Change:
Steps to reproduce the behavior: ceph via Happening on current (currently at ), as well as on and . Do note that while this looks like a build failure for , is the one overriding the package version to something incompatible. The unaltered package builds fine. Please run and paste the result. Add a :+1: [reaction] to [issues you find important]. [reaction]: [issues you find important]:
See also , which I think should fix this.
Trying to build samba4Full and it errors on the same package. Just for any info for anyone.
I have addressed further review comments in Please somebody review.
Same error today with 'github:nixos/nixpkgs/' (2024-08-18)'

Discussion:
homepage = "https://ceph.io/en/"; inherit description; license = with lib.licenses; [ lgpl21 gpl2Only bsd3 mit publicDomain ]; <del> maintainers = with lib.maintainers; [ adev ak johanot krav ]; </del> <ins> maintainers = with lib.maintainers; [ adev ak johanot krav nh2 ]; </ins> platforms = [ "x86_64-linux" "aarch64-linux" ]; };

python = python311.override { self = python; packageOverrides = self: super: let <del> cryptographyOverrideVersion = "40.0.1"; </del> bcryptOverrideVersion = "4.0.1"; in { <del> # Ceph does not support `bcrypt` > 4.0 yet: </del> <ins> # Ceph does not support the following yet: # * `bcrypt` > 4.0 # * `cryptography` > 40 # See: # * https://github.com/NixOS/nixpkgs/pull/281858#issuecomment-1899358602 </ins> # * Upstream issue: https://tracker.ceph.com/issues/63529 #   > Python Sub-Interpreter Model Used by ceph-mgr Incompatible With Python Modules Based on PyO3 <ins> # * Moved to issue: https://tracker.ceph.com/issues/64213 #   > MGR modules incompatible with later PyO3 versions - PyO3 modules may only be initialized once per interpreter process </ins> bcrypt = super.bcrypt.overridePythonAttrs (old: rec { pname = "bcrypt"; version = bcryptOverrideVersion;

hash = "sha256-lDWX69YENZFMu7pyBmavUZaalGvFqbHSHfkwkzmDQaY="; }; }); <del> # Ceph does not support `cryptography` > 40 yet: # * https://github.com/NixOS/nixpkgs/pull/281858#issuecomment-1899358602 # * Upstream issue: https://tracker.ceph.com/issues/63529 #   > Python Sub-Interpreter Model Used by ceph-mgr Incompatible With Python Modules Based on PyO3 # </del> # We pin the older `cryptography` 40 here; # this also forces us to pin an older `pyopenssl` because the current one # is not compatible with older `cryptography`, see: #     https://github.com/pyca/pyopenssl/blob/d9752e44127ba36041b045417af8a0bf16ec4f1e/CHANGELOG.rst#2320-2023-05-30 <del> cryptography = super.cryptography.overridePythonAttrs (old: rec { version = cryptographyOverrideVersion; src = fetchPypi { inherit (old) pname; version = cryptographyOverrideVersion; hash = "sha256-KAPy+LHpX2FEGZJsfm9V2CivxhTKXtYVQ4d65mjMNHI="; }; cargoDeps = rustPlatform.fetchCargoTarball { inherit src; sourceRoot = let cargoRoot = "src/rust"; in "${old.pname}-${cryptographyOverrideVersion}/${cargoRoot}"; name = "${old.pname}-${cryptographyOverrideVersion}"; hash = "sha256-gFfDTc2QWBWHBCycVH1dYlCsWQMVcRZfOBIau+njtDU="; }; # Not using the normal `(old.patches or []) ++` pattern here to use # the overridden package's patches, because current nixpkgs's `cryptography` # has patches that do not apply on this old version. patches = [ # Fix https://nvd.nist.gov/vuln/detail/CVE-2023-49083 which has no upstream backport. # See https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a#diff-f5134bf8f3cf0a5cc8601df55e50697acc866c603a38caff98802bd8e17976c5R1893 ./python-cryptography-Cherry-pick-fix-for-CVE-2023-49083-on-cryptography-40.patch ]; # Tests would require overriding `cryptography-vectors`, which is not currently # possible/desired, see: https://github.com/NixOS/nixpkgs/pull/281858#pullrequestreview-1841421866 doCheck = false; }); </del> <ins> cryptography = self.callPackage ./old-python-packages/cryptography.nix {}; </ins> # This is the most recent version of `pyopenssl` that's still compatible with `cryptography` 40. # See https://github.com/NixOS/nixpkgs/pull/281858#issuecomment-1899358602

