PySigner

[meejah]

It seems the PySigner class should maybe be exported?

It is used by e.g. sign() but there's no way to refer to it.

[wiktor-k]

Hi! 👋

🤔 even if it were exported there would be no way to construct it... is there a specific use-case you're missing? (I hope you're not thinking of using this library via Rust interface which is totally not supported 😅 ).

[meejah]

Perhaps I'm holding it wrong ;) but just for type-checking -- i.e. if a function wants to take the result of .secrets.signer() and also wants type-checking information, it needs a signature like sign(thing: pysequoia.PySigner) right?

[wiktor-k]

No, you're holding it right, I just wasn't sure if pyo3 actually emits type information. 😅

Could you tell me more on how do you test this, so I can check if my (potential) fix is working? Thanks!

[meejah]

Hrm. I'm not super familiar with Python typing (I use Rust or Haskell if I want "real" types ;) ) and was preparing a contribution for thing that does use typing information.

Trying to come up with a SSCCE reveals that there just isn't enough pysequoia type information for mypy to run, I think?

Sorry for the noise! and thanks for the library

[wiktor-k]

Nah, it wasn't noise at all. The typing information is very much in scope, it's just I'm not a real Python programmer and would have troubles verifying if it has been correctly implemented (help welcome!).

I see pyo3 already exports some typing info:

>>> from pysequoia import sign
>>> sign.__text_signature__
'(signer, bytes, *, mode=...)'
>>> from inspect import signature
>>> signature(sign)
<Signature (signer, bytes, *, mode=Ellipsis)>

Not sure if IDEs/other tooling is using that thing though.

FWIW I'm okay with keeping that issue open as a generic "make better typing info" ticket. As I said though, it's not actionable until someone knowledgable comes with easy to verify criteria :)

[meejah]

I'll upload my example when I'm not on mobile..

[meejah]

import pysequoia
import subprocess


# the types can go in quotes, only MyPy or humans really care
def sign(data: bytes, signer: "pysequoia.PySigner") -> bytes:
    return pysequoia.sign(signer, data)


# this is my key-id, will want to use one's own
data = subprocess.check_output(
    ["sq", "key", "export", "--cert", "9D5A2BD5688ECB889DEBCD3FC2602803128069A7"]
)
cert = pysequoia.Cert.from_bytes(data)
result = sign(b"attack at dawn", cert.secrets.signer("passphrase"))
print(result)

Running mypy on this results in:

test_typing.py:2: error: Skipping analyzing "pysequoia": module is installed, but missing library stubs or py.typed marker  [import-untyped]
test_typing.py:2: note: See https://mypy.readthedocs.io/en/stable/running_mypy.html#missing-imports
Found 1 error in 1 file (checked 1 source file)

I haven't added stubs like this to a Rust-based Python library before so I'm not exactly sure what the next step is -- but certainly some sort of type information for return-values from e.g. Cert.secrets.signer() would be required AFAIK.

[wiktor-k]

Yep, this looks like something I can work with. Many thanks 🙏

(Although I have to put the usual open source disclaimer here: not promising any actual ETAs 😅).

[wiktor-k]

Maybe let's re-open this ticket because, surprise-surprise, exporting PySigner is needed to actually export good typing info (just like you've said 😅 ).

Some WIP in #51 quite a lot of it works but some doesn't so I'll let it sit for a while pondering what to do next... 👋