fix pyo3 warnings for 0.21 with gil-refs enabled

.github/workflows/ci.yml

@@ -49,7 +49,7 @@ jobs:
           - {VERSION: "3.12", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "4a9e48f727ce7ad924c53a55b301e426d7e43863"}}
           # Builds with various Rust versions. Includes MSRV and next
           # potential future MSRV.
-          - {VERSION: "3.12", NOXSESSION: "rust,tests", RUST: "1.65.0"}
+          - {VERSION: "3.12", NOXSESSION: "rust,tests-nocoverage", RUST: "1.65.0"}
           - {VERSION: "3.12", NOXSESSION: "rust,tests", RUST: "beta"}
           - {VERSION: "3.12", NOXSESSION: "rust,tests", RUST: "nightly"}
     timeout-minutes: 15

src/rust/Cargo.toml

@@ -10,7 +10,7 @@ rust-version = "1.65.0"
 [dependencies]
 once_cell = "1"
 cfg-if = "1"
-pyo3 = { version = "0.20", features = ["abi3"] }
+pyo3 = { version="0.21.0", features = ["abi3", "gil-refs"] }
 asn1 = { version = "0.16.1", default-features = false }
 cryptography-cffi = { path = "cryptography-cffi" }
 cryptography-key-parsing = { path = "cryptography-key-parsing" }

src/rust/cryptography-cffi/Cargo.toml

@@ -8,7 +8,7 @@ publish = false
 rust-version = "1.65.0"
 
 [dependencies]
-pyo3 = { version = "0.20", features = ["abi3"] }
+pyo3 = { version="0.21.0", features = ["abi3", "gil-refs"] }
 openssl-sys = "0.9.101"
 
 [build-dependencies]

src/rust/cryptography-cffi/src/lib.rs

@@ -5,7 +5,7 @@
 #![deny(rust_2018_idioms, clippy::undocumented_unsafe_blocks)]
 
 #[cfg(not(python_implementation = "PyPy"))]
-use pyo3::FromPyPointer;
+use pyo3::Py;
 
 #[cfg(python_implementation = "PyPy")]
 extern "C" {
@@ -16,18 +16,20 @@ extern "C" {
     fn PyInit__openssl() -> *mut pyo3::ffi::PyObject;
 }
 
-pub fn create_module(py: pyo3::Python<'_>) -> pyo3::PyResult<&pyo3::types::PyModule> {
+pub fn create_module(
+    py: pyo3::Python<'_>,
+) -> pyo3::PyResult<pyo3::Bound<'_, pyo3::types::PyModule>> {
     #[cfg(python_implementation = "PyPy")]
     let openssl_mod = unsafe {
         let res = Cryptography_make_openssl_module();
         assert_eq!(res, 0);
-        pyo3::types::PyModule::import(py, "_openssl")?
+        pyo3::types::PyModule::import_bound(py, "_openssl")?.clone()
     };
     #[cfg(not(python_implementation = "PyPy"))]
     // SAFETY: `PyInit__openssl` returns an owned reference.
     let openssl_mod = unsafe {
         let ptr = PyInit__openssl();
-        pyo3::types::PyModule::from_owned_ptr(py, ptr)
+        Py::from_owned_ptr(py, ptr).bind(py).clone()
     };
 
     Ok(openssl_mod)

src/rust/src/asn1.rs

@@ -6,6 +6,7 @@ use asn1::SimpleAsn1Readable;
 use cryptography_x509::certificate::Certificate;
 use cryptography_x509::common::{DssSignature, SubjectPublicKeyInfo, Time};
 use cryptography_x509::name::Name;
+use pyo3::prelude::PyModuleMethods;
 use pyo3::types::IntoPyDict;
 use pyo3::ToPyObject;
 
@@ -167,14 +168,16 @@ fn test_parse_certificate(data: &[u8]) -> Result<TestCertificate, CryptographyEr
     })
 }
 
-pub(crate) fn create_submodule(py: pyo3::Python<'_>) -> pyo3::PyResult<&pyo3::prelude::PyModule> {
-    let submod = pyo3::prelude::PyModule::new(py, "asn1")?;
-    submod.add_function(pyo3::wrap_pyfunction!(parse_spki_for_data, submod)?)?;
+pub(crate) fn create_submodule(
+    py: pyo3::Python<'_>,
+) -> pyo3::PyResult<pyo3::Bound<'_, pyo3::prelude::PyModule>> {
+    let submod = pyo3::prelude::PyModule::new_bound(py, "asn1")?;
+    submod.add_function(pyo3::wrap_pyfunction!(parse_spki_for_data, &submod)?)?;
 
-    submod.add_function(pyo3::wrap_pyfunction!(decode_dss_signature, submod)?)?;
-    submod.add_function(pyo3::wrap_pyfunction!(encode_dss_signature, submod)?)?;
+    submod.add_function(pyo3::wrap_pyfunction!(decode_dss_signature, &submod)?)?;
+    submod.add_function(pyo3::wrap_pyfunction!(encode_dss_signature, &submod)?)?;
 
-    submod.add_function(pyo3::wrap_pyfunction!(test_parse_certificate, submod)?)?;
+    submod.add_function(pyo3::wrap_pyfunction!(test_parse_certificate, &submod)?)?;
 
     Ok(submod)
 }

src/rust/src/backend/aead.rs

@@ -1,6 +1,7 @@
 // This file is dual licensed under the terms of the Apache License, Version
 // 2.0, and the BSD License. See the LICENSE file in the root of this repository
 // for complete details.
+use pyo3::prelude::PyModuleMethods;
 
 use crate::buf::CffiBuf;
 use crate::error::{CryptographyError, CryptographyResult};
@@ -1130,8 +1131,10 @@ impl AesGcmSiv {
     }
 }
 
-pub(crate) fn create_module(py: pyo3::Python<'_>) -> pyo3::PyResult<&pyo3::prelude::PyModule> {
-    let m = pyo3::prelude::PyModule::new(py, "aead")?;
+pub(crate) fn create_module(
+    py: pyo3::Python<'_>,
+) -> pyo3::PyResult<pyo3::Bound<'_, pyo3::prelude::PyModule>> {
+    let m = pyo3::prelude::PyModule::new_bound(py, "aead")?;
 
     m.add_class::<AesGcm>()?;
     m.add_class::<ChaCha20Poly1305>()?;

src/rust/src/backend/cipher_registry.rs

@@ -259,7 +259,7 @@ fn get_cipher_registry(
         // this should't be necessary but OpenSSL 3 will return an EVP_CIPHER
         // even when the cipher is unavailable.
         if cfg!(not(CRYPTOGRAPHY_OPENSSL_300_OR_GREATER))
-            || types::LEGACY_PROVIDER_LOADED.get(py)?.is_true()?
+            || types::LEGACY_PROVIDER_LOADED.get(py)?.is_truthy()?
         {
             #[cfg(not(CRYPTOGRAPHY_OSSLCONF = "OPENSSL_NO_BF"))]
             {

src/rust/src/backend/ciphers.rs

@@ -7,6 +7,7 @@ use crate::buf::{CffiBuf, CffiMutBuf};
 use crate::error::{CryptographyError, CryptographyResult};
 use crate::exceptions;
 use crate::types;
+use pyo3::prelude::PyModuleMethods;
 use pyo3::IntoPy;
 
 struct CipherContext {
@@ -29,7 +30,7 @@ impl CipherContext {
                         format!(
                             "cipher {} in {} mode is not supported ",
                             algorithm.getattr(pyo3::intern!(py, "name"))?,
-                            if mode.is_true()? {
+                            if mode.is_truthy()? {
                                 mode.getattr(pyo3::intern!(py, "name"))?
                             } else {
                                 mode
@@ -550,14 +551,16 @@ fn _advance_aad(ctx: &pyo3::PyAny, n: u64) {
     }
 }
 
-pub(crate) fn create_module(py: pyo3::Python<'_>) -> pyo3::PyResult<&pyo3::prelude::PyModule> {
-    let m = pyo3::prelude::PyModule::new(py, "ciphers")?;
-    m.add_function(pyo3::wrap_pyfunction!(create_encryption_ctx, m)?)?;
-    m.add_function(pyo3::wrap_pyfunction!(create_decryption_ctx, m)?)?;
-    m.add_function(pyo3::wrap_pyfunction!(cipher_supported, m)?)?;
-
-    m.add_function(pyo3::wrap_pyfunction!(_advance, m)?)?;
-    m.add_function(pyo3::wrap_pyfunction!(_advance_aad, m)?)?;
+pub(crate) fn create_module(
+    py: pyo3::Python<'_>,
+) -> pyo3::PyResult<pyo3::Bound<'_, pyo3::prelude::PyModule>> {
+    let m = pyo3::prelude::PyModule::new_bound(py, "ciphers")?;
+    m.add_function(pyo3::wrap_pyfunction!(create_encryption_ctx, &m)?)?;
+    m.add_function(pyo3::wrap_pyfunction!(create_decryption_ctx, &m)?)?;
+    m.add_function(pyo3::wrap_pyfunction!(cipher_supported, &m)?)?;
+
+    m.add_function(pyo3::wrap_pyfunction!(_advance, &m)?)?;
+    m.add_function(pyo3::wrap_pyfunction!(_advance_aad, &m)?)?;
 
     m.add_class::<PyCipherContext>()?;
     m.add_class::<PyAEADEncryptionContext>()?;

src/rust/src/backend/cmac.rs

@@ -1,6 +1,7 @@
 // This file is dual licensed under the terms of the Apache License, Version
 // 2.0, and the BSD License. See the LICENSE file in the root of this repository
 // for complete details.
+use pyo3::prelude::PyModuleMethods;
 
 use crate::backend::cipher_registry;
 use crate::backend::hashes::already_finalized_error;
@@ -97,8 +98,10 @@ impl Cmac {
     }
 }
 
-pub(crate) fn create_module(py: pyo3::Python<'_>) -> pyo3::PyResult<&pyo3::prelude::PyModule> {
-    let m = pyo3::prelude::PyModule::new(py, "cmac")?;
+pub(crate) fn create_module(
+    py: pyo3::Python<'_>,
+) -> pyo3::PyResult<pyo3::Bound<'_, pyo3::prelude::PyModule>> {
+    let m = pyo3::prelude::PyModule::new_bound(py, "cmac")?;
 
     m.add_class::<Cmac>()?;
 

src/rust/src/backend/dh.rs

@@ -1,6 +1,7 @@
 // This file is dual licensed under the terms of the Apache License, Version
 // 2.0, and the BSD License. See the LICENSE file in the root of this repository
 // for complete details.
+use pyo3::prelude::PyModuleMethods;
 
 use cryptography_x509::common;
 
@@ -545,11 +546,13 @@ impl DHParameterNumbers {
     }
 }
 
-pub(crate) fn create_module(py: pyo3::Python<'_>) -> pyo3::PyResult<&pyo3::prelude::PyModule> {
-    let m = pyo3::prelude::PyModule::new(py, "dh")?;
-    m.add_function(pyo3::wrap_pyfunction!(generate_parameters, m)?)?;
-    m.add_function(pyo3::wrap_pyfunction!(from_der_parameters, m)?)?;
-    m.add_function(pyo3::wrap_pyfunction!(from_pem_parameters, m)?)?;
+pub(crate) fn create_module(
+    py: pyo3::Python<'_>,
+) -> pyo3::PyResult<pyo3::Bound<'_, pyo3::prelude::PyModule>> {
+    let m = pyo3::prelude::PyModule::new_bound(py, "dh")?;
+    m.add_function(pyo3::wrap_pyfunction!(generate_parameters, &m)?)?;
+    m.add_function(pyo3::wrap_pyfunction!(from_der_parameters, &m)?)?;
+    m.add_function(pyo3::wrap_pyfunction!(from_pem_parameters, &m)?)?;
 
     m.add_class::<DHPrivateKey>()?;
     m.add_class::<DHPublicKey>()?;

src/rust/src/backend/dsa.rs

@@ -1,6 +1,7 @@
 // This file is dual licensed under the terms of the Apache License, Version
 // 2.0, and the BSD License. See the LICENSE file in the root of this repository
 // for complete details.
+use pyo3::prelude::PyModuleMethods;
 
 use crate::backend::utils;
 use crate::buf::CffiBuf;
@@ -497,9 +498,11 @@ impl DsaParameterNumbers {
     }
 }
 
-pub(crate) fn create_module(py: pyo3::Python<'_>) -> pyo3::PyResult<&pyo3::prelude::PyModule> {
-    let m = pyo3::prelude::PyModule::new(py, "dsa")?;
-    m.add_function(pyo3::wrap_pyfunction!(generate_parameters, m)?)?;
+pub(crate) fn create_module(
+    py: pyo3::Python<'_>,
+) -> pyo3::PyResult<pyo3::Bound<'_, pyo3::prelude::PyModule>> {
+    let m = pyo3::prelude::PyModule::new_bound(py, "dsa")?;
+    m.add_function(pyo3::wrap_pyfunction!(generate_parameters, &m)?)?;
 
     m.add_class::<DsaPrivateKey>()?;
     m.add_class::<DsaPublicKey>()?;

src/rust/src/backend/ec.rs

@@ -5,6 +5,7 @@
 use std::collections::hash_map::DefaultHasher;
 use std::hash::{Hash, Hasher};
 
+use pyo3::prelude::PyModuleMethods;
 use pyo3::ToPyObject;
 
 use crate::backend::utils;
@@ -660,12 +661,14 @@ impl EllipticCurvePublicNumbers {
     }
 }
 
-pub(crate) fn create_module(py: pyo3::Python<'_>) -> pyo3::PyResult<&pyo3::prelude::PyModule> {
-    let m = pyo3::prelude::PyModule::new(py, "ec")?;
-    m.add_function(pyo3::wrap_pyfunction!(curve_supported, m)?)?;
-    m.add_function(pyo3::wrap_pyfunction!(generate_private_key, m)?)?;
-    m.add_function(pyo3::wrap_pyfunction!(derive_private_key, m)?)?;
-    m.add_function(pyo3::wrap_pyfunction!(from_public_bytes, m)?)?;
+pub(crate) fn create_module(
+    py: pyo3::Python<'_>,
+) -> pyo3::PyResult<pyo3::Bound<'_, pyo3::prelude::PyModule>> {
+    let m = pyo3::prelude::PyModule::new_bound(py, "ec")?;
+    m.add_function(pyo3::wrap_pyfunction!(curve_supported, &m)?)?;
+    m.add_function(pyo3::wrap_pyfunction!(generate_private_key, &m)?)?;
+    m.add_function(pyo3::wrap_pyfunction!(derive_private_key, &m)?)?;
+    m.add_function(pyo3::wrap_pyfunction!(from_public_bytes, &m)?)?;
 
     m.add_class::<ECPrivateKey>()?;
     m.add_class::<ECPublicKey>()?;

src/rust/src/backend/ed25519.rs

@@ -1,6 +1,7 @@
 // This file is dual licensed under the terms of the Apache License, Version
 // 2.0, and the BSD License. See the LICENSE file in the root of this repository
 // for complete details.
+use pyo3::prelude::PyModuleMethods;
 
 use crate::backend::utils;
 use crate::buf::CffiBuf;
@@ -158,11 +159,13 @@ impl Ed25519PublicKey {
     }
 }
 
-pub(crate) fn create_module(py: pyo3::Python<'_>) -> pyo3::PyResult<&pyo3::prelude::PyModule> {
-    let m = pyo3::prelude::PyModule::new(py, "ed25519")?;
-    m.add_function(pyo3::wrap_pyfunction!(generate_key, m)?)?;
-    m.add_function(pyo3::wrap_pyfunction!(from_private_bytes, m)?)?;
-    m.add_function(pyo3::wrap_pyfunction!(from_public_bytes, m)?)?;
+pub(crate) fn create_module(
+    py: pyo3::Python<'_>,
+) -> pyo3::PyResult<pyo3::Bound<'_, pyo3::prelude::PyModule>> {
+    let m = pyo3::prelude::PyModule::new_bound(py, "ed25519")?;
+    m.add_function(pyo3::wrap_pyfunction!(generate_key, &m)?)?;
+    m.add_function(pyo3::wrap_pyfunction!(from_private_bytes, &m)?)?;
+    m.add_function(pyo3::wrap_pyfunction!(from_public_bytes, &m)?)?;
 
     m.add_class::<Ed25519PrivateKey>()?;
     m.add_class::<Ed25519PublicKey>()?;

src/rust/src/backend/ed448.rs

@@ -1,6 +1,7 @@
 // This file is dual licensed under the terms of the Apache License, Version
 // 2.0, and the BSD License. See the LICENSE file in the root of this repository
 // for complete details.
+use pyo3::prelude::PyModuleMethods;
 
 use crate::backend::utils;
 use crate::buf::CffiBuf;
@@ -155,11 +156,13 @@ impl Ed448PublicKey {
     }
 }
 
-pub(crate) fn create_module(py: pyo3::Python<'_>) -> pyo3::PyResult<&pyo3::prelude::PyModule> {
-    let m = pyo3::prelude::PyModule::new(py, "ed448")?;
-    m.add_function(pyo3::wrap_pyfunction!(generate_key, m)?)?;
-    m.add_function(pyo3::wrap_pyfunction!(from_private_bytes, m)?)?;
-    m.add_function(pyo3::wrap_pyfunction!(from_public_bytes, m)?)?;
+pub(crate) fn create_module(
+    py: pyo3::Python<'_>,
+) -> pyo3::PyResult<pyo3::Bound<'_, pyo3::prelude::PyModule>> {
+    let m = pyo3::prelude::PyModule::new_bound(py, "ed448")?;
+    m.add_function(pyo3::wrap_pyfunction!(generate_key, &m)?)?;
+    m.add_function(pyo3::wrap_pyfunction!(from_private_bytes, &m)?)?;
+    m.add_function(pyo3::wrap_pyfunction!(from_public_bytes, &m)?)?;
 
     m.add_class::<Ed448PrivateKey>()?;
     m.add_class::<Ed448PublicKey>()?;

src/rust/src/backend/hashes.rs

@@ -1,6 +1,7 @@
 // This file is dual licensed under the terms of the Apache License, Version
 // 2.0, and the BSD License. See the LICENSE file in the root of this repository
 // for complete details.
+use pyo3::prelude::PyModuleMethods;
 
 use std::borrow::Cow;
 
@@ -136,8 +137,10 @@ impl Hash {
     }
 }
 
-pub(crate) fn create_module(py: pyo3::Python<'_>) -> pyo3::PyResult<&pyo3::prelude::PyModule> {
-    let m = pyo3::prelude::PyModule::new(py, "hashes")?;
+pub(crate) fn create_module(
+    py: pyo3::Python<'_>,
+) -> pyo3::PyResult<pyo3::Bound<'_, pyo3::prelude::PyModule>> {
+    let m = pyo3::prelude::PyModule::new_bound(py, "hashes")?;
     m.add_class::<Hash>()?;
 
     Ok(m)