PyCA's cryptography library
520cea6ec9
Add patch from upstream PR https://github.com/pyca/cryptography/pull/14819 to fix AESGCM failing when an older FIPS provider (e.g. OpenSSL 3.0.7) is loaded alongside a newer main OpenSSL library (>= 3.2). The fix adds a fallback mechanism that re-initializes cipher contexts from stored parameters when EVP_CIPHER_CTX_copy fails, which can occur due to version mismatches between the FIPS provider and main library. Resolves: RHEL-173746 |
||
|---|---|---|
| tests | ||
| .gitignore | ||
| 14819.patch | ||
| changelog | ||
| conftest-skipper.py | ||
| gating.yaml | ||
| python-cryptography.spec | ||
| README.md | ||
| sources | ||
| stepdown-cffi-and-maturin.patch | ||
| vendor_rust.py | ||
PyCA cryptography
https://cryptography.io/en/latest/
Packaging python-cryptography
The example assumes
- Fedora Rawhide (f34)
- PyCA cryptography release
3.4 - Update Bugzilla issue is
RHBZ#00000001
Build new python-cryptography
Switch and update branch
fedpkg switch-branch rawhide
fedpkg pull
Bump version and get sources
rpmdev-bumpspec -c "Update to 3.4 (#00000001)" -n 3.4 python-cryptography.spec
spectool -gf python-cryptography.spec
Upload new source
fedpkg new-sources cryptography-3.4.tar.gz
Commit changes
fedpkg commit --clog
fedpkg push
Build
fedpkg build
RHEL/CentOS builds
RHEL and CentOS use a different approach for Rust crates packaging than
Fedora. On Fedora Rust dependencies are packaged as RPMs, e.g.
rust-pyo3+default-devel RPM. These packages don't exist on RHEL and
CentOS. Instead python-cryptography uses a tar ball with vendored crates.
The tar ball is created by a script:
./vendor_rust.py
rhpkg upload cryptography-3.4-vendor.tar.bz2