python-nss-ng 1.2.1__tar.gz → 1.3.0__tar.gz

python_nss_ng-1.3.0/.aislop/config.yml

@@ -0,0 +1,20 @@
+# SPDX-License-Identifier: MPL-2.0
+# SPDX-FileCopyrightText: 2025 The Linux Foundation
+
+# aislop quality gate configuration.
+#
+# The repository scans clean, so hold `aislop ci` at the strictest
+# score the tool offers rather than the default 70.
+#
+# Note the limit of a score gate: aislop normalises the score by file
+# count and rounds it, so a single low-weight finding (a stray
+# python-formatting warning, say) still rounds to 100 and passes.
+# Failing on any finding at all needs a step that gates on the
+# diagnostic count in `aislop scan --json`, not on the score.
+#
+# The C sources under src/ come from upstream python-nss; they carry
+# narrow, per-rule `aislop-ignore-file` directives in place of a blanket
+# exclusion, so every other rule (including the security engine) still
+# runs against them.
+ci:
+  failBelow: 100

python_nss_ng-1.3.0/.git_archival.txt

@@ -0,0 +1,4 @@
+node: f3dfb2874779585519dc97dd4abd7cebd22b8814
+node-date: 2026-08-18T15:12:11+01:00
+describe-name: v1.3.0
+ref-names: grafted, HEAD, tag: v1.3.0, origin/main, origin/HEAD

{python_nss_ng-1.2.1 → python_nss_ng-1.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-nss-ng
-Version: 1.2.1
+Version: 1.3.0
 Summary: Python bindings for Network Security Services (NSS) and Netscape Portable Runtime (NSPR)
 Keywords: nss,nspr,cryptography,ssl,tls,pki,x509,security
 Author-Email: John Dennis <jdennis@redhat.com>, Matthew Watkins <mwatkins@linuxfoundation.org>

python_nss_ng-1.3.0/_version.txt

@@ -0,0 +1 @@
+1.3.0

{python_nss_ng-1.2.1 → python_nss_ng-1.3.0}/pyproject.toml

@@ -319,9 +319,3 @@ before-all = "yum install -y nss-devel nspr-devel pkg-config || apt-get update &
 
 [tool.cibuildwheel.macos]
 before-all = "brew install nss nspr pkg-config"
-
-[tool.uv]
-# Supply-chain cooldown: do not resolve anything published in the last
-# 7 days (rolling window; uv records it as a relative span in uv.lock).
-# Requires uv >= 0.9.17 for the relative-duration ("7 days") form.
-exclude-newer = "7 days"

{python_nss_ng-1.2.1 → python_nss_ng-1.3.0}/src/__init__.py

@@ -4,6 +4,8 @@
 # SPDX-License-Identifier: MPL-2.0
 # SPDX-FileCopyrightText: Copyright (c) 2010-2025 python-nss-ng contributors
 
+# aislop-ignore-file ai-slop/unused-import -- "import" lines flagged here are RST code examples inside a documentation string, not real imports (ruff F401 validates the real ones)
+
 import sys
 from importlib.metadata import PackageNotFoundError
 from importlib.metadata import version as _pkg_version
@@ -154,7 +156,6 @@ Things All NSS programs must do
 
 - Import the NSS/NSPR modules::
 
-    from nss.error import NSPRError
     import nss.io as io
     import nss.nss as nss
     import nss.ssl as ssl

{python_nss_ng-1.2.1 → python_nss_ng-1.3.0}/src/nss_context.py

@@ -29,6 +29,8 @@ import logging
 from collections.abc import Callable, Generator
 from typing import Any
 
+# aislop-ignore-file ai-slop/hallucinated-import -- "nss" is this package's own compiled C-extension module (built from py_nss.c)
+
 logger = logging.getLogger(__name__)
 
 

{python_nss_ng-1.2.1 → python_nss_ng-1.3.0}/src/py_nspr_error.h

@@ -5,6 +5,8 @@
  * SPDX-FileCopyrightText: Copyright (c) 2010-2025 python-nss-ng contributors
  */
 
+// aislop-ignore-file ai-slop/todo-stub -- maintainer notes carried from upstream python-nss
+
 #ifndef NSS_ERROR_MODULE_H
 #define NSS_ERROR_MODULE_H
 

{python_nss_ng-1.2.1 → python_nss_ng-1.3.0}/src/py_nspr_io.c

@@ -5,6 +5,10 @@
  * SPDX-FileCopyrightText: Copyright (c) 2010-2025 python-nss-ng contributors
  */
 
+// aislop-ignore-file ai-slop/todo-stub -- maintainer notes carried from upstream python-nss
+// aislop-ignore-file ai-slop/unreachable-code -- goto targets and the break after return in switch cases
+// aislop-ignore-file complexity/file-too-large -- upstream extension module is a single translation unit
+
 // FIXME: add detail to each set_nspr_error()
 // FIXME: should nspr exception be derived from IOError? Note our detail is IOError's filename
 // FIXME: add factory functions for TCPSocket, UDPSocket

{python_nss_ng-1.2.1 → python_nss_ng-1.3.0}/src/py_nspr_io.h

@@ -5,6 +5,9 @@
  * SPDX-FileCopyrightText: Copyright (c) 2010-2025 python-nss-ng contributors
  */
 
+// aislop-ignore-file ai-slop/todo-stub -- maintainer notes carried from upstream python-nss
+// aislop-ignore-file ai-slop/trivial-comment -- upstream decorative section banners
+
 #ifndef NSS_IO_MODULE_H
 #define NSS_IO_MODULE_H
 

{python_nss_ng-1.2.1 → python_nss_ng-1.3.0}/src/py_nss.c

@@ -5,6 +5,10 @@
  * SPDX-FileCopyrightText: Copyright (c) 2010-2025 python-nss-ng contributors
  */
 
+// aislop-ignore-file ai-slop/todo-stub -- maintainer notes carried from upstream python-nss
+// aislop-ignore-file ai-slop/unreachable-code -- goto targets and the break after return in switch cases
+// aislop-ignore-file complexity/file-too-large -- upstream extension module is a single translation unit
+
 #if 0
 
 //Template for new classes

{python_nss_ng-1.2.1 → python_nss_ng-1.3.0}/src/py_nss.h

@@ -5,6 +5,8 @@
  * SPDX-FileCopyrightText: Copyright (c) 2010-2025 python-nss-ng contributors
  */
 
+// aislop-ignore-file ai-slop/todo-stub -- maintainer notes carried from upstream python-nss
+
 // FIXME: some of these class types have items in them with arenas, but we can't hold a reference
 //        to an arena, so check to make sure we copy the items out and don't store the
 //        the item with the arena in it.

{python_nss_ng-1.2.1 → python_nss_ng-1.3.0}/src/py_ssl.c

@@ -5,6 +5,10 @@
  * SPDX-FileCopyrightText: Copyright (c) 2010-2025 python-nss-ng contributors
  */
 
+// aislop-ignore-file ai-slop/todo-stub -- maintainer notes carried from upstream python-nss
+// aislop-ignore-file ai-slop/unreachable-code -- goto targets and the break after return in switch cases
+// aislop-ignore-file complexity/file-too-large -- upstream extension module is a single translation unit
+
 // FIXME: sometimes in the API dist_name is used and sometimes ca_name, make consistent.
 // FIXME: PyIntObjects represent their value as a long, but in many places we declared their C representation as
 //        as int, we should change it to long, and at the same time match the parameters used in the NSPR/NSS API

{python_nss_ng-1.2.1 → python_nss_ng-1.3.0}/src/py_ssl.h

@@ -5,6 +5,8 @@
  * SPDX-FileCopyrightText: Copyright (c) 2010-2025 python-nss-ng contributors
  */
 
+// aislop-ignore-file ai-slop/todo-stub -- maintainer notes carried from upstream python-nss
+
 #ifndef NSS_SSL_MODULE_H
 #define NSS_SSL_MODULE_H
 

{python_nss_ng-1.2.1 → python_nss_ng-1.3.0}/src/secure_logging.py

@@ -127,7 +127,6 @@ def check_message_safety(message: str) -> LogSensitivity:
     """
     message_lower = message.lower()
 
-    # Check for forbidden patterns
     for pattern in FORBIDDEN_LOG_PATTERNS:
         if pattern in message_lower:
             return LogSensitivity.SENSITIVE
@@ -272,7 +271,6 @@ def log_exception_safely(
         # Log only the exception type and context
         msg = f"{context}: {exc_type} occurred (details redacted for security)"
     elif sensitivity == LogSensitivity.REDACTED:
-        # Log with redaction
         msg = f"{context}: {exc_type}: {redact_message(exc_message)}"
     else:
         # Safe to log
@@ -329,23 +327,20 @@ class SecureExceptionHandler:
 
     def __exit__(self, exc_type, exc_val, exc_tb):
         if exc_type is not None:
-            # Log the exception securely
+
             def logger_fn(msg: str) -> None:
                 self.logger.log(self.log_level, msg)
 
             log_exception_safely(logger_fn, exc_val, self.context)
 
-            # Return False to re-raise, True to suppress
             return not self.reraise
         return None
 
 
 # Example usage patterns
 if __name__ == "__main__":
-    # Configure logging
     logging.basicConfig(level=logging.DEBUG)
 
-    # Create secure logger
     logger = get_secure_logger(__name__)
 
     # Safe logging

{python_nss_ng-1.2.1 → python_nss_ng-1.3.0}/test/test_documentation_accuracy.py

@@ -335,19 +335,11 @@ class TestDocumentationCompleteness:
         if not doc_dir.exists():
             pytest.skip("doc directory not found")
 
-        # Look for testing-related docs
-        md_files = list(doc_dir.glob("*.md"))
-        filenames = [f.name.lower() for f in md_files]
-
-        # Should have some testing documentation
-        has_test_docs = any("test" in name for name in filenames)
+        filenames = sorted(path.name.lower() for path in doc_dir.glob("*.md"))
 
-        # This is a soft requirement
-        if has_test_docs:
-            assert True
-        else:
-            # Just document that test docs are recommended
-            pass
+        assert any("test" in name for name in filenames), (
+            f"doc/ should document the test suite, found: {filenames}"
+        )
 
     def test_api_reference_or_stubs_exist(self):
         """Test that API reference or type stubs exist."""

{python_nss_ng-1.2.1 → python_nss_ng-1.3.0}/test/test_performance.py

@@ -180,6 +180,7 @@ class TestMemoryUsage:
 
         # Force garbage collection
         gc.collect()
+        baseline_blocks = sys.getallocatedblocks()
 
         # Perform many digest operations
         for _ in range(iterations):
@@ -189,8 +190,11 @@ class TestMemoryUsage:
         # Force garbage collection
         gc.collect()
 
-        # Memory should be stable (hard to test directly, but shouldn't crash)
-        assert True
+        # sha256_digest returns bytes, which the cyclic GC does not track, so
+        # count CPython allocator blocks instead: a retained result costs one
+        # block per iteration. Native NSS allocations stay invisible here.
+        growth = sys.getallocatedblocks() - baseline_blocks
+        assert growth < iterations // 10, f"Digest operations leaked {growth} blocks"
 
     @pytest.mark.slow
     def test_certificate_reference_memory(self, nss_db_context):
@@ -199,6 +203,7 @@ class TestMemoryUsage:
 
         # Force garbage collection
         gc.collect()
+        baseline_blocks = sys.getallocatedblocks()
 
         for _ in range(iterations):
             try:
@@ -213,8 +218,10 @@ class TestMemoryUsage:
         # Force garbage collection
         gc.collect()
 
-        # Should not crash or leak
-        assert True
+        # CertificateType carries no Py_TPFLAGS_HAVE_GC, so a retained wrapper
+        # never reaches gc.get_objects(); it does cost an allocator block.
+        growth = sys.getallocatedblocks() - baseline_blocks
+        assert growth < iterations // 10, f"Certificate lookups leaked {growth} blocks"
 
     @pytest.mark.slow
     def test_digest_context_memory(self, nss_db_context):
@@ -223,6 +230,7 @@ class TestMemoryUsage:
 
         # Force garbage collection
         gc.collect()
+        baseline_blocks = sys.getallocatedblocks()
 
         for _ in range(iterations):
             context = nss.create_digest_context(nss.SEC_OID_SHA256)
@@ -235,8 +243,10 @@ class TestMemoryUsage:
         # Force garbage collection
         gc.collect()
 
