Conversation
cryptography 47.0.0 removed legacy curves (e.g. SECT571R1) still referenced at import time by cryptojwt's EC JWK module, breaking test collection across the suite on all Python versions.
python setup.py install invokes easy_install, which re-resolves idpyoidc's own install_requires independently of requirements-dev.txt. It ignores the cryptography pin, fetches pyOpenSSL's latest release (which needs a newer cryptography), and then fails outright since modern cryptography sdists ship no setup.py for easy_install to run. Installing requirements-dev.txt and the package together in one pip call lets the resolver pick a pyOpenSSL version compatible with the pinned cryptography instead.
Member
|
I think we should do the opposite and actually use the cryptojwt v1.11.0 or newer. |
cryptojwt 1.11.0 fixes the EC JWK module's reference to legacy curves cryptography 47 removed, which is what the pin in de7eab5 worked around.
lionick
changed the title
Contributor
Author
|
I agree, I have sum up the work at #125. |
| - '3.8' | ||
| - '3.9' | ||
| - '3.10' | ||
| - '3.11' |
Member
There was a problem hiding this comment.
We should add 3.12, 3.13, 3.14
| bandit | ||
| urllib3<1.27 | ||
| cryptography<47 No newline at end of file | ||
| urllib3<1.27 No newline at end of file |
Member
There was a problem hiding this comment.
do we need this restriction?
Contributor
Author
There was a problem hiding this comment.
I think we don't.
Added in Dec 2022 for a requests/urllib3 incompatibility that predates requests' proper urllib3 2.x support. Current requests (2.32.5) declares Requires-Dist: urllib3<3,>=1.21.1, so nothing in the dependency graph needs the old ceiling anymore.
I have updated the #125
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
cryptography 47.0.0 removed legacy curves (e.g. SECT571R1) still referenced at import time by cryptojwt's EC JWK module, breaking test collection across the suite on all Python versions.