v3.31.2: the SCP81 TLS-PSK Python floor, documented and guarded

ssl's TLS-PSK callbacks (PskTlsServer) exist only since Python 3.13 - the
first CI run on 3.12 errored in all 20 PSK tests, and the docs confirm
"Added in version 3.13".

- PskTlsServer._make_context raises a clear RuntimeError naming the
  requirement instead of AttributeError; a source pin keeps the guard.
- tests/test_scp81.py skips PskTlsServerTest where the callbacks are
  missing (it runs on 3.13+), so contributors on 3.9-3.12 no longer see
  20 failures.
- The READMEs state the requirement, and the Windows notes now strongly
  recommend Python 3.13: pyscard has wheels up to 3.13, and on 3.14
  pyscard and some pysim dependency wheels are unavailable and build
  from source (MSVC).  setup.bat and setup.sh print the same guidance.
- Version strings + the PWA cache bumped together (simple-v457).

998 Python + 953 frontend green.

.github/workflows/release.yml

@@ -35,9 +35,11 @@ jobs:
           repository: osmocom/pysim
           path: pysim
 
+      # 3.13+ is required by the suite: ssl's TLS-PSK callbacks
+      # (SCP81's PskTlsServer) exist only since Python 3.13.
       - uses: actions/setup-python@v5
         with:
-          python-version: '3.12'
+          python-version: '3.13'
 
       # pyscard has no manylinux wheels, so it builds from source on Linux
       # and needs the PC/SC development headers.
@@ -55,6 +57,12 @@ jobs:
         working-directory: simple
         run: python -m unittest discover -s tests
 
+      # sp.test.js / the AES tests require the npm runtime dependencies
+      # (des.js, aes-js); the build deps come along with them.
+      - name: Install the frontend test dependencies
+        working-directory: simple/frontend
+        run: npm ci --no-audit --no-fund
+
       - name: Frontend suite
         working-directory: simple/frontend
         run: node --test

README.md

@@ -738,9 +738,9 @@ The bundled Python server wraps [pySim](https://osmocom.org/projects/pysim/wiki)
 
 ### Prerequisites
 
-- **Python 3.9+** with `pip`, and **Git**
+- **Python 3.9+** with `pip`, and **Git** — the app runs on 3.9+, but the **SCP81 TLS-PSK listener needs Python 3.13+** (`ssl`'s PSK callbacks).
 - **Smart card reader** (PC/SC or serial/FTDI) — PC/SC is preferable (`pcsc-lite` + `ccid` on Linux). `pyscard` has no Linux wheels, so it builds from source: install the PC/SC header package too (`libpcsclite-dev` on Debian/Ubuntu, `pcsc-lite-devel` on Fedora; on Arch `pcsclite` includes them).
-- **Windows** — use Python 3.9–3.13 (3.13 recommended): `pyscard` ships precompiled wheels for these versions. On 3.14 it builds from source (needs MSVC C++ Build Tools). The SMPP bridge (`smpp.twisted3`) is intentionally skipped on Windows.
+- **Windows** — use **Python 3.13 (strongly recommended)**: `pyscard` has precompiled wheels up to 3.13 and the SCP81 TLS-PSK listener needs 3.13+. On 3.14 `pyscard` and some pysim dependency wheels are not available and build from source (needs MSVC C++ Build Tools). 3.9–3.12 run the app but not the SCP81 PSK listener. The SMPP bridge (`smpp.twisted3`) is intentionally skipped on Windows.
 
 ### Scripts
 

README_RUS.md

@@ -722,9 +722,9 @@ PWA проверяет версию сервера при подключении
 
 ### Требования
 
-- **Python 3.9+** с `pip`, и **Git**
+- **Python 3.9+** с `pip`, и **Git** — приложение работает на 3.9+, но **SCP81 TLS-PSK-слушателю нужен Python 3.13+** (PSK-callback'и `ssl`).
 - **Смарт-картридер** (PC/SC или serial/FTDI) — предпочтителен PC/SC (`pcsc-lite` + `ccid` на Linux). У `pyscard` нет Linux-wheel, поэтому он собирается из исходников: поставьте и пакет с заголовками PC/SC (`libpcsclite-dev` в Debian/Ubuntu, `pcsc-lite-devel` в Fedora; в Arch они входят в `pcsclite`).
-- **Windows** — используйте Python 3.9–3.13 (рекомендуется 3.13): у `pyscard` есть готовые wheel. На 3.14 он собирается из исходников (нужны MSVC C++ Build Tools). SMPP-мост (`smpp.twisted3`) в Windows сознательно не ставится.
+- **Windows** — используйте **Python 3.13 (настоятельно рекомендуется)**: у `pyscard` есть готовые wheel до 3.13, и SCP81 TLS-PSK-слушателю нужен 3.13+. На 3.14 wheel для `pyscard` и части зависимостей pysim отсутствуют, они собираются из исходников (нужны MSVC C++ Build Tools). 3.9–3.12 запускают приложение, но не SCP81 PSK-слушатель. SMPP-мост (`smpp.twisted3`) в Windows сознательно не ставится.
 
