crates/vm/src/stdlib/_stat.rs (2)

229-249: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Windows-specific constants still use pub visibility.

These Windows-specific items retain pub visibility while all other platform-agnostic constants were changed to pub(super). This will trigger unreachable_pub warnings when building on Windows. The lint likely wasn't caught because you ran cargo clippy on a non-Windows platform.

Proposed fix

 #[cfg(windows)]
 #[pyattr]
-pub use windows_sys::Win32::Storage::FileSystem::{
+pub(super) use windows_sys::Win32::Storage::FileSystem::{
     FILE_ATTRIBUTE_ARCHIVE, FILE_ATTRIBUTE_COMPRESSED, FILE_ATTRIBUTE_DEVICE,
     FILE_ATTRIBUTE_DIRECTORY, FILE_ATTRIBUTE_ENCRYPTED, FILE_ATTRIBUTE_HIDDEN,
     FILE_ATTRIBUTE_INTEGRITY_STREAM, FILE_ATTRIBUTE_NO_SCRUB_DATA, FILE_ATTRIBUTE_NORMAL,
     FILE_ATTRIBUTE_NOT_CONTENT_INDEXED, FILE_ATTRIBUTE_OFFLINE, FILE_ATTRIBUTE_READONLY,
     FILE_ATTRIBUTE_REPARSE_POINT, FILE_ATTRIBUTE_SPARSE_FILE, FILE_ATTRIBUTE_SYSTEM,
     FILE_ATTRIBUTE_TEMPORARY, FILE_ATTRIBUTE_VIRTUAL,
 };

 // Windows reparse point tags
 #[cfg(windows)]
 #[pyattr]
-pub const IO_REPARSE_TAG_SYMLINK: u32 = 0xA000000C;
+pub(super) const IO_REPARSE_TAG_SYMLINK: u32 = 0xA000000C;
 #[cfg(windows)]
 #[pyattr]
-pub const IO_REPARSE_TAG_MOUNT_POINT: u32 = 0xA0000003;
+pub(super) const IO_REPARSE_TAG_MOUNT_POINT: u32 = 0xA0000003;
 #[cfg(windows)]
 #[pyattr]
-pub const IO_REPARSE_TAG_APPEXECLINK: u32 = 0x8000001B;
+pub(super) const IO_REPARSE_TAG_APPEXECLINK: u32 = 0x8000001B;

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@crates/vm/src/stdlib/_stat.rs` around lines 229 - 249, The Windows-specific
exported items and constants (the re-exported FILE_ATTRIBUTE_* group and the
IO_REPARSE_TAG_* constants) are still declared pub and should match the
platform-agnostic change to restrict visibility; change their visibility from
pub to pub(super) for the windows-specific #[pyattr] block and for the three
consts IO_REPARSE_TAG_SYMLINK, IO_REPARSE_TAG_MOUNT_POINT, and
IO_REPARSE_TAG_APPEXECLINK so they no longer trigger unreachable_pub warnings
when building on Windows.

---

340-346: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

macOS-specific constants also retain pub visibility.

Similarly, these macOS-specific constants will trigger unreachable_pub warnings when building on macOS.

Proposed fix

 #[cfg(target_os = "macos")]
 #[pyattr]
-pub const SF_SUPPORTED: u32 = 0x009f0000;
+pub(super) const SF_SUPPORTED: u32 = 0x009f0000;

 #[cfg(target_os = "macos")]
 #[pyattr]
-pub const SF_SYNTHETIC: u32 = 0xc0000000;
+pub(super) const SF_SYNTHETIC: u32 = 0xc0000000;

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@crates/vm/src/stdlib/_stat.rs` around lines 340 - 346, The two macOS-only
constants SF_SUPPORTED and SF_SYNTHETIC are declared pub and cause
unreachable_pub warnings; make them private by removing the pub modifier (keep
the existing #[cfg(target_os = "macos")] and #[pyattr] attributes) so change
"pub const SF_SUPPORTED" and "pub const SF_SYNTHETIC" to "const SF_SUPPORTED"
and "const SF_SYNTHETIC".

crates/vm/src/stdlib/_signal.rs (1)

75-81: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Incomplete unreachable_pub fix: non-unix/non-windows stubs remain pub.

The unix equivalents of SIG_DFL, SIG_IGN, and SIG_ERR were correctly narrowed to pub(crate) (Lines 60, 66), but the #[cfg(not(unix))] counterparts (Lines 75–81) still carry pub. Likewise, the #[cfg(not(any(unix, windows)))] stub of signal (Lines 200–206) remains pub while the unix/windows version was changed to pub(crate). All of these sit inside pub(crate) mod _signal, so unreachable_pub will still fire on non-unix/non-windows targets (e.g., WASM).

