Fix Python 3.12+ warnings and add local pytest target

Author: rsgalloway

CHANGELOG.md

@@ -7,6 +7,17 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ---
 
+## [1.0.2] - 2026-04-01
+
+### Changed
+- add a `make pytest` target that installs the package in editable mode before running the test suite
+
+### Fixed
+- remove `return` statements from `finally` blocks in encryption helpers to avoid newer Python `SyntaxWarning`s
+- harden optional `cryptography` imports so missing crypto dependencies do not break exception handling paths
+
+---
+
 ## [1.0.1] - 2026-02-08
 
 ### Fixed

Makefile

@@ -41,6 +41,11 @@ test:
 	$(ENVSTACK_CMD) -- ls -al
 	${ENVSTACK_CMD} -- which python
 
+# Run the pytest suite from an editable install, matching CI behavior
+pytest:
+	python -m pip install -e .
+	pytest tests -q
+
 # Install dryrun target to simulate installation
 dryrun:
 	$(ENVSTACK_CMD) -- dist --dryrun
@@ -51,4 +56,4 @@ install: build
 	dist --force --yes
 
 # Phony targets
-.PHONY: build dryrun install clean
+.PHONY: build dryrun install clean test pytest

lib/envstack/encrypt.py

@@ -44,9 +44,15 @@
 # cryptography and _rust dependency may not be available everywhere
 # ImportError: DLL load failed while importing _rust: Module not found.
 Fernet = None
+InvalidToken = type("InvalidToken", (Exception,), {})
+InvalidTag = type("InvalidTag", (Exception,), {})
+padding = None
+Cipher = None
+algorithms = None
+modes = None
 try:
-    import cryptography.exceptions
     from cryptography.fernet import Fernet, InvalidToken
+    from cryptography.exceptions import InvalidTag
     from cryptography.hazmat.primitives import padding
     from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
 except ImportError as err:
@@ -217,7 +223,7 @@ def encrypt(self, data: str):
             results = compact_store(encrypted_data)
         except binascii.Error as e:
             log.error("invalid base64 encoding: %s", e)
-        except cryptography.exceptions.InvalidTag:
+        except InvalidTag:
             log.error("invalid encryption key")
         except ValueError as e:
             log.error("invalid value: %s", e)
@@ -237,7 +243,7 @@ def decrypt(self, data: str):
             return decrypted.decode()
         except binascii.Error as e:
             log.debug("invalid base64 encoding: %s", e)
-        except cryptography.exceptions.InvalidTag:
+        except InvalidTag:
             log.debug("invalid encryption key")
         except ValueError as e:
             log.debug("invalid value: %s", e)