pyproject.toml

[build-system]
requires = ["setuptools>=68", "wheel"]
build-backend = "setuptools.build_meta"

[project]
name = "openbadgeslib"
dynamic = ["version"]
description = "Production-ready Python library & CLI for Open Badges 3.0 (W3C Verifiable Credentials): issue, verify, and revoke JWT-VC credentials with Bitstring Status Lists and did:web — plus strict OB 2.0 and legacy OB 1.0."
readme = "README.md"
license = { text = "LGPLv3" }
authors = [
    { name = "Luis González Fernández", email = "luisgf@luisgf.es" },
    { name = "Jesús Cea Avión", email = "jcea@jcea.es" },
]
keywords = [
    "openbadges", "open-badges", "verifiable-credentials", "vc-jwt", "w3c-vc",
    "digital-credentials", "did", "did-web", "bitstring-status-list",
    "revocation", "ob3", "credentials", "ed25519", "cryptography",
    "data-integrity", "eddsa",
]
classifiers = [
    "Development Status :: 5 - Production/Stable",
    "Intended Audience :: Developers",
    "Intended Audience :: Education",
    "Intended Audience :: Information Technology",
    "Operating System :: OS Independent",
    "Topic :: Security :: Cryptography",
    "Topic :: Education",
    "Programming Language :: Python :: 3.10",
    "Programming Language :: Python :: 3.11",
    "Programming Language :: Python :: 3.12",
    "Programming Language :: Python :: 3.13",
    "Programming Language :: Python :: 3.14",
    "Topic :: Software Development :: Libraries :: Python Modules",
    "Natural Language :: English",
    "Natural Language :: Spanish",
    "License :: OSI Approved :: GNU Lesser General Public License v3 (LGPLv3)",
]
requires-python = ">=3.10"
dependencies = [
    "pypng>=0.20220715.0",
    "PyJWT[crypto]>=2.8",
    "cryptography>=42",
    "defusedxml>=0.7",
]

[project.optional-dependencies]
# Issuing and verifying Data Integrity (Linked Data Proof) credentials needs a
# JSON-LD processor for RDF canonicalization; everything else works without it.
ldp = [
    "pyld>=2.0.4",
]
# EUDI track: issue/verify badges as SD-JWT VC (the EU wallet / ARF format) via
# the generic openvc-core library. openvc-core is stable (1.x) with a published
# SemVer/deprecation contract, so the pin follows SemVer: floor at the version
# the suite is tested against, ceiling at the next major.
# See openbadgeslib/ob3/eudi.py.
eudi = [
    "openvc-core>=1.18,<2",
]
# ecdsa-sd-2023 (selective disclosure) VERIFY for the OB 3.0 Data Integrity
# track: credentials secured with the ecdsa-sd-2023 cryptosuite are verified by
# delegating the large, security-sensitive selective-disclosure crypto to
# openvc-core's audited EcdsaSdProofSuite — openbadgeslib keeps the OB3 model,
# trust binding and lifecycle checks. Pulls openvc-core with its RDF
# canonicalization (pyld). Native eddsa-rdfc-2022 stays under [ldp]; issuance of
# ecdsa-sd-2023 is out of scope. See openbadgeslib/ob3/ldp.py.
ldp-sd = [
    "openvc-core[data-integrity]>=1.13,<2",
]
dev = [
    "pytest>=8.0",
    "pytest-cov>=5.0",
    "flake8>=7.0",
    "pdoc>=14",
    "mypy>=1.8",
    # Commit-message linting. Depend on gitlint-core, NOT the `gitlint`
    # meta-package: `gitlint` is an empty shim for gitlint-core[trusted-deps],
    # and that extra hard-pins click==8.1.3 / sh==1.14.3 — both now carry
    # advisories (PYSEC-2026-2132, command injection in click.edit(), fixed in
    # 8.3.3; CVE-2026-54552, incomplete privilege drop in sh's _uid, fixed in
    # 2.2.4) that turned the weekly Audit job red. Neither is reachable from
    # gitlint (it never calls click.edit(), and it does not import sh at all
    # unless GITLINT_USE_SH_LIB=1, which nothing here sets), but upstream has
    # been dormant since 2023 so no fixed release is coming. gitlint-core
    # declares the same dependencies loosely and still ships the `gitlint`
    # console script, so the command is unchanged; this is the workaround
    # gitlint's own installation docs recommend.
    "gitlint-core>=0.19",
    # Floors so the patched versions are a requirement, not a resolver accident;
    # ceilings because we now own these bounds and a dormant gitlint 0.19.1 is
    # unlikely to survive the next major of either. sh keeps gitlint-core's
    # platform marker: it is not installed on Windows, and the windows CI leg
    # installs [dev].
    "click>=8.3.3,<9",
    "sh>=2.2.4,<3; sys_platform != 'win32'",
    # Validates issued OB 3.0 credentials against the official 1EdTech JSON
    # Schemas (draft 2019-09); see tests/test_ob3_conformance_schema.py. The
    # format-nongpl extra activates the date-time/uri format checkers (via
    # rfc3339-validator etc.) so `format` keywords are asserted, not ignored —
    # and stays GPL-free, unlike the plain [format] extra.
    "jsonschema[format-nongpl]>=4.20",
]