]; }); <ins> fastapi = super.fastapi.overridePythonAttrs (old: rec { # Flaky test: #     ResourceWarning: Unclosed <MemoryObjectSendStream> # Unclear whether it's flaky in general or only in this overridden package set. doCheck = false; }); </ins> # Ceph does not support `kubernetes` >= 19, see: #     https://github.com/NixOS/nixpkgs/pull/281858#issuecomment-1900324090 kubernetes = super.kubernetes.overridePythonAttrs (old: rec {

passthru = { inherit version; <ins> inherit python; # to be able to test our overridden packages above individually with `nix-build -A` </ins> tests = { inherit (nixosTests) ceph-multi-node

<ins> # This older version only exists because `ceph` needs it, see `cryptography.nix`. { buildPythonPackage, fetchPypi, lib, cryptography, }: buildPythonPackage rec { pname = "cryptography-vectors"; # The test vectors must have the same version as the cryptography package inherit (cryptography) version; format = "setuptools"; src = fetchPypi { pname = "cryptography_vectors"; inherit version; hash = "sha256-hGBwa1tdDOSoVXHKM4nPiPcAu2oMYTPcn+D1ovW9oEE="; }; # No tests included doCheck = false; pythonImportsCheck = [ "cryptography_vectors" ]; meta = with lib; { description = "Test vectors for the cryptography package"; homepage = "https://cryptography.io/en/latest/development/test-vectors/"; # Source: https://github.com/pyca/cryptography/tree/master/vectors; license = with licenses; [ asl20 bsd3 ]; maintainers = with maintainers; [ nh2 ]; }; } </ins>

<ins> # This older version only exists because `ceph` needs it, see its package. { lib, stdenv, callPackage, buildPythonPackage, fetchPypi, fetchpatch, rustPlatform, cargo, rustc, setuptoolsRustBuildHook, openssl, Security ? null, isPyPy, cffi, pkg-config, pytestCheckHook, pytest-subtests, pythonOlder, pretend, libiconv, libxcrypt, iso8601, py, pytz, hypothesis, }: let cryptography-vectors = callPackage ./cryptography-vectors.nix { }; in buildPythonPackage rec { pname = "cryptography"; version = "40.0.1"; # Also update the hash in vectors.nix format = "setuptools"; disabled = pythonOlder "3.6"; src = fetchPypi { inherit pname version; hash = "sha256-KAPy+LHpX2FEGZJsfm9V2CivxhTKXtYVQ4d65mjMNHI="; }; cargoDeps = rustPlatform.fetchCargoTarball { inherit src; sourceRoot = "${pname}-${version}/${cargoRoot}"; name = "${pname}-${version}"; hash = "sha256-gFfDTc2QWBWHBCycVH1dYlCsWQMVcRZfOBIau+njtDU="; }; # Since Cryptography v40 is quite outdated, we need to backport # security fixes that are only available in newer versions. patches = [ # Fix https://nvd.nist.gov/vuln/detail/CVE-2023-49083 which has no upstream backport. # See https://github.com/pyca/cryptography/commit/f09c261ca10a31fe41b1262306db7f8f1da0e48a#diff-f5134bf8f3cf0a5cc8601df55e50697acc866c603a38caff98802bd8e17976c5R1893 ./python-cryptography-Cherry-pick-fix-for-CVE-2023-49083-on-cryptography-40.patch # Fix https://nvd.nist.gov/vuln/detail/CVE-2024-26130 # See https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55 (fetchpatch { name = "python-cryptography-CVE-2024-26130-dont-crash-when-a-PKCS-12-key-and-cert-dont-match-mmap-mode.patch"; url = "https://github.com/pyca/cryptography/commit/97d231672763cdb5959a3b191e692a362f1b9e55.patch"; hash = "sha256-l45NOzOWhHW4nY4OIRpdjYQRvUW8BROGWdpkAtvVn0Y="; }) ]; postPatch = '' substituteInPlace pyproject.toml  --replace "--benchmark-disable" "" ''; cargoRoot = "src/rust"; nativeBuildInputs = [ rustPlatform.cargoSetupHook setuptoolsRustBuildHook cargo rustc pkg-config ] ++ lib.optionals (!isPyPy) [ cffi ]; buildInputs = [ openssl ] ++ lib.optionals stdenv.isDarwin [ Security libiconv ] ++ lib.optionals (pythonOlder "3.9") [ libxcrypt ]; propagatedBuildInputs = lib.optionals (!isPyPy) [ cffi ]; nativeCheckInputs = [ cryptography-vectors hypothesis iso8601 pretend py pytestCheckHook pytest-subtests pytz ]; pytestFlagsArray = [ "--disable-pytest-warnings" ]; disabledTestPaths = [ # save compute time by not running benchmarks "tests/bench" ] ++ lib.optionals (stdenv.isDarwin && stdenv.isAarch64) [ # aarch64-darwin forbids W+X memory, but this tests depends on it: # * https://cffi.readthedocs.io/en/latest/using.html#callbacks "tests/hazmat/backends/test_openssl_memleak.py" ]; meta = with lib; { description = "A package which provides cryptographic recipes and primitives"; longDescription = '' Cryptography includes both high level recipes and low level interfaces to common cryptographic algorithms such as symmetric ciphers, message digests, and key derivation functions. Our goal is for it to be your "cryptographic standard library". It supports Python 2.7, Python 3.5+, and PyPy 5.4+. ''; homepage = "https://github.com/pyca/cryptography"; changelog = "https://cryptography.io/en/latest/changelog/#v" + replaceStrings [ "." ] [ "-" ] version; license = with licenses; [ asl20 bsd3 psfl ]; maintainers = with maintainers; [ nh2 ]; }; } </ins>

