Hopefully next

.ci/install-deps.sh

@@ -7,6 +7,12 @@ export TPM2_TSS_VERSION=${TPM2_TSS_VERSION:-"3.0.3"}
 export TPM2_TSS_FAPI=${TPM2_TSS_FAPI:-"true"}
 export TPM2_TOOLS_VERSION=${TPM2_TOOLS_VERSION:-"5.5"}
 
+# Setup environment for using cached libraries/binaries
+export CI_DEPS_PATH="${HOME}/cideps"
+export PATH="${PATH}:${CI_DEPS_PATH}/bin"
+export PKG_CONFIG_PATH="${CI_DEPS_PATH}/lib/pkgconfig"
+export LD_LIBRARY_PATH="${CI_DEPS_PATH}/lib/"
+
 #
 # Get dependencies for building and install tpm2-tss and abrmd projects
 #
@@ -60,27 +66,30 @@ if ! pkg-config tss2-sys; then
     extra_configure_flags="--disable-fapi"
   fi
   ./bootstrap
-  ./configure --sysconfdir=/etc ${extra_configure_flags} CFLAGS=-g
-  make -j4
-  sudo make install
+  ./configure --prefix="${CI_DEPS_PATH}" ${extra_configure_flags} CFLAGS=-g
+  make -j$(nproc)
+  make install
   sudo ldconfig
   popd
 fi
 
+# link ${CI_DEPS_PATH}/etc/tpm2-tss to /etc/ for the FAPI tests
+sudo ln -s "${CI_DEPS_PATH}/etc/tpm2-tss" /etc/
+
 #
 # Get a simulator
 #
 
 # Does our tcti support the TCTI for swtpm? If so get the swtpm simulator
-if pkg-config --exists tss2-tcti-swtpm; then
+if pkg-config --exists tss2-tcti-swtpm && ! swtpm --version; then
 
   # libtpms
   if ! pkg-config libtpms; then
     git -C /tmp clone --depth=1 https://github.com/stefanberger/libtpms.git
     pushd /tmp/libtpms
-    ./autogen.sh --prefix=/usr --with-openssl --with-tpm2 --without-tpm1
+    ./autogen.sh --prefix="${CI_DEPS_PATH}" --with-openssl --with-tpm2 --without-tpm1
     make -j$(nproc)
-    sudo make install
+    make install
     popd
     rm -fr /tmp/libtpms
     sudo ldconfig
@@ -90,19 +99,20 @@ if pkg-config --exists tss2-tcti-swtpm; then
   if ! command -v swtpm; then
     git -C /tmp clone --depth=1 https://github.com/stefanberger/swtpm.git
     pushd /tmp/swtpm
-    ./autogen.sh --prefix=/usr
+    ./autogen.sh --prefix="${CI_DEPS_PATH}"
     make -j$(nproc)
-    sudo make install
+    make install
     popd
     rm -fr /tmp/swtpm
   fi
 # Get IBM Simulator (supported for a longer time)
-else
+elif ! command -v tpm_server; then
   # pull from fork that has fixes for RC handling not yet in mainline.
   git -C /tmp clone --depth=1 https://github.com/williamcroberts/ibmswtpm2.git -b fix-rc-exits
   pushd /tmp/ibmswtpm2/src
   make -j$(nproc)
-  sudo cp tpm_server /usr/local/bin
+  mkdir -p "${CI_DEPS_PATH}/bin"
+  cp tpm_server "${CI_DEPS_PATH}/bin"
   popd
   rm -fr /tmp/ibmswtpm2
 fi
@@ -119,9 +129,9 @@ if ! command -v tpm2; then
     --branch "${TPM2_TOOLS_VERSION}" https://github.com/tpm2-software/tpm2-tools.git
   pushd /tmp/tpm2-tools
   ./bootstrap
-  ./configure CFLAGS=-g --disable-fapi
+  ./configure CFLAGS=-g --prefix="${CI_DEPS_PATH}" --disable-fapi
   make -j$(nproc)
-  sudo make install
+  make install
   popd
 fi
 

.ci/run.sh

@@ -5,6 +5,12 @@ if [ -d "${HOME}/.local/bin" ]; then
   export PATH="${HOME}/.local/bin:${PATH}"
 fi
 
+# Setup environment for using cached libraries/binaries
+export CI_DEPS_PATH="${HOME}/cideps"
+export PATH="${PATH:+${PATH}:}${CI_DEPS_PATH}/bin"
+export PKG_CONFIG_PATH="${PKG_CONFIG_PATH:+${PKG_CONFIG_PATH}:}${CI_DEPS_PATH}/lib/pkgconfig"
+export LD_LIBRARY_PATH="${LD_LIBRARY_PATH:+${LD_LIBRARY_PATH}:}${CI_DEPS_PATH}/lib/"
+
 SRC_ROOT=${SRC_ROOT:-"${PWD}"}
 PYTHON=${PYTHON:-"python3"}
 
@@ -103,6 +109,11 @@ function run_style() {
   "${PYTHON}" -m black --diff --check "${SRC_ROOT}"
 }
 
+function run_mypy() {
+  python3 -m pip install --user -e .[dev]
+  mypy --strict src/tpm2_pytss
+}
+
 if [ "x${TEST}" != "x" ]; then
   run_test
 elif [ "x${WHITESPACE}" != "x" ]; then
@@ -111,4 +122,6 @@ elif [ "x${STYLE}" != "x" ]; then
   run_style
 elif [ "x${PUBLISH_PKG}" != "x" ]; then
   run_publish_pkg
+elif [ "x${MYPY}" != "x" ]; then
+  run_mypy
 fi

