Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Adjust cryptography version bounds to be more accurate #486

Merged
merged 1 commit into from
Oct 13, 2021
Merged

Adjust cryptography version bounds to be more accurate #486

merged 1 commit into from
Oct 13, 2021

Conversation

sirosen
Copy link
Member

@sirosen sirosen commented Oct 13, 2021

No description provided.

@sirosen
Copy link
Member Author

sirosen commented Oct 13, 2021

I'm actually going to update this to adjust the lower-bound as well. It turns out that pyjwt requires cryptography>=3 and, by my reading of the situation, might actually need >=3.1 because it instantiates rsa pubkeys without specifying a backend. (Which was a new usage supported in 3.1)

I also want to take another look at the mindeps build, to make sure it's doing the right thing.

@sirosen
Adjust cryptography bounds to handle pyjwt
96aa868 
pyjwt>=2.0 requires cryptography>=3.3.1
Rather than specifying a lower bound than that, raise our minimum
version to match. This signals to us, to our users, and to dependency
solvers that we need this version.

On `cryptography<3.1`, `decode_id_token()` fails because PyJWT tries
to load an RSA pubkey and uses the `cryptography` API in a way that
was newly added in v3.1 (does not pass a backend).
@sirosen sirosen changed the title Fix cryptography upper bound Adjust cryptography version bounds to be more accurate Oct 13, 2021
@sirosen sirosen merged commit 6edb30d into globus:main Oct 13, 2021
@sirosen sirosen deleted the fix-crypto-bound branch October 13, 2021 20:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@sirosen