Conflicting versions

[seocam]

Currently when I try to install x5092json using pip I get an error because cryptography has a pinned version in 2.5 but pyopenssl depends version >=2.8.

$ pip3 install x5092json
Processing /home/scampos/.cache/pip/wheels/91/86/f8/a31daf085f20d81ffb6caaa5e2824bd86bb5344ee4fe36a614/x5092json-1.0.3-py3-none-any.whl
Collecting cryptography==2.5
  Using cached cryptography-2.5-cp34-abi3-manylinux1_x86_64.whl (2.4 MB)
Collecting asn1
  Using cached asn1-2.3.1-py2.py3-none-any.whl (9.2 kB)
Collecting pyOpenSSL
  Using cached pyOpenSSL-19.1.0-py2.py3-none-any.whl (53 kB)
Collecting asn1crypto>=0.21.0
  Using cached asn1crypto-1.3.0-py2.py3-none-any.whl (103 kB)
Collecting six>=1.4.1
  Using cached six-1.15.0-py2.py3-none-any.whl (10 kB)
Collecting cffi!=1.11.3,>=1.8
  Using cached cffi-1.14.0-cp38-cp38-manylinux1_x86_64.whl (409 kB)
Collecting enum34
  Using cached enum34-1.1.10-py3-none-any.whl (11 kB)
Collecting pycparser
  Using cached pycparser-2.20-py2.py3-none-any.whl (112 kB)
ERROR: pyopenssl 19.1.0 has requirement cryptography>=2.8, but you'll have cryptography 2.5 which is incompatible.
Installing collected packages: asn1crypto, six, pycparser, cffi, cryptography, enum34, asn1, pyOpenSSL, x5092json

Is it really required to keep version 2.5 of cryptography?

[jcrowgey]

For now, it is. Although I'd love some help making this better.

Unfortunately, I can't remember the entire situation off the top of my head. But what I recall at the moment is that at some point cryptography went through and removed openssl bindings that were unused by the project at the current head. However, we're using this binding here, so we have to pin to an older version.

Now, admittedly, it was naughty of us to call an underscored library function ._lib, so we got what we deserved when they removed it. I'd be happy to take a patch to fix this.

Edit: I think that since I worked on this project, pyca/cryptography has added an rfc4514 function which, I believe, would work to replace the RFC_2253 formatting we're doing.

[orencohendev]

Is there a way to fix the versioning thing? cryptography has advanced to version 3.4.7 and I would like to help bring this tool back to life. Any idea where to deep dive to make sure the package conforms to the new cryptography version?