Modernize keyset loading and test the full support matrix - #12
Merged
script3r merged 2 commits intoSep 5, 2026
Merged
Conversation
This was referenced Sep 5, 2026
script3r
merged commit Sep 5, 2026
4836bf9
into
codex/validate-resolved-field-options
10 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Keyset loading checked
~paths before expanding them, exposed decoding/type errors inconsistently, and used the older reader/handle API. CI also omitted two advertised Python/Django combinations and never exercised the minimum supported Tink release.Use Tink's
json_proto_keyset_formatAPIs with typed handles, preserving existing JSON formats and empty encrypted-keyset AAD. Normalize paths before validation and provide configuration errors for non-UTF-8 files, invalid master primitives, and incompatible AEAD keysets. Add the missing Python 3.13/3.14 + Django 5.2 jobs and a Tink 1.13.0 job, mirrored in tox. No runtime version minimum changes.The README now accurately describes explicit model validation and deterministic key-rotation limitations. The included code review records findings, performance measurements, rollout details, and follow-up priorities, including backend-dependent deterministic serialization and server integration coverage.
Validation: 5 new configuration cases failed before the fix. All 137 library and 6 example tests pass on Python 3.14 / Django 6.0 / Tink 1.16.1 and Python 3.10 / Django 5.2 / Tink 1.13.0; coverage is 97.62%. Includes existing cleartext/encrypted-keyset interoperability and an unhashable master AEAD. Ruff lint/format, Pyright, distribution builds, strict Twine checks, pip-audit, and Bandit medium/high checks pass.
Final modernization step; depends on #13, which integrates the already-reviewed changes from #8–#11 into
main. After #13 lands, change this PR's base tomainbefore merging it.Current remaining landing order: #13 → #12. PR #7 is already in
main; #8–#11 were merged into predecessor branches and are included in #13.Full review and landing notes. Use merge commits to preserve stack ancestry; squash/rebase merges require rebasing the remaining stack before landing it.