From 338384ced7ef0ca8ba22e7ee770cdc6f89096d69 Mon Sep 17 00:00:00 2001
From: Max-Sentyron <max.suurland@sentyron.com>
Date: Thu, 20 Nov 2025 19:10:33 +0000
Subject: [PATCH] Add stubs for wolfcrypt

---
 pyrightconfig.stricter.json              |   1 +
 stubs/wolfcrypt/METADATA.toml            |   2 +
 stubs/wolfcrypt/wolfcrypt/__init__.pyi   |  30 +++
 stubs/wolfcrypt/wolfcrypt/_ffi.pyi       |   3 +
 stubs/wolfcrypt/wolfcrypt/_version.pyi   |   2 +
 stubs/wolfcrypt/wolfcrypt/asn.pyi        |   7 +
 stubs/wolfcrypt/wolfcrypt/ciphers.pyi    | 292 +++++++++++++++++++++++
 stubs/wolfcrypt/wolfcrypt/exceptions.pyi |   1 +
 stubs/wolfcrypt/wolfcrypt/hashes.pyi     |  53 ++++
 stubs/wolfcrypt/wolfcrypt/pwdbased.pyi   |   1 +
 stubs/wolfcrypt/wolfcrypt/random.pyi     |   5 +
 stubs/wolfcrypt/wolfcrypt/utils.pyi      |   1 +
 12 files changed, 398 insertions(+)
 create mode 100644 stubs/wolfcrypt/METADATA.toml
 create mode 100644 stubs/wolfcrypt/wolfcrypt/__init__.pyi
 create mode 100644 stubs/wolfcrypt/wolfcrypt/_ffi.pyi
 create mode 100644 stubs/wolfcrypt/wolfcrypt/_version.pyi
 create mode 100644 stubs/wolfcrypt/wolfcrypt/asn.pyi
 create mode 100644 stubs/wolfcrypt/wolfcrypt/ciphers.pyi
 create mode 100644 stubs/wolfcrypt/wolfcrypt/exceptions.pyi
 create mode 100644 stubs/wolfcrypt/wolfcrypt/hashes.pyi
 create mode 100644 stubs/wolfcrypt/wolfcrypt/pwdbased.pyi
 create mode 100644 stubs/wolfcrypt/wolfcrypt/random.pyi
 create mode 100644 stubs/wolfcrypt/wolfcrypt/utils.pyi

diff --git a/pyrightconfig.stricter.json b/pyrightconfig.stricter.json
index 63b7c08047e8..ac9648196f67 100644
--- a/pyrightconfig.stricter.json
+++ b/pyrightconfig.stricter.json
@@ -92,6 +92,7 @@
         "stubs/tensorflow",
         "stubs/tqdm",
         "stubs/vobject",
+        "stubs/wolfcrypt",
         "stubs/workalendar",
         "stubs/xmldiff",
     ],
diff --git a/stubs/wolfcrypt/METADATA.toml b/stubs/wolfcrypt/METADATA.toml
new file mode 100644
index 000000000000..4558713e54e5
--- /dev/null
+++ b/stubs/wolfcrypt/METADATA.toml
@@ -0,0 +1,2 @@
+version = "5.8.*"
+upstream_repository = "https://github.com/wolfssl/wolfcrypt-py"
diff --git a/stubs/wolfcrypt/wolfcrypt/__init__.pyi b/stubs/wolfcrypt/wolfcrypt/__init__.pyi
new file mode 100644
index 000000000000..888d168efc05
--- /dev/null
+++ b/stubs/wolfcrypt/wolfcrypt/__init__.pyi
@@ -0,0 +1,30 @@
+from wolfcrypt._version import __version__ as __version__
+
+__all__ = [
+    "__title__",
+    "__summary__",
+    "__uri__",
+    "__version__",
+    "__author__",
+    "__email__",
+    "__license__",
+    "__copyright__",
+    "ciphers",
+    "hashes",
+    "random",
+    "pwdbased",
+]
+
+__title__: str
+__summary__: str
+__uri__: str
+__author__: str
+__email__: str
+__license__: str
+__copyright__: str
+
+# Names in __all__ with no definition:
+#   ciphers
+#   hashes
+#   pwdbased
+#   random
diff --git a/stubs/wolfcrypt/wolfcrypt/_ffi.pyi b/stubs/wolfcrypt/wolfcrypt/_ffi.pyi
new file mode 100644
index 000000000000..7a2faf00eb61
--- /dev/null
+++ b/stubs/wolfcrypt/wolfcrypt/_ffi.pyi
@@ -0,0 +1,3 @@
+import _cffi_backend
+
+ffi: _cffi_backend.FFI
diff --git a/stubs/wolfcrypt/wolfcrypt/_version.pyi b/stubs/wolfcrypt/wolfcrypt/_version.pyi
new file mode 100644
index 000000000000..e48a573943a6
--- /dev/null
+++ b/stubs/wolfcrypt/wolfcrypt/_version.pyi
@@ -0,0 +1,2 @@
+__wolfssl_version__: str
+__version__: str
diff --git a/stubs/wolfcrypt/wolfcrypt/asn.pyi b/stubs/wolfcrypt/wolfcrypt/asn.pyi
new file mode 100644
index 000000000000..b06c01d7ebf8
--- /dev/null
+++ b/stubs/wolfcrypt/wolfcrypt/asn.pyi
@@ -0,0 +1,7 @@
+from wolfcrypt.hashes import _Hash
+
+def pem_to_der(pem:bytes, pem_type:int)->bytes: ...
+def der_to_pem(der:bytes, pem_type:int)->bytes: ...
+def hash_oid_from_class(hash_cls: type[_Hash])->int: ...
+def make_signature(data: bytes, hash_cls:type[_Hash], key:str|bytes=None)->bytes: ...
+def check_signature(signature: bytes, data:bytes, hash_cls:type[_Hash], pub_key)->bool: ...
diff --git a/stubs/wolfcrypt/wolfcrypt/ciphers.pyi b/stubs/wolfcrypt/wolfcrypt/ciphers.pyi
new file mode 100644
index 000000000000..a5a01cd4d7d0
--- /dev/null
+++ b/stubs/wolfcrypt/wolfcrypt/ciphers.pyi
@@ -0,0 +1,292 @@
+from _typeshed import Incomplete
+from enum import IntEnum
+from typing import Literal, overload
+
+MODE_ECB = Literal[1]
+MODE_CBC = Literal[2]
+MODE_CFB = Literal[3]
+MODE_OFB = Literal[5]
+MODE_CTR = Literal[6]
+_FEEDBACK_MODES = Literal[MODE_ECB, MODE_CBC, MODE_CFB, MODE_OFB, MODE_CTR]
+
+ECC_CURVE_INVALID: int
+ECC_CURVE_DEF: int
+ECC_SECP192R1: int
+ECC_PRIME192V2: int
+ECC_PRIME192V3: int
+ECC_PRIME239V1: int
+ECC_PRIME239V2: int
+ECC_PRIME239V3: int
+ECC_SECP256R1: int
+ECC_SECP112R1: int
+ECC_SECP112R2: int
+ECC_SECP128R1: int
+ECC_SECP128R2: int
+ECC_SECP160R1: int
+ECC_SECP160R2: int
+ECC_SECP224R1: int
+ECC_SECP384R1: int
+ECC_SECP521R1: int
+ECC_SECP160K1: int
+ECC_SECP192K1: int
+ECC_SECP224K1: int
+ECC_SECP256K1: int
+ECC_BRAINPOOLP160R1: int
+ECC_BRAINPOOLP192R1: int
+ECC_BRAINPOOLP224R1: int
+ECC_BRAINPOOLP256R1: int
+ECC_BRAINPOOLP320R1: int
+ECC_BRAINPOOLP384R1: int
+ECC_BRAINPOOLP512R1: int
+
+MGF1NONE: int
+MGF1SHA1: int
+MGF1SHA224: int
+MGF1SHA256: int
+MGF1SHA384: int
+MGF1SHA512: int
+HASH_TYPE_NONE: int
+HASH_TYPE_MD2: int
+HASH_TYPE_MD4: int
+HASH_TYPE_MD5: int
+HASH_TYPE_SHA: int
+HASH_TYPE_SHA224: int
+HASH_TYPE_SHA256: int
+HASH_TYPE_SHA384: int
+HASH_TYPE_SHA512: int
+HASH_TYPE_MD5_SHA: int
+HASH_TYPE_SHA3_224: int
+HASH_TYPE_SHA3_256: int
+HASH_TYPE_SHA3_384: int
+HASH_TYPE_SHA3_512: int
+HASH_TYPE_BLAKE2B: int
+HASH_TYPE_BLAKE2S: int
+
+
+class _Cipher:
+    mode: _FEEDBACK_MODES
+    @overload
+    def __init__(self, key:str| bytes, mode: Literal[MODE_CBC, MODE_CTR], IV:str| bytes) -> None: ...
