#1078747 python3-cryptography: cryptography.exceptions fails to import

Package:
python3-cryptography
Source:
python3-cryptography
Description:
Python library exposing cryptographic recipes and primitives (Python 3)
Submitter:
Sebastian Ramacher
Date:
2025-03-17 17:36:02 UTC
Severity:
normal
Tags:
#1078747#5
Date:
2024-08-15 09:54:59 UTC
From:
To:
Importing cryptography.exceptions fails to import:
Traceback (most recent call last):
  File "<input>", line 1, in <module>
    import cryptography.exceptions
  File "/usr/lib/python3/dist-packages/cryptography/exceptions.py", line 9, in <module>
    from cryptography.hazmat.bindings._rust import exceptions as rust_exceptions
  File "<frozen importlib._bootstrap>", line 1360, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1331, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 921, in _load_unlocked
  File "<frozen importlib._bootstrap>", line 813, in module_from_spec
  File "/home/sebastian/development/bpython/bpython/curtsiesfrontend/repl.py", line 275, in _create_module
    module_object = self.loader.create_module(spec)
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
RuntimeError: OpenSSL 3.0's legacy provider failed to load. This is a fatal error by default, but cryptography supports running without legacy algorithms by se
tting the environment variable CRYPTOGRAPHY_OPENSSL_NO_LEGACY. If you did not expect this error, you have likely made a mistake with your OpenSSL configuration
.

This import error breaks at least paramiko.

Cheers
#1078747#10
Date:
2024-08-16 23:07:13 UTC
From:
To:
Hi,

This was caused by the recent split of legacy providers from the main
OpenSSL package. Installing openssl-provider-legacy "fixes" the error.
These are the aloorithms considered "legacy":

Hashing: MD2, MD4, MDC2, WHIRLPOOL, RIPEMD160
Ciphers: Blowfish, CAST, DES, IDEA, RC2, RC4, RC5, SEED
KDF: PBKDF1, PVKKDF
(From https://manpages.debian.org/bookworm/openssl/OSSL_PROVIDER-legacy.7ssl.en.html)

Some of the software I tried works with setting
CRYPTOGRAPHY_OPENSSL_NO_LEGACY=1, because they obviously don't use any
of the legacy algorithms...

I wonder if this really needs to be a hard fail in Debian? Or do we want
to patch every cryptography-using tool with a line like

os.environ['CRYPTOGRAPHY_OPENSSL_NO_LEGACY'] = "1"

to "promise" not to require the legacy ciphers? And every package which
needs these ciphers must add a dependency on openssl-provider-legacy?

I currently don't have a good solution. Making python3-cryptography
depend on openssl-provider-legacy feels kinda wrong to me...

Regargs, Tobias
#1078747#15
Date:
2024-08-17 13:29:07 UTC
From:
To:
See also https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=965041#50 and
below.
#1078747#26
Date:
2024-08-21 15:49:44 UTC
From:
To:
Control: severity -1 wishlist
openssl-provider-legacy as a workaround, so for now these bugs should
disappear.