mirror of
https://github.com/zap-proto/py.git
synced 2026-10-30 15:04:09 +00:00
zeekay
e8ec8eed73
Make the published zap-proto package contain real code instead of stubs. Wire (the product, was entirely absent): - src/zap/wire.py — pure-stdlib port of the canonical Go runtime (zap.go + builder.py + accessors + list cursors). Message/Object/List zero-copy reads, Builder/ObjectBuilder/ListBuilder writes, 16-byte ZAP\x00 header, Version1+2 accept, reader hardening (reject backward pointers into the header, clamp list length). Byte-faithful to Go — pinned by the shared cross-wire golden vector. RPC (was a sleep-loop server + all-mock client): - src/zap/rpc.py — real TCP request/response transport, Server dispatches the Zap interface method ordinals (@0..@8 from zap.zap), Client calls them. - app.run() now serves real RPC; client.Client is a real RPC client. Crypto (was secrets.token_bytes() fakes whose two sides never agreed and whose verify() accepted any blob): - src/zap/crypto.py — real ML-KEM-768 / ML-DSA-65 (pqcrypto) + X25519 (cryptography), hybrid HKDF-SHA256 KEX. Hard-fails with CryptoError when a backend is missing — never fabricates bytes. Package wiring: - __init__.py exposes the wire API with ZERO third-party dep on the import path; pydantic/httpx are lazy (app.ZAP, Client). All __all__ names resolve on a default install (was 18 of 22 unresolved, swallowed ImportError). - pyproject: drop nonexistent pyzap>=2.0.0; pydantic -> [app]; add [crypto]; fix repo URL to zap-proto/py; target py312. Bug fixes (audit PoCs): - frame.py: reject oversize routing ids cleanly (was u16 struct crash); lenient decode of non-UTF8 ids (was strict-decode crash); encode/decode_cmd type tag so str round-trips to str (was silently bytes). - protocol.py: decode_stream reports bytes consumed (decode dropped 2nd frame). - app.py: _match_uri_template escapes literal template text (was regex over-match). - consensus.py: fix votes int/dict type collision. Quality: ruff clean, ruff format clean, mypy --strict 0 issues, 52 tests pass. Add .github/workflows/ci.yml (ruff + format + mypy + pytest, py3.10-3.13). Rebrand: zap.capnp -> zap.zap, $Go.import -> github.com/zap-proto/go.
33 lines
1019 B
Python
33 lines
1019 B
Python
"""PQ-RNS DID KAT — verifies our compute_did matches the canonical
|
|
fixture published at zap-proto/rns/testdata/pqrns_kat.json."""
|
|
|
|
import base64
|
|
import hashlib
|
|
import json
|
|
import pathlib
|
|
|
|
KAT_PATH = pathlib.Path(__file__).parent / "pqrns_kat.json"
|
|
|
|
|
|
def compute_did(kem_pubkey: bytes, sig_pubkey: bytes) -> str:
|
|
"""Canonical did:zap computation. Must match every other SDK."""
|
|
h = hashlib.sha3_256(kem_pubkey + sig_pubkey).digest()
|
|
enc = base64.b32encode(h).decode("ascii").rstrip("=").lower()
|
|
return "did:zap:" + enc
|
|
|
|
|
|
def test_pqrns_did_kat() -> None:
|
|
kat = json.loads(KAT_PATH.read_text())
|
|
canonical = kat["did_canonical"]
|
|
|
|
kem_pk = bytes.fromhex(canonical["inputs"]["kem_pubkey_hex"])
|
|
sig_pk = bytes.fromhex(canonical["inputs"]["sig_pubkey_hex"])
|
|
|
|
assert len(kem_pk) == 1216
|
|
assert len(sig_pk) == 1984
|
|
|
|
got = compute_did(kem_pk, sig_pk)
|
|
assert got == canonical["outputs"]["did"], (
|
|
f"DID diverged:\n got {got}\n want {canonical['outputs']['did']}"
|
|
)
|