From 12cc01799f096966a71576d7615446f797d04ab0 Mon Sep 17 00:00:00 2001 From: Paul Flynn Date: Mon, 19 Oct 2026 13:02:30 -0400 Subject: [PATCH] refactor(xtest): rename the hexless feature to hexless_integrity The 'hexless' feature, representing TDF 4.3.0 hexless integrity hashes, is renamed to 'hexless_integrity' to avoid ambiguity with the upcoming 'hexless_policy_binding' option. This is a pure rename with no behavioral changes. Co-Authored-By: Claude Opus 5.5 (1M context) Signed-off-by: Paul Flynn --- otdf-local/src/otdf_local/config/features.py | 4 +- xtest/fixtures/bench.py | 6 ++- xtest/perf/README.md | 2 +- xtest/sdk/go/cli.sh | 4 +- xtest/sdk/java/cli.sh | 2 +- xtest/sdk/js/cli.sh | 2 +- xtest/tdfs.py | 20 ++++++---- xtest/test_abac.py | 40 ++++++++++---------- xtest/test_audit_logs_integration.py | 12 +++--- xtest/test_legacy.py | 24 ++++++------ xtest/test_policytypes.py | 2 +- xtest/test_pqc.py | 12 +++--- xtest/test_root_signature.py | 2 +- xtest/test_tdfs.py | 32 ++++++++-------- xtest/test_tdfs_units.py | 6 +-- xtest/test_zip64.py | 2 +- 16 files changed, 90 insertions(+), 82 deletions(-) diff --git a/otdf-local/src/otdf_local/config/features.py b/otdf-local/src/otdf_local/config/features.py index 306a4e1b5..f6434976b 100644 --- a/otdf-local/src/otdf_local/config/features.py +++ b/otdf-local/src/otdf_local/config/features.py @@ -16,7 +16,7 @@ "bulk_rewrap", "connectrpc", "ecwrap", - "hexless", + "hexless_integrity", "hexaflexible", "kasallowlist", "key_management", @@ -96,7 +96,7 @@ def _compute_features(semver: tuple[int, int, int]) -> set[FeatureType]: # Hexless format support if semver >= (0, 4, 39): - features.add("hexless") + features.add("hexless_integrity") features.add("hexaflexible") # Namespace grants diff --git a/xtest/fixtures/bench.py b/xtest/fixtures/bench.py index d5194b380..bac5ca451 100644 --- a/xtest/fixtures/bench.py +++ b/xtest/fixtures/bench.py @@ -235,7 +235,7 @@ def _spec_for(spec: str | None, sdk: str) -> str | None: #: operation, and a timing difference between them is a difference in work, #: not in speed. _COMPARABILITY_FEATURES: tuple[tdfs.feature_type, ...] = ( - "hexless", + "hexless_integrity", "hexaflexible", "autoconfigure", ) @@ -270,7 +270,9 @@ def pinned_target_mode(arms: BenchArms) -> tdfs.container_version | None: and arms.candidate.supports("hexaflexible") ): return None - if arms.baseline.supports("hexless") and arms.candidate.supports("hexless"): + if arms.baseline.supports("hexless_integrity") and arms.candidate.supports( + "hexless_integrity" + ): return "4.3.0" return "4.2.2" diff --git a/xtest/perf/README.md b/xtest/perf/README.md index 3bce3fefb..1163c7a6f 100644 --- a/xtest/perf/README.md +++ b/xtest/perf/README.md @@ -438,7 +438,7 @@ delta reads zero. Both arms get the same plaintext, the same attribute (explicit RSA, so an arm does not silently switch to EC), the same container, and the same target mode. `comparability_problem()` refuses the comparison outright when the two builds -disagree on `hexless`, `hexaflexible`, or `autoconfigure` — a timing difference +disagree on `hexless_integrity`, `hexaflexible`, or `autoconfigure` — a timing difference there is a difference in *work*, not in speed. For decrypt, both arms read one ciphertext produced by the baseline. If each arm diff --git a/xtest/sdk/go/cli.sh b/xtest/sdk/go/cli.sh index c12168ac0..bc07ce0c6 100755 --- a/xtest/sdk/go/cli.sh +++ b/xtest/sdk/go/cli.sh @@ -77,9 +77,9 @@ if [ "$1" == "supports" ]; then exit 1 fi ;; - hexless) + hexless_integrity) set -o pipefail - # Schema version 4.3.0 introduced hexless + # Schema version 4.3.0 introduced hexless integrity "${cmd[@]}" --version --json | jq -re .schema_version | awk -F. '{ if ($1 > 4 || ($1 == 4 && $2 >= 2)) exit 0; else exit 1; }' exit $? ;; diff --git a/xtest/sdk/java/cli.sh b/xtest/sdk/java/cli.sh index a6986fe69..7da503c8a 100755 --- a/xtest/sdk/java/cli.sh +++ b/xtest/sdk/java/cli.sh @@ -104,7 +104,7 @@ if [ "$1" == "supports" ]; then fi ;; - hexless) + hexless_integrity) set -o pipefail java -jar "$SCRIPT_DIR"/cmdline.jar --version | jq -re .tdfSpecVersion | awk -F. '{ if ($1 > 4 || ($1 == 4 && $2 > 2) || ($1 == 4 && $2 == 3 && $3 >= 0)) exit 0; else exit 1; }' exit $? diff --git a/xtest/sdk/js/cli.sh b/xtest/sdk/js/cli.sh index 7add678a0..9af5a6915 100755 --- a/xtest/sdk/js/cli.sh +++ b/xtest/sdk/js/cli.sh @@ -67,7 +67,7 @@ if [[ "$1" == "supports" ]]; then exit 1 fi ;; - hexless) + hexless_integrity) set -o pipefail npx $CTL --version | jq -re .tdfSpecVersion | awk -F. '{ if ($1 > 4 || ($1 == 4 && $2 > 2) || ($1 == 4 && $2 == 3 && $3 >= 0)) exit 0; else exit 1; }' exit $? diff --git a/xtest/tdfs.py b/xtest/tdfs.py index 60bf26e9c..2f732d5ef 100644 --- a/xtest/tdfs.py +++ b/xtest/tdfs.py @@ -166,7 +166,7 @@ def is_sdk_type(val: str) -> TypeIs[sdk_type]: # unconditionally, which is how you get a red repro out of a build that is # still vulnerable rather than a skip. "gmac_root_rejected", - "hexless", + "hexless_integrity", "hexaflexible", "kasallowlist", # Platform: resolve managed keys using the KAS URI from the KAO. Force-only @@ -351,7 +351,7 @@ def __init__(self, **kwargs: dict[str, Any]): # Included in SDK 0.3.27, service 0.4.39 if self.semver >= (0, 4, 39): - self.features.add("hexless") + self.features.add("hexless_integrity") self.features.add("hexaflexible") if self.semver >= (0, 4, 19): @@ -1041,12 +1041,14 @@ def skip_if_unsupported(sdk: SDK, *features: feature_type): sdk.skip_if_unsupported(*features) -def skip_hexless_skew(encrypt_sdk: SDK, decrypt_sdk: SDK): +def skip_hexless_integrity_skew(encrypt_sdk: SDK, decrypt_sdk: SDK): if encrypt_sdk.supports("hexaflexible"): return - if encrypt_sdk.supports("hexless") and not decrypt_sdk.supports("hexless"): + if encrypt_sdk.supports("hexless_integrity") and not decrypt_sdk.supports( + "hexless_integrity" + ): pytest.skip( - f"{decrypt_sdk} sdk doesn't yet support [hexless], but {encrypt_sdk} does" + f"{decrypt_sdk} sdk doesn't yet support hexless integrity, but {encrypt_sdk} does" ) @@ -1191,8 +1193,12 @@ def skip_pqc_hybrid_format_skew(encrypt_sdk: SDK | None = None) -> None: def select_target_version( encrypt_sdk: SDK, decrypt_sdk: SDK ) -> container_version | None: - if encrypt_sdk.supports("hexaflexible") and not decrypt_sdk.supports("hexless"): + if encrypt_sdk.supports("hexaflexible") and not decrypt_sdk.supports( + "hexless_integrity" + ): return "4.2.2" - if encrypt_sdk.supports("hexaflexible") and decrypt_sdk.supports("hexless"): + if encrypt_sdk.supports("hexaflexible") and decrypt_sdk.supports( + "hexless_integrity" + ): return "4.3.0" return None diff --git a/xtest/test_abac.py b/xtest/test_abac.py index a86c588db..aa7a10e61 100644 --- a/xtest/test_abac.py +++ b/xtest/test_abac.py @@ -93,7 +93,7 @@ def test_key_mapping_multiple_mechanisms( tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) # Currently, we only support rsa:2048 and ec:secp256r1 