cryptography 47.0.0: Installing and importing cryptography requires the compiled Rust extension _rust rather than pure CFFI dynamic compilation, causing source builds on musl images to fail on Cargo instead of C toolchains.

A model would assume cryptography relies purely on CFFI dynamic bindings compiled via C toolchains (gcc, openssl-dev) and requires passing backend=default_backend() to Cipher and key constructors.
On a musl image with no matching wheel, building from source fails loudly with RuntimeError: Cargo, the Rust package manager, is not installed or is not on PATH rather than a C compiler error.

{"case":{"caseId":"case:sha256:19c55b6f9ec7ea6a89ca1ff1bb684995e0e8c2c5b4f95337d3b74a509f83b445","constraints":{"runtime":"python"},"contract":["assert _rust.__name__ == 'cryptography.hazmat.bindings._rust'","assert x509.Certificate is _rust.x509.Certificate","assert isinstance(x509.load_pem_x509_certificate(PEM_CERT), _rust.x509.Certificate)","assert Cipher(algorithms.AES(key), modes.CBC(iv)).algorithm.key == key","assert binding_mod._openssl is _rust._openssl"],"goal":"Installing and importing cryptography requires the compiled Rust extension _rust rather than pure CFFI dynamic compilation, causing source builds on musl images to fail on Cargo instead of C toolchains.","kind":"HOW","packages":["pkg:pypi/cryptography@47.0.0"],"schemaVersion":1,"symbols":["cryptography.hazmat.bindings._rust","cryptography.hazmat.bindings._rust.x509.Certificate","cryptography.hazmat.bindings.openssl.binding.Binding","cryptography.x509.load_pem_x509_certificate","cryptography.hazmat.primitives.ciphers.Cipher"]},"contractCommand":["python","test/contract.py"],"environment":{"arch":"x64","ecosystem":"pypi","executionContext":"python","language":"python","os":"linux","packageManager":"pip","runtime":"python","schemaVersion":1},"license":"MIT-0","packages":["pkg:pypi/cryptography@47.0.0"],"schemaVersion":1,"symbols":["cryptography.hazmat.bindings._rust","cryptography.hazmat.bindings._rust.x509.Certificate","cryptography.hazmat.bindings.openssl.binding.Binding","cryptography.x509.load_pem_x509_certificate","cryptography.hazmat.primitives.ciphers.Cipher"],"verifierAdapter":"python@1"}

cffi==2.0.0
cryptography==47.0.0
pycparser==3.0

cffi==2.0.0
cryptography==47.0.0
pycparser==3.0

import cryptography.hazmat.bindings._rust as _rust
from cryptography import x509
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.bindings.openssl.binding import Binding
import cryptography.hazmat.bindings.openssl.binding as binding_mod

# 1. Verify Rust native extension exists and exports native submodules
assert _rust.__name__ == "cryptography.hazmat.bindings._rust"
assert hasattr(_rust, "x509")
assert hasattr(_rust, "asn1")
assert hasattr(_rust, "openssl")
assert hasattr(_rust, "_openssl")

# 2. Verify X.509 Certificate is backed directly by Rust struct, not pure Python/CFFI wrapper
assert x509.Certificate is _rust.x509.Certificate
assert type(x509.load_pem_x509_certificate).__name__ == "builtin_function_or_method"

PEM_CERT = (
    b"-----BEGIN CERTIFICATE-----\n"
    b"MIICsjCCAZqgAwIBAgIEB1vNFTANBgkqhkiG9w0BAQsFADAbMRkwFwYDVQQDDBB0\n"
    b"ZXN0LmV4YW1wbGUuY29tMB4XDTIwMDEwMTAwMDAwMFoXDTMwMDEwMTAwMDAwMFow\n"
    b"GzEZMBcGA1UEAwwQdGVzdC5leGFtcGxlLmNvbTCCASIwDQYJKoZIhvcNAQEBBQAD\n"
    b"ggEPADCCAQoCggEBAJ4dDz1ZuOZk0kbFNn5DlKgXUHJhnmWGzNah3h/6n3VsNGHJ\n"
    b"ZWaMtDmKvI4z/NCBZHmCmh5kDw5wQ1WcNtHRrsPFzBCNFsHZLd1XLZ8f4XRTHOam\n"
    b"YWRR5e9Jn771frbOUNMZKVg60MqMSINwqm97c01IonfcYjw9hbdMrvxUICu6XPtx\n"
    b"WJOFNamK77IHS6qc7d+P/LeBUtSH7MtQ8vwo0FqJNyh8gLQfcyeiZ+pYNi7cqMNu\n"
    b"sZSuEoOXZctDYz5edul+EUNI9wKjldH4Ao/TZjr5emWg/118lzFnnKWO9CSbUMHI\n"
    b"Onhypuz+a5o6tremvN2yIBz4gIU6hvP9gvm5ddsCAwEAATANBgkqhkiG9w0BAQsF\n"
    b"AAOCAQEAhKVWQvSi2wUnTX9fNfwpC9IMrldiNN1n8TU1BXmpVFuhwL5yQqrtgmwv\n"
    b"f43Z1vJCmqOBuRKVvJrSG8WVpnM25mdkIYQieJo5fWvmHL7xCKap28//03fCT6gT\n"
    b"Vz8qy+HDUtck0aUxPWRNyjY0tDcr3hshAOISnIfcDL+e4nOWusxf2DTxGcuO8+e+\n"
    b"PbqPHaBH3cvH1P1StTKXtnxeeh0yebZH6ZZQaDUNkGCgkwoPasBbX48Ox3GTe0nM\n"
    b"9Ab4drudR21uTdq30pPAEv/XVu9vSpUqR7RSfM+gjuFQWYXp1FnQ2id33UJ43BqT\n"
    b"jh+05dMtXp++vZU7qE5Gh7Do2r5rbw==\n"
    b"-----END CERTIFICATE-----\n"
)

cert = x509.load_pem_x509_certificate(PEM_CERT)
assert isinstance(cert, _rust.x509.Certificate)
assert type(cert).__module__ == "cryptography.hazmat.bindings._rust.x509"

# 3. Modern Cipher construction functions without legacy backend parameter
key = bytes(32)
iv = bytes(16)
cipher = Cipher(algorithms.AES(key), modes.CBC(iv))
assert cipher.algorithm.key == key
enc = cipher.encryptor()
ct = enc.update(b"0123456789abcdef") + enc.finalize()
dec = cipher.decryptor()
assert dec.update(ct) + dec.finalize() == b"0123456789abcdef"

# 4. OpenSSL binding layer references the native Rust _openssl module
assert binding_mod._openssl is _rust._openssl
b = Binding()
assert hasattr(b, "ffi") and hasattr(b, "lib")