Switch to maturin.

It seems to be much faster at doing things locally.

.github/requirements/build-requirements.in

@@ -2,7 +2,7 @@
 setuptools>=61.0.0
 wheel
 cffi>=1.12; platform_python_implementation != 'PyPy'
-setuptools-rust>=1.7.0
+maturin>=1,<2
 
 # WARN: changing the requirements here DOES NOT update the dependencies used for building at the github workflow, as the build process used build-requirements.txt
 # To update build-requirements.txt according to the dependencies here, run pip-compile --allow-unsafe --generate-hashes build-requirements.in

.github/requirements/build-requirements.txt

@@ -58,22 +58,29 @@ cffi==1.16.0 ; platform_python_implementation != "PyPy" \
  --hash=sha256:fa3a0128b152627161ce47201262d3140edb5a5c3da88d73a1b790a959126956 \
  --hash=sha256:fcc8eb6d5902bb1cf6dc4f187ee3ea80a1eba0a89aba40a5cb20a5087d961357
  # via -r build-requirements.in
+maturin==1.2.0 \
+ --hash=sha256:02a3ec65872b294d012824d9af5a445ea614140f6fc55c16f07af04622450de3 \
+ --hash=sha256:03207fcb64d3a340f353de57186e3614478430ad09887e68438739b724096782 \
+ --hash=sha256:0d8bfa63522a454ff862c6680575255e28fa0f634d206fb5af84c73f5f5fabf0 \
+ --hash=sha256:138526c3275eeebb1bd566c20aae6a76f39cf55991f127c81dd79da725f45d59 \
+ --hash=sha256:2fb701d44c68849e4cf41d92f6aeefcc166edecccc3b0c0a430a003190dc5b2e \
+ --hash=sha256:45f90cac503bacfa6c20e112836b2f53a3355b7b913471f5a104f2c4b09c5b9c \
+ --hash=sha256:840803f176c12a56bd023a13dc0e6fef63bc0480665ee9eeda9ed527a6ccb8dc \
+ --hash=sha256:955d9d46cf00a8887954d5e37ab3f28dc75d46caeddb4e8e43366e39c803a3b9 \
+ --hash=sha256:adbf64b6ec763fc9ece32bfa0979335f79333106aabf34415ae7c72ed8b432af \
+ --hash=sha256:bf5986127e7dd3f6e5403dc737f260e1c425c5b7b017a492abe85f38955c6beb \
+ --hash=sha256:c013cf9aa0156ac25df06fa7c06edd1d115723c8c270cb25e0060bc0d25c72d5 \
+ --hash=sha256:c0946b9badd053c92962770aad9133d6fc9cdbc98eb8c707e808f0c5c9005651 \
+ --hash=sha256:cc60957012cfd3f662cd313ca0cdaac64f5f5cd6ddbbbc2a1ddab341ccc28e4d
+ # via -r build-requirements.in
 pycparser==2.21 \
  --hash=sha256:8ee45429555515e1f6b185e78100aea234072576aa43ab53aefcae078162fca9 \
  --hash=sha256:e644fdec12f7872f86c58ff790da456218b10f863970249516d60a5eaca77206
  # via cffi
-semantic-version==2.10.0 \
- --hash=sha256:bdabb6d336998cbb378d4b9db3a4b56a1e3235701dc05ea2690d9a997ed5041c \
- --hash=sha256:de78a3b8e0feda74cabc54aab2da702113e33ac9d9eb9d2389bcf1f58b7d9177
- # via setuptools-rust
-setuptools-rust==1.9.0 \
- --hash=sha256:409caf49dcf7ad9bd510b4bf4011fbad504e745fae98f57fe1c06f3a97719638 \
- --hash=sha256:704df0948f2e4cc60c2596ad6e840ea679f4f43e58ed4ad0c1857807240eab96
- # via -r build-requirements.in
 tomli==2.0.1 \
  --hash=sha256:939de3e7a6161af0c887ef91b7d41a53e7c5a1ca976325f429cb46ea9bc30ecc \
  --hash=sha256:de526c12914f0c550d15924c62d72abc48d6fe7364aa87328337a31007fe8a4f
- # via setuptools-rust
+ # via maturin
 wheel==0.42.0 \
  --hash=sha256:177f9c9b0d45c47873b619f5b650346d632cdc35fb5e4d25058e09c9e581433d \
  --hash=sha256:c45be39f7882c9d34243236f2d63cbd58039e360f85d0913425fbd7ceea617a8
@@ -85,4 +92,3 @@ setuptools==69.1.1 \
  --hash=sha256:5c0806c7d9af348e6dd3777b4f4dbb42c7ad85b190104837488eab9a7c945cf8
  # via
  # -r build-requirements.in
- # setuptools-rust

