Anaconda image has incompatible cryptography and openssl modules, breaking conda package manager

[broander]

Hi,

Currently conda is broken in the latest image available (mcr.microsoft.com/devcontainers/anaconda:0-3). This issue has been going on for a couple of months, but reporting it now that it's blocking installing new dependencies for a project.

If after creating a fresh container one attempts to install anything with conda, including just updating conda with 'conda update conda', the following error occurs: "AttributeError: module 'lib' has no attribute 'OpenSSL_add_all_algorithms'"

There is discussion of the issue here: pyca/cryptography#7959 The root cause is due to incompatible versions of cryptography and openssl via pyopenssl coexisting at once in the same environment.

While one can work around the issue by upgrading pyopenssl using pip, this breaks the conda package manager's ability to successfully complete transactions going forward to upgrade or install new packages, transactions either taking very, very long to complete or failing to verify and ending without executing.

Would you please fix this incompatibility in the latest image and going forward so we can use conda to install packages?
A potential solution would be reving the version of anaconda being installed on the source image to one where this incompatibility isn't present from inception. Thanks!

[broander]

Also, I just tried creating a container using the dev image (mcr.microsoft.com/vscode/devcontainers/anaconda:dev-3) and the same issue outlined above is present.

[broander]

I tried out the miniconda image this morning (mcr.microsoft.com/devcontainers/miniconda:0-3), and it does not have the same issue, and one is able to install new packages using conda. However, you might find it interesting that if one tries 'conda update conda' with the miniconda package, it fails and an error is raised relating to the cryptography package, although a different one than the Anaconda image:

[samruddhikhandale]

Hi 👋

Thanks for reporting the issue, the upstream anaconda image (continuumio/anaconda3) consists of a version of cryptography with a security vulnerability (GHSA-39hc-v87j-747x).

ddeca8d patches the vulnerability and upgrades the cryptography version to latest (v39.0.2 in latest prod image). From pyca/cryptography#7959, upgrading pyOpenSSL fixes the issue. @broander I'll open a PR to upgrade it, in the meanwhile you can fix it for yourself with 👇

python3 -m pip install --upgrade pyOpenssl

ℹ️ Same reasoning for miniconda image as well!

[broander]

@samruddhikhandale Thanks for taking a look at this. I see you're working through developing your pull request, appreciate it. I tried your latest solution for the Anaconda image, which is having pip install pyOpenssl. That does indeed allow 'conda update conda' to succeed. However, you should add another test to install a package after that, for example 'conda install -c conda-forge pylint'. That is failing; I also tested with several other common packages on conda-forge.

[broander]

Hi, more info--I was able to get the miniconda image to a working state, built on top of your current fix in the pull request for that image, by resolving a permissions error I would get when installing or updating certain packages with conda by updating permissions for the python folders in /opt/conda with the following command: 'sudo chown -R vscode /opt/conda/lib/python3.10/site-packages/*'. So potentially the Docker image build isn't getting everything sorted with permissions for the vscode user to operate on those directories? Maybe some files created by 'RUN conda update -y cryptography' in the Dockerfile aren't getting the right permissions assigned?

I checked the smoke test logs, and they're the same error I was getting which was fixed by the above solution: 'Permission denied: '/opt/conda/lib/python3.10/site-packages/conda-23.1.0-py3.10.egg-info/PKG-INFO' -> '/opt/conda/lib/python3.10/site-packages/conda-23.1.0-py3.10.egg-info/PKG-INFO.c~''

[samruddhikhandale]

Thanks for all the help, I appreciate that! my latest commit should fix the error for miniconda, (local tests passed 🎉 ). Let me know what you think.

#489

[broander]

Just checked out the latest change--agree that makes sense. I tried it out, it works. If anyone wants to run any optional stuff after that command per the comments in the source code they'll need to switch the USER back to root so maybe noting something like that. And this solution is quite hacky because if someone using this image downstream defines a different default username than vscode in their devcontainer.json, it'll almost surely be broken because they won't have permission to act on anything owned by vscode. But hopefully this is all temporary and the upstream gets fixed so we don't have to patch it like this, I'm not sure what we do otherwise in the meantime.

Also, would be good to add another test for the Anaconda image, it's passing currently but I think it will fail (based on testing I did last night) if you add 'conda install -c conda-forge --yes tensorflow' as another test for that image.

[samruddhikhandale]

Closing as deployed. Feel free to re-open if needed, thanks!