Enable strict bytes. This causes mypy to treat bytes as bytes, and not as a hodgepodge of buffer things

pyproject.toml

@@ -149,6 +149,7 @@ warn_redundant_casts = true
 warn_unused_ignores = true
 warn_unused_configs = true
 strict_equality = true
+strict_bytes = true
 
 [[tool.mypy.overrides]]
 module = ["pretend"]

src/cryptography/hazmat/bindings/_rust/__init__.pyi

@@ -5,17 +5,18 @@
 import typing
 
 from cryptography.hazmat.primitives import padding
+from cryptography.utils import Buffer
 
 def check_ansix923_padding(data: bytes) -> bool: ...
 
 class PKCS7PaddingContext(padding.PaddingContext):
     def __init__(self, block_size: int) -> None: ...
-    def update(self, data: bytes) -> bytes: ...
+    def update(self, data: Buffer) -> bytes: ...
     def finalize(self) -> bytes: ...
 
 class PKCS7UnpaddingContext(padding.PaddingContext):
     def __init__(self, block_size: int) -> None: ...
-    def update(self, data: bytes) -> bytes: ...
+    def update(self, data: Buffer) -> bytes: ...
     def finalize(self) -> bytes: ...
 
 class ObjectIdentifier:

src/cryptography/hazmat/bindings/_rust/openssl/aead.pyi

@@ -2,102 +2,106 @@
 # 2.0, and the BSD License. See the LICENSE file in the root of this repository
 # for complete details.
 
+from collections.abc import Sequence
+
+from cryptography.utils import Buffer
+
 class AESGCM:
-    def __init__(self, key: bytes) -> None: ...
+    def __init__(self, key: Buffer) -> None: ...
     @staticmethod
     def generate_key(bit_length: int) -> bytes: ...
     def encrypt(
         self,
-        nonce: bytes,
-        data: bytes,
-        associated_data: bytes | None,
+        nonce: Buffer,
+        data: Buffer,
+        associated_data: Buffer | None,
     ) -> bytes: ...
     def decrypt(
         self,
-        nonce: bytes,
-        data: bytes,
-        associated_data: bytes | None,
+        nonce: Buffer,
+        data: Buffer,
+        associated_data: Buffer | None,
     ) -> bytes: ...
 
 class ChaCha20Poly1305:
-    def __init__(self, key: bytes) -> None: ...
+    def __init__(self, key: Buffer) -> None: ...
     @staticmethod
     def generate_key() -> bytes: ...
     def encrypt(
         self,
-        nonce: bytes,
-        data: bytes,
-        associated_data: bytes | None,
+        nonce: Buffer,
+        data: Buffer,
+        associated_data: Buffer | None,
     ) -> bytes: ...
     def decrypt(
         self,
-        nonce: bytes,
-        data: bytes,
-        associated_data: bytes | None,
+        nonce: Buffer,
+        data: Buffer,
+        associated_data: Buffer | None,
     ) -> bytes: ...
 
 class AESCCM:
-    def __init__(self, key: bytes, tag_length: int = 16) -> None: ...
+    def __init__(self, key: Buffer, tag_length: int = 16) -> None: ...
     @staticmethod
     def generate_key(bit_length: int) -> bytes: ...
     def encrypt(
         self,
-        nonce: bytes,
-        data: bytes,
-        associated_data: bytes | None,
+        nonce: Buffer,
+        data: Buffer,
+        associated_data: Buffer | None,
     ) -> bytes: ...
     def decrypt(
         self,
-        nonce: bytes,
-        data: bytes,
-        associated_data: bytes | None,
+        nonce: Buffer,
+        data: Buffer,
+        associated_data: Buffer | None,
     ) -> bytes: ...
 
 class AESSIV:
-    def __init__(self, key: bytes) -> None: ...
+    def __init__(self, key: Buffer) -> None: ...
     @staticmethod
     def generate_key(bit_length: int) -> bytes: ...
     def encrypt(
         self,
-        data: bytes,
-        associated_data: list[bytes] | None,
+        data: Buffer,
+        associated_data: Sequence[Buffer] | None,
     ) -> bytes: ...
     def decrypt(
         self,
-        data: bytes,
-        associated_data: list[bytes] | None,
+        data: Buffer,
+        associated_data: Sequence[Buffer] | None,
     ) -> bytes: ...
 
 class AESOCB3:
-    def __init__(self, key: bytes) -> None: ...
+    def __init__(self, key: Buffer) -> None: ...
     @staticmethod
     def generate_key(bit_length: int) -> bytes: ...
     def encrypt(
         self,
-        nonce: bytes,
-        data: bytes,
-        associated_data: bytes | None,
+        nonce: Buffer,
+        data: Buffer,
+        associated_data: Buffer | None,
     ) -> bytes: ...
     def decrypt(
         self,
-        nonce: bytes,
-        data: bytes,
-        associated_data: bytes | None,
+        nonce: Buffer,
+        data: Buffer,
+        associated_data: Buffer | None,
     ) -> bytes: ...
 
