Repository: pyca/cryptography

Issue:
Drop Wheezy Builder?
Wheezy is EOL as of May 31, 2018 (https://wiki.debian.org/LTS). Should we drop it out of our test matrix going forward? We still have OpenSSL 1.0.1 coverage through building on Ubuntu 14.04 (supported through April 2019).


Discussion:
We'll lose coverage on older 2.7s (2.7.3 is what wheezy has), before I worry about that maybe we should quantify what 2.7.x versions our users have. Assuming it's not a gross amount, +1 for dropping this from our testing as soon as May 31st rolls around.

Do you have the cycles to do that telemetry work?
Top versions last 30 days:

```

1 | 2236996 | 2.7.6 |  
2 | 469550 | 2.7.12 |  
3 | 295073 | 2.7.13 |  
4 | 193391 | 2.7.14 |  
5 | 156874 | 2.7.5 |  
6 | 110675 | 3.6.5 |  
7 | 88057 | 3.5.2 |  
8 | 81148 | 2.7.9 |  
9 | 64586 | 2.7.10 |  
10 | 62921 | 3.6.3 |  
11 | 42327 | 3.6.4 |  
12 | 29378 | 2.7.15
13 | 26596 | 3.5.3 |  
14 | 23929 | 3.4.3 |  
15 | 23793 | 3.5.5 |  
16 | 23722 | 3.6.2 |  
17 | 20482 | 2.7.3 |  
18 | 19406 | 2.7.11 |  
19 | 18108 | 3.4.5 |  
20 | 17039 | 3.6.1 |  
21 | 14273 | 2.7.15rc1 |  
22 | 14139 | 3.5.1 |  
23 | 12154 | 3.5.4 |  
24 | 9698 | 2.7.8
```
Do we have CI coverage on either 2.7.5 or 2.7.6? If yes, let's kick it to the curb!
Trusty is 2.7.6 so we are covered.
https://packages.ubuntu.com/trusty/python claims 2.7.5, but I remember that
there's some nonsense here. Let's do it.

Wait until it's officially EOL, or just do it now?

On Wed, May 23, 2018 at 8:47 PM Paul Kehrer <notifications@github.com>
wrote:

> Trusty is 2.7.6 so we are covered.
>
> —
> You are receiving this because you commented.
> Reply to this email directly, view it on GitHub
> <https://github.com/pyca/cryptography/issues/4258#issuecomment-391550169>,
> or mute the thread
> <https://github.com/notifications/unsubscribe-auth/AAADBENhKH_uUQyDH3wKhVPWZkYmmcf3ks5t1gM6gaJpZM4UGnH8>
> .
>


-- 
"I disapprove of what you say, but I will defend to the death your right to
say it." -- Evelyn Beatrice Hall (summarizing Voltaire)
"The people's good is the highest law." -- Cicero
GPG Key fingerprint: D1B3 ADC0 E023 8CA6

I'll send a PR now, why not. And yeah the package search says 2.7.5 but if you actually install it then you get 2.7.6.

Resolving patch:
diff --git a/src/cryptography/hazmat/primitives/constant_time.py b/src/cryptography/hazmat/primitives/constant_time.py
--- a/src/cryptography/hazmat/primitives/constant_time.py
+++ b/src/cryptography/hazmat/primitives/constant_time.py
@@ -5,7 +5,9 @@
 from __future__ import absolute_import, division, print_function
 
 import hmac
+import warnings
 
+from cryptography import utils
 from cryptography.hazmat.bindings._constant_time import lib
 
 
@@ -17,6 +19,13 @@ def bytes_eq(a, b):
         return hmac.compare_digest(a, b)
 
 else:
+    warnings.warn(
+        "Support for your Python version is deprecated. The next version of "
+        "cryptography will remove support. Please upgrade to a 2.7.x "
+        "release that supports hmac.compare_digest as soon as possible.",
+        utils.DeprecatedIn23,
+    )
+
     def bytes_eq(a, b):
         if not isinstance(a, bytes) or not isinstance(b, bytes):
             raise TypeError("a and b must be bytes.")
diff --git a/src/cryptography/utils.py b/src/cryptography/utils.py
--- a/src/cryptography/utils.py
+++ b/src/cryptography/utils.py
@@ -22,6 +22,7 @@ class CryptographyDeprecationWarning(UserWarning):
 # cycle ends.
 PersistentlyDeprecated = CryptographyDeprecationWarning
 DeprecatedIn21 = CryptographyDeprecationWarning
+DeprecatedIn23 = CryptographyDeprecationWarning
 
 
 def _check_bytes(name, value):


Test patch: