failing to build with cryptography 3.1

[dirk-thomas]

The nightly ROS 2 builds failed on macOS and Windows. I assume due to the new cryptography version 3.1 being released.

[dirk-thomas]

Upstream ticket: pyca/cryptography#5433.

[kyrofa]

Oh that's unfortunate. I see three paths forward:

1. Wait for cryptography to add a proper API to replace the bindings
2. Move back to shelling out to openssl directly
3. Pin to cryptography 3.0

I think (1) is really the only real solution here-- the others are workarounds and temporary solutions at best. They at least seem interested in exposing this via the API though, maybe we can help. We'll push on that a little, it looks like you've started on (3) for now?

[dirk-thomas]

The referenced PR implements option 3 to get the jobs passing now.

Upstream is working on re-adding the necessary API as described in option 1 (see discussion on the upstream ticket). If that has been released we could unpin (which is tracked in ros2/ci#507).

[kyrofa]

Excellent, thanks @dirk-thomas, sounds like a plan. We'll join the upstream discussion.