PostQuantum.FileFormat/.github/workflows/python-binding.yml at main · systemslibrarian/PostQuantum.FileFormat · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
name: Python binding

on:
  push:
    paths:
      - "bindings/python/**"
      - "impl/rust/pqf-reader/**"
      - ".github/workflows/python-binding.yml"
  pull_request:
    paths:
      - "bindings/python/**"
      - "impl/rust/pqf-reader/**"
      - ".github/workflows/python-binding.yml"

permissions:
  contents: read

jobs:
  build:
    name: Build + smoke (${{ matrix.os }} / py${{ matrix.python }})
    runs-on: ${{ matrix.os }}
    strategy:
      fail-fast: false
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
        python: ["3.9", "3.12"]
    steps:
      - name: Checkout
        uses: actions/checkout@v6

      - name: Set up Python ${{ matrix.python }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python }}

      - name: Install Rust (stable)
        uses: dtolnay/rust-toolchain@stable

      - name: Cache Cargo
        uses: actions/cache@v5
        with:
          path: |
            ~/.cargo/registry
            ~/.cargo/git
            bindings/python/target
            impl/rust/pqf-reader/target
          key: ${{ runner.os }}-py${{ matrix.python }}-cargo-${{ hashFiles('bindings/python/Cargo.toml', 'impl/rust/pqf-reader/Cargo.toml') }}

      - name: Install maturin
        run: pip install --upgrade pip maturin

      - name: Build + install the binding into the venv
        working-directory: bindings/python
        run: maturin develop --release

      - name: Smoke test (import + parse a vector)
        working-directory: bindings/python
        shell: bash
        run: |
          python - <<'PY'
          import pqf, json, pathlib
          repo = pathlib.Path("../..").resolve()
          # Pick the first positive test vector.
          path = repo / "test-vectors" / "v1" / "cases" / "TV-001.pqf"
          blob = path.read_bytes()
          header = pqf.parse_header(blob)
          assert header["alg"]["kem"] == "x25519+ml-kem-768", header
          assert header["alg"]["combiner"] == "x-wing"
          assert len(header["recipients"]) >= 1
          print("OK: pqf.parse_header round-trips on TV-001")

          # Now decrypt with the manifest identity.
          manifest = json.loads((repo / "test-vectors" / "v1" / "manifest.json").read_text())
          ident_a = manifest["Identities"][0]
          identity = pqf.Identity.from_manifest(
              ident_a["Id"],
              ident_a["PublicKey"],
              ident_a["X25519PrivateKey"],
              ident_a["MlKem768PrivateKey"],
          )
          plaintext = pqf.decrypt(blob, identity)
          assert len(plaintext) > 0
          print(f"OK: pqf.decrypt produced {len(plaintext)} bytes")
          PY