[sarthak-shubham]

Fixes #826

Addresses the CryptographyDeprecationWarning raised when using FFDH key exchange with cryptography v50.0.0+.

Changes:

Wraps FFDH operations in warnings.catch_warnings() to suppress CryptographyDeprecationWarning locally, preventing it from leaking into end-user logs.
Adds a try/except ImportError fallback to import dh from cryptography.hazmat.decrepit.asymmetric if it is eventually removed from primitives, following the same pattern used for deprecated symmetric ciphers in crypto/cipher.py.
Tested with python -m unittest tests.test_kex — all 14 tests pass.

[sarthak-shubham]

@ronf following up from #826 - I went with a try/except ImportError fallback scoped to the single dh symbol here, rather than the _algs/_decrepit_algs registry from cipher.py, since there's only one thing to fall back on here, not a list. Let me know if you'd rather I match the registry pattern for consistency.

Also, the CI workflow is waiting on approval to run whenever you get a chance.

[ronf]

Is there a way to do this which avoids having to insert the warnings block in each of the DH class methods? I see that the decrepit module doesn't yet have the asymmetric algorithms in it, so we can't count on that succeeding to avoid the warnings. However, I'd really like to find a way to suppress the warnings once at import time and not have to go through that code every time a DH key is instantiated.

[sarthak-shubham]

@ronf Yes, I understand the per-method overhead issue you pointed towards. I've updated the PR to mirror the pattern you're already using in crypto/cipher.py.

Instead of wrapping each method, the classes are now aliased at the module level inside a single warnings.catch_warnings() block. This safely catches the deprecation warning just once during import, which lets us remove the suppression blocks (and their overhead) from the DH class methods.

I kept the try/except block exactly as is, so it will still safely fall back to decrepit whenever they eventually migrate it out of primitives.

And also tested this against cryptography v50.0.0 and it successfully catches the warning without leaking globally. Let me know if this looks good to you.

[ronf]

Thanks - this looks much nicer!

Just one small item remaining: Since the primary import always succeeds (but just with a warning) for now, the "except" block won't ever get executed, causing a code coverage issue. Two possible options:

1. Remove the decrepit import for now, and just let it error out when the primary import begins to fail. This might be safest, as we can't be 100% sure what the decrepit version looks like. Once the decrepit module is added, the import for it can be re-added.
2. Leave both imports, but mark the "except" block around the decrepit import with # pragma: no cover to avoid the code coverage issue of not yet ever falling into that block.

[sarthak-shubham]

@ronf I just added # pragma: no cover to the except (ImportError, AttributeError) line to address the coverage gap, following the same pattern used in cipher.py. Tests pass nicely.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.87%. Comparing base (fab96ac) to head (e52795a).
⚠️ Report is 239 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #830      +/-   ##
===========================================
+ Coverage    99.85%   99.87%   +0.02%     
===========================================
  Files           95      102       +7     
  Lines        27784    32548    +4764     
  Branches      2908     3146     +238     
===========================================
+ Hits         27743    32507    +4764     
  Misses          38       38              
  Partials         3        3              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ronf]

Thanks very much for this! It's now in the "develop" branch and will be part of the next release...