Support manylinux wheel for WSL (Windows Subsystem for Linux)

[mhils]

The cryptography manylinux wheel currently fail under the Windows Subsystem for Linux:

$ pip3 install cryptography
$ python3 -c "import OpenSSL"
  File "/home/user/venv/lib/python3.5/site-packages/OpenSSL/__init__.py", line 8, in <module>
    from OpenSSL import crypto, SSL
  File "/home/user/venv/lib/python3.5/site-packages/OpenSSL/crypto.py", line 16, in <module>
    from OpenSSL._util import (
  File "/home/user/venv/lib/python3.5/site-packages/OpenSSL/_util.py", line 6, in <module>
    from cryptography.hazmat.bindings.openssl.binding import Binding
  File "/home/user/venv/lib/python3.5/site-packages/cryptography/hazmat/bindings/openssl/binding.py", line 13, in <module>
    from cryptography.hazmat.bindings._openssl import ffi, lib
ImportError: /home/user/venv/lib/python3.5/site-packages/cryptography/hazmat/bindings/_openssl.abi3.so: 
cannot enable executable stack as shared object requires: Invalid argument

The reason for this seems to be that _openssl.abi3.so has the executable stack flag bit set, which WSL does not support.

There are some good news: If I just clear that bit (execstac -c _openssl.abi3.so), I can successfully import OpenSSL. Skipping the manylinux wheel on WSL (pip3 install cryptography --no-binary cryptography) also works fine, as the resulting .so file does not have the execstack bit set.

Looking at what said bit enables, it looks like a good idea to have execstack disabled in any case. The nice side effect would be to fix WSL installations along the way. 😃

See also: microsoft/WSL#286, microsoft/WSL#916

[alex]

Why the fuck does anything ever get built with executable stack? Are we trying to make life easy for attackers?

What upstream do I need to complain to to fix this, gcc?

[alex]

(Also yes, in the meantime we should fix this in our build process; and IMO we should issue a release with it ASAP)

[alex]

Filed openssl/openssl#4575 with OpenSSL, which appears to be the cause of the issue.

In teh meantime we should pass the correct incanation like the linux distros do when we build OpenSSL

[reaperhulk]

2.1.2 is now released and resolves this.

[alex]

Done in our 2.1.2 release.

[mhils]

Wow, that was quick - thanks so much! 😃