Informational 14 Bitcoin Committed Apr 22, 2026 · 08:15 UTC

android: use plain 'build' dependency (using 'venv') instead of 'build[virtualenv]', remove setuptools as its use is now pinned via hostpython_prerequisites where applicable, update depends asserts in pyqt6sip, sip, pyqt_builder

9d5b4a7c View source ↗

Public commit record

What the developer wrote

Authored by Sander van Grieken

73/100 · Adequate

android: use plain 'build' dependency (using 'venv') instead of 'build[virtualenv]',
remove setuptools as its use is now pinned via hostpython_prerequisites where applicable,
update depends asserts in pyqt6sip, sip, pyqt_builder

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context

The short version

What changed, and why it matters

This commit updates how Electrum's Android build system installs Python packaging tools. It switches from a feature-rich 'build[virtualenv]' dependency to a simpler 'build' dependency, removes a custom pinned recipe for setuptools, and moves setuptools into a new 'hostpython_prerequisites' mechanism for some recipes. It also updates version assertions for packaging, pyqt6sip, sip, and pyqt_builder to match a newer python-for-android version. There is no direct security fix visible in the diff; it appears to be build-system maintenance.

Recommended action

Treat as routine build-system hygiene. Review the upstream python-for-android changelog between commits 0b9f7e76 and 43dfdfae for any security-relevant changes. Verify that the new hostpython_prerequisites mechanism still pins setuptools to the expected hash and that removing the custom setuptools recipe does not weaken reproducible-build guarantees.

Security signals we found

Dependency pinning and recipe maintenance for Android build chain

Removal of custom setuptools recipe in favor of upstream hostpython_prerequisites mechanism

Update of python-for-android pinned commit in Dockerfile

No direct patch of vulnerability, memory safety issue, or cryptographic flaw visible in diff

Technical analysis

Evidence from the diff

The commit modifies Android build recipes in contrib/android/p4a_recipes/. It replaces build[virtualenv]==1.4.0 with build==1.4.0 in hostpython3, dropping virtualenv, distlib, filelock, platformdirs, and python_discovery pinned hashes. It deletes the custom setuptools recipe and instead declares setuptools==80.9.0 as a hostpython_prerequisite for pycryptodomex. It updates packaging recipe version assertion from 21.3 to 26.0 and its sha512sum. It updates dependency assertions for pyqt6sip, pyqt_builder, and sip to remove setuptools and packaging where upstream no longer declares them. The Dockerfile pins a newer python-for-android commit (43dfdfaec…).

Changed components

contrib/android/Dockerfilecontrib/android/p4a_recipes/hostpython3/__init__.pycontrib/android/p4a_recipes/packaging/__init__.pycontrib/android/p4a_recipes/pycryptodomex/__init__.pycontrib/android/p4a_recipes/pyqt6sip/__init__.pycontrib/android/p4a_recipes/pyqt_builder/__init__.pycontrib/android/p4a_recipes/setuptools/__init__.py (deleted)contrib/android/p4a_recipes/sip/__init__.py

Inspect captured patch +14 / −41

diff --git a/contrib/android/Dockerfile b/contrib/android/Dockerfile
index 8a136c2..6e43b83 100644
--- a/contrib/android/Dockerfile
+++ b/contrib/android/Dockerfile
@@ -235,7 +235,7 @@ RUN cd /opt \
     && /opt/venv/bin/python3 -m pip install --no-build-isolation --no-dependencies -e .
 
 # install python-for-android
-ENV P4A_CHECKOUT_COMMIT="0b9f7e763866cd3533417418d4b31e7b316b624e"
+ENV P4A_CHECKOUT_COMMIT="43dfdfaec0865fbd9c7d4f57457323601c4afae1"
 # ^ from branch electrum_202602 (note: careful with force-pushing! see #8162)
 RUN cd /opt \
     && git clone https://github.com/spesmilo/python-for-android \
diff --git a/contrib/android/p4a_recipes/hostpython3/__init__.py b/contrib/android/p4a_recipes/hostpython3/__init__.py
index 5d9f0d6..a4a63d7 100644
--- a/contrib/android/p4a_recipes/hostpython3/__init__.py
+++ b/contrib/android/p4a_recipes/hostpython3/__init__.py
@@ -17,28 +17,18 @@ class HostPython3RecipePinned(util.InheritedRecipeMixin, HostPython3Recipe):
 
