cryptography should be no longer there, idna and cffi we would need to check.

looks like idna was a requirement of cryptography and requests, cryptography is no longer used, but let me check requests

Looks like idna still is a dependency of requests https://github.com/psf/requests/blob/main/setup.cfg#L6 . I would need to look why it was explicitly added instead of it being an implicit dependency. I recommend we keep that one for now.

And cffi is a dependency of xattr https://github.com/xattr/xattr/blob/main/pyproject.toml#L15

I would need to assess first, the reason for these indirect dependencies were added. Likely due to one of the packaging/environments failing to include them.

Looks like cffi was added for cryptography but this predates the inclusion of xattr 221a298

Idna was explicitly added for requests 8871cd9

I'll work on this a bit more, but here are my thoughts:

• no indirect deps should be present in dependencies.ini and requirements.txt, they may be in some of the CICD files
• given that I removed those 3 and tests passed, we need better tests :-) May be something that uses IDNA url for example

no indirect deps should be present

Unfortunately the "should" here is one of those theory versus reality arguments. They were added because they were needed.

• Given they are used indirectly anyway, they not abundant, we can take the time to take a closer look why they were originally added
• Many things have changed since they were added it could be that they are no longer needed.

we need better tests :-)

tests can always be improved

I am digging around and so far I don't see any direct use of cffi nor idna across the projects even:

• ("from cffi import" OR "import cffi") AND (org:libyal OR org:log2timeline)
• ("from idna import" OR "import idna") AND (org:libyal OR org:log2timeline)

(Disclaimer: The above two ways are the only standard ways to use a Python module, AFAIK)

While dfvfs also lists cffi as direct dep, I see no place where it is used. Based on blame, cffi is a remains of pycrypto->cryptography move 5 years ago (and now cryptography is no longer used). Let me know if we need another issue for this (since different project).

(Disclaimer: The above two ways are the only standard ways to use a Python module, AFAIK)

Python has many "standard" ways of using modules.

I'll have a closer looks when time permits. Maybe this was msi or Pyinstaller related.