Should upgrade cryptography to 39.0.1

[k9ert]

Should upgrade cryptography to 39.0.1

[k9ert]

I guess i mixed up some stuff here. Thank you, very much appreciated.

[reaperhulk]

You'll notice that our version bound requires >=38,<40, which is to say that it allows and pip will automatically resolve the latest 39.0.x release. Exact pinning is something projects that depend on these libraries should do -- if we were to try to enforce pins we'd break all our downstream consumers due to how Python packaging works.

[k9ert]

I'm not familiar with tox.ini so that's fine as well?!
https://github.com/pyca/pyopenssl/blob/main/tox.ini#L22

You're probably right from a pure technical dependency resolve point of view. But you should upgrade it nevertheless if you want to be considered as a secure to use library.

[mhils]

I'm not familiar with tox.ini so that's fine as well?!

Yes.

You're probably right from a pure technical dependency resolve point of view. But you should upgrade it nevertheless if you want to be considered as a secure to use library.

This is merely stating compatibility, pip defaults to the latest and greatest version by default.

[reaperhulk]

As a side note, the CVE linked isn't even reachable from pyOpenSSL (it does not call that code path).

[k9ert]

Thanks so far. Do you have a hint where this AttributeError is coming from?

ImportError while loading conftest '/tmp/cirrus-ci-build/tests/conftest.py'.
tests/conftest.py:16: in <module>
    from cryptoadvance.specter.managers.node_manager import NodeManager
src/cryptoadvance/specter/managers/node_manager.py:15: in <module>
    from ..util.bitcoind_setup_tasks import setup_bitcoind_thread
src/cryptoadvance/specter/util/bitcoind_setup_tasks.py:3: in <module>
    import pgpy
.env/lib/python3.10/site-packages/pgpy/__init__.py:4: in <module>
    from .pgp import PGPKey
.env/lib/python3.10/site-packages/pgpy/pgp.py:27: in <module>
    from .constants import CompressionAlgorithm
.env/lib/python3.10/site-packages/pgpy/constants.py:23: in <module>
    from ._curves import BrainpoolP256R1, BrainpoolP384R1, BrainpoolP512R1, X25519, Ed25519
.env/lib/python3.10/site-packages/pgpy/_curves.py:37: in <module>
    @utils.register_interface(ec.EllipticCurve)
E   AttributeError: module 'cryptography.utils' has no attribute 'register_interface'

More infos here: cryptoadvance/specter-desktop#2184

[alex]

pgpy v0.6.0 resolves this

…

On Thu, Mar 9, 2023 at 6:17 AM k9ert ***@***.***> wrote: Thanks so far. Do you have a hint where this AttributeError is coming from? ImportError while loading conftest '/tmp/cirrus-ci-build/tests/conftest.py'. tests/conftest.py:16: in <module> from cryptoadvance.specter.managers.node_manager import NodeManager src/cryptoadvance/specter/managers/node_manager.py:15: in <module> from ..util.bitcoind_setup_tasks import setup_bitcoind_thread src/cryptoadvance/specter/util/bitcoind_setup_tasks.py:3: in <module> import pgpy .env/lib/python3.10/site-packages/pgpy/__init__.py:4: in <module> from .pgp import PGPKey .env/lib/python3.10/site-packages/pgpy/pgp.py:27: in <module> from .constants import CompressionAlgorithm .env/lib/python3.10/site-packages/pgpy/constants.py:23: in <module> from ._curves import BrainpoolP256R1, BrainpoolP384R1, BrainpoolP512R1, X25519, Ed25519 .env/lib/python3.10/site-packages/pgpy/_curves.py:37: in <module> @utils.register_interface(ec.EllipticCurve) E AttributeError: module 'cryptography.utils' has no attribute 'register_interface' — Reply to this email directly, view it on GitHub <#1191 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAGBAQWKBC2EWELDLCYE3W3G35PANCNFSM6AAAAAAVUZMXVU> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

-- All that is necessary for evil to succeed is for good people to do nothing.