opened
lukeseawalker
username_0
I'm asking help to understand why the drop of the support for OpenSSL 3.2 is affecting only the aarch64 architecture of my AmazonLinux2 OS but not the x86_64 one, using the same version of the packages.

In aarch64 I have
```
$ pip freeze
bcrypt==3.2.0
boto3==1.16.6
botocore==1.19.6
cffi==1.14.3
cryptography==3.2
jmespath==0.10.0
paramiko==2.7.2
pycparser==2.20
PyNaCl==1.4.0
python-dateutil==2.8.1
retrying==1.3.3
s3transfer==0.3.3
six==1.15.0
urllib3==1.25.11

$ rpm -qa | grep -i ssl
openssl-libs-1.0.2k-19.amzn2.0.3.aarch64
openssl-devel-1.0.2k-19.amzn2.0.3.aarch64
openssl-1.0.2k-19.amzn2.0.3.aarch64
perl-IO-Socket-SSL-1.94-7.amzn2.0.1.noarch
python-backports-ssl_match_hostname-3.5.0.1-1.amzn2.noarch
perl-Net-SSLeay-1.55-6.amzn2.0.1.aarch64

$find /opt/virtualenv/ | grep ssl | grep so
/opt/virtualenv/lib/python3.6/site-packages/cryptography/hazmat/bindings/_openssl.abi3.so

$ldd /opt/virtualenv/lib/python3.6/site-packages/cryptography/hazmat/bindings/_openssl.abi3.so
    linux-vdso.so.1 (0x0000ffff986f0000)
    libssl.so.10 => /lib64/libssl.so.10 (0x0000ffff98543000)
    libcrypto.so.10 => /lib64/libcrypto.so.10 (0x0000ffff98323000)
    libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff982ee000)
    libc.so.6 => /lib64/libc.so.6 (0x0000ffff98168000)
    libgssapi_krb5.so.2 => /lib64/libgssapi_krb5.so.2 (0x0000ffff98106000)
    libkrb5.so.3 => /lib64/libkrb5.so.3 (0x0000ffff98003000)
    libcom_err.so.2 => /lib64/libcom_err.so.2 (0x0000ffff97fe2000)
    libk5crypto.so.3 => /lib64/libk5crypto.so.3 (0x0000ffff97f91000)
    libdl.so.2 => /lib64/libdl.so.2 (0x0000ffff97f70000)
    libz.so.1 => /lib64/libz.so.1 (0x0000ffff97f3f000)
    /lib/ld-linux-aarch64.so.1 (0x0000ffff986b2000)
    libkrb5support.so.0 => /lib64/libkrb5support.so.0 (0x0000ffff97f1e000)
    libkeyutils.so.1 => /lib64/libkeyutils.so.1 (0x0000ffff97efd000)
    libresolv.so.2 => /lib64/libresolv.so.2 (0x0000ffff97eca000)
    libselinux.so.1 => /lib64/libselinux.so.1 (0x0000ffff97e87000)
    libpcre.so.1 => /lib64/libpcre.so.1 (0x0000ffff97e36000)

$ ls -la /lib64/libssl*
-rwxr-xr-x 1 root root 407136 Jan  9  2020 /lib64/libssl3.so
lrwxrwxrwx 1 root root     16 Oct 27 21:11 /lib64/libssl.so -> libssl.so.1.0.2k
lrwxrwxrwx 1 root root     16 Sep 21 21:16 /lib64/libssl.so.10 -> libssl.so.1.0.2k
-rwxr-xr-x 1 root root 490448 Mar 19  2020 /lib64/libssl.so.1.0.2k
```

In x86_64 I have
```
# pip freeze
bcrypt==3.2.0
boto3==1.16.6
botocore==1.19.6
cffi==1.14.3
cryptography==3.2
jmespath==0.10.0
paramiko==2.7.2
pycparser==2.20
PyNaCl==1.4.0
python-dateutil==2.8.1
retrying==1.3.3
s3transfer==0.3.3
six==1.15.0
urllib3==1.25.11

# rpm -qa | grep -i ssl
openssl-1.0.2k-19.amzn2.0.3.x86_64
perl-IO-Socket-SSL-1.94-7.amzn2.0.1.noarch
perl-Net-SSLeay-1.55-6.amzn2.0.1.x86_64
python-backports-ssl_match_hostname-3.5.0.1-1.amzn2.noarch
openssl-devel-1.0.2k-19.amzn2.0.3.x86_64
openssl-libs-1.0.2k-19.amzn2.0.3.x86_64

# find /opt/virtualenv/lib/python3.6/ | grep ssl | grep so
/opt/virtualenv/lib/python3.6/site-packages/cryptography/hazmat/bindings/_openssl.abi3.so

# ldd /opt/virtualenv/lib/python3.6/site-packages/cryptography/hazmat/bindings/_openssl.abi3.so
    linux-vdso.so.1 (0x00007ffc02eea000)
    libpthread.so.0 => /lib64/libpthread.so.0 (0x00007f8323ab3000)
    libc.so.6 => /lib64/libc.so.6 (0x00007f8323708000)
    /lib64/ld-linux-x86-64.so.2 (0x00007f83242b4000)
```

