From 7d89ab199e169cf81c63e7772295f3527370447f Mon Sep 17 00:00:00 2001
From: The MMGen Project <mmgen@tuta.io>
Date: Sat, 15 Aug 2026 14:13:08 +0000
Subject: [PATCH] make `ecdsa` and `pexpect` packages testing-only

---
 mmgen/proto/cosmos/tx/protobuf.py |  4 ++++
 setup.cfg                         |  2 --
 test/modtest_d/dep.py             | 11 -----------
 test/modtest_d/testdep.py         | 11 +++++++++++
 4 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/mmgen/proto/cosmos/tx/protobuf.py b/mmgen/proto/cosmos/tx/protobuf.py
index 90c24ef2..370e48b5 100755
--- a/mmgen/proto/cosmos/tx/protobuf.py
+++ b/mmgen/proto/cosmos/tx/protobuf.py
@@ -150,6 +150,10 @@ class Tx(BaseMessage):
 				if not verify_sig(sig, msghash, pubkey):
 					raise ValueError('signature verification failed')
 			case 'ecdsa':
+				import os
+				if not os.getenv('MMGEN_TEST_SUITE'):
+					from ....util import die
+					die(3, 'The `ecdsa` package is unsafe and may be used only in a testing environment')
 				# ecdsa.keys.VerifyingKey.verify_digest():
 				#   raises BadSignatureError if the signature is invalid or malformed
 				import ecdsa
diff --git a/setup.cfg b/setup.cfg
index b06bce52..1bb88286 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -61,10 +61,8 @@ install_requires =
 	gmpy2
 	cryptography
 	pynacl
-	ecdsa
 	aiohttp
 	requests
-	pexpect
 	lxml
 	scrypt
 	semantic-version; platform_system != "Windows" # scripts/create-token.py
diff --git a/test/modtest_d/dep.py b/test/modtest_d/dep.py
index 473490a8..0c561e4c 100755
--- a/test/modtest_d/dep.py
+++ b/test/modtest_d/dep.py
@@ -79,12 +79,6 @@ class unit_tests:
 		Crypto(cfg).encrypt_aes_ctr(b'deadbeef' * 4, b'deadbeef' * 2, b'foo')
 		return True
 
-	def ecdsa(self, name, ut):
-		import ecdsa
-		pko = ecdsa.SigningKey.from_secret_exponent(12345678901234, curve=ecdsa.SECP256k1)
-		pko.get_verifying_key().to_string().hex()
-		return True
-
 	def ripemd160(self, name, ut):
 		import hashlib
 		if hashlib.new.__name__ == 'hashlib_new_wrapper':
@@ -109,11 +103,6 @@ class unit_tests:
 		asyncio.run(do())
 		return True
 
-	def pexpect(self, name, ut):
-		import pexpect
-		from pexpect.popen_spawn import PopenSpawn
-		return True
-
 	def scrypt(self, name, ut):
 		passwd, salt = b'foo', b'bar'
 		N, r, p = 4, 8, 16
diff --git a/test/modtest_d/testdep.py b/test/modtest_d/testdep.py
index cdf2c7d0..565e598a 100755
--- a/test/modtest_d/testdep.py
+++ b/test/modtest_d/testdep.py
@@ -45,6 +45,17 @@ class unit_tests:
 		network.address.for_p2pkh_wit(hash160_c)
 		return True
 
+	def ecdsa(self, name, ut):
+		import ecdsa
+		pko = ecdsa.SigningKey.from_secret_exponent(12345678901234, curve=ecdsa.SECP256k1)
+		pko.get_verifying_key().to_string().hex()
+		return True
+
+	def pexpect(self, name, ut):
+		import pexpect
+		from pexpect.popen_spawn import PopenSpawn
+		return True
+
 	def monero_python(self, name, ut):
 		from mmgen.util2 import load_cryptodome
 		load_cryptodome()