secure-keystore 3.0.0__tar.gz

secure_keystore-3.0.0/.gitignore

@@ -0,0 +1,88 @@
+# ── Secrets and runtime data ─────────────────────────────────────────────────
+#
+# The one category in this repository that matters more than build output. A
+# keystore directory holds encrypted values, but a plaintext keys file holds the
+# real thing - and the whole point of the library is that neither ends up in a
+# commit.
+#
+# Not anchored to the root: a keystore written while running an example under
+# javascript/ or python/ must be ignored there too.
+.keystore/
+.keystore-*/
+*.skb
+*-backup-*.tar
+backups/
+
+# Plaintext input files, anchored to the root and to each implementation, so the
+# deliberately committed samples under */examples/ stay tracked.
+/keys.txt
+/keys.env
+/keys.json
+/*/keys.txt
+/*/keys.env
+/*/keys.json
+
+# ── JavaScript ───────────────────────────────────────────────────────────────
+node_modules/
+*/node_modules/
+javascript/dist/
+npm-debug.log*
+# npm auth. The publish token is read from the NPM_TOKEN environment variable.
+.npmrc
+
+# ── .NET ─────────────────────────────────────────────────────────────────────
+# Scoped to dotnet/, because javascript/bin holds the CLI entry point and is
+# meant to be committed.
+dotnet/**/bin/
+dotnet/**/obj/
+dotnet/**/TestResults/
+*.user
+
+# ── Python ───────────────────────────────────────────────────────────────────
+__pycache__/
+*.py[cod]
+python/build/
+python/dist/
+python/.venv/
+python/*.egg-info/
+# An editable install writes its metadata beside the package.
+python/src/*.egg-info/
+*.egg-link
+.pytest_cache/
+.ruff_cache/
+
+# ── PHP ──────────────────────────────────────────────────────────────────────
+# composer.lock is not committed: this is a library, and the lock file of a
+# library binds nobody.
+php/vendor/
+php/composer.lock
+php/.phpunit.cache/
+.phpunit.result.cache
+
+# ── Go ───────────────────────────────────────────────────────────────────────
+go/secure-keystore
+go/secure-keystore.exe
+go/**/testdata/fuzz/
+go/**/*.test
+go/coverage.out
+
+# ── Rust ─────────────────────────────────────────────────────────────────────
+# Cargo.lock is not committed, for the same reason as composer.lock.
+rust/target/
+rust/Cargo.lock
+rust/fuzz/target/
+rust/fuzz/corpus/
+rust/fuzz/artifacts/
+
+# ── Test artifacts ───────────────────────────────────────────────────────────
+# Tests write to the system temp directory, so this only catches the older
+# suites and anything run by hand.
+test-temp/
+coverage/
+
+# ── Editor and OS noise ──────────────────────────────────────────────────────
+.DS_Store
+Thumbs.db
+.vscode/
+.idea/
+*.log

