A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

I haven't removed the _sha3 and _blake2 modules yet on purpose. I recommend that we wait two releases and drop them in 3.12.

I haven't removed the _sha3 and _blake2 modules yet on purpose. I recommend that we wait two releases and drop them in 3.12.

It may be prudent enough, but it's worth documenting this somewhere :)
Based on #24601 (comment) I thought that you didn't have any arguments against dropping _sha3 in 3.10.

I would like to remove a lot of stuff from the stdlib. That doesn't mean it's a good idea to remove it. :)

PEP 644 is deliberately vague and says

Python could drop the builtin implementation.

Please notice that is says could, not will, shell, or should. There are backwards compatibility implications with the removal of the builtin code.

I would like to remove a lot of stuff from the stdlib. That doesn't mean it's a good idea to remove it. :)

😄

PEP 644 is deliberately vague and says

Python could drop the builtin implementation.

Please notice that is says could, not will, shell, or should. There are backwards compatibility implications with the removal of the builtin code.

It does say "Python's internal copy of the Keccak Code Package and the internal _sha3 module will be removed."

This PR is stale because it has been open for 30 days with no activity.

Greg and I came to the conclusion that the hashlib module must provide sha3 even when Python is built without OpenSSL. In bpo-47098 GH-32060 I replaced the large KCP with a tiny implementation.