vals = [ @@ -145,7 +145,7 @@ def test_key_mapping_extended_mechanisms( ) pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) skip_dspx1153(encrypt_sdk, decrypt_sdk) attr, key_ids = attribute_allof_with_extended_mechanisms @@ -208,7 +208,7 @@ def test_key_mapping_extended_ec_mechanisms( "key_management", "autoconfigure", "mechanism-ec-curves-384-521" ) tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) skip_dspx1153(encrypt_sdk, decrypt_sdk) attr, key_ids = attribute_allof_with_extended_mechanisms @@ -266,7 +266,7 @@ def test_key_mapping_extended_rsa_mechanisms( encrypt_sdk.skip_if_unsupported("mechanism-rsa-4096") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) skip_dspx1153(encrypt_sdk, decrypt_sdk) attr, key_ids = attribute_allof_with_extended_mechanisms @@ -321,7 +321,7 @@ def test_autoconfigure_one_attribute_standard( tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) ct_file = encrypted_tdf( encrypt_sdk, @@ -368,7 +368,7 @@ def test_autoconfigure_two_kas_or_standard( tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) ct_file = encrypted_tdf( encrypt_sdk, @@ -421,7 +421,7 @@ def test_autoconfigure_double_kas_and( tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) ct_file = encrypted_tdf( encrypt_sdk, @@ -473,7 +473,7 @@ def test_autoconfigure_one_attribute_attr_grant( tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) ct_file = encrypted_tdf( encrypt_sdk, @@ -511,7 +511,7 @@ def test_autoconfigure_two_kas_or_attr_and_value_grant( tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) ct_file = encrypted_tdf( encrypt_sdk, @@ -556,7 +556,7 @@ def test_autoconfigure_two_kas_and_attr_and_value_grant( tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) ct_file = encrypted_tdf( encrypt_sdk, @@ -600,7 +600,7 @@ def test_autoconfigure_one_attribute_ns_grant( tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure", "ns_grants") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) ct_file = encrypted_tdf( encrypt_sdk, @@ -638,7 +638,7 @@ def test_autoconfigure_two_kas_or_ns_and_value_grant( tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure", "ns_grants") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) ct_file = encrypted_tdf( encrypt_sdk, @@ -683,7 +683,7 @@ def test_autoconfigure_two_kas_and_ns_and_value_grant( tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure", "ns_grants") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) ct_file = encrypted_tdf( encrypt_sdk, @@ -953,7 +953,7 @@ def test_decrypt_uses_kao_kas_registration( pytest.skip("Not in focus") encrypt_sdk.skip_if_unsupported("key_management", "autoconfigure") decrypt_sdk.skip_if_unsupported("key_management") - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) attr, key = attribute_with_alternate_kas_registration ct_file = encrypted_tdf( @@ -1030,7 +1030,7 @@ def test_decrypt_rejects_kao_kas_registration_when_disabled( pytest.skip("Not in focus") encrypt_sdk.skip_if_unsupported("key_management", "autoconfigure") decrypt_sdk.skip_if_unsupported("key_management") - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) attr, key = attribute_with_alternate_kas_registration_disabled ct_file = encrypted_tdf( @@ -1112,7 +1112,7 @@ def test_decrypt_same_kid_in_different_registries_with_cache( pytest.skip("Not in focus") encrypt_sdk.skip_if_unsupported("key_management", "autoconfigure") decrypt_sdk.skip_if_unsupported("key_management") - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) ciphertexts = [] for attr, key in attributes_with_same_kid_in_different_registries: @@ -1175,7 +1175,7 @@ def test_autoconfigure_key_management_two_kas_two_keys( skip_dspx2457(encrypt_sdk) pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) ct_file = encrypted_tdf( encrypt_sdk, @@ -1246,8 +1246,8 @@ def test_import_legacy_golden_r1_key_and_decrypt_no_split( if not in_focus & {decrypt_sdk}: pytest.skip("Not in focus") tdfs.skip_if_unsupported(decrypt_sdk, "key_management") - if not decrypt_sdk.supports("hexless"): - pytest.skip("Decrypting hexless files is not supported") + if not decrypt_sdk.supports("hexless_integrity"): + pytest.skip("Decrypting hexless integrity files is not supported") from test_legacy import get_golden_file @@ -1274,7 +1274,7 @@ def test_encrypt_decrypt_all_containers_with_base_key_e1( tdfs.skip_if_unsupported(decrypt_sdk, "key_management") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) sample_name = f"base-e1-{encrypt_sdk}" ct_file = tmp_dir / f"{sample_name}.tdf" diff --git a/xtest/test_audit_logs_integration.py b/xtest/test_audit_logs_integration.py index 06ddbccdb..e5c13d08d 100644 --- a/xtest/test_audit_logs_integration.py +++ b/xtest/test_audit_logs_integration.py @@ -62,7 +62,7 @@ def test_rewrap_success_fields( pytest.skip("Not in focus") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) ct_file = tmp_dir / f"rewrap-success-{encrypt_sdk}.tdf" encrypt_sdk.encrypt( @@ -110,7 +110,7 @@ def test_rewrap_success_with_attributes( pytest.skip("Not in focus") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure") # Create a TDF with an attribute - the test client should have access @@ -156,7 +156,7 @@ def test_multiple_kao_rewrap_audit( pytest.skip("Not in focus") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure") ct_file = tmp_dir / f"multi-kao-{encrypt_sdk}.tdf" @@ -310,7 +310,7 @@ def test_decision_on_successful_access( pytest.skip("Not in focus") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) tdfs.skip_if_unsupported(encrypt_sdk, "autoconfigure") ct_file = tmp_dir / f"decision-success-{encrypt_sdk}.tdf" @@ -372,7 +372,7 @@ def test_audit_logs_on_tampered_file( pytest.skip("Not in focus") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) # Create valid TDF ct_file = tmp_dir / f"tamper-audit-{encrypt_sdk}.tdf" @@ -431,7 +431,7 @@ def test_audit_under_sequential_load( pytest.skip("Not in focus") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) num_decrypts = 5 diff --git a/xtest/test_legacy.py b/xtest/test_legacy.py index 4a221ff17..22536ee1e 100644 --- a/xtest/test_legacy.py +++ b/xtest/test_legacy.py @@ -21,8 +21,8 @@ def test_decrypt_small( ): if not in_focus & {decrypt_sdk}: pytest.skip("Not in focus") - if not decrypt_sdk.supports("hexless"): - pytest.skip("Decrypting hexless files is not supported") + if not decrypt_sdk.supports("hexless_integrity"): + pytest.skip("Decrypting hexless integrity files is not supported") ct_file = get_golden_file("small-java-4.3.0-e0f8caf.tdf") rt_file = tmp_dir / f"small-java-{decrypt_sdk}.untdf" decrypt_sdk.decrypt(ct_file, rt_file, container="ztdf") @@ -41,8 +41,8 @@ def test_decrypt_big( ): if not in_focus & {decrypt_sdk}: pytest.skip("Not in focus") - if not decrypt_sdk.supports("hexless"): - pytest.skip("Decrypting hexless files is not supported") + if not decrypt_sdk.supports("hexless_integrity"): + pytest.skip("Decrypting hexless integrity files is not supported") ct_file = get_golden_file("big-java-4.3.0-e0f8caf.tdf") rt_file = tmp_dir / f"big-java-{decrypt_sdk}.untdf" decrypt_sdk.decrypt(ct_file, rt_file, container="ztdf") @@ -62,8 +62,8 @@ def test_decrypt_SDKv0_7_5( ): if not in_focus & {decrypt_sdk}: pytest.skip("Not in focus") - if not decrypt_sdk.supports("hexless"): - pytest.skip("Decrypting hexless files is not supported") + if not decrypt_sdk.supports("hexless_integrity"): + pytest.skip("Decrypting hexless integrity files is not supported") ct_file = get_golden_file("xstext-java-v0.7.5-94b161d53-DSP2.0.2_and_2.0.3.tdf") rt_file = tmp_dir / f"0.7.5-java-{decrypt_sdk}.untdf" decrypt_sdk.decrypt(ct_file, rt_file, container="ztdf") @@ -79,8 +79,8 @@ def test_decrypt_SDKv0_7_8( ): if not in_focus & {decrypt_sdk}: pytest.skip("Not in focus") - if not decrypt_sdk.supports("hexless"): - pytest.skip("Decrypting hexless files is not supported") + if not decrypt_sdk.supports("hexless_integrity"): + pytest.skip("Decrypting hexless integrity files is not supported") ct_file = get_golden_file("xstext-java-v0.7.8-7f487c2-DSP2.0.4.tdf") rt_file = tmp_dir / f"0.7.8-java-{decrypt_sdk}.untdf" decrypt_sdk.decrypt(ct_file, rt_file, container="ztdf") @@ -96,8 +96,8 @@ def test_decrypt_SDKv0_9_0( ): if not in_focus & {decrypt_sdk}: pytest.skip("Not in focus") - if not decrypt_sdk.supports("hexless"): - pytest.skip("Decrypting hexless files is not supported") + if not decrypt_sdk.supports("hexless_integrity"): + pytest.skip("Decrypting hexless integrity files is not supported") ct_file = get_golden_file("xstext-java-v0.9.0-2de6a49-DSP2.0.5.1_and_2.0.6.tdf") rt_file = tmp_dir / f"0.9.0-java-{decrypt_sdk}.untdf" decrypt_sdk.decrypt(ct_file, rt_file, container="ztdf") @@ -112,8 +112,8 @@ def test_decrypt_no_splitid( ): if not in_focus & {decrypt_sdk}: pytest.skip("Not in focus") - if not decrypt_sdk.supports("hexless"): - pytest.skip("Decrypting hexless files is not supported") + if not decrypt_sdk.supports("hexless_integrity"): + pytest.skip("Decrypting hexless integrity files is not supported") ct_file = get_golden_file("no-splitids-java.tdf") rt_file = tmp_dir / f"no-splitids-java-{decrypt_sdk}.untdf" decrypt_sdk.decrypt(ct_file, rt_file, container="ztdf") diff --git a/xtest/test_policytypes.py b/xtest/test_policytypes.py index 95495434b..308db4c22 100644 --- a/xtest/test_policytypes.py +++ b/xtest/test_policytypes.py @@ -21,7 +21,7 @@ def skip_rts_as_needed( pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) if container == "ztdf-ecwrap": if not encrypt_sdk.supports("ecwrap"): pytest.skip(f"{encrypt_sdk} sdk doesn't yet support ecwrap bindings") diff --git a/xtest/test_pqc.py b/xtest/test_pqc.py index 9ad259983..9e35cc538 100644 --- a/xtest/test_pqc.py +++ b/xtest/test_pqc.py @@ -82,7 +82,7 @@ def test_xwing_roundtrip( "key_management", "autoconfigure", "mechanism-xwing" ) tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) tdfs.skip_pqc_hybrid_format_skew(encrypt_sdk) attr, key_ids = attribute_with_xwing_key @@ -135,7 +135,7 @@ def test_xwing_with_ec_roundtrip( "key_management", "autoconfigure", "mechanism-xwing" ) tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) tdfs.skip_pqc_hybrid_format_skew(encrypt_sdk) attr, key_ids = attribute_with_xwing_and_ec_keys @@ -200,7 +200,7 @@ def test_secpmlkem_3_roundtrip( "key_management", "autoconfigure", "mechanism-secpmlkem" ) tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) tdfs.skip_pqc_hybrid_format_skew(encrypt_sdk) attr, key_ids = attribute_with_secpmlkem_3_key @@ -279,7 +279,7 @@ def test_secpmlkem_5_roundtrip( "key_management", "autoconfigure", "mechanism-secpmlkem" ) tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) tdfs.skip_pqc_hybrid_format_skew(encrypt_sdk) attr, key_ids = attribute_with_secpmlkem_5_key @@ -343,7 +343,7 @@ def test_mlkem_768_roundtrip( "key_management", "autoconfigure", "mechanism-mlkem" ) tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) attr, key_ids = attribute_with_mlkem_768_key @@ -393,7 +393,7 @@ def test_mlkem_1024_roundtrip( "key_management", "autoconfigure", "mechanism-mlkem" ) tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) attr, key_ids = attribute_with_mlkem_1024_key diff --git a/xtest/test_root_signature.py b/xtest/test_root_signature.py index 457b55ac7..fb0728dc6 100644 --- a/xtest/test_root_signature.py +++ b/xtest/test_root_signature.py @@ -54,7 +54,7 @@ def skip_unless_in_play( ) -> None: if not in_focus & {encrypt_sdk, decrypt_sdk}: pytest.skip("Not in focus") - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) # --- manifest and payload surgery -------------------------------------------- diff --git a/xtest/test_tdfs.py b/xtest/test_tdfs.py index eb8b7fb29..c84a08f64 100644 --- a/xtest/test_tdfs.py +++ b/xtest/test_tdfs.py @@ -40,7 +40,7 @@ def test_tdf_roundtrip( pfs = tdfs.get_platform_features() if not in_focus & {encrypt_sdk, decrypt_sdk}: pytest.skip("Not in focus") - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) if container == "ztdf-ecwrap": if not encrypt_sdk.supports("ecwrap"): @@ -78,7 +78,7 @@ def test_tdf_roundtrip( assert kao.type == "wrapped" assert kao.ephemeralPublicKey is None if target_mode == "4.2.2" or ( - target_mode is None and not encrypt_sdk.supports("hexless") + target_mode is None and not encrypt_sdk.supports("hexless_integrity") ): looks_like_422(manifest) else: @@ -132,7 +132,7 @@ def test_chunky_roundtrip( """ if not in_focus & {encrypt_sdk, decrypt_sdk}: pytest.skip("Not in focus") - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) ct_file = chunky_tdf( encrypt_sdk, @@ -205,7 +205,7 @@ def test_tdf_spec_target_430( pytest.skip( f"Encrypt SDK {encrypt_sdk} doesn't support targeting container format 4.3.0" ) - if not decrypt_sdk.supports("hexless"): + if not decrypt_sdk.supports("hexless_integrity"): pytest.skip( f"Decrypt SDK {decrypt_sdk} doesn't support hexless integrity information in container format 4.3.0" ) @@ -354,7 +354,7 @@ def test_tdf_assertions_unkeyed( pfs = tdfs.get_platform_features() if not in_focus & {encrypt_sdk, decrypt_sdk}: pytest.skip("Not in focus") - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) if not encrypt_sdk.supports("assertions"): pytest.skip(f"{encrypt_sdk} sdk doesn't yet support assertions") @@ -384,7 +384,7 @@ def test_tdf_assertions_with_keys( pfs = tdfs.get_platform_features() if not in_focus & {encrypt_sdk, decrypt_sdk}: pytest.skip("Not in focus") - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) if not encrypt_sdk.supports("assertions"): pytest.skip(f"{encrypt_sdk} sdk doesn't yet support assertions") @@ -626,7 +626,7 @@ def test_tdf_with_unbound_policy( pytest.skip("Not in focus") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) ct_file = encrypted_tdf( encrypt_sdk, target_mode=tdfs.select_target_version(encrypt_sdk, decrypt_sdk), @@ -653,7 +653,7 @@ def test_tdf_with_altered_policy_binding( pytest.skip("Not in focus") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) ct_file = encrypted_tdf( encrypt_sdk, attr_values=attribute_default_rsa.value_fqns, @@ -684,7 +684,7 @@ def test_tdf_with_altered_root_sig( pytest.skip("Not in focus") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) ct_file = encrypted_tdf( encrypt_sdk, target_mode=tdfs.select_target_version(encrypt_sdk, decrypt_sdk), @@ -710,7 +710,7 @@ def test_tdf_with_altered_seg_sig_wrong( pytest.skip("Not in focus") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) ct_file = encrypted_tdf( encrypt_sdk, target_mode=tdfs.select_target_version(encrypt_sdk, decrypt_sdk), @@ -741,7 +741,7 @@ def test_tdf_with_altered_enc_seg_size( pytest.skip("Not in focus") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) ct_file = encrypted_tdf( encrypt_sdk, target_mode=tdfs.select_target_version(encrypt_sdk, decrypt_sdk), @@ -773,7 +773,7 @@ def test_tdf_with_altered_assertion_statement( pytest.skip("Not in focus") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) if not encrypt_sdk.supports("assertions"): pytest.skip(f"{encrypt_sdk} sdk doesn't yet support assertions") if not decrypt_sdk.supports("assertions"): @@ -808,7 +808,7 @@ def test_tdf_with_altered_assertion_with_keys( pytest.skip("Not in focus") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) if not encrypt_sdk.supports("assertions"): pytest.skip(f"{encrypt_sdk} sdk doesn't yet support assertions") if not decrypt_sdk.supports("assertion_verification"): @@ -852,7 +852,7 @@ def test_tdf_altered_payload_end( pytest.skip(f"DSPX-1153 SDK [{decrypt_sdk}] has a bug with payload tampering") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) ct_file = encrypted_tdf( encrypt_sdk, target_mode=tdfs.select_target_version(encrypt_sdk, decrypt_sdk), @@ -882,7 +882,7 @@ def test_tdf_with_malicious_kao( pytest.skip("Not in focus") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) if not decrypt_sdk.supports("kasallowlist"): pytest.skip(f"{encrypt_sdk} sdk doesn't yet support an allowlist for kases") ct_file = encrypted_tdf( @@ -927,7 +927,7 @@ def test_tdf_with_duplicate_kao_same_kas( pytest.skip("Not in focus") pfs = tdfs.get_platform_features() tdfs.skip_connectrpc_skew(encrypt_sdk, decrypt_sdk, pfs) - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) # Only the decrypt side needs to tolerate the duplicate KAO; the encrypt # side just produces a normal TDF that we mutate below. if not decrypt_sdk.supports("multikao"): diff --git a/xtest/test_tdfs_units.py b/xtest/test_tdfs_units.py index 2a9c17b45..9e5672412 100644 --- a/xtest/test_tdfs_units.py +++ b/xtest/test_tdfs_units.py @@ -27,9 +27,9 @@ class TestParseForcedSupports: def test_parses_comma_and_whitespace_separated_names(self): - assert tdfs._parse_forced_supports(" hexless, dpop ,ecwrap") == frozenset( - {"hexless", "dpop", "ecwrap"} - ) + assert tdfs._parse_forced_supports( + " hexless_integrity, dpop ,ecwrap" + ) == frozenset({"hexless_integrity", "dpop", "ecwrap"}) def test_empty_string_yields_empty_set(self): assert tdfs._parse_forced_supports("") == frozenset() diff --git a/xtest/test_zip64.py b/xtest/test_zip64.py index 583852ead..2910ebb61 100644 --- a/xtest/test_zip64.py +++ b/xtest/test_zip64.py @@ -79,7 +79,7 @@ def test_zip64_band_roundtrip( """ if not in_focus & {encrypt_sdk, decrypt_sdk}: pytest.skip("Not in focus") - tdfs.skip_hexless_skew(encrypt_sdk, decrypt_sdk) + tdfs.skip_hexless_integrity_skew(encrypt_sdk, decrypt_sdk) ct_file = encrypted_tdf( encrypt_sdk,