🔧 Proposed fix

 #[cfg(not(unix))]
 #[pyattr]
-pub const SIG_DFL: sighandler_t = 0;
+pub(crate) const SIG_DFL: sighandler_t = 0;
 #[cfg(not(unix))]
 #[pyattr]
-pub const SIG_IGN: sighandler_t = 1;
+pub(crate) const SIG_IGN: sighandler_t = 1;
 #[cfg(not(unix))]
 #[allow(dead_code)]
-pub const SIG_ERR: sighandler_t = -1 as _;
+pub(crate) const SIG_ERR: sighandler_t = -1 as _;

 #[cfg(not(any(unix, windows)))]
 #[pyfunction]
-pub fn signal(
+pub(crate) fn signal(
     _signalnum: i32,
     _handler: PyObjectRef,
     vm: &VirtualMachine,
 ) -> PyResult<Option<PyObjectRef>> {

Also applies to: 200-206

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@crates/vm/src/stdlib/_signal.rs` around lines 75 - 81, The
non-unix/non-windows stubs for signal symbols are still declared public, causing
unreachable_pub warnings; change the visibility of SIG_DFL, SIG_IGN, and SIG_ERR
in the #[cfg(not(unix))] block to pub(crate) (matching the unix variants) and
likewise change the #[cfg(not(any(unix, windows)))] stub of the signal function
to pub(crate) so all declarations inside pub(crate) mod _signal have consistent,
non-public visibility; update the declarations for the symbols SIG_DFL, SIG_IGN,
SIG_ERR and the signal function accordingly.

crates/vm/src/getpath.rs (1)

46-66: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Windows mod platform items still use bare pub, which will re-trigger unreachable_pub on Windows builds.

The non-Windows mod platform (lines 15–43) was correctly updated to pub(super), but the #[cfg(windows)] variant (lines 46–66) still exposes all items as plain pub. Since mod platform is a private module in both cfg branches, the Windows items are equally unreachable from outside this file, and the newly-enabled unreachable_pub = "warn" lint will fire when building on Windows.

🛠️ Proposed fix

 #[cfg(windows)]
 mod platform {
     use crate::version;
 
-    pub const BUILDDIR_TXT: &str = "pybuilddir.txt";
-    pub const BUILD_LANDMARK: &str = "Modules\\Setup.local";
-    pub const VENV_LANDMARK: &str = "pyvenv.cfg";
-    pub const BUILDSTDLIB_LANDMARK: &str = "Lib\\os.py";
-    pub const STDLIB_SUBDIR: &str = "Lib";
+    pub(super) const BUILDDIR_TXT: &str = "pybuilddir.txt";
+    pub(super) const BUILD_LANDMARK: &str = "Modules\\Setup.local";
+    pub(super) const VENV_LANDMARK: &str = "pyvenv.cfg";
+    pub(super) const BUILDSTDLIB_LANDMARK: &str = "Lib\\os.py";
+    pub(super) const STDLIB_SUBDIR: &str = "Lib";
 
-    pub fn stdlib_landmarks() -> [String; 2] {
+    pub(super) fn stdlib_landmarks() -> [String; 2] {
         ["Lib\\os.py".into(), "Lib\\os.pyc".into()]
     }
 
-    pub fn platstdlib_landmark() -> String {
+    pub(super) fn platstdlib_landmark() -> String {
         "DLLs".into()
     }
 
-    pub fn zip_landmark() -> String {
+    pub(super) fn zip_landmark() -> String {
         format!("python{}{}.zip", version::MAJOR, version::MINOR)
     }
 }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@crates/vm/src/getpath.rs` around lines 46 - 66, The Windows-specific mod
platform currently exposes items with plain pub which triggers unreachable_pub;
change the visibility of all public items in the #[cfg(windows)] platform module
to pub(super) (i.e., BUILDDIR_TXT, BUILD_LANDMARK, VENV_LANDMARK,
BUILDSTDLIB_LANDMARK, STDLIB_SUBDIR and the functions stdlib_landmarks,
platstdlib_landmark, zip_landmark) so they mirror the non-Windows branch and
remain reachable only within the parent module.

crates/stdlib/src/ssl/cert.rs (1)

1262-1281: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

validate_cert_key_match() never validates the key pair.

This returns Ok(()) for any non-empty cert chain plus any parseable private key; it never compares the certificate’s public key to the private key. So mismatched cert/key pairs are only caught later, despite the helper name and docs claiming they were validated here. Either perform the public-key check in this helper or rename/document it as a private-key sanity check instead.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@crates/stdlib/src/ssl/cert.rs` around lines 1262 - 1281, The helper
validate_cert_key_match currently only checks the private key parses
(any_supported_type) and doesn't verify the cert's public key matches the
private key; update it to actually compare keys: parse the first certificate's
public key (from CertificateDer<'_>) and derive the public key from private_key
(via any_supported_type or the signing key API), then compare their raw
public-key bytes (or use rustls/ring APIs to verify equality) and return
Err(...) if they differ; reference validate_cert_key_match, CertificateDer,
PrivateKeyDer, and any_supported_type (or use CertifiedKey creation) so the
function fails on mismatched pairs, or if you prefer not to change behavior,
rename/document validate_cert_key_match to reflect it only checks private-key
parseability.