Skip to content

{Packaging} Bump cryptography from 2.8 to 3.3.2 #15687

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fengzhou-msft merged 9 commits into from
Feb 19, 2021
Merged

{Packaging} Bump cryptography from 2.8 to 3.3.2 #15687

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
98e1759
Bump cryptography from 2.8 to 3.2 in /src/azure-cli
dependabot[bot] Oct 27, 2020
26061ea
Merge branch 'dev' into dependabot/pip/src/azure-cli/cryptography-3.2
jiasli Jan 20, 2021
d1c2311
setup.py
jiasli Jan 20, 2021
3dbbfaa
Bump to 3.3.1
jiasli Jan 20, 2021
6f73888
cryptography>=3.2
fengzhou-msft Feb 18, 2021
be107f1
Pin to 3.3.2 to resolve CVE
fengzhou-msft Feb 18, 2021
ba6d1a1
Merge branch 'dev' of github.com:Azure/azure-cli into dependabot/pip/…
fengzhou-msft Feb 19, 2021
4fc6813
Merge branch 'dependabot/pip/src/azure-cli/cryptography-3.2' of githu…
fengzhou-msft Feb 19, 2021
f4e78df
move cryptography to azure-cli-core
fengzhou-msft Feb 19, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions src/azure-cli-core/setup.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,7 @@
'argcomplete~=1.8',
'azure-cli-telemetry==1.0.6.*',
'colorama~=0.4.1',
'cryptography>=3.2,<3.4',
Copy link
Member

@fengzhou-msft fengzhou-msft Feb 19, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

adal relies on cryptography, so moved it to azure-cli-core.

3.4+ versions rely on rust and cause install issues on some platforms. Let's set the upper bound for now.

Copy link
Member

@jiasli jiasli Feb 19, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

3.4+ versions rely on rust and cause install issues on some platforms. Let's set the upper bound for now.

The original discussion: pyca/cryptography#5771

Copy link
Member

@jiasli jiasli Feb 19, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

azure-devops (#16858) and azure-cli-ml (#16880) shouldn't rely on adal or cryptography directly. They should use those provided by azure-cli-core.

Copy link
Member

@fengzhou-msft fengzhou-msft Feb 19, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good point. I will submit issues to azure-devops (submitted Azure/azure-devops-cli-extension#1108). Machine learning team is working on a new extension to replace the old one, I will request a cleaning of their dependnecies.

'humanfriendly>=4.7,<10.0',
'jmespath',
'knack==0.8.0rc2',
Expand Down
2 changes: 1 addition & 1 deletion src/azure-cli/requirements.py3.Darwin.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,7 +94,7 @@ cffi==1.14.4
chardet==3.0.4
colorama==0.4.1
ConfigArgParse==0.14.0
cryptography==2.8
cryptography==3.3.2
fabric==2.4.0
humanfriendly==9.1
idna==2.8
Expand Down
2 changes: 1 addition & 1 deletion src/azure-cli/requirements.py3.Linux.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,7 +94,7 @@ cffi==1.14.4
chardet==3.0.4
colorama==0.4.1
ConfigArgParse==0.14.0
cryptography==2.8
cryptography==3.3.2
fabric==2.4.0
humanfriendly==9.1
idna==2.8
Expand Down
2 changes: 1 addition & 1 deletion src/azure-cli/requirements.py3.windows.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,7 +93,7 @@ certifi==2019.6.16
cffi==1.14.4
chardet==3.0.4
colorama==0.4.1
cryptography==2.8
cryptography==3.3.2
fabric==2.4.0
humanfriendly==9.1
idna==2.8
Expand Down
1 change: 0 additions & 1 deletion src/azure-cli/setup.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,7 +131,6 @@
'azure-synapse-accesscontrol~=0.2.0',
'azure-synapse-artifacts~=0.3.0',
'azure-synapse-spark~=0.2.0',
'cryptography>=2.3.1,<3.0.0',
Copy link
Member

@yungezz yungezz Feb 19, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

will remove the dependency here impacting extensions etc? since we don't want extension directly depend on azure-cli-core?

Copy link
Member

@fengzhou-msft fengzhou-msft Feb 19, 2021

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

azure-cli will always install azure-cli-core, so moving the dependency version specifier to azure-cli-core will have no impact on azure-cli and extensions. Previously, pip install azure-cli-core individually will fail as azure-cli-core indirectly depends on cryptography through adal, but it's not pinned there.

'fabric~=2.4',
'jsmin~=2.2.2',
'pytz==2019.1',
Expand Down