fix(tests): a failing signer must be a real key now, not a duck type - #49
Merged
Conversation
agentrust-trace 0.10.0 requires the signing key to be an Ed25519PrivateKey rather than anything carrying a sign method. That is the right direction: a signing key should be a key. It also invalidates this test's stand-in. test_a_failure_inside_official_signing_is_reported_as_one built a hand-rolled FailsWhenUsed class to reach the signing call and raise from inside it. Under 0.10.0 that object is refused by the type check first, so the test saw "key must be an Ed25519PrivateKey, got FailsWhenUsed" instead of the error it was written to observe. Its own docstring warns against exactly this failure, passing on the wrong refusal, one shape earlier than it anticipated. A mock specced to Ed25519PrivateKey satisfies the isinstance check and still raises when used, which is the case the test is about: a real key whose hardware backing is unavailable at the moment of signing. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XbDBXDWWvMFa7c2jGgyq9t
This class is skipped below Python 3.11, where the trace extra and therefore cryptography are not installed. A module-level import breaks collection before setUpClass can apply that skip, so the 3.10 job failed on ModuleNotFoundError rather than skipping. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XbDBXDWWvMFa7c2jGgyq9t
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CI here goes red against
agentrust-trace0.10.0, released today. This repo floors it at>=0.9,<1, so it picked the new version up immediately.What changed upstream
0.10.0 requires the signing key to be an
Ed25519PrivateKeyrather than anything carrying asignmethod:That is the right direction — a signing key should be a key — and it is worth keeping. It also invalidates this test's stand-in.
What broke
test_a_failure_inside_official_signing_is_reported_as_onebuilt a hand-rolledFailsWhenUsedclass to get past the shape check, reach the signing call, and raise from inside it. Under 0.10.0 that object is refused by the type check first, so the test observed the wrong error.Its own docstring warns against precisely this:
The hazard it named was real; it just arrived one shape earlier than anticipated.
The fix
A
MagicMock(spec=Ed25519PrivateKey)satisfies theisinstancecheck and still raises when used. That is the case this test is actually about: a real key whose hardware backing is unavailable at the moment of signing, rather than a malformed key object.Verified against the published 0.10.0 wheel: the file's 10 tests pass, and reverting only the test file turns it red again.
🤖 Generated with Claude Code
https://claude.ai/code/session_01XbDBXDWWvMFa7c2jGgyq9t