.github/workflows/ci.yml

@@ -48,10 +48,9 @@ jobs:
  - {VERSION: "3.12", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "11adf9a75d6b34723d1a20a0da4e4100ea6ca593"}}
  # Builds with various Rust versions. Includes MSRV and next
  # potential future MSRV:
- # 1.64 - maturin, workspace inheritance
  # 1.65 - Generic associated types (GATs), std::backtrace
- - {VERSION: "3.12", NOXSESSION: "rust-noclippy,tests", RUST: "1.63.0"}
  - {VERSION: "3.12", NOXSESSION: "rust,tests", RUST: "1.64.0"}
+ - {VERSION: "3.12", NOXSESSION: "rust,tests", RUST: "1.65.0"}
  - {VERSION: "3.12", NOXSESSION: "rust,tests", RUST: "beta"}
  - {VERSION: "3.12", NOXSESSION: "rust,tests", RUST: "nightly"}
  timeout-minutes: 15

.github/workflows/wheel-builder.yml

@@ -57,8 +57,8 @@ jobs:
  fail-fast: false
  matrix:
  PYTHON:
- - { VERSION: "cp311-cp311", ABI_VERSION: 'cp37' }
- - { VERSION: "cp311-cp311", ABI_VERSION: 'cp39' }
+ - { VERSION: "cp311-cp311", ABI_VERSION: 'py37' }
+ - { VERSION: "cp311-cp311", ABI_VERSION: 'py39' }
  - { VERSION: "pp39-pypy39_pp73" }
  - { VERSION: "pp310-pypy310_pp73" }
  MANYLINUX:
@@ -131,8 +131,10 @@ jobs:
  - name: Build the wheel
  run: |
  if [ -n "${{ matrix.PYTHON.ABI_VERSION }}" ]; then
- PY_LIMITED_API="--config-settings=--build-option=--py-limited-api=${{ matrix.PYTHON.ABI_VERSION }} --no-build-isolation"
+ PY_LIMITED_API="--config-settings=build-args=--features=pyo3/abi3-${{ matrix.PYTHON.ABI_VERSION }} --no-build-isolation"
  fi
+
+ source .venv/bin/activate
  OPENSSL_DIR="/opt/pyca/cryptography/openssl" \
  OPENSSL_STATIC=1 \
  .venv/bin/python -m pip wheel -v $PY_LIMITED_API cryptograph*.tar.gz -w dist/ && mv dist/cryptography*.whl tmpwheelhouse
@@ -166,7 +168,7 @@ jobs:
  matrix:
  PYTHON:
  - VERSION: '3.11'
- ABI_VERSION: 'cp37'
+ ABI_VERSION: 'py37'
  # Despite the name, this is built for the macOS 11 SDK on arm64 and 10.9+ on intel
  DOWNLOAD_URL: 'https://www.python.org/ftp/python/3.11.3/python-3.11.3-macos11.pkg'
  BIN_PATH: '/Library/Frameworks/Python.framework/Versions/3.11/bin/python3'
@@ -178,7 +180,7 @@ jobs:
  # build against
  _PYTHON_HOST_PLATFORM: 'macosx-10.9-universal2'
  - VERSION: '3.11'
- ABI_VERSION: 'cp39'
+ ABI_VERSION: 'py39'
  # Despite the name, this is built for the macOS 11 SDK on arm64 and 10.9+ on intel
  DOWNLOAD_URL: 'https://www.python.org/ftp/python/3.11.3/python-3.11.3-macos11.pkg'
  BIN_PATH: '/Library/Frameworks/Python.framework/Versions/3.11/bin/python3'
@@ -190,7 +192,7 @@ jobs:
  # build against
  _PYTHON_HOST_PLATFORM: 'macosx-10.9-universal2'
  - VERSION: '3.11'
- ABI_VERSION: 'cp37'
+ ABI_VERSION: 'py37'
  DOWNLOAD_URL: 'https://www.python.org/ftp/python/3.11.3/python-3.11.3-macos11.pkg'
  BIN_PATH: '/Library/Frameworks/Python.framework/Versions/3.11/bin/python3'
  DEPLOYMENT_TARGET: '10.12'
@@ -257,9 +259,10 @@ jobs:
  - name: Build the wheel
  run: |
  if [ -n "${{ matrix.PYTHON.ABI_VERSION }}" ]; then
- PY_LIMITED_API="--config-settings=--build-option=--py-limited-api=${{ matrix.PYTHON.ABI_VERSION }} --no-build-isolation"
+ PY_LIMITED_API="--config-settings=build-args=--features=pyo3/abi3-${{ matrix.PYTHON.ABI_VERSION }} --no-build-isolation"
  fi
 
