Drop upper bounds on cryptography and pyopenssl#802
Drop upper bounds on cryptography and pyopenssl#802hauntsaninja wants to merge 1 commit intooracle:masterfrom
Conversation
|
Thank you for your pull request and welcome to our community! To contribute, please sign the Oracle Contributor Agreement (OCA).
To sign the OCA, please create an Oracle account and sign the OCA in Oracle's Contributor Agreement Application. When signing the OCA, please provide your GitHub username. After signing the OCA and getting an OCA approval from Oracle, this PR will be automatically updated. If you are an Oracle employee, please make sure that you are a member of the main Oracle GitHub organization, and your membership in this organization is public. |
|
See also #805 |
The only place where `OpenSSL` is used is via an indirect dependency from `urllib3.contrib.pyopenssl`, which itself is only used when the Python built-in SSL module doesn't support SNI (Server Name Indication). That module itself is only imported via the vendored `requests` init, _iff_ `ssl.HAS_SNI` is `False`, or as an optional import in vendored `requests.help` (which is never imported by code; in the original `requests` library, it's supposed to be run as a command-line module, but it's unlikely `python -m oci._vendor.requests.help` is a real use case). The `urllib3.contrib.pyopenssl` module's docstring says: > This module was relevant before the standard library ``ssl`` > module supported SNI, but now that we've dropped support for > Python 2.7 all relevant Python versions support SNI so > **this module is no longer recommended**. This is related to oracle#802; right now there are upper version pins on `pyOpenSSL`, which prevent downstream users from upgrading to e.g. non-vulnerable versions of that library downstream. Signed-off-by: Aarni Koskela <akx@iki.fi>
|
I am also having issues due to this, but the workaround from this PR didnt fix it for me. @hauntsaninja I think you will also need to change it in setup.py and pyproject.toml, see: |
These are security critical dependencies. Bounds here limit people's ability to respond to vulnerabilities.
See also #700 #692 #681 #618 #568 #548 #515
See also https://iscinumpy.dev/post/bound-version-constraints/