freeipa

#9983 Nightly test failure (f45+) because of CryptographyDeprecationWarning
Closed: fixed by frenaud. Opened by frenaud.

Closed: fixed
Reopen Issue

Issue

A few tests are failing because of a new deprecation warning visible in rawhide (f45).

  • test_integration/test_commands.py::TestIPACommand::test_certmap_match_issue7520
  • test_integration/test_commands.py::TestIPACommand::test_add_permission_failure_issue5923
  • test_integration/test_random_serial_numbers.py::TestIPACommand_RSN::test_certmap_match_issue7520
  • test_integration/test_random_serial_numbers.py::TestIPACommand_RSN::test_add_permission_failure_issue5923

The test fails because ipa commands display a Deprecation warning issued by python-cryptography package:

DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd86:transport.py:513 RUN ['ipa', 'certmap-match', '/etc/ipa/ca.crt']
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd86:transport.py:557 /usr/lib/python3.14/site-packages/ipalib/constants.py:407: CryptographyDeprecationWarning: Single-key TripleDES (8-byte keys) is deprecated and support will be removed in a future release. Use 24-byte keys instead (e.g., key + key + key).
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd86:transport.py:557   if backend.cipher_supported(TripleDES(
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd86:transport.py:557 ---------------
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd86:transport.py:557 0 users matched
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd86:transport.py:557 ---------------
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd86:transport.py:557 ----------------------------
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd86:transport.py:557 Number of entries returned 0
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd86:transport.py:557 ----------------------------
DEBUG    ipatests.pytest_ipa.integration.host.Host.master.cmd86:transport.py:217 Exit code: 1

Actual behavior

When importing ipalib.constants the package python3-cryptography raises a DeprecationWarning. SImple reproducer:

python3 -c 'from cryptography.hazmat.decrepit.ciphers.algorithms import TripleDES; from cryptography.hazmat.backends.openssl.backend import backend; from cryptography.hazmat.primitives.ciphers import modes; backend.cipher_supported(TripleDES(b"\x00" * 8), modes.CBC(b"\x00" * 8))'

With python3-cryptography-46.0.7-1.fc44 there is no warning
With python3-cryptography-47.0.0-1.fc45 we see the following:

python3 -c 'from cryptography.hazmat.decrepit.ciphers.algorithms import TripleDES; from cryptography.hazmat.backends.openssl.backend import backend; from cryptography.hazmat.primitives.ciphers import modes; backend.cipher_supported(TripleDES(b"\x00" * 8), modes.CBC(b"\x00" * 8))'
<string>:1: CryptographyDeprecationWarning: Single-key TripleDES (8-byte keys) is deprecated and support will be removed in a future release. Use 24-byte keys instead (e.g., key + key + key).

The code in ipalib/constants.py can be modified to use a 24-byte key when checking if TripleDES is supported. For instance TripleDES(b"\x00" * 24)

Metadata Update from @frenaud:
- Issue assigned to frenaud

Example of test failure in https://$ARTIFACTS_SERVER/idm-ci/freeipa_upstream_nightly/Nightly-rawhide/master/2026-05-02_19-30/rawhide/test_commands/1/report.html?sort=result

Metadata Update from @frenaud:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/8391

master:

  • 4c60fef41b25a1b2c652bdde230d90913f397483 constants: Use 24-byte key to check id TripleDES is supported
  • c95de5942b6e14d11588edd7b886c08b1c87a39c prci definitions: extend test_commands timeout to 6000s

ipa-4-13:

  • 0c9b1e2324bd1e9795c6878bc6456f9abf3aa3c9 constants: Use 24-byte key to check id TripleDES is supported
  • 0135a9e551faa674423b919d7ab8c58c5942685c prci definitions: extend test_commands timeout to 6000s

Metadata Update from @frenaud:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

test-failure

None
None
None
https://github.com/freeipa/freeipa/pull/8391
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.