+ source venv/bin/activate
  OPENSSL_DIR="$(readlink -f ../openssl-macos-universal2/)" \
  OPENSSL_STATIC=1 \
  venv/bin/python -m pip wheel -v $PY_LIMITED_API cryptograph*.tar.gz -w dist/ && mv dist/cryptography*.whl wheelhouse
@@ -293,8 +296,8 @@ jobs:
  - {ARCH: 'x86', WINDOWS: 'win32', RUST_TRIPLE: 'i686-pc-windows-msvc'}
  - {ARCH: 'x64', WINDOWS: 'win64', RUST_TRIPLE: 'x86_64-pc-windows-msvc'}
  PYTHON:
- - {VERSION: "3.11", "ABI_VERSION": "cp37"}
- - {VERSION: "3.11", "ABI_VERSION": "cp39"}
+ - {VERSION: "3.11", "ABI_VERSION": "py37"}
+ - {VERSION: "3.11", "ABI_VERSION": "py39"}
  - {VERSION: "pypy-3.9"}
  - {VERSION: "pypy-3.10"}
  exclude:
@@ -348,7 +351,7 @@ jobs:
  - run: mkdir wheelhouse
  - run: |
  if [ -n "${{ matrix.PYTHON.ABI_VERSION }}" ]; then
- PY_LIMITED_API="--config-settings=--build-option=--py-limited-api=${{ matrix.PYTHON.ABI_VERSION }} --no-build-isolation"
+ PY_LIMITED_API="--config-settings=build-args=--features=pyo3/abi3-${{ matrix.PYTHON.ABI_VERSION }} --no-build-isolation"
  fi
 
  python -m pip wheel -v cryptography*.tar.gz $PY_LIMITED_API -w dist/ && mv dist/cryptography*.whl wheelhouse/

CHANGELOG.rst

@@ -14,6 +14,7 @@ Changelog
 * :func:`~cryptography.hazmat.primitives.asymmetric.rsa.generate_private_key`
  now enforces a minimum RSA key size of 1024-bit. Note that 1024-bit is still
  considered insecure, users should generally use a key size of 2048-bits.
+* Updated the minimum supported Rust version (MSRV) to 1.64.0, from 1.63.0.
 * Added new :doc:`/hazmat/decrepit/index` module which contains outdated and
  insecure cryptographic primitives.
  :class:`~cryptography.hazmat.primitives.ciphers.algorithms.CAST5`,

docs/installation.rst

@@ -134,7 +134,7 @@ Fedora/RHEL/CentOS
 .. warning::
 
  For RHEL and CentOS you must be on version 8.8 or newer for the command
- below to install a sufficiently new Rust. If your Rust is less than 1.63.0
+ below to install a sufficiently new Rust. If your Rust is less than 1.64.0
  please see the :ref:`Rust installation instructions <installation:Rust>`
  for information about installing a newer Rust.
 
@@ -312,7 +312,7 @@ Rust
  a Rust toolchain.
 
 Building ``cryptography`` requires having a working Rust toolchain. The current
-minimum supported Rust version is 1.63.0. **This is newer than the Rust some
+minimum supported Rust version is 1.64.0. **This is newer than the Rust some
 package managers ship**, so users may need to install with the
 instructions below.
 

pyproject.toml

@@ -1,14 +1,15 @@
 [build-system]
 # These requirements must be kept sync with the requirements on ./github/requirements/build-requirements files
 requires = [
- # First version of setuptools to support pyproject.toml configuration
- "setuptools>=61.0.0",
- "wheel",
+ "maturin>=1,<2",
+
  # Must be kept in sync with `project.dependencies`
  "cffi>=1.12; platform_python_implementation != 'PyPy'",
- "setuptools-rust>=1.7.0",
+ # Needed because cffi imports distutils, and in Python 3.12, distutils has
+ # been removed from the stdlib, but installing setuptools puts it back.
+ "setuptools",
 ]
-build-backend = "setuptools.build_meta"
+build-backend = "maturin"
 
