Merge branch 'master' into staging
[jackhill/guix/guix.git] / gnu / packages / python-crypto.scm
index 00e704a..d331601 100644 (file)
@@ -2,7 +2,7 @@
 ;;; Copyright © 2015 Eric Dvorsak <eric@dvorsak.fr>
 ;;; Copyright © 2015, 2016, 2017, 2018, 2019, 2020, 2021 Efraim Flashner <efraim@flashner.co.il>
 ;;; Copyright © 2015, 2016, 2017, 2019 Leo Famulari <leo@famulari.name>
-;;; Copyright © 2016, 2017, 2020 Marius Bakke <mbakke@fastmail.com>
+;;; Copyright © 2016, 2017, 2020, 2022 Marius Bakke <marius@gnu.org>
 ;;; Copyright © 2017 Ben Sturmfels <ben@sturm.com.au>
 ;;; Copyright © 2016 Sou Bunnbu <iyzsong@gmail.com>
 ;;; Copyright © 2015 Cyril Roelandt <tipecaml@gmail.com>
@@ -23,8 +23,9 @@
 ;;; Copyright © 2019 Clément Lassieur <clement@lassieur.org>
 ;;; Copyright © 2020 Alexandros Theodotou <alex@zrythm.org>
 ;;; Copyright © 2020 Justus Winter <justus@sequoia-pgp.org>
-;;; Copyright © 2020 Vinicius Monego <monego@posteo.net>
+;;; Copyright © 2020, 2021 Vinicius Monego <monego@posteo.net>
 ;;; Copyright © 2021 Maxim Cournoyer <maxim.cournoyer@gmail.com>
+;;; Copyright © 2021 Maxime Devos <maximedevos@telenet.be>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
 (define-module (gnu packages python-crypto)
   #:use-module (guix packages)
   #:use-module (guix download)
+  #:use-module (guix gexp)
   #:use-module (guix git-download)
+  #:use-module (guix build-system cargo)
   #:use-module (guix build-system python)
   #:use-module (gnu packages)
   #:use-module (gnu packages check)
+  #:use-module (gnu packages crates-io)
   #:use-module (gnu packages crypto)
   #:use-module (gnu packages kerberos)
   #:use-module (gnu packages libffi)
@@ -60,6 +64,7 @@
   #:use-module (gnu packages python-compression)
   #:use-module (gnu packages python-web)
   #:use-module (gnu packages python-xyz)
+  #:use-module (gnu packages rust)
   #:use-module (gnu packages swig)
   #:use-module (gnu packages time)
   #:use-module (gnu packages tls)
@@ -84,7 +89,7 @@
         (base32 "1hzw6h01fm216nmipyylgz0zybd80w1xsk12m7djycnhqrnrvvv1"))))
     (build-system python-build-system)
     (propagated-inputs
-     `(("python-pycrypto" ,python-pycrypto)))
+     (list python-pycrypto))
     (synopsis "Python OTR Implementation")
     (description "Python OTR is an Off-The-Record Protocol Implementation in
 Python.  It does not bind to libotr.")
@@ -94,17 +99,22 @@ Python.  It does not bind to libotr.")
 (define-public python-base58
   (package
     (name "python-base58")
-    (version "2.0.1")
+    (version "2.1.1")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "base58" version))
        (sha256
         (base32
-         "0yfaqp76kbdb62hikr5n4jkkfjfmii89grwfy6sw3fmsv5hrap1n"))))
+         "1317ly0db7nnjg5k58f6nqa0svfcvn446xd5bpiyi0bfbczwpl65"))))
     (build-system python-build-system)
+    (arguments
+     '(#:phases (modify-phases %standard-phases
+                  (replace 'check
+                    (lambda* (#:key tests? #:allow-other-keys)
+                      (when tests? (invoke "pytest" "-vv")))))))
     (native-inputs
-     `(("python-pyhamcrest" ,python-pyhamcrest)))
+     (list python-pyhamcrest python-pytest python-pytest-benchmark))
     (home-page "https://github.com/keis/base58")
     (synopsis "Base58 and Base58Check implementation")
     (description "Base58 and Base58Check implementation compatible
@@ -123,11 +133,9 @@ with what is used by the Bitcoin network.")
         (base32 "0agvzdn7r7jx5y4scl5gjmrmr6njvizwmr9n7h1kmaahdrrc34sv"))))
     (build-system python-build-system)
     (native-inputs
-     `(("python-pycparser" ,python-pycparser)
-       ("python-pytest" ,python-pytest)))
+     (list python-pycparser python-pytest))
     (propagated-inputs
-     `(("python-cffi" ,python-cffi)
-       ("python-six" ,python-six)))
+     (list python-cffi python-six))
     (home-page "https://github.com/pyca/bcrypt/")
     (synopsis
      "Modern password hashing library")
@@ -150,15 +158,15 @@ Password Scheme\"} by Niels Provos and David Mazieres.")
         (base32 "015y5qaw9qnxr29lg60dml1g5rbqd4586wy5n8m41ib55gvm1zfy"))))
     (build-system python-build-system)
     (native-inputs
-     `(("python-nose" ,python-nose)))
+     (list python-nose))
     (propagated-inputs
-     `(("python-py-bcrypt" ,python-py-bcrypt)))
+     (list python-bcrypt))
     (arguments
      `(#:phases
        (modify-phases %standard-phases
          (add-before 'check 'set-PYTHON_EGG_CACHE
            ;; Some tests require access to "$HOME/.cython".
-           (lambda _ (setenv "PYTHON_EGG_CACHE" "/tmp") #t)))))
+           (lambda _ (setenv "PYTHON_EGG_CACHE" "/tmp"))))))
     (home-page "https://bitbucket.org/ecollins/passlib")
     (synopsis "Comprehensive password hashing framework")
     (description
@@ -169,41 +177,6 @@ useful for a wide range of tasks, from verifying a hash found in /etc/shadow,
 to providing full-strength password hashing for multi-user application.")
     (license license:bsd-3)))
 
-(define-public python2-passlib
-  (package-with-python2 python-passlib))
-
-(define-public python-py-bcrypt
-  (package
-    (name "python-py-bcrypt")
-    (version "0.4")
-    (source
-     (origin
-       (method url-fetch)
-       (uri (pypi-uri "py-bcrypt" version))
-       (sha256
-        (base32
-         "0y6smdggwi5s72v6p1nn53dg6w05hna3d264cq6kas0lap73p8az"))))
-    (build-system python-build-system)
-    (home-page "https://code.google.com/p/py-bcrypt")
-    (synopsis
-     "Bcrypt password hashing and key derivation")
-    (description
-     "A python wrapper of OpenBSD's Blowfish password hashing code.  This
-system hashes passwords using a version of Bruce Schneier's Blowfish block
-cipher with modifications designed to raise the cost of off-line password
-cracking and frustrate fast hardware implementation.  The computation cost of
-the algorithm is parametrised, so it can be increased as computers get faster.
-The intent is to make a compromise of a password database less likely to
-result in an attacker gaining knowledge of the plaintext passwords (e.g. using
-John the Ripper).")
-    ;; "sha2.c" is under BSD-3;
-    ;; "blowfish.c" and "bcrypt.c" are under BSD-4;
-    ;; the rest is under ISC.
-    (license (list license:isc license:bsd-3 license:bsd-4))))
-
-(define-public python2-py-bcrypt
-  (package-with-python2 python-py-bcrypt))
-
 (define-public python-pyblake2
   (package
     (name "python-pyblake2")
@@ -245,10 +218,7 @@ This package provides a Python interface for BLAKE2.")
      `(;; FIXME: Tests require many unpackaged libraries, see dev-requirements.txt.
        #:tests? #f))
     (propagated-inputs
-     `(("python-bcrypt" ,python-bcrypt)
-       ("python-pyasn1" ,python-pyasn1)
-       ("python-pynacl" ,python-pynacl)
-       ("python-cryptography" ,python-cryptography)))
+     (list python-bcrypt python-pyasn1 python-pynacl python-cryptography))
     (home-page "https://www.paramiko.org/")
     (synopsis "SSHv2 protocol library")
     (description "Paramiko is a python implementation of the SSHv2 protocol,
@@ -260,24 +230,27 @@ Python interface around SSH networking concepts.")
 (define-public python-ecdsa
   (package
     (name "python-ecdsa")
-    (version "0.14.1")
+    (version "0.17.0")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "ecdsa" version))
        (sha256
-        (base32 "13nx5cbfxc0gnax5zwdmp9xc40qd1llk62mv85jyrvqkbw017ik4"))))
+        (base32 "1ak8xa2r660d85abrlffp0bqvwdadg9ga4066g856hcy8fxh1xdr"))))
     (build-system python-build-system)
     (arguments
      '(#:phases
        (modify-phases %standard-phases
          (replace 'check
-           (lambda _ (invoke "pytest"))))))
+           (lambda _ (invoke
+                      "pytest"
+                      "-vv"
+                      "-k"
+                      "not test_multithreading_with_interrupts"))))))
     (propagated-inputs
-     `(("python-six" ,python-six)))
+     (list python-six))
     (native-inputs
-     `(("openssl" ,openssl)
-       ("python-pytest" ,python-pytest)))
+     (list openssl python-pytest))
     (home-page "https://github.com/warner/python-ecdsa")
     (synopsis "ECDSA cryptographic signature library (pure python)")
     (description
@@ -311,8 +284,7 @@ making them easy to handle and incorporate into other protocols.")
         "0g0ayql5b9mkjam8hym6zyg6bv77lbh66rv1fyvgqb17kfc1xkpj"))))
     (build-system python-build-system)
     (inputs
-     `(("python" ,python)
-       ("gmp" ,gmp)))
+     (list python gmp))
     (arguments
      `(#:phases
        (modify-phases %standard-phases
@@ -349,7 +321,7 @@ etc.).  The package is structured to make adding new modules easy.")
          "19663qxmma0i8bfbjc2iwy5hgq0g4pfb75r023v5dps68zfvffgh"))))
     (build-system python-build-system)
     (inputs
-     `(("mit-krb5" ,mit-krb5)))
+     (list mit-krb5))
     (home-page "https://github.com/apple/ccs-pykerberos")
     (synopsis
      "Python Kerberos library used by CalendarServer")
@@ -382,15 +354,15 @@ do what is needed for client/server Kerberos authentication based on
                (invoke "pytest"))
              #t)))))
     (native-inputs
-     `(("python-toml" ,python-toml)
-       ("python-pytest" ,python-pytest)
-       ("python-pytest-checkdocs" ,python-pytest-checkdocs)
-       ("python-pytest-cov" ,python-pytest-cov)
-       ("python-pytest-flake8" ,python-pytest-flake8)
-       ("python-setuptools" ,python-setuptools)
-       ("python-setuptools-scm" ,python-setuptools-scm)))
+     (list python-toml
+           python-pytest
+           python-pytest-checkdocs
+           python-pytest-cov
+           python-pytest-flake8
+           python-setuptools
+           python-setuptools-scm))
     (propagated-inputs
-     `(("python-secretstorage" ,python-secretstorage)))
+     (list python-secretstorage))
     (home-page "https://github.com/jaraco/keyring")
     (synopsis "Store and access your passwords safely")
     (description
@@ -418,11 +390,9 @@ password storage.")
