feat: add the ESDK TestServer Python Language_Server

codebuild/py311/decrypt_dafny_esdk_vectors_keyrings.yml

@@ -20,7 +20,7 @@ phases:
   install:
     runtime-versions:
       python: 3.11
-      dotnet: 6.0
+      dotnet: 8.0
   pre_build:
     commands:
       # Build Python MPL TestVector runner from source      

codebuild/py311/decrypt_golden_manifest_with_keyrings.yml

@@ -16,7 +16,7 @@ phases:
   install:
     runtime-versions:
       python: 3.11
-      dotnet: 6.0
+      dotnet: 8.0
   pre_build:
     commands:
       # Build Python MPL TestVector runner from source      

codebuild/py311/decrypt_keyrings_with_keyrings.yml

@@ -16,7 +16,7 @@ phases:
   install:
     runtime-versions:
       python: 3.11
-      dotnet: 6.0
+      dotnet: 8.0
   pre_build:
     commands:
       # Build Python MPL TestVector runner from source      

codebuild/py311/decrypt_masterkey_with_keyrings.yml

@@ -16,7 +16,7 @@ phases:
   install:
     runtime-versions:
       python: 3.11
-      dotnet: 6.0
+      dotnet: 8.0
   pre_build:
     commands:
       # Build Python MPL TestVector runner from source      

codebuild/py311/decrypt_net_401_vectors_keyrings.yml

@@ -17,7 +17,7 @@ phases:
   install:
     runtime-versions:
       python: 3.11
-      dotnet: 6.0
+      dotnet: 8.0
   pre_build:
     commands:
       # Build Python MPL TestVector runner from source      

codebuild/py311/encrypt_keyrings.yml

@@ -16,7 +16,7 @@ phases:
   install:
     runtime-versions:
       python: 3.11
-      dotnet: 6.0
+      dotnet: 8.0
   build:
     commands:
       # Build Python MPL TestVector runner from source      

codebuild/py311/generate_decrypt_vectors_keyrings.yml

@@ -16,7 +16,7 @@ phases:
   install:
     runtime-versions:
       python: 3.11
-      dotnet: 6.0
+      dotnet: 8.0
   build:
     commands:
       # Build Python MPL TestVector runner from source      

codebuild/py312/decrypt_dafny_esdk_vectors_keyrings.yml

@@ -20,7 +20,7 @@ phases:
   install:
     runtime-versions:
       python: 3.12
-      dotnet: 6.0
+      dotnet: 8.0
   pre_build:
     commands:
       # Build Python MPL TestVector runner from source      

codebuild/py312/decrypt_golden_manifest_with_keyrings.yml

@@ -16,7 +16,7 @@ phases:
   install:
     runtime-versions:
       python: 3.12
-      dotnet: 6.0
+      dotnet: 8.0
   pre_build:
     commands:
       # Build Python MPL TestVector runner from source      

codebuild/py312/decrypt_hkeyring_with_keyrings.yml

@@ -16,7 +16,7 @@ phases:
   install:
     runtime-versions:
       python: 3.12
-      dotnet: 6.0
+      dotnet: 8.0
   pre_build:
     commands:
       # Build Python MPL TestVector runner from source      

codebuild/py312/decrypt_hkeyring_with_net.yml

@@ -47,4 +47,5 @@ phases:
 
   build:
     commands:
-      - dotnet test --framework net6.0
+      # The .NET 6 runtime is no longer installable; run the net6.0 build on the newest installed runtime.
+      - DOTNET_ROLL_FORWARD=Major dotnet test --framework net6.0

codebuild/py312/decrypt_keyrings_with_keyrings.yml

@@ -16,7 +16,7 @@ phases:
   install:
     runtime-versions:
       python: 3.12
-      dotnet: 6.0
+      dotnet: 8.0
   pre_build:
     commands:
       # Build Python MPL TestVector runner from source      

codebuild/py312/decrypt_masterkey_with_keyrings.yml

@@ -16,7 +16,7 @@ phases:
   install:
     runtime-versions:
       python: 3.12
-      dotnet: 6.0
+      dotnet: 8.0
   pre_build:
     commands:
       # Build Python MPL TestVector runner from source      

codebuild/py312/decrypt_net_401_vectors_keyrings.yml

@@ -17,7 +17,7 @@ phases:
   install:
     runtime-versions:
       python: 3.12
-      dotnet: 6.0
+      dotnet: 8.0
   pre_build:
     commands:
       # Build Python MPL TestVector runner from source      

codebuild/py312/encrypt_keyrings.yml

@@ -16,7 +16,7 @@ phases:
   install:
     runtime-versions:
       python: 3.12
-      dotnet: 6.0
+      dotnet: 8.0
   build:
     commands:
       # Build Python MPL TestVector runner from source      

