dsql
d446f50942
EC-5: _load_private_key branches on whether a password was given so the normalized ValueError matches the actual cryptography TypeError case (was always claiming "encrypted but no password" even when a password was given for an unencrypted key). EC-6: encrypt_aes_key_with_rsa/decrypt_aes_key_with_rsa now raise a clear ValueError via _require_rsa for a non-RSA key (e.g. Ed25519/EC), instead of crashing raw with AttributeError at wrap/unwrap — this lib is RSA-envelope only. EC-7: initialize() requires exactly 32 bytes (isinstance bytes, len==32), rejecting a 16/24-byte key (silent AES-128/192 downgrade) or a str instead of failing late and opaquely at first encrypt. EC-8: fingerprint_data gains a default= handler (datetime/date/time, bytes/bytearray, and a type-tagged repr fallback) plus a key-type-tagging pre-pass so datetime/bytes/ ObjectId-like values no longer TypeError and int-vs-str dict keys no longer collide to the same fingerprint. Never logs the data being fingerprinted. Also compresses the essay-length docstrings (module + several methods) to cut narration while keeping the load-bearing footgun notes (RSA-only, AES-256 key length, never-log-key-material) intact — zero behavior change, re-verified after. Signed-off-by: disqualifier <dev@disqualifier.me>
16 lines
401 B
TOML
16 lines
401 B
TOML
[build-system]
|
|
requires = ["hatchling"]
|
|
build-backend = "hatchling.build"
|
|
|
|
[project]
|
|
name = "envelope_crypto"
|
|
version = "0.1.6"
|
|
description = "Envelope encryption (RSA-OAEP wrapped AES-256-GCM) for dict records — config-free, storage-agnostic, installable."
|
|
requires-python = ">=3.10"
|
|
dependencies = [
|
|
"cryptography>=42.0",
|
|
]
|
|
|
|
[tool.hatch.build.targets.wheel]
|
|
packages = ["src/envelope_crypto"]
|