PyCA's cryptography library
28cd304e9d
OpenSSL 3.0 FIPS mode is now detected correctly Upstream fixes on top of 36.0.1: - Fix error check from EVP_PKEY_CTX_set_signature_md - Block 3DES in FIPS mode - Disable DSA tests in FIPS mode - Enable SHA1 signatures in test suite - Fix serialization of keyusage ext with no bits Related: rhbz#2060787 |
||
|---|---|---|
| tests | ||
| .gitignore | ||
| 0001-Block-TripleDES-in-FIPS-mode-6879.patch | ||
| 0002-Disable-DSA-tests-in-FIPS-mode-6916.patch | ||
| 0003-fixes-6927-handle-negative-return-values-from-openss.patch | ||
| 0004-Disable-test_openssl_assert_error_on_stack-in-FIPS-m.patch | ||
| 0005-Fixed-serialization-of-keyusage-ext-with-no-bits-693.patch | ||
| conftest-skipper.py | ||
| gating.yaml | ||
| python-cryptography.spec | ||
| README.md | ||
| sources | ||
| vendor_rust.py | ||
PyCA cryptography
https://cryptography.io/en/latest/
Packaging python-cryptography
The example assumes
- Fedora Rawhide (f34)
- PyCA cryptography release
3.4 - Update Bugzilla issue is
RHBZ#00000001
Build new python-cryptography
Switch and update branch
fedpkg switch-branch rawhide
fedpkg pull
Bump version and get sources
rpmdev-bumpspec -c "Update to 3.4 (#00000001)" -n 3.4 python-cryptography.spec
spectool -gf python-cryptography.spec
Upload new source
fedpkg new-sources cryptography-3.4.tar.gz
Commit changes
fedpkg commit --clog
fedpkg push
Build
fedpkg build
RHEL/CentOS builds
RHEL and CentOS use a different approach for Rust crates packaging than
Fedora. On Fedora Rust dependencies are packaged as RPMs, e.g.
rust-pyo3+default-devel RPM. These packages don't exist on RHEL and
CentOS. Instead python-cryptography uses a tar ball with vendored crates.
The tar ball is created by a script:
./vendor_rust.py
rhpkg upload cryptography-3.4-vendor.tar.bz2