Mailman 3 September 2015 - Cryptography-dev

PyCA cryptography 1.0.2 released
by Paul Kehrer Sept. 28, 2015

Sept. 28, 2015

PyCA cryptography 1.0.2 has been released. This release contains a security fix that affects anyone running python with -O. Changelog: * SECURITY ISSUE: The OpenSSL backend prior to 1.0.2 made extensive use of assertions to check response codes where our tests could not trigger a failure. However, when Python is run with -O these asserts are optimized away. If a user ran Python with this flag and got an invalid response code this could result in undefined behavior or worse. Accordingly, all response checks from the OpenSSL backend have been converted from assert to a true function call. Credit Emilia Käsper (Google Security Team) for the report. -Paul Kehrer (reaperhulk)

3 2

PyCA cryptography 1.0.1 released
by Paul Kehrer Sept. 6, 2015

Sept. 6, 2015

PyCA cryptography (https://github.com/pyca/cryptography) 1.0.1 has been released! cryptography is a package which provides cryptographic recipes and primitives to Python developers. Our goal is for it to be your "cryptographic standard library". We support Python 2.6-2.7, Python 3.3+, and PyPy 2.6+. Changelog (https://cryptography.io/en/latest/changelog/) * We now ship OS X wheels that statically link OpenSSL by default. When installing a wheel on OS X 10.10+ (and using a Python compiled against the 10.10 SDK) users will no longer need to compile. * Set the default string mask to UTF-8 in the OpenSSL backend to resolve character encoding issues with older versions of OpenSSL. * Several new OpenSSL bindings have been added to support a future pyOpenSSL release. * Raise an error during install on PyPy < 2.6. 1.0+ requires PyPy 2.6+. Thanks to all the contributors who helped on this release, especially around infrastructure to support the new wheels. -Paul Kehrer (reaperhulk)

2 1

openssl in virtualenv question
by Jeff Feng Sept. 1, 2015

Sept. 1, 2015

Hi, I'm setting up development environment on my Mac, and using virtualenv. When I run cryptography test cases, I found the old OS X bundled openssl was used, not the latest openssl installed by Homebrew. So, I did version check in my virtualenv: $ which openssl /usr/local/bin/openssl <-- looks good $ openssl version OpenSSL 0.9.8zg 14 July 2015 <----errh, not right. $ /usr/local/bin/openssl version OpenSSL 1.0.2d 9 Jul 2015 <----- it's right Anyone have idea which config I missed ? Thanks in advance. - Jeff

2 1