more typing (#5887)

* backend typing for twofactor package and more otp work

* even more typing

* style fixes

* no generic typing for _get_backend

* remove unneeded typing

17 files changed, 122 insertions, 30 deletions

diff --git a/tests/hazmat/backends/test_no_backend.py b/tests/hazmat/backends/test_no_backend.py
index 9c01d1368..282238d70 100644
--- a/tests/hazmat/backends/test_no_backend.py
+++ b/tests/hazmat/backends/test_no_backend.py
@@ -12,4 +12,4 @@ def test_get_backend_no_backend():
 
 def test_get_backend():
     faux_backend = object()
-    assert _get_backend(faux_backend) is faux_backend
+    assert _get_backend(faux_backend) is faux_backend  # type: ignore[arg-type]
diff --git a/tests/hazmat/primitives/test_ciphers.py b/tests/hazmat/primitives/test_ciphers.py
index f00282ecc..99aa4af3f 100644
--- a/tests/hazmat/primitives/test_ciphers.py
+++ b/tests/hazmat/primitives/test_ciphers.py
@@ -202,7 +202,11 @@ def test_invalid_backend():
     pretend_backend = object()
 
     with raises_unsupported_algorithm(_Reasons.BACKEND_MISSING_INTERFACE):
-        ciphers.Cipher(AES(b"AAAAAAAAAAAAAAAA"), modes.ECB(), pretend_backend)
+        ciphers.Cipher(
+            AES(b"AAAAAAAAAAAAAAAA"),
+            modes.ECB(),
+            pretend_backend,  # type: ignore[arg-type]
+        )
 
 
 @pytest.mark.supported(
diff --git a/tests/hazmat/primitives/test_cmac.py b/tests/hazmat/primitives/test_cmac.py
index 1c8841ac8..1d6892540 100644
--- a/tests/hazmat/primitives/test_cmac.py
+++ b/tests/hazmat/primitives/test_cmac.py
@@ -217,4 +217,4 @@ def test_invalid_backend():
     pretend_backend = object()
 
     with raises_unsupported_algorithm(_Reasons.BACKEND_MISSING_INTERFACE):
-        CMAC(AES(key), pretend_backend)
+        CMAC(AES(key), pretend_backend)  # type: ignore[arg-type]
diff --git a/tests/hazmat/primitives/test_concatkdf.py b/tests/hazmat/primitives/test_concatkdf.py
index 18134eeca..5da47ecc4 100644
--- a/tests/hazmat/primitives/test_concatkdf.py
+++ b/tests/hazmat/primitives/test_concatkdf.py
@@ -298,6 +298,17 @@ def test_invalid_backend():
     pretend_backend = object()
 
     with raises_unsupported_algorithm(_Reasons.BACKEND_MISSING_INTERFACE):
-        ConcatKDFHash(hashes.SHA256(), 16, None, pretend_backend)
+        ConcatKDFHash(
+            hashes.SHA256(),
+            16,
+            None,
+            pretend_backend,  # type: ignore[arg-type]
+        )
     with raises_unsupported_algorithm(_Reasons.BACKEND_MISSING_INTERFACE):
-        ConcatKDFHMAC(hashes.SHA256(), 16, None, None, pretend_backend)
+        ConcatKDFHMAC(
+            hashes.SHA256(),
+            16,
+            None,
+            None,
+            pretend_backend,  # type: ignore[arg-type]
+        )
diff --git a/tests/hazmat/primitives/test_dh.py b/tests/hazmat/primitives/test_dh.py
index b37eca4eb..17d3a776e 100644
--- a/tests/hazmat/primitives/test_dh.py
+++ b/tests/hazmat/primitives/test_dh.py
@@ -82,7 +82,7 @@ def test_dh_numbers():
         dh.DHPublicNumbers(1, None)  # type: ignore[arg-type]
 
     with pytest.raises(TypeError):
-        dh.DHPublicNumbers(None, params)
+        dh.DHPublicNumbers(None, params)  # type:ignore[arg-type]
 
     private = dh.DHPrivateNumbers(1, public)
 
@@ -93,7 +93,7 @@ def test_dh_numbers():
         dh.DHPrivateNumbers(1, None)  # type: ignore[arg-type]
 
     with pytest.raises(TypeError):
-        dh.DHPrivateNumbers(None, public)
+        dh.DHPrivateNumbers(None, public)  # type:ignore[arg-type]
 
 
 def test_dh_parameter_numbers_equality():
@@ -585,7 +585,7 @@ class TestDHPrivateKeySerialization(object):
         key = parameters.generate_private_key()
         with pytest.raises(TypeError):
             key.private_bytes(
-                "notencoding",
+                "notencoding",  # type:ignore[arg-type]
                 serialization.PrivateFormat.PKCS8,
                 serialization.NoEncryption(),
             )
@@ -596,7 +596,7 @@ class TestDHPrivateKeySerialization(object):
         with pytest.raises(ValueError):
             key.private_bytes(
                 serialization.Encoding.PEM,
-                "invalidformat",
+                "invalidformat",  # type:ignore[arg-type]
                 serialization.NoEncryption(),
             )
 
@@ -607,7 +607,7 @@ class TestDHPrivateKeySerialization(object):
             key.private_bytes(
                 serialization.Encoding.PEM,
                 serialization.PrivateFormat.PKCS8,
-                "notanencalg",
+                "notanencalg",  # type:ignore[arg-type]
             )
 
     def test_private_bytes_unsupported_encryption_type(self, backend):
@@ -735,7 +735,8 @@ class TestDHPublicKeySerialization(object):
         key = parameters.generate_private_key().public_key()
         with pytest.raises(TypeError):
             key.public_bytes(
-                "notencoding", serialization.PublicFormat.SubjectPublicKeyInfo
+                "notencoding",  # type:ignore[arg-type]
+                serialization.PublicFormat.SubjectPublicKeyInfo,
             )
 
     def test_public_bytes_pkcs1_unsupported(self, backend):
@@ -888,13 +889,17 @@ class TestDHParameterSerialization(object):
         parameters = FFDH3072_P.parameters(backend)
         with pytest.raises(TypeError):
             parameters.parameter_bytes(
-                "notencoding", serialization.ParameterFormat.PKCS3
+                "notencoding",  # type:ignore[arg-type]
+                serialization.ParameterFormat.PKCS3,
             )
 
     def test_parameter_bytes_invalid_format(self, backend):
         parameters = FFDH3072_P.parameters(backend)
         with pytest.raises(ValueError):
-            parameters.parameter_bytes(serialization.Encoding.PEM, "notformat")
+            parameters.parameter_bytes(
+                serialization.Encoding.PEM,
+                "notformat",  # type: ignore[arg-type]
+            )
 
     def test_parameter_bytes_openssh_unsupported(self, backend):
         parameters = FFDH3072_P.parameters(backend)
diff --git a/tests/hazmat/primitives/test_hashes.py b/tests/hazmat/primitives/test_hashes.py
index 67de7947b..e433d9c01 100644
--- a/tests/hazmat/primitives/test_hashes.py
+++ b/tests/hazmat/primitives/test_hashes.py
@@ -159,7 +159,7 @@ def test_invalid_backend():
     pretend_backend = object()
 
     with raises_unsupported_algorithm(_Reasons.BACKEND_MISSING_INTERFACE):
-        hashes.Hash(hashes.SHA1(), pretend_backend)
+        hashes.Hash(hashes.SHA1(), pretend_backend)  # type:ignore[arg-type]
 
 
 def test_buffer_protocol_hash(backend):
diff --git a/tests/hazmat/primitives/test_hkdf.py b/tests/hazmat/primitives/test_hkdf.py
index 80b27b9a9..e5218723c 100644
--- a/tests/hazmat/primitives/test_hkdf.py
+++ b/tests/hazmat/primitives/test_hkdf.py
@@ -217,7 +217,15 @@ def test_invalid_backend():
     pretend_backend = object()
 
