* nit in LICENSE, itself doesn't make sense here

* more cleanup

* New osrandom_engine in C

Inspired by Python/random.c and the old implementation.

Signed-off-by: Christian Heimes <christian@python.org>

* osrandom_engine

* Fix naming bug caused by search 'n replace mistake
* Make it easier to override osrandom auto-detection
* Add engine ctrl and backend API to get implementation from ENGINE

Signed-off-by: Christian Heimes <christian@python.org>

* Better test coverage, documentation, LICENSE

Signed-off-by: Christian Heimes <christian@python.org>

* Coverage is hard.

Signed-off-by: Christian Heimes <christian@python.org>

* * enable win32 check
* read() returns size_t

Signed-off-by: Christian Heimes <christian@python.org>

* Add macOS to spelling list. Remove dead code from header file.

Signed-off-by: Christian Heimes <christian@python.org>

* remove CCRandomGenerateBytes path and update getentropy to work on macOS

This change allows us to test all the engines in our CI:
* getentropy (tested by macOS sierra)
* getrandom (tested on several linux builders)
* /dev/urandom (tested on FreeBSD, OS X 10.11 and below, & older linux)
* CryptGenRandom (tested on windows builders)

I also fixed bugs preventing compilation in the getentropy code

* getentropy() returns int and is restricted to 256 bytes on macOS, too.

Signed-off-by: Christian Heimes <christian@python.org>

* add versionadded

* Re-add import of os module

* Fixes related to Alex's recent review.

Signed-off-by: Christian Heimes <christian@python.org>

* Add error reporting and fail for EAGAIN

Add error reporting strings for various error cases. This gives us much
nicer and understandable error messages.

SYS_getrandom() EAGAIN is now an error. Cryptography refuses to
initialize its osrandom engine when the Kernel's CPRNG hasn't been
seeded yet.

Signed-off-by: Christian Heimes <christian@python.org>

* Remove Python OpenSSL locking callback and replace it with one in C

The Python OpenSSL locking callback is unsafe; if GC is triggered
during the callback's invocation, it can result in the callback being
invoked reentrantly, which can lead to deadlocks. This patch replaces
it with one in C that gets built at compile time via cffi along with
the rest of the OpenSSL binding.

* fixes for some issues

* unused

* revert these changes

* these two for good measure

* missing param

* sigh, syntax

* delete tests that assumed an ability to mess with locks

* style fixes

* licensing stuff

* utf8

* Unicode. Huh. What it isn't good for, absolutely nothing.

from OpenTLS.