[project.urls]
Homepage = "https://github.com/luisgf/openbadgeslib"
Documentation = "https://github.com/luisgf/openbadgeslib/wiki"
"API Reference" = "https://luisgf.github.io/openbadgeslib/"
Source = "https://github.com/luisgf/openbadgeslib"
Changelog = "https://github.com/luisgf/openbadgeslib/blob/master/Changelog.txt"

[project.scripts]
# Unified front-end (#234): `openbadges <command>` dispatches to the five tools
# below, which remain installed under their own names as aliases.
openbadges = "openbadgeslib.openbadges_cli:main"
openbadges-init = "openbadgeslib.openbadges_init:main"
openbadges-keygenerator = "openbadgeslib.openbadges_keygenerator:main"
openbadges-signer = "openbadgeslib.openbadges_signer:main"
openbadges-verifier = "openbadgeslib.openbadges_verifier:main"
openbadges-publish = "openbadgeslib.openbadges_publish:main"

[tool.setuptools.packages.find]
where = ["."]
include = ["openbadgeslib*"]

# Ship the PEP 561 marker so downstream type checkers use our annotations,
# and the pinned JSON-LD contexts the Data Integrity verifier canonicalizes
# against (see openbadgeslib/ob3/contexts/__init__.py for provenance).
[tool.setuptools.package-data]
openbadgeslib = ["py.typed"]
"openbadgeslib.ob3.contexts" = ["*.json"]

# Single source of truth for the version: openbadgeslib/util.py __version__.
# setuptools reads it by AST (no import), so it stays in sync automatically.
[tool.setuptools.dynamic]
version = { attr = "openbadgeslib.util.__version__" }

[tool.mypy]
python_version = "3.10"
files = ["openbadgeslib"]
# Full strict mode — the README advertises `mypy --strict`, so CI enforces it.
# (strict implies disallow_untyped_defs, disallow_any_generics, warn_return_any,
# no_implicit_optional, warn_unused_ignores, … — see `mypy --help`.)
strict = true

# Third-party dependencies that ship no type information.
[[tool.mypy.overrides]]
module = ["png.*", "defusedxml.*", "pyld.*"]
ignore_missing_imports = true

# openvc-core is behind the optional [eudi] extra and is not installed in the
# default (dev,ldp) type-check environment; ignore it when absent. It ships
# py.typed, so where installed its real types are still used.
[[tool.mypy.overrides]]
module = ["openvc.*", "openvc_ebsi.*"]
ignore_missing_imports = true

[tool.pytest.ini_options]
testpaths = ["tests"]
# The conformance_docker suite drives 1EdTech's official validators as Docker
# services (network + DID resolution) — deselected by default so the local
# run and the release gate stay fast and hermetic. The nightly conformance
# workflow opts in with `pytest -m conformance_docker`.
addopts = "-m 'not conformance_docker'"
markers = [
    "conformance_docker: validates issued badges against the official 1EdTech validators running in Docker (opt-in; needs Docker, network)",
]

[tool.coverage.run]
source = ["openbadgeslib"]

[tool.coverage.report]
show_missing = true
# Freeze the coverage floor so a regression fails CI instead of slipping by in
# the log. The #169 targeted-coverage work took the total past 93% (dedicated
# baking/mail/keys tests, OB2 signer/verifier + OB3 LDP error branches, and
# openbadges_verifier.py 74% -> 95%); the floor is raised to 93 accordingly.
# pytest-cov honours this on the CI `pytest --cov` run.
fail_under = 93
exclude_lines = [
    "if __name__ == .__main__.:",
    "pass$",
]