+    @overload
+    def __init__(self, key:str| bytes, mode: _FEEDBACK_MODES, IV:str| bytes|None=None) -> None: ...
+    @overload
+    @classmethod
+    def new(cls, key:str| bytes, mode: Literal[MODE_CBC, MODE_CTR], IV:str| bytes, **kwargs): ...
+    @overload
+    @classmethod
+    def new(cls, key:str| bytes, mode: _FEEDBACK_MODES, IV:str| bytes|None=None, **kwargs): ...
+    def encrypt(self, string: str|bytes)->bytes: ...
+    def decrypt(self, string: str|bytes)->bytes: ...
+
+class Aes(_Cipher):
+    block_size: int
+    key_size: None
+
+class AesGcmStream:
+    block_size: int
+    def __init__(self, key: str|bytes, IV: str|bytes, tag_bytes: int = 16) -> None: ...
+    def set_aad(self, data: str|bytes) -> None: ...
+    def get_aad(self)->bytes: ...
+    def encrypt(self, data: str|bytes)->bytes: ...
+    def decrypt(self, data: str|bytes)->bytes: ...
+    def final(self, authTag=None): ...
+
+class ChaCha(_Cipher):
+    block_size: int
+    key_size: int
+    def __init__(self, key: str = "", size: int = 32) -> None: ...
+    def set_iv(self, nonce, counter: int = 0) -> None: ...
+
+class ChaCha20Poly1305:
+    block_size: int
+    def __init__(self, key, IV, aad, tag_bytes: int = 16) -> None: ...
+    def set_aad(self, data) -> None: ...
+    def get_aad(self): ...
+    def encrypt(self, inPlainText): ...
+    def decrypt(self, inGeneratedAuthTag, inGeneratedCipher): ...
+    def checkTag(self, authTag) -> None: ...
+    def final(self, authTag=None): ...
+
+class Des3(_Cipher):
+    block_size: int
+    key_size: int
+
+class _Rsa:
+    RSA_MIN_PAD_SIZE: int
+    native_object: Incomplete
+    def __init__(self) -> None: ...
+    def __del__(self) -> None: ...
+    def set_mgf(self, mgf) -> None: ...
+
+class RsaPublic(_Rsa):
+    output_size: Incomplete
+    size: Incomplete
+    def __init__(self, key=None, hash_type=None) -> None: ...
+    @classmethod
+    def from_pem(cls, file, hash_type=None): ...
+    def encrypt(self, plaintext): ...
+    def encrypt_oaep(self, plaintext, label: str = ""): ...
+    def verify(self, signature): ...
+    def verify_pss(self, plaintext, signature): ...
+
+class RsaPrivate(RsaPublic):
+    @classmethod
+    def make_key(cls, size, rng=..., hash_type=None): ...
+    size: Incomplete
+    output_size: Incomplete
+    def __init__(self, key=None, hash_type=None) -> None: ...
+    @classmethod
+    def from_pem(cls, file, hash_type=None): ...
+    def encode_key(self): ...
+    def decrypt(self, ciphertext): ...
+    def decrypt_oaep(self, ciphertext, label: str = ""): ...
+    def sign(self, plaintext): ...
+    def sign_pss(self, plaintext): ...
+
+class _Ecc:
+    native_object: Incomplete
+    def __init__(self) -> None: ...
+    def __del__(self) -> None: ...
+    @property
+    def size(self): ...
+    @property
+    def max_signature_size(self): ...
+
+class EccPublic(_Ecc):
+    def __init__(self, key=None) -> None: ...
+    def decode_key(self, key) -> None: ...
+    def decode_key_raw(self, qx, qy, curve_id=7) -> None: ...
+    def encode_key(self, with_curve: bool = True): ...