secure_keystore-3.0.0/CHANGELOG.md

@@ -0,0 +1,74 @@
+# Changelog
+
+All notable changes to the Python implementation are recorded here. The
+format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the
+project uses [semantic versioning](https://semver.org/spec/v2.0.0.html).
+
+The **package version** and the **store format version** are separate numbers and
+move at different speeds — see [SPEC.md §11](../SPEC.md#11-versioning). This is
+package 3.0.0, writing store format 3.0.
+
+## [3.0.0] - 2026-10-13
+
+First release of the Python implementation.
+
+Written against [SPEC.md](../SPEC.md) rather than by reading another
+implementation — which is the rule that let six of them agree — and tested against
+the [shared conformance corpus](../conformance/), a set of fixtures the JavaScript
+implementation produced.
+
+**Not verified.** Written against the specification, but not yet run on a machine with a Python toolchain. See [ROADMAP.md §3](../ROADMAP.md#3-next--ci-across-all-six).
+
+### Added
+
+- `Keystore`, the store: `secure`, `get`, `get_all`, `set`, `migrate`,
+  `delete_key` and `delete_store`, in this language's spelling. A user key
+  unlocks a per-store master key; the master key unlocks each value under its own
+  salt.
+- **One password stretch per store open**, not one per value. The user key is
+  stretched with PBKDF2-HMAC-SHA256 at 600,000 rounds; value keys come from
+  HKDF-SHA256, because a master key is not a password and stretching it buys
+  nothing. See [SPEC.md §2.1](../SPEC.md#21-two-derivations-because-there-are-two-jobs).
+- **Every value bound to its key name**, as GCM additional authenticated data and
+  as HKDF context, so a value file moved to another key's name fails to decrypt.
+- Metadata without a user key: listing stores, listing keys, and store info. Key
+  names are not encrypted, which is what makes a store inspectable without a
+  password — and means a key name must not itself be a secret.
+- Export and import as one portable `.skb` bundle, with every name in it reduced
+  to its base name before writing, because a bundle is an untrusted file that
+  arrived over a wire.
+- Stateless value tokens: `encrypt_value` and `decrypt_value`, writing `skv2` and
+  reading both `skv2` and `skv1`. The iteration count is recorded in the token, so
+  a column encrypted cheaply and a single secret encrypted expensively both read
+  back.
+- Reading format 2.0 stores, and `migrate` to carry one across to 3.0. A 2.0 store
+  keeps taking 2.0 writes until it is migrated, so a store is never half one
+  format and half the other.
+- The three input formats — colon, dotenv and JSON — parseable from a string, with
+  no directory involved.
+- Errors carrying the codes in [SPEC.md §10](../SPEC.md#10-errors), identical in
+  every implementation.
+- A command line with the same verbs, flags and `--json` output as every other
+  implementation.
+- **Silence by default.** The library prints nothing unless given a logger, which
+  is what lets it drop into an application that has opinions about its own
+  logging.
+
+### Fixed before release
+
+- **The command line raised `UnicodeEncodeError` on any non-ASCII value.**
+  Python defaults stdout to the ANSI code page on Windows - cp1252 - so printing
+  a secret containing an emoji aborted the command rather than printing
+  anything. The library was correct throughout; it could store a secret it could
+  not show. stdout and stderr are now reconfigured to UTF-8. Found by
+  [`cross-test.mjs`](../conformance/cross-test.mjs).
+
+### Notes specific to Python
+
+- `cryptography` for PBKDF2HMAC, HKDF and AESGCM — the one dependency.
+- `AESGCM` accepts both the 12-byte nonce 3.0 uses and the 16-byte one 2.0 wrote, so reading a legacy store needs no special case.
+- `AESGCM.encrypt` appends the tag to the ciphertext; the format stores them as separate hex fields, so the last 16 bytes are split off.
+- Full type hints and a `py.typed` marker.
+- The whole `master.json` document is kept, so unknown fields survive a rewrite.
+
+[3.0.0]: https://github.com/eharain/secure-keystore/releases/tag/python%2Fv3.0.0

secure_keystore-3.0.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Tech Style Ltd
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

