Add ty type checking alongside mypy

ty and mypy use incompatible suppression comments: ty ignores any
`# type: ignore[...]` that carries error codes in brackets, and mypy
only recognizes `# type: ignore` when it is the first comment on a
line. Lines that both checkers flag now carry a mypy comment followed
by a ty one, which each tool parses as its own. A bare `# type: ignore`
is honored by both, so the sites that already use one are left alone.

Add ty to the pep8test dependency group and run it in the `flake` and
`local` nox sessions. ty resolves its target version from
`project.requires-python` rather than the interpreter it runs on, so
pass `--python-version` to keep it in step with mypy; otherwise the two
disagree about which `sys.version_info` branch is reachable, and ty
demands `tomli` even on interpreters where the fallback import is dead.

Skip ty on Python 3.9. ty binds away the first parameter of a
`__call__` typed through a Callable-bounded TypeVar, which is how
pytest 8's `_WithException` protocol declares it, so every
`pytest.skip("...")` in the suite is rejected. pytest 9 dropped that
pattern but requires Python 3.10+.

Disable ty's `unused-type-ignore-comment`. One arm of a
`sys.version_info` pair is unreachable at any given version, and ty
reports the blanket ignore mypy needs there as unused. mypy's
`warn_unused_ignores` already covers those comments.
`unused-ignore-comment` (for `# ty: ignore`) stays on, since mypy
cannot check those.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FfdhCmHmddyxdZACBwjaeg

Author: claude

ci-constraints-requirements.txt

@@ -248,6 +248,8 @@ tomli==2.4.1 ; python_full_version <= '3.11'
     #   nox
     #   pytest
     #   sphinx
+ty==0.0.69
+    # via cryptography (pyproject.toml:dev)
 typing-extensions==4.16.0
     # via
     #   cryptography (pyproject.toml)

docs/development/submitting-patches.rst

@@ -24,6 +24,22 @@ running ``ruff`` against it. If you've installed the development requirements
 this will automatically use our configuration. You can also run the ``nox``
 job with ``nox -e flake``.
 
+We type check with both ``mypy`` and ``ty``. The two use different suppression
+comments, so a line that needs suppressing in both must carry both, with the
+``mypy`` one first (``mypy`` only recognizes ``# type: ignore`` when it is the
+first comment on the line):
+
+.. code-block:: python
+
+    key1 < key2  # type: ignore[operator]  # ty: ignore[unsupported-operator]
+
+``ty`` does not understand ``mypy``'s error codes (see `ty#3127`_) and ignores
+a ``# type: ignore[...]`` comment that has any codes in brackets, so a
+``mypy``-only suppression needs nothing extra. A bare ``# type: ignore``, on
+the other hand, is honored by both, and needs no ``ty`` comment.
+
+Don't add a ``# ty: ignore`` that isn't needed: ``ty`` reports unused ones.
+
 `Write comments as complete sentences.`_
 
 Class names which contains acronyms or initialisms should always be
@@ -148,3 +164,4 @@ So, specifically:
 .. _`syntax`: https://www.sphinx-doc.org/en/master/usage/restructuredtext/domains.html#info-field-lists
 .. _`Studies have shown`: https://smartbear.com/learn/code-review/best-practices-for-peer-code-review/
 .. _`our mailing list`: https://mail.python.org/mailman/listinfo/cryptography-dev
+.. _`ty#3127`: https://github.com/astral-sh/ty/issues/3127

noxfile.py

@@ -54,6 +54,33 @@ def load_pyproject_toml() -> dict:
         return tomllib.load(f)
 
 
+def run_ty(session: nox.Session) -> None:
+    # ty binds away the first parameter of a `__call__` typed through a
+    # Callable-bounded TypeVar (https://github.com/astral-sh/ty/issues/3981),
+    # which is how pytest 8's `_WithException` protocol declares it, so it
+    # rejects every `pytest.skip("...")` in the test suite
+    # (https://github.com/astral-sh/ty/issues/2797). pytest 9 dropped that
+    # pattern but requires Python 3.10+, so skip ty on 3.9.
+    if sys.version_info < (3, 10):
+        session.log("Skipping ty: needs pytest >= 9, which needs Python 3.10+")
+        return
+
+    session.run(
+        "ty",
+        "check",
+        # ty takes its target version from `project.requires-python` (3.9)
+        # rather than the interpreter it runs on. Pin it so ty and mypy agree
+        # on which `sys.version_info` branches are reachable. No session pins a
+        # python, so this is the version the session venv uses.
+        f"--python-version={sys.version_info[0]}.{sys.version_info[1]}",
+        "src/cryptography/",
+        "vectors/cryptography_vectors/",
+        "tests/",
+        "release.py",
+        "noxfile.py",
+    )
+
+
 @nox.session
 @nox.session(name="tests-ssh")
 @nox.session(name="tests-randomorder")
@@ -232,6 +259,7 @@ def flake(session: nox.Session) -> None:
         "release.py",
         "noxfile.py",
     )
+    run_ty(session)
     session.run("check-sdist", "--no-isolation")
 
 
@@ -332,6 +360,8 @@ def local(session: nox.Session):
         "noxfile.py",
     )
 
+    run_ty(session)
+
     session.run(
         "maturin",
         "develop",

pyproject.toml

@@ -100,6 +100,7 @@ sdist = ["build >=1.0.0"]
 pep8test = [
     "ruff >=0.11.11",
     "mypy >=1.14",
+    "ty >=0.0.69",
     "check-sdist",
     "click >=8.0.1",
 ]
@@ -159,6 +160,21 @@ warn_unused_configs = true
 strict_equality = true
 strict_bytes = true
 
