Bug: Error on sam build command

[getanwar]

Description:

I can not build projects after upgrading sam cli from 1.65.0 to 1.67.0
After facing the issue for a couple of times I thought it might fix if I remove python3.8 manually and reinstall aws-sam-cli. But it did not solve it. I confirmed that python3.8 was reinstall with aws-sam-cli

Steps to reproduce:

1. run brew upgrade aws-sam-cli
2. try to build any sam project

I encountered the following error after doing that.

Observed result:

sam build --debug

  File "/opt/homebrew/bin/sam", line 8, in <module>
    sys.exit(cli())
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/click/core.py", line 1130, in __call__
    return self.main(*args, **kwargs)
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/click/core.py", line 1055, in main
    rv = self.invoke(ctx)
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/click/core.py", line 1651, in invoke
    cmd_name, cmd, args = self.resolve_command(ctx, args)
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/click/core.py", line 1698, in resolve_command
    cmd = self.get_command(ctx, cmd_name)
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/samcli/cli/command.py", line 133, in get_command
    mod = importlib.import_module(pkg_name)
  File "/opt/homebrew/Cellar/python@3.8/3.8.16/Frameworks/Python.framework/Versions/3.8/lib/python3.8/importlib/__init__.py", line 127, in import_module
    return _bootstrap._gcd_import(name[level:], package, level)
  File "<frozen importlib._bootstrap>", line 1014, in _gcd_import
  File "<frozen importlib._bootstrap>", line 991, in _find_and_load
  File "<frozen importlib._bootstrap>", line 975, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 671, in _load_unlocked
  File "<frozen importlib._bootstrap_external>", line 843, in exec_module
  File "<frozen importlib._bootstrap>", line 219, in _call_with_frames_removed
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/samcli/commands/build/__init__.py", line 6, in <module>
    from .command import cli  # noqa
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/samcli/commands/build/command.py", line 12, in <module>
    from samcli.commands._utils.options import (
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/samcli/commands/_utils/options.py", line 21, in <module>
    from samcli.commands._utils.template import get_template_data, TemplateNotFoundException
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/samcli/commands/_utils/template.py", line 10, in <module>
    from botocore.utils import set_value_from_jmespath
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/botocore/utils.py", line 37, in <module>
    import botocore.httpsession
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/botocore/httpsession.py", line 46, in <module>
    from urllib3.contrib.pyopenssl import (
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/urllib3/contrib/pyopenssl.py", line 50, in <module>
    import OpenSSL.crypto
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/OpenSSL/__init__.py", line 8, in <module>
    from OpenSSL import crypto, SSL
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/OpenSSL/crypto.py", line 3268, in <module>
    _lib.OpenSSL_add_all_algorithms()
AttributeError: module 'lib' has no attribute 'OpenSSL_add_all_algorithms'

Expected result:

Additional environment details (Ex: Windows, Mac, Amazon Linux etc)

1. OS: MacOS 12.4 (Monterey)
2. sam --version: SAM CLI, version 1.67.0
3. AWS region: us-east-2

Add --debug flag to command you are running

[JoL0712]

cryptography 39.0.0 no longer supports openssl 1.1.0 or older and thus is causing this issue.
Reference:

• AttributeError: module 'lib' has no attribute 'OpenSSL_add_all_algorithms'. AWS sam build failure. pyca/cryptography#7959
• https://cryptography.io/en/latest/changelog/#v39-0-0

aws-sam-cli uses the latest cryptography while using pyopenssl 22.0.0. These two are incompatible.
As a workaround until the dependencies are fixed, you can force install cryptography 38.0.4 and sam should work (I just verified with my CI/CD builds which all got broken today due to the cryptography update).

[nszeitli]

Getting this in all our github actions using aws-actions/setup-sam. New years day dependency bomb!

[getanwar]

cryptography 39.0.0 no longer supports openssl 1.1.0 or older and thus is causing this issue. Reference:

• AttributeError: module 'lib' has no attribute 'OpenSSL_add_all_algorithms' pyca/cryptography#7959
• https://cryptography.io/en/latest/changelog/#v39-0-0

aws-sam-cli uses the latest cryptography while using pyopenssl 22.0.0. These two are incompatible. As a workaround until the dependencies are fixed, you can force install cryptography 38.0.4 and sam should work (I just verified with my CI/CD builds which all got broken today due to the cryptography update).

Thank you so much. I got it work!

[reaperhulk]

pyOpenSSL declares a lower and upper bound on its own dependencies to avoid this sort of issue, however it didn't start to do so until version 22.1.0. This repository currently pins 22.0.0

aws-sam-cli/requirements/base.txt

Line 21 in 07fa5f4

pyopenssl==22.0.0

Once the pin is updated you won't see this type of issue again in the future.

