Pin cryptography to versions compatible with pyopenssl #913

IzerOnadimQC · 2024-12-02T16:48:53Z

Checklist

Used a static YAML file for the patch if possible (instructions).
Only wrote code directly into generate_patch_json.py if absolutely necessary.
Ran pre-commit run -a and ensured all files pass the linting checks.
Ran python show_diff.py and posted the output as part of the PR.
Modifications won't affect packages built in the future.

Diff output

$ python show_diff.py
================================================================================
================================================================================
linux-armv7l
================================================================================
================================================================================
win-32
win-32::pyopenssl-16.2.0-py27_0.tar.bz2
win-32::pyopenssl-16.2.0-py35_0.tar.bz2
win-32::pyopenssl-16.2.0-py36_0.tar.bz2
-    "cryptography >=1.3.4",
+    "cryptography >=1.3.4,<42.0.0a0",
win-32::pyopenssl-17.2.0-py27_0.tar.bz2
win-32::pyopenssl-17.2.0-py35_0.tar.bz2
win-32::pyopenssl-17.2.0-py36_0.tar.bz2
-    "cryptography >=1.9",
+    "cryptography >=1.9,<42.0.0a0",
win-32::pyopenssl-16.0.0-py27_0.tar.bz2
win-32::pyopenssl-16.0.0-py34_0.tar.bz2
win-32::pyopenssl-16.0.0-py35_0.tar.bz2
-    "cryptography >=1.3",
+    "cryptography >=1.3,<42.0.0a0",
win-32::pyopenssl-17.5.0-py27_1.tar.bz2
win-32::pyopenssl-17.5.0-py35_1.tar.bz2
win-32::pyopenssl-17.5.0-py36_1.tar.bz2
-    "cryptography >=2.1.4",
+    "cryptography >=2.1.4,<42.0.0a0",
================================================================================
================================================================================
linux-ppc64le
linux-ppc64le::pyopenssl-19.0.0-py27_0.tar.bz2
linux-ppc64le::pyopenssl-19.0.0-py36_0.tar.bz2
linux-ppc64le::pyopenssl-19.0.0-py37_0.tar.bz2
linux-ppc64le::pyopenssl-19.0.0-py38_0.tar.bz2
-    "cryptography >=2.2.1",
+    "cryptography >=2.2.1,<42.0.0a0",
linux-ppc64le::pyopenssl-19.1.0-py36_0.tar.bz2
linux-ppc64le::pyopenssl-19.1.0-py37_0.tar.bz2
linux-ppc64le::pyopenssl-19.1.0-py38_0.tar.bz2
-    "cryptography >=2.8",
+    "cryptography >=2.8,<42.0.0a0",
================================================================================
================================================================================
linux-aarch64
linux-aarch64::pyopenssl-19.0.0-py27_0.tar.bz2
linux-aarch64::pyopenssl-19.0.0-py36_0.tar.bz2
linux-aarch64::pyopenssl-19.0.0-py37_0.tar.bz2
linux-aarch64::pyopenssl-19.0.0-py38_0.tar.bz2
-    "cryptography >=2.2.1",
+    "cryptography >=2.2.1,<42.0.0a0",
linux-aarch64::pyopenssl-19.1.0-py36_0.tar.bz2
linux-aarch64::pyopenssl-19.1.0-py37_0.tar.bz2
linux-aarch64::pyopenssl-19.1.0-py38_0.tar.bz2
-    "cryptography >=2.8",
+    "cryptography >=2.8,<42.0.0a0",
================================================================================
================================================================================
