Add mypy to CI (#693)

* Configure mypy

Use the lightweight config from
    https://github.com/pyca/cryptography/blob/main/pyproject.toml#L24
for now.

* Run mypy in CI

* Annotate attributes of Signed and EncryptedMessage

placeholder for now, to get mypy passing

* Address mypy's warnings about missing `__bytes__`

Sadly I can't import `SupportBytes` from typing_extensions, so for 3.8
and below I need to define it myself.

* Distinguish builtin exceptions from nacl's clones

* Only require mypy or testing on cpython

* Fix a couple of typos

* Can use stdlib's `SupportBytes`

* Mypy is not a package dependency

* Typecheck in a dedicated tox env

* Appease the linter

.github/workflows/ci.yml

@@ -16,6 +16,7 @@ jobs:
         PYTHON:
           - {VERSION: "3.9", TOXENV: "docs", COVERAGE: "false"}
           - {VERSION: "3.9", TOXENV: "meta", COVERAGE: "false"}
+          - {VERSION: "3.9", TOXENV: "mypy", COVERAGE: "false"}
           - {VERSION: "pypy3", TOXENV: "pypy"}
           - {VERSION: "3.6", TOXENV: "py36"}
           - {VERSION: "3.7", TOXENV: "py37"}

.gitignore

@@ -43,3 +43,6 @@ src/libsodium/libtool
 
 # whitelist libsodium's build directory
 !src/libsodium/builds/msvc/build
+
+# mypy's cache
+.mypy_cache

pyproject.toml

@@ -10,3 +10,16 @@ build-backend = "setuptools.build_meta"
 [tool.black]
 line-length = 79
 target-version = ["py36"]
+
+[tool.mypy]
+show_error_codes = true
+check_untyped_defs = true
+no_implicit_reexport = true
+
+files = ["src/nacl"]
+
+[[tool.mypy.overrides]]
+module = [
+    "nacl._sodium",
+]
+ignore_missing_imports = true

setup.py

@@ -36,7 +36,10 @@
 
 requirements = []
 setup_requirements = ["setuptools"]
-test_requirements = ["pytest>=3.2.1,!=3.3.0", "hypothesis>=3.27.0"]
+test_requirements = [
+    "pytest>=3.2.1,!=3.3.0",
+    "hypothesis>=3.27.0",
+]
 docs_requirements = ["sphinx>=1.6.5", "sphinx_rtd_theme"]
 
 

src/nacl/encoding.py

@@ -15,6 +15,7 @@
 
 import base64
 import binascii
+from typing import SupportsBytes
 
 
 class RawEncoder:
@@ -78,5 +79,5 @@ def decode(data):
 
 
 class Encodable:
-    def encode(self, encoder=RawEncoder):
+    def encode(self: SupportsBytes, encoder=RawEncoder):
         return encoder.encode(bytes(self))

src/nacl/exceptions.py

@@ -13,6 +13,13 @@
 # limitations under the License.
 
 
+# We create a clone of various builtin Exception types which additionally
+# inherit from CryptoError. Below, we refer to the parent types via the
+# `builtins` namespace, so mypy can distinguish between (e.g.)
+# `nacl.exceptions.RuntimeError` and `builtins.RuntimeError`.
+import builtins
+
+
 class CryptoError(Exception):
     """
     Base exception for all nacl related errors
@@ -25,19 +32,19 @@ class BadSignatureError(CryptoError):
     """
 
 
-class RuntimeError(RuntimeError, CryptoError):
+class RuntimeError(builtins.RuntimeError, CryptoError):
     pass
 
 
-class AssertionError(AssertionError, CryptoError):
+class AssertionError(builtins.AssertionError, CryptoError):
     pass
 
 
-class TypeError(TypeError, CryptoError):
+class TypeError(builtins.TypeError, CryptoError):
     pass
 
 
-class ValueError(ValueError, CryptoError):
+class ValueError(builtins.ValueError, CryptoError):
     pass
 
 

src/nacl/signing.py

@@ -29,6 +29,9 @@ class SignedMessage(bytes):
     :class:`SigningKey`.
     """
 
+    _signature: object
+    _message: object
+
     @classmethod
     def _from_parts(cls, signature, message, combined):
         obj = cls(combined)

src/nacl/utils.py

@@ -14,6 +14,7 @@
 
 
 import os
+from typing import SupportsBytes
 
 import nacl.bindings
 from nacl import encoding
@@ -25,6 +26,9 @@ class EncryptedMessage(bytes):
     :class:`SecretBox`.
     """
 
+    _nonce = object
+    _ciphertext = object
+
     @classmethod
     def _from_parts(cls, nonce, ciphertext, combined):
         obj = cls(combined)
@@ -48,7 +52,7 @@ def ciphertext(self):
 
 
 class StringFixer:
-    def __str__(self):
+    def __str__(self: SupportsBytes):
         return str(self.__bytes__())
 
 

tox.ini

@@ -1,5 +1,5 @@
 [tox]
-envlist = pypy,py36,py37,py38,docs,meta
+envlist = pypy,py36,py37,py38,docs,meta,mypy
 isolated_build = True
 
 [testenv]
@@ -37,6 +37,12 @@ commands =
     black --check .
     check-manifest . --ignore .travis.yml
 
+[testenv:mypy]
+deps =
+    mypy
+commands =
+    mypy
+
 [flake8]
 ignore = E203,E501,W503,W504
 select = E,W,F,I