Remove Python2 from CI and code that branched on it (#5607)

* Remove Python2 from CI and code that branched on it

* Update setup.py

Co-authored-by: Hugo van Kemenade <[email protected]>

* remove

* review feedback

Co-authored-by: Hugo van Kemenade <[email protected]>

Author: alex

.github/workflows/ci.yml

@@ -16,12 +16,8 @@ jobs:
       matrix:
         PYTHON:
           - {VERSION: "3.9", TOXENV: "pep8,packaging,docs", COVERAGE: "false"}
-          - {VERSION: "pypy2", TOXENV: "pypy-nocoverage", COVERAGE: "false"}
           - {VERSION: "pypy3", TOXENV: "pypy3-nocoverage", COVERAGE: "false"}
-          - {VERSION: "2.7", TOXENV: "py27", OPENSSL: {TYPE: "openssl", VERSION: "1.1.0l"}}
-          - {VERSION: "2.7", TOXENV: "py27-ssh", OPENSSL: {TYPE: "openssl", VERSION: "1.1.0l"}}
           - {VERSION: "3.9", TOXENV: "py39", OPENSSL: {TYPE: "openssl", VERSION: "1.1.0l"}}
-          - {VERSION: "2.7", TOXENV: "py27", OPENSSL: {TYPE: "openssl", VERSION: "1.1.1h"}}
           - {VERSION: "3.9", TOXENV: "py39", OPENSSL: {TYPE: "openssl", VERSION: "1.1.1h"}}
           - {VERSION: "3.9", TOXENV: "py39-ssh", OPENSSL: {TYPE: "openssl", VERSION: "1.1.1h"}}
           - {VERSION: "3.9", TOXENV: "py39", OPENSSL: {TYPE: "openssl", VERSION: "1.1.1h", CONFIG_FLAGS: "no-engine no-rc2 no-srtp no-ct"}}
@@ -86,16 +82,13 @@ jobs:
     strategy:
       matrix:
         IMAGE:
-          - {IMAGE: "pyca/cryptography-runner-centos8", TOXENV: "py27"}
           - {IMAGE: "pyca/cryptography-runner-centos8", TOXENV: "py36"}
           - {IMAGE: "pyca/cryptography-runner-centos8-fips", TOXENV: "py36", FIPS: true}
-          - {IMAGE: "pyca/cryptography-runner-stretch", TOXENV: "py27"}
           - {IMAGE: "pyca/cryptography-runner-buster", TOXENV: "py37"}
           - {IMAGE: "pyca/cryptography-runner-bullseye", TOXENV: "py38"}
           - {IMAGE: "pyca/cryptography-runner-sid", TOXENV: "py39"}
           - {IMAGE: "pyca/cryptography-runner-ubuntu-bionic", TOXENV: "py36"}
           - {IMAGE: "pyca/cryptography-runner-ubuntu-focal", TOXENV: "py38"}
-          - {IMAGE: "pyca/cryptography-runner-ubuntu-rolling", TOXENV: "py27"}
           - {IMAGE: "pyca/cryptography-runner-ubuntu-rolling", TOXENV: "py38"}
           - {IMAGE: "pyca/cryptography-runner-ubuntu-rolling", TOXENV: "py38-randomorder"}
           - {IMAGE: "pyca/cryptography-runner-fedora", TOXENV: "py39"}
@@ -120,7 +113,6 @@ jobs:
     strategy:
       matrix:
         PYTHON:
-          - {VERSION: "2.7", TOXENV: "py27", EXTRA_CFLAGS: ""}
           - {VERSION: "3.6", TOXENV: "py36", EXTRA_CFLAGS: ""}
           - {VERSION: "3.9", TOXENV: "py39", EXTRA_CFLAGS: "-DUSE_OSRANDOM_RNG_FOR_TESTING"}
     name: "Python ${{ matrix.PYTHON.VERSION }} on macOS"
@@ -162,7 +154,6 @@ jobs:
           - {ARCH: 'x86', WINDOWS: 'win32'}
           - {ARCH: 'x64', WINDOWS: 'win64'}
         PYTHON:
-          - {VERSION: "2.7", TOXENV: "py27", MSVC_VERSION: "2010", CL_FLAGS: ""}
           - {VERSION: "3.6", TOXENV: "py36", MSVC_VERSION: "2019", CL_FLAGS: ""}
           - {VERSION: "3.7", TOXENV: "py37", MSVC_VERSION: "2019", CL_FLAGS: ""}
           - {VERSION: "3.8", TOXENV: "py38", MSVC_VERSION: "2019", CL_FLAGS: ""}
@@ -176,13 +167,6 @@ jobs:
           python-version: ${{ matrix.PYTHON.VERSION }}
           architecture: ${{ matrix.WINDOWS.ARCH }}
 
-      - name: Install MSVC for Python 2.7
-        run: |
-            Invoke-WebRequest -Uri https://download.microsoft.com/download/7/9/6/796EF2E4-801B-4FC4-AB28-B59FBF6D907B/VCForPython27.msi -OutFile VCForPython27.msi
-            Start-Process msiexec -Wait -ArgumentList @('/i', 'VCForPython27.msi', '/qn', 'ALLUSERS=1')
-            Remove-Item VCForPython27.msi -Force
-        shell: powershell
-        if: matrix.PYTHON.VERSION == '2.7'
       - run: python -m pip install tox requests coverage
       - name: Download OpenSSL
         run: |

.github/workflows/wheel-builder.yml

@@ -11,7 +11,7 @@ jobs:
     container: ${{ matrix.MANYLINUX.CONTAINER }}
     strategy:
       matrix:
-        PYTHON: ["cp27-cp27m", "cp27-cp27mu", "cp36-cp36m"]
+        PYTHON: ["cp36-cp36m"]
         MANYLINUX:
           - NAME: manylinux1_x86_64
             CONTAINER: "pyca/cryptography-manylinux1:x86_64"
@@ -57,12 +57,8 @@ jobs:
     strategy:
       matrix:
         PYTHON:
-          - VERSION: '2.7'
-            ABI_VERSION: '2.7'
-            DOWNLOAD_URL: 'https://www.python.org/ftp/python/2.7.17/python-2.7.17-macosx10.9.pkg'
-            BIN_PATH: '/Library/Frameworks/Python.framework/Versions/2.7/bin/python'
           - VERSION: '3.8'
-            ABI_VERSION: '3.6'
+            ABI_VERSION: 'cp36'
             DOWNLOAD_URL: 'https://www.python.org/ftp/python/3.8.2/python-3.8.2-macosx10.9.pkg'
             BIN_PATH: '/Library/Frameworks/Python.framework/Versions/3.8/bin/python3'
     name: "${{ matrix.PYTHON.VERSION }} ABI ${{ matrix.PYTHON.ABI_VERSION }} macOS"
@@ -85,16 +81,11 @@ jobs:
       - run: venv/bin/pip download cryptography==${{ github.event.inputs.version }} --no-deps --no-binary cryptography && tar zxvf cryptography*.tar.gz && mkdir wheelhouse
       - name: Build the wheel
         run: |
-          REGEX="3\.([0-9])*"
-          if [[ "${{ matrix.PYTHON.ABI_VERSION }}" =~ $REGEX ]]; then
-              PY_LIMITED_API="--py-limited-api=cp3${BASH_REMATCH[1]}"
-          fi
-
           cd cryptography*
           CRYPTOGRAPHY_SUPPRESS_LINK_FLAGS="1" \
               LDFLAGS="${HOME}/openssl-macos-x86-64/lib/libcrypto.a ${HOME}/openssl-macos-x86-64/lib/libssl.a" \
               CFLAGS="-I${HOME}/openssl-macos-x86-64/include -mmacosx-version-min=10.10 -march=core2" \
-              ../venv/bin/python setup.py bdist_wheel $PY_LIMITED_API && mv dist/cryptography*.whl ../wheelhouse
+              ../venv/bin/python setup.py bdist_wheel --py-limited-api=${{ matrix.PYTHON.ABI_VERSION }} && mv dist/cryptography*.whl ../wheelhouse
       - run: venv/bin/pip install -f wheelhouse --no-index cryptography
       - run: |
           venv/bin/python -c "from cryptography.hazmat.backends.openssl.backend import backend;print('Loaded: ' + backend.openssl_version_text());print('Linked Against: ' + backend._ffi.string(backend._lib.OPENSSL_VERSION_TEXT).decode('ascii'))"
@@ -114,8 +105,7 @@ jobs:
           - {ARCH: 'x86', WINDOWS: 'win32'}
           - {ARCH: 'x64', WINDOWS: 'win64'}
         PYTHON:
-          - {VERSION: "2.7", MSVC_VERSION: "2010"}
-          - {VERSION: "3.8", MSVC_VERSION: "2019", "USE_ABI3": "true", "ABI_VERSION": "cp36"}
+          - {VERSION: "3.8", MSVC_VERSION: "2019", "ABI_VERSION": "cp36"}
     name: "${{ matrix.PYTHON.VERSION }} ${{ matrix.WINDOWS.WINDOWS }} ${{ matrix.PYTHON.ABI_VERSION }}"
     steps:
       - uses: actions/checkout@v2
@@ -124,13 +114,6 @@ jobs:
         with:
           python-version: ${{ matrix.PYTHON.VERSION }}
           architecture: ${{ matrix.WINDOWS.ARCH }}
-      - name: Install MSVC for Python 2.7
-        run: |
-            Invoke-WebRequest -Uri https://download.microsoft.com/download/7/9/6/796EF2E4-801B-4FC4-AB28-B59FBF6D907B/VCForPython27.msi -OutFile VCForPython27.msi
-            Start-Process msiexec -Wait -ArgumentList @('/i', 'VCForPython27.msi', '/qn', 'ALLUSERS=1')
-            Remove-Item VCForPython27.msi -Force
-        shell: powershell
-        if: matrix.PYTHON.VERSION == '2.7'
       - run: pip install requests
       - name: Download OpenSSL
         run: |
@@ -144,10 +127,7 @@ jobs:
       - run: python -m pip install -U pip wheel cffi six ipaddress "enum34; python_version < '3'"
       - run: pip download cryptography==${{ github.event.inputs.version }} --no-deps --no-binary cryptography && tar zxvf cryptography*.tar.gz && mkdir wheelhouse
         shell: bash
-      - run: cd cryptography* && python setup.py bdist_wheel && mv dist/cryptography*.whl ../wheelhouse
-        if: matrix.PYTHON.USE_ABI3 != 'true'
       - run: cd cryptography* && python setup.py bdist_wheel --py-limited-api=${{ matrix.PYTHON.ABI_VERSION }} && mv dist/cryptography*.whl ../wheelhouse
-        if: matrix.PYTHON.USE_ABI3 == 'true'
       - run: pip install -f wheelhouse --no-index cryptography
       - name: Print the OpenSSL we built and linked against
         run: |