osx-arm64
================================================================================
================================================================================
noarch
noarch::pyopenssl-21.0.0-pyhd8ed1ab_0.tar.bz2
-    "cryptography >=3.3",
+    "cryptography >=3.3,<42.0.0a0",
noarch::pyopenssl-19.1.0-py_1.tar.bz2
-    "cryptography >=2.8",
+    "cryptography >=2.8,<42.0.0a0",
noarch::pyopenssl-20.0.0-pyhd8ed1ab_0.tar.bz2
noarch::pyopenssl-20.0.1-pyhd8ed1ab_0.tar.bz2
-    "cryptography >=3.2",
+    "cryptography >=3.2,<42.0.0a0",
noarch::bitstring-4.1.0-pyhd8ed1ab_0.conda
-    "bitarray >=2.8.0,<3",
+    "bitarray >=2.8.0",
================================================================================
================================================================================
win-64
win-64::pyopenssl-17.5.0-py27_1.tar.bz2
win-64::pyopenssl-17.5.0-py35_1.tar.bz2
win-64::pyopenssl-17.5.0-py36_1.tar.bz2
-    "cryptography >=2.1.4",
+    "cryptography >=2.1.4,<42.0.0a0",
win-64::pyopenssl-16.0.0-py27_0.tar.bz2
win-64::pyopenssl-16.0.0-py34_0.tar.bz2
win-64::pyopenssl-16.0.0-py35_0.tar.bz2
-    "cryptography >=1.3",
+    "cryptography >=1.3,<42.0.0a0",
win-64::pyopenssl-18.0.0-py27_0.tar.bz2
win-64::pyopenssl-18.0.0-py27_1000.tar.bz2
win-64::pyopenssl-18.0.0-py35_0.tar.bz2
win-64::pyopenssl-18.0.0-py36_0.tar.bz2
win-64::pyopenssl-18.0.0-py36_1000.tar.bz2
win-64::pyopenssl-18.0.0-py37_0.tar.bz2
win-64::pyopenssl-18.0.0-py37_1000.tar.bz2
win-64::pyopenssl-19.0.0-py27_0.tar.bz2
win-64::pyopenssl-19.0.0-py36_0.tar.bz2
win-64::pyopenssl-19.0.0-py37_0.tar.bz2
win-64::pyopenssl-19.0.0-py38_0.tar.bz2
-    "cryptography >=2.2.1",
+    "cryptography >=2.2.1,<42.0.0a0",
win-64::pyopenssl-17.2.0-py27_0.tar.bz2
win-64::pyopenssl-17.2.0-py35_0.tar.bz2
win-64::pyopenssl-17.2.0-py36_0.tar.bz2
-    "cryptography >=1.9",
+    "cryptography >=1.9,<42.0.0a0",
win-64::pyopenssl-16.2.0-py27_0.tar.bz2
win-64::pyopenssl-16.2.0-py35_0.tar.bz2
win-64::pyopenssl-16.2.0-py36_0.tar.bz2
-    "cryptography >=1.3.4",
+    "cryptography >=1.3.4,<42.0.0a0",
win-64::pyopenssl-19.1.0-py27_0.tar.bz2
win-64::pyopenssl-19.1.0-py36_0.tar.bz2
win-64::pyopenssl-19.1.0-py37_0.tar.bz2
win-64::pyopenssl-19.1.0-py38_0.tar.bz2
-    "cryptography >=2.8",
+    "cryptography >=2.8,<42.0.0a0",
================================================================================
================================================================================
osx-64
osx-64::pyopenssl-17.2.0-py27_0.tar.bz2
osx-64::pyopenssl-17.2.0-py35_0.tar.bz2
osx-64::pyopenssl-17.2.0-py36_0.tar.bz2
osx-64::pyopenssl-17.4.0-py27_0.tar.bz2
osx-64::pyopenssl-17.4.0-py35_0.tar.bz2
osx-64::pyopenssl-17.4.0-py36_0.tar.bz2
-    "cryptography >=1.9",
+    "cryptography >=1.9,<42.0.0a0",
osx-64::pyopenssl-16.2.0-py27_0.tar.bz2
osx-64::pyopenssl-16.2.0-py35_0.tar.bz2
osx-64::pyopenssl-16.2.0-py36_0.tar.bz2
-    "cryptography >=1.3.4",
+    "cryptography >=1.3.4,<42.0.0a0",
osx-64::pyopenssl-19.1.0-py27_0.tar.bz2