-        # Should not leak
-        assert True
+        # PK11ContextType is likewise untracked by the cyclic GC; the allocator
+        # block count still rises by one per retained context.
+        growth = sys.getallocatedblocks() - baseline_blocks
+        assert growth < iterations // 10, f"Digest contexts leaked {growth} blocks"
 
 
 class TestStressConditions:
@@ -268,18 +278,17 @@ class TestStressConditions:
     def test_rapid_context_creation_destruction(self, nss_db_context):
         """Test rapid creation and destruction of contexts."""
         iterations = 500
+        expected = nss.sha256_digest(b"test")
 
         for _ in range(iterations):
             context = nss.create_digest_context(nss.SEC_OID_SHA256)
             context.digest_begin()
             context.digest_op(b"test")
             digest = context.digest_final()
-            assert digest is not None
+            # Rapid churn must not carry state between contexts
+            assert digest == expected
             # Context destroyed immediately
 
-        # Should handle rapid churn
-        assert True
-
     @pytest.mark.slow
     def test_large_data_chunks(self, nss_db_context):
         """Test processing very large data."""
@@ -296,13 +305,11 @@ class TestStressConditions:
         """Test many small operations in sequence."""
         iterations = 5000
         test_data = b"small"
+        expected = nss.sha256_digest(test_data)
 
         for _ in range(iterations):
             digest = nss.sha256_digest(test_data)
-            assert digest is not None
-
-        # Should handle many small operations
-        assert True
+            assert digest == expected
 
 
 class TestConcurrentPerformance:

{python_nss_ng-1.2.1 → python_nss_ng-1.3.0}/test/test_platform_specific.py

@@ -12,6 +12,7 @@ import os
 import platform
 import subprocess
 import sys
+import sysconfig
 import tempfile
 
 import pytest
@@ -439,9 +440,8 @@ class TestCrossPlatformCompatibility:
         # Windows: .exe
         if sys.platform.startswith("win"):
             pytest.skip("Windows not supported")
-        else:
-            # Unix systems don't require extension
-            assert True
+
+        assert sysconfig.get_config_var("EXE") == ""
 
 
 if __name__ == "__main__":

{python_nss_ng-1.2.1 → python_nss_ng-1.3.0}/test/test_type_hints.py

@@ -52,12 +52,13 @@ class TestTypeHints:
     def test_mypy_available(self):
         """Test if mypy is available for type checking."""
         try:
-            import mypy
-
-            assert True  # mypy is available
+            import mypy.api
         except ImportError:
             pytest.skip("mypy not installed - install with: pip install mypy")
 
+        # The stub validation below drives mypy through this entry point
+        assert callable(mypy.api.run)
+
     @pytest.mark.skipif(sys.version_info < (3, 8), reason="Type hints require Python 3.8+")
     def test_mypy_validates_stubs(self, stub_files):
         """Test that mypy validates stub files without errors."""
@@ -156,11 +157,12 @@ class TestPythonModuleHints:
 
         try:
             import nss_context
-
-            assert True
         except ImportError:
             pytest.fail("nss_context module not found")
 
+        assert hasattr(nss_context, "NSSContext")
+        assert hasattr(nss_context, "nss_context")
+
     def test_deprecations_has_hints(self):
         """Test that deprecations.py has type hints."""
         sys.path.insert(0, "src")

{python_nss_ng-1.2.1 → python_nss_ng-1.3.0}/uv.lock

@@ -9,10 +9,6 @@ resolution-markers = [
     "python_full_version < '3.12'",
 ]
 
-[options]
-exclude-newer = "0001-01-01T00:00:00Z" # This has no effect and is included for backwards compatibility when using relative exclude-newer values.
-exclude-newer-span = "P7D"
-
 [[package]]
 name = "ast-serialize"
 version = "0.3.0"

python_nss_ng-1.2.1/.git_archival.txt

@@ -1,4 +0,0 @@
-node: 0dedcdfba5bdf88fee5c42918949cb6403738886
-node-date: 2026-06-30T09:23:01-06:00
-describe-name: v1.2.1
-ref-names: grafted, HEAD, tag: v1.2.1, origin/main, origin/HEAD

python_nss_ng-1.2.1/_version.txt

@@ -1 +0,0 @@
-1.2.1