extension
+  policy, and RFC 6125 hostname matching
+- HKDF, PBKDF2, scrypt and Argon2id
+- Minimal strict DER and PEM codecs for keys and certificates
+- Hash and HMAC facades over hashlib
+
+Side-channel hardening: RSA private operations blinded with a random
+factor and verified against the public exponent before release, fixed
+iteration scalar multiplication with mask-selected adds on all curves,
+mask-arithmetic Montgomery cswap, uniform full-buffer padding scans,
+and constant-time-style comparisons on all secret-derived values.

purecrypt-0.1.1/CONTRIBUTING.md

@@ -0,0 +1,19 @@
+# Contributing
+
+Report bugs through GitHub issues. Security reports go to
+security@quad4.io (see SECURITY.md).
+
+## Setup
+
+    uv sync
+    make check
+
+`make check` runs the full local gate: ruff lint and format, bandit,
+mypy strict, ty, and pytest with coverage.
+
+## Conventions
+
+- No runtime dependencies unless the project genuinely needs one.
+- Source files start with the SPDX license identifier.
+- Public API changes need tests.
+- Commit messages: short, imperative, formal.

purecrypt-0.1.1/LICENSE

@@ -0,0 +1,12 @@
+Copyright (c) 2026 Quad4
+
+Permission to use, copy, modify, and/or distribute this software for any purpose
+with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
+FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.

purecrypt-0.1.1/Makefile

@@ -0,0 +1,16 @@
+.PHONY: check lint test build
+
+check: lint test
+
+lint:
+	uv run ruff check .
+	uv run ruff format --check .
+	uv run bandit -r src/
+	uv run mypy
+	uvx ty check src tests
+
+test:
+	uv run pytest --cov --cov-report=term-missing
+
+build:
+	uv build

purecrypt-0.1.1/PKG-INFO

@@ -0,0 +1,103 @@
+Metadata-Version: 2.5
+Name: purecrypt
+Version: 0.1.1
+Summary: Pure-Python cryptographic primitives. No dependencies, no Rust. NOT READY FOR PRODUCTION.
+Project-URL: Homepage, https://quad4.io
+Project-URL: Repository, https://github.com/Quad4-Software/python-library-template
+Project-URL: Issues, https://github.com/Quad4-Software/python-library-template/issues
+Project-URL: Changelog, https://github.com/Quad4-Software/python-library-template/blob/master/CHANGELOG.md
+Author: Quad4
+License-Expression: 0BSD
+License-File: LICENSE
+Keywords: aes,chacha20,cryptography,ed25519,pure-python,rsa
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: BSD License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+
+# purecrypt
+
+[![CI](https://github.com/Quad4-Software/purecrypt/actions/workflows/ci.yml/badge.svg)](https://github.com/Quad4-Software/purecrypt/actions/workflows/ci.yml)
+[![CodeQL](https://github.com/Quad4-Software/purecrypt/actions/workflows/codeql.yml/badge.svg)](https://github.com/Quad4-Software/purecrypt/actions/workflows/codeql.yml)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/Quad4-Software/purecrypt/badge)](https://securityscorecards.dev/viewer/?uri=github.com/Quad4-Software/purecrypt)
+[![PyPI](https://img.shields.io/pypi/v/purecrypt.svg)](https://pypi.org/project/purecrypt/)
+[![License: 0BSD](https://img.shields.io/badge/license-0BSD-blue)](LICENSE)
+
+> **Security notice.** Pure Python cannot provide constant-time
+> execution. Secret-key operations (signing, decryption, key exchange)
+> are hardened against the obvious leaks: RSA blinding, fixed-iteration
+> scalar multiplication with mask-selected adds, uniform error paths,
+> and constant-time-style comparisons. Residual timing variance in the
+> interpreter remains, so do not run secret-key operations where a
+> co-located attacker can measure timing. Public-data operations such
+> as certificate validation and signature verification are unaffected.
+> For high-assurance deployments use audited native implementations
+> such as `cryptography` (OpenSSL) or `PyNaCl` (libsodium).
+
+Pure-Python cryptographic primitives for Python 3.10+. No
+dependencies, no Rust, no C extensions: only `hashlib`, `hmac` and
+`secrets` from the standard library.
+
+## Install
+
+    pip install purecrypt
+
+## Contents
+
+- AES-128/192/256 with ECB, CBC, CTR and GCM (AEAD)
+- ChaCha20, Poly1305, ChaCha20-Poly1305 and XChaCha20-Poly1305
+- Ed25519 signatures and X25519 key exchange
+- ECDSA and ECDH over P-256, P-384, P-521 and secp256k1 (RFC 6979
+  deterministic signatures)
+- RSA: key generation, PSS and PKCS#1 v1.5 signatures, OAEP and
+  PKCS#1 v1.5 encryption, PKCS#1/PKCS#8/SPKI serialization, encrypted
+  PKCS#8 (PBES2/AES-CBC)
+- X.509 certificate parsing, signature verification, RFC 5280 chain
+  validation and RFC 6125 hostname matching
+- HKDF, PBKDF2, scrypt and Argon2id
+- Minimal DER/PEM handling for key serialization
+- SHA-2, SHA-3, SHAKE, BLAKE2 and HMAC facades over hashlib
+
+## Example
+
+```python
+from purecrypt.aes import gcm_decrypt, gcm_encrypt
+from purecrypt.eddsa import Ed25519PrivateKey
+from purecrypt.x509 import Certificate, validate_chain, verify_hostname
+
+key, nonce = b"k" * 32, b"n" * 12
+ct, tag = gcm_encrypt(key, nonce, b"secret", aad=b"hdr")
+assert gcm_decrypt(key, nonce, ct, tag, aad=b"hdr") == b"secret"
+
+priv = Ed25519PrivateKey.generate()
+sig = priv.sign(b"message")
+priv.public_key().verify(sig, b"message")
+
+leaf = Certificate.from_pem(pem_text)
+validate_chain(leaf, intermediates, trust_roots)
+verify_hostname(leaf, "example.com")
+```
+
+## Known limitations
+
+- No constant-time guarantees. Python semantics preclude them.
+- Secret zeroization is best-effort (mutable buffers are wiped where
+  practical, but interpreter copies are out of scope).
+- RSA PKCS#1 v1.5 decryption is inherently Bleichenbacher-prone. Use
+  OAEP.
+- X.509 validation covers RFC 5280 path rules and RFC 6125 hostnames,
+  but there is no revocation checking (no CRL or OCSP) and no name or
+  policy constraint enforcement. A critical extension whose semantics
+  are not enforced fails validation.
+- No TLS. That is a different and much larger problem.
+
+## Development
+
+    uv sync --group dev
+    make check
+
+License: 0BSD. Quad4 Software, https://quad4.io

