turn API-mandated no-op into assertion

Make it explicit that there cannot actually be a rest data when
finalizing an encrypted object. The Cryptography API mandates
that the caller handle the remainder of the data on finalization.
By virtue of being a stream cipher, the AES-GCM encoder always
returns the exact number of bytes that it was given so
technically the rest is meaningless.

diff --git a/testing/test_crypto.py b/testing/test_crypto.py
index 0e881aa..f4d9254 100644 (file)
--- a/testing/test_crypto.py
+++ b/testing/test_crypto.py
@@ -455,7 +455,17 @@ class AESGCMTest (CryptoLayerTest):
 
             n, ct = encryptor.process (pt)
             rest, _, _ = encryptor.done (header_dummy)
-            ct += rest
+
+            # NB: If this check *ever* fails, then something changed in the
+            #     encoding layer. AES-GCM is a stream cipher so each encoding
+            #     step will yield the exact number of ciphertext bytes that
+            #     was provided as plaintext. Thus there cannot be any encoded
+            #     data left when calling the finalizers. None of the crypo code
+            #     depends on that assumption but nevertheless we check it here
+            #     in case anything changes upstream in the Cryptography
+            #     library. In case there actually is a rest, replace the
+            #     assertion below with ``ct += rest``.
+            assert (len (rest) == 0)
 
             if len (pt) > new_max:
                 assert n < len (pt)