Repository: pyca/cryptography

Issue:
Build failed on OpenBSD 7.2
OpenBSD 7.2 upgraded LibreSSL to 3.6.0 (LIBRESSL_VERSION_NUMBER 0x3060000fL) that has OPENSSL_cleanup function.

Please update version check in src/_cffi_src/openssl/crypto.py to:
```
#if CRYPTOGRAPHY_IS_LIBRESSL && LIBRESSL_VERSION_NUMBER < 0x3060000fL
static const long Cryptography_HAS_OPENSSL_CLEANUP = 0;
void (*OPENSSL_cleanup)(void) = NULL;
#else
static const long Cryptography_HAS_OPENSSL_CLEANUP = 1;
#endif
```


Discussion:
Is LibreSSL 3.6.0 even released? I don't see it on https://www.libressl.org/releases.html
Not yet, it is still in beta. It is planned to be released on Oct 20, 2022.
[Changelog for 3.6.0](https://github.com/libressl-portable/portable/blob/master/ChangeLog)
@toxadx can you verify that https://github.com/pyca/cryptography/pull/7654 fixes it?
Yes, build is successful.
```
$ uname -a
OpenBSD *hidden* 7.2 GENERIC.MP#731 amd64
```
```
cr/bin/pip install -e "git+ssh://git@github.com/alex/cryptography.git@libressl-360#egg=cryptography"
Obtaining cryptography from git+ssh://****@github.com/alex/cryptography.git@libressl-360#egg=cryptography
  Updating ./cr/src/cryptography clone (to revision libressl-360)
  Running command git fetch -q --tags
  Running command git reset --hard -q 3361a56a275511ccc57948d3b82514d81ebdedec
  Installing build dependencies ... done
  Checking if build backend supports build_editable ... done
  Getting requirements to build editable ... done
  Preparing editable metadata (pyproject.toml) ... done
Collecting cffi>=1.12
  Using cached cffi-1.15.1-cp39-cp39-openbsd_7_2_amd64.whl
Collecting pycparser
  Using cached pycparser-2.21-py2.py3-none-any.whl (118 kB)
Building wheels for collected packages: cryptography
  Building editable for cryptography (pyproject.toml) ... done
  Created wheel for cryptography: filename=cryptography-39.0.0.dev1-0.editable-cp39-cp39-openbsd_7_2_amd64.whl size=10007 sha256=2d01688d2dd0b98a994f0e394e467d3f0dfa88672bba532111dedd520f2574cd
  Stored in directory: /tmp/pip-ephem-wheel-cache-u21kdosw/wheels/e0/ad/ac/ce9f3ba909bd92747c775c16ffb26f0a98360af2ebca88d6b6
Successfully built cryptography
Installing collected packages: pycparser, cffi, cryptography
Successfully installed cffi-1.15.1 cryptography-39.0.0.dev1 pycparser-2.21
```

Resolving patch:
diff --git a/src/_cffi_src/openssl/crypto.py b/src/_cffi_src/openssl/crypto.py
--- a/src/_cffi_src/openssl/crypto.py
+++ b/src/_cffi_src/openssl/crypto.py
@@ -75,7 +75,7 @@
 # define OPENSSL_DIR             SSLEAY_DIR
 #endif
 
-#if CRYPTOGRAPHY_IS_LIBRESSL
+#if CRYPTOGRAPHY_LIBRESSL_LESS_THAN_360
 static const long Cryptography_HAS_OPENSSL_CLEANUP = 0;
 void (*OPENSSL_cleanup)(void) = NULL;
 #else
diff --git a/src/_cffi_src/openssl/cryptography.py b/src/_cffi_src/openssl/cryptography.py
--- a/src/_cffi_src/openssl/cryptography.py
+++ b/src/_cffi_src/openssl/cryptography.py
@@ -47,12 +47,15 @@
     (LIBRESSL_VERSION_NUMBER < 0x3040000f)
 #define CRYPTOGRAPHY_LIBRESSL_LESS_THAN_350 \
     (LIBRESSL_VERSION_NUMBER < 0x3050000f)
+#define CRYPTOGRAPHY_LIBRESSL_LESS_THAN_360 \
+    (LIBRESSL_VERSION_NUMBER < 0x3060000f)
 
 #else
 #define CRYPTOGRAPHY_LIBRESSL_LESS_THAN_322 (0)
 #define CRYPTOGRAPHY_LIBRESSL_LESS_THAN_332 (0)
 #define CRYPTOGRAPHY_LIBRESSL_LESS_THAN_340 (0)
 #define CRYPTOGRAPHY_LIBRESSL_LESS_THAN_350 (0)
+#define CRYPTOGRAPHY_LIBRESSL_LESS_THAN_360 (0)
 #endif
 
 #if OPENSSL_VERSION_NUMBER < 0x10100000
diff --git a/src/cryptography/hazmat/primitives/serialization/ssh.py b/src/cryptography/hazmat/primitives/serialization/ssh.py
--- a/src/cryptography/hazmat/primitives/serialization/ssh.py
+++ b/src/cryptography/hazmat/primitives/serialization/ssh.py
@@ -174,7 +174,9 @@ class _FragList:
 
     flist: typing.List[bytes]
 
-    def __init__(self, init: typing.List[bytes] = None) -> None:
+    def __init__(
+        self, init: typing.Optional[typing.List[bytes]] = None
+    ) -> None:
         self.flist = []
         if init:
             self.flist.extend(init)


Test patch:
diff --git a/tests/hazmat/primitives/test_ec.py b/tests/hazmat/primitives/test_ec.py
--- a/tests/hazmat/primitives/test_ec.py
+++ b/tests/hazmat/primitives/test_ec.py
@@ -479,7 +479,9 @@ def test_load_invalid_ec_key_from_pem(self, backend):
         # BoringSSL rejects infinity points before it ever gets to us, so it
         # uses a more generic error message.
         match = (
-            "infinity" if not backend._lib.CRYPTOGRAPHY_IS_BORINGSSL else None
+            r"infinity|invalid form"
+            if not backend._lib.CRYPTOGRAPHY_IS_BORINGSSL
+            else None
         )
         with pytest.raises(ValueError, match=match):
             serialization.load_pem_public_key(
diff --git a/tests/test_interfaces.py b/tests/test_interfaces.py
--- a/tests/test_interfaces.py
+++ b/tests/test_interfaces.py
@@ -58,7 +58,7 @@ def property(self):
     def test_signature_mismatch(self):
         class SimpleInterface(metaclass=abc.ABCMeta):
             @abc.abstractmethod
-            def method(self, other: object) -> int:
+            def method(self, other: object):
                 """Method with signature"""
 
         class ClassWithoutSignature:
@@ -66,7 +66,7 @@ def method(self, other):
                 """Method without signature"""
 
         class ClassWithSignature:
-            def method(self, other: object) -> int:
+            def method(self, other: object):
                 """Method with signature"""
 
         verify_interface(SimpleInterface, ClassWithoutSignature)