       (arguments
        `(#:python ,python-2))
       (native-inputs
-       `(("python2-pytest" ,python2-pytest)
-         ("python2-pytest-runner" ,python2-pytest-runner)
-         ("python2-setuptools-scm" ,python2-setuptools-scm)))
+       (list python2-pytest python2-pytest-runner python2-setuptools-scm))
       (propagated-inputs
-       `(("python2-pycrypto" ,python2-pycrypto))))))
+       (list python2-pycrypto)))))
 
 (define-public python-keyrings.alt
   (package
@@ -451,9 +421,7 @@ password storage.")
             #t))))
     (build-system python-build-system)
     (native-inputs
-     `(("python-keyring" ,python-keyring)
-       ("python-pytest" ,python-pytest)
-       ("python-setuptools-scm" ,python-setuptools-scm)))
+     (list python-keyring python-pytest python-setuptools-scm))
     (home-page "https://github.com/jaraco/keyrings.alt")
     (synopsis "Alternate keyring implementations")
     (description "Keyrings in this package may have security risks or other
@@ -476,10 +444,9 @@ risk.")
          "1yxqfb5131wahjyw9pxz03bq476rcfx62s6k53xx4cqbzzgdaqkq"))))
     (build-system python-build-system)
     (propagated-inputs
-     `(("python-pyopenssl" ,python-pyopenssl)
-       ("python-tldextract" ,python-tldextract)))
+     (list python-pyopenssl python-tldextract))
     (native-inputs
-     `(("python-pytest-cov" ,python-pytest-cov)))
+     (list python-pytest-cov))
     (home-page "https://github.com/ikreymer/certauth")
     (synopsis "Certificate authority creation tool")
     (description "This package provides a small library, built on top of
@@ -492,13 +459,13 @@ for example, for recording or replaying web content.")
 (define-public python-certifi
   (package
     (name "python-certifi")
-    (version "2020.12.5")
+    (version "2021.10.8")
     (source (origin
               (method url-fetch)
               (uri (pypi-uri "certifi" version))
               (sha256
                (base32
-                "177mdbw0livdjvp17sz6wsfrc32838m9y59v871gpgv2888raj8s"))))
+                "0wl8ln7acd797i1q7mmb430l6hqwhmk4bd37x8ycw02b3my4x23q"))))
     (build-system python-build-system)
     (arguments '(#:tests? #f))          ;no tests
     (home-page "https://certifi.io/")
@@ -514,14 +481,14 @@ is used by the Requests library to verify HTTPS requests.")
 (define-public python-cryptography-vectors
   (package
     (name "python-cryptography-vectors")
-    (version "3.3.1")
+    (version "36.0.1")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "cryptography_vectors" version))
        (sha256
         (base32
-         "192wix3sr678x21brav5hgc6j93l7ab1kh69p2scr3fsblq9qy03"))))
+         "166mvhhmgglqai1sjkkb76mpdkad2yykam11d2w44hs2snpr117w"))))
     (build-system python-build-system)
     (home-page "https://github.com/pyca/cryptography")
     (synopsis "Test vectors for the cryptography package")
@@ -530,35 +497,115 @@ is used by the Requests library to verify HTTPS requests.")
     ;; Distributed under either BSD-3 or ASL2.0
     (license (list license:bsd-3 license:asl2.0))))
 
-(define-public python2-cryptography-vectors
-  (package-with-python2 python-cryptography-vectors))
-
 (define-public python-cryptography
   (package
     (name "python-cryptography")
-    (version "3.3.1")
+    (version "36.0.1")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "cryptography" version))
        (sha256
         (base32
-         "1ribd1vxq9wwz564mg60dzcy699gng54admihjjkgs9dx95pw5vy"))))
+         "0f1n8bvngarhsssm60xc59xfzkh7yqpyyyypaph3v5bs7pfc3rak"))))
     (build-system python-build-system)
+    (arguments
+     (list
+      #:imported-modules (append %cargo-build-system-modules
+                                 %python-build-system-modules)
+      #:modules `(((guix build cargo-build-system) #:prefix cargo:)
+                  ,@%python-build-system-modules
+                  (srfi srfi-1)
+                  (ice-9 match))
+      #:phases
+      #~(modify-phases (@ (guix build python-build-system) %standard-phases)
+          (add-after 'unpack 'loosen-ouroboros-version
+            (lambda _
+              (substitute* "src/rust/Cargo.toml"
+                (("ouroboros = \"0\\.13\"")
+                 "ouroboros = \"0.14\""))))
+          (add-before 'build 'configure-cargo
+            (lambda* (#:key inputs #:allow-other-keys)
+              ;; Hide irrelevant inputs from cargo-build-system so it does
+              ;; not try to unpack sanity-check.py, etc.