+    def encode_key_raw(self): ...
+    def import_x963(self, x963) -> None: ...
+    def export_x963(self): ...
+    def verify(self, signature, data): ...
+    def verify_raw(self, R, S, data): ...
+
+class EccPrivate(EccPublic):
+    @classmethod
+    def make_key(cls, size, rng=...): ...
+    def decode_key(self, key) -> None: ...
+    def decode_key_raw(self, qx, qy, d, curve_id=7) -> None: ...
+    def encode_key(self): ...
+    def encode_key_raw(self): ...
+    def shared_secret(self, peer): ...
+    def sign(self, plaintext, rng=...): ...
+    def sign_raw(self, plaintext, rng=...): ...
+
+class _Ed25519:
+    native_object: Incomplete
+    def __init__(self) -> None: ...
+    def __del__(self) -> None: ...
+    @property
+    def size(self): ...
+    @property
+    def max_signature_size(self): ...
+
+class Ed25519Public(_Ed25519):
+    def __init__(self, key=None) -> None: ...
+    def decode_key(self, key) -> None: ...
+    def encode_key(self): ...
+    def verify(self, signature, data): ...
+
+class Ed25519Private(Ed25519Public):
+    def __init__(self, key=None, pub=None) -> None: ...
+    @classmethod
+    def make_key(cls, size, rng=...): ...
+    def decode_key(self, key, pub=None) -> None: ...
+    def encode_key(self): ...
+    def sign(self, plaintext): ...
+
+class _Ed448:
+    native_object: Incomplete
+    def __init__(self) -> None: ...
+    def __del__(self) -> None: ...
+    @property
+    def size(self): ...
+    @property
+    def max_signature_size(self): ...
+
+class Ed448Public(_Ed448):
+    def __init__(self, key=None) -> None: ...
+    def decode_key(self, key) -> None: ...
+    def encode_key(self): ...
+    def verify(self, signature, data, ctx=None): ...
+
+class Ed448Private(Ed448Public):
+    def __init__(self, key=None, pub=None) -> None: ...
+    @classmethod
+    def make_key(cls, size, rng=...): ...
+    def decode_key(self, key, pub=None) -> None: ...
+    def encode_key(self): ...
+    def sign(self, plaintext, ctx=None): ...
+
+class MlKemType(IntEnum):
+    ML_KEM_512 = ...
+    ML_KEM_768 = ...
+    ML_KEM_1024 = ...
+
+class _MlKemBase:
+    INVALID_DEVID: Incomplete
+    init_done: bool
+    native_object: Incomplete
+    def __init__(self, mlkem_type) -> None: ...
+    def __del__(self) -> None: ...
+    @property
+    def ct_size(self): ...
+    @property
+    def ss_size(self): ...
+
+class MlKemPublic(_MlKemBase):
+    @property
+    def key_size(self): ...
+    def encode_key(self): ...
+    def decode_key(self, pub_key) -> None: ...
+    def encapsulate(self, rng=...): ...
+    def encapsulate_with_random(self, rand): ...
+
+class MlKemPrivate(_MlKemBase):
+    @classmethod
+    def make_key(cls, mlkem_type, rng=...): ...
+    @classmethod
+    def make_key_with_random(cls, mlkem_type, rand): ...
+    @property
+    def pub_key_size(self): ...
+    @property
+    def priv_key_size(self): ...
+    def encode_pub_key(self): ...
+    def encode_priv_key(self): ...
+    def decode_key(self, priv_key: tuple[bytes, str]): ...
+    native_object: Incomplete
+    def decapsulate(self, ct): ...
+
+class MlDsaType(IntEnum):
+    ML_DSA_44 = ...
+    ML_DSA_65 = ...
+    ML_DSA_87 = ...
+
+class _MlDsaBase:
+    INVALID_DEVID: Incomplete
+    native_object: Incomplete
+    def __init__(self, mldsa_type) -> None: ...
+    def __del__(self) -> None: ...
+    @property
+    def sig_size(self): ...
+    def verify(self, signature, message): ...
+
+class MlDsaPrivate(_MlDsaBase):
+    @classmethod
+    def make_key(cls, mldsa_type, rng=...): ...
+    @property
+    def pub_key_size(self): ...