.zuul.d/jobs.yaml

@@ -25,13 +25,6 @@
     vars:
       tox_envlist: py36
 
-- job:
-    name: pyca-cryptography-centos-8-py27-arm64
-    parent: pyca-cryptography-base
-    nodeset: centos-8-arm64
-    vars:
-      tox_envlist: py27
-
 - job:
     name: pyca-cryptography-build-wheel
     abstract: true
@@ -57,12 +50,8 @@
         - platform: manylinux1_x86_64
           image: pyca/cryptography-manylinux1:x86_64
           pythons:
-            - cp27-cp27m
-            - cp27-cp27mu
             - cp36-cp36m
         - platform: manylinux2010_x86_64
           image: pyca/cryptography-manylinux2010:x86_64
           pythons:
-            - cp27-cp27m
-            - cp27-cp27mu
             - cp36-cp36m

.zuul.d/project.yaml

@@ -6,7 +6,6 @@
         - pyca-cryptography-ubuntu-focal-py38-arm64
         - pyca-cryptography-ubuntu-bionic-py36-arm64
         - pyca-cryptography-centos-8-py36-arm64
-        - pyca-cryptography-centos-8-py27-arm64
     release:
       jobs:
         - pyca-cryptography-build-wheel-arm64

CHANGELOG.rst

@@ -6,6 +6,8 @@ Changelog
 
 .. note:: This version is not yet released and is under active development.
 
