Merge pull request #293 from chrysn-pull-requests/pyo3022

python: Migrate to pyo3 0.22

lakers-python/Cargo.toml

@@ -8,7 +8,7 @@ license.workspace = true
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
-pyo3 = { version = "0.20.2", features = ["extension-module"] }
+pyo3 = { version = "0.22", features = ["extension-module"] }
 lakers = { package = "lakers", path = "../lib", default-features = false }
 lakers-ead-authz = { path = "../ead/lakers-ead-authz" }
 lakers-shared = { path = "../shared", features = ["python-bindings", "quadruple_sizes"] }

lakers-python/src/ead_authz/authenticator.rs

@@ -26,15 +26,15 @@ impl PyAuthzAutenticator {
         py: Python<'a>,
         ead_1: EADItem,
         message_1: Vec<u8>,
-    ) -> PyResult<(&'a PyString, &'a PyBytes)> {
+    ) -> PyResult<(Bound<'a, PyString>, Bound<'a, PyBytes>)> {
         let message_1 = EdhocMessageBuffer::new_from_slice(message_1.as_slice())?;
         let (state, loc_w, voucher_request) =
             self.authenticator.process_ead_1(&ead_1, &message_1)?;
         self.authenticator_wait = state;
         let loc_w = std::str::from_utf8(loc_w.as_slice()).unwrap();
         Ok((
-            PyString::new(py, loc_w),
-            PyBytes::new(py, voucher_request.as_slice()),
+            PyString::new_bound(py, loc_w),
+            PyBytes::new_bound(py, voucher_request.as_slice()),
         ))
     }
 

lakers-python/src/ead_authz/device.rs

@@ -58,7 +58,7 @@ impl PyAuthzDevice {
         self.device_wait.set_h_message_1(h_message_1_arr);
     }
 
-    pub fn get_g_w<'a>(&self, py: Python<'a>) -> PyResult<&'a PyBytes> {
-        Ok(PyBytes::new(py, &self.device.g_w[..]))
+    pub fn get_g_w<'a>(&self, py: Python<'a>) -> PyResult<Bound<'a, PyBytes>> {
+        Ok(PyBytes::new_bound(py, &self.device.g_w[..]))
     }
 }

lakers-python/src/ead_authz/server.rs

@@ -25,13 +25,17 @@ impl PyAuthzEnrollmentServer {
         }
     }
 
-    fn handle_voucher_request<'a>(&self, py: Python<'a>, vreq: Vec<u8>) -> PyResult<&'a PyBytes> {
+    fn handle_voucher_request<'a>(
+        &self,
+        py: Python<'a>,
+        vreq: Vec<u8>,
+    ) -> PyResult<Bound<'a, PyBytes>> {
         let vreq = EdhocMessageBuffer::new_from_slice(vreq.as_slice()).unwrap();
         match self
             .server
             .handle_voucher_request(&mut default_crypto(), &vreq)
         {
-            Ok(voucher_response) => Ok(PyBytes::new(py, voucher_response.as_slice())),
+            Ok(voucher_response) => Ok(PyBytes::new_bound(py, voucher_response.as_slice())),
             Err(error) => Err(error.into()),
         }
     }
@@ -54,21 +58,25 @@ impl PyAuthzServerUserAcl {
         }
     }
 
-    fn decode_voucher_request<'a>(&self, py: Python<'a>, vreq: Vec<u8>) -> PyResult<&'a PyBytes> {
+    fn decode_voucher_request<'a>(
+        &self,
+        py: Python<'a>,
+        vreq: Vec<u8>,
+    ) -> PyResult<Bound<'a, PyBytes>> {
         let vreq = EdhocMessageBuffer::new_from_slice(vreq.as_slice()).unwrap();
         match self
             .server
             .decode_voucher_request(&mut default_crypto(), &vreq)
         {
-            Ok(id_u) => Ok(PyBytes::new(py, id_u.as_slice())),
+            Ok(id_u) => Ok(PyBytes::new_bound(py, id_u.as_slice())),
             Err(error) => Err(error.into()),
         }
     }
 
