🚀 v0.2.1: Add native Python support for SHA256 MySQL authentication methods

[codebydivine]

🎯 Summary

This PR adds native Python support for SHA256-based MySQL authentication methods (sha256_password and caching_sha2_password) without requiring the cryptography package. This addresses critical deployment scenarios where cryptography is unavailable or problematic.

⚡ Problem Solved

Previously, aiomysql would fail with this error when using modern MySQL authentication:

Failed to initialize database pool: 'cryptography' package is required for sha256_password or caching_sha2_password auth methods

🔥 Why This Matters

Critical Use Cases Enabled:

• 🐍 No-GIL Python: Cryptography package currently doesn't work with No-GIL Python and likely won't in the near future
• 🔒 Restricted Environments: Corporate/secure environments where cryptography cannot be downloaded or installed
• 📦 Lightweight Deployments: Lambda functions, containers, and edge deployments preferring minimal dependencies
• 🚢 Air-gapped Systems: Isolated systems without access to compiled dependencies

✨ What's New

Core Implementation:

• aiomysql/_auth_native.py - Complete native authentication implementation (322 lines)

  • Native RSA encryption using Python standard library
  • PKCS#1 v1.5 padding implementation
  • PEM public key parsing with ASN.1 DER support
  • Password scrambling for mysql_native_password and caching_sha2_password

• aiomysql/connection.py - Safe fallback integration

  • _safe_rsa_encrypt() function with automatic fallback
  • Updated all authentication methods to use native implementations
  • Maintains 100% backward compatibility

Testing:

• tests/test_auth_native.py - Comprehensive unit tests (290 lines, 9 test classes)
  • Full compatibility testing with PyMySQL reference implementation
  • Edge case coverage and integration tests
  • Real-world MySQL server validation

🔧 Technical Details

Supported Authentication Methods:

• ✅ mysql_native_password - Traditional MySQL authentication
• ✅ caching_sha2_password - MySQL 8.0+ default (with native RSA)
• ✅ sha256_password - SHA256-based authentication (with native RSA)
• ✅ mysql_clear_password - Clear text authentication

Security Features:

• 🛡️ PKCS#1 v1.5 padding - Proper RSA encryption padding
• 🔐 Cryptographically secure random padding - Uses os.urandom()
• 🎯 Same security level as cryptography package implementation
• ✅ Key validation and edge case handling

🧪 Testing & Validation

Real-World Testing:

• ✅ MySQL Server 8.0.39-30: Successfully tested with real server
• ✅ Authentication Method: caching_sha2_password working natively
• ✅ Clean Environment: Verified in environment without cryptography
• ✅ Query Operations: Full database functionality confirmed

Compatibility Testing:

• ✅ PyMySQL Reference: 100% match with reference implementation
• ✅ Backward Compatibility: All existing code works unchanged
• ✅ No Regressions: Comprehensive regression testing passed
• ✅ Connection Pooling: Pool operations work with native auth

📈 Performance & Benefits

Deployment Benefits:

• 🎯 Zero Code Changes: Drop-in replacement, automatic fallback
• 📦 Reduced Dependencies: Can eliminate cryptography package entirely
• 🚀 Faster Cold Starts: Smaller package size for serverless deployments
• 💪 Better Reliability: Fewer dependency conflicts and build issues

Performance:

• ⚡ Efficient: Uses optimized Python built-ins (pow() for modular exponentiation)
• 🧠 Memory Conscious: Proper cleanup of sensitive data
• 🔄 Minimal Overhead: Only computes what's necessary

🔄 Migration Path

For Existing Users:

# No changes needed - works automatically\!
import aiomysql  # cryptography package now optional

conn = await aiomysql.connect(
    host='your_host',
    user='your_user', 
    password='your_password',
    auth_plugin='caching_sha2_password'  # Works natively\!
)

Installation Options:

# Option 1: Native only (recommended for new deployments)
pip install aiomysql  # No cryptography needed

# Option 2: With fallback (existing deployments)  
pip install aiomysql cryptography  # Uses native when cryptography fails

# Option 3: Upgrade path
pip uninstall cryptography  # Optional - remove if only used for MySQL
# Your code continues working with native implementation

📋 Changes Included

Files Added:

• aiomysql/_auth_native.py - Native authentication implementation
• tests/test_auth_native.py - Comprehensive test suite

Files Modified:

• aiomysql/connection.py - Safe fallback integration
• CHANGES.txt - Version 0.2.1 changelog

Version:

• Bumped to v0.2.1 with proper semantic versioning
• Git tag created: v0.2.1

🎭 Backward Compatibility

• ✅ 100% Compatible: No breaking changes
• ✅ Automatic Fallback: Uses cryptography if available, native if not
• ✅ Same API: All existing function signatures unchanged
• ✅ Same Behavior: Identical authentication flow and error handling

🚀 Ready for Production

This implementation has been:

• ✅ Thoroughly tested with real MySQL servers
• ✅ Validated for compatibility with PyMySQL reference
• ✅ Verified for security with proper cryptographic practices
• ✅ Checked for regressions with comprehensive test suite

This PR enables aiomysql to work in previously impossible deployment scenarios while maintaining full compatibility and security. 🎉

---

Closes: Issues related to cryptography dependency requirements
Enables: No-GIL Python, restricted environments, lightweight deployments
Version: v0.2.1

[codebydivine]

Python 3.7 support removed and build got fixed. Feel free to merge and publish!