.github/workflows/tests.yaml

@@ -10,11 +10,14 @@ jobs:
         python-version: ['3.8', '3.9', '3.10', '3.11', '3.12']
         tss-version: ['master', '2.4.0', '3.0.0', '3.0.3', '3.2.0', '4.0.0']
         with-fapi: [true]
-        tools-version: ['5.5']
+        tools-version: ['5.6']
         include:
           - python-version: '3.9'
             tss-version: '3.1.0'
             with-fapi: false
+          - python-version: '3.12'
+            tss-version: 'master'
+            tools-version: 'master'
 
 
     steps:
@@ -26,6 +29,45 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
 
+      - name: cache pip
+        uses: actions/cache@v3
+        with:
+          path: ~/.cache/pip
+          key: pip-${{ hashFiles('**/setup.cfg') }}
+
+      - name: cache swtpm
+        uses: actions/cache@v3
+        with:
+          path: |
+            ~/cideps/lib/libtpms.so*
+            ~/cideps/bin/swtpm
+            ~/cideps/lib/swtpm/libswtpm_libtpms.so*
+          key: swtpm
+
+      - name: cache ibmswtpm2
+        uses: actions/cache@v3
+        with:
+          path: ~/cideps/bin/tpm_server
+          key: ibmswtpm2
+
+      - name: cache tpm2-tools
+        uses: actions/cache@v3
+        if: matrix.tools-version != 'master'
+        with:
+          path: ~/cideps/bin/tpm2*
+          key: tools-${{ matrix.tools-version }}-${{ matrix.tss-version }}
+
+      - name: cache tpm2-tss
+        uses: actions/cache@v3
+        if: matrix.tss-version != 'master'
+        with:
+          path: |
+            ~/cideps/lib/libtss2-*
+            ~/cideps/lib/pkgconfig/tss2-*
+            ~/cideps/include/tss2
+            ~/cideps/etc/tpm2-tss
+          key: tss2-${{ matrix.tss-version }}-c1
+
       - name: Install dependencies
         env:
           TPM2_TSS_VERSION: ${{ matrix.tss-version }}
@@ -67,6 +109,28 @@ jobs:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: /tmp/coverage.xml
 
+  mypy:
+    runs-on: ubuntu-20.04
+
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v2
+
+      - name: Set up Python 3.x
+        uses: actions/setup-python@v2
+        with:
+          python-version: 3.x
+
+      - name: Install dependencies
+        env:
+          TPM2_TSS_VERSION: 4.0.1
+        run: ./.ci/install-deps.sh
+
+      - name: Check
+        env:
+          MYPY: 1
+        run: ./.ci/run.sh
+
   whitespace-check:
     runs-on: ubuntu-latest
     steps:

.gitignore

@@ -42,3 +42,4 @@ htmlcov
 /.pytest_cache/
 src/tpm2_pytss/internal/type_mapping.py
 src/tpm2_pytss/internal/versions.py
+src/tpm2_pytss/_libtpm2_pytss/lib.pyi

docs/api.rst

@@ -14,3 +14,4 @@ The API documentation for the tpm2-pytss project.
     Utility Routines <utils>
     TSS PEM Key (OpenSSL) <tsskey>
     TSS2_Exception <exception>
+    cryptography <cryptography>

docs/cryptography.rst

@@ -0,0 +1,6 @@
+cryptography
+============
+
+.. automodule:: tpm2_pytss.cryptography
+   :members:
+   :undoc-members:

mypy_stubs/asn1crypto/core.pyi

@@ -0,0 +1,16 @@
+from typing import Optional, Any, Dict
+
+class Boolean:
+    _trailer: bytes
+class ObjectIdentifier:
+    def __init__(self, oid: str): ...
+    native: Optional[str]
+class Sequence:
+    def __setitem__(self, key: str, value: Any) -> None: ...
+    def __getitem__(self, key: str) -> Any: ...
+    def dump(self, force: bool = False) -> bytes: ...
+    @classmethod
+    def load(cls, encoded_data: bytes, strict: bool = False, **kwargs: Dict[str, Any]) -> "Sequence": ...
+
+class Integer: ...
+class OctetString: ...

mypy_stubs/asn1crypto/pem.pyi

@@ -0,0 +1,4 @@
+from typing import Optional, Dict, Tuple
+
+def armor(type_name: str, der_bytes: bytes, headers: Optional[Dict[str, str]] = None) -> bytes: ...
+def unarmor(pem_bytes: bytes , multiple: bool = False) -> Tuple[str, Dict[str, str], bytes]: ...

pyproject.toml

@@ -1,5 +1,5 @@
 [build-system]
-requires = ["setuptools>=44", "wheel", "setuptools_scm[toml]>=3.4.3", "pycparser", "pkgconfig"]
+requires = ["setuptools>=44", "wheel", "setuptools_scm[toml]>=3.4.3", "pycparser", "pkgconfig", "cffi"]
 build-backend = "setuptools.build_meta"
 
 [tool.setuptools_scm]
@@ -19,6 +19,13 @@ exclude = '''
     | build
     | dist
     | esys_binding.py
+    | .*\.pyi$
   )
 )
 '''
+
+[tool.mypy]
+mypy_path = "mypy_stubs"
+exclude = [
+  'src/tpm2_pytss/encoding.py',
+]

setup.cfg

@@ -55,3 +55,4 @@ dev =
     myst-parser
     build
     installer
+    mypy