 [project]
 name = "cryptography"
@@ -56,14 +57,6 @@ source = "https://github.com/pyca/cryptography/"
 issues = "https://github.com/pyca/cryptography/issues"
 changelog = "https://cryptography.io/en/latest/changelog/"
 
-[tool.setuptools]
-zip-safe = false
-package-dir = {"" = "src"}
-
-[tool.setuptools.packages.find]
-where = ["src"]
-include = ["cryptography*"]
-
 [project.optional-dependencies]
 ssh = ["bcrypt >=3.1.5"]
 
@@ -85,12 +78,42 @@ sdist = ["build"]
 # `click` included because its needed to type check `release.py`
 pep8test = ["ruff", "mypy", "check-sdist", "click"]
 
-[[tool.setuptools-rust.ext-modules]]
-target = "cryptography.hazmat.bindings._rust"
-path = "src/rust/Cargo.toml"
-py-limited-api = "auto"
-rust-version = ">=1.63.0"
-
+[tool.maturin]
+python-source = "src"
+python-packages = ["cryptography"]
+manifest-path = "src/rust/Cargo.toml"
+module-name = "cryptography.hazmat.bindings._rust"
+locked = true
+sdist-generator = "git"
+features = ["pyo3/abi3-py37"]
+include = [
+ "CHANGELOG.rst",
+ "CONTRIBUTING.rst",
+ "LICENSE",
+ "LICENSE.APACHE",
+ "LICENSE.BSD",
+
+ "docs/**/*",
+
+ "src/_cffi_src/**/*.py",
+ "src/_cffi_src/**/*.c",
+ "src/_cffi_src/**/*.h",
+
+ "src/rust/**/Cargo.toml",
+ "src/rust/**/Cargo.lock",
+ "src/rust/**/*.rs",
+
+ "tests/**/*.py",
+]
+exclude = [
+ "vectors/**/*",
+ "src/rust/target/**/*",
+ "docs/_build/**/*",
+ ".github/**/*",
+ ".readthedocs.yml",
+ "ci-constraints-requirements.txt",
+ "mypy.ini",
+]
 
 [tool.pytest.ini_options]
 addopts = "-r s --capture=no --strict-markers --benchmark-disable"

src/rust/Cargo.toml

@@ -5,7 +5,7 @@ authors = ["The cryptography developers <[email protected]>"]
 edition = "2021"
 publish = false
 # This specifies the MSRV
-rust-version = "1.63.0"
+rust-version = "1.64.0"
 
 [dependencies]
 once_cell = "1"

src/rust/cryptography-cffi/Cargo.toml

@@ -5,7 +5,7 @@ authors = ["The cryptography developers <[email protected]>"]
 edition = "2021"
 publish = false
 # This specifies the MSRV
-rust-version = "1.63.0"
+rust-version = "1.64.0"
 
 [dependencies]
 pyo3 = { version = "0.20", features = ["abi3"] }

src/rust/cryptography-key-parsing/Cargo.toml

@@ -5,7 +5,7 @@ authors = ["The cryptography developers <[email protected]>"]
 edition = "2021"
 publish = false
 # This specifies the MSRV
-rust-version = "1.63.0"
+rust-version = "1.64.0"
 
 [dependencies]
 asn1 = { version = "0.16.0", default-features = false }

src/rust/cryptography-openssl/Cargo.toml

@@ -5,7 +5,7 @@ authors = ["The cryptography developers <[email protected]>"]
 edition = "2021"
 publish = false
 # This specifies the MSRV
-rust-version = "1.63.0"
+rust-version = "1.64.0"
 
 [dependencies]
 cfg-if = "1"

src/rust/cryptography-x509-verification/Cargo.toml

@@ -5,7 +5,7 @@ authors = ["The cryptography developers <[email protected]>"]
 edition = "2021"
 publish = false
 # This specifies the MSRV
-rust-version = "1.63.0"
+rust-version = "1.64.0"
 
 [dependencies]
 asn1 = { version = "0.16.0", default-features = false }

src/rust/cryptography-x509/Cargo.toml

@@ -5,7 +5,7 @@ authors = ["The cryptography developers <[email protected]>"]
 edition = "2021"
 publish = false
 # This specifies the MSRV
-rust-version = "1.63.0"
+rust-version = "1.64.0"
 
 [dependencies]
 asn1 = { version = "0.16.0", default-features = false }