+* **BACKWARDS INCOMPATIBLE:** Support for Python 2 has been removed.
+
 .. _v3-3:
 
 3.3 - 2020-12-08

README.rst

@@ -18,7 +18,7 @@ pyca/cryptography
 
 ``cryptography`` is a package which provides cryptographic recipes and
 primitives to Python developers.  Our goal is for it to be your "cryptographic
-standard library". It supports Python 2.7, Python 3.6+, and PyPy 5.4+.
+standard library". It supports Python 3.6+ and PyPy3 7.2+.
 
 ``cryptography`` includes both high level recipes and low level interfaces to
 common cryptographic algorithms such as symmetric ciphers, message digests, and

docs/development/getting-started.rst

@@ -79,7 +79,6 @@ each supported Python version and run the tests. For example:
 
     $ tox
     ...
-     py27: commands succeeded
     ERROR:   pypy: InterpreterNotFound: pypy
      py38: commands succeeded
      docs: commands succeeded

docs/installation.rst

@@ -10,10 +10,9 @@ You can install ``cryptography`` with ``pip``:
 Supported platforms
 -------------------
 
-Currently we test ``cryptography`` on Python 2.7, 3.6+,
-PyPy 7.3.1, and PyPy3 7.3.1 on these operating systems.
+Currently we test ``cryptography`` on Python 3.6+ and PyPy3 7.3.1 on these
+operating systems.
 
-* x86-64 CentOS 7.x
 * x86-64 & AArch64 CentOS 8.x
 * x86-64 Fedora (latest)
 * x86-64 macOS 10.15 Catalina
@@ -45,9 +44,9 @@ just run
 If you prefer to compile it yourself you'll need to have OpenSSL installed.
 You can compile OpenSSL yourself as well or use `a binary distribution`_.
 Be sure to download the proper version for your architecture and Python
-(VC2010 works for Python 2.7 while VC2015 is required for 3.6 and above).
-Wherever you place your copy of OpenSSL you'll need to set the ``LIB`` and ``INCLUDE``
-environment variables to include the proper locations. For example:
+(VC2015 is required for 3.6 and above). Wherever you place your copy of OpenSSL
+you'll need to set the ``LIB`` and ``INCLUDE`` environment variables to include
+the proper locations. For example:
 
 .. code-block:: console
 
@@ -87,8 +86,6 @@ available on your system.
 Alpine
 ~~~~~~
 
-Replace ``python3-dev`` with ``python-dev`` if you're using Python 2.
-
 .. code-block:: console
 
     $ sudo apk add gcc musl-dev python3-dev libffi-dev openssl-dev
@@ -98,8 +95,6 @@ If you get an error with ``openssl-dev`` you may have to use ``libressl-dev``.
 Debian/Ubuntu
 ~~~~~~~~~~~~~
 
-Replace ``python3-dev`` with ``python-dev`` if you're using Python 2.
-
 .. code-block:: console
 
     $ sudo apt-get install build-essential libssl-dev libffi-dev python3-dev

setup.py

@@ -63,9 +63,8 @@
             "Operating System :: POSIX :: Linux",
             "Operating System :: Microsoft :: Windows",
             "Programming Language :: Python",
-            "Programming Language :: Python :: 2",
-            "Programming Language :: Python :: 2.7",
             "Programming Language :: Python :: 3",
+            "Programming Language :: Python :: 3 :: Only",
             "Programming Language :: Python :: 3.6",
             "Programming Language :: Python :: 3.7",
             "Programming Language :: Python :: 3.8",
@@ -79,13 +78,10 @@
             where="src", exclude=["_cffi_src", "_cffi_src.*"]
         ),
         include_package_data=True,
-        python_requires=(
-            ">=2.7,!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*,!=3.5.*"
-        ),
+        python_requires=">=3.6",
         install_requires=["six >= 1.4.1"] + setup_requirements,
         setup_requires=setup_requirements,
         extras_require={
-            ":python_version < '3'": ["enum34", "ipaddress"],
             "test": [
                 "pytest>=3.6.0,!=3.9.0,!=3.9.1,!=3.9.2",
                 "pretend",

src/cryptography/__init__.py

@@ -4,9 +4,6 @@
 
 from __future__ import absolute_import, division, print_function
 
-import sys
-import warnings
-
 from cryptography.__about__ import (
     __author__,
     __copyright__,
@@ -17,7 +14,6 @@
     __uri__,
     __version__,
 )
-from cryptography.utils import CryptographyDeprecationWarning
 