osx-64::pyopenssl-19.1.0-py36_0.tar.bz2
osx-64::pyopenssl-19.1.0-py37_0.tar.bz2
osx-64::pyopenssl-19.1.0-py38_0.tar.bz2
-    "cryptography >=2.8",
+    "cryptography >=2.8,<42.0.0a0",
osx-64::pyopenssl-18.0.0-py27_0.tar.bz2
osx-64::pyopenssl-18.0.0-py27_1000.tar.bz2
osx-64::pyopenssl-18.0.0-py35_0.tar.bz2
osx-64::pyopenssl-18.0.0-py36_0.tar.bz2
osx-64::pyopenssl-18.0.0-py36_1000.tar.bz2
osx-64::pyopenssl-18.0.0-py37_0.tar.bz2
osx-64::pyopenssl-18.0.0-py37_1000.tar.bz2
osx-64::pyopenssl-19.0.0-py27_0.tar.bz2
osx-64::pyopenssl-19.0.0-py36_0.tar.bz2
osx-64::pyopenssl-19.0.0-py37_0.tar.bz2
osx-64::pyopenssl-19.0.0-py38_0.tar.bz2
-    "cryptography >=2.2.1",
+    "cryptography >=2.2.1,<42.0.0a0",
osx-64::pyopenssl-17.5.0-py27_1.tar.bz2
osx-64::pyopenssl-17.5.0-py35_1.tar.bz2
osx-64::pyopenssl-17.5.0-py36_1.tar.bz2
-    "cryptography >=2.1.4",
+    "cryptography >=2.1.4,<42.0.0a0",
osx-64::pyopenssl-16.0.0-py27_0.tar.bz2
osx-64::pyopenssl-16.0.0-py34_0.tar.bz2
osx-64::pyopenssl-16.0.0-py35_0.tar.bz2
osx-64::pyopenssl-16.0.0-py36_0.tar.bz2
-    "cryptography >=1.3",
+    "cryptography >=1.3,<42.0.0a0",
================================================================================
================================================================================
linux-64
linux-64::pyopenssl-17.2.0-py27_0.tar.bz2
linux-64::pyopenssl-17.2.0-py35_0.tar.bz2
linux-64::pyopenssl-17.2.0-py36_0.tar.bz2
linux-64::pyopenssl-17.4.0-py27_0.tar.bz2
linux-64::pyopenssl-17.4.0-py35_0.tar.bz2
linux-64::pyopenssl-17.4.0-py36_0.tar.bz2
-    "cryptography >=1.9",
+    "cryptography >=1.9,<42.0.0a0",
linux-64::pyopenssl-18.0.0-py27_0.tar.bz2
linux-64::pyopenssl-18.0.0-py27_1000.tar.bz2
linux-64::pyopenssl-18.0.0-py35_0.tar.bz2
linux-64::pyopenssl-18.0.0-py36_0.tar.bz2
linux-64::pyopenssl-18.0.0-py36_1000.tar.bz2
linux-64::pyopenssl-18.0.0-py37_0.tar.bz2
linux-64::pyopenssl-18.0.0-py37_1000.tar.bz2
linux-64::pyopenssl-19.0.0-py27_0.tar.bz2
linux-64::pyopenssl-19.0.0-py36_0.tar.bz2
linux-64::pyopenssl-19.0.0-py37_0.tar.bz2
linux-64::pyopenssl-19.0.0-py38_0.tar.bz2
-    "cryptography >=2.2.1",
+    "cryptography >=2.2.1,<42.0.0a0",
linux-64::pyopenssl-16.0.0-py27_0.tar.bz2
linux-64::pyopenssl-16.0.0-py34_0.tar.bz2
linux-64::pyopenssl-16.0.0-py35_0.tar.bz2
linux-64::pyopenssl-16.0.0-py36_0.tar.bz2
-    "cryptography >=1.3",
+    "cryptography >=1.3,<42.0.0a0",
linux-64::pyopenssl-19.1.0-py27_0.tar.bz2
linux-64::pyopenssl-19.1.0-py36_0.tar.bz2
linux-64::pyopenssl-19.1.0-py37_0.tar.bz2
linux-64::pyopenssl-19.1.0-py38_0.tar.bz2
-    "cryptography >=2.8",
+    "cryptography >=2.8,<42.0.0a0",
linux-64::pyopenssl-17.5.0-py27_1.tar.bz2
linux-64::pyopenssl-17.5.0-py35_1.tar.bz2
linux-64::pyopenssl-17.5.0-py36_1.tar.bz2
-    "cryptography >=2.1.4",
+    "cryptography >=2.1.4,<42.0.0a0",
linux-64::pyopenssl-16.2.0-py27_0.tar.bz2
linux-64::pyopenssl-16.2.0-py35_0.tar.bz2
linux-64::pyopenssl-16.2.0-py36_0.tar.bz2
-    "cryptography >=1.3.4",
+    "cryptography >=1.3.4,<42.0.0a0",

