[PATCH patatt v2 4/4] Import PyNaCl unconditionally

[Tamir Duberstein <tamird@kernel.org>]

PyNaCl is already a required runtime dependency, but missing imports
are only reported when signing, verification, or key generation runs.

Import the required symbols at module load time and remove the
RuntimeError wrappers and test skip for an unavailable dependency.
Incomplete installations then fail when patatt is imported.

Signed-off-by: Tamir Duberstein <tamird@kernel.org>
Assisted-by: LLM
---
 src/patatt/__init__.py | 25 ++++---------------------
 tests/conftest.py      |  6 +-----
 2 files changed, 5 insertions(+), 26 deletions(-)

diff --git a/src/patatt/__init__.py b/src/patatt/__init__.py
index 7254fcc..6b61a18 100644
--- a/src/patatt/__init__.py
+++ b/src/patatt/__init__.py
@@ -23,10 +23,11 @@ import urllib.parse
 import warnings
 from io import BytesIO
 from pathlib import Path
-from typing import TYPE_CHECKING, Dict, List, Optional, Tuple, Union
+from typing import Dict, List, Optional, Tuple, Union
 
-if TYPE_CHECKING:
-    from nacl.signing import SigningKey
+from nacl.encoding import Base64Encoder
+from nacl.exceptions import BadSignatureError
+from nacl.signing import SigningKey, VerifyKey
 
 GitConfigType = Dict[str, Union[str, List[str]]]
 AttestationResult = Tuple[
@@ -455,12 +456,6 @@ class DevsigHeader:
 
     @staticmethod
     def _sign_ed25519(payload: bytes, privkey: bytes) -> tuple[bytes, bytes]:
-        try:
-            from nacl.encoding import Base64Encoder
-            from nacl.signing import SigningKey
-        except ModuleNotFoundError as ex:
-            raise RuntimeError('This operation requires PyNaCl libraries') from ex
-
         if privkey not in KEYCACHE:
             sk = SigningKey(privkey, encoder=Base64Encoder)
             vk = base64.b64encode(sk.verify_key.encode())
@@ -479,13 +474,6 @@ class DevsigHeader:
 
     @staticmethod
     def _validate_ed25519(sigdata: bytes, pubkey: bytes) -> bytes:
-        try:
-            from nacl.encoding import Base64Encoder
-            from nacl.exceptions import BadSignatureError
-            from nacl.signing import VerifyKey
-        except ModuleNotFoundError as ex:
-            raise RuntimeError('This operation requires PyNaCl libraries') from ex
-
         vk = VerifyKey(pubkey, encoder=Base64Encoder)
         try:
             return vk.verify(sigdata, encoder=Base64Encoder)
@@ -1769,11 +1757,6 @@ def cmd_validate(cmdargs: argparse.Namespace, config: GitConfigType) -> None:
 
 
 def cmd_genkey(cmdargs: argparse.Namespace, config: GitConfigType) -> None:
-    try:
-        from nacl.signing import SigningKey
-    except ModuleNotFoundError as ex:
-        raise RuntimeError('This operation requires PyNaCl libraries') from ex
-
     # Do we have the signingkey defined?
     usercfg = get_config_from_git(r'user\..*')
     if not config.get('identity'):
diff --git a/tests/conftest.py b/tests/conftest.py
index 2d5c0b6..9e92937 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -6,6 +6,7 @@ from pathlib import Path
 from typing import Generator
 
 import pytest
+from nacl.signing import SigningKey
 
 from patatt import DevsigHeader, PatattMessage
 
@@ -51,11 +52,6 @@ def patatt_message(sample_email_bytes: bytes) -> PatattMessage:
 @pytest.fixture
 def sample_ed25519_key_pair() -> dict[str, bytes]:
     """Generate a sample ed25519 key pair for testing."""
-    try:
-        from nacl.signing import SigningKey
-    except ImportError:
-        pytest.skip('PyNaCl not installed, skipping ed25519 tests')
-
     # Generate a key pair
     private_key = SigningKey.generate()
     public_key = private_key.verify_key

-- 
2.56.0.rc0.682.g1951b10616.frankengit