     # this property overrides the default hostpython dependencies for PyProjectRecipe recipies
     pyproject_base_dependencies = [
-        HashPinnedDependency(package="build[virtualenv]==1.4.0",
+        HashPinnedDependency(package="build==1.4.0",
                              hashes=['sha256:6a07c1b8eb6f2b311b96fcbdbce5dab5fe637ffda0fd83c9cac622e927501596']),
         HashPinnedDependency(package="pip==24.0",
                              hashes=['sha256:ba0d021a166865d2265246961bec0152ff124de910c5cc39f1156ce3fa7c69dc']),
         HashPinnedDependency(package="setuptools==80.9.0",
                              hashes=['sha256:062d34222ad13e0cc312a4c02d73f059e86a4acbfbdea8f8f76b28c99f306922']),
 
-        # pin deptree build[virtualenv]==1.4.0
+        # pin deptree build==1.4.0
         HashPinnedDependency(package="packaging==26.0",
                              hashes=['sha256:b36f1fef9334a5588b4166f8bcd26a14e521f2b55e6b9de3aaa80d3ff7a37529']),
         HashPinnedDependency(package="pyproject_hooks==1.2.0",
                              hashes=['sha256:9e5c6bfa8dcc30091c74b0cf803c81fdd29d94f01992a7707bc97babb1141913']),
-        HashPinnedDependency(package="virtualenv==21.2.0",
-                             hashes=['sha256:1bd755b504931164a5a496d217c014d098426cddc79363ad66ac78125f9d908f']),
-        HashPinnedDependency(package="distlib==0.4.0",
-                             hashes=['sha256:9659f7d87e46584a30b5780e43ac7a2143098441670ff0a49d5f9034c54a6c16']),
-        HashPinnedDependency(package="filelock==3.25.2",
-                             hashes=['sha256:ca8afb0da15f229774c9ad1b455ed96e85a81373065fb10446672f64444ddf70']),
-        HashPinnedDependency(package="platformdirs==4.9.4",
-                             hashes=['sha256:68a9a4619a666ea6439f2ff250c12a853cd1cbd5158d258bd824a7df6be2f868']),
-        HashPinnedDependency(package="python_discovery==1.1.3",
-                             hashes=['sha256:90e795f0121bc84572e737c9aa9966311b9fde44ffb88a5953b3ec9b31c6945e']),
     ]
 
 
diff --git a/contrib/android/p4a_recipes/packaging/__init__.py b/contrib/android/p4a_recipes/packaging/__init__.py
index a8f225a..b16d67d 100644
--- a/contrib/android/p4a_recipes/packaging/__init__.py
+++ b/contrib/android/p4a_recipes/packaging/__init__.py
@@ -1,15 +1,13 @@
 from pythonforandroid.recipes.packaging import PackagingRecipe
 
 
-assert PackagingRecipe._version == "21.3"
+assert PackagingRecipe._version == "26.0"
 assert PackagingRecipe.depends == ["setuptools", "pyparsing", "python3"]
 assert PackagingRecipe.python_depends == []
 
 
 class PackagingRecipePinned(PackagingRecipe):
-    #version = "21.3"
-    # note: 21.3 is the last version to use setup.py, so newer versions don't work. see comment for PyparsingRecipePinned
-    sha512sum = "2e3aa276a4229ac7dc0654d586799473ced9761a83aa4159660d37ae1a2a8f30e987248dd0e260e2834106b589f259a57ce9936eef0dcc3c430a99ac6b663e05"
+    sha512sum = "27a066a7d65ba76189212973b6a0d162f3d361848b1b0c34a82865cf180b3284a837cc34206c297f002a73feae414e25a26c5960bb884a74ea337f582585f1d2"
 
 
 recipe = PackagingRecipePinned()
diff --git a/contrib/android/p4a_recipes/pycryptodomex/__init__.py b/contrib/android/p4a_recipes/pycryptodomex/__init__.py
index 0e0a580..0491968 100644
--- a/contrib/android/p4a_recipes/pycryptodomex/__init__.py
+++ b/contrib/android/p4a_recipes/pycryptodomex/__init__.py
@@ -1,5 +1,5 @@
 from pythonforandroid.recipe import PythonRecipe
-
+from pythonforandroid.util import HashPinnedDependency
 
 assert PythonRecipe.depends == ['python3']
 assert PythonRecipe.python_depends == []
@@ -9,7 +9,11 @@ class PycryptodomexRecipe(PythonRecipe):
     version = "3.23.0"
     sha512sum = "951cebaad2e19b9f9d04fe85c73ab1ff8b515069c1e0e8e3cd6845ec9ccd5ef3e5737259e0934ed4a6536e289dee6aabac58e1c822a5a6393e86b482c60afc89"
     url = "https://github.com/Legrandin/pycryptodome/archive/v{version}x.tar.gz"
-    depends = ["setuptools", "cffi"]
+    depends = ["cffi"]
+    hostpython_prerequisites = [
+        HashPinnedDependency(package="setuptools==80.9.0",
+                             hashes=['sha256:062d34222ad13e0cc312a4c02d73f059e86a4acbfbdea8f8f76b28c99f306922']),
+    ]
 
 
 recipe = PycryptodomexRecipe()
diff --git a/contrib/android/p4a_recipes/pyqt6sip/__init__.py b/contrib/android/p4a_recipes/pyqt6sip/__init__.py
index 6c35425..9aa70d6 100644
--- a/contrib/android/p4a_recipes/pyqt6sip/__init__.py
+++ b/contrib/android/p4a_recipes/pyqt6sip/__init__.py
@@ -7,7 +7,7 @@ util = load_source('util', os.path.join(os.path.dirname(os.path.dirname(__file__
 
 
 assert PyQt6SipRecipe._version == "13.10.3"
-assert PyQt6SipRecipe.depends == ['setuptools', 'python3']
+assert PyQt6SipRecipe.depends == ['python3']
 assert PyQt6SipRecipe.python_depends == []
 
 
diff --git a/contrib/android/p4a_recipes/pyqt_builder/__init__.py b/contrib/android/p4a_recipes/pyqt_builder/__init__.py
index 3849943..8fa6557 100644
--- a/contrib/android/p4a_recipes/pyqt_builder/__init__.py
+++ b/contrib/android/p4a_recipes/pyqt_builder/__init__.py
@@ -3,7 +3,7 @@ from pythonforandroid.util import HashPinnedDependency
 
 
 assert PyQtBuilderRecipe._version == "1.19.1"
-assert PyQtBuilderRecipe.depends == ["packaging", "sip", "python3"], PyQtBuilderRecipe.depends
+assert PyQtBuilderRecipe.depends == ["sip", "python3"], PyQtBuilderRecipe.depends
 assert PyQtBuilderRecipe.python_depends == []
 
 
diff --git a/contrib/android/p4a_recipes/setuptools/__init__.py b/contrib/android/p4a_recipes/setuptools/__init__.py
deleted file mode 100644
index d60d390..0000000
--- a/contrib/android/p4a_recipes/setuptools/__init__.py
+++ /dev/null
@@ -1,19 +0,0 @@
-from pythonforandroid.recipes.setuptools import SetuptoolsRecipe
-from pythonforandroid.util import HashPinnedDependency
-
-
-assert SetuptoolsRecipe._version == "80.9.0"
-assert SetuptoolsRecipe.depends == ['python3']
-assert SetuptoolsRecipe.python_depends == []
-
-
-class SetuptoolsRecipePinned(SetuptoolsRecipe):
-    hostpython_prerequisites = [
-        HashPinnedDependency(package='setuptools==80.9.0',
-                             hashes=[]),
-    ]
-
-    sha512sum = "36eb1f219d29c6b9e135936bde2001ad70a971c8069cd0175d3a5325b450e6843a903d3f70043c9f534768ebeab8ab0c544b8f44456555d333f1ed72daa5c18b"
-
-
-recipe = SetuptoolsRecipePinned()
diff --git a/contrib/android/p4a_recipes/sip/__init__.py b/contrib/android/p4a_recipes/sip/__init__.py
index 456f707..c603c51 100644
--- a/contrib/android/p4a_recipes/sip/__init__.py
+++ b/contrib/android/p4a_recipes/sip/__init__.py
@@ -2,7 +2,7 @@ from pythonforandroid.recipes.sip import SipRecipe
 
 
 assert SipRecipe._version == "6.15.1"
-assert SipRecipe.depends == ["setuptools", "packaging", "python3"], SipRecipe.depends
+assert SipRecipe.depends == ["python3"], SipRecipe.depends
 assert SipRecipe.python_depends == []

Risk score

Why this scored 14/100

Our methodology →

Potential impact 2/30

Exploitability 2/25

Stealth signal 2/15

Affected reach 3/15

Confidence 3/10

Evidence quality 2/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 14/100

Community notes

Related watches

wallet: sign_message: strip whitespaces in GUIs, do not strip in CLI

qml: strip whitespace from message before signing, as in qt gui

trezor: drop session after closing it