Fix remaining ty static type checker warnings and errors.

.github/workflows/python-app.yml

@@ -33,7 +33,9 @@ jobs:
     - name: Install the project
       run: uv sync --dev
     - name: Perform static checks
-      run: uv run ruff check
+      run: |
+        uv run ruff check
+        uv run ty check
     - name: Run tests using the locally built wheel
       run: |
         uv pip install --reinstall dist/*.whl

tests/test_mldsa.py

@@ -232,7 +232,7 @@ def test_sign_with_seed_bad_type(mldsa_type, rng, seed: int | str):
         message = b"This is a test message for ML-DSA signature"
         context = b"Some context for the signature"
         with pytest.raises(TypeError):
-            mldsa_priv.sign_with_seed(message, seed, ctx=context)
+            mldsa_priv.sign_with_seed(message, seed, ctx=context)  # ty: ignore [invalid-argument-type]
 
     def test_make_key_from_seed(mldsa_type):
         seed = bytes(MlDsaPrivate.ML_DSA_KEYGEN_SEED_LENGTH)
@@ -249,4 +249,4 @@ def test_make_key_from_seed_bad_length(mldsa_type, seed_length):
     @pytest.mark.parametrize("seed", [0, "seed"])
     def test_make_key_from_seed_bad_type(mldsa_type, seed: int | str):
         with pytest.raises(TypeError):
-            MlDsaPrivate.make_key_from_seed(mldsa_type, seed)
+            MlDsaPrivate.make_key_from_seed(mldsa_type, seed)  # ty: ignore [invalid-argument-type]

tests/test_mlkem.py

@@ -621,7 +621,7 @@ def test_init_pattern_3(mlkem_type):
     @pytest.mark.parametrize("rand", [0, "rand"])
     def test_make_key_with_random_bad_random_type(mlkem_type, rand: int | str):
         with pytest.raises(TypeError):
-            MlKemPrivate.make_key_with_random(mlkem_type, rand)
+            MlKemPrivate.make_key_with_random(mlkem_type, rand)  # ty: ignore [invalid-argument-type]
 
     @pytest.mark.parametrize("mlkem_type", mlkem_types)
     @pytest.mark.parametrize("rand", [0, "rand"])
@@ -630,7 +630,7 @@ def test_encapsulate_with_random_bad_random_type(mlkem_type, rand: int | str):
         assert type(mlkem_pub) is MlKemPublic
 
         with pytest.raises(TypeError):
-            mlkem_pub.encapsulate_with_random(rand)
+            mlkem_pub.encapsulate_with_random(rand)  # ty: ignore [invalid-argument-type]
 
     @pytest.mark.parametrize("mlkem_type", mlkem_types)
     def test_size_properties(mlkem_type):

wolfcrypt/ciphers.py

@@ -1372,7 +1372,7 @@ def decode_key(self, key: BytesOrStr) -> None:
                 raise WolfCryptError(f"Key decode error ({self.max_signature_size})")
 
         @override
-        def decode_key_raw(self, qx: BytesOrStr, qy: BytesOrStr, d: BytesOrStr, curve_id: int = ECC_SECP256R1) -> None:
+        def decode_key_raw(self, qx: BytesOrStr, qy: BytesOrStr, d: BytesOrStr, curve_id: int = ECC_SECP256R1) -> None:  # ty: ignore[invalid-method-override]
             """
             Decodes an ECC private key from its raw elements: public (Qx,Qy)
             and private(d)
@@ -1394,7 +1394,7 @@ def decode_key_raw(self, qx: BytesOrStr, qy: BytesOrStr, d: BytesOrStr, curve_id
                 raise WolfCryptApiError("Key decode error", ret)
 
         @override
-        def encode_key(self) -> bytes:
+        def encode_key(self, with_curve: bool = True) -> bytes:
             """
             Encodes the ECC private key in an ASN sequence.
 
@@ -1409,7 +1409,7 @@ def encode_key(self) -> bytes:
             return _ffi.buffer(key, ret)[:]
 
         @override
-        def encode_key_raw(self) -> tuple[bytes, bytes, bytes]:
+        def encode_key_raw(self) -> tuple[bytes, bytes, bytes]:  # ty: ignore[invalid-method-override]
             """
             Encodes the ECC private key in its three raw elements
 
@@ -1680,7 +1680,7 @@ def decode_key(self, key: BytesOrStr, pub: bytes | None = None) -> None:
                 raise WolfCryptError(f"Key decode error ({self.max_signature_size})")
 
         @override
-        def encode_key(self) -> tuple[bytes, bytes]:
+        def encode_key(self) -> tuple[bytes, bytes]:  # ty: ignore[invalid-method-override]
             """
             Encodes the ED25519 private key.
 
@@ -1889,7 +1889,7 @@ def decode_key(self, key: BytesOrStr, pub: bytes | None = None) -> None:
                 raise WolfCryptError(f"Key decode error ({self.max_signature_size})")
 
         @override
-        def encode_key(self) -> tuple[bytes, bytes]:
+        def encode_key(self) -> tuple[bytes, bytes]:  # ty: ignore[invalid-method-override]
             """
             Encodes the ED448 private key.
 

wolfcrypt/hashes.py

@@ -457,6 +457,7 @@ class _Hmac(_Hash):
         digest_size = None
         _native_type = "Hmac *"
         _native_size = _ffi.sizeof("Hmac")
+        _type: int
         _delete = staticmethod(_lib.wc_HmacFree)
 
         @override
@@ -498,11 +499,6 @@ def new(cls, key: BytesOrStr, string: BytesOrStr | None = None) -> _Hash:  # pyl
             """
             return cls(key, string)
 
-
-        @property
-        @abstractmethod
-        def _type(self) -> int: ...
-
         def _hmac_init(self, hmac: int, key: bytes) -> int:
             ret = _lib.wc_HmacInit(self._native_object, _ffi.NULL, -2)
             if ret < 0:

wolfcrypt/hkdf.py

@@ -32,7 +32,7 @@
 
 if TYPE_CHECKING:
     if _lib.HMAC_ENABLED:
-        from wolfcrypt.hashes import _Hmac
+        from wolfcrypt.hashes import _Hmac  # ty: ignore[possibly-missing-import]
 
 
 if _lib.HKDF_ENABLED: