fix: update ruff config and fix linting issues

- Move deprecated top-level ruff settings to lint section
- Fix import sorting and formatting issues
- Update type annotations to use modern syntax (list/tuple instead of List/Tuple)
- Add explicit strict parameter to zip() calls
- Remove trailing whitespace

Author: hemonserrat

git_safe/crypto.py

@@ -2,13 +2,13 @@
 Cryptographic operations for git-safe
 """
 
+import hashlib
+import hmac
 import os
 import struct
-import hmac
-import hashlib
 
-from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
 from cryptography.hazmat.backends import default_backend
+from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
 
 from .constants import BLOCK_SIZE, CTR_NONCE_LEN, HMAC_CHECK_LEN
 
@@ -28,7 +28,7 @@ def ctr_decrypt(aes_key: bytes, nonce: bytes, data: bytes) -> bytes:
     # Create cipher in ECB mode for manual CTR implementation
     cipher = Cipher(algorithms.AES(aes_key), modes.ECB(), backend=default_backend())  # nosec B305
     encryptor = cipher.encryptor()
-    
+
     out = bytearray()
 
     for off in range(0, len(data), BLOCK_SIZE):
@@ -45,7 +45,7 @@ def ctr_decrypt(aes_key: bytes, nonce: bytes, data: bytes) -> bytes:
             ctr = counter_bytes[:BLOCK_SIZE]
 
         stream = encryptor.update(ctr)
-        out.extend(b ^ s for b, s in zip(block, stream))
+        out.extend(b ^ s for b, s in zip(block, stream, strict=False))
 
     # Finalize the encryptor (required by cryptography library)
     encryptor.finalize()

git_safe/file_ops.py

@@ -3,7 +3,6 @@
 """
 
 from pathlib import Path
-from typing import List, Optional
 
 from .constants import CTR_NONCE_LEN, HMAC_CHECK_LEN, MAGIC
 from .crypto import compute_hmac, ctr_decrypt, ctr_encrypt, generate_nonce, verify_hmac
@@ -61,7 +60,7 @@ def encrypt_file(file_path: Path, aes_key: bytes, hmac_key: bytes, backup: bool
 
 
 def decrypt_file(
-    file_path: Path, aes_key: bytes, hmac_key: bytes, output_path: Optional[Path] = None, verify_only: bool = False
+    file_path: Path, aes_key: bytes, hmac_key: bytes, output_path: Path | None = None, verify_only: bool = False
 ) -> bool:
     """
     Decrypt a file, always overwriting the original file in-place.
@@ -147,7 +146,7 @@ def is_encrypted_file(file_path: Path) -> bool:
         return False
 
 
-def find_encrypted_files(root_path: Path) -> List[Path]:
+def find_encrypted_files(root_path: Path) -> list[Path]:
     """
     Find all encrypted files in a directory tree.
 

git_safe/keyfile.py

@@ -5,7 +5,6 @@
 import os
 import struct
 from pathlib import Path
-from typing import Optional, Tuple
 
 import gnupg
 
@@ -18,7 +17,7 @@ class KeyfileError(Exception):
     pass
 
 
-def generate_keys() -> Tuple[bytes, bytes]:
+def generate_keys() -> tuple[bytes, bytes]:
     """
     Generate new AES and HMAC keys.
 
@@ -54,7 +53,7 @@ def create_keyfile_data(aes_key: bytes, hmac_key: bytes) -> bytes:
     return bytes(data)
 
 
-def load_keyfile(path: Path) -> Tuple[bytes, bytes]:
+def load_keyfile(path: Path) -> tuple[bytes, bytes]:
     """
     Load keys from a keyfile.
 
@@ -130,7 +129,7 @@ def save_keyfile(path: Path, aes_key: bytes, hmac_key: bytes) -> None:
         raise KeyfileError(f"Cannot save keyfile {path}: {e}") from e
 
 
-def export_key_gpg(keyfile_path: Path, gpg_recipient: str, output_path: Optional[Path] = None) -> Path:
+def export_key_gpg(keyfile_path: Path, gpg_recipient: str, output_path: Path | None = None) -> Path:
     """
     Export keyfile encrypted with GPG.
 
@@ -170,7 +169,7 @@ def export_key_gpg(keyfile_path: Path, gpg_recipient: str, output_path: Optional
         raise KeyfileError(f"Failed to export GPG keyfile: {e}") from e
 
 
-def import_key_gpg(encrypted_keyfile_path: Path, output_path: Optional[Path] = None) -> Path:
+def import_key_gpg(encrypted_keyfile_path: Path, output_path: Path | None = None) -> Path:
     """
     Import keyfile decrypted from GPG.
 
@@ -216,7 +215,7 @@ def import_key_gpg(encrypted_keyfile_path: Path, output_path: Optional[Path] = N
         raise KeyfileError(f"Failed to import GPG keyfile: {e}") from e
 
 
-def generate_keyfile(path: Path) -> Tuple[bytes, bytes]:
+def generate_keyfile(path: Path) -> tuple[bytes, bytes]:
     """
     Generate a new keyfile with random keys.
 

git_safe/patterns.py

@@ -3,7 +3,6 @@
 """
 
 from pathlib import Path
-from typing import List, Optional
 
 from pathspec import PathSpec, patterns
 
@@ -14,7 +13,7 @@ class PatternError(Exception):
     pass
 
 
-def parse_gitattributes(gitattributes_path: Optional[Path] = None) -> PathSpec:
+def parse_gitattributes(gitattributes_path: Path | None = None) -> PathSpec:
     """
     Parse .gitattributes file and extract patterns for git-safe filter.
 
@@ -63,7 +62,7 @@ def parse_gitattributes(gitattributes_path: Optional[Path] = None) -> PathSpec:
     return PathSpec.from_lines(patterns.GitWildMatchPattern, patterns_list)
 
 
-def find_matching_files(root_path: Path, pathspec: PathSpec) -> List[Path]:
+def find_matching_files(root_path: Path, pathspec: PathSpec) -> list[Path]:
     """
     Find all files matching the pathspec patterns.
 
@@ -85,7 +84,7 @@ def find_matching_files(root_path: Path, pathspec: PathSpec) -> List[Path]:
     return matching_files
 
 
-def should_encrypt_file(file_path: Path, root_path: Optional[Path] = None) -> bool:
+def should_encrypt_file(file_path: Path, root_path: Path | None = None) -> bool:
     """
     Check if a file should be encrypted based on .gitattributes patterns.
 

pyproject.toml

@@ -93,6 +93,8 @@ ensure_newline_before_comments = true
 [tool.ruff]
 target-version = "py311"
 line-length = 120
+
+[tool.ruff.lint]
 select = [
     "E",  # pycodestyle errors
     "W",  # pycodestyle warnings
@@ -108,7 +110,7 @@ ignore = [
     "C901",  # too complex
 ]
 
-[tool.ruff.per-file-ignores]
+[tool.ruff.lint.per-file-ignores]
 "__init__.py" = ["F401"]
 
 [tool.mypy]