+              (let ((cargo-inputs (filter (match-lambda
+                                            ((name . path)
+                                             (or (string-prefix? "rust-" name)
+                                                 (string=? "gcc" name))))
+                                          inputs)))
+                (with-directory-excursion "src/rust"
+                  ((assoc-ref cargo:%standard-phases 'unpack-rust-crates)
+                   #:inputs cargo-inputs
+                   #:vendor-dir "guix-vendor")
+                  ((assoc-ref cargo:%standard-phases 'configure)
+                   #:inputs cargo-inputs)
+                  ((assoc-ref cargo:%standard-phases 'patch-cargo-checksums)
+                   #:vendor-dir "guix-vendor"))
+                (rename-file "src/rust/.cargo" ".cargo"))))
+          (replace 'check
+            (lambda* (#:key tests? #:allow-other-keys)
+              (when tests?
+                (invoke "pytest" "-vv" "tests")))))))
     (inputs
-     `(("openssl" ,openssl)))
+     (list openssl
+           rust-aliasable-0.1
+           rust-asn1-0.8
+           rust-asn1-derive-0.8
+           rust-autocfg-1
+           rust-base64-0.13
+           rust-bitflags-1
+           rust-cfg-if-0.1
+           rust-cfg-if-1
+           rust-chrono-0.4
+           rust-cloudabi-0.1
+           rust-lazy-static-1
+           rust-libc-0.2
+           rust-indoc-0.3
+           rust-indoc-impl-0.3
+           rust-inflector-0.11
+           rust-instant-0.1
+           rust-lock-api-0.4
+           rust-num-integer-0.1
+           rust-num-traits-0.2
+           rust-once-cell-1
+           rust-ouroboros-0.14
+           rust-ouroboros-macro-0.14
+           rust-parking-lot-0.11
+           rust-parking-lot-core-0.8
+           rust-paste-0.1
+           rust-paste-impl-0.1
+           rust-pem-1
+           rust-proc-macro-error-1
+           rust-proc-macro-error-attr-1
+           rust-proc-macro-hack-0.5
+           rust-proc-macro2-1
+           rust-pyo3-0.15
+           rust-pyo3-build-config-0.15
+           rust-pyo3-macros-0.15
+           rust-pyo3-macros-backend-0.15
+           rust-quote-1
+           rust-redox-syscall-0.1
+           rust-scopeguard-1
+           rust-smallvec-1
+           rust-stable-deref-trait-1
+           rust-syn-1
+           rust-unicode-xid-0.2
+           rust-unindent-0.1
+           rust-version-check-0.9
+           rust-winapi-0.3))
     (propagated-inputs
-     `(("python-asn1crypto" ,python-asn1crypto)
-       ("python-cffi" ,python-cffi)
-       ("python-six" ,python-six)
-       ("python-idna" ,python-idna)
-       ("python-iso8601" ,python-iso8601)))
+     (list python-asn1crypto python-cffi python-six python-idna
+           python-iso8601))
     (native-inputs
-     `(("python-cryptography-vectors" ,python-cryptography-vectors)
-       ("python-hypothesis" ,python-hypothesis)
-       ("python-pretend" ,python-pretend)
-       ("python-pytz" ,python-pytz)
-       ("python-pytest" ,python-pytest)))
+     (list python-cryptography-vectors
+           python-hypothesis
+           python-pretend
+           python-pytz
+           python-pytest
+           python-pytest-subtests
+           python-setuptools-rust
+           rust
+           `(,rust "cargo")))
     (home-page "https://github.com/pyca/cryptography")
     (synopsis "Cryptographic recipes and primitives for Python")
     (description
@@ -571,70 +618,109 @@ message digests and key derivation functions.")
     (license (list license:bsd-3 license:asl2.0))
     (properties `((python2-variant . ,(delay python2-cryptography))))))
 
+(define-public python2-cryptography-vectors
+  (package
+    (inherit python-cryptography-vectors)
+    (version "3.3.1")
+    (source (origin
+              (method url-fetch)
+              (uri (pypi-uri "cryptography_vectors" version))
+              (sha256
+               (base32
+                "192wix3sr678x21brav5hgc6j93l7ab1kh69p2scr3fsblq9qy03"))))
+    (arguments
+     (list #:python python-2))))
+
 (define-public python2-cryptography
   (let ((crypto (package-with-python2
                  (strip-python2-variant python-cryptography))))
-    (package/inherit crypto
+    (package
+      (inherit crypto)
+      (version "3.3.1")
+      (source (origin
+                (method url-fetch)
+                (uri (pypi-uri "cryptography" version))
+                (sha256
+                 (base32
+                  "1ribd1vxq9wwz564mg60dzcy699gng54admihjjkgs9dx95pw5vy"))))
+      (arguments
+       `(#:python ,python-2
+         #:phases
+         (modify-phases %standard-phases
+           ;; The sanity-check attempts attempts to import the non-existent
+           ;; modules "_openssl" and "_padding".
