Groups > linux.debian.maint.python > #13746

python-cryptography, Rust, and OpenSSL 3.0

Path	csiph.com!newsfeed.xs4all.nl!newsfeed7.news.xs4all.nl!bofh.it!news.nic.it!robomod
From	Simon Chopin <simon.chopin@canonical.com>
Newsgroups	linux.debian.maint.python
Subject	python-cryptography, Rust, and OpenSSL 3.0
Date	Wed, 01 Dec 2021 14:00:01 +0100
Message-ID	<Dpxnj-2tu-1@gated-at.bofh.it> (permalink)
X-Original-To	Debian Python <debian-python@lists.debian.org>
X-Mailbox-Line	From debian-python-request@lists.debian.org Wed Dec 1 12:57:09 2021
Old-Return-Path	<simon.chopin@canonical.com>
X-Amavis-Spam-Status	No, score=-9.379 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FOURLA=0.1, LDO_WHITELIST=-5, MURPHY_DRUGS_REL8=0.02, RCVD_IN_DNSWL_MED=-2.3, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no
X-Policyd-Weight	using cached result; rate:hard: -5.5
X-Greylist	delayed 546 seconds by postgrey-1.36 at bendel; Wed, 01 Dec 2021 12:40:29 UTC
X-Gm-Message-State	AOAM533SpyYQbk8x8YCe78dCPds8EWOAIH13gjEuBAqSPoerF8CoDp6h ijd2b2+mynZ+hCHKqzo0tYFX7yDSGSoJdgZy/qgLZqvkeB8bkzJC4DQu0yKtyXxwP/QSpc8PDBX MnKJwajL4i7CGpp/WaH3qbEl3YiE+EZP6pn2Aq2IxH2MlDMTkB1Qc5O9eU3ME
X-Received	by 2002:a17:906:9b92:: with SMTP id dd18mr7032083ejc.290.1638361880782; Wed, 01 Dec 2021 04:31:20 -0800 (PST)
X-Google-SMTP-Source	ABdhPJxAq4LhPwTLyhhEF8Xu+C5s6EX7g+ybhq4dKdu2siilQ4/JfM2fpIAqwt7O7x6GaGTShwo3j/lepdU1Cm0xO1Q=
X-Received	by 2002:a17:906:9b92:: with SMTP id dd18mr7032054ejc.290.1638361880555; Wed, 01 Dec 2021 04:31:20 -0800 (PST)
MIME-Version	1.0
User-Agent	alot/0.9.1
Content-Type	text/plain; charset="UTF-8"
X-Mailing-List	<debian-python@lists.debian.org> archive/latest/19554
List-ID	<debian-python.lists.debian.org>
List-URL	<https://lists.debian.org/debian-python/>
List-Archive	https://lists.debian.org/msgid-search/CAOOWow0wdsz1iX+mvhuKEshk-2jx4LBOFBQsZueBJuSK+CE0Ow@mail.gmail.com
Approved	robomod@news.nic.it
Lines	48
Organization	linux.* mail to news gateway
Sender	robomod@news.nic.it
X-Original-Cc	Sandro Tosi <morph@debian.org>, Tristan Seligmann <mithrandi@debian.org>
X-Original-Date	Wed, 1 Dec 2021 04:31:20 -0800
X-Original-Message-ID	<CAOOWow0wdsz1iX+mvhuKEshk-2jx4LBOFBQsZueBJuSK+CE0Ow@mail.gmail.com>
Xref	csiph.com linux.debian.maint.python:13746

Show key headers only | View raw

Hi,

TL;DR: Does it make sense to upload the intermediary upstream version
3.4.8 or rather wait for someone to work on the Rust-based later versions?

I'm currently working on the OpenSSL 3.0 transition in Ubuntu, and
python-cryptography in its current version in Debian and Ubuntu does not
support it[0].

The current version of the package is 3.3.2-1, whereas upstream is at
36.0. Versioning scheme notwithstanding, upstream moves with a rapid
pace, since 3.3.2 came out in February 2021.

This package has recently gained some notoriety[1] for wanting
to use Rust to replace parts of its C core. 3.4 introduces an optional
dependency on the Rust toolchain, which became mandatory in 35.0 (think
3.5).

Said 35.0 release also brought OpenSSL 3.0 support, which is why I first
tried to update the package directly to 35.0 (36.0 wasn't out at the
time), but it needs a good few packages that aren't, or weren't at the time,
in the Debian archive, with transitive dependencies on crates that
aren't necessarily version-compatible with what's currently in Debian.
Furthermore, dh-python and pybuild aren't necessarily ready for the
setuptools Rust extension.

So, instead I opted for packaging the last Rust-optional version, 3.4.8,
and backported the necessary OpenSSL 3.0 patches. I posted the result of
this work on Salsa[2].

Now that the OpenSSL 3 transition has started in Ubuntu, I plan on
uploading this package to our archive as I lack the time to do the
necessary work for the Rust enablement, but I'm wondering if it makes
sense to do the same in Debian?

Cheers,
Simon

PS: please keep me in CC, as I'm not subscribed to the ML.

[0]: https://bugs.launchpad.net/ubuntu/+source/python-cryptography/+bug/1946189
[1]: https://lwn.net/Articles/845535/
[2]: https://salsa.debian.org/python-team/packages/python-cryptography/-/merge_requests/6

--
Simon Chopin
Foundations Team                               	             Ubuntu MOTU
simon.chopin@canonical.com                            schopin@ubuntu.com

Back to linux.debian.maint.python | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

python-cryptography, Rust, and OpenSSL 3.0 Simon Chopin <simon.chopin@canonical.com> - 2021-12-01 14:00 +0100
  Re: python-cryptography, Rust, and OpenSSL 3.0 Andrius Merkys <merkys@debian.org> - 2021-12-01 16:10 +0100
    Re: python-cryptography, Rust, and OpenSSL 3.0 Thomas Goirand <zigo@debian.org> - 2021-12-01 18:30 +0100
      Re: python-cryptography, Rust, and OpenSSL 3.0 Andrius Merkys <merkys@debian.org> - 2021-12-02 09:10 +0100
  Re: python-cryptography, Rust, and OpenSSL 3.0 Stefano Rivera <stefanor@debian.org> - 2021-12-01 20:40 +0100
    Re: python-cryptography, Rust, and OpenSSL 3.0 Tristan Seligmann <mithrandi@mithrandi.net> - 2021-12-01 21:00 +0100
      Re: python-cryptography, Rust, and OpenSSL 3.0 Tristan Seligmann <mithrandi@mithrandi.net> - 2021-12-02 11:10 +0100
        Re: python-cryptography, Rust, and OpenSSL 3.0 Andrius Merkys <merkys@debian.org> - 2021-12-02 11:40 +0100

csiph-web