Dependency on an old version of cryptography
Metadata
Current evaluation
Fixed via PR #1024, which updated the cryptography dependency after Ubuntu updates provided sufficient Rust versions for all target platforms.
Suggested action: —
No scores available.
Issue body
Charmcraft (and several other apps) depend indirectly on `cryptography` (cryptography -> SecretStorage -> keyring -> craft-store...). We've pinned `cryptography==3.4.8` because of a lack of rust dependencies on supported platforms.
See:
* https://github.com/canonical/charmcraft/pull/619
* https://github.com/canonical/charmcraft/pull/978
* https://github.com/pyca/cryptography/issues/5776
Cryptography 39 [requires](https://cryptography.io/en/39.0.0/installation/#rust) Rust v1.48.0 or newer. Currently on 18.04 the [version of rustc available](https://packages.ubuntu.com/bionic/rustc) for armhf, arm64, ppc64el and s390x is 1.24.1. Likewise on [20.04](https://packages.ubuntu.com/focal/rustc) it's only 1.41.0 on those platforms.
It might be possible to move to cryptography 38 once we target only 20.04 or later since it depends on [1.41.0](https://cryptography.io/en/37.0.0/installation/#rust),
(internal: OPEN-322)
Evaluation history
| Date | Model | Scores | Action | Summary |
|---|---|---|---|---|
| qwen3.6-35b-a3b-mtp-q6 | — | — | Fixed via PR #1024, which updated the cryptography dependency after Ubuntu updates provided sufficient Rust versions for all target platforms. | |
| qwen/qwen3.6-35b-a3b | — | — | Fixed by merging PR #1024, which updated the cryptography dependency and modified snapcraft.yaml. The upgrade became feasible after focal-updates and bionic-updates provided sufficient Rustc versions for all platforms. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Resolved via PR #1024, which upgrades the cryptography dependency after Ubuntu updates provided compatible Rust versions, removing the legacy version pin. | |
| qwen3.6-35b-a3b-mtp-q6 | — | — | Merged via PR #1024, which updated the cryptography dependency and modified snapcraft.yaml after Ubuntu updates provided sufficient Rust versions. |
Update history
No update history recorded yet.
Related issues
| Issue | Project | State | Summary | Similarity |
|---|---|---|---|---|
| #1327 build: bump dependencies constrained by rustc version | rockcraft | merged | Merged after two approvals. Bumps dependencies constrained by an older rustc version, resolving an OSV vulnerability in cryptography. | |
| #4195 build(deps): bump cryptography from 40.0.2 to 41.0.0 | snapcraft | merged | Dependabot dependency update to bump cryptography from 40.0.2 to 41.0.0 was approved, passed CI checks, and successfully merged. Reviewers confirmed Rust version compatibility across all target architectures. |