Allow for the cryptography package to not be installed (use thick mode)

Author: anthony-tuininga

doc/src/release_notes.rst

@@ -30,6 +30,11 @@ Thin Mode Changes
     when connecting to a database that the listener configuration file states
     exists but actually doesn't
     (`issue 51 <https://github.com/oracle/python-oracledb/issues/51>`__).
+#)  The error `DPY-3016: python-oracledb thin mode cannot be used because the
+    cryptography package is not installed` is now raised when the cryptography
+    package is not installed, instead of an ImportError. This allows platforms
+    that are not capable of building the cryptography package to still use
+    Thick mode.
 #)  Fixed bug that prevented the `full_code` attribute from being populated on
     the errors returned by :func:`Cursor.getbatcherrors()`.
 
@@ -51,7 +56,7 @@ Common Changes
     via the new parameter `access_token` to :func:`oracledb.connect()` and
     :func:`oracledb.create_pool()`.
 #)  Added method :func:`oracledb.is_thin_mode()` to support determining whether
-    the driver is using thin mode or not
+    the driver is using Thin mode or not
     (`issue 16 <https://github.com/oracle/python-oracledb/issues/10>`__).
 #)  Improved samples and documentation.
 

doc/src/user_guide/installation.rst

@@ -158,7 +158,9 @@ To use python-oracledb, you need:
 
 - The Python cryptography package. This package is automatically installed as a
   dependency of python-oracledb.  It is strongly recommended that you keep the
-  cryptography package up to date whenever new versions are released.
+  cryptography package up to date whenever new versions are released.  If the
+  cryptography package is not available, you can still install python-oracledb
+  but can only use it in Thick mode, see :ref:`nocrypto`.
 
 - Optionally, Oracle Client libraries can be installed to enable some additional
   advanced functionality. These can be from the free `Oracle Instant Client
@@ -745,6 +747,29 @@ offline computer and install it with::
 Then follow the general python-oracledb platform installation instructions
 to install Oracle client libraries.
 
+.. _nocrypto:
+
+Installing python-oracledb without the Cryptography Package
+===========================================================
+
+If the Python cryptography package is not available, python-oracledb can still
+be installed but can only be used in Thick mode.
+
+To install without the cryptography package, use pip's ``--no-deps`` option,
+for example:
+
+.. code-block:: python
+
+    python -m pip install oracledb --no-deps
+
+Oracle Client libraries must then be installed.  See previous sections.
+
+To use python-oracledb in Thick mode you must call
+:meth:`oracledb.init_oracle_client()` in your application, see
+:ref:`enablingthick`.  Without this, your application will get the error
+``DPY-3016: python-oracledb thin mode cannot be used because the cryptography
+package is not installed``.
+
 Installing from Source Code
 ===========================
 
@@ -803,7 +828,7 @@ used to install into a local directory::
     python setup.py install --user
 
 Troubleshooting
-================
+===============
 
 If installation fails:
 

src/oracledb/errors.py

@@ -183,6 +183,7 @@ def _raise_from_string(exc_type: Exception, message: str) -> None:
 ERR_UNSUPPORTED_PYTHON_TYPE_FOR_VAR = 3013
 ERR_LOB_OF_WRONG_TYPE = 3014
 ERR_UNSUPPORTED_VERIFIER_TYPE = 3015
+ERR_NO_CRYPTOGRAPHY_PACKAGE = 3016
 
 # error numbers that result in DatabaseError
 ERR_TNS_ENTRY_NOT_FOUND = 4000
@@ -392,6 +393,9 @@ def _raise_from_string(exc_type: Exception, message: str) -> None:
             'no configuration directory to search for tnsnames.ora',
     ERR_NO_CREDENTIALS:
             'no credentials specified',
+    ERR_NO_CRYPTOGRAPHY_PACKAGE:
+            'python-oracledb thin mode cannot be used because the '
+            'cryptography package is not installed',
     ERR_NO_STATEMENT:
             'no statement specified and no prior statement prepared',
     ERR_NO_STATEMENT_EXECUTED:

src/oracledb/impl/thin/connection.pyx

@@ -67,6 +67,8 @@ cdef class ThinConnImpl(BaseConnImpl):
         str _cclass
 
     def __init__(self, str dsn, ConnectParamsImpl params):
+        if not HAS_CRYPTOGRAPHY:
+            errors._raise_err(errors.ERR_NO_CRYPTOGRAPHY_PACKAGE)
         BaseConnImpl.__init__(self, dsn, params)
         self._protocol = Protocol()
 

src/oracledb/impl/thin/crypto.pyx

@@ -29,11 +29,15 @@
 # (embedded in thin_impl.pyx).
 #------------------------------------------------------------------------------
 
-from cryptography import x509
-from cryptography.hazmat.primitives import hashes, serialization
-from cryptography.hazmat.primitives.ciphers import algorithms, modes, Cipher
-from cryptography.hazmat.primitives.asymmetric import padding
-from cryptography.hazmat.primitives.kdf import pbkdf2
+try:
+    from cryptography import x509
+    from cryptography.hazmat.primitives import hashes, serialization
+    from cryptography.hazmat.primitives.ciphers import algorithms, modes, Cipher
+    from cryptography.hazmat.primitives.asymmetric import padding
+    from cryptography.hazmat.primitives.kdf import pbkdf2
+except ImportError:
+    HAS_CRYPTOGRAPHY = False
+
 
 DN_REGEX = '(?:^|,\s?)(?:(?P<name>[A-Z]+)=(?P<val>"(?:[^"]|"")+"|[^,]+))+'
 PEM_WALLET_FILE_NAME = "ewallet.pem"

src/oracledb/impl/thin/pool.pyx

@@ -52,6 +52,8 @@ cdef class ThinPoolImpl(BasePoolImpl):
         bint _open
 
     def __init__(self, str dsn, PoolParamsImpl params):
+        if not HAS_CRYPTOGRAPHY:
+            errors._raise_err(errors.ERR_NO_CRYPTOGRAPHY_PACKAGE)
         params._check_credentials()
         self.connect_params = params
         self.username = params.user

src/oracledb/thin_impl.pyx

@@ -85,6 +85,8 @@ from .var import Var
 
 ctypedef unsigned char char_type
 
+cdef bint HAS_CRYPTOGRAPHY = True
+
 include "impl/thin/constants.pxi"
 include "impl/thin/utils.pyx"
 include "impl/thin/crypto.pyx"