     with raises_unsupported_algorithm(_Reasons.BACKEND_MISSING_INTERFACE):
-        HKDF(hashes.SHA256(), 16, None, None, pretend_backend)
+        HKDF(
+            hashes.SHA256(),
+            16,
+            None,
+            None,
+            pretend_backend,  # type:ignore[arg-type]
+        )
 
     with raises_unsupported_algorithm(_Reasons.BACKEND_MISSING_INTERFACE):
-        HKDFExpand(hashes.SHA256(), 16, None, pretend_backend)
+        HKDFExpand(
+            hashes.SHA256(), 16, None, pretend_backend  # type:ignore[arg-type]
+        )
diff --git a/tests/hazmat/primitives/test_hmac.py b/tests/hazmat/primitives/test_hmac.py
index 1cbd39c10..44dd94e05 100644
--- a/tests/hazmat/primitives/test_hmac.py
+++ b/tests/hazmat/primitives/test_hmac.py
@@ -94,4 +94,6 @@ def test_invalid_backend():
     pretend_backend = object()
 
     with raises_unsupported_algorithm(_Reasons.BACKEND_MISSING_INTERFACE):
-        hmac.HMAC(b"key", hashes.SHA1(), pretend_backend)
+        hmac.HMAC(
+            b"key", hashes.SHA1(), pretend_backend  # type:ignore[arg-type]
+        )
diff --git a/tests/hazmat/primitives/test_kbkdf.py b/tests/hazmat/primitives/test_kbkdf.py
index ddbf953b1..ae9330807 100644
--- a/tests/hazmat/primitives/test_kbkdf.py
+++ b/tests/hazmat/primitives/test_kbkdf.py
@@ -268,7 +268,7 @@ class TestKBKDFHMAC(object):
                 b"label",
                 b"context",
                 None,
-                backend=object(),
+                backend=object(),  # type: ignore[arg-type]
             )
 
     def test_unicode_error_label(self, backend):
diff --git a/tests/hazmat/primitives/test_pbkdf2hmac.py b/tests/hazmat/primitives/test_pbkdf2hmac.py
index 8586debe4..0c83c6a01 100644
--- a/tests/hazmat/primitives/test_pbkdf2hmac.py
+++ b/tests/hazmat/primitives/test_pbkdf2hmac.py
@@ -67,4 +67,10 @@ def test_invalid_backend():
     pretend_backend = object()
 
     with raises_unsupported_algorithm(_Reasons.BACKEND_MISSING_INTERFACE):
-        PBKDF2HMAC(hashes.SHA1(), 20, b"salt", 10, pretend_backend)
+        PBKDF2HMAC(
+            hashes.SHA1(),
+            20,
+            b"salt",
+            10,
+            pretend_backend,  # type:ignore[arg-type]
+        )
diff --git a/tests/hazmat/primitives/test_rsa.py b/tests/hazmat/primitives/test_rsa.py
index 9c98dbbab..2c8715b24 100644
--- a/tests/hazmat/primitives/test_rsa.py
+++ b/tests/hazmat/primitives/test_rsa.py
@@ -381,7 +381,9 @@ def test_rsa_generate_invalid_backend():
     pretend_backend = object()
 
     with raises_unsupported_algorithm(_Reasons.BACKEND_MISSING_INTERFACE):
-        rsa.generate_private_key(65537, 2048, pretend_backend)
+        rsa.generate_private_key(
+            65537, 2048, pretend_backend  # type:ignore[arg-type]
+        )
 
 
 class TestRSASignature(object):
diff --git a/tests/hazmat/primitives/test_scrypt.py b/tests/hazmat/primitives/test_scrypt.py
index 63e6b35ce..b87cb220a 100644
--- a/tests/hazmat/primitives/test_scrypt.py
+++ b/tests/hazmat/primitives/test_scrypt.py
@@ -84,7 +84,7 @@ class TestScrypt(object):
                 work_factor,
                 block_size,
                 parallelization_factor,
-                backend,
+                backend,  # type: ignore[arg-type]
             )
 
