Ensure mypy strict works, drop Python 3.7

.github/workflows/lint.yml

@@ -18,7 +18,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@v4
         with:
-          python-version: '3.10'
+          python-version: '3.11'
 
       - name: Install flake8
         run: python -m pip install flake8
@@ -28,3 +28,12 @@ jobs:
         with:
           linters: flake8
           run: flake8 signify --ignore=E128,W503 --max-line-length=120
+
+  mypy:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: Run mypy
+        uses: jpetrucciani/[email protected]

.github/workflows/test.yml

@@ -14,7 +14,7 @@ jobs:
 
     strategy:
       matrix:
-        python-version: [3.7, 3.8, 3.9, "3.10"]
+        python-version: [3.8, 3.9, "3.10", "3.11"]
 
     steps:
       - uses: actions/checkout@v3

README.rst

@@ -14,7 +14,7 @@ This module is a forked from Google's ``verify_sigs`` module, updated to fit
 modern Python standards and be compatible with Python 3. It is **not** a drop-in
 replacement, as significant changes have occurred.
 
-This module is compatible with Python 3.7+ and does not support Python 2.
+This module is compatible with Python 3.8+ and does not support Python 2.
 
 Installation
 ------------

docs/changelog.rst

@@ -9,6 +9,7 @@ unreleased
   be to rely on the first signature, though Signify defaults to allow any signature to verify. Next to these two,
   we have also added the options for 'all' (all signatures must verify) and 'best' (the best must verify).
 * Changed some arguments of some methods to keyword-only arguments. This is a backwards-incompatible change.
+* Drop support for Python 3.7, as it is end-of-life since June 2023. The minimum required version is now 3.8.
 
 v0.5.2 (2023-04-22)
 -------------------

docs/index.rst

@@ -7,7 +7,7 @@ This module is a forked from Google's ``verify_sigs`` module, updated to fit
 modern Python standards and be compatible with Python 3. It is **not** a drop-in
 replacement, as significant changes have occurred.
 
-This module is compatible with Python 3.7+ and does not support Python 2.
+This module is compatible with Python 3.8+ and does not support Python 2.
 
 .. toctree::
    :maxdepth: 1

pyproject.toml

@@ -0,0 +1,15 @@
+[tool.mypy]
+files = "signify"
+python_version = "3.8"
+strict = true
+disallow_incomplete_defs = true
+
+[[tool.mypy.overrides]]
+module = [
+    "asn1crypto.*",
+    "certvalidator.*",
+    "oscrypto.*",
+    "pyasn1.*",
+    "pyasn1_modules.*"
+]
+ignore_missing_imports = true

setup.py

@@ -42,10 +42,10 @@
         'Intended Audience :: Legal Industry',
         'Intended Audience :: System Administrators',
         'License :: OSI Approved :: MIT License',
-        'Programming Language :: Python :: 3.7',
         'Programming Language :: Python :: 3.8',
         'Programming Language :: Python :: 3.9',
         'Programming Language :: Python :: 3.10',
+        'Programming Language :: Python :: 3.11',
         'Topic :: Scientific/Engineering :: Information Analysis',
         'Topic :: Security :: Cryptography',
         'Topic :: System :: Software Distribution',

signify/__init__.py

@@ -1,5 +1,4 @@
-from typing import Any
-
+from typing import Any, cast
 
 __version__ = "0.5.2"
 
@@ -10,8 +9,8 @@ def _print_type(t: Any) -> str:
     elif isinstance(t, tuple):
         return ".".join(map(str, t))
     elif callable(t) and hasattr(t(), 'name'):
-        return t().name  # used by hashlib
+        return cast(str, t().name)  # used by hashlib
     elif hasattr(t, "__name__"):
-        return t.__name__
+        return cast(str, t.__name__)
     else:
         return type(t).__name__

signify/asn1/ctl.py

@@ -5,36 +5,36 @@
 # Based on http://download.microsoft.com/download/C/8/8/C8862966-5948-444D-87BD-07B976ADA28C/%5BMS-CAESO%5D.pdf
 
 
-class CTLVersion(univ.Integer):
+class CTLVersion(univ.Integer):  # type: ignore[misc]
     namedValues = namedval.NamedValues(
         ('v1', 0)
     )
 
 
-class SubjectUsage(rfc5280.ExtKeyUsageSyntax):
+class SubjectUsage(rfc5280.ExtKeyUsageSyntax):  # type: ignore[misc]
     pass
 
 
-class ListIdentifier(univ.OctetString):
+class ListIdentifier(univ.OctetString):  # type: ignore[misc]
     pass
 
 
-class SubjectIdentifier(univ.OctetString):
+class SubjectIdentifier(univ.OctetString):  # type: ignore[misc]
     pass
 
