Update mypy and type-check the vendored spsdk

pynitrokey/cli/fido2.py

@@ -786,7 +786,7 @@ def version(serial: Optional[str], udp: bool) -> None:
         locked = ""
         # @todo:
         if len(res) > 3:
-            if res[3]:  # type: ignore
+            if res[3]:
                 locked = "locked"
             else:
                 locked = "unlocked"

pynitrokey/trussed/bootloader/lpc55_upload/apps/utils/utils.py

@@ -5,8 +5,11 @@
 #
 # SPDX-License-Identifier: BSD-3-Clause
 
+import os
 from typing import Dict
 
+from ...utils.misc import get_abs_path, write_file
+
 
 def filepath_from_config(
     config: Dict,

pynitrokey/trussed/bootloader/lpc55_upload/crypto/types.py

@@ -11,8 +11,9 @@
 from cryptography import utils
 from cryptography.hazmat.primitives.serialization import Encoding
 from cryptography.x509.base import Version
-from cryptography.x509.extensions import ExtensionOID, Extensions, KeyUsage
-from cryptography.x509.name import Name, NameOID, ObjectIdentifier
+from cryptography.x509.extensions import Extensions, KeyUsage
+from cryptography.x509.name import Name
+from cryptography.x509.oid import ExtensionOID, NameOID, ObjectIdentifier
 
 from ..exceptions import SPSDKError
 

pynitrokey/trussed/bootloader/lpc55_upload/mboot/memories.py

@@ -43,7 +43,7 @@ def get_legacy_str(cls, key: str) -> Optional[int]:
         :return: new enum value
         """
         new_key = LEGACY_MEM_ID.get(key)
-        return cast(int, cls.get_tag(new_key)) if new_key else None
+        return cls.get_tag(new_key) if new_key else None
 
     @classmethod
     def get_legacy_int(cls, key: int) -> Optional[str]:

pynitrokey/trussed/bootloader/lpc55_upload/utils/crypto/otfad.py

@@ -7,8 +7,19 @@
 
 """The module provides support for On-The-Fly encoding for RTxxx devices."""
 
+import logging
+from struct import pack
 from typing import Any, Dict, List, Optional, Union
 
+from crcmod.predefined import mkPredefinedCrcFun
+
+from ...crypto.rng import random_bytes
+from ...crypto.symmetric import Counter, aes_ctr_encrypt, aes_key_wrap
+from ...exceptions import SPSDKError, SPSDKValueError
+from ...utils.misc import Endianness, align_block
+
+logger = logging.getLogger(__name__)
+
 
 class KeyBlob:
     """OTFAD KeyBlob: The class specifies AES key and counter initial value for specified address range.

pyproject.toml

@@ -42,6 +42,7 @@ dependencies = [
   "libusbsio",
   "nethsm >= 1.0.0,<2",
   "asn1tools >= 0.166.0",
+  "pyyaml >= 6.0.1",
 ]
 dynamic = ["version", "description"]
 
@@ -52,7 +53,7 @@ dev = [
   "flit >=3.2,<4",
   "ipython",
   "isort",
-  "mypy >=1.4,<1.5",
+  "mypy >=1.9",
   "pyinstaller ==5.9.0",
   "pyinstaller-versionfile ==2.1.1; sys_platform=='win32'",
   "types-requests",
@@ -97,6 +98,7 @@ module = [
     "pynitrokey.libnk",
     "pynitrokey.start.*",
     "pynitrokey.test_secrets_app",
+    "pynitrokey.trussed.bootloader.lpc55_upload.*",
 ]
 check_untyped_defs = false
 disallow_any_generics = false
@@ -122,11 +124,6 @@ ignore_errors = true
 module = "pynitrokey.trussed.bootloader.nrf52"
 disallow_untyped_calls = false
 
-# pynitrokey.nk3.bootloader.lpc55_upload is only temporary in this package
-[[tool.mypy.overrides]]
-module = "pynitrokey.trussed.bootloader.lpc55_upload.*"
-ignore_errors = true
-
 # libraries without annotations
 [[tool.mypy.overrides]]
 module = [
@@ -148,6 +145,7 @@ module = [
     "libusbsio.*",
     "fastjsonschema",
     "deepmerge.*",
+    "crcmod.*",
 ]
 ignore_missing_imports = true