+    @property
+    def priv_key_size(self): ...
+    def encode_pub_key(self): ...
+    def encode_priv_key(self): ...
+    def decode_key(self, priv_key, pub_key=None) -> None: ...
+    def sign(self, message, rng=...): ...
+
+class MlDsaPublic(_MlDsaBase):
+    @property
+    def key_size(self): ...
+    def decode_key(self, pub_key): ...
+    def encode_key(self): ...
diff --git a/stubs/wolfcrypt/wolfcrypt/exceptions.pyi b/stubs/wolfcrypt/wolfcrypt/exceptions.pyi
new file mode 100644
index 000000000000..9a3e60558ce0
--- /dev/null
+++ b/stubs/wolfcrypt/wolfcrypt/exceptions.pyi
@@ -0,0 +1 @@
+class WolfCryptError(Exception): ...
diff --git a/stubs/wolfcrypt/wolfcrypt/hashes.pyi b/stubs/wolfcrypt/wolfcrypt/hashes.pyi
new file mode 100644
index 000000000000..76f69f1341a9
--- /dev/null
+++ b/stubs/wolfcrypt/wolfcrypt/hashes.pyi
@@ -0,0 +1,53 @@
+from typing import overload
+
+class _Hash:
+    def __init__(self, string: str|None=None) -> None: ...
+    @classmethod
+    def new(cls, string:str|None=None): ...
+    def copy(self): ...
+    def update(self, string: str|None) -> None: ...
+    def digest(self)->bytes: ...
+    def hexdigest(self)-> bytes: ...
+
+class Sha(_Hash):
+    digest_size: int
+
+class Sha256(_Hash):
+    digest_size: int
+
+class Sha384(_Hash):
+    digest_size: int
+
+class Sha512(_Hash):
+    digest_size: int
+
+class Sha3(_Hash):
+    SHA3_224_DIGEST_SIZE: int
+    SHA3_256_DIGEST_SIZE: int
+    SHA3_384_DIGEST_SIZE: int
+    SHA3_512_DIGEST_SIZE: int
+    digest_size: int
+    @overload
+    def __init__(self) -> None: ...
+    @overload
+    def __init__(self, string: str, size=...) -> None: ...
+
+class _Hmac(_Hash):
+    digest_size: int
+    def __init__(self, key:str|bytes, string:str|None=None) -> None: ...
+    @classmethod
+    def new(cls, key:str|bytes, string:str|None=None): ... # type: ignore[override]
+
+class HmacSha(_Hmac):
+    digest_size: int
+
+class HmacSha256(_Hmac):
+    digest_size: int
+
+class HmacSha384(_Hmac):
+    digest_size: int
+
+class HmacSha512(_Hmac):
+    digest_size: int
+
+def hash_type_to_cls(hash_type: int)->type[_Hash]: ...
diff --git a/stubs/wolfcrypt/wolfcrypt/pwdbased.pyi b/stubs/wolfcrypt/wolfcrypt/pwdbased.pyi
new file mode 100644
index 000000000000..cd079aff85fe
--- /dev/null
+++ b/stubs/wolfcrypt/wolfcrypt/pwdbased.pyi
@@ -0,0 +1 @@
+def PBKDF2(password: str | bytes, salt: str | bytes, iterations: int, key_length: int, hash_type: int)-> bytes: ...
diff --git a/stubs/wolfcrypt/wolfcrypt/random.pyi b/stubs/wolfcrypt/wolfcrypt/random.pyi
new file mode 100644
index 000000000000..699be1478be1
--- /dev/null
+++ b/stubs/wolfcrypt/wolfcrypt/random.pyi
@@ -0,0 +1,5 @@
+class Random:
+    def __init__(self) -> None: ...
+    def __del__(self) -> None: ...
+    def byte(self)-> bytes: ...
+    def bytes(self, length:int)-> bytes: ...
diff --git a/stubs/wolfcrypt/wolfcrypt/utils.pyi b/stubs/wolfcrypt/wolfcrypt/utils.pyi
new file mode 100644
index 000000000000..a0b4f211f4c0
--- /dev/null
+++ b/stubs/wolfcrypt/wolfcrypt/utils.pyi
@@ -0,0 +1 @@
+def t2b(string: str| bytes) -> bytes: ...