Path: csiph.com!newsfeed.xs4all.nl!newsfeed7.news.xs4all.nl!bofh.it!news.nic.it!robomod From: Simon Chopin Newsgroups: linux.debian.maint.python Subject: python-cryptography, Rust, and OpenSSL 3.0 Date: Wed, 01 Dec 2021 14:00:01 +0100 Message-ID: X-Original-To: Debian Python X-Mailbox-Line: From debian-python-request@lists.debian.org Wed Dec 1 12:57:09 2021 Old-Return-Path: X-Amavis-Spam-Status: No, score=-9.379 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FOURLA=0.1, LDO_WHITELIST=-5, MURPHY_DRUGS_REL8=0.02, RCVD_IN_DNSWL_MED=-2.3, UNPARSEABLE_RELAY=0.001] autolearn=ham autolearn_force=no X-Policyd-Weight: using cached result; rate:hard: -5.5 X-Greylist: delayed 546 seconds by postgrey-1.36 at bendel; Wed, 01 Dec 2021 12:40:29 UTC X-Gm-Message-State: AOAM533SpyYQbk8x8YCe78dCPds8EWOAIH13gjEuBAqSPoerF8CoDp6h ijd2b2+mynZ+hCHKqzo0tYFX7yDSGSoJdgZy/qgLZqvkeB8bkzJC4DQu0yKtyXxwP/QSpc8PDBX MnKJwajL4i7CGpp/WaH3qbEl3YiE+EZP6pn2Aq2IxH2MlDMTkB1Qc5O9eU3ME X-Received: by 2002:a17:906:9b92:: with SMTP id dd18mr7032083ejc.290.1638361880782; Wed, 01 Dec 2021 04:31:20 -0800 (PST) X-Google-SMTP-Source: ABdhPJxAq4LhPwTLyhhEF8Xu+C5s6EX7g+ybhq4dKdu2siilQ4/JfM2fpIAqwt7O7x6GaGTShwo3j/lepdU1Cm0xO1Q= X-Received: by 2002:a17:906:9b92:: with SMTP id dd18mr7032054ejc.290.1638361880555; Wed, 01 Dec 2021 04:31:20 -0800 (PST) MIME-Version: 1.0 User-Agent: alot/0.9.1 Content-Type: text/plain; charset="UTF-8" X-Mailing-List: archive/latest/19554 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/CAOOWow0wdsz1iX+mvhuKEshk-2jx4LBOFBQsZueBJuSK+CE0Ow@mail.gmail.com Approved: robomod@news.nic.it Lines: 48 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Cc: Sandro Tosi , Tristan Seligmann X-Original-Date: Wed, 1 Dec 2021 04:31:20 -0800 X-Original-Message-ID: Xref: csiph.com linux.debian.maint.python:13746 Hi, TL;DR: Does it make sense to upload the intermediary upstream version 3.4.8 or rather wait for someone to work on the Rust-based later versions? I'm currently working on the OpenSSL 3.0 transition in Ubuntu, and python-cryptography in its current version in Debian and Ubuntu does not support it[0]. The current version of the package is 3.3.2-1, whereas upstream is at 36.0. Versioning scheme notwithstanding, upstream moves with a rapid pace, since 3.3.2 came out in February 2021. This package has recently gained some notoriety[1] for wanting to use Rust to replace parts of its C core. 3.4 introduces an optional dependency on the Rust toolchain, which became mandatory in 35.0 (think 3.5). Said 35.0 release also brought OpenSSL 3.0 support, which is why I first tried to update the package directly to 35.0 (36.0 wasn't out at the time), but it needs a good few packages that aren't, or weren't at the time, in the Debian archive, with transitive dependencies on crates that aren't necessarily version-compatible with what's currently in Debian. Furthermore, dh-python and pybuild aren't necessarily ready for the setuptools Rust extension. So, instead I opted for packaging the last Rust-optional version, 3.4.8, and backported the necessary OpenSSL 3.0 patches. I posted the result of this work on Salsa[2]. Now that the OpenSSL 3 transition has started in Ubuntu, I plan on uploading this package to our archive as I lack the time to do the necessary work for the Rust enablement, but I'm wondering if it makes sense to do the same in Debian? Cheers, Simon PS: please keep me in CC, as I'm not subscribed to the ML. [0]: https://bugs.launchpad.net/ubuntu/+source/python-cryptography/+bug/1946189 [1]: https://lwn.net/Articles/845535/ [2]: https://salsa.debian.org/python-team/packages/python-cryptography/-/merge_requests/6 -- Simon Chopin Foundations Team Ubuntu MOTU simon.chopin@canonical.com schopin@ubuntu.com