Hi, I have a PR ready to go for this. But, I wanted to check in before I sprang it on you, this being my first contribution. It brings the PyO3 version up to 0.23.4 from 0.18.0.

develop...surfingreg:securedrop:develop-bump-pyo3-version

The Rust tests pass. I'm less confident about what will happen outside Rust. Mainly because, in alignment with the newer pyo3 API, I changed the signature for redwood() (https://pyo3.rs/v0.23.4/function.html)...

from:
fn redwood(py: Python, m: &PyModule) -> PyResult<()>

to: 
fn redwood(m: &Bound<'_, PyModule>) -> PyResult<()>

pyo3 migration ref:
https://pyo3.rs/v0.23.4/migration.html?highlight=pybytes#to-python-conversions-changed-for-byte-collections-vec-u8-n-and-smallvec

It does also bump us past this, though it doesn't appear relevant(?).
https://rustsec.org/advisories/RUSTSEC-2024-0409.html

Thoughts? Thanks!
Greg

Hi @surfingreg! Thanks for working on this.

I'm less confident about what will happen outside Rust.

The Python application tests should be comprehensive enough if you want to run it locally or in CI. As long as it's exporting roughly the same thing, it should just work.

It does also bump us past this, though it doesn't appear relevant(?).
https://rustsec.org/advisories/RUSTSEC-2024-0409.html

That seems to be a regression in 0.23.0, so we weren't affected. Probably wouldn't have affected us too bad since we only have one version of Python installed in the environment where we build packages.