+# ty does not understand mypy's error codes, so a line both checkers flag
+# carries a `# type: ignore[...]` followed by a `# ty: ignore[...]`. If ty
+# grows support for mypy's names (https://github.com/astral-sh/ty/issues/3127)
+# the `ty:` halves can be dropped.
+[tool.ty.rules]
+# In `sys.version_info`-gated code one branch is always unreachable, and ty
+# reports the blanket ignore there as unused while mypy stays quiet. Whichever
+# version we check, one arm of such a pair gets flagged. mypy's
+# `warn_unused_ignores` already covers `# type: ignore` comments, so turn this
+# off. `unused-ignore-comment` (for `# ty: ignore`) stays enabled, since mypy
+# can't check those.
+# Tracked upstream as https://github.com/astral-sh/ty/issues/2681; this can be
+# re-enabled once ty stops reporting suppressions in unreachable code.
+unused-type-ignore-comment = "ignore"
+
 [[tool.mypy.overrides]]
 module = ["pretend"]
 ignore_missing_imports = true

src/cryptography/hazmat/bindings/openssl/binding.py

@@ -36,7 +36,7 @@ def build_conditional_library(
     conditional_names: Mapping[str, Callable[[], list[str]]],
 ) -> typing.Any:
     conditional_lib = types.ModuleType("lib")
-    conditional_lib._original_lib = lib  # type: ignore[attr-defined]
+    conditional_lib._original_lib = lib  # type: ignore[attr-defined]  # ty: ignore[unresolved-attribute]
     excluded_names = set()
     for condition, names_cb in conditional_names.items():
         if not getattr(lib, condition):

src/cryptography/x509/extensions.py

@@ -2510,7 +2510,7 @@ def __init__(self, oid: ObjectIdentifier, value: bytes) -> None:
         self._value = value
 
     @property
-    def oid(self) -> ObjectIdentifier:  # type: ignore[override]
+    def oid(self) -> ObjectIdentifier:  # type: ignore[override]  # ty: ignore[invalid-attribute-override]
         return self._oid
 
     @property

tests/hazmat/asn1/test_api.py

@@ -225,7 +225,7 @@ class Example:
         with pytest.raises(
             TypeError, match="got an unexpected keyword argument 'bar'"
         ):
-            Example(bar=3)  # type: ignore[call-arg]
+            Example(bar=3)  # type: ignore[call-arg]  # ty: ignore[missing-argument, unknown-argument]
 
     def test_fail_init_missing_field_name(self) -> None:
         @asn1.sequence
@@ -239,7 +239,7 @@ class Example:
         )
 
         with pytest.raises(TypeError, match=expected_err):
-            Example()  # type: ignore[call-arg]
+            Example()  # type: ignore[call-arg]  # ty: ignore[missing-argument]
 
     def test_fail_positional_field_initialization(self) -> None:
         @asn1.sequence
@@ -475,7 +475,7 @@ def test_fail_choice_with_non_literal_tag(self) -> None:
             class Example:
                 foo: typing.Union[
                     Annotated[
-                        asn1.Variant[int, str],
+                        asn1.Variant[int, str],  # ty: ignore[invalid-type-arguments]
                         asn1.Implicit(0),
                     ],
                     Annotated[
@@ -542,7 +542,7 @@ class Example:
         with pytest.raises(
             TypeError, match="got an unexpected keyword argument 'bar'"
         ):
-            Example(bar=3)  # type: ignore[call-arg]
+            Example(bar=3)  # type: ignore[call-arg]  # ty: ignore[missing-argument, unknown-argument]
 
     def test_fail_init_missing_field_name(self) -> None:
         @asn1.set
@@ -556,7 +556,7 @@ class Example:
         )
 
         with pytest.raises(TypeError, match=expected_err):
-            Example()  # type: ignore[call-arg]
+            Example()  # type: ignore[call-arg]  # ty: ignore[missing-argument]
 
     def test_fail_positional_field_initialization(self) -> None:
         @asn1.set

tests/hazmat/primitives/test_dh.py

@@ -506,7 +506,7 @@ def test_public_key_equality(self):
         assert key1 != object()
 
         with pytest.raises(TypeError):
-            key1 < key2  # type: ignore[operator]
+            key1 < key2  # type: ignore[operator]  # ty: ignore[unsupported-operator]
 
     def test_public_key_copy(self):
         key_bytes = load_vectors_from_file(

tests/hazmat/primitives/test_dsa.py

@@ -397,7 +397,7 @@ def test_public_key_equality(self):
         assert key1 != key3
         assert key1 != object()
         with pytest.raises(TypeError):
-            key1 < key2  # type: ignore[operator]
+            key1 < key2  # type: ignore[operator]  # ty: ignore[unsupported-operator]
 
     def test_public_key_copy(self):
         key_bytes = load_vectors_from_file(

tests/hazmat/primitives/test_ec.py

@@ -763,7 +763,7 @@ def test_public_key_equality(self, backend):
         assert key1 != key3
         assert key1 != object()
         with pytest.raises(TypeError):
-            key1 < key2  # type: ignore[operator]
+            key1 < key2  # type: ignore[operator]  # ty: ignore[unsupported-operator]
 
     def test_public_key_copy(self, backend):
         _skip_curve_unsupported(backend, ec.SECP256R1())