 class AESGCMSIV:
-    def __init__(self, key: bytes) -> None: ...
+    def __init__(self, key: Buffer) -> None: ...
     @staticmethod
     def generate_key(bit_length: int) -> bytes: ...
     def encrypt(
         self,
-        nonce: bytes,
-        data: bytes,
-        associated_data: bytes | None,
+        nonce: Buffer,
+        data: Buffer,
+        associated_data: Buffer | None,
     ) -> bytes: ...
     def decrypt(
         self,
-        nonce: bytes,
-        data: bytes,
-        associated_data: bytes | None,
+        nonce: Buffer,
+        data: Buffer,
+        associated_data: Buffer | None,
     ) -> bytes: ...

src/cryptography/hazmat/bindings/_rust/openssl/ed25519.pyi

@@ -3,10 +3,11 @@
 # for complete details.
 
 from cryptography.hazmat.primitives.asymmetric import ed25519
+from cryptography.utils import Buffer
 
 class Ed25519PrivateKey: ...
 class Ed25519PublicKey: ...
 
 def generate_key() -> ed25519.Ed25519PrivateKey: ...
-def from_private_bytes(data: bytes) -> ed25519.Ed25519PrivateKey: ...
+def from_private_bytes(data: Buffer) -> ed25519.Ed25519PrivateKey: ...
 def from_public_bytes(data: bytes) -> ed25519.Ed25519PublicKey: ...

src/cryptography/hazmat/bindings/_rust/openssl/ed448.pyi

@@ -3,10 +3,11 @@
 # for complete details.
 
 from cryptography.hazmat.primitives.asymmetric import ed448
+from cryptography.utils import Buffer
 
 class Ed448PrivateKey: ...
 class Ed448PublicKey: ...
 
 def generate_key() -> ed448.Ed448PrivateKey: ...
-def from_private_bytes(data: bytes) -> ed448.Ed448PrivateKey: ...
+def from_private_bytes(data: Buffer) -> ed448.Ed448PrivateKey: ...
 def from_public_bytes(data: bytes) -> ed448.Ed448PublicKey: ...

src/cryptography/hazmat/bindings/_rust/openssl/hashes.pyi

@@ -5,14 +5,15 @@
 import typing
 
 from cryptography.hazmat.primitives import hashes
+from cryptography.utils import Buffer
 
 class Hash(hashes.HashContext):
     def __init__(
         self, algorithm: hashes.HashAlgorithm, backend: typing.Any = None
     ) -> None: ...
     @property
     def algorithm(self) -> hashes.HashAlgorithm: ...
-    def update(self, data: bytes) -> None: ...
+    def update(self, data: Buffer) -> None: ...
     def finalize(self) -> bytes: ...
     def copy(self) -> Hash: ...
 
@@ -22,6 +23,6 @@ class XOFHash:
     def __init__(self, algorithm: hashes.ExtendableOutputFunction) -> None: ...
     @property
     def algorithm(self) -> hashes.ExtendableOutputFunction: ...
-    def update(self, data: bytes) -> None: ...
+    def update(self, data: Buffer) -> None: ...
     def squeeze(self, length: int) -> bytes: ...
     def copy(self) -> XOFHash: ...

src/cryptography/hazmat/bindings/_rust/openssl/hmac.pyi

@@ -5,17 +5,18 @@
 import typing
 
 from cryptography.hazmat.primitives import hashes
+from cryptography.utils import Buffer
 
 class HMAC(hashes.HashContext):
     def __init__(
         self,
-        key: bytes,
+        key: Buffer,
         algorithm: hashes.HashAlgorithm,
         backend: typing.Any = None,
     ) -> None: ...
     @property
     def algorithm(self) -> hashes.HashAlgorithm: ...
-    def update(self, data: bytes) -> None: ...
+    def update(self, data: Buffer) -> None: ...
     def finalize(self) -> bytes: ...
     def verify(self, signature: bytes) -> None: ...
     def copy(self) -> HMAC: ...

src/cryptography/hazmat/bindings/_rust/openssl/kdf.pyi

@@ -5,9 +5,10 @@
 import typing
 
 from cryptography.hazmat.primitives.hashes import HashAlgorithm
+from cryptography.utils import Buffer
 
 def derive_pbkdf2_hmac(
-    key_material: bytes,
+    key_material: Buffer,
     algorithm: HashAlgorithm,
     salt: bytes,
     iterations: int,
@@ -24,7 +25,7 @@ class Scrypt:
         p: int,
         backend: typing.Any = None,
     ) -> None: ...
-    def derive(self, key_material: bytes) -> bytes: ...
+    def derive(self, key_material: Buffer) -> bytes: ...
     def verify(self, key_material: bytes, expected_key: bytes) -> None: ...
 
 class Argon2id:

src/cryptography/hazmat/bindings/_rust/openssl/keys.pyi

@@ -8,16 +8,17 @@ from cryptography.hazmat.primitives.asymmetric.types import (
     PrivateKeyTypes,
     PublicKeyTypes,
 )
+from cryptography.utils import Buffer
 
 def load_der_private_key(
-    data: bytes,
+    data: Buffer,
     password: bytes | None,
     backend: typing.Any = None,
     *,
     unsafe_skip_rsa_key_validation: bool = False,
 ) -> PrivateKeyTypes: ...
 def load_pem_private_key(
-    data: bytes,
+    data: Buffer,
     password: bytes | None,
     backend: typing.Any = None,
     *,

src/cryptography/hazmat/bindings/_rust/openssl/poly1305.pyi

@@ -2,12 +2,14 @@
 # 2.0, and the BSD License. See the LICENSE file in the root of this repository
 # for complete details.
 
+from cryptography.utils import Buffer
+
 class Poly1305:
-    def __init__(self, key: bytes) -> None: ...
+    def __init__(self, key: Buffer) -> None: ...
     @staticmethod
-    def generate_tag(key: bytes, data: bytes) -> bytes: ...
+    def generate_tag(key: Buffer, data: bytes) -> bytes: ...
     @staticmethod
-    def verify_tag(key: bytes, data: bytes, tag: bytes) -> None: ...
-    def update(self, data: bytes) -> None: ...
+    def verify_tag(key: Buffer, data: bytes, tag: bytes) -> None: ...
+    def update(self, data: Buffer) -> None: ...
     def finalize(self) -> bytes: ...
     def verify(self, tag: bytes) -> None: ...

src/cryptography/hazmat/bindings/_rust/openssl/x25519.pyi

@@ -3,10 +3,11 @@
 # for complete details.
 
 from cryptography.hazmat.primitives.asymmetric import x25519
+from cryptography.utils import Buffer
 
 class X25519PrivateKey: ...
 class X25519PublicKey: ...
 
 def generate_key() -> x25519.X25519PrivateKey: ...
-def from_private_bytes(data: bytes) -> x25519.X25519PrivateKey: ...
+def from_private_bytes(data: Buffer) -> x25519.X25519PrivateKey: ...
 def from_public_bytes(data: bytes) -> x25519.X25519PublicKey: ...

src/cryptography/hazmat/bindings/_rust/openssl/x448.pyi

@@ -3,10 +3,11 @@
 # for complete details.
 
 from cryptography.hazmat.primitives.asymmetric import x448
+from cryptography.utils import Buffer
 
 class X448PrivateKey: ...
 class X448PublicKey: ...
 
 def generate_key() -> x448.X448PrivateKey: ...
-def from_private_bytes(data: bytes) -> x448.X448PrivateKey: ...
+def from_private_bytes(data: Buffer) -> x448.X448PrivateKey: ...
 def from_public_bytes(data: bytes) -> x448.X448PublicKey: ...

src/cryptography/hazmat/bindings/_rust/pkcs12.pyi

@@ -14,6 +14,7 @@ from cryptography.hazmat.primitives.serialization.pkcs12 import (
     PKCS12KeyAndCertificates,
     PKCS12PrivateKeyTypes,
 )
+from cryptography.utils import Buffer
 
 class PKCS12Certificate:
     def __init__(
@@ -25,8 +26,8 @@ class PKCS12Certificate:
     def certificate(self) -> x509.Certificate: ...
 
 def load_key_and_certificates(
-    data: bytes,
-    password: bytes | None,
+    data: Buffer,
+    password: Buffer | None,
     backend: typing.Any = None,
 ) -> tuple[
     PrivateKeyTypes | None,

src/cryptography/hazmat/bindings/_rust/test_support.pyi

@@ -5,6 +5,7 @@
 from cryptography import x509
 from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.serialization import pkcs7
+from cryptography.utils import Buffer
 
 class TestCertificate:
     not_after_tag: int
@@ -16,7 +17,7 @@ def test_parse_certificate(data: bytes) -> TestCertificate: ...
 def pkcs7_verify(
     encoding: serialization.Encoding,
     sig: bytes,
-    msg: bytes | None,
+    msg: Buffer | None,
     certs: list[x509.Certificate],
     options: list[pkcs7.PKCS7Options],
 ) -> None: ...

src/cryptography/hazmat/primitives/_cipheralgorithm.py

@@ -36,7 +36,7 @@ def key_size(self) -> int:
 
 
 class BlockCipherAlgorithm(CipherAlgorithm):
-    key: bytes
+    key: utils.Buffer
 
     @property
     @abc.abstractmethod
@@ -46,7 +46,9 @@ def block_size(self) -> int:
         """
 
 
-def _verify_key_size(algorithm: CipherAlgorithm, key: bytes) -> bytes:
+def _verify_key_size(
+    algorithm: CipherAlgorithm, key: utils.Buffer
+) -> utils.Buffer:
     # Verify that the key is instance of bytes
     utils._check_byteslike("key", key)