 ### Скрипты
 

frontend/index.html

@@ -1943,7 +1943,7 @@
 // ===== Version =====
 // Single source of truth for the PWA version: shown in the header and used
 // by the server version check in pysimConnect().
-const SIMPLE_VERSION = '3.31.1';
+const SIMPLE_VERSION = '3.31.2';
 document.getElementById('app-version').textContent = 'v' + SIMPLE_VERSION;
 
 // ===== view history (the browser Back/Forward buttons) =====

frontend/sw.js

@@ -1,4 +1,4 @@
-const CACHE = 'simple-v456';
+const CACHE = 'simple-v457';
 const URLS = [
   'index.html',
   'help.html',

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "pysim-simple-server"
-version = "3.31.1"
+version = "3.31.2"
 description = "HTTP REST server wrapping pysim for the SIMple PWA"
 license = { text = "GPL-2.0-or-later" }
 requires-python = ">=3.9"

pysim_simple_server/scp81.py

@@ -18,6 +18,7 @@ DATA records to it.
 
 import socket
 import ssl
+import sys
 import threading
 import time
 
@@ -252,6 +253,11 @@ class PskTlsServer:
         # SSLV3_ALERT_UNEXPECTED_MESSAGE on the post-handshake
         # NewSessionTicket record (verified live 2026-09-15).
         ctx.options |= ssl.OP_NO_TICKET
+        if not hasattr(ctx, 'set_psk_server_callback'):
+            # ssl's TLS-PSK callbacks exist only since Python 3.13.
+            raise RuntimeError(
+                'TLS-PSK requires Python 3.13+ (ssl.SSLContext.set_psk_server_callback '
+                'is missing in %s)' % sys.version.split()[0])
         ctx.set_psk_server_callback(self._psk_cb)
         return ctx
 

pysim_simple_server/server.py

@@ -37,7 +37,7 @@ from osmocom.tlv import BER_TLV_IE
 from osmocom.utils import rpad
 
 
-VERSION = '3.31.1'
+VERSION = '3.31.2'
 
 MAX_ENVELOPE_SEGMENTS = 5  # max SMS segments for outgoing C-APDU in ENVELOPE
 

setup.bat

@@ -44,11 +44,14 @@ call "%VENV_DIR%\Scripts\activate.bat"
 REM Upgrade pip
 python -m pip install --upgrade pip -q
 
-REM pyscard has precompiled wheels for Python 3.9-3.13.
-REM On Python 3.14 pip builds it from source (requires Microsoft C++ Build Tools).
-echo Note: pyscard ships precompiled wheels for Python 3.9-3.13.
-echo       Python 3.14 will build pyscard from source and require
-echo       Microsoft C++ Build Tools ("Desktop development with C++").
+REM Python 3.13 is strongly recommended: pyscard ships precompiled wheels up
+REM to 3.13, the SCP81 TLS-PSK listener needs 3.13+, and on 3.14 pyscard and
+REM some pysim dependency wheels are unavailable (source builds need MSVC).
+echo Note: Python 3.13 is strongly recommended.
+echo       pyscard has precompiled wheels up to 3.13 and the SCP81 TLS-PSK
+echo       listener needs 3.13+.  On Python 3.14 pyscard and some pysim
+echo       dependency wheels are unavailable; those build from source and
+echo       require Microsoft C++ Build Tools ("Desktop development with C++").
 echo.
 
 REM Install pysim dependencies first, then pysim itself (without the SMPP

setup.sh

@@ -52,6 +52,14 @@ else
     echo "  Fedora:        sudo dnf install pcsc-lite pcsc-lite-ccid pcsc-lite-devel"
 fi
 
+# The SCP81 TLS-PSK listener uses ssl's PSK callbacks, added in Python 3.13.
+PY_MINOR=$(echo "$PY_VER" | cut -d. -f2)
+if [ "${PY_VER%.*}" = "3" ] && [ "$PY_MINOR" -lt 13 ]; then
+    echo "Note: the SCP81 TLS-PSK listener needs Python 3.13+ (this is $PY_VER);"
+    echo "      the rest of the app works normally."
+    echo ""
+fi
+
 echo ""
 echo "=== Setup complete ==="
 echo "Run ./start.sh to start the server."

tests/test_scp81.py

@@ -5,6 +5,7 @@ terminal's Data available notification (TS 102 223 7.5.10).
 Synthetic PSK only; no live card data.
 """
 
+import inspect
 import socket
 import ssl
 import sys
@@ -80,6 +81,18 @@ class HttpParseTest(unittest.TestCase):
         self.assertTrue(body.startswith(b'64\r\n'))
 
 
+class PskGuardTest(unittest.TestCase):
+    """On Python < 3.13 the listener must explain the requirement, not raise
+    AttributeError (the PSK tests themselves are skipped there)."""
+
+    def test_the_context_names_the_python_requirement(self):
+        src = inspect.getsource(scp81.PskTlsServer._make_context)
+        self.assertIn("hasattr(ctx, 'set_psk_server_callback')", src)
+        self.assertIn('Python 3.13+', src)
+
+
+@unittest.skipUnless(hasattr(ssl.SSLContext, 'set_psk_server_callback'),
+                     'TLS-PSK requires Python 3.13+')
 class PskTlsServerTest(unittest.TestCase):
     def _client_ctx(self, identity=IDENT, psk=PSK):
         ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)