 
 __all__ = [
@@ -30,12 +26,3 @@
     "__license__",
     "__copyright__",
 ]
-
-if sys.version_info[0] == 2:
-    warnings.warn(
-        "Python 2 is no longer supported by the Python core team. Support for "
-        "it is now deprecated in cryptography, and will be removed in the "
-        "next release.",
-        CryptographyDeprecationWarning,
-        stacklevel=2,
-    )

src/cryptography/hazmat/backends/openssl/backend.py

@@ -10,7 +10,6 @@
 import warnings
 from contextlib import contextmanager
 
-import six
 from six.moves import range
 
 from cryptography import utils, x509
@@ -521,24 +520,15 @@ def _consume_errors_with_text(self):
     def _bn_to_int(self, bn):
         assert bn != self._ffi.NULL
 
-        if not six.PY2:
-            # Python 3 has constant time from_bytes, so use that.
-            bn_num_bytes = self._lib.BN_num_bytes(bn)
-            bin_ptr = self._ffi.new("unsigned char[]", bn_num_bytes)
-            bin_len = self._lib.BN_bn2bin(bn, bin_ptr)
-            # A zero length means the BN has value 0
-            self.openssl_assert(bin_len >= 0)
-            val = int.from_bytes(self._ffi.buffer(bin_ptr)[:bin_len], "big")
-            if self._lib.BN_is_negative(bn):
-                val = -val
-            return val
-        else:
-            # Under Python 2 the best we can do is hex()
-            hex_cdata = self._lib.BN_bn2hex(bn)
-            self.openssl_assert(hex_cdata != self._ffi.NULL)
-            hex_str = self._ffi.string(hex_cdata)
-            self._lib.OPENSSL_free(hex_cdata)
-            return int(hex_str, 16)
+        bn_num_bytes = self._lib.BN_num_bytes(bn)
+        bin_ptr = self._ffi.new("unsigned char[]", bn_num_bytes)
+        bin_len = self._lib.BN_bn2bin(bn, bin_ptr)
+        # A zero length means the BN has value 0
+        self.openssl_assert(bin_len >= 0)
+        val = int.from_bytes(self._ffi.buffer(bin_ptr)[:bin_len], "big")
+        if self._lib.BN_is_negative(bn):
+            val = -val
+        return val
 
     def _int_to_bn(self, num, bn=None):
         """
@@ -552,24 +542,10 @@ def _int_to_bn(self, num, bn=None):
         if bn is None:
             bn = self._ffi.NULL
 
-        if not six.PY2:
-            # Python 3 has constant time to_bytes, so use that.
-
-            binary = num.to_bytes(int(num.bit_length() / 8.0 + 1), "big")
-            bn_ptr = self._lib.BN_bin2bn(binary, len(binary), bn)
-            self.openssl_assert(bn_ptr != self._ffi.NULL)
-            return bn_ptr
-
-        else:
-            # Under Python 2 the best we can do is hex(), [2:] removes the 0x
-            # prefix.
-            hex_num = hex(num).rstrip("L")[2:].encode("ascii")
-            bn_ptr = self._ffi.new("BIGNUM **")
-            bn_ptr[0] = bn
-            res = self._lib.BN_hex2bn(bn_ptr, hex_num)
-            self.openssl_assert(res != 0)
-            self.openssl_assert(bn_ptr[0] != self._ffi.NULL)
-            return bn_ptr[0]
+        binary = num.to_bytes(int(num.bit_length() / 8.0 + 1), "big")
+        bn_ptr = self._lib.BN_bin2bn(binary, len(binary), bn)
+        self.openssl_assert(bn_ptr != self._ffi.NULL)
+        return bn_ptr
 
     def generate_rsa_private_key(self, public_exponent, key_size):
         rsa._verify_rsa_parameters(public_exponent, key_size)

src/cryptography/hazmat/primitives/asymmetric/rsa.py

@@ -5,12 +5,7 @@
 from __future__ import absolute_import, division, print_function
 
 import abc
-
-try:
-    # Only available in math in 3.5+
-    from math import gcd
-except ImportError:
-    from fractions import gcd
+from math import gcd
 
 import six