secure_keystore-3.0.0/PKG-INFO

@@ -0,0 +1,222 @@
+Metadata-Version: 2.5
+Name: secure-keystore
+Version: 3.0.0
+Summary: Encrypted secrets at rest for Python, with no service to run. Two-layer AES-256-GCM over PBKDF2-SHA256 and HKDF-SHA256, with a documented cross-language format.
+Project-URL: Homepage, https://tech-style.co/
+Project-URL: Repository, https://github.com/eharain/secure-keystore
+Project-URL: Issues, https://github.com/eharain/secure-keystore/issues
+Project-URL: Changelog, https://github.com/eharain/secure-keystore/blob/main/python/CHANGELOG.md
+Author-email: Ejaz Hussain Arain <hello@tech-style.co>
+Maintainer-email: Tech Style Ltd <hello@tech-style.co>
+License: MIT
+License-File: LICENSE
+Keywords: aes-gcm,ci-cd,configuration,credentials,devops,dotenv,encryption,encryption-at-rest,hkdf,keystore,pbkdf2,secret-management,secrets,vault
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Topic :: Security :: Cryptography
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Classifier: Typing :: Typed
+Requires-Python: >=3.10
+Requires-Dist: cryptography>=41.0
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0; extra == 'dev'
+Description-Content-Type: text/markdown
+
+# secure-keystore — Python
+
+**Encrypted secrets at rest, with no service to run.** One dependency:
+[`cryptography`](https://cryptography.io/).
+
+[![PyPI](https://img.shields.io/badge/pypi-secure--keystore-3775A9.svg)](https://pypi.org/project/secure-keystore/)
+[![Python](https://img.shields.io/badge/python-3.10%2B-3776AB.svg)](https://www.python.org/)
+[![licence](https://img.shields.io/badge/licence-MIT-blue.svg)](LICENSE)
+[![format](https://img.shields.io/badge/format-3.0-6366f1.svg)](../SPEC.md)
+
+```bash
+pip install secure-keystore
+```
+
+```python
+import os
+from secure_keystore import Keystore
+
+store = Keystore()
+store.secure("./keys.env", os.environ["USER_KEY"], "production")
+api_key = store.get("api_key", os.environ["USER_KEY"], "production")
+```
+
+This is one of [six implementations](../README.md#one-format-six-languages) of the
+[secure-keystore format](../SPEC.md). A store written here opens in the
+JavaScript, Go, .NET, PHP and Rust ones, and the other way round — which is not a
+claim but [a test](tests/test_conformance.py) against a corpus the JavaScript
+implementation produced, and against
+[`cross-test.mjs`](../conformance/cross-test.mjs), where all six write stores and
+all six read every one of them.
+
+---
+
+## Two ways in
+
+**A store** — a directory of encrypted values that one user key opens.
+
+**A token** — one string in, one string out, nothing on disk.
+
+```python
+from secure_keystore import encrypt_value, decrypt_value
+
+token = encrypt_value("sk_live_abc123", user_key)
+back = decrypt_value(token, user_key)
+```
+
+---
+
+## API
+
+### `Keystore(keystore_dir=None, *, iterations=600_000, logger=None, create_dir=True)`
+
+Binds one keystore directory and one set of options, validated once here rather
+than on every call. The instance holds no secret: the user key is passed to each
+call that needs one and is never retained.
+
+| Argument | Default | |
+|---|---|---|
+| `keystore_dir` | `./.keystore` | Where stores live. |
+| `iterations` | `600000` | PBKDF2 rounds for the *user key*, on new and migrated stores. Recorded in the store. Does not apply to value keys, which use HKDF. |
+| `logger` | `None` | Called with one line of progress. **None means the package prints nothing** — the default, and what a server wants. |
+| `create_dir` | `True` | Create the keystore directory if absent. |
+
+### Store operations
+
+```python
+store.secure(input_file, user_key, store_name=None) -> SecureResult
+store.get(key, user_key, store_name=None) -> str
+store.get_all(user_key, store_name) -> dict[str, str]
+store.set(key, value, user_key, store_name) -> SetResult
