{Package} remove upper bound in cryptography dependency #15104
Conversation
It does not seem necessary, none of the changes appear to affect azure-cli usage. https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst Distributions have already moved past 3.0, so this restriction is problematic.
|
hi @fengzhou-msft @bim-msft could you pls help review the change? what's impact to keyvault? |
|
ping |
|
hi @bluca sorry for late response, we're full with Ignite release before. Will test it then |
Sure no problem, thanks |
| @@ -126,7 +126,7 @@ | |||
| 'azure-storage-common~=1.4', | |||
| 'azure-synapse-accesscontrol~=0.2.0', | |||
| 'azure-synapse-spark~=0.2.0', | |||
| 'cryptography>=2.3.1,<3.0.0', | |||
| 'cryptography>=2.3.1', | |||
There was a problem hiding this comment.
normal practice in CLI is pin exact major version. what's impact of the change?
There was a problem hiding this comment.
It might be common, but I'm afraid it's not good practice to pin without any specific reason - eg, a specific incompatibility. There is no incompatibility introduced in 3.0 here, so it's unnecessary. The impact is that python3-cryptography is moving on everywhere, and the old deprecated versions are not available anymore, so we have to manually patch this downstream, which is causing extra work.
https://packages.debian.org/search?keywords=python3-cryptography&searchon=names&suite=all§ion=all
https://packages.ubuntu.com/search?keywords=python3-cryptography&searchon=names&suite=all§ion=all
https://rpmfind.net/linux/rpm2html/search.php?query=python3-cryptography
|
@bluca we've bumped cryptography: azure-cli/src/azure-cli-core/setup.py Line 50 in b791aa1 Due to latest versions relying on rust and breaking installation on platforms like alpine we used for docker image, it's still upper bounded. |
|
That's great, thank you! |
It does not seem necessary, none of the changes appear to affect azure-cli usage.
https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst
Distributions have already moved past 3.0, so this restriction is
problematic.
This checklist is used to make sure that common guidelines for a pull request are followed.
The PR title and description has followed the guideline in Submitting Pull Requests.
I adhere to the Command Guidelines.