+           (delete 'sanity-check))))
+      (native-inputs
+       (list python2-cryptography-vectors python2-hypothesis python2-pretend
+             python2-pytz python2-pytest))
+      (inputs (list openssl))
       (propagated-inputs
-       `(("python2-ipaddress" ,python2-ipaddress)
-         ("python2-backport-ssl-match-hostname"
-          ,python2-backport-ssl-match-hostname)
-         ("python2-enum34" ,python2-enum34)
-         ,@(package-propagated-inputs crypto))))))
+       (modify-inputs (package-propagated-inputs crypto)
+         (prepend python2-ipaddress
+                  python2-backport-ssl-match-hostname
+                  python2-enum34))))))
 
 (define-public python-pyopenssl
   (package
     (name "python-pyopenssl")
-    (version "20.0.1")
+    (version "22.0.0")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "pyOpenSSL" version))
        (sha256
         (base32
-         "0labcbh2g0jhgisd79wx9kixmi6fip28096d1xb05fj3jmsiq8sc"))))
+         "1gzihw09sqi71lwx97c69hab7w4rbnl6hhfrl6za3i5a4la1n2v6"))))
     (build-system python-build-system)
     (arguments
-     '(#:phases
-       (modify-phases %standard-phases
-         (delete 'check)
-         (add-after 'install 'check
-           (lambda* (#:key inputs outputs #:allow-other-keys)
-             (add-installed-pythonpath inputs outputs)
-             ;; PyOpenSSL runs tests against a certificate with a fixed
-             ;; expiry time.  To ensure successful builds in the future,
-             ;; set the time to roughly the release date.
-             (invoke "faketime" "2021-05-01" "py.test" "-v" "-k"
-                     (string-append
-                      ;; This test tries to look up certificates from
-                      ;; the compiled-in default path in OpenSSL, which
-                      ;; does not exist in the build environment.
-                      "not test_fallback_default_verify_paths "
-                      ;; This test attempts to make a connection to
-                      ;; an external web service.
-                      "and not test_set_default_verify_paths "
-                      ;; Fails on i686-linux and possibly other 32-bit platforms
-                      ;; https://github.com/pyca/pyopenssl/issues/974
-                      "and not test_verify_with_time")))))))
+     (list
+      #:phases
+      #~(modify-phases %standard-phases
+          (replace 'check
+            (lambda* (#:key tests? #:allow-other-keys)
+              (when tests?
+                ;; PyOpenSSL runs tests against a certificate with a fixed
+                ;; expiry time.  To ensure successful builds in the future,
+                ;; set the time to roughly the release date.
+                (invoke "faketime" "2022-02-01" "py.test" "-v" "-k"
+                        (string-append
+                         ;; This test tries to look up certificates from
+                         ;; the compiled-in default path in OpenSSL, which
+                         ;; does not exist in the build environment.
+                         "not test_fallback_default_verify_paths "
+                         ;; This test attempts to make a connection to
+                         ;; an external web service.
+                         "and not test_set_default_verify_paths "
+                         ;; Fails on i686-linux and possibly other 32-bit platforms
+                         ;; https://github.com/pyca/pyopenssl/issues/974
+                         "and not test_verify_with_time"))))))))
     (propagated-inputs
-     `(("python-cryptography" ,python-cryptography)
-       ("python-six" ,python-six)))
+     (list python-cryptography python-six))
     (inputs
-     `(("openssl" ,openssl)))
+     (list openssl))
     (native-inputs
-     `(("libfaketime" ,libfaketime)
-       ("python-flaky" ,python-flaky)
-       ("python-pretend" ,python-pretend)
-       ("python-pytest" ,python-pytest)))
+     (list libfaketime python-flaky python-pretend python-pytest))
     (home-page "https://github.com/pyca/pyopenssl")
     (synopsis "Python wrapper module around the OpenSSL library")
     (description
       "PyOpenSSL is a high-level wrapper around a subset of the OpenSSL
 library.")
+    (properties `((python2-variant . ,(delay python2-pyopenssl))))
     (license license:asl2.0)))
 
 (define-public python2-pyopenssl
-  (package-with-python2 python-pyopenssl))
+  (let ((base (package-with-python2 (strip-python2-variant python-pyopenssl))))
+    (package
+      (inherit base)
+      (version "21.0.0")
+      (source
+       (origin
+         (method url-fetch)
+         (uri (pypi-uri "pyOpenSSL" version))
+         (patches (search-patches "python2-pyopenssl-openssl-compat.patch"))
+         (sha256
+          (base32
+           "1cqcc20fwl521z3fxsc1c98gbnhb14q55vrvjfp6bn6h8rg8qbay")))))))
 
 (define-public python-ed25519
   (package
@@ -702,9 +788,7 @@ python-axolotl.")
                        '("axolotl/tests" "build/lib/axolotl/tests"))
              #t)))))
     (propagated-inputs
-     `(("python-axolotl-curve25519" ,python-axolotl-curve25519)
-       ("python-cryptography" ,python-cryptography)
-       ("python-protobuf" ,python-protobuf)))
+     (list python-axolotl-curve25519 python-cryptography python-protobuf))
     (home-page "https://github.com/tgalal/python-axolotl")
     (synopsis "Python port of libaxolotl-android")
     (description "This is a python port of libaxolotl-android.  This
@@ -819,12 +903,9 @@ PKCS#8, PKCS#12, PKCS#5, X.509 and TSP.")
            (lambda _
              (invoke "pytest" "-vv"))))))
     (native-inputs
-     `(("python-hypothesis" ,python-hypothesis)
-       ("python-pytest" ,python-pytest)))
+     (list python-hypothesis python-pytest))
     (propagated-inputs
-     `(("python-cffi" ,python-cffi)
-       ("python-six" ,python-six)
-       ("libsodium" ,libsodium)))
+     (list python-cffi python-six libsodium))
     (home-page "https://github.com/pyca/pynacl/")
     (synopsis "Python bindings to libsodium")
     (description
@@ -857,9 +938,7 @@ of improving usability, security and speed.")
