I've had my own run-ins with issues surrounding trying to use Cryptography and hitting compile troubles. A few months back I made a source distribution (sdist)

I've had my own run-ins with issues surrounding trying to use Cryptography and hitting compile troubles. A few months back I made a source distribution (sdist) of an internal Python module using Poetry and tried building an Alpine-based container that used it. Because I made a sdist, installing it required Poetry to "compile", and Poetry has a dependency chain down to Cryptography. Because Python/PyPi doesn't support musl-compiled native libraries, I found myself having to install a several hundred MB toolchain to basically copy a Python script to the correct location. I think Poetry now ships a stripped down version of its build engine that doesn't have this dependency so problem solved-ish. Admittedly I haven't looked at the Cryptography code base to see how much it depends on native code but I wish people made a conscious effort to consider the downstream ramifications of including a particular dependency. I am the maintainer of a quasi-popular JavaScript library and I deliberately wrote my own helper functions for things like base64/UTF-8 conversion just to avoid potential issues (it's been around since 2008 so JavaScript was also a hot mess at the time).