Build updated for upstream libaegis 0.9.0 simplified API with matching changes on Python side. Set lower MacOS build target (11.0). Build abi3 version for all supported Python versions, reducing the number of wheels. Other build cleanup.

Author: Leo Vasanko

libaegis

@@ -37,6 +37,6 @@ package-dir = {"" = "src"}
 packages = ["aeg"]
 
 [tool.setuptools.package-data]
-aeg = ["*.h", "*.so", "*.pyd"]
+aeg = ["*.h"]
 
 [tool.setuptools_scm]

pyproject.toml

@@ -1,35 +1,24 @@
 """Setup script for aeg - builds CFFI extension with libaegis C library."""
 
 import sys
+import sysconfig
 from pathlib import Path
 
 from cffi import FFI
 from setuptools import setup
 
-# Locate the static library (built by build_backend.py before this runs)
-lib_name = "aegis.lib" if sys.platform == "win32" else "libaegis.a"
-libaegis_static = Path("libaegis/zig-out/lib") / lib_name
-if not libaegis_static.exists():
-    raise RuntimeError(f"libaegis static library not found at {libaegis_static}")
-libaegis_static = str(libaegis_static.resolve())
-
-# Include directory for headers
-libaegis_include = Path("libaegis/src/include")
-if not libaegis_include.exists():
-    raise RuntimeError(f"libaegis include directory not found at {libaegis_include}")
-include_dirs = [str(libaegis_include)]
-
-# Read the CDEF header
-cdef_path = Path(__file__).parent / "src" / "aeg" / "aegis_cdef.h"
-cdef_content = cdef_path.read_text(encoding="utf-8")
+libaegis_static = Path("libaegis/zig-out/lib") / (
+    "aegis.lib" if sys.platform == "win32" else "libaegis.a"
+)
 
-# Create CFFI builder
 ffibuilder = FFI()
-ffibuilder.cdef(cdef_content)
+ffibuilder.cdef((Path(__file__).parent / "src/aeg/aegis_cdef.h").read_text())
+
+# Free-threaded Python does not support Limited API (abi3)
+is_free_threaded = sysconfig.get_config_var("Py_GIL_DISABLED")
 
-# Set the source
 ffibuilder.set_source(
-    "aeg._aegis",  # module name
+    "aeg._aegis",
     """
     #include "aegis.h"
     #include "aegis128l.h"
@@ -39,11 +28,15 @@
     #include "aegis256x2.h"
     #include "aegis256x4.h"
     """,
-    include_dirs=include_dirs,
-    extra_objects=[libaegis_static],
+    include_dirs=["libaegis/src/include"],
+    extra_objects=[str(libaegis_static.resolve())],
+    py_limited_api=not is_free_threaded,
 )
 
 if __name__ == "__main__":
     setup(
         cffi_modules=["setup.py:ffibuilder"],
+        options=(
+            {"bdist_wheel": {"py_limited_api": "cp310"}} if not is_free_threaded else {}
+        ),
     )

setup.py

@@ -708,24 +708,17 @@ def update(
             raise TypeError(
                 "into length must be >= expected output size for this update"
             )
-        written = ffi.new("size_t *")
         rc = _lib.aegis128l_state_encrypt_update(
             self._state.ptr,
             ffi.from_buffer(out_mv),
-            out_mv.nbytes,
-            written,
             _ptr(message),
             message.nbytes,
         )
         if rc != 0:
             err_num = ffi.errno
             err_name = errno.errorcode.get(err_num, f"errno_{err_num}")
-            raise RuntimeError(
-                f"state encrypt update failed: {err_name} written {written[0]}"
-            )
-        w = int(written[0])
-        assert w == expected_out
-        return out if into is None else memoryview(out)[:w]  # type: ignore
+            raise RuntimeError(f"state encrypt update failed: {err_name}")
+        return out if into is None else memoryview(out)[:expected_out]  # type: ignore
 
     def final(self, into: Buffer | None = None) -> bytearray | memoryview:
         """Finalize encryption and return the authentication tag.
@@ -746,24 +739,17 @@ def final(self, into: Buffer | None = None) -> bytearray | memoryview:
         if into is not None:
             into = memoryview(into)
         out = into if into is not None else bytearray(maclen)
-        written = ffi.new("size_t *")
         rc = _lib.aegis128l_state_encrypt_final(
             self._state.ptr,
             ffi.from_buffer(out),
-            memoryview(out).nbytes,
-            written,
             maclen,
         )
         if rc != 0:
             err_num = ffi.errno
             err_name = errno.errorcode.get(err_num, f"errno_{err_num}")
             raise RuntimeError(f"state encrypt final failed: {err_name}")
-        w = int(written[0])
-        if into is None:
-            # Only the tag bytes are returned when we allocate the buffer
-            assert w == maclen
         self._state = None
-        return out if into is None else memoryview(out)[:w]  # type: ignore
+        return out if into is None else memoryview(out)[:maclen]  # type: ignore
 