              (delete-file "setup.cfg")
              (invoke "pytest"))))))
     (native-inputs
-     `(("python-numpy" ,python-numpy)
-       ("python-pillow" ,python-pillow)
-       ("python-pytest" ,python-pytest)))
+     (list python-numpy python-pillow python-pytest))
     (home-page "https://github.com/halcy/blurhash-python")
     (synopsis
      "Pure-Python implementation of the blurhash algorithm")
@@ -880,7 +959,7 @@ of improving usability, security and speed.")
             "1gc3i5s93zq6x1nkaxkq1dvmsc12vmrw0hns9f5s1hcb78ni52c8"))))
     (build-system python-build-system)
     (propagated-inputs
-     `(("python-future" ,python-future)))
+     (list python-future))
     (home-page "https://github.com/ubinity/ECPy")
     (synopsis "Pure Python Elliptic Curve Library")
     (description "This package provides a Elliptic Curve Library in pure
@@ -905,9 +984,7 @@ Python.")
      ;; The tests require flake8 >= 3.5, which is not yet packaged.
      '(#:tests? #f))
     (propagated-inputs
-     `(("python-cryptography" ,python-cryptography)
-       ("python-pyopenssl" ,python-pyopenssl)
-       ("python-six" ,python-six)))
+     (list python-cryptography python-pyopenssl python-six))
 ;; TODO Enable when we have flake8 >= 3.5.
 ;    (native-inputs
 ;     `(("python-coverage" ,python-coverage)
@@ -927,18 +1004,38 @@ protocol (Javascript Object Signing and Encryption).")
 (define-public python2-josepy
   (package-with-python2 python-josepy))
 
+(define pycryptodome-unbundle-tomcrypt-snippet
+  #~(begin
+      ;; Unbundle libtomcrypt.
+      (delete-file-recursively "src/libtom")
+      (substitute* "src/DES.c"
+        (("#include \"libtom/tomcrypt_des.c\"")
+         "#include <tomcrypt.h>"))
+      (substitute* "setup.py"
+        (("include_dirs=\\['src/', 'src/libtom/'\\]")
+         ;; FIXME: why does '-ltomcrypt' need to be added
+         ;; manually, even when 'tomcrypt' is added to 'libraries'?
+         ;; This behaviour is not documented at
+         ;; <https://docs.python.org/3/extending/building.html>.
+         "include_dirs=['src/'], libraries=['tomcrypt', 'tommath'],
+ extra_link_args=['-ltomcrypt', '-ltommath']"))))
+
 (define-public python-pycryptodome
   (package
     (name "python-pycryptodome")
-    (version "3.9.9")
+    (version "3.11.0")
     (source
      (origin
        (method url-fetch)
        (uri (pypi-uri "pycryptodome" version))
        (sha256
         (base32
-         "1i4m74f88qj9ci8rpyzrbk2slmsdj5ipmwdkq6qk24byalm203li"))))
+         "1l3a80z3lxcj1q0hzj1d3plavy2d51y4vzcd85zj0zm7yyxrd022"))
+       (modules '((guix build utils)))
+       (snippet pycryptodome-unbundle-tomcrypt-snippet)))
     (build-system python-build-system)
+    (inputs
+     (list libtomcrypt libtommath))
     (home-page "https://www.pycryptodome.org")
     (synopsis "Low-level cryptographic Python library")
     (description
@@ -991,7 +1088,9 @@ PyCryptodome variants, the other being python-pycryptodomex.")
        (method url-fetch)
        (uri (pypi-uri "pycryptodomex" version))
        (sha256
-        (base32 "0lbx4qk3xmwqiidhmkj8qa7bh2lf8bwzg0xjpsh2w5zqjrc7qnvv"))))
+        (base32 "0vcd65ylri2a4pdqcc1897jasj7wfmqklj8x3pdynmdvark3d603"))
+       (modules '((guix build utils)))
+       (snippet pycryptodome-unbundle-tomcrypt-snippet)))
     (description
      "PyCryptodome is a self-contained Python package of low-level
 cryptographic primitives.  It's not a wrapper to a separate C library like
@@ -1043,8 +1142,8 @@ provides drop-in compatibility with PyCrypto.")))
      `(;; FIXME: Tests start failing with time due to date checks in TLS
        ;; certificates.
        #:tests? #f))
-    (inputs `(("openssl" ,openssl)))
-    (native-inputs `(("swig" ,swig)))
+    (inputs (list openssl))
+    (native-inputs (list swig))
     (home-page "https://gitlab.com/m2crypto/m2crypto")
     (synopsis "Python crypto and TLS toolkit")
     (description "@code{M2Crypto} is a complete Python wrapper for OpenSSL
@@ -1096,12 +1195,12 @@ through the Engine interface.")
                (("==") ">="))
              #t)))))
     (propagated-inputs
-     `(("python-argon2-cffi" ,python-argon2-cffi)
-       ("python-construct" ,python-construct)
-       ("python-dateutil" ,python-dateutil)
-       ("python-future" ,python-future)
-       ("python-lxml" ,python-lxml)
-       ("python-pycryptodomex" ,python-pycryptodomex)))
+     (list python-argon2-cffi
+           python-construct
+           python-dateutil
+           python-future
+           python-lxml
+           python-pycryptodomex))
     (home-page "https://github.com/libkeepass/pykeepass")
     (synopsis "Python library to interact with keepass databases")
     (description
@@ -1141,7 +1240,7 @@ supports KDBX3 and KDBX4.")
