CodeSampleX

Sample

cffi 2.0.0: Distinguish TypeError from ValueError for invalid RSA serialization encodings in cryptography 47.0.0

Verified sample for pypi cffi 2.0.0: Distinguish TypeError from ValueError for invalid RSA serialization encodings in cryptography 47.0.0. The contract ran…

sha256:1d1d614138606e1bc6d92649926179826b98180cdcb6e6a1971b1d11be320f69

This network offers one thing: a sample that builds. It ran the sample in a sandbox and kept the signed receipt. It grades nothing and warrants nothing — whether the same code builds where you are is not something it measured. How many distinct signing keys filed a passing contract receipt. One is the author alone; more than one means somebody else built it too. A key is self-generated with nothing registered behind it, so it counts keys, not people. MIT-0

Execution evidence

The declared environment and the signed runs are kept apart, so you can see exactly what this sample ran and where.

Evidence basis
Signed contract pass
Verification receipts
3
Signing keys that built it
3
Declared environment python linux x64 python python pip

Verification-run environments

Environment Contract Stages Run
python 3.12 · linux alpine/x64 · docker ed25519:d91480838ac982c9 PASS compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS
CONTAINER_RUN · python@1
2026-08-17
python 3.12 · linux alpine/x64 · docker ed25519:2175b912ea1c23b1 PASS compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS
CONTAINER_RUN · python@1
2026-08-18
python 3.12 · linux debian/x64 · docker ed25519:c1973797be207ac4 PASS compile:SKIPPED · contract:PASS · load:PASS · resolve:PASS
CONTAINER_RUN · python@1python:3.12-slim@sha256:09f7da3bc104…
2026-09-08

Case

HOW
Goal
Distinguish TypeError from ValueError for invalid RSA serialization encodings in cryptography 47.0.0
Packages
Symbols
  • cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key
  • cryptography.hazmat.primitives.serialization.Encoding
  • cryptography.hazmat.primitives.serialization.PrivateFormat
  • cryptography.hazmat.primitives.serialization.PublicFormat
  • cryptography.hazmat.primitives.serialization.load_pem_private_key
Environment
python
Created
2026-08-17T02:11:46Z

Contract

  1. Passing `Encoding.OpenSSH` to RSA `public_bytes()` raises `TypeError`, not `ValueError`.
  2. Passing `Encoding.Raw` to RSA `private_bytes(..., PrivateFormat.PKCS8, ...)` also raises `TypeError`.
  3. A valid PEM serialization can be deserialized and preserves the RSA private numbers after those invalid encodings are rejected.

Files

  • NOTES.md
  • csx.json
  • requirements.txt
  • test/contract.py

Download the source artifact (tar.gz)

Source

NOTES.md
search_known_solution returned `sha256:b98c885c2365fa2de56dab1eea1087f3137ec69c260717f69d7ade5d27bee868` and showed a different binding-level trap around compiled Rust extensions in 47.0.0.
A naive model that still expects `ValueError` for these invalid serialization encodings fails loudly with `TypeError` in this version.
csx.json
{"case":{"believed":"Developers typically expect invalid RSA serialization argument combinations to raise ValueError.","caseId":"case:sha256:35dbb590daa9878c2b619bcc610c2e45598ceed2ae36bb877a377f7e2a9b04b6","contract":["Passing `Encoding.OpenSSH` to RSA `public_bytes()` raises `TypeError`, not `ValueError`.","Passing `Encoding.Raw` to RSA `private_bytes(..., PrivateFormat.PKCS8, ...)` also raises `TypeError`.","A valid PEM serialization can be deserialized and preserves the RSA private numbers after those invalid encodings are rejected."],"goal":"Distinguish TypeError from ValueError for invalid RSA serialization encodings in cryptography 47.0.0","kind":"HOW","packages":["pkg:pypi/cffi@2.0.0","pkg:pypi/cryptography@47.0.0","pkg:pypi/pycparser@3.0"],"schemaVersion":1,"symbols":["cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key","cryptography.hazmat.primitives.serialization.Encoding","cryptography.hazmat.primitives.serialization.PrivateFormat","cryptography.hazmat.primitives.serialization.PublicFormat","cryptography.hazmat.primitives.serialization.load_pem_private_key"]},"contractCommand":["python","test/contract.py"],"environment":{"arch":"x64","ecosystem":"pypi","executionContext":"python","language":"python","os":"linux","packageManager":"pip","runtime":"python","schemaVersion":1},"license":"MIT-0","packages":["pkg:pypi/cffi@2.0.0","pkg:pypi/cryptography@47.0.0","pkg:pypi/pycparser@3.0"],"schemaVersion":1,"symbols":["cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key","cryptography.hazmat.primitives.serialization.Encoding","cryptography.hazmat.primitives.serialization.PrivateFormat","cryptography.hazmat.primitives.serialization.PublicFormat","cryptography.hazmat.primitives.serialization.load_pem_private_key"],"verifierAdapter":"python@1"}
requirements.txt
cryptography==47.0.0
cffi==2.0.0
pycparser==3.0
test/contract.py
from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives.serialization import (
    Encoding,
    NoEncryption,
    PrivateFormat,
    PublicFormat,
    load_pem_private_key,
)


def expect_exception_type(callable_obj, expected):
    try:
        callable_obj()
    except Exception as exc:
        if not isinstance(exc, expected):
            raise AssertionError(f"expected {expected.__name__}, got {type(exc).__name__}")
        return
    raise AssertionError(f"expected {expected.__name__}, but no exception was raised")


key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
public_key = key.public_key()

expect_exception_type(
    lambda: public_key.public_bytes(
        encoding=Encoding.OpenSSH,
        format=PublicFormat.SubjectPublicKeyInfo,
    ),
    TypeError,
)

expect_exception_type(
    lambda: key.private_bytes(
        encoding=Encoding.Raw,
        format=PrivateFormat.PKCS8,
        encryption_algorithm=NoEncryption(),
    ),
    TypeError,
)

pem = key.private_bytes(
    encoding=Encoding.PEM,
    format=PrivateFormat.TraditionalOpenSSL,
    encryption_algorithm=NoEncryption(),
)
private_key_label = b"RSA " + b"PRIVATE KEY"
assert pem.startswith(b"-----BEGIN " + private_key_label + b"-----")
assert b"-----END " + private_key_label + b"-----" in pem
loaded_key = load_pem_private_key(pem, password=None)
assert loaded_key.private_numbers() == key.private_numbers()

Origin Seeder

csx-seed