conda-forge-admin · 2024-12-02T16:50:30Z

Hi! This is the friendly automated conda-forge-linting service.

I just wanted to let you know that I linted all conda-recipes in your PR (recipe/meta.yaml) and found it was in an excellent condition.

xhochy · 2024-12-02T20:11:38Z

fyi @conda-forge/cryptography

maresb · 2024-12-02T22:22:19Z

I should have checked more carefully. I opened a duplicate in #918. Either should work. I certainly won't be offended if you close mine. I do the tightening slightly differently, as detailed in #918 (comment).

It would be great to get one of these merged soon, since I suspect this may be causing some fairly widespread breakage.

IzerOnadimQC · 2024-12-02T23:17:52Z

I should have checked more carefully. I opened a duplicate in #918. Either should work. I certainly won't be offended if you close mine. I do the tightening slightly differently, as detailed in #918 (comment).

I'm not overly opinionated on which approach we take - AFAICT your approach would also fix the issue and does not seem overly constraining. The one thing I would say about your approach is that it could probably be made simpler by removing the existing version constraint, and just converting your version_lt to a version version_le, which, if I'm understanding correctly, would cover both cases.

It would be great to get one of these merged soon, since I suspect this may be causing some fairly widespread breakage.

Agreed. Could a member of @conda-forge/core please approve and merge either one?

jakirkham · 2024-12-02T23:55:04Z

@h-vetinari could you please take a look at this PR and PR ( #918 )?

h-vetinari

LGTM

maresb · 2024-12-03T08:40:27Z

After sleeping on this, I think that my pins are slightly better because they are monotone. (With this version there is a very slight risk that the solver finds a local optimum with pyopenssl 21.0.0 and cryptography 41 since pyopenssl 22.0.0 requires cryptography <39.)

I think the comments here are more informative, so I'm going to copy those to my branch in #918.

ocefpaf · 2024-12-03T08:42:17Z

Sorry, I saw #918 first. They are quite similar and thank you both. (I was still investigating this yesterday but this seems to be the right fix.)

maresb · 2024-12-03T08:44:03Z

Thanks @ocefpaf! I will open a new PR with proper attribution to ensure that @IzerOnadimQC's informative comments are preserved.

Pin cryptography to versions compatible with pyopenssl

27ad1fe

IzerOnadimQC marked this pull request as ready for review December 2, 2024 20:08

IzerOnadimQC requested a review from a team as a code owner December 2, 2024 20:08

Merge branch 'main' into pyopenssl-cryptography-compat

8592219

maresb mentioned this pull request Dec 2, 2024

Add upper bound for cryptography #918

Merged

5 tasks

h-vetinari approved these changes Dec 3, 2024

View reviewed changes

This was referenced Dec 3, 2024

AttributeError: module 'lib' has no attribute 'X509_V_FLAG_NOTIFY_POLICY' Open-MSS/MSS#2581

Closed

pinning cryptography Open-MSS/MSS#2582

Closed

jorisvandenbossche mentioned this pull request Dec 3, 2024

CI: avoid bad combination of pyopenssl and cryptography versions pandas-dev/pandas#60462

Closed

ocefpaf closed this Dec 3, 2024

maresb mentioned this pull request Dec 3, 2024

(Comments only) Add more context about cryptography pins in pyopenssl #919

Merged

tsibley mentioned this pull request Dec 3, 2024

CI tests failing since 28 Nov nextstrain/cli#408

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Pin cryptography to versions compatible with pyopenssl #913

Pin cryptography to versions compatible with pyopenssl #913

IzerOnadimQC commented Dec 2, 2024 •

edited

Loading

conda-forge-admin commented Dec 2, 2024

xhochy commented Dec 2, 2024

maresb commented Dec 2, 2024

IzerOnadimQC commented Dec 2, 2024

jakirkham commented Dec 2, 2024

h-vetinari left a comment

maresb commented Dec 3, 2024

ocefpaf commented Dec 3, 2024

maresb commented Dec 3, 2024

Pin cryptography to versions compatible with pyopenssl #913

Pin cryptography to versions compatible with pyopenssl #913

Conversation

IzerOnadimQC commented Dec 2, 2024 • edited Loading

conda-forge-admin commented Dec 2, 2024

xhochy commented Dec 2, 2024

maresb commented Dec 2, 2024

IzerOnadimQC commented Dec 2, 2024

jakirkham commented Dec 2, 2024

h-vetinari left a comment

Choose a reason for hiding this comment

maresb commented Dec 3, 2024

ocefpaf commented Dec 3, 2024

maresb commented Dec 3, 2024

IzerOnadimQC commented Dec 2, 2024 •

edited

Loading