Mailman 3 April 2021 - Cryptography-dev

Problems with importing OpenSSL on Windows
by Łukasz Hanuszczak April 21, 2021

April 21, 2021

Hello, Our team uses two continuous integration systems that build and package the Windows distribution of our project. One of them is internal and runs on Windows 7, the other one is AppVeyor (running Windows 2012, which is based on Windows 8 best to my knowledge) that works with our open-source repository on GitHub. Both systems use the same script that initializes the virtual environment, upgrades pip, installs dependencies. The only significant difference is that the internal pipeline does not have internet access and uses vendored wheels (though downloaded from PyPI upfront). Both systems use exactly the same version of Python and pip, as witnessed by the output of `pip debug --verbose`: ``` (...) pip version: pip 21.0.1 from c:\buildenv\python_64\lib\site-packages\pip (python 3.6) sys.version: 3.6.8 (tags/v3.6.8:3c6b436a57, Dec 24 2018, 00:16:47) [MSC v.1916 64 bit (AMD64)] (...) ``` Unfortunately, after upgrading `cryptography` from 2.9.2 to 3.3.2, the AppVeyor task started to fail with the following error (during runtime, the package installation process itself works fine): ``` (...) File "c:\buildenv\python_64\lib\site-packages\cryptography\hazmat\backends\openssl\__init__.py", line 7, in <module> from cryptography.hazmat.backends.openssl.backend import backend File "c:\buildenv\python_64\lib\site-packages\cryptography\hazmat\backends\openssl\backend.py", line 117, in <module> from cryptography.hazmat.bindings.openssl import binding File "c:\buildenv\python_64\lib\site-packages\cryptography\hazmat\bindings\openssl\binding.py", line 14, in <module> from cryptography.hazmat.bindings._openssl import ffi, lib ImportError: DLL load failed: The specified module could not be found. ``` I have verified that on both systems there is the `cryptography` OpenSSL DLL available (`c:\buildenv\python_64\lib\site-packages\cryptography\hazmat\bindings\_openssl.pyd`) and that it has exactly the same size (3,107,328 bytes). I have also checked and tried using a newer version of `cryptography` (3.4.7) on AppVeyor but the problem does not go away. Has there been any change in handling of the OpenSSL DLL between 2.9.2 and 3.3.2? Or is there any other reason that might hint the source of issues? Is it possible that the DLL itself introduced some new system dependency that has to be installed first? Thank you, Łukasz

2 3

codecov security incident
by Alex Gaynor April 15, 2021

April 15, 2021

This morning codecov disclosed a security incident: https://about.codecov.io/security-update/ This incident allowed an attacker to run code in environments that use codecov for uploading coverage. Since the Python Cryptographic Authority uses codecov across our projects for tracking coverage, we wanted to provide an update on how we were impacted by this incident. tl;dr; we're not impacted We use codecov across many many testing jobs. However, none of these jobs contain access to any secrets or tokens or any sort. Further, we do not not use codecov in any jobs that generate release artifacts (e.g. built wheels). Because our CI infrastructure relies on ephemeral environments; jobs are isolated from each other -- gaining access to a job that runs tests cannot be pivoted to access to a job that generates a release wheel. 100% of our source code is open source, including all release infrastructure, so there was no source code to steal. The fact that we were not impacted reflects deliberate decisions to minimize the attack surface of the parts of our release infrastructure that could impact the integrity of our artifacts. Nevertheless, we are going to be investigating whether there exist good alternatives to codecov -- this reflects not just this security incident, but also a long running pattern of instability in codecov's service. Our constraints are our coverage infrastructure needs to be able to merge coverage results from multiple jobs and languages and compute aggregate coverage and reports and it needs to be highly reliable. We encourage folks to send recommendations our way. Regards, Alex & Paul -- All that is necessary for evil to succeed is for good people to do nothing.

1 0

Submission
by Masoud Shokohi April 4, 2021

April 4, 2021

Submission

1 0

Replicating CI of the project?
by Konstantin Shemyak April 2, 2021

April 2, 2021

In my attempt to contribute to the project, I have bumped into numerous "corners" of the CI checks and have caused massive force-push spam. What would be your suggestion to replicate the CI of the project to be able to run all the checks before actually creating a PR? Konstantin Shemyak

2 1