Not compatible with LibreSSL 4.1.0

[hhartzer]

Hi,

I recently upgraded to OpenBSD 7.7 and found that I'm not able to install cryptography. OpenBSD 7.7 comes with LibreSSL 4.1.0.

I see the following error:

        cargo:conf=OPENSSL_NO_BUF_FREELISTS,OPENSSL_NO_COMP,OPENSSL_NO_EC2M,OPENSSL_NO_ENGINE,OPENSSL_NO_KRB5,OPENSSL_NO_PSK,OPENSSL_NO_SRP,OPENSSL_NO_SSL3_METHOD,OPENSSL_NO_SEED,OPENSSL_NO_SCRYPT
        cargo:rustc-cfg=openssl
        cargo:rustc-cfg=libressl
        cargo:rustc-cfg=libressl251
        cargo:rustc-cfg=libressl252
        cargo:rustc-cfg=libressl261
        cargo:rustc-cfg=libressl270
        cargo:rustc-cfg=libressl271
        cargo:rustc-cfg=libressl273
        cargo:rustc-cfg=libressl280
        cargo:rustc-cfg=libressl281
        cargo:rustc-cfg=libressl291
        cargo:rustc-cfg=libressl310
        cargo:rustc-cfg=libressl321
        cargo:rustc-cfg=libressl332
        cargo:rustc-cfg=libressl340
        cargo:rustc-cfg=libressl350
        cargo:rustc-cfg=libressl360
        cargo:rustc-cfg=libressl370
        cargo:rustc-cfg=libressl380
        cargo:rustc-cfg=libressl381
        cargo:rustc-cfg=libressl382
        cargo:rustc-cfg=libressl390
        cargo:rustc-cfg=libressl400
        cargo:libressl_version_number=4010000f
      
        --- stderr
      
        thread 'main' panicked at /home/user/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/openssl-sys-0.9.104/build/main.rs:423:5:
      
      
        This crate is only compatible with OpenSSL (version 1.0.1 through 1.1.1, or 3), or LibreSSL 2.5
        through 4.0.x, but a different version of OpenSSL was found. The build is now aborting
        due to this version mismatch.
      
      
        note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
      warning: build failed, waiting for other jobs to finish...
      __ maturin failed
        Caused by: Failed to build a native library through cargo
        Caused by: Cargo build finished with "exit status: 101": `env -u CARGO PYO3_ENVIRONMENT_SIGNATURE="cpython-3.12-64bit" PYO3_PYTHON="/home/user/.venvs/test/bin/python3.12" PYTHON_SYS_EXECUTABLE="/home/user/.venvs/test/bin/python3.12" "cargo" "rustc" "--features" "pyo3/abi3-py37" "--message-format" "json-render-diagnostics" "--locked" "--manifest-path" "/tmp/pip-install-072oa4jm/cryptography_1542511713d84d4694d2ec61f30337bc/src/rust/Cargo.toml" "--release" "--lib"`
      Error: command ['maturin', 'pep517', 'build-wheel', '-i', '/home/user/.venvs/test/bin/python3.12', '--compatibility', 'off'] returned non-zero exit status 1

What would it take to support LibreSSL 4.1.0? Do you need anything else from me?

Thanks!

[alex]

We'll support LibreSSL 4.1.0 as soon as there's a release of LibreSSL portable https://www.libressl.org/releases.html

[hhartzer]

We'll support LibreSSL 4.1.0 as soon as there's a release of LibreSSL portable https://www.libressl.org/releases.html

Got it, thank you!

[hhartzer]

Alright, looks like 4.1.0 has landed. Hopefully the changes are straight forward for cryptography.

[reaperhulk]

It will mostly just be a release of rust-openssl and then us bumping our dependency, although we have a separate CI issue with an OpenSSL update to centos we need to resolve as well now.

[alex]

If someone sends the appropriate PR to rust-openssl, I'll release this evening

…

On Wed, Apr 30, 2025, 8:43 AM Paul Kehrer ***@***.***> wrote: *reaperhulk* left a comment (pyca/cryptography#12822) <#12822 (comment)> It will mostly just be a release of rust-openssl and then us bumping our dependency, although we have a separate CI issue with an OpenSSL update to centos we need to resolve as well now. — Reply to this email directly, view it on GitHub <#12822 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAAGBBOACLE7BUYUPHVA3D24DANPAVCNFSM6AAAAAB4BWT2AKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDQNBRHA2TGOJUG4> . You are receiving this because you commented.Message ID: ***@***.***>

[botovq]

Done: sfackler/rust-openssl#2398 Thanks @alex

[alex]

rust-openssl is out. now we just need to fix our own CI (which broke due to some sort of FIPS changes in openssl 3.5.0....) and we can get this into a release.

[alex]

44.0.3 is out

[hhartzer]

Thank you! I can confirm that 44.0.3 installs on OpenBSD 7.7 without issue.