+store.migrate(store_name, user_key) -> MigrateResult
+store.delete_key(key, store_name) -> None
+store.delete_store(store_name) -> None
+```
+
+`get_all` costs **one** PBKDF2 derivation however many keys the store holds — see
+[SPEC.md §2.1](../SPEC.md#21-two-derivations-because-there-are-two-jobs).
+
+### Metadata — no user key needed
+
+```python
+store.list_stores() -> list[str]
+store.list_keys(store_name) -> list[str]
+store.get_store_info(store_name) -> StoreInfo
+```
+
+Key names live in metadata in the clear, so **a key name must not itself be a
+secret**.
+
+### Bundles and tokens
+
+```python
+store.export_store(store_name, backup_path=None) -> str
+store.import_store(backup_path, store_name=None) -> str
+
+encrypt_value(plaintext, user_key, *, iterations=None) -> str | None
+decrypt_value(token, user_key) -> str
+is_encrypted_value(value) -> bool
+token_version(value) -> str | None
+```
+
+`iterations` lowers the cost for bulk work — a token pays one stretch **per
+value**, unlike a store. The count is recorded in the token, so decryption
+follows whatever was chosen.
+
+---
+
+## Errors
+
+Every failure is a `KeystoreError` with a stable `.code`:
+
+```python
+from secure_keystore import ErrorCodes, KeystoreError
+
+try:
+    store.get("api_key", user_key, "production")
+except KeystoreError as error:
+    if error.code == ErrorCodes.BAD_USER_KEY:
+        ...   # wrong password, tampered bytes, or a mismatched context
+    if error.code == ErrorCodes.STORE_NOT_FOUND:
+        ...   # not deployed yet
+```
+
+The codes are identical in all six implementations —
+[SPEC.md §10](../SPEC.md#10-errors). A wrong user key would otherwise surface as
+`cryptography.exceptions.InvalidTag`, which names neither the store nor the
+reason.
+
+---
+
+## Notes specific to Python
+
+**`AESGCM` handles both nonce lengths.** `cryptography` accepts a 16-byte nonce as
+well as the 12-byte one format 3.0 uses, so reading a format 2.0 store needs no
+special case here — unlike .NET, where it needs a whole GCM implementation. Do not
+let that make the 16-byte IV look fine; see
+[ROADMAP.md §1.1](../ROADMAP.md#11-a-12-byte-iv).
+
+**`AESGCM.encrypt` appends the tag** to the ciphertext; the format stores them as
+separate hex fields, so the last 16 bytes are split off.
+
+**Type hints throughout**, and a `py.typed` marker, so `mypy` sees the API.
+
+**Ordering.** `entries` is a list and stays one; `dict` preserves insertion order
+in the versions this supports, so a parsed input file keeps the document's key
+order.
+
+---
+
+## The CLI
+
+```bash
+secure-keystore get api_key "$USER_KEY" production
+python -m secure_keystore --help          # the same thing, without the entry point
+```
+
+Same verbs, flags, error codes and `--json` output as every other
+implementation — see the [root README](../README.md#the-cli).
+
+---
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest                      # includes the shared corpus
+```
+
+```
+python/
+├── src/secure_keystore/
+│   ├── __init__.py       the public surface, and ALGORITHMS
+│   ├── _format.py        everything the format fixes
+│   ├── errors.py         KeystoreError and its codes
+│   ├── _crypto.py        PBKDF2, HKDF, AES-GCM — the only place a cipher is built
+│   ├── token.py          the stateless skv2 token
+│   ├── input_file.py     the three input formats, testable without a file
+│   ├── bundle.py         the .skb bundle
+│   ├── keystore.py       the store itself
+│   └── cli.py
+└── tests/
+```
+
+## Further reading
+
+- **[../SPEC.md](../SPEC.md)** — the format, in enough detail to implement it
+- **[../conformance/](../conformance/)** — how cross-language compatibility is tested
+- **[CHANGELOG.md](CHANGELOG.md)**
+
+## Licence
+
+MIT © [Tech Style Ltd](https://tech-style.co/)

