Upgrade security/py-pycryptodome{,x,-test-vectors}

[ngie]

Summary

This change upgrades py-pycryptodome from 3.16 to 3.17 and
py-pycryptodome-test-vectors from 1.0.10 to 1.0.12.

Minor adjustments were made to py-pycryptodome-test-vectors to
accomodate the fact that the upstream author no longer distributes .zip
files for the package.

PR: 270161
Signed-off-by: Enji Cooper <[e-mail]>

Test Plan

Ran the py-cryptodome tests and they passed:

$ make test
===>  Testing for py39-pycryptodome-3.17
===>   py39-pycryptodome-3.17 depends on package: py39-pycryptodome-test-vectors>=0 - found
===>   py39-pycryptodome-3.17 depends on file: /usr/local/bin/python3.9 - found
...
Ran 42562 tests in 111.879s

OK
$

[john_saltant.com]

In addition to my per-line comments, I would suggest you run poudriere testport as an extra Q/A step, and record the FreeBSD version and architecture on which you successfully built and tested the update. See bug 268531 for an example of these practices.

security/py-pycryptodome-test-vectors/Makefile

2

Will the tests pass if the 1.0.12 test vectors are used with the 3.16.0 release? If not, maybe a dependency with minimum version spec would be appropriate?

14–15

Add support for Python 3.11 is included in the 3.17 release.

security/py-pycryptodome/Makefile

20

Add support for Python 3.11 was included in the 3.17 release.

[ngie]

Address comments re: 3.11 support.

[ngie]

Add a minimum required test-vectors version and a comment noting why the version is pinned.

[ngie]

Fix typo in previous revision regarding version pinning.

[ngie]

security/py-pycryptodome-test-vectors/Makefile

2

It's not mentioned explicitly, but I think it's potentially implied in the original package split.

From https://www.pycryptodome.org/src/changelog#id22 :

The bulk of the test vectors have been moved to the separate package pycryptodome-test-vectors. As result, packages pycryptodome and pycryptodomex become significantly smaller (from 14MB to 3MB).

Since they share the same GH development repo, I would assume it's best to keep the test-vectors reasonably in sync with the other packages.

[ngie]

This built successfully with poudriere on 13.1-RELEASE-p7/amd64. It also passed the exp-run according to @antoine: https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=270161#c1 .

[ngie]

John: do you have any more comments I should follow up on?

[john_saltant.com]

I would assume it's best to keep the test-vectors reasonably in sync with the other packages.

Given that upstream maintains independent versioning of the main project and the test vectors, it's not at all clear to me that this is a good assumption.

# It's best to keep the versions in sync to avoid introducing unwanted
# side-effects from mismatched package versions.
TEST_DEPENDS=	${PYTHON_PKGNAMEPREFIX}pycryptodome-test-vectors>=1.0.12:security/py-pycryptodome-test-vectors@${PY_FLAVOR}

If you're willing to try running the updated test vectors against the previous version and vice versa, I would do that and use the empirical results to inform whether a version constraint is warranted in the dependency. Otherwise, I think it's better to leave the version unconstrained.

[ngie]

The maintainer did this differently in a package update.