codebuild/py312/generate_decrypt_vectors_keyrings.yml

@@ -16,7 +16,7 @@ phases:
   install:
     runtime-versions:
       python: 3.12
-      dotnet: 6.0
+      dotnet: 8.0
   build:
     commands:
       # Build Python MPL TestVector runner from source      

test-server/.gitignore

@@ -0,0 +1,9 @@
+# Cloned Python ESDK source (fetched by the orchestrator / Makefile at run time)
+.deps/
+# Python virtual environment
+.venv/
+# Python caches / build artifacts
+__pycache__/
+*.pyc
+.pytest_cache/
+*.egg-info/

test-server/README.md

@@ -0,0 +1,46 @@
+# ESDK TestServer — Python Language_Server (hand-implemented)
+
+A hand-implemented `Language_Server` for the ESDK TestServer. Smithy server
+codegen is not used for Python, so this server hand-writes the marshalling layer
+that conforms to the single Smithy model's **rpcv2Cbor** wire contract
+(Requirement 1.8) and delegates to the real **AWS Encryption SDK for Python**.
+
+## What it implements
+
+- The five operations `CreateClient`, `Encrypt`, `Decrypt`, `EncryptStream`,
+  `DecryptStream`, routed at `POST /service/ESDKTestServer/operation/<Op>`.
+- A thread-safe `ClientId -> client` registry (`CreateClient` returns a UUID).
+- The tagged-union-via-optional-members config (keyrings, CMMs, recursive
+  multi-keyring / required-EC CMM) → real Material Providers Library keyrings and
+  cryptographic materials managers, mirroring the Java server's `EsdkClientFactory`.
+- The two modeled errors serialized as a CBOR map carrying the `__type`
+  discriminator (the error's absolute shape id), so the stock generated Java
+  `Test_Client` maps them back to `GenericServerError` / `ESDKClientError`
+  (matching the Java server's `DiscriminatingCbor`).
+- Streaming: the `*Stream` operations carry a plain blob on the wire and drive the
+  ESDK streaming API server-side (Streaming_Capable).
+
+## Dependencies
+
+- `cbor2`, `boto3` (declared in `pyproject.toml`).
+- The **AWS Encryption SDK for Python** + **Material Providers Library**, installed
+  from a clone of https://github.com/aws/aws-encryption-sdk-python (its repo URL is
+  part of the Configuration). The orchestrator/Makefile clones it and installs it
+  editable from the relative path, so the server runs against live source with no
+  compile step.
+
+## Run locally
+
+```bash
+python3 -m venv .venv
+.venv/bin/pip install -e .deps/aws-encryption-sdk-python \
+    'aws-cryptographic-material-providers>=1.7.4,<=1.11.2' cbor2 boto3
+.venv/bin/pip install -e .
+.venv/bin/python -m esdk_test_server 8091   # listens on http://127.0.0.1:8091
+```
+
+Point the Tests at it (alongside the Java server) via runtime configuration:
+
+```
+-Desdk.testserver.targets=java:3=http://127.0.0.1:8080,python:4=http://127.0.0.1:8091
+```

test-server/bug-config.json

@@ -0,0 +1,6 @@
+[
+  "decrypt-accepts-trailing-bytes-commit-key",
+  "decrypt-accepts-trailing-bytes-commit-key-ecdsa",
+  "encrypt-accepts-reserved-prefix-encryption-context-key",
+  "raw-rsa-decrypt-reparses-private-key"
+]

test-server/esdk_test_server/__init__.py

@@ -0,0 +1,10 @@
+# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0
+"""Hand-implemented Python Language_Server for the ESDK TestServer.
+
+Speaks the same rpcv2Cbor wire contract as the single Smithy model (the source of
+truth) and delegates to the real AWS Encryption SDK for Python. There is no
+generated code here: the marshalling layer is hand-written to conform to the
+model's request/response shapes, the five operations, and the two modeled errors
+(Requirement 1.8).
+"""

test-server/esdk_test_server/__main__.py

@@ -0,0 +1,25 @@
+# Copyright Amazon.com Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0
+"""Entry point: ``python -m esdk_test_server <port>`` starts the Python server.
+
+The port is the first positional argument (mirroring the Java server's
+``runServer <port>``), defaulting to the ESDK_TESTSERVER_PORT env var, then 8081.
+"""
+
+import os
+import sys
+
+from .app import serve
+
+
+def main(argv=None):
+    argv = list(sys.argv[1:] if argv is None else argv)
+    if argv:
+        port = int(argv[0])
+    else:
+        port = int(os.environ.get("ESDK_TESTSERVER_PORT", "8081"))
+    serve(port)
+
+
+if __name__ == "__main__":
+    main()