     ;; requires "hashlib.scrypt", provided by Python 3.6+ built with OpenSSL
     ;; 1.1+.  Use that as soon as Guix provides it.
     (inputs
-     `(("libscrypt" ,libscrypt)))
+     (list libscrypt))
     (home-page "https://github.com/jvarho/pylibscrypt")
     (synopsis "Scrypt for Python")
     (description "There are a lot of different scrypt modules for Python, but
@@ -1170,9 +1269,9 @@ none of them have everything that I'd like, so here's one more.  It uses
                (("/usr/local/lib/libsodium.so")
                 (search-input-file inputs "/lib/libsodium.so"))))))))
     (native-inputs
-     `(("python-pyhamcrest" ,python-pyhamcrest)))
+     (list python-pyhamcrest))
     (inputs
-     `(("libsodium" ,libsodium)))
+     (list libsodium))
     (home-page "https://libnacl.readthedocs.org/")
     (synopsis "Python bindings for libsodium based on ctypes")
     (description "@code{libnacl} is used to gain direct access to the
@@ -1214,7 +1313,7 @@ require users to log in.")
          "0hjk71k3mgnl8siikm9lii9im8kv0rb7inkjzx78rnancra48xxr"))))
     (build-system python-build-system)
     (inputs
-     `(("openssl" ,openssl)))
+     (list openssl))
     (home-page "https://bitbucket.org/mhallin/py-scrypt")
     (synopsis "Bindings for the scrypt key derivation function library")
     (description "This is a set of Python bindings for the scrypt key
@@ -1234,10 +1333,8 @@ derivation function.")
          "0b9f5qiqjy8ralzgwjgkhx82h6h8sa7532psmb8mkd65md5aan08"))))
     (build-system python-build-system)
     (propagated-inputs
-     `(("python-attrs" ,python-attrs)
-       ("python-pyasn1" ,python-pyasn1)
-       ("python-pyasn1-modules" ,python-pyasn1-modules)
-       ("python-pyopenssl" ,python-pyopenssl)))
+     (list python-attrs python-pyasn1 python-pyasn1-modules
+           python-pyopenssl))
     (home-page "https://service-identity.readthedocs.io/")
     (synopsis "Service identity verification for PyOpenSSL")
     (description
@@ -1264,7 +1361,7 @@ relevant RFCs too.")
           "1jhxk5vhxmxxjp3zj526ry521v9inzzl8jqaaf0ma65w6k332ak2"))))
     (build-system python-build-system)
     (native-inputs
-     `(("python-nose" ,python-nose)))
+     (list python-nose))
     (home-page "https://github.com/casebeer/python-hkdf")
     (synopsis "HMAC-based Extract-and-Expand Key Derivation Function (HKDF)")
     (description "This package provides a Python implementation of the HMAC Key
@@ -1284,7 +1381,7 @@ Derivation function (HKDF) defined in RFC 5869.")
           "1x16r7lrbklvfzbacb66qv9iiih6liq1y612dqh2chgf555n2yn1"))))
     (build-system python-build-system)
     (propagated-inputs
-     `(("python-hkdf" ,python-hkdf)))
+     (list python-hkdf))
     (home-page "https://github.com/warner/python-spake2")
     (synopsis "SPAKE2 password-authenticated key exchange in Python")
     (description "This package provides a Python implementation of the SPAKE2
@@ -1308,12 +1405,12 @@ Password-Authenticated Key Exchange algorithm.")
       ;; <https://github.com/meejah/txtorcon/issues/330>
      `(#:tests? #f))
     (propagated-inputs
-     `(("python-automat" ,python-automat)
-       ("python-idna" ,python-idna)
-       ("python-incremental" ,python-incremental)
-       ("python-service-identity" ,python-service-identity)
-       ("python-twisted" ,python-twisted)
-       ("python-zope-interface" ,python-zope-interface)))
+     (list python-automat
+           python-idna
+           python-incremental
+           python-service-identity
+           python-twisted
+           python-zope-interface))
     (home-page "https://github.com/meejah/txtorcon")
     (synopsis "Twisted-based Tor controller client")
     (description "This package provides a Twisted-based Tor controller client,
@@ -1333,10 +1430,9 @@ with state-tracking and configuration abstractions.")
          "0lipygpzhwzzsq2k5imb1jgkmj8y4khxdwhzadjs3bd56g6bmkx9"))))
     (build-system python-build-system)
     (native-inputs
-     `(("python-pytest" ,python-pytest)
-       ("python-pytest-runner" ,python-pytest-runner)))
+     (list python-pytest python-pytest-runner))
     (inputs
-     `(("keyutils" ,keyutils)))
+     (list keyutils))
     (arguments
      '(#:tests? #f))
     (home-page "https://github.com/sassoftware/python-keyutils")
@@ -1375,9 +1471,7 @@ storing and retrieving sensitive information in your programs.")
              (chdir "scripts")
              #t)))))
     (propagated-inputs
-     `(("python-click" ,python-click)
-       ("python-intelhex" ,python-intelhex)
-       ("python-cryptography" ,python-cryptography)))
+     (list python-click python-intelhex python-cryptography))
     (home-page "https://mcuboot.com")
     (synopsis "Tool to securely sign firmware images for booting by MCUboot")
     (description "MCUboot is a secure bootloader for 32-bit MCUs.  This
@@ -1398,7 +1492,7 @@ MCUboot.")
          "16mavidki4ma5ip8srqalr19gz4f5yn3cnmmgps1fmgfr24j63rm"))))
     (build-system python-build-system)
     (propagated-inputs
-     `(("python-cryptography" ,python-cryptography)))
+     (list python-cryptography))
     (home-page "https://github.com/jborean93/ntlm-auth")
     (synopsis
      "Calculates NTLM Authentication codes")
@@ -1429,8 +1523,7 @@ and Backlog for a list of what is and is not currently supported.")
     (arguments
      '(#:tests? #f)) ; Tests require a running dbus service.
     (propagated-inputs
-     `(("python-cryptography" ,python-cryptography)
-       ("python-jeepney" ,python-jeepney)))
+     (list python-cryptography python-jeepney))
     (home-page "https://github.com/mitya57/secretstorage")
     (synopsis "Python bindings to FreeDesktop.org Secret Service API")
     (description
@@ -1461,14 +1554,14 @@ items and collections, editing items, locking and unlocking collections
              (add-installed-pythonpath inputs outputs)
              (invoke "pytest" "-vv"))))))
     (native-inputs
-     `(("python-more-itertools" ,python-more-itertools)
-       ("python-pyopenssl" ,python-pyopenssl)
-       ("python-pytest" ,python-pytest)
-       ("python-pytest-cov" ,python-pytest-cov)
-       ("python-service-identity" ,python-service-identity)
-       ("python-zipp" ,python-zipp)))
+     (list python-more-itertools
+           python-pyopenssl
+           python-pytest
+           python-pytest-cov
+           python-service-identity
+           python-zipp))
     (propagated-inputs
-     `(("python-cryptography" ,python-cryptography)))
+     (list python-cryptography))
     (home-page "https://github.com/python-trio/trustme")
     (synopsis "Fake a certificate authority for tests")
     (description
@@ -1491,9 +1584,9 @@ use in your tests.")
           "0n980gqpzh0fm58h3i4mi2i10wgj606lscm1r5sk60vbf6vh8mv9"))))
     (build-system python-build-system)
     (propagated-inputs
-     `(("python-pyopenssl" ,python-pyopenssl)))
+     (list python-pyopenssl))
     (native-inputs
-     `(("python-pytest" ,python-pytest)))
+     (list python-pytest))
     (home-page "https://github.com/LLNL/certipy")
     (synopsis "Utility to create and sign CAs and certificates")
     (description
@@ -1514,11 +1607,8 @@ certificates, signing and building trust bundles.")
          (base32 "0mw6ch5s4czpmsiwqwhcidgk27858pl8vlvb7acrxjkm4ribcnbx"))))
     (build-system python-build-system)
     (native-inputs
-     `(("python-testpath" ,python-testpath)
-       ("python-tornado" ,python-tornado)
-       ("python-trio" ,python-trio)
-       ("python-pytest" ,python-pytest)
-       ("python-pytest-trio" ,python-pytest-trio)))
+     (list python-testpath python-tornado python-trio python-pytest
+           python-pytest-trio))
     (home-page "https://gitlab.com/takluyver/jeepney")
     (synopsis "Low-level, pure Python DBus protocol wrapper")
     (description
@@ -1555,12 +1645,10 @@ I/O-free core, and integration modules for different event loops.")
              ;; see tox.ini
              (invoke "python" "-m" "argon2" "-n" "1" "-t" "1" "-m" "8" "-p" "1"))))))
     (propagated-inputs
-     `(("python-cffi" ,python-cffi)
-       ("python-six" ,python-six)))
-    (inputs `(("argon2" ,argon2)))
+     (list python-cffi python-six))
+    (inputs (list argon2))
     (native-inputs
-     `(("python-hypothesis" ,python-hypothesis)
-       ("python-pytest" ,python-pytest)))
+     (list python-hypothesis python-pytest))
     (home-page "https://argon2-cffi.readthedocs.io/")
     (synopsis "Secure Password Hashes for Python")
     (description
@@ -1592,10 +1680,9 @@ can decide how long it takes to hash a password and how much memory is required.
            (lambda _
              (invoke "python" "-m" "pytest"))))))
     (native-inputs
-     `(("python-pytest" ,python-pytest)))
+     (list python-pytest))
     (propagated-inputs
-     `(("python-argon2-cffi" ,python-argon2-cffi)
-       ("python-cryptography" ,python-cryptography)))
+     (list python-argon2-cffi python-cryptography))
     (home-page "https://www.dropbox.com/developers")
     (synopsis "Library to password-protect your data")
     (description
@@ -1623,12 +1710,10 @@ signatures.")
              (when tests?
                (invoke "pytest")))))))
     (native-inputs
-     `(("python-cryptography" ,python-cryptography)
-       ("python-pyasn1" ,python-pyasn1)
-       ("python-pytest" ,python-pytest)
-       ("python-singledispatch" ,python-singledispatch)
-       ("python-six" ,python-six)
-       ("python-wheel" ,python-wheel)))
+     (list python-pytest
+           python-wheel))
+    (propagated-inputs (list python-cryptography python-pyasn1
+                             python-singledispatch python-six))
     (home-page "https://github.com/SecurityInnovation/PGPy")
     (synopsis "Python implementation of OpenPGP")
     (description