Support Python 3.10 through 3.14

Use Python 3.10-compatible enum, typing, and integer conversion forms while preserving existing behavior. Advertise and test Python 3.10 through 3.14, with non-blocking Python 3.15 prerelease coverage.

Security: no intended change to codex32 encoding, recovery, or wallet behavior.

Validation:
- python -m pytest -q (864 passed)
- python -m mypy src/codex32
- python -m ruff check --target-version py310 .
- python -m ruff format --check .
- python -m build --no-isolation
- python -m twine check built artifacts

Refs #18.

Author: BenWestgate

.github/workflows/python-package.yml

@@ -31,3 +31,35 @@ jobs:
       - run: python tools/differential_correction.py --verify
       - run: python -m build --no-isolation
       - run: python tools/verify_wheel_environment.py
+
+  compatibility:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.14"]
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: ${{ matrix.python-version }}
+      - run: python -m pip install --upgrade pip
+      - run: python -m pip install --require-hashes -r requirements/cli-build-dependencies.txt
+      - run: python -m pip install --no-build-isolation -e '.[dev]'
+      - run: python -m pip check
+      - run: python -m pytest -q
+
+  prerelease:
+    continue-on-error: true
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: "3.15"
+          allow-prereleases: true
+      - run: python -m pip install --upgrade pip
+      - run: python -m pip install --require-hashes -r requirements/cli-build-dependencies.txt
+      - run: python -m pip install --no-build-isolation -e '.[dev]'
+      - run: python -m pip check
+      - run: python -m pytest -q

README.md

@@ -27,7 +27,7 @@ obtain an independent review before relying on it with funds. See
 
 ## Install
 
-Python 3.12 or 3.13 is required. The installed package has no third-party
+Python 3.10 through 3.14 is supported. The installed package has no third-party
 runtime dependencies. To install it with the pinned build backend, run these
 commands from the project folder:
 

pyproject.toml

@@ -10,7 +10,7 @@ authors = [
 ]
 description = "Python reference implementation for codex32 (BIP93) and codex32-encoded master seeds."
 readme = "README.md"
-requires-python = ">=3.12,<3.14"
+requires-python = ">=3.10"
 license = "MIT"
 license-files = ["LICENSE*"]
 maintainers = [
@@ -22,8 +22,11 @@ classifiers = [
   "Intended Audience :: Developers",
   "Programming Language :: Python :: 3",
   "Programming Language :: Python :: 3 :: Only",
+  "Programming Language :: Python :: 3.10",
+  "Programming Language :: Python :: 3.11",
   "Programming Language :: Python :: 3.12",
   "Programming Language :: Python :: 3.13",
+  "Programming Language :: Python :: 3.14",
   "Operating System :: OS Independent",
   "Topic :: Security :: Cryptography",
   "Topic :: Software Development :: Libraries",
@@ -52,7 +55,7 @@ where = ["src"]
 testpaths = ["tests"]
 
 [tool.mypy]
-python_version = "3.12"
+python_version = "3.10"
 strict = true
 
 [tool.ruff]

src/codex32/generation.py

@@ -6,7 +6,7 @@
 from collections.abc import Callable, Sequence
 from collections.abc import Set as AbstractSet
 from dataclasses import dataclass
-from typing import Never, SupportsIndex, cast
+from typing import NoReturn, SupportsIndex, cast
 
 from codex32._bip32 import _valid_root
 from codex32.bech32 import CHARSET, _u5_to_chars, convertbits
@@ -198,7 +198,7 @@ class CreationCeremony:
     def __init__(self) -> None:
         raise TypeError("use a CreationCeremony class constructor")
 
-    def __reduce_ex__(self, _protocol: SupportsIndex) -> Never:
+    def __reduce_ex__(self, _protocol: SupportsIndex) -> NoReturn:
         raise TypeError("creation ceremonies cannot be copied or serialized")
 
     @classmethod

src/codex32/profiles/__init__.py

@@ -2,19 +2,21 @@
 
 from __future__ import annotations
 
-from enum import StrEnum
-from typing import TYPE_CHECKING
+from enum import Enum
+from typing import TYPE_CHECKING, TypeAlias, Union
 
 from codex32.errors import UnknownProfile
 
 if TYPE_CHECKING:
     from codex32.profiles.bip39 import _Bip39Rules
     from codex32.profiles.cl32 import _Cl32Rules
     from codex32.profiles.ms32 import _Ms32Rules
-type _ProfileRules = _Ms32Rules | _Cl32Rules | _Bip39Rules
+_ProfileRules: TypeAlias = Union["_Ms32Rules", "_Cl32Rules", "_Bip39Rules"]
 
 
-class Profile(StrEnum):
+class Profile(str, Enum):
+    __str__ = str.__str__
+
     MS = "ms"
     CL = "cl"
     BIP39_12W = "bip39_12w"

src/codex32/profiles/bip39.py

@@ -57,7 +57,7 @@ def validate_payload(self, symbols: tuple[int, ...], index: str) -> None:
         semantic = value >> self.outer_padding
         embedded = semantic & ((1 << self.checksum_bits) - 1)
         entropy = semantic >> self.checksum_bits
-        entropy_bytes = entropy.to_bytes(self.entropy_bits // 8)
+        entropy_bytes = entropy.to_bytes(self.entropy_bits // 8, "big")
         expected = hashlib.sha256(entropy_bytes).digest()[0] >> (8 - self.checksum_bits)
         if embedded != expected:
             raise InvalidBip39Checksum("embedded BIP39 entropy checksum is invalid")

tests/test_bip93.py

@@ -32,6 +32,10 @@
 from codex32.errors import CodexError, InvalidChecksum
 
 
+def test_profile_string_matches_its_value() -> None:
+    assert str(Profile.MS) == "ms"
+
+
 def test_vector_1_parts_and_seed() -> None:
     secret = parse_codex32(VECTOR_1["secret_s"])
     assert isinstance(secret, MasterSeed)