dstu-core (Python bindings)

Not independently audited. See the root project's docs/SECURITY.md and docs/DECISIONS.md for the full threat model and per-construction status. This binding wraps the full dstu_core::crypto_* surface (docs/bindings-strategy.md T-49).

Installing

pip install dstu-core
python -c "import dstu_core; dstu_core.selftest()"

Building from source (contributors)

python -m venv .venv
source .venv/bin/activate        # or .venv\Scripts\activate on Windows
pip install maturin
maturin develop --release
python -c "import dstu_core; dstu_core.selftest()"

pyo3 needs a real Python interpreter to link against at build time. Plain python/python3 may not be enough to find one — on Windows in particular, those names can resolve to non-functional Microsoft Store alias stubs instead of a real install. If cargo build/maturin develop fails to find (or finds the wrong) Python, point it at one explicitly:

export PYO3_PYTHON=/path/to/a/real/python3   # POSIX
$env:PYO3_PYTHON = "C:\path\to\python.exe"   # PowerShell

maturin develop builds the Rust extension and installs it into the active virtualenv as an editable package. dstu_core.selftest() re-runs dstu_core::selftest::run() (docs/TASKS.md T-161) against the exact compiled build and raises RuntimeError if anything official-vector-level is wrong — the first thing to run after any build to confirm it actually works, not just compiled.

This crate is its own Cargo workspace, separate from the repo root (docs/DECISIONS.md D-119) — build/test it from inside this directory, not from the repo root.

Usage

Every function/class below lives directly on the dstu_core module (no submodules). See examples/ for complete, runnable scripts, and tests/ for the full correctness/rejection/misuse suite each one is verified against (D-64/D-65).

import dstu_core as d

key = d.secretbox_keygen()
sealed = d.secretbox_seal(key, b"a message worth protecting")
assert d.secretbox_open(key, sealed) == b"a message worth protecting"

Testing

pip install pytest ruff
pytest
ruff check .
ruff format --check .

cargo build -p uacrypt --release (from the repo root) first if you want tests/test_secretstream.py's live uacrypt CLI interop test to actually run instead of skipping. cargo xtask python (from the repo root) runs this whole sequence, including that build step, in one command.