Mailman 3 October 2022 - Cryptography-dev

PyCA cryptography 38.0.2 yanked
by Alex Gaynor Oct. 12, 2022

Oct. 12, 2022

Yesterday, PyCA cryptography 38.0.2 was released to PyPI. Today, we yanked the release from PyPI due to regressions in OpenSSL that led the OpenSSL team to withdraw OpenSSL 3.0.6 (which PyCA cryptography's wheels include). We expect to issue a follow up release once the OpenSSL team has released OpenSSL 3.0.7. cryptography includes both high level recipes and low level interfaces to common cryptographic algorithms such as symmetric ciphers, asymmetric algorithms, message digests, X509, key derivation functions, and much more. We support Python 3.6+, and PyPy3. Alex -- All that is necessary for evil to succeed is for good people to do nothing.

1 0

PyCA cryptography 38.0.2 released
by Paul Kehrer Oct. 11, 2022

Oct. 11, 2022

PyCA cryptography 38.0.2 has been released to PyPI. cryptography includes both high level recipes and low level interfaces to common cryptographic algorithms such as symmetric ciphers, asymmetric algorithms, message digests, X509, key derivation functions, and much more. We support Python 3.6+, and PyPy3. Changelog (https://cryptography.io/en/latest/changelog/#v38-0-2): * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.0.6. -Paul Kehrer (reaperhulk)

1 0

Is this "pyopenssl" update code reviewed?
by simtiaz＠ncsu.edu Oct. 5, 2022

Oct. 5, 2022

<html> <head></head> <body> Hi, I am a PhD student from NC State University researching software supply chain security, specifically the secure use of third-party open source packages. As part of our research, we have developed an update audit tool, <a href="https://github.com/nasifimtiazohi/depdive">Depdive</a>, that can analyze if the changes in a package update have passed through a code review process. As part of an empirical evaluation, we studied the update from version 17.5.0 to version 18.0.0 of your package <a href="https://github.com/pyca/pyopenssl">pyopenssl</a>. As per our analysis, the update consists of 9 new commits. We determined that all of the commits were reviewed by a second developer. Details for each commit and the reasoning on how we determined if a commit was reviewed are provided in the attached CSV file. We are reaching out to you as the maintainer(s) of pyopenssl, to evaluate if you agree with our analysis. We invite you to fill out <a href="https://forms.gle/LBwTcNs2tgHdHVwBA">this short survey</a> to provide your opinion. The survey should take five minutes at the maximum. Please also fill out the unique ID 15678 for the update discussed in this email to help us track responses. We thank you for maintaining a great open source package. We would be grateful if you help our research on how downstream users can use third-party packages, like yours, securely in their supply chain. Don't hesitate to contact me if you have any questions regarding this survey or our research in general. More details on our study can be found in our <a href="https://arxiv.org/pdf/2206.09422.pdf">current paper draft</a>. Nasif Imtiaz PhD Student NC State University nasifimtiazohi.github.io </body> </html>

1 0

Quick Question
by Rodney McBride Oct. 3, 2022

Oct. 3, 2022

Is there a plan to get the cryptography package updated to v39 on PyPI? The reason I ask is because all versions of cryptography below v39 have been flagged by the Safety DB module due to the LibreSSL security vulnerability. Thanks, Rodney McBride, Veteran, [Cybersecurity Analyst](https://www.credly.com/badges/9c16f971-4465-4d7d-99ba-beb6a501ee06), [Security Analytics Professional](https://www.credly.com/users/rodney-mcbride/badges), [Security+](https://www.youracclaim.com/badges/b48fbf86-4137-455e-b7c8-4a2a5… Sent with [Proton Mail](https://proton.me/) secure email.

2 1