     def test_salt_not_bytes(self, backend):
diff --git a/tests/hazmat/primitives/test_x963kdf.py b/tests/hazmat/primitives/test_x963kdf.py
index 5254aa006..c0c3c37d2 100644
--- a/tests/hazmat/primitives/test_x963kdf.py
+++ b/tests/hazmat/primitives/test_x963kdf.py
@@ -116,4 +116,9 @@ def test_invalid_backend():
     pretend_backend = object()
 
     with raises_unsupported_algorithm(_Reasons.BACKEND_MISSING_INTERFACE):
-        X963KDF(hashes.SHA256(), 16, None, pretend_backend)
+        X963KDF(
+            hashes.SHA256(),
+            16,
+            None,
+            pretend_backend,  # type: ignore[arg-type]
+        )
diff --git a/tests/hazmat/primitives/twofactor/test_hotp.py b/tests/hazmat/primitives/twofactor/test_hotp.py
index 979f3f004..3e983f83f 100644
--- a/tests/hazmat/primitives/twofactor/test_hotp.py
+++ b/tests/hazmat/primitives/twofactor/test_hotp.py
@@ -120,4 +120,6 @@ def test_invalid_backend():
     pretend_backend = object()
 
     with raises_unsupported_algorithm(_Reasons.BACKEND_MISSING_INTERFACE):
-        HOTP(secret, 8, hashes.SHA1(), pretend_backend)
+        HOTP(
+            secret, 8, hashes.SHA1(), pretend_backend  # type: ignore[arg-type]
+        )
diff --git a/tests/hazmat/primitives/twofactor/test_totp.py b/tests/hazmat/primitives/twofactor/test_totp.py
index 015977339..2e7311ff8 100644
--- a/tests/hazmat/primitives/twofactor/test_totp.py
+++ b/tests/hazmat/primitives/twofactor/test_totp.py
@@ -155,4 +155,10 @@ def test_invalid_backend():
     pretend_backend = object()
 
     with raises_unsupported_algorithm(_Reasons.BACKEND_MISSING_INTERFACE):
-        TOTP(secret, 8, hashes.SHA1(), 30, pretend_backend)
+        TOTP(
+            secret,
+            8,
+            hashes.SHA1(),
+            30,
+            pretend_backend,  # type: ignore[arg-type]
+        )
diff --git a/tests/x509/test_x509.py b/tests/x509/test_x509.py
index 87b6b29e6..5baa37861 100644
--- a/tests/x509/test_x509.py
+++ b/tests/x509/test_x509.py
@@ -60,8 +60,7 @@ from ..hazmat.primitives.test_ec import _skip_curve_unsupported
 from ..utils import load_nist_vectors, load_vectors_from_file
 
 
-@utils.register_interface(x509.ExtensionType)
-class DummyExtension(object):
+class DummyExtension(x509.ExtensionType):
     oid = x509.ObjectIdentifier("1.2.3.4")
 
 
@@ -1683,11 +1682,15 @@ class TestRSACertificateRequest(object):
         basic_constraints = cert.extensions.get_extension_for_oid(
             ExtensionOID.BASIC_CONSTRAINTS
         )
+        assert isinstance(basic_constraints.value, x509.BasicConstraints)
         assert basic_constraints.value.ca is False
         assert basic_constraints.value.path_length is None
         subject_alternative_name = cert.extensions.get_extension_for_oid(
             ExtensionOID.SUBJECT_ALTERNATIVE_NAME
         )
+        assert isinstance(
+            subject_alternative_name.value, x509.SubjectAlternativeName
+        )
         assert list(subject_alternative_name.value) == [
             x509.DNSName("cryptography.io"),
         ]
@@ -2498,11 +2501,15 @@ class TestCertificateBuilder(object):
         basic_constraints = cert.extensions.get_extension_for_oid(
             ExtensionOID.BASIC_CONSTRAINTS
         )
+        assert isinstance(basic_constraints.value, x509.BasicConstraints)
         assert basic_constraints.value.ca is False
         assert basic_constraints.value.path_length is None
         subject_alternative_name = cert.extensions.get_extension_for_oid(
             ExtensionOID.SUBJECT_ALTERNATIVE_NAME
         )
+        assert isinstance(
+            subject_alternative_name.value, x509.SubjectAlternativeName
+        )
         assert list(subject_alternative_name.value) == [
             x509.DNSName("cryptography.io"),
         ]
@@ -2545,11 +2552,15 @@ class TestCertificateBuilder(object):
         basic_constraints = cert.extensions.get_extension_for_oid(
             ExtensionOID.BASIC_CONSTRAINTS
         )
+        assert isinstance(basic_constraints.value, x509.BasicConstraints)
         assert basic_constraints.value.ca is False
         assert basic_constraints.value.path_length is None
         subject_alternative_name = cert.extensions.get_extension_for_oid(
             ExtensionOID.SUBJECT_ALTERNATIVE_NAME
         )
+        assert isinstance(
+            subject_alternative_name.value, x509.SubjectAlternativeName
+        )
         assert list(subject_alternative_name.value) == [
             x509.DNSName("cryptography.io"),
         ]
@@ -2600,11 +2611,15 @@ class TestCertificateBuilder(object):
         basic_constraints = cert.extensions.get_extension_for_oid(
             ExtensionOID.BASIC_CONSTRAINTS
         )
+        assert isinstance(basic_constraints.value, x509.BasicConstraints)
         assert basic_constraints.value.ca is False
         assert basic_constraints.value.path_length is None
         subject_alternative_name = cert.extensions.get_extension_for_oid(
             ExtensionOID.SUBJECT_ALTERNATIVE_NAME
         )
+        assert isinstance(
+            subject_alternative_name.value, x509.SubjectAlternativeName
+        )
         assert list(subject_alternative_name.value) == [
             x509.DNSName("cryptography.io"),
         ]
@@ -2635,6 +2650,7 @@ class TestCertificateBuilder(object):
         )
 
         cert = builder.sign(issuer_private_key, hashes.SHA256(), backend)
+        assert cert.signature_hash_algorithm is not None
         issuer_private_key.public_key().verify(
             cert.signature,
             cert.tbs_certificate_bytes,
@@ -2693,11 +2709,15 @@ class TestCertificateBuilder(object):
         basic_constraints = cert.extensions.get_extension_for_oid(
             ExtensionOID.BASIC_CONSTRAINTS
         )
+        assert isinstance(basic_constraints.value, x509.BasicConstraints)
         assert basic_constraints.value.ca is False
         assert basic_constraints.value.path_length is None
         subject_alternative_name = cert.extensions.get_extension_for_oid(
             ExtensionOID.SUBJECT_ALTERNATIVE_NAME
         )
+        assert isinstance(
+            subject_alternative_name.value, x509.SubjectAlternativeName
+        )
         assert list(subject_alternative_name.value) == [
             x509.DNSName("cryptography.io"),
         ]
@@ -2728,6 +2748,7 @@ class TestCertificateBuilder(object):
         )
 
         cert = builder.sign(issuer_private_key, hashes.SHA256(), backend)
+        assert cert.signature_hash_algorithm is not None
         issuer_private_key.public_key().verify(
             cert.signature,
             cert.tbs_certificate_bytes,
@@ -3230,6 +3251,7 @@ class TestCertificateBuilder(object):
         basic_constraints = request.extensions.get_extension_for_oid(
             ExtensionOID.BASIC_CONSTRAINTS
         )
+        assert isinstance(basic_constraints.value, x509.BasicConstraints)
         assert basic_constraints.value.path_length is None
 
     @pytest.mark.parametrize(
@@ -3273,7 +3295,9 @@ class TestCertificateSigningRequestBuilder(object):
             x509.Name([])
         )
         with pytest.raises(TypeError):
-            builder.sign(private_key, "NotAHash", backend)
+            builder.sign(
+                private_key, "NotAHash", backend  # type: ignore[arg-type]
+            )
 
     @pytest.mark.supported(
         only_if=lambda backend: backend.ed25519_supported(),
@@ -3373,6 +3397,7 @@ class TestCertificateSigningRequestBuilder(object):
         basic_constraints = request.extensions.get_extension_for_oid(
             ExtensionOID.BASIC_CONSTRAINTS
         )
+        assert isinstance(basic_constraints.value, x509.BasicConstraints)
         assert basic_constraints.value.ca is True
         assert basic_constraints.value.path_length == 2
 