purecrypt-0.1.1/README.md

@@ -0,0 +1,82 @@
+# purecrypt
+
+[![CI](https://github.com/Quad4-Software/purecrypt/actions/workflows/ci.yml/badge.svg)](https://github.com/Quad4-Software/purecrypt/actions/workflows/ci.yml)
+[![CodeQL](https://github.com/Quad4-Software/purecrypt/actions/workflows/codeql.yml/badge.svg)](https://github.com/Quad4-Software/purecrypt/actions/workflows/codeql.yml)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/Quad4-Software/purecrypt/badge)](https://securityscorecards.dev/viewer/?uri=github.com/Quad4-Software/purecrypt)
+[![PyPI](https://img.shields.io/pypi/v/purecrypt.svg)](https://pypi.org/project/purecrypt/)
+[![License: 0BSD](https://img.shields.io/badge/license-0BSD-blue)](LICENSE)
+
+> **Security notice.** Pure Python cannot provide constant-time
+> execution. Secret-key operations (signing, decryption, key exchange)
+> are hardened against the obvious leaks: RSA blinding, fixed-iteration
+> scalar multiplication with mask-selected adds, uniform error paths,
+> and constant-time-style comparisons. Residual timing variance in the
+> interpreter remains, so do not run secret-key operations where a
+> co-located attacker can measure timing. Public-data operations such
+> as certificate validation and signature verification are unaffected.
+> For high-assurance deployments use audited native implementations
+> such as `cryptography` (OpenSSL) or `PyNaCl` (libsodium).
+
+Pure-Python cryptographic primitives for Python 3.10+. No
+dependencies, no Rust, no C extensions: only `hashlib`, `hmac` and
+`secrets` from the standard library.
+
+## Install
+
+    pip install purecrypt
+
+## Contents
+
+- AES-128/192/256 with ECB, CBC, CTR and GCM (AEAD)
+- ChaCha20, Poly1305, ChaCha20-Poly1305 and XChaCha20-Poly1305
+- Ed25519 signatures and X25519 key exchange
+- ECDSA and ECDH over P-256, P-384, P-521 and secp256k1 (RFC 6979
+  deterministic signatures)
+- RSA: key generation, PSS and PKCS#1 v1.5 signatures, OAEP and
+  PKCS#1 v1.5 encryption, PKCS#1/PKCS#8/SPKI serialization, encrypted
+  PKCS#8 (PBES2/AES-CBC)
+- X.509 certificate parsing, signature verification, RFC 5280 chain
+  validation and RFC 6125 hostname matching
+- HKDF, PBKDF2, scrypt and Argon2id
+- Minimal DER/PEM handling for key serialization
+- SHA-2, SHA-3, SHAKE, BLAKE2 and HMAC facades over hashlib
+
+## Example
+
+```python
+from purecrypt.aes import gcm_decrypt, gcm_encrypt
+from purecrypt.eddsa import Ed25519PrivateKey
+from purecrypt.x509 import Certificate, validate_chain, verify_hostname
+
+key, nonce = b"k" * 32, b"n" * 12
+ct, tag = gcm_encrypt(key, nonce, b"secret", aad=b"hdr")
+assert gcm_decrypt(key, nonce, ct, tag, aad=b"hdr") == b"secret"
+
+priv = Ed25519PrivateKey.generate()
+sig = priv.sign(b"message")
+priv.public_key().verify(sig, b"message")
+
+leaf = Certificate.from_pem(pem_text)
+validate_chain(leaf, intermediates, trust_roots)
+verify_hostname(leaf, "example.com")
+```
+
+## Known limitations
+
+- No constant-time guarantees. Python semantics preclude them.
+- Secret zeroization is best-effort (mutable buffers are wiped where
+  practical, but interpreter copies are out of scope).
+- RSA PKCS#1 v1.5 decryption is inherently Bleichenbacher-prone. Use
+  OAEP.
+- X.509 validation covers RFC 5280 path rules and RFC 6125 hostnames,
+  but there is no revocation checking (no CRL or OCSP) and no name or
+  policy constraint enforcement. A critical extension whose semantics
+  are not enforced fails validation.
+- No TLS. That is a different and much larger problem.
+
+## Development
+
+    uv sync --group dev
+    make check
+
+License: 0BSD. Quad4 Software, https://quad4.io

