Repository: pyca/cryptography

Issue:
Look at dropping OpenSSL 1.1.0
I believe the only major distribution that's still supported and uses 1.1.0 is Debian Stretch -- which is EOL in June of 2022 (https://endoflife.date/debian)

PyPI download stats show that 1.1.0 usage among recent cryptography version sdist downloads has fluxtuated between 0.6% and 1.5% over the last 9 months. SQL to reproduce:

```SQL
SELECT
  FORMAT_DATE("%Y-%m", timestamp) AS yyyymm,
  ROUND(100 * SUM(CASE
        WHEN SUBSTR(REGEXP_EXTRACT(details.openssl_version, r"^OpenSSL ([^ ]+) "), 0, 5) = "1.0.1" THEN 1
        ELSE 0 END) / COUNT(*), 1) AS percent_101,
  ROUND(100 * SUM(CASE
        WHEN SUBSTR(REGEXP_EXTRACT(details.openssl_version, r"^OpenSSL ([^ ]+) "), 0, 5) = "1.0.2" THEN 1
        ELSE 0 END) / COUNT(*), 1) AS percent_102,
  ROUND(100 * SUM(CASE
        WHEN SUBSTR(REGEXP_EXTRACT(details.openssl_version, r"^OpenSSL ([^ ]+) "), 0, 5) = "1.1.0" THEN 1
        ELSE 0 END) / COUNT(*), 1) AS percent_110,
  ROUND(100 * SUM(CASE
        WHEN SUBSTR(REGEXP_EXTRACT(details.openssl_version, r"^OpenSSL ([^ ]+) "), 0, 5) = "1.1.1" THEN 1
        ELSE 0 END) / COUNT(*), 1) AS percent_111,
  ROUND(100 * SUM(CASE
        WHEN SUBSTR(REGEXP_EXTRACT(details.openssl_version, r"^OpenSSL ([^ ]+) "), 0, 5) = "3.0.0" THEN 1
        ELSE 0 END) / COUNT(*), 1) AS percent_300,
  COUNT(*) AS download_count
FROM
  `bigquery-public-data.pypi.file_downloads`
WHERE
  DATE(timestamp) BETWEEN DATE_SUB(CURRENT_DATE(), INTERVAL 1 YEAR) AND CURRENT_DATE()
  AND details.openssl_version IS NOT NULL
  AND file.project = 'cryptography'
  AND file.type = 'sdist'
  AND (file.version LIKE '3.4.%' OR file.version LIKE '35.%' OR file.version LIKE '36.%')
GROUP BY
  yyyymm
ORDER BY
  yyyymm DESC
LIMIT
  100
```

Based on this I conclude that at the very latest, we should drop 1.1.0 in July of 2022, but we should consider doing it earlier.

I believe this means we should begin emitting a pending deprecation warning in our 37th release. Opinions?


Discussion:
I'm in favor of starting our standard deprecation cycle here. 37 Pending, 38 Deprecated, 39 removed

Resolving patch:
diff --git a/src/cryptography/hazmat/bindings/openssl/binding.py b/src/cryptography/hazmat/bindings/openssl/binding.py
--- a/src/cryptography/hazmat/bindings/openssl/binding.py
+++ b/src/cryptography/hazmat/bindings/openssl/binding.py
@@ -7,6 +7,7 @@
 import threading
 import types
 import typing
+import warnings
 
 import cryptography
 from cryptography import utils
@@ -179,6 +180,20 @@ def init_static_locks(cls):
         cls._ensure_ffi_initialized()
 
 
+def _verify_openssl_version(lib):
+    if (
+        lib.CRYPTOGRAPHY_OPENSSL_LESS_THAN_111
+        and not lib.CRYPTOGRAPHY_IS_LIBRESSL
+        and not lib.CRYPTOGRAPHY_IS_BORINGSSL
+    ):
+        warnings.warn(
+            "OpenSSL version 1.1.0 is no longer supported by the OpenSSL "
+            "project, please upgrade. A future version of cryptography will "
+            "drop support for it.",
+            utils.DeprecatedIn37,
+        )
+
+
 def _verify_package_version(version):
     # Occasionally we run into situations where the version of the Python
     # package does not match the version of the shared object that is loaded.
@@ -203,3 +218,5 @@ def _verify_package_version(version):
 _verify_package_version(cryptography.__version__)
 
 Binding.init_static_locks()
+
+_verify_openssl_version(Binding.lib)
diff --git a/src/cryptography/utils.py b/src/cryptography/utils.py
--- a/src/cryptography/utils.py
+++ b/src/cryptography/utils.py
@@ -25,6 +25,7 @@ class CryptographyDeprecationWarning(UserWarning):
 PersistentlyDeprecated2019 = CryptographyDeprecationWarning
 DeprecatedIn35 = CryptographyDeprecationWarning
 DeprecatedIn36 = CryptographyDeprecationWarning
+DeprecatedIn37 = CryptographyDeprecationWarning
 
 
 def _check_bytes(name: str, value: bytes) -> None:


Test patch: