Switch "crypto" implementation to Python

This simplifies the build process and avoids needing to ship a vendor'd
OpenSSL.

Author: jlaine

.github/workflows/tests.yml

@@ -62,21 +62,10 @@ jobs:
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python }}
-      - name: Install OpenSSL and disable firewall
+      - name: Disable firewall
         if: matrix.os == 'macos-latest'
         run: |
-          brew install openssl
-          echo "AIOQUIC_SKIP_TESTS=chacha20" >> $GITHUB_ENV
-          echo "CFLAGS=-I$(brew --prefix openssl)/include" >> $GITHUB_ENV
-          echo "LDFLAGS=-L$(brew --prefix openssl)/lib" >> $GITHUB_ENV
           sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate off
-      - name: Install OpenSSL
-        if: matrix.os == 'windows-latest'
-        run: |
-          # OpenSSL is pre-installed on windows-2025 runners.
-          echo "INCLUDE=C:\Progra~1\OpenSSL\include" >> $GITHUB_ENV
-          echo "LIB=C:\Progra~1\OpenSSL\\lib\\VC\\x64\\MD" >> $GITHUB_ENV
-        shell: bash
       - name: Run tests
         run: |
           python -m pip install -U pip setuptools wheel
@@ -135,12 +124,8 @@ jobs:
       - name: Build wheels
         env:
           CIBW_ARCHS: ${{ matrix.arch }}
-          CIBW_BEFORE_BUILD: python scripts/fetch-vendor.py /tmp/vendor
-          CIBW_BEFORE_BUILD_WINDOWS: python scripts\fetch-vendor.py C:\cibw\vendor
-          CIBW_ENVIRONMENT: AIOQUIC_SKIP_TESTS=ipv6,loss CFLAGS=-I/tmp/vendor/include LDFLAGS=-L/tmp/vendor/lib
-          CIBW_ENVIRONMENT_WINDOWS: AIOQUIC_SKIP_TESTS=ipv6,loss INCLUDE=C:\\cibw\\vendor\\include LIB=C:\\cibw\\vendor\\lib
-          # The limited API is not available on free-threaded builds.
-          CIBW_SKIP: 'cp3??t-* pp*'
+          CIBW_ENVIRONMENT: AIOQUIC_SKIP_TESTS=ipv6,loss
+          CIBW_SKIP: 'pp*'
           CIBW_TEST_COMMAND: python -m unittest discover -t {project} -s {project}/tests
           # There are no binary wheels for cryptography on 32-bit platforms.
           CIBW_TEST_SKIP: "*-{manylinux_i686,musllinux_i686,win32}"

scripts/fetch-vendor.json

@@ -5,10 +5,8 @@
 
 if sys.platform == "win32":
     extra_compile_args = []
-    libraries = ["libcrypto", "advapi32", "crypt32", "gdi32", "user32", "ws2_32"]
 else:
     extra_compile_args = ["-std=c99"]
-    libraries = ["crypto"]
 
 
 class bdist_wheel_abi3(bdist_wheel):
@@ -30,14 +28,6 @@ def get_tag(self):
             define_macros=[("Py_LIMITED_API", "0x03080000")],
             py_limited_api=True,
         ),
-        setuptools.Extension(
-            "aioquic._crypto",
-            extra_compile_args=extra_compile_args,
-            libraries=libraries,
-            sources=["src/aioquic/_crypto.c"],
-            define_macros=[("Py_LIMITED_API", "0x03080000")],
-            py_limited_api=True,
-        ),
     ],
     cmdclass={"bdist_wheel": bdist_wheel_abi3},
 )