 
-class TrustedSubject(univ.Sequence):
+class TrustedSubject(univ.Sequence):  # type: ignore[misc]
     componentType = namedtype.NamedTypes(
         namedtype.NamedType('subjectIdentifier', SubjectIdentifier()),
         namedtype.OptionalNamedType('subjectAttributes', rfc2315.Attributes()),
     )
 
 
-class TrustedSubjects(univ.SequenceOf):
+class TrustedSubjects(univ.SequenceOf):  # type: ignore[misc]
     componentType = TrustedSubject()
 
 
-class CertificateTrustList(univ.Sequence):
+class CertificateTrustList(univ.Sequence):  # type: ignore[misc]
     componentType = namedtype.NamedTypes(
         namedtype.DefaultedNamedType('version', CTLVersion('v1')),
         namedtype.NamedType('subjectUsage', SubjectUsage()),
@@ -52,45 +52,45 @@ class CertificateTrustList(univ.Sequence):
 # The following are known attributes
 
 
-class EnhkeyUsage(rfc5280.ExtKeyUsageSyntax):
+class EnhkeyUsage(rfc5280.ExtKeyUsageSyntax):  # type: ignore[misc]
     pass
 
 
-class FriendlyName(univ.OctetString):
+class FriendlyName(univ.OctetString):  # type: ignore[misc]
     pass
 
 
-class KeyIdentifier(univ.OctetString):
+class KeyIdentifier(univ.OctetString):  # type: ignore[misc]
     pass
 
 
-class SubjectNameMd5Hash(univ.OctetString):
+class SubjectNameMd5Hash(univ.OctetString):  # type: ignore[misc]
     pass
 
 
-class RootProgramCertPolicies(univ.OctetString):  # TODO: not implemented
+class RootProgramCertPolicies(univ.OctetString):  # type: ignore[misc]  # TODO: not implemented
     pass
 
 
-class AuthRootSha256Hash(univ.OctetString):
+class AuthRootSha256Hash(univ.OctetString):  # type: ignore[misc]
     pass
 
 
-class DisallowedFiletime(univ.OctetString):
+class DisallowedFiletime(univ.OctetString):  # type: ignore[misc]
     pass
 
 
-class RootProgramChainPolicies(rfc5280.ExtKeyUsageSyntax):
+class RootProgramChainPolicies(rfc5280.ExtKeyUsageSyntax):  # type: ignore[misc]
     pass
 
 
-class DisallowedEnhkeyUsage(rfc5280.ExtKeyUsageSyntax):
+class DisallowedEnhkeyUsage(rfc5280.ExtKeyUsageSyntax):  # type: ignore[misc]
     pass
 
 
-class NotBeforeFiletime(univ.OctetString):
+class NotBeforeFiletime(univ.OctetString):  # type: ignore[misc]
     pass
 
 
-class NotBeforeEnhkeyUsage(rfc5280.ExtKeyUsageSyntax):
+class NotBeforeEnhkeyUsage(rfc5280.ExtKeyUsageSyntax):  # type: ignore[misc]
     pass

signify/asn1/helpers.py

@@ -2,17 +2,17 @@
 
 import contextlib
 import datetime
-from typing import Iterator
+from typing import Iterator, cast
 
 from pyasn1.type.useful import GeneralizedTime, UTCTime
 from pyasn1_modules import rfc5652, rfc3161
 
 
 def time_to_python(time: GeneralizedTime | UTCTime) -> datetime.datetime | None:
     if 'utcTime' in time:
-        return time['utcTime'].asDateTime
+        return cast(datetime.datetime, time['utcTime'].asDateTime)
     elif 'generalTime' in time:
-        return time['generalTime'].asDateTime
+        return cast(datetime.datetime, time['generalTime'].asDateTime)
     else:
         return None
 

signify/asn1/pkcs7.py

@@ -2,9 +2,9 @@
 from pyasn1_modules import rfc2315
 
 
-class Data(univ.OctetString):
+class Data(univ.OctetString):  # type: ignore[misc]
     pass
 
 
-class Countersignature(rfc2315.SignerInfo):
+class Countersignature(rfc2315.SignerInfo):  # type: ignore[misc]
     pass

signify/asn1/preserving_der.py

@@ -6,7 +6,7 @@
 __all__ = ['encode']
 
 
-class SetOfEncoder(cer_encoder.SetOfEncoder):
+class SetOfEncoder(cer_encoder.SetOfEncoder):  # type: ignore[misc]
     """This class is identical to the one of the CER encoder, except that the sorting has been removed. """
 
     def encodeValue(self, value, asn1Spec, encodeFun, **options):  # type: ignore[no-untyped-def]
@@ -36,7 +36,7 @@ def encodeValue(self, value, asn1Spec, encodeFun, **options):  # type: ignore[no
 })
 
 
-class Encoder(encoder.Encoder):
+class Encoder(encoder.Encoder):  # type: ignore[misc]
     fixedDefLengthMode = True
     fixedChunkSize = 0