@@ -3518,6 +3543,7 @@ class TestCertificateSigningRequestBuilder(object):
         basic_constraints = request.extensions.get_extension_for_oid(
             ExtensionOID.BASIC_CONSTRAINTS
         )
+        assert isinstance(basic_constraints.value, x509.BasicConstraints)
         assert basic_constraints.value.ca is False
         assert basic_constraints.value.path_length is None
 
@@ -3553,6 +3579,7 @@ class TestCertificateSigningRequestBuilder(object):
         basic_constraints = request.extensions.get_extension_for_oid(
             ExtensionOID.BASIC_CONSTRAINTS
         )
+        assert isinstance(basic_constraints.value, x509.BasicConstraints)
         assert basic_constraints.value.ca is True
         assert basic_constraints.value.path_length == 2
 
@@ -3657,6 +3684,7 @@ class TestCertificateSigningRequestBuilder(object):
         basic_constraints = request.extensions.get_extension_for_oid(
             ExtensionOID.BASIC_CONSTRAINTS
         )
+        assert isinstance(basic_constraints.value, x509.BasicConstraints)
         assert basic_constraints.value.ca is True
         assert basic_constraints.value.path_length == 2
 
@@ -3800,11 +3828,13 @@ class TestCertificateSigningRequestBuilder(object):
         basic_constraints = request.extensions.get_extension_for_oid(
             ExtensionOID.BASIC_CONSTRAINTS
         )
+        assert isinstance(basic_constraints.value, x509.BasicConstraints)
         assert basic_constraints.value.ca is True
         assert basic_constraints.value.path_length == 2
         ext = request.extensions.get_extension_for_oid(
             ExtensionOID.SUBJECT_ALTERNATIVE_NAME
         )
+        assert isinstance(ext.value, x509.SubjectAlternativeName)
         assert list(ext.value) == [x509.DNSName("cryptography.io")]
 
     def test_add_attributes(self, backend):
diff --git a/tests/x509/test_x509_crlbuilder.py b/tests/x509/test_x509_crlbuilder.py
index b32322f97..14fe23871 100644
--- a/tests/x509/test_x509_crlbuilder.py
+++ b/tests/x509/test_x509_crlbuilder.py
@@ -341,6 +341,7 @@ class TestCertificateRevocationListBuilder(object):
         assert len(crl.extensions) == 1
         ext1 = crl.extensions.get_extension_for_class(x509.FreshestCRL)
         assert ext1.critical is False
+        assert isinstance(ext1.value, x509.FreshestCRL)
         assert isinstance(ext1.value[0], x509.DistributionPoint)
         assert ext1.value[0].full_name is not None
         uri = ext1.value[0].full_name[0]
@@ -411,7 +412,9 @@ class TestCertificateRevocationListBuilder(object):
         )
 
         with pytest.raises(TypeError):
-            builder.sign(private_key, object(), backend)
+            builder.sign(
+                private_key, object(), backend  # type: ignore[arg-type]
+            )
 
     @pytest.mark.supported(
         only_if=lambda backend: backend.ed25519_supported(),
@@ -437,7 +440,11 @@ class TestCertificateRevocationListBuilder(object):
         )
 
         with pytest.raises(ValueError):
-            builder.sign(private_key, object(), backend)
+            builder.sign(
+                private_key,
+                object(),  # type:ignore[arg-type]
+                backend,
+            )
         with pytest.raises(ValueError):
             builder.sign(private_key, hashes.SHA256(), backend)
 
@@ -465,7 +472,11 @@ class TestCertificateRevocationListBuilder(object):
         )
 
         with pytest.raises(ValueError):
-            builder.sign(private_key, object(), backend)
+            builder.sign(
+                private_key,
+                object(),  # type:ignore[arg-type]
+                backend,
+            )
         with pytest.raises(ValueError):
             builder.sign(private_key, hashes.SHA256(), backend)