python37Packages.cryptography: 2.5 -> 2.6.1 #56690

primeos · 2019-03-02T11:27:20Z

Motivation for this change

Things done

dtzWill

LGTM!

Looking at changelog for 2.6.1, this also helps use OpenSSL 1.1.x goodness once we switch over!

worldofpeace · 2019-03-30T16:14:46Z

@FRidh @dotlambda

Is this good for merge into staging?

FRidh · 2019-03-31T07:45:08Z

I have not yet run a job on Hydra as it's already overloaded with the release branch and such. I intend to run a job a week or so after the release, although actually I think everything will be fine.

worldofpeace · 2019-03-31T15:04:36Z

I have not yet run a job on Hydra as it's already overloaded with the release branch and such. I intend to run a job a week or so after the release, although actually I think everything will be fine.

Ah I see, you think it should be fine. But if there's any problems a hydra job would reveal it would probably be a good idea 👍

Thanks.

eadwu · 2019-04-20T21:43:09Z

pkgs/development/python-modules/cryptography/default.nix

  };

  outputs = [ "out" "dev" ];

-  buildInputs = [ openssl cryptography_vectors ]
+  buildInputs = [ openssl ]


Should openssl be pointed towards openssl_1_1? At least for sourcehut to work support for ed25519 is needed which isn't provided by the default openssl.

File "/nix/store/jszvzjmq5nx90dlw8d80hcyfwzzqzj7p-python3.7-cryptography-2.6.1/lib/python3.7/site-packages/cryptography/hazmat/primitives/asymmetric/ed25519.py", line 63, in from_private_bytes _Reasons.UNSUPPORTED_PUBLIC_KEY_ALGORITHM cryptography.exceptions.UnsupportedAlgorithm: ed25519 is not supported by this version of OpenSSL.

dtzWill · 2019-04-22T01:44:57Z

On Sat, 20 Apr 2019 14:43:16 -0700, Edmund Wu ***@***.***> wrote: Should `openssl` be pointed towards `openssl_1_1`? At least for `sourcehut` to work support for `ed25519` is needed which isn't provided by the default `openssl`.

Sounds good to me-- while we're at it, when can we make this the default?

…

``` File "/nix/store/jszvzjmq5nx90dlw8d80hcyfwzzqzj7p-python3.7-cryptography-2.6.1/lib/python3.7/site-packages/cryptography/hazmat/primitives/asymmetric/ed25519.py", line 63, in from_private_bytes _Reasons.UNSUPPORTED_PUBLIC_KEY_ALGORITHM cryptography.exceptions.UnsupportedAlgorithm: ed25519 is not supported by this version of OpenSSL. ``` -- You are receiving this because you commented. Reply to this email directly or view it on GitHub: #56690 (review) part: text/html

primeos · 2019-04-22T10:23:35Z

@eadwu @dtzWill I would prefer to change the OpenSSL version in another PR, optimally in #22357, to avoid the risk of breaking too many things at once and test it more extensively.

This PR is open for way too long now and should be pretty safe to merge (I'm not aware of any problems due to past updates of cryptography - apart from a few warning messages).
I'll run a few rebuilds and merge this if there aren't any problems (though I am not sure how useful that actually is as most failures would probably occur at runtime - apart from failures due to pinned versions, but that wasn't a problem in the past and shouldn't have changed).

This should make the management easier. The package cryptography_vectors contains the test vectors for cryptography and should therefore always have the same version. By linking the version of cryptography_vectors to cryptography, this simply cannot be forgotten.

Changelog: https://cryptography.io/en/latest/changelog/#v2-6-1 Important changes: - BACKWARDS INCOMPATIBLE: Removed cryptography.hazmat.primitives.asymmetric.utils.encode_rfc6979_signature and cryptography.hazmat.primitives.asymmetric.utils.decode_rfc6979_signature, which had been deprecated for nearly 4 years. Use encode_dss_signature() and decode_dss_signature() instead. - BACKWARDS INCOMPATIBLE: Removed cryptography.x509.Certificate.serial, which had been deprecated for nearly 3 years. Use serial_number instead.

dtzWill · 2019-04-22T14:05:06Z

On Mon, 22 Apr 2019 03:23:42 -0700, Michael Weiss ***@***.***> wrote: @eadwu @dtzWill I would prefer to change the OpenSSL version in another PR, optimally in #22357, to avoid the risk of breaking too many things at once and test it more extensively.

Oh, absolutely! I was just ... chatting about how we might want to do it in general :). Agreed that's a fight for a different PR.

…

This PR is open for way too long now and should be pretty safe to merge (I'm not aware of any problems due to past updates of `cryptography` - apart from a few warning messages). I'll run a few rebuilds and merge this if there aren't any problems (though I am not sure how useful that actually is as most failures would probably occur at runtime - apart from failures due to pinned versions, but that wasn't a problem in the past and shouldn't have changed). -- You are receiving this because you were mentioned. Reply to this email directly or view it on GitHub: #56690 (comment) part: text/html

primeos · 2019-04-23T14:26:09Z

Ok, great - yeah it's really time to switch to OpenSSL 1.1 in general...

I ran most rebuilds and didn't notice any failures that are related to this PR and this update should be fine :)

worldofpeace · 2019-04-23T14:27:52Z

❇️ 🎆

primeos requested a review from FRidh as a code owner March 2, 2019 11:27

GrahamcOfBorg added 6.topic: python 10.rebuild-darwin: 501+ 10.rebuild-darwin: 5001+ 10.rebuild-linux: 501+ 10.rebuild-linux: 5001+ labels Mar 2, 2019

FRidh self-assigned this Mar 2, 2019

dtzWill approved these changes Mar 7, 2019

View reviewed changes

worldofpeace approved these changes Mar 30, 2019

View reviewed changes

infinisil added the 8.has: package (update) label Mar 30, 2019

worldofpeace mentioned this pull request Apr 13, 2019

pythonPackages.cryptography{,_vectors}: 2.5 -> 2.6.1 #59426

Closed

10 tasks

eadwu mentioned this pull request Apr 14, 2019

sourcehut: init #54425

Merged

10 tasks

eadwu reviewed Apr 20, 2019

View reviewed changes

primeos force-pushed the python-cryptography branch from bdbfd56 to 90509b8 Compare April 22, 2019 10:12

primeos and others added 3 commits April 22, 2019 12:29

pythonPackages.cryptography: vectors are checkInputs

186fc20

primeos force-pushed the python-cryptography branch from 90509b8 to 186fc20 Compare April 22, 2019 10:30

primeos merged commit c93fd4a into NixOS:staging Apr 23, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

python37Packages.cryptography: 2.5 -> 2.6.1 #56690

python37Packages.cryptography: 2.5 -> 2.6.1 #56690

primeos commented Mar 2, 2019

dtzWill left a comment

worldofpeace commented Mar 30, 2019

FRidh commented Mar 31, 2019

worldofpeace commented Mar 31, 2019 •

edited

eadwu Apr 20, 2019

dtzWill commented Apr 22, 2019 via email

primeos commented Apr 22, 2019

dtzWill commented Apr 22, 2019 via email

primeos commented Apr 23, 2019

worldofpeace commented Apr 23, 2019

python37Packages.cryptography: 2.5 -> 2.6.1 #56690

python37Packages.cryptography: 2.5 -> 2.6.1 #56690

Conversation

primeos commented Mar 2, 2019

Motivation for this change

Things done

dtzWill left a comment

Choose a reason for hiding this comment

worldofpeace commented Mar 30, 2019

FRidh commented Mar 31, 2019

worldofpeace commented Mar 31, 2019 • edited

eadwu Apr 20, 2019

Choose a reason for hiding this comment

dtzWill commented Apr 22, 2019 via email

primeos commented Apr 22, 2019

dtzWill commented Apr 22, 2019 via email

primeos commented Apr 23, 2019

worldofpeace commented Apr 23, 2019

worldofpeace commented Mar 31, 2019 •

edited