dependency aws-encryption-sdk v3.1.0 uses incompatible downstream dependency (cryptography >=40)

Open

#255 opened on Apr 13, 2023 5 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 2/5
Estimated time: 1-3 hours
Newbie friendliness: 35/100

Issue type: Bug
Clarity: Mostly clear
Activity status: Stale
Tech stack: python
Domain: backend

Research direction

Start by locating the dependency declaration used to bundle Python hooks and compare its aws-encryption-sdk version with the upstream v3.1.1 release and cryptography constraint linked in the issue. Verify the dependency update with the Python hook runtime; done means the hooks import without the cryptography.utils exception.

Written by the indexing model from the issue text.

Description

aws-encryption-sdk v3.1.0 (python hook runtime dependency) has a dependency on cryptogrpahy>2.5 (see https://github.com/aws/aws-encryption-sdk-python/blob/7950abd73ee333407d2dadd02ef2d57c3df464cf/requirements.txt#L2). This causes python hooks to be bundled with the latest version of cryptography (40.0.1), however the cryptography package has recently fully deprecated a method used by aws-encryption-sdk v3.1.0 (utils.verify_instance). This is resulting in a runtime exception for python hooks bundled with cloudformation-cli-python-lib v2.1.15:

Unable to import module 'x.handlers': cannot import name 'verify_interface' from 'cryptography.utils' (/var/task/cryptography/utils.py)

aws-encryption-sdk v3.1.1 no longer uses the verify_instancemethod and looks like it could be a suitable replacement (see: https://github.com/aws/aws-encryption-sdk-python/releases/tag/v3.1.1).

Dominant language: Python
Stars: 107
Forks: 46
PR merge metrics: No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.