Note that the drop of OpenSSL 1.1.0 is not really related to this issue, as over 98% of cryptography's downloads come from wheels (which we do against openssl3-latest) rather than being locally built.

[Obrecsys]

How did you get it to work?

[karimdaghari]

cryptography 39.0.0 no longer supports openssl 1.1.0 or older and thus is causing this issue.
Reference:

pyca/cryptography#7959
https://cryptography.io/en/latest/changelog/#v39-0-0
aws-sam-cli uses the latest cryptography while using pyopenssl 22.0.0. These two are incompatible.
As a workaround until the dependencies are fixed, you can force install cryptography 38.0.4 and sam should work (I just verified with my CI/CD builds which all got broken today due to the cryptography update).

If you're on MacOS/Homebrew here's how to implement the workaround:

/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/bin/pip install --force-reinstall "cryptography==38.0.4"

[korostelevm]

Having this issue in codebuild as well (aws/codebuild/standard:5.0)

[altaurog]

@nszeitli for aws-actions/setup-sam, you can add the following step to github workflow (worked for us):

      - name: sam fix https://github.com/aws/aws-sam-cli/issues/4527
        run: $(dirname $(readlink $(which sam)))/pip install --force-reinstall "cryptography==38.0.4"

[moelasmar]

We are checking this issue. Could you please confirm do you see this issue only on homebrew installation or also on the pkg installation?

[aahung]

Error using setup-sam GH action (with pip install inside)

https://github.com/aahung/test-pipeline-20211006/actions/runs/3825152161/jobs/6507908315

[moelasmar]

This issue is only affecting the people who use pip to install AWS SAM CLI, or use the homebrew installation way on ARM architecture (linux or mac).

For macOS users, We recommend using the PKG installation approach, and For Linux users, we recommend the Command line installer way. You can find all the installation details here.

For pip installations, you can try the @karimdaghari workaround (Thanks @karimdaghari for your help :) )

We are working on the fix for this issue, we will update this issue once it got released.

[moelasmar]

Thanks @getanwar for raising this issue. Could you please try the PKG installation and let us know if it fixed your issue?

[gaurav7700]

karimdaghari

Thanks, it worked !

[fizwan]

as of now, github actions that depends on sam cli still failed

Edit: In the meantime, while waiting for the release of the fixes, you can try add this temporary workaround step right after this step:
- uses: aws-actions/setup-sam@v2

[Raul-CC]

ons that depends on sam cli still failed

Kudos to @altaurog, his line of the fixed version of cryptography worked like a charm:
This is our current setup, using Github for building:

      - name: Setup AWS SAM
        uses: aws-actions/setup-sam@v1
        with:
          version: 1.65.0
      - name: sam fix https://github.com/aws/aws-sam-cli/issues/4527
        run: $(dirname $(readlink $(which sam)))/pip install --force-reinstall "cryptography==38.0.4"

[altaurog]

Thanks @Raul-CC ! As an aside, note that the latest version of aws-actions/setup-sam is v2. (Sorry, I realize this isn’t exactly on-topic)

[hawflau]

Closing as the fix has been released with AWS SAM CLI v1.68.0 - https://github.com/aws/aws-sam-cli/releases/tag/v1.68.0

[github-actions]

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[Gordonbaes]

Hi guys, help!

I am having the same problem with my CI/CD pipelines on Google Cloud. I tried to reinstall cryptography but doesn't seem to work - it keeps returning the same AttributeError: module 'lib' has no attribute 'OpenSSL_add_all_algorithms'.

Not sure if my syntax below is correct?

pip install --force-reinstall "cryptography==38.0.4"
pip3 install --force-reinstall "cryptography==38.0.4"

I also tried to include cryptography==38.0.4 in my requirements.txt file and reinstall it, only to receive the same error:

[altaurog]

Check which pip you are using @Gordonbaes . If it isn’t /home/htrinh/.local/bin/pip it won’t help you.

[Gordonbaes]

Thanks @altaurog I was looking at the wrong place. However when I tried to run pip install --force-reinstall "cryptography==38.0.4" in /usr/local/bin/pip it didn't work either...
The error is still AttributeError: module 'lib' has no attribute 'OpenSSL_add_all_algorithms'.

Below is a screenshot of the beginning of the error:

Apologies if my question sounds silly, I'm super new on this :)

[altaurog]

@Gordonbaes it is difficult to diagnose this without more information, but it doesn’t look like the same error as reported here. This error arose when invoking sam, and v1.68.0 is meant to fix that. Your error arises when invoking pip, which would seem to indicate the python env is somehow broken. What version of pip do you have?