Tests fail on macOS ARM

[jaraco]

When I run the tests on my local machine, they fail with this error:

 jaraco.crypto main @ tox -- -x
.pkg: _optional_hooks> python /Users/jaraco/.local/pipx/venvs/tox/lib/python3.11/site-packages/pyproject_api/_backend.py True setuptools.build_meta
.pkg: get_requires_for_build_editable> python /Users/jaraco/.local/pipx/venvs/tox/lib/python3.11/site-packages/pyproject_api/_backend.py True setuptools.build_meta
.pkg: build_editable> python /Users/jaraco/.local/pipx/venvs/tox/lib/python3.11/site-packages/pyproject_api/_backend.py True setuptools.build_meta
py: install_package> python -I -m pip install --force-reinstall --no-deps /Users/jaraco/code/jaraco/jaraco.crypto/.tox/.tmp/package/35/jaraco.crypto-3.1.1.dev7+gd7dae33-0.editable-py3-none-any.whl
py: commands[0]> pytest -x
=============================================================== test session starts ===============================================================
platform darwin -- Python 3.11.4, pytest-7.4.0, pluggy-1.2.0
cachedir: .tox/py/.pytest_cache
rootdir: /Users/jaraco/code/jaraco/jaraco.crypto
configfile: pytest.ini
plugins: black-0.3.12, checkdocs-2.10.1, mypy-0.10.3, cov-4.1.0, enabler-2.3.1, ruff-0.1.1
collected 100 items                                                                                                                               

conftest.py ...s                                                                                                                            [  4%]
. .                                                                                                                                         [  5%]
docs/conf.py ..s                                                                                                                            [  8%]
jaraco/crypto/__init__.py ..s                                                                                                               [ 11%]
jaraco/crypto/cipher.py ...                                                                                                                 [ 14%]
jaraco/crypto/digest.py ...                                                                                                                 [ 17%]
jaraco/crypto/evp.py ...                                                                                                                    [ 20%]
jaraco/crypto/rand.py ..s                                                                                                                   [ 23%]
jaraco/crypto/support.py ...                                                                                                                [ 26%]
jaraco/crypto/itsdangerous/__init__.py ..s                                                                                                  [ 29%]
jaraco/crypto/itsdangerous/compat.py .....                                                                                                  [ 34%]
jaraco/crypto/tests/__init__.py ..s                                                                                                         [ 37%]
jaraco/crypto/tests/test_cipher.py ..........................F

==================================================================== FAILURES =====================================================================
____________________________________________________________ test_cipher[data_parts0] _____________________________________________________________

data_parts = ('', '', '')

    @pytest.mark.parametrize(
        'data_parts', [('a' * i, 'b' * i, 'c' * i) for i in range(0, 1000, 50)]
    )
    def test_cipher(data_parts):
        """
        Encrypt and decrypt the data_parts supplied and ensure the source
        matches the result.
        """
        key = '11111111111111111111111111111111'
        iv = '1111111111111111'
        params = ('AES-256', 'CBC'), key, iv
        ce = cipher.Cipher(*params)
        list(map(ce.update, data_parts))
>       data_enc = ce.finalize()

jaraco/crypto/tests/test_cipher.py:37: 
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

self = <jaraco.crypto.cipher.Cipher object at 0x112b131d0>, data = None

    def finalize(self, data=None):
        if data is not None:
            self.update(data)
        self.finalized = True
        out = ctypes.create_string_buffer(evp.MAX_BLOCK_LENGTH)
        out_len = ctypes.c_int()
        res = evp.CipherFinal_ex(self, out, out_len)
        if res != 1:
>           raise CipherError("Error finalizing cipher")
E           jaraco.crypto.cipher.CipherError: Error finalizing cipher

jaraco/crypto/cipher.py:107: CipherError

---------- coverage: platform darwin, python 3.11.4-final-0 ----------
Name                                     Stmts   Miss  Cover   Missing
----------------------------------------------------------------------
conftest.py                                  5      0   100%
docs/conf.py                                11      0   100%
jaraco/crypto/__init__.py                    0      0   100%
jaraco/crypto/cipher.py                     78     11    86%   34, 50, 59, 66, 71, 88, 96, 101, 108-110
jaraco/crypto/digest.py                     45     28    38%   16-19, 27, 30, 33-36, 39-45, 48-60
jaraco/crypto/evp.py                        45      0   100%
jaraco/crypto/itsdangerous/__init__.py       0      0   100%
jaraco/crypto/itsdangerous/compat.py        19      2    89%   22-23
jaraco/crypto/rand.py                       33     21    36%   16-23, 27-31, 39-47
jaraco/crypto/support.py                    24      7    71%   8-15
jaraco/crypto/tests/__init__.py              0      0   100%
jaraco/crypto/tests/test_cipher.py          23      2    91%   38-39
jaraco/crypto/tests/test_digest.py          16     10    38%   9, 14, 18-25
jaraco/crypto/tests/test_rand.py            20     15    25%   7-9, 13-15, 19-27
jaraco/crypto/tests/test_threads.py         19     11    42%   11-17, 21-25, 29
----------------------------------------------------------------------
TOTAL                                      338    107    68%

====================================================================== mypy =======================================================================
Success: no issues found in 15 source files
============================================================= short test summary info =============================================================
FAILED jaraco/crypto/tests/test_cipher.py::test_cipher[data_parts0] - jaraco.crypto.cipher.CipherError: Error finalizing cipher
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! stopping after 1 failures !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
===================================================== 1 failed, 57 passed, 6 skipped in 7.87s =====================================================
py: exit 1 (8.53 seconds) /Users/jaraco/code/jaraco/jaraco.crypto> pytest -x pid=41008
.pkg: _exit> python /Users/jaraco/.local/pipx/venvs/tox/lib/python3.11/site-packages/pyproject_api/_backend.py True setuptools.build_meta
  py: FAIL code 1 (9.39=setup[0.86]+cmd[8.53] seconds)
  evaluation failed :( (9.46 seconds)

Tests pass in CI, so I suspect the difference is ARM.

[jaraco]

Tests pass on Windows for ARM (with OpenSSL 3.1 for ARM and Python 3.12 for ARM), so it's not a simple issue of architecture.

[jaraco]

After enhancing the error message, the cause is more apparent:

jaraco.crypto.cipher.CipherError: Error finalizing cipher: error:1C80006B:Provider routines::wrong final block length

Switching to openssl 1.1, the error message is different but the same:

jaraco.crypto.cipher.CipherError: Error finalizing cipher: error:0606506D:digital envelope routines:EVP_DecryptFinal_ex:wrong final block length

[jaraco]

Wait, what? The routine is encrypting, but the error message mentions DecryptFinal. That's suspiciously similar to openssl/openssl#21439.

[jaraco]

After posting openssl/openssl#21709, I quickly tracked down the cause. It's the lack of a specification for the enc parameter to EVP_CipherInit_ex.

I've filed python/cpython#107844 to track the apparent foot gun that this issue revealed.