-    fn prepare_voucher<'a>(&self, py: Python<'a>, vreq: Vec<u8>) -> PyResult<&'a PyBytes> {
+    fn prepare_voucher<'a>(&self, py: Python<'a>, vreq: Vec<u8>) -> PyResult<Bound<'a, PyBytes>> {
         let vreq = EdhocMessageBuffer::new_from_slice(vreq.as_slice()).unwrap();
         match self.server.prepare_voucher(&mut default_crypto(), &vreq) {
-            Ok(voucher_response) => Ok(PyBytes::new(py, voucher_response.as_slice())),
+            Ok(voucher_response) => Ok(PyBytes::new_bound(py, voucher_response.as_slice())),
             Err(error) => Err(error.into()),
         }
     }

lakers-python/src/initiator.rs

@@ -42,7 +42,7 @@ impl PyEdhocInitiator {
         py: Python<'a>,
         c_i: Option<Vec<u8>>,
         ead_1: Option<EADItem>,
-    ) -> PyResult<&'a PyBytes> {
+    ) -> PyResult<Bound<'a, PyBytes>> {
         let c_i = match c_i {
             Some(c_i) => ConnId::from_slice(c_i.as_slice()).ok_or(
                 pyo3::exceptions::PyValueError::new_err("Connection identifier out of range"),
@@ -53,7 +53,7 @@ impl PyEdhocInitiator {
         match i_prepare_message_1(&self.start, &mut default_crypto(), c_i, &ead_1) {
             Ok((state, message_1)) => {
                 self.wait_m2 = state;
-                Ok(PyBytes::new(py, message_1.as_slice()))
+                Ok(PyBytes::new_bound(py, message_1.as_slice()))
             }
             Err(error) => Err(error.into()),
         }
@@ -63,18 +63,18 @@ impl PyEdhocInitiator {
         &mut self,
         py: Python<'a>,
         message_2: Vec<u8>,
-    ) -> PyResult<(&'a PyBytes, &'a PyBytes, Option<EADItem>)> {
+    ) -> PyResult<(Bound<'a, PyBytes>, Bound<'a, PyBytes>, Option<EADItem>)> {
         let message_2 = EdhocMessageBuffer::new_from_slice(message_2.as_slice())?;
 
         match i_parse_message_2(&self.wait_m2, &mut default_crypto(), &message_2) {
             Ok((state, c_r, id_cred_r, ead_2)) => {
                 self.processing_m2 = state;
                 let id_cred_r = if id_cred_r.reference_only() {
-                    PyBytes::new(py, &[id_cred_r.kid])
+                    PyBytes::new_bound(py, &[id_cred_r.kid])
                 } else {
-                    PyBytes::new(py, id_cred_r.value.as_slice())
+                    PyBytes::new_bound(py, id_cred_r.value.as_slice())
                 };
-                let c_r = PyBytes::new(py, c_r.as_slice());
+                let c_r = PyBytes::new_bound(py, c_r.as_slice());
                 Ok((c_r, id_cred_r, ead_2))
             }
             Err(error) => Err(error.into()),
@@ -112,7 +112,7 @@ impl PyEdhocInitiator {
         py: Python<'a>,
         cred_transfer: CredentialTransfer,
         ead_3: Option<EADItem>,
-    ) -> PyResult<(&'a PyBytes, &'a PyBytes)> {
+    ) -> PyResult<(Bound<'a, PyBytes>, Bound<'a, PyBytes>)> {
         match i_prepare_message_3(
             &mut self.processed_m2,
             &mut default_crypto(),
@@ -123,8 +123,8 @@ impl PyEdhocInitiator {
             Ok((state, message_3, prk_out)) => {
                 self.completed = state;
                 Ok((
-                    PyBytes::new(py, message_3.as_slice()),
-                    PyBytes::new(py, prk_out.as_slice()),
+                    PyBytes::new_bound(py, message_3.as_slice()),
+                    PyBytes::new_bound(py, prk_out.as_slice()),
                 ))
             }
             Err(error) => Err(error.into()),
@@ -137,7 +137,7 @@ impl PyEdhocInitiator {
         label: u8,
         context: Vec<u8>,
         length: usize,
-    ) -> PyResult<&'a PyBytes> {
+    ) -> PyResult<Bound<'a, PyBytes>> {
         let mut context_buf: BytesMaxContextBuffer = [0x00u8; MAX_KDF_CONTEXT_LEN];
         context_buf[..context.len()].copy_from_slice(context.as_slice());
 
@@ -149,14 +149,14 @@ impl PyEdhocInitiator {
             context.len(),
             length,
         );
-        Ok(PyBytes::new(py, &res[..length]))
+        Ok(PyBytes::new_bound(py, &res[..length]))
     }
 
     pub fn edhoc_key_update<'a>(
         &mut self,
         py: Python<'a>,
         context: Vec<u8>,
-    ) -> PyResult<&'a PyBytes> {
+    ) -> PyResult<Bound<'a, PyBytes>> {
         let mut context_buf = [0x00u8; MAX_KDF_CONTEXT_LEN];
         context_buf[..context.len()].copy_from_slice(context.as_slice());
 
@@ -166,22 +166,22 @@ impl PyEdhocInitiator {
             &context_buf,
             context.len(),
         );
-        Ok(PyBytes::new(py, &res[..SHA256_DIGEST_LEN]))
+        Ok(PyBytes::new_bound(py, &res[..SHA256_DIGEST_LEN]))
     }
 
-    pub fn get_h_message_1<'a>(&self, py: Python<'a>) -> PyResult<&'a PyBytes> {
-        Ok(PyBytes::new(py, &self.wait_m2.h_message_1[..]))
+    pub fn get_h_message_1<'a>(&self, py: Python<'a>) -> PyResult<Bound<'a, PyBytes>> {
+        Ok(PyBytes::new_bound(py, &self.wait_m2.h_message_1[..]))
     }
 
     pub fn compute_ephemeral_secret<'a>(
         &self,
         py: Python<'a>,
         g_a: Vec<u8>,
-    ) -> PyResult<&'a PyBytes> {
+    ) -> PyResult<Bound<'a, PyBytes>> {
         let mut g_a_arr = BytesP256ElemLen::default();
         g_a_arr.copy_from_slice(&g_a[..]);
         let secret = default_crypto().p256_ecdh(&self.start.x, &g_a_arr);
-        Ok(PyBytes::new(py, &secret[..]))
+        Ok(PyBytes::new_bound(py, &secret[..]))
     }
 
     pub fn selected_cipher_suite(&self) -> PyResult<u8> {

lakers-python/src/lib.rs

@@ -21,7 +21,7 @@ pub fn py_credential_check_or_fetch<'a>(
     py: Python<'a>,
     id_cred_received: Vec<u8>,
     cred_expected: Option<AutoCredentialRPK>,
-) -> PyResult<&'a PyBytes> {
+) -> PyResult<Bound<'a, PyBytes>> {
     let cred_expected = cred_expected.map(|c| c.to_credential()).transpose()?;
 
     let valid_cred = if id_cred_received.len() == 1 {
@@ -41,16 +41,18 @@ pub fn py_credential_check_or_fetch<'a>(
             )?,
         )?
     };
-    Ok(PyBytes::new(py, valid_cred.value.as_slice()))
+    Ok(PyBytes::new_bound(py, valid_cred.value.as_slice()))
 }
 
 /// this function is useful to test the python bindings
 #[pyfunction]
-fn p256_generate_key_pair<'a>(py: Python<'a>) -> PyResult<(&'a PyBytes, &'a PyBytes)> {
+fn p256_generate_key_pair<'a>(
+    py: Python<'a>,
+) -> PyResult<(Bound<'a, PyBytes>, Bound<'a, PyBytes>)> {
     let (x, g_x) = default_crypto().p256_generate_key_pair();
     Ok((
-        PyBytes::new(py, x.as_slice()),
-        PyBytes::new(py, g_x.as_slice()),
+        PyBytes::new_bound(py, x.as_slice()),
+        PyBytes::new_bound(py, g_x.as_slice()),
     ))
 }
 
@@ -79,7 +81,7 @@ impl AutoCredentialRPK {
 // this name must match `lib.name` in `Cargo.toml`
 #[pymodule]
 #[pyo3(name = "lakers")]
-fn lakers_python(_py: Python, m: &PyModule) -> PyResult<()> {
+fn lakers_python(_py: Python, m: &Bound<'_, PyModule>) -> PyResult<()> {
     m.add_function(wrap_pyfunction!(p256_generate_key_pair, m)?)?;
     m.add_function(wrap_pyfunction!(py_credential_check_or_fetch, m)?)?;
     // edhoc items
@@ -94,8 +96,8 @@ fn lakers_python(_py: Python, m: &PyModule) -> PyResult<()> {
     m.add_class::<ead_authz::PyAuthzEnrollmentServer>()?;
     m.add_class::<ead_authz::PyAuthzServerUserAcl>()?;
 
-    let submodule = PyModule::new(_py, "consts")?;
+    let submodule = PyModule::new_bound(_py, "consts")?;
     submodule.add("EAD_AUTHZ_LABEL", lakers_ead_authz::consts::EAD_AUTHZ_LABEL)?;
-    m.add_submodule(submodule)?;
+    m.add_submodule(&submodule)?;
     Ok(())
 }

lakers-python/src/responder.rs

@@ -36,12 +36,12 @@ impl PyEdhocResponder {
         &mut self,
         py: Python<'a>,
         message_1: Vec<u8>,
-    ) -> PyResult<(&'a PyBytes, Option<EADItem>)> {
+    ) -> PyResult<(Bound<'a, PyBytes>, Option<EADItem>)> {
         let message_1 = EdhocMessageBuffer::new_from_slice(message_1.as_slice())?;
         let (state, c_i, ead_1) =
             r_process_message_1(&self.start, &mut default_crypto(), &message_1)?;
         self.processing_m1 = state;
-        let c_i = PyBytes::new(py, c_i.as_slice());
+        let c_i = PyBytes::new_bound(py, c_i.as_slice());
 
         Ok((c_i, ead_1))
     }
@@ -52,7 +52,7 @@ impl PyEdhocResponder {
         cred_transfer: CredentialTransfer,
         c_r: Option<Vec<u8>>,
         ead_2: Option<EADItem>,
-    ) -> PyResult<&'a PyBytes> {
+    ) -> PyResult<Bound<'a, PyBytes>> {
         let c_r = match c_r {
             Some(c_r) => ConnId::from_slice(c_r.as_slice()).ok_or(
                 pyo3::exceptions::PyValueError::new_err("Connection identifier out of range"),
@@ -73,7 +73,7 @@ impl PyEdhocResponder {
         ) {
             Ok((state, message_2)) => {
                 self.wait_m3 = state;
-                Ok(PyBytes::new(py, message_2.as_slice()))
+                Ok(PyBytes::new_bound(py, message_2.as_slice()))
             }
             Err(error) => Err(error.into()),
         }
@@ -83,15 +83,15 @@ impl PyEdhocResponder {
         &mut self,
         py: Python<'a>,
         message_3: Vec<u8>,
-    ) -> PyResult<(&'a PyBytes, Option<EADItem>)> {
+    ) -> PyResult<(Bound<'a, PyBytes>, Option<EADItem>)> {
         let message_3 = EdhocMessageBuffer::new_from_slice(message_3.as_slice())?;
         match r_parse_message_3(&mut self.wait_m3, &mut default_crypto(), &message_3) {
             Ok((state, id_cred_i, ead_3)) => {
                 self.processing_m3 = state;
                 let id_cred_i = if id_cred_i.reference_only() {
-                    PyBytes::new(py, &[id_cred_i.kid])
+                    PyBytes::new_bound(py, &[id_cred_i.kid])
                 } else {
-                    PyBytes::new(py, id_cred_i.value.as_slice())
+                    PyBytes::new_bound(py, id_cred_i.value.as_slice())
                 };
                 Ok((id_cred_i, ead_3))
             }
@@ -103,12 +103,12 @@ impl PyEdhocResponder {
         &mut self,
         py: Python<'a>,
         valid_cred_i: super::AutoCredentialRPK,
-    ) -> PyResult<&'a PyBytes> {
+    ) -> PyResult<Bound<'a, PyBytes>> {
         let valid_cred_i = valid_cred_i.to_credential()?;
         match r_verify_message_3(&mut self.processing_m3, &mut default_crypto(), valid_cred_i) {
             Ok((state, prk_out)) => {
                 self.completed = state;
-                Ok(PyBytes::new(py, prk_out.as_slice()))
+                Ok(PyBytes::new_bound(py, prk_out.as_slice()))
             }
             Err(error) => Err(error.into()),
         }
@@ -120,7 +120,7 @@ impl PyEdhocResponder {
         label: u8,
         context: Vec<u8>,
         length: usize,
-    ) -> PyResult<&'a PyBytes> {
+    ) -> PyResult<Bound<'a, PyBytes>> {
         let mut context_buf: BytesMaxContextBuffer = [0x00u8; MAX_KDF_CONTEXT_LEN];
         context_buf[..context.len()].copy_from_slice(context.as_slice());
 