secure_keystore-3.0.0/README.md

@@ -0,0 +1,192 @@
+# secure-keystore — Python
+
+**Encrypted secrets at rest, with no service to run.** One dependency:
+[`cryptography`](https://cryptography.io/).
+
+[![PyPI](https://img.shields.io/badge/pypi-secure--keystore-3775A9.svg)](https://pypi.org/project/secure-keystore/)
+[![Python](https://img.shields.io/badge/python-3.10%2B-3776AB.svg)](https://www.python.org/)
+[![licence](https://img.shields.io/badge/licence-MIT-blue.svg)](LICENSE)
+[![format](https://img.shields.io/badge/format-3.0-6366f1.svg)](../SPEC.md)
+
+```bash
+pip install secure-keystore
+```
+
+```python
+import os
+from secure_keystore import Keystore
+
+store = Keystore()
+store.secure("./keys.env", os.environ["USER_KEY"], "production")
+api_key = store.get("api_key", os.environ["USER_KEY"], "production")
+```
+
+This is one of [six implementations](../README.md#one-format-six-languages) of the
+[secure-keystore format](../SPEC.md). A store written here opens in the
+JavaScript, Go, .NET, PHP and Rust ones, and the other way round — which is not a
+claim but [a test](tests/test_conformance.py) against a corpus the JavaScript
+implementation produced, and against
+[`cross-test.mjs`](../conformance/cross-test.mjs), where all six write stores and
+all six read every one of them.
+
+---
+
+## Two ways in
+
+**A store** — a directory of encrypted values that one user key opens.
+
+**A token** — one string in, one string out, nothing on disk.
+
+```python
+from secure_keystore import encrypt_value, decrypt_value
+
+token = encrypt_value("sk_live_abc123", user_key)
+back = decrypt_value(token, user_key)
+```
+
+---
+
+## API
+
+### `Keystore(keystore_dir=None, *, iterations=600_000, logger=None, create_dir=True)`
+
+Binds one keystore directory and one set of options, validated once here rather
+than on every call. The instance holds no secret: the user key is passed to each
+call that needs one and is never retained.
+
+| Argument | Default | |
+|---|---|---|
+| `keystore_dir` | `./.keystore` | Where stores live. |
+| `iterations` | `600000` | PBKDF2 rounds for the *user key*, on new and migrated stores. Recorded in the store. Does not apply to value keys, which use HKDF. |
+| `logger` | `None` | Called with one line of progress. **None means the package prints nothing** — the default, and what a server wants. |
+| `create_dir` | `True` | Create the keystore directory if absent. |
+
+### Store operations
+
+```python
+store.secure(input_file, user_key, store_name=None) -> SecureResult
+store.get(key, user_key, store_name=None) -> str
+store.get_all(user_key, store_name) -> dict[str, str]
+store.set(key, value, user_key, store_name) -> SetResult
+store.migrate(store_name, user_key) -> MigrateResult
+store.delete_key(key, store_name) -> None
+store.delete_store(store_name) -> None
+```
+
+`get_all` costs **one** PBKDF2 derivation however many keys the store holds — see
+[SPEC.md §2.1](../SPEC.md#21-two-derivations-because-there-are-two-jobs).
+
+### Metadata — no user key needed
+
+```python
+store.list_stores() -> list[str]
+store.list_keys(store_name) -> list[str]
+store.get_store_info(store_name) -> StoreInfo
+```
+
+Key names live in metadata in the clear, so **a key name must not itself be a
+secret**.
+
+### Bundles and tokens
+
+```python
+store.export_store(store_name, backup_path=None) -> str
+store.import_store(backup_path, store_name=None) -> str
+
+encrypt_value(plaintext, user_key, *, iterations=None) -> str | None
+decrypt_value(token, user_key) -> str
+is_encrypted_value(value) -> bool
+token_version(value) -> str | None
+```
+
+`iterations` lowers the cost for bulk work — a token pays one stretch **per
+value**, unlike a store. The count is recorded in the token, so decryption
+follows whatever was chosen.
+
+---
+
+## Errors
+
+Every failure is a `KeystoreError` with a stable `.code`:
+
+```python
+from secure_keystore import ErrorCodes, KeystoreError
+
+try:
+    store.get("api_key", user_key, "production")
+except KeystoreError as error:
+    if error.code == ErrorCodes.BAD_USER_KEY:
+        ...   # wrong password, tampered bytes, or a mismatched context
+    if error.code == ErrorCodes.STORE_NOT_FOUND:
+        ...   # not deployed yet
+```
+
+The codes are identical in all six implementations —
+[SPEC.md §10](../SPEC.md#10-errors). A wrong user key would otherwise surface as
+`cryptography.exceptions.InvalidTag`, which names neither the store nor the
+reason.
+
+---
+
+## Notes specific to Python
+
+**`AESGCM` handles both nonce lengths.** `cryptography` accepts a 16-byte nonce as
+well as the 12-byte one format 3.0 uses, so reading a format 2.0 store needs no
+special case here — unlike .NET, where it needs a whole GCM implementation. Do not
+let that make the 16-byte IV look fine; see
+[ROADMAP.md §1.1](../ROADMAP.md#11-a-12-byte-iv).
+
+**`AESGCM.encrypt` appends the tag** to the ciphertext; the format stores them as
+separate hex fields, so the last 16 bytes are split off.
+
+**Type hints throughout**, and a `py.typed` marker, so `mypy` sees the API.
+
+**Ordering.** `entries` is a list and stays one; `dict` preserves insertion order
+in the versions this supports, so a parsed input file keeps the document's key
+order.
+
+---
+
+## The CLI
+
+```bash
+secure-keystore get api_key "$USER_KEY" production
+python -m secure_keystore --help          # the same thing, without the entry point
+```
+
+Same verbs, flags, error codes and `--json` output as every other
+implementation — see the [root README](../README.md#the-cli).
+
+---
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest                      # includes the shared corpus
+```
+
+```
+python/
+├── src/secure_keystore/
+│   ├── __init__.py       the public surface, and ALGORITHMS
+│   ├── _format.py        everything the format fixes
+│   ├── errors.py         KeystoreError and its codes
+│   ├── _crypto.py        PBKDF2, HKDF, AES-GCM — the only place a cipher is built
+│   ├── token.py          the stateless skv2 token
+│   ├── input_file.py     the three input formats, testable without a file
+│   ├── bundle.py         the .skb bundle
+│   ├── keystore.py       the store itself
+│   └── cli.py
+└── tests/
+```
+
+## Further reading
+
+- **[../SPEC.md](../SPEC.md)** — the format, in enough detail to implement it
+- **[../conformance/](../conformance/)** — how cross-language compatibility is tested
+- **[CHANGELOG.md](CHANGELOG.md)**
+
+## Licence
+
+MIT © [Tech Style Ltd](https://tech-style.co/)