purecrypt-0.1.1/SECURITY.md

@@ -0,0 +1,6 @@
+# Security policy
+
+Only the latest release is supported.
+
+Report vulnerabilities to security@quad4.io. Do not open public issues for
+security reports.

purecrypt-0.1.1/pyproject.toml

@@ -0,0 +1,111 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "purecrypt"
+dynamic = ["version"]
+description = "Pure-Python cryptographic primitives. No dependencies, no Rust. NOT READY FOR PRODUCTION."
+readme = "README.md"
+requires-python = ">=3.10"
+license = "0BSD"
+authors = [{ name = "Quad4" }]
+keywords = ["cryptography", "aes", "chacha20", "ed25519", "rsa", "pure-python"]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: BSD License",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Typing :: Typed",
+]
+dependencies = []
+
+[project.urls]
+Homepage = "https://quad4.io"
+Repository = "https://github.com/Quad4-Software/python-library-template"
+Issues = "https://github.com/Quad4-Software/python-library-template/issues"
+Changelog = "https://github.com/Quad4-Software/python-library-template/blob/master/CHANGELOG.md"
+
+[tool.hatch.version]
+path = "src/purecrypt/__init__.py"
+
+[dependency-groups]
+dev = [
+    "pytest>=9.1.1",
+    "pytest-cov>=7.1.0",
+    "ruff>=0.16.8",
+    "bandit>=1.9.4",
+    "mypy>=2.3.1",
+    "hypothesis>=6.168.0",
+    "ty>=0.0.83",
+]
+
+[tool.ruff]
+target-version = "py310"
+src = ["src", "tests"]
+
+[tool.ruff.lint]
+select = [
+    "E", "W",   # pycodestyle
+    "F",        # pyflakes
+    "I",        # isort
+    "N",        # pep8-naming
+    "UP",       # pyupgrade
+    "YTT",      # sys.version misuse
+    "FA",       # future annotations
+    "A",        # builtins shadowing
+    "B",        # flake8-bugbear
+    "BLE",      # blind except
+    "C4",       # comprehensions
+    "C90",      # mccabe complexity
+    "DTZ",      # timezone-aware datetimes
+    "ERA",      # commented-out code
+    "FURB",     # refurb
+    "G",        # logging format
+    "ICN",      # import conventions
+    "ISC",      # implicit string concat
+    "LOG",      # logging
+    "PERF",     # perflint
+    "PGH",      # pygrep hooks
+    "PIE",      # misc lints
+    "PT",       # pytest style
+    "PTH",      # pathlib
+    "RET",      # return
+    "RSE",      # raise/return
+    "S",        # bandit rules
+    "SIM",      # simplify
+    "SLOT",     # __slots__
+    "T20",      # print
+    "TRY",      # exception handling
+    "RUF",      # ruff-specific
+]
+ignore = [
+    "ISC001",  # single-line implicit concat conflicts with the formatter
+    "TRY003",  # long messages in raise calls are fine
+]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/*" = ["S101", "S603"]
+# Names intentionally mirror the cryptography package's exception API.
+"src/purecrypt/exceptions.py" = ["N818"]
+
+[tool.mypy]
+strict = true
+files = ["src", "tests"]
+
+[tool.bandit]
+exclude_dirs = ["tests"]
+
+[tool.coverage.run]
+branch = true
+source = ["src/purecrypt"]
+
+[tool.coverage.report]
+show_missing = true
+fail_under = 80
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+xfail_strict = true
+filterwarnings = ["error"]