The difference I can see is that in the x86_64 architecture, the cryptography bindings are not linking any SSL lib and it's not clear to me why this is different from aarch64.
Can you please help me in clarifying this?

Thanks
L
Question about dropping OpenSSL support in 3.2
issue
created
alex
username_1
I believe it's because on x86_64 you got a wheel from us, which includes a pre-compiled cryptography that statically links its own OpenSSL 1.1.1. But you didn't install a pre-compiled wheel on aarch64.

Please note that we _do_ publish aarch64 wheels, so you can probably obtain one by updating to a newer pip.
comment
created
alex
username_1
Since I can see you work at AWS, you may also want to consult your colleague @username_2 you helped us set up our aarch64 infra.
comment
created
geoffreyblake
username_2
The official 3.2 wheel seems ok:

```
(.env) [ec2-user@ip-172-31-11-57 pytest]$ python3 -m pip install cryptography==3.2
Collecting cryptography==3.2
  Downloading cryptography-3.2-cp35-abi3-manylinux2014_aarch64.whl (2.6 MB)
     |████████████████████████████████| 2.6 MB 14.9 MB/s
Requirement already satisfied: cffi!=1.11.3,>=1.8 in ./.env/lib/python3.6/site-packages (from cryptography==3.2) (1.14.3)
Requirement already satisfied: six>=1.4.1 in ./.env/lib/python3.6/site-packages (from cryptography==3.2) (1.15.0)
Requirement already satisfied: pycparser in ./.env/lib/python3.6/site-packages (from cffi!=1.11.3,>=1.8->cryptography==3.2) (2.20)
Installing collected packages: cryptography
Successfully installed cryptography-3.2
(.env) [ec2-user@ip-172-31-11-57 pytest]$ ldd .env/lib/python3.6/site-packages/cryptography/hazmat/bindings/_openssl.abi3.so
        linux-vdso.so.1 (0x0000ffff9ffa0000)
        libpthread.so.0 => /lib64/libpthread.so.0 (0x0000ffff9fbb0000)
        libc.so.6 => /lib64/libc.so.6 (0x0000ffff9fa30000)
        /lib/ld-linux-aarch64.so.1 (0x0000ffff9ffb0000)
```

I'll chat with @username_0 about his use case privately.
comment
created
lukeseawalker
username_0
Thanks everybody, for the records I solved it updating pip
Before
```
$ pip --version
pip 18.1 from /opt/virtualenv/lib/python3.6/site-packages/pip (python 3.6)

$ pip install --force-reinstall  cryptography
Collecting cryptography
  Using cached https://files.pythonhosted.org/packages/94/5c/42de91c7fbdb817b2d9a4e64b067946eb38a4eb36c1a09c96c87a0f86a82/cryptography-3.2.1.tar.gz
  Installing build dependencies ... done
```
After pip update
```
$ pip --version
pip 20.2.4 from /opt/virtualenv/lib/python3.6/site-packages/pip (python 3.6)

$ pip install --force-reinstall  cryptography
Collecting cryptography
  Downloading https://files.pythonhosted.org/packages/08/31/c43f1e45b4a5ebac13ff038a3f167ba3c7432f6dc8683ea504f5af9265eb/cryptography-3.2.1-cp35-abi3-manylinux1_x86_64.whl (2.6MB)
    100% |████████████████████████████████| 2.7MB 18.3MB/s
Collecting six>=1.4.1 (from cryptography)
```

The info that I was missing is that pip 19.3+ is required to enable installation of python wheel binaries on Graviton, [source](https://github.com/aws/aws-graviton-getting-started)

You can close this.
L
comment
created
alex
username_1
Glad to hear this was resolved.
comment
closed
alex
username_1
issue