freeipa

#9708 add support for python cryptography 44.0.0
Closed: fixed by frenaud. Opened by slev.

Closed: fixed
Reopen Issue

cryptography 44.0.0 brought several changes related to its usage in IPA code.

$ python3 -c 'import ipalib.x509'
/usr/src/RPM/BUILD/freeipa-4.12.2/ipalib/constants.py:392: CryptographyDeprecationWarning: TripleDES has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.TripleDES and will be removed from cryptography.hazmat.primitives.ciphers.algorithms in 48.0.0.
  if getattr(algorithms, 'TripleDES', None):
/usr/src/RPM/BUILD/freeipa-4.12.2/ipalib/constants.py:393: CryptographyDeprecationWarning: TripleDES has been moved to cryptography.hazmat.decrepit.ciphers.algorithms.TripleDES and will be removed from cryptography.hazmat.primitives.ciphers.algorithms in 48.0.0.
  if backend.cipher_supported(algorithms.TripleDES(
Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "/usr/src/RPM/BUILD/freeipa-4.12.2/ipalib/__init__.py", line 921, in <module>
    from ipalib.frontend import Command, LocalOrRemote, Updater
  File "/usr/src/RPM/BUILD/freeipa-4.12.2/ipalib/frontend.py", line 31, in <module>
    from ipalib.parameters import create_param, Param, Str, Flag
  File "/usr/src/RPM/BUILD/freeipa-4.12.2/ipalib/parameters.py", line 125, in <module>
    from ipalib.x509 import (
  File "/usr/src/RPM/BUILD/freeipa-4.12.2/ipalib/x509.py", line 91, in <module>
    class IPACertificate(crypto_x509.Certificate):
TypeError: type 'cryptography.hazmat.bindings._rust.x509.Certificate' is not an acceptable base type

  • the warning message about TripleDES has been changed
    https://github.com/pyca/cryptography/pull/11407

  • Certificate (and many others) are concrete classes
    https://github.com/pyca/cryptography/issues/11437
    https://github.com/pyca/cryptography/pull/11989

I raised this issue with PyCA developers and we'll get ability to subclass x509.Certificate class back. There is a work in progress in https://github.com/pyca/cryptography/pull/12077 but it does not work yet as more changes are needed in Rust code to allow actual instantiation of the class.

See my comments in https://github.com/pyca/cryptography/issues/11437#issuecomment-2509170229 for more details.

@slev could you please handle the deprecation warnings in this ticket? We also should skip PyCA 44.0.0 as it is clearly not compatible with FreeIPA.

@slev could you please handle the deprecation warnings in this ticket? We also should skip PyCA 44.0.0 as it is clearly not compatible with FreeIPA.

Feel free to take the commit for your PR:
https://github.com/stanislavlevin/freeipa/commits/issue_9708_warnings/

Thank you, the implementation looks good to me. I added it to https://github.com/freeipa/freeipa/pull/7614

Metadata Update from @abbra:
- Issue assigned to abbra

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-53854, https://issues.redhat.com/browse/RHEL-69926, https://issues.redhat.com/browse/RHEL-69927

master:

  • 8a8b8a76acb1290bc62cceec9d153e28e88f73b3 Revert "readthedocs: install crypto 43.0.0"
  • a47475f3794533b207cd763b407a0f414c33b459 ipalib/x509: support PyCA 44.0
  • bc31c2700c3779cfad688eb098042060bf09df3c pyca: adapt import paths for TripleDES cipher

Metadata Update from @frenaud:
- Custom field rhbz adjusted to https://issues.redhat.com/browse/RHEL-53854, https://issues.redhat.com/browse/RHEL-69926, https://issues.redhat.com/browse/RHEL-69927, https://issues.redhat.com/browse/RHEL-69928 (was: https://issues.redhat.com/browse/RHEL-53854, https://issues.redhat.com/browse/RHEL-69926, https://issues.redhat.com/browse/RHEL-69927)

ipa-4-12:

  • e3cf4d0bf971a803e75f0b5b54634f65e641b752 Revert "readthedocs: install crypto 43.0.0"
  • d4d56a6705c870901bc73882e4804367f7c9c91a ipalib/x509: support PyCA 44.0
  • 8dfec28647f7c17e47fbfc96a1720dcde1592386 pyca: adapt import paths for TripleDES cipher

ipa-4-11:

  • 3f38a3729e16904afe6e7921960a8ba47b76b626 ipalib/x509: support PyCA 44.0
  • 427370af48d2ba892e98d3983e1c57c2b0e2a994 Revert "readthedocs: install crypto 43.0.0"

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.