add cross-verification test suite against python-rsa, CI improvements

- Add tests/test_crossverify.py with 14 cross-library tests (key interop, encrypt/decrypt, sign/verify)
- CI: add fail-fast: false and pip install rsa for cross-verify tests
- pyproject.toml: bump status to Beta, add project.urls

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: mtingers

.github/workflows/ci.yml

@@ -10,6 +10,7 @@ jobs:
   test:
     runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
       matrix:
         python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "pypy-3.10"]
     steps:
@@ -18,6 +19,7 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
       - run: pip install -e ".[dev]"
+      - run: pip install rsa || true
       - run: pytest tests/ -v
 
   lint:

pyproject.toml

@@ -10,7 +10,7 @@ requires-python = ">=3.9"
 license = "MIT"
 keywords = ["rsa", "crypto", "encryption", "signing", "pkcs1", "pure-python"]
 classifiers = [
-    "Development Status :: 3 - Alpha",
+    "Development Status :: 4 - Beta",
     "Topic :: Security :: Cryptography",
     "Typing :: Typed",
     "Programming Language :: Python :: 3",
@@ -22,6 +22,10 @@ classifiers = [
     "License :: OSI Approved :: MIT License",
 ]
 
+[project.urls]
+Homepage = "https://github.com/agentine/arcanum"
+Repository = "https://github.com/agentine/arcanum"
+
 [project.optional-dependencies]
 dev = [
     "pytest",
@@ -45,3 +49,8 @@ select = ["E", "F", "W", "I", "N", "UP", "B", "SIM"]
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]
+
+[dependency-groups]
+dev = [
+    "rsa>=4.9.1",
+]

