Problem with package: cryptography no wheels for Python 3.11 and OpenSSL 3.x

[arthur-proglove]

Package name

cryptography

Package version

43.0

PyPI URL

https://pypi.org/project/cryptography/

piwheels URL

https://www.piwheels.org/project/cryptography/

Python version

• Python 3.9
• Python 3.11

I am aware this is the issue tracker for a Python package index specifically for Raspberry Pi

• Yes

I have checked for duplicate issues

• Yes

I am the maintainer

• Yes

More information

The JSON metadata file is reporting a 3.11 ABI for the cryptography version 43 but it is a 3.7 ABI.

$ curl https://piwheels.org/project/cryptography/json/ | jq '.releases."43.0.0"' 
{
  "released": "2024-07-20 16:38:04",
  "prerelease": false,
  "yanked": false,
  "skip_reason": "",
  "files": {
    "cryptography-43.0.0-cp37-abi3-linux_armv6l.whl": {
      "filehash": "753936c34638683658391e76bb2e61428cbaf0868667144eed942b826f6663cf",
      "filesize": 1535029,
      "builder_abi": "cp311",
      "file_abi_tag": "abi3",
      "platform": "linux_armv6l",
      "requires_python": ">=3.7",
      "apt_dependencies": []
    },
    "cryptography-43.0.0-cp37-abi3-linux_armv7l.whl": {
      "filehash": "753936c34638683658391e76bb2e61428cbaf0868667144eed942b826f6663cf",
      "filesize": 1535029,
      "builder_abi": "cp311",
      "file_abi_tag": "abi3",
      "platform": "linux_armv7l",
      "requires_python": ">=3.7",
      "apt_dependencies": []
    }
  }
}

When downloading the cryptography-43.0.0-cp37-abi3-linux_armv6l.whl file, the rust library is built against OpenSSL 1.1

$ readelf -a  cryptography/hazmat/bindings/_rust.abi3.so  | grep 'Shared library' | grep ssl
 0x00000001 (NEEDED)                     Shared library: [libssl.so.1.1]

On the 42 version, this was correct

$ readelf -a  cryptography/hazmat/bindings/_rust.cpython-311-arm-linux-gnueabihf.so  | grep 'Shared library' | grep ssl
 0x00000001 (NEEDED)                     Shared library: [libssl.so.3]

[bennuttall]

So in issue #462 the problem was with Bullseye (cp39). It was suggested that we build with the statically linked openssl 3. I did that and the resultant wheel was tagged as cp37 which means "compatible with python 3.7 and above" and abi3 which means any Python 3. So it should work for Python 3.9 and 3.11 on either OS, unless the build flag didn't actually statically link openssl.

I will remove the build for now. You'll have to compile it yourself with rust.

[arthur-proglove]

So in issue #462 the problem was with Bullseye (cp39). It was suggested that we build with the statically linked openssl 3. I did that and the resultant wheel was tagged as cp37 which means "compatible with python 3.7 and above" and abi3 which means any Python 3. So it should work for Python 3.9 and 3.11 on either OS, unless the build flag didn't actually statically link openssl.

I will remove the build for now. You'll have to compile it yourself with rust.

ah yes, I see what you mean, it should have worked on 3.11.
Then I guess it was not statically compiled :-).

Thanks for the answer (and your work!)