secure_keystore-3.0.0/pyproject.toml

@@ -0,0 +1,54 @@
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[project]
+name = "secure-keystore"
+version = "3.0.0"
+description = "Encrypted secrets at rest for Python, with no service to run. Two-layer AES-256-GCM over PBKDF2-SHA256 and HKDF-SHA256, with a documented cross-language format."
+readme = "README.md"
+license = { text = "MIT" }
+requires-python = ">=3.10"
+authors = [{ name = "Ejaz Hussain Arain", email = "hello@tech-style.co" }]
+maintainers = [{ name = "Tech Style Ltd", email = "hello@tech-style.co" }]
+keywords = [
+    "encryption", "secrets", "secret-management", "keystore", "credentials",
+    "vault", "aes-gcm", "pbkdf2", "hkdf", "dotenv", "configuration",
+    "encryption-at-rest", "devops", "ci-cd",
+]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Topic :: Security :: Cryptography",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+    "Typing :: Typed",
+]
+dependencies = ["cryptography>=41.0"]
+
+[project.urls]
+Homepage = "https://tech-style.co/"
+Repository = "https://github.com/eharain/secure-keystore"
+Issues = "https://github.com/eharain/secure-keystore/issues"
+Changelog = "https://github.com/eharain/secure-keystore/blob/main/python/CHANGELOG.md"
+
+[project.scripts]
+secure-keystore = "secure_keystore.cli:main"
+
+[project.optional-dependencies]
+dev = ["pytest>=7.0"]
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/secure_keystore"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+
+[tool.ruff]
+line-length = 100
+target-version = "py310"