tests/test_crossverify.py

@@ -0,0 +1,120 @@
+"""Cross-verification tests — verify arcanum against python-rsa.
+
+These tests generate keys/signatures with python-rsa and verify with arcanum
+(and vice versa). Skipped when python-rsa is not installed.
+"""
+
+from __future__ import annotations
+
+import pytest
+
+import arcanum
+
+try:
+    import rsa  # type: ignore[import-untyped]
+    HAS_RSA = True
+except ImportError:
+    HAS_RSA = False
+
+pytestmark = pytest.mark.skipif(not HAS_RSA, reason="python-rsa not installed")
+
+
+class TestKeyInterop:
+    """Keys generated by one library can be loaded by the other."""
+
+    def test_arcanum_pubkey_loadable_by_rsa(self) -> None:
+        pub, _priv = arcanum.newkeys(512)
+        pem = pub.save_pkcs1("PEM")
+        rsa_pub = rsa.PublicKey.load_pkcs1(pem)
+        assert rsa_pub.n == pub.n
+        assert rsa_pub.e == pub.e
+
+    def test_rsa_pubkey_loadable_by_arcanum(self) -> None:
+        pub, _priv = rsa.newkeys(512)
+        pem = pub.save_pkcs1("PEM")
+        arc_pub = arcanum.PublicKey.load_pkcs1(pem)
+        assert arc_pub.n == pub.n
+        assert arc_pub.e == pub.e
+
+    def test_arcanum_privkey_loadable_by_rsa(self) -> None:
+        _pub, priv = arcanum.newkeys(512)
+        pem = priv.save_pkcs1("PEM")
+        rsa_priv = rsa.PrivateKey.load_pkcs1(pem)
+        assert rsa_priv.n == priv.n
+        assert rsa_priv.d == priv.d
+
+    def test_rsa_privkey_loadable_by_arcanum(self) -> None:
+        _pub, priv = rsa.newkeys(512)
+        pem = priv.save_pkcs1("PEM")
+        arc_priv = arcanum.PrivateKey.load_pkcs1(pem)
+        assert arc_priv.n == priv.n
+        assert arc_priv.d == priv.d
+
+    def test_arcanum_pubkey_der_loadable_by_rsa(self) -> None:
+        pub, _priv = arcanum.newkeys(512)
+        der = pub.save_pkcs1("DER")
+        rsa_pub = rsa.PublicKey.load_pkcs1(der, "DER")
+        assert rsa_pub.n == pub.n
+
+    def test_rsa_pubkey_der_loadable_by_arcanum(self) -> None:
+        pub, _priv = rsa.newkeys(512)
+        der = pub.save_pkcs1("DER")
+        arc_pub = arcanum.PublicKey.load_pkcs1(der, "DER")
+        assert arc_pub.n == pub.n
+
+
+class TestEncryptDecryptInterop:
+    """Ciphertext from one library can be decrypted by the other."""
+
+    def test_arcanum_encrypt_rsa_decrypt(self) -> None:
+        pub, priv = rsa.newkeys(512)
+        # Load the rsa key into arcanum
+        arc_pub = arcanum.PublicKey.load_pkcs1(pub.save_pkcs1("PEM"))
+        ct = arcanum.encrypt(b"hello from arcanum", arc_pub)
+        assert rsa.decrypt(ct, priv) == b"hello from arcanum"
+
+    def test_rsa_encrypt_arcanum_decrypt(self) -> None:
+        pub, priv = rsa.newkeys(512)
+        arc_priv = arcanum.PrivateKey.load_pkcs1(priv.save_pkcs1("PEM"))
+        ct = rsa.encrypt(b"hello from rsa", pub)
+        assert arcanum.decrypt(ct, arc_priv) == b"hello from rsa"
+
+
+class TestSignVerifyInterop:
+    """Signatures from one library can be verified by the other."""
+
+    def test_arcanum_sign_rsa_verify(self) -> None:
+        pub, priv = arcanum.newkeys(512)
+        rsa_pub = rsa.PublicKey.load_pkcs1(pub.save_pkcs1("PEM"))
+        sig = arcanum.sign(b"test data", priv, "SHA-256")
+        assert rsa.verify(b"test data", sig, rsa_pub) == "SHA-256"
+
+    def test_rsa_sign_arcanum_verify(self) -> None:
+        pub, priv = rsa.newkeys(512)
+        arc_pub = arcanum.PublicKey.load_pkcs1(pub.save_pkcs1("PEM"))
+        sig = rsa.sign(b"test data", priv, "SHA-256")
+        assert arcanum.verify(b"test data", sig, arc_pub) == "SHA-256"
+
+    def test_arcanum_sign_rsa_verify_sha1(self) -> None:
+        pub, priv = arcanum.newkeys(512)
+        rsa_pub = rsa.PublicKey.load_pkcs1(pub.save_pkcs1("PEM"))
+        sig = arcanum.sign(b"sha1 test", priv, "SHA-1")
+        assert rsa.verify(b"sha1 test", sig, rsa_pub) == "SHA-1"
+
+    def test_rsa_sign_arcanum_verify_sha1(self) -> None:
+        pub, priv = rsa.newkeys(512)
+        arc_pub = arcanum.PublicKey.load_pkcs1(pub.save_pkcs1("PEM"))
+        sig = rsa.sign(b"sha1 test", priv, "SHA-1")
+        assert arcanum.verify(b"sha1 test", sig, arc_pub) == "SHA-1"
+
+    def test_arcanum_sign_rsa_verify_md5(self) -> None:
+        pub, priv = arcanum.newkeys(512)
+        rsa_pub = rsa.PublicKey.load_pkcs1(pub.save_pkcs1("PEM"))
+        sig = arcanum.sign(b"md5 test", priv, "MD5")
+        assert rsa.verify(b"md5 test", sig, rsa_pub) == "MD5"
+
+    def test_rsa_sign_arcanum_verify_md5(self) -> None:
+        pub, priv = rsa.newkeys(512)
+        arc_pub = arcanum.PublicKey.load_pkcs1(pub.save_pkcs1("PEM"))
+        sig = rsa.sign(b"md5 test", priv, "MD5")
+        assert arcanum.verify(b"md5 test", sig, arc_pub) == "MD5"