Dependency on an old version of cryptography
Metadata
Current evaluation
Resolved by merged PR #1024 (96f6a183), upgrading cryptography from 3.4.8 to 39.0 and adding required Rust build dependencies for supported architectures.
Resolution: closed resolved
Reason: PR #1024 was merged as commit 96f6a183, updating cryptography to v39.0 and adding the required Rust dependencies to snapcraft.yaml. This directly addressed the dependency limitation tracked by #991.
Evaluated by: mr-cal-bot
No scores available.
Issue body
Charmcraft (and several other apps) depend indirectly on `cryptography` (cryptography -> SecretStorage -> keyring -> craft-store...). We've pinned `cryptography==3.4.8` because of a lack of rust dependencies on supported platforms.
See:
* https://github.com/canonical/charmcraft/pull/619
* https://github.com/canonical/charmcraft/pull/978
* https://github.com/pyca/cryptography/issues/5776
Cryptography 39 [requires](https://cryptography.io/en/39.0.0/installation/#rust) Rust v1.48.0 or newer. Currently on 18.04 the [version of rustc available](https://packages.ubuntu.com/bionic/rustc) for armhf, arm64, ppc64el and s390x is 1.24.1. Likewise on [20.04](https://packages.ubuntu.com/focal/rustc) it's only 1.41.0 on those platforms.
It might be possible to move to cryptography 38 once we target only 20.04 or later since it depends on [1.41.0](https://cryptography.io/en/37.0.0/installation/#rust),
(internal: OPEN-322)
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| stealth/space-bunny-alpha | — | closed resolved | Resolved by merged PR #1024 (96f6a183), upgrading cryptography from 3.4.8 to 39.0 and adding required Rust build dependencies for supported architectures. | |
| stealth/space-bunny-alpha | — | closed resolved | Pinned cryptography==3.4.8 lifted: PR #1024 (commit 96f6a183) bumped it to 39.0 and added Rust build deps to snap/snapcraft.yaml, followed by #1091 (92e93b46) fixing cross-arch builds. | |
| stealth/space-bunny-alpha | — | closed resolved | Resolved by merged PR #1024 (commit 96f6a183), upgrading cryptography to 39.0 and adding required Rust dependencies for all architectures. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Fixed via PR #1024, which updated the cryptography dependency after Ubuntu updates provided sufficient Rust versions for all target platforms. | |
| qwen/qwen3.6-35b-a3b | — | — | Fixed by merging PR #1024, which updated the cryptography dependency and modified snapcraft.yaml. The upgrade became feasible after focal-updates and bionic-updates provided sufficient Rustc versions for all platforms. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Resolved via PR #1024, which upgrades the cryptography dependency after Ubuntu updates provided compatible Rust versions, removing the legacy version pin. |
Update history
No update history recorded yet.
Related work
-
Likely Fixed By:
canonical/charmcraft#1024
(confidence 100%)
Merged upgrade to cryptography 39.0 with the necessary Rust build dependencies.
-
Related To:
canonical/charmcraft#978
(confidence 95%)
Earlier cryptography 39 upgrade attempt was closed unmerged before being superseded by #1024.
-
Related To:
canonical/charmcraft#1091
(confidence 90%)
Follow-up merged work ensured cryptography built correctly across all supported architectures.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1018 build(deps): bump cryptography from 3.4.8 to 39.0.1 | charmcraft | closed | Closed unmerged; the cryptography 39.0 upgrade landed through merged PR #1024 (commit 96f6a183), including required Rust build dependencies. | |
| #4195 build(deps): bump cryptography from 40.0.2 to 41.0.0 | snapcraft | merged | Merged PR #4195 via commit d8930f173, upgrading cryptography from 40.0.2 to 41.0.0 after confirming Rust 1.65 availability on supported architectures. | |
| #978 chore(deps): update dependency cryptography to v39 | charmcraft | closed | Renovate PR to bump cryptography 3.4.8 -> 39.0.0 was closed unmerged by lengau (2023-01-19) because cryptography 39 needs Rust >=1.48 unavailable on 18.04/20.04 armhf/arm64/ppc64el/s390x. Later redone manually and merged as #1024 (96f6a183). | |
| #1024 deps: update cryptography to v39.0 | charmcraft | merged | PR #1024 (commit 96f6a183) merged into charmcraft, upgrading cryptography to39.0 and adding needed Rust build deps to snap/snapcraft.yaml; it fixes issue #991 after the author validated builds on all architectures. | |
| #4280 build(deps): bump cryptography from 41.0.0 to 41.0.2 | snapcraft | closed | Dependabot PR to bump cryptography 41.0.0→41.0.2 was closed unmerged; dependabot commented "Superseded by #4301", which upgraded directly to 41.0.3 and was merged as commit f38160c9d. | |
| #4033 build(deps): bump cryptography from 3.4 to 39.0.1 | snapcraft | closed | Closed unmerged because cryptography 39.0.1 did not work on every architecture; maintainers cited canonical/charmcraft#1024, and Snapcraft later updated it in #4136 (3fd3e4c52). | |
| #1395 build(deps): bump cryptography from 41.0.4 to 41.0.6 | charmcraft | closed | Closed unmerged as redundant after commit d8a889db had already updated cryptography to v41.0.6; Dependabot confirmed the dependency was current. | |
| #423 fix(build): upgrade rust for cryptography | imagecraft | merged | Merged PR #423 upgraded the Rust toolchain for cryptography dependencies, fixing the build and landing as commit 5648cbe. | |
| #4457 build(deps): bump cryptography from 41.0.4 to 41.0.6 | snapcraft | closed | Closed unmerged as obsolete after cryptography was updated to 41.0.7; Dependabot said the 41.0.4→41.0.6 bump was no longer needed. | |
| #4599 build(deps): bump cryptography from 42.0.2 to 42.0.4 | snapcraft | closed | Dependabot bump of cryptography 42.0.2 -> 42.0.4 was closed unmerged; the same bump had already landed via Renovate PR #4598 (commit 7cfb60986), and Dependabot confirmed it was up-to-date. |