fix(deps): make cryptography an optional test dependency

.github/workflows/build.yml

@@ -272,7 +272,8 @@ jobs:
       - name: Install wheel for testing
         run: |
           source venv/bin/activate
-          pip install dist/c2pa_python-*.whl
+          # `[test]` extra pulls cryptography for the callback-signer tests.
+          pip install "$(ls dist/c2pa_python-*.whl)[test]"
 
       - name: Run unittest tests on installed wheel
         run: |
@@ -372,8 +373,8 @@ jobs:
           .\venv\Scripts\activate
           $wheel = Get-ChildItem -Path dist -Filter "c2pa_python-*.whl" | Select-Object -First 1
           if (-not $wheel) { Write-Error "No wheel file found in dist directory"; exit 1 }
-          pip install $wheel.FullName
-          pip install -r requirements.txt
+          # `[test]` extra pulls cryptography for the callback-signer tests.
+          pip install "$($wheel.FullName)[test]"
           pip install pytest
 
       - name: Run tests with pytest (venv)
@@ -453,7 +454,8 @@ jobs:
       - name: Install wheel for testing
         run: |
           source venv/bin/activate
-          pip install dist/c2pa_python-*.whl
+          # `[test]` extra pulls cryptography for the callback-signer tests.
+          pip install "$(ls dist/c2pa_python-*.whl)[test]"
 
       - name: Run unittest tests on installed wheel
         run: |

pyproject.toml

@@ -23,10 +23,16 @@ maintainers = [
 urls = {homepage = "https://contentauthenticity.org", repository = "https://github.com/contentauth/c2pa-python"}
 dependencies = [
     "toml>=0.10.2",
-    "cryptography>=41.0.0",
     "requests>=2.0.0"
 ]
 
+# `cryptography` is only used by the tests/examples (callback signers), not by
+# the runtime bindings, so it is a test-only extra rather than an install dep.
+[project.optional-dependencies]
+test = [
+    "cryptography>=41.0.0"
+]
+
 [project.scripts]
 download-artifacts = "c2pa.build:download_artifacts"
 

requirements.txt

@@ -1,2 +1,2 @@
-# only used in the training example
-cryptography>=47.0.0
+# Runtime has no pure-Python pip dependencies (crypto lives in the native lib).
+# `cryptography` is a test-only extra: see pyproject.toml / requirements-dev.txt.