From a76fcbcc446c8c880634156c2210c1404a7dd412 Mon Sep 17 00:00:00 2001 From: AlexanderKomarov Date: Thu, 10 Sep 2026 11:20:26 +0200 Subject: [PATCH 1/3] fix(deps): make cryptography an optional test dependency --- .github/workflows/build.yml | 10 ++++++---- pyproject.toml | 8 +++++++- requirements.txt | 4 ++-- 3 files changed, 15 insertions(+), 7 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index e970c93a..c4a4877a 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -272,7 +272,8 @@ jobs: - name: Install wheel for testing run: | source venv/bin/activate - pip install dist/c2pa_python-*.whl + # `[test]` extra pulls cryptography for the callback-signer tests. + pip install "$(ls dist/c2pa_python-*.whl)[test]" - name: Run unittest tests on installed wheel run: | @@ -372,8 +373,8 @@ jobs: .\venv\Scripts\activate $wheel = Get-ChildItem -Path dist -Filter "c2pa_python-*.whl" | Select-Object -First 1 if (-not $wheel) { Write-Error "No wheel file found in dist directory"; exit 1 } - pip install $wheel.FullName - pip install -r requirements.txt + # `[test]` extra pulls cryptography for the callback-signer tests. + pip install "$($wheel.FullName)[test]" pip install pytest - name: Run tests with pytest (venv) @@ -453,7 +454,8 @@ jobs: - name: Install wheel for testing run: | source venv/bin/activate - pip install dist/c2pa_python-*.whl + # `[test]` extra pulls cryptography for the callback-signer tests. + pip install "$(ls dist/c2pa_python-*.whl)[test]" - name: Run unittest tests on installed wheel run: | diff --git a/pyproject.toml b/pyproject.toml index 7620ff9e..5e2a3714 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -23,10 +23,16 @@ maintainers = [ urls = {homepage = "https://contentauthenticity.org", repository = "https://github.com/contentauth/c2pa-python"} dependencies = [ "toml>=0.10.2", - "cryptography>=41.0.0", "requests>=2.0.0" ] +# `cryptography` is only used by the tests/examples (callback signers), not by +# the runtime bindings, so it is a test-only extra rather than an install dep. +[project.optional-dependencies] +test = [ + "cryptography>=41.0.0" +] + [project.scripts] download-artifacts = "c2pa.build:download_artifacts" diff --git a/requirements.txt b/requirements.txt index 481efa9f..4cc52382 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,2 +1,2 @@ -# only used in the training example -cryptography>=47.0.0 +# Runtime has no pure-Python pip dependencies (crypto lives in the native lib). +# `cryptography` is a test-only extra: see pyproject.toml / requirements-dev.txt. From 8ebf607c12657ddc910a2df360046f77efa6d2fd Mon Sep 17 00:00:00 2001 From: AlexanderKomarov Date: Tue, 15 Sep 2026 10:50:10 +0200 Subject: [PATCH 2/3] Fix review comments. --- .github/workflows/build.yml | 12 ++++++------ pyproject.toml | 7 ------- requirements.txt | 3 +-- 3 files changed, 7 insertions(+), 15 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index c4a4877a..97987acb 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -272,8 +272,8 @@ jobs: - name: Install wheel for testing run: | source venv/bin/activate - # `[test]` extra pulls cryptography for the callback-signer tests. - pip install "$(ls dist/c2pa_python-*.whl)[test]" + pip install "$(ls dist/c2pa_python-*.whl)" + pip install -r requirements-dev.txt - name: Run unittest tests on installed wheel run: | @@ -373,8 +373,8 @@ jobs: .\venv\Scripts\activate $wheel = Get-ChildItem -Path dist -Filter "c2pa_python-*.whl" | Select-Object -First 1 if (-not $wheel) { Write-Error "No wheel file found in dist directory"; exit 1 } - # `[test]` extra pulls cryptography for the callback-signer tests. - pip install "$($wheel.FullName)[test]" + pip install "$($wheel.FullName)" + pip install -r requirements-dev.txt pip install pytest - name: Run tests with pytest (venv) @@ -454,8 +454,8 @@ jobs: - name: Install wheel for testing run: | source venv/bin/activate - # `[test]` extra pulls cryptography for the callback-signer tests. - pip install "$(ls dist/c2pa_python-*.whl)[test]" + pip install "$(ls dist/c2pa_python-*.whl)" + pip install -r requirements-dev.txt - name: Run unittest tests on installed wheel run: | diff --git a/pyproject.toml b/pyproject.toml index 5e2a3714..5357d61e 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -26,13 +26,6 @@ dependencies = [ "requests>=2.0.0" ] -# `cryptography` is only used by the tests/examples (callback signers), not by -# the runtime bindings, so it is a test-only extra rather than an install dep. -[project.optional-dependencies] -test = [ - "cryptography>=41.0.0" -] - [project.scripts] download-artifacts = "c2pa.build:download_artifacts" diff --git a/requirements.txt b/requirements.txt index 4cc52382..e4082826 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,2 +1 @@ -# Runtime has no pure-Python pip dependencies (crypto lives in the native lib). -# `cryptography` is a test-only extra: see pyproject.toml / requirements-dev.txt. +# cryptography moved to requirements-dev.txt (used by tests/examples only). From b07f769b7dadd575d55085c3afde9d65669d1193 Mon Sep 17 00:00:00 2001 From: AlexanderKomarov Date: Tue, 15 Sep 2026 10:58:41 +0200 Subject: [PATCH 3/3] ci: simplify wheel install in build.yml --- .github/workflows/build.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 97987acb..ac702cfa 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -272,7 +272,7 @@ jobs: - name: Install wheel for testing run: | source venv/bin/activate - pip install "$(ls dist/c2pa_python-*.whl)" + pip install dist/c2pa_python-*.whl pip install -r requirements-dev.txt - name: Run unittest tests on installed wheel @@ -373,7 +373,7 @@ jobs: .\venv\Scripts\activate $wheel = Get-ChildItem -Path dist -Filter "c2pa_python-*.whl" | Select-Object -First 1 if (-not $wheel) { Write-Error "No wheel file found in dist directory"; exit 1 } - pip install "$($wheel.FullName)" + pip install $wheel.FullName pip install -r requirements-dev.txt pip install pytest @@ -454,7 +454,7 @@ jobs: - name: Install wheel for testing run: | source venv/bin/activate - pip install "$(ls dist/c2pa_python-*.whl)" + pip install dist/c2pa_python-*.whl pip install -r requirements-dev.txt - name: Run unittest tests on installed wheel