Skip to content

Conversation

achamayou
Copy link
Member

@achamayou achamayou commented Jul 23, 2025

It is not ideal that we depend on pycose, even if it's just for tests, because:

  1. It uses python-ecdsa (https://github.com/tlsfuzzer/python-ecdsa), which is slow and not meant to be used in production
  2. It has not had a release since November 2022

Luckily, python-cwt (https://github.com/dajiaji/python-cwt) suffers from neither problem, and offers substantially better coverage of COSE-related RFCs as well. It looks like a better bet for tooling and testing, and since it is released regularly, something we can hopefully contribute to - for example COSE Receipt verification.

@achamayou achamayou changed the title WIP: move to python-cwt Replace pycose with python-cwt Aug 28, 2025
@achamayou achamayou marked this pull request as ready for review August 28, 2025 16:22
@achamayou achamayou requested a review from a team as a code owner August 28, 2025 16:22
@achamayou achamayou added this pull request to the merge queue Sep 1, 2025
Merged via the queue into microsoft:main with commit 649d063 Sep 1, 2025
18 checks passed
@achamayou achamayou deleted the pycose_to_cwt branch September 1, 2025 10:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants