android build: switch from "cryptography" to "pycryptodomex"
What the developer wrote
Authored by SomberNight
android build: switch from "cryptography" to "pycryptodomex"
We had been using an ancient version of "cryptography" so far in our p4a fork,
however it is not compatible with OpenSSL 3.0. (Previously we were building it with OpenSSL 1.1)
Bumping "cryptography" is difficult, as building new versions of it from source requires a full rust toolchain.
Instead, this commit switches to "pycryptodomex", as a replacement, which is much easier to build from source.
What changed, and why it matters
This commit changes the Android build recipe for the Electrum Bitcoin wallet. It swaps one cryptographic library (cryptography) for another (pycryptodomex) because the old library could not be built with newer OpenSSL and the newer version is hard to compile. There is no direct evidence in the commit that this fixes a security vulnerability; it appears to be a build-maintenance change.
Treat this as a routine build-maintenance commit. If assessing security risk, verify that pycryptodomex 3.23.0 is used only as a drop-in replacement and that no cryptographic behavior changed. Monitor Electrum's release notes for any later security framing of this dependency change.
Security signals we found
Dependency swap in Android build configuration
Old dependency pinned to OpenSSL 1.1 era, incompatible with OpenSSL 3.0
No CVE, advisory, or security-relevant diff content present in commit
Evidence from the diff
The commit modifies contrib/android/buildozer_qml.spec to replace the ‘cryptography’ requirement with ‘pycryptodomex’, and adds a new p4a recipe file to build pycryptodomex 3.23.0 from source. The stated rationale is that the previously pinned old ‘cryptography’ package is incompatible with OpenSSL 3.0, and upgrading ‘cryptography’ would require a Rust toolchain. The change is purely a dependency substitution in the Android build pipeline. No runtime code paths are changed, no CVE is referenced, and no security advisory is linked.
Changed components
Android build configuration (contrib/android/buildozer_qml.spec)Python-for-Android recipe for pycryptodomex (contrib/android/p4a_recipes/pycryptodomex/__init__.py)Inspect captured patch +16 / −1
diff --git a/contrib/android/buildozer_qml.spec b/contrib/android/buildozer_qml.spec
index e19bcac..75328a5 100644
--- a/contrib/android/buildozer_qml.spec
+++ b/contrib/android/buildozer_qml.spec
@@ -76,7 +76,7 @@ requirements =
plyer,
libffi,
libsecp256k1,
- cryptography,
+ pycryptodomex,
pyqt6sip,
pyqt6,
libzbar
diff --git a/contrib/android/p4a_recipes/pycryptodomex/__init__.py b/contrib/android/p4a_recipes/pycryptodomex/__init__.py
new file mode 100644
index 0000000..0e0a580
--- /dev/null
+++ b/contrib/android/p4a_recipes/pycryptodomex/__init__.py
@@ -0,0 +1,15 @@
+from pythonforandroid.recipe import PythonRecipe
+
+
+assert PythonRecipe.depends == ['python3']
+assert PythonRecipe.python_depends == []
+
+
+class PycryptodomexRecipe(PythonRecipe):
+ version = "3.23.0"
+ sha512sum = "951cebaad2e19b9f9d04fe85c73ab1ff8b515069c1e0e8e3cd6845ec9ccd5ef3e5737259e0934ed4a6536e289dee6aabac58e1c822a5a6393e86b482c60afc89"
+ url = "https://github.com/Legrandin/pycryptodome/archive/v{version}x.tar.gz"
+ depends = ["setuptools", "cffi"]
+
+
+recipe = PycryptodomexRecipe()
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.