<ins> commit 08dbad8552ecca85d3e38072f94eb864b143d218 Author: Niklas Hambüchen <mail@nh2.me> Date:   Mon Jan 22 12:52:06 2024 +0000 Cherry-pick fix for CVE-2023-49083 Cherry-Picked-From: f09c261ca10a31fe41b1262306db7f8f1da0e48a Cherry-Picked-By: Niklas Hambüchen <mail@nh2.me> diff --git a/src/cryptography/hazmat/backends/openssl/backend.py b/src/cryptography/hazmat/backends/openssl/backend.py index a3fe1bce4..58e7207c4 100644 --- a/src/cryptography/hazmat/backends/openssl/backend.py +++ b/src/cryptography/hazmat/backends/openssl/backend.py @@ -2383,9 +2383,12 @@ class Backend: _Reasons.UNSUPPORTED_SERIALIZATION, ) +        certs: list[x509.Certificate] = [] +        if p7.d.sign == self._ffi.NULL: +            return certs + sk_x509 = p7.d.sign.cert num = self._lib.sk_X509_num(sk_x509) -        certs = [] for i in range(num): x509 = self._lib.sk_X509_value(sk_x509, i) self.openssl_assert(x509 != self._ffi.NULL) diff --git a/tests/hazmat/primitives/test_pkcs7.py b/tests/hazmat/primitives/test_pkcs7.py index 4e61c5ef5..d8170bfb9 100644 --- a/tests/hazmat/primitives/test_pkcs7.py +++ b/tests/hazmat/primitives/test_pkcs7.py @@ -89,6 +89,12 @@ class TestPKCS7Loading: mode="rb", ) +    def test_load_pkcs7_empty_certificates(self, backend): +        der = b"x30x0Bx06x09x2Ax86x48x86xF7x0Dx01x07x02" + +        certificates = pkcs7.load_der_pkcs7_certificates(der) +        assert certificates == [] + # We have no public verification API and won't be adding one until we get # some requirements from users so this function exists to give us basic </ins>

<del> commit 08dbad8552ecca85d3e38072f94eb864b143d218 Author: Niklas Hambüchen <mail@nh2.me> Date:   Mon Jan 22 12:52:06 2024 +0000 Cherry-pick fix for CVE-2023-49083 Cherry-Picked-From: f09c261ca10a31fe41b1262306db7f8f1da0e48a Cherry-Picked-By: Niklas Hambüchen <mail@nh2.me> diff --git a/src/cryptography/hazmat/backends/openssl/backend.py b/src/cryptography/hazmat/backends/openssl/backend.py index a3fe1bce4..58e7207c4 100644 --- a/src/cryptography/hazmat/backends/openssl/backend.py +++ b/src/cryptography/hazmat/backends/openssl/backend.py @@ -2383,9 +2383,12 @@ class Backend: _Reasons.UNSUPPORTED_SERIALIZATION, ) +        certs: list[x509.Certificate] = [] +        if p7.d.sign == self._ffi.NULL: +            return certs + sk_x509 = p7.d.sign.cert num = self._lib.sk_X509_num(sk_x509) -        certs = [] for i in range(num): x509 = self._lib.sk_X509_value(sk_x509, i) self.openssl_assert(x509 != self._ffi.NULL) diff --git a/tests/hazmat/primitives/test_pkcs7.py b/tests/hazmat/primitives/test_pkcs7.py index 4e61c5ef5..d8170bfb9 100644 --- a/tests/hazmat/primitives/test_pkcs7.py +++ b/tests/hazmat/primitives/test_pkcs7.py @@ -89,6 +89,12 @@ class TestPKCS7Loading: mode="rb", ) +    def test_load_pkcs7_empty_certificates(self, backend): +        der = b"x30x0Bx06x09x2Ax86x48x86xF7x0Dx01x07x02" + +        certificates = pkcs7.load_der_pkcs7_certificates(der) +        assert certificates == [] + # We have no public verification API and won't be adding one until we get # some requirements from users so this function exists to give us basic </del>