 
 class Decryptor:
@@ -837,24 +823,17 @@ def update(self, ct: Buffer, into: Buffer | None = None) -> bytearray | memoryvi
         out_mv = memoryview(out)
         if out_mv.nbytes < expected_out:
             raise TypeError("into length must be >= required capacity for this update")
-        written = ffi.new("size_t *")
-        rc = _lib.aegis128l_state_decrypt_detached_update(
+        rc = _lib.aegis128l_state_decrypt_update(
             self._state.ptr,
             ffi.from_buffer(out_mv),
-            out_mv.nbytes,
-            written,
             _ptr(ct),
             ct.nbytes,
         )
         if rc != 0:
             err_num = ffi.errno
             err_name = errno.errorcode.get(err_num, f"errno_{err_num}")
             raise RuntimeError(f"state decrypt update failed: {err_name}")
-        w = int(written[0])
-        assert w == expected_out, (
-            f"got {w}, expected {expected_out}, ct.nbytes={ct.nbytes}"
-        )
-        return out if into is None else memoryview(out)[:w]  # type: ignore
+        return out if into is None else memoryview(out)[:expected_out]  # type: ignore
 
     def final(self, mac: Buffer) -> None:
         """Finalize decryption by verifying the MAC tag.
@@ -873,9 +852,7 @@ def final(self, mac: Buffer) -> None:
         mac = memoryview(mac)
         if mac.nbytes != maclen:
             raise TypeError(f"mac length must be {maclen}")
-        rc = _lib.aegis128l_state_decrypt_detached_final(
-            self._state.ptr, ffi.NULL, 0, ffi.NULL, _ptr(mac), maclen
-        )
+        rc = _lib.aegis128l_state_decrypt_final(self._state.ptr, _ptr(mac), maclen)
         if rc != 0:
             raise ValueError("authentication failed")
         self._state = None

src/aeg/aegis128l.py

@@ -708,24 +708,17 @@ def update(
             raise TypeError(
                 "into length must be >= expected output size for this update"
             )
-        written = ffi.new("size_t *")
         rc = _lib.aegis128x2_state_encrypt_update(
             self._state.ptr,
             ffi.from_buffer(out_mv),
-            out_mv.nbytes,
-            written,
             _ptr(message),
             message.nbytes,
         )
         if rc != 0:
             err_num = ffi.errno
             err_name = errno.errorcode.get(err_num, f"errno_{err_num}")
-            raise RuntimeError(
-                f"state encrypt update failed: {err_name} written {written[0]}"
-            )
-        w = int(written[0])
-        assert w == expected_out
-        return out if into is None else memoryview(out)[:w]  # type: ignore
+            raise RuntimeError(f"state encrypt update failed: {err_name}")
+        return out if into is None else memoryview(out)[:expected_out]  # type: ignore
 
     def final(self, into: Buffer | None = None) -> bytearray | memoryview:
         """Finalize encryption and return the authentication tag.
@@ -746,24 +739,17 @@ def final(self, into: Buffer | None = None) -> bytearray | memoryview:
         if into is not None:
             into = memoryview(into)
         out = into if into is not None else bytearray(maclen)
-        written = ffi.new("size_t *")
         rc = _lib.aegis128x2_state_encrypt_final(
             self._state.ptr,
             ffi.from_buffer(out),
-            memoryview(out).nbytes,
-            written,
             maclen,
         )
         if rc != 0:
             err_num = ffi.errno
             err_name = errno.errorcode.get(err_num, f"errno_{err_num}")
             raise RuntimeError(f"state encrypt final failed: {err_name}")
-        w = int(written[0])
-        if into is None:
-            # Only the tag bytes are returned when we allocate the buffer
-            assert w == maclen
         self._state = None
-        return out if into is None else memoryview(out)[:w]  # type: ignore
+        return out if into is None else memoryview(out)[:maclen]  # type: ignore
 
 
 class Decryptor:
@@ -837,24 +823,17 @@ def update(self, ct: Buffer, into: Buffer | None = None) -> bytearray | memoryvi
         out_mv = memoryview(out)
         if out_mv.nbytes < expected_out:
             raise TypeError("into length must be >= required capacity for this update")
-        written = ffi.new("size_t *")
-        rc = _lib.aegis128x2_state_decrypt_detached_update(
+        rc = _lib.aegis128x2_state_decrypt_update(
             self._state.ptr,
             ffi.from_buffer(out_mv),
-            out_mv.nbytes,
-            written,
             _ptr(ct),
             ct.nbytes,
         )
         if rc != 0:
             err_num = ffi.errno
             err_name = errno.errorcode.get(err_num, f"errno_{err_num}")
             raise RuntimeError(f"state decrypt update failed: {err_name}")
-        w = int(written[0])
-        assert w == expected_out, (
-            f"got {w}, expected {expected_out}, ct.nbytes={ct.nbytes}"
-        )
-        return out if into is None else memoryview(out)[:w]  # type: ignore
+        return out if into is None else memoryview(out)[:expected_out]  # type: ignore
 
     def final(self, mac: Buffer) -> None:
         """Finalize decryption by verifying the MAC tag.
@@ -873,9 +852,7 @@ def final(self, mac: Buffer) -> None:
         mac = memoryview(mac)
         if mac.nbytes != maclen:
             raise TypeError(f"mac length must be {maclen}")
-        rc = _lib.aegis128x2_state_decrypt_detached_final(
-            self._state.ptr, ffi.NULL, 0, ffi.NULL, _ptr(mac), maclen
-        )
+        rc = _lib.aegis128x2_state_decrypt_final(self._state.ptr, _ptr(mac), maclen)
         if rc != 0:
             raise ValueError("authentication failed")
         self._state = None

src/aeg/aegis128x2.py

@@ -708,24 +708,17 @@ def update(
             raise TypeError(
                 "into length must be >= expected output size for this update"
             )
-        written = ffi.new("size_t *")
         rc = _lib.aegis128x4_state_encrypt_update(
             self._state.ptr,
             ffi.from_buffer(out_mv),
-            out_mv.nbytes,
-            written,
             _ptr(message),
             message.nbytes,
         )
         if rc != 0:
             err_num = ffi.errno
             err_name = errno.errorcode.get(err_num, f"errno_{err_num}")
-            raise RuntimeError(
-                f"state encrypt update failed: {err_name} written {written[0]}"
-            )
-        w = int(written[0])
-        assert w == expected_out
-        return out if into is None else memoryview(out)[:w]  # type: ignore
+            raise RuntimeError(f"state encrypt update failed: {err_name}")
+        return out if into is None else memoryview(out)[:expected_out]  # type: ignore
 
     def final(self, into: Buffer | None = None) -> bytearray | memoryview:
         """Finalize encryption and return the authentication tag.
@@ -746,24 +739,17 @@ def final(self, into: Buffer | None = None) -> bytearray | memoryview:
         if into is not None:
             into = memoryview(into)
         out = into if into is not None else bytearray(maclen)
-        written = ffi.new("size_t *")
         rc = _lib.aegis128x4_state_encrypt_final(
             self._state.ptr,
             ffi.from_buffer(out),
-            memoryview(out).nbytes,
-            written,
             maclen,
         )
         if rc != 0:
             err_num = ffi.errno
             err_name = errno.errorcode.get(err_num, f"errno_{err_num}")
             raise RuntimeError(f"state encrypt final failed: {err_name}")
-        w = int(written[0])
-        if into is None:
-            # Only the tag bytes are returned when we allocate the buffer
-            assert w == maclen
         self._state = None
-        return out if into is None else memoryview(out)[:w]  # type: ignore
+        return out if into is None else memoryview(out)[:maclen]  # type: ignore
 
 
 class Decryptor:
@@ -837,24 +823,17 @@ def update(self, ct: Buffer, into: Buffer | None = None) -> bytearray | memoryvi
         out_mv = memoryview(out)
         if out_mv.nbytes < expected_out:
             raise TypeError("into length must be >= required capacity for this update")
-        written = ffi.new("size_t *")
-        rc = _lib.aegis128x4_state_decrypt_detached_update(
+        rc = _lib.aegis128x4_state_decrypt_update(
             self._state.ptr,
             ffi.from_buffer(out_mv),
-            out_mv.nbytes,
-            written,
             _ptr(ct),
             ct.nbytes,
         )
         if rc != 0:
             err_num = ffi.errno
             err_name = errno.errorcode.get(err_num, f"errno_{err_num}")
             raise RuntimeError(f"state decrypt update failed: {err_name}")
-        w = int(written[0])
-        assert w == expected_out, (
-            f"got {w}, expected {expected_out}, ct.nbytes={ct.nbytes}"
-        )
-        return out if into is None else memoryview(out)[:w]  # type: ignore
+        return out if into is None else memoryview(out)[:expected_out]  # type: ignore
 
     def final(self, mac: Buffer) -> None:
         """Finalize decryption by verifying the MAC tag.
@@ -873,9 +852,7 @@ def final(self, mac: Buffer) -> None:
         mac = memoryview(mac)
         if mac.nbytes != maclen:
             raise TypeError(f"mac length must be {maclen}")
-        rc = _lib.aegis128x4_state_decrypt_detached_final(
-            self._state.ptr, ffi.NULL, 0, ffi.NULL, _ptr(mac), maclen
-        )
+        rc = _lib.aegis128x4_state_decrypt_final(self._state.ptr, _ptr(mac), maclen)
         if rc != 0:
             raise ValueError("authentication failed")
         self._state = None