@@ -132,14 +132,14 @@ impl PyEdhocResponder {
             context.len(),
             length,
         );
-        Ok(PyBytes::new(py, &res[..length]))
+        Ok(PyBytes::new_bound(py, &res[..length]))
     }
 
     pub fn edhoc_key_update<'a>(
         &mut self,
         py: Python<'a>,
         context: Vec<u8>,
-    ) -> PyResult<&'a PyBytes> {
+    ) -> PyResult<Bound<'a, PyBytes>> {
         let mut context_buf = [0x00u8; MAX_KDF_CONTEXT_LEN];
         context_buf[..context.len()].copy_from_slice(context.as_slice());
 
@@ -149,6 +149,6 @@ impl PyEdhocResponder {
             &context_buf,
             context.len(),
         );
-        Ok(PyBytes::new(py, &res[..SHA256_DIGEST_LEN]))
+        Ok(PyBytes::new_bound(py, &res[..SHA256_DIGEST_LEN]))
     }
 }

shared/Cargo.toml

@@ -12,7 +12,7 @@ keywords.workspace = true
 categories.workspace = true
 
 [dependencies]
-pyo3 = { version = "0.20.2", features = ["extension-module"], optional = true }
+pyo3 = { version = "0.22", features = ["extension-module"], optional = true }
 hex = { version = "0.4.3", optional = true }
 log = "0.4"
 

shared/src/python_bindings.rs

@@ -45,8 +45,10 @@ impl EADItem {
         }
     }
 
-    fn value<'a>(&self, py: Python<'a>) -> Option<&'a PyBytes> {
-        self.value.as_ref().map(|v| PyBytes::new(py, v.as_slice()))
+    fn value<'a>(&self, py: Python<'a>) -> Option<Bound<'a, PyBytes>> {
+        self.value
+            .as_ref()
+            .map(|v| PyBytes::new_bound(py, v.as_slice()))
     }
 
     fn label(&self) -> u8 {
@@ -104,12 +106,12 @@ impl CredentialRPK {
         )
     }
 
-    fn value<'a>(&self, py: Python<'a>) -> &'a PyBytes {
-        PyBytes::new(py, self.value.as_slice())
+    fn value<'a>(&self, py: Python<'a>) -> Bound<'a, PyBytes> {
+        PyBytes::new_bound(py, self.value.as_slice())
     }
 
-    fn public_key<'a>(&self, py: Python<'a>) -> &'a PyBytes {
-        PyBytes::new(py, self.public_key.as_slice())
+    fn public_key<'a>(&self, py: Python<'a>) -> Bound<'a, PyBytes> {
+        PyBytes::new_bound(py, self.public_key.as_slice())
     }
 
     fn kid(&self) -> u8 {