From d8fba116677b95a7b05b9b6173d94fec405550bc Mon Sep 17 00:00:00 2001 From: Stephen Matula Date: Fri, 11 Sep 2026 12:41:02 -0400 Subject: [PATCH] Build cryptography with an embedded OpenSSL for legacy-cipher parity Our cryptography wheel silently loses six ciphers that the official PyPI wheel supports. Point the build at the builder's static OpenSSL so the wheel comes out the same shape upstream ships. OpenSSL dlopens its providers, and auditwheel only follows DT_NEEDED, so ossl-modules/legacy.so never makes it into the wheel. The libcrypto that does get bundled has MODULESDIR compiled to builder paths that do not exist wherever the wheel is installed, so OSSL_PROVIDER_load(NULL, "legacy") fails at import and Blowfish, CAST5, IDEA, SEED, ARC4 and RC2 all raise UnsupportedAlgorithm. Since 50.x that load failure is only a warning rather than an error, so the import succeeds and wheel-check passes on a wheel with six dead ciphers. cryptography is not on the index at the moment. 1dcf8263 (2026-08-31) removed it along with pillow, pyarrow, numpy, lxml, cffi and freeze-core and denylisted all seven against re-publication as transitive dependencies, "due to incompatible native library bundling". For cryptography, this is that incompatible bundling. So this file is a precondition for putting the package back, not a repair to something users are pulling today. Upstream sidesteps the whole problem by embedding OpenSSL in _rust.abi3.so. OPENSSL_DIR and OPENSSL_STATIC make openssl-sys do the same against the static, no-module OpenSSL the builder now provides. Measured on cryptography 50.0.1, built from sdist in the builder image, repaired with auditwheel, exercised on python:3.12-slim: _rust.abi3.so bundled libs legacy ciphers today 6.32 MB libcrypto, libssl 1 of 7 with this 13.66 MB none 7 of 7 PyPI wheel 14.39 MB none 7 of 7 the 1 that works today is TripleDES, which lives in the default provider. DT_NEEDED on the extension module is identical to PyPI's. Requires the builder image to provide /opt/_internal/static-openssl. That prefix is deliberately off PKG_CONFIG_PATH and out of ldconfig, so this file is the only thing that reaches it and no other package is affected. The path is a version-independent symlink. Like overrides/settings/pillow.yaml, this does not itself trigger a rebuild -- identify-packages only diffs onboarded_packages -- so it takes effect on cryptography's next version bump. Assisted-by: Claude Opus 5 --- overrides/settings/cryptography.yaml | 29 ++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) create mode 100644 overrides/settings/cryptography.yaml diff --git a/overrides/settings/cryptography.yaml b/overrides/settings/cryptography.yaml new file mode 100644 index 000000000..d5fc69e8c --- /dev/null +++ b/overrides/settings/cryptography.yaml @@ -0,0 +1,29 @@ +--- +# Embed OpenSSL in _rust.abi3.so, the way the official PyPI wheels are built, +# instead of linking it dynamically and letting auditwheel bundle libcrypto and +# libssl beside it. +# +# The dynamic path ships a broken wheel. OpenSSL dlopens its providers, so +# auditwheel -- which only follows DT_NEEDED -- never sees ossl-modules/ +# legacy.so and does not bundle it, and the libcrypto it does bundle has a +# MODULESDIR baked in that points at builder paths absent wherever the wheel is +# installed. OSSL_PROVIDER_load(NULL, "legacy") fails at import and Blowfish, +# CAST5, IDEA, SEED, ARC4 and RC2 all raise UnsupportedAlgorithm. Since 50.x +# that load failure is only a warning, so the import succeeds and the wheel +# passes wheel-check with six ciphers dead. +# +# Prerequisite: the builder image must provide the static, no-module OpenSSL at +# this prefix -- added in the plumbing builder (build-openssl-static.sh). It is +# a second OpenSSL, deliberately kept off PKG_CONFIG_PATH and out of ldconfig, +# so only packages that set OPENSSL_DIR explicitly can reach it. The shared +# OpenSSL everything else links against is untouched. +# +# static-openssl is a version-independent symlink, so bumping OpenSSL in the +# builder does not require a change here. +# +# Note: cryptography is currently in denied_packages.txt -- 1dcf8263 removed it +# and six others "due to incompatible native library bundling". This file is +# what has to be in place before it can be re-onboarded. +env: + OPENSSL_DIR: /opt/_internal/static-openssl + OPENSSL_STATIC: "1"