[Cryptography-dev] Problems with importing OpenSSL on Windows

[Łukasz Hanuszczak]

Hello again,

On Thu, Apr 15, 2021 at 2:30 PM Alex Gaynor <alex.gaynor at gmail.com> wrote:

> I don't believe we made any fundamental changes to our DLLs -- all we've
> done is update OpenSSL versions over this period.
>

There is one thing I noticed that changed between 2.9.2 and 3.3.2: all DLL
files in `cryptography\hazmat\bindings` (`_constant_time`, `_openssl`,
`_padding`) in 2.9.2 are suffixed with platform compatibility tags (so it
is `_openssl.cp36-win_amd64.pyd`), whereas in 3.3.2 they are not (it is
just `_openssl.pyd`). While this might not be the culprit here, it is
definitely suspicious—do you have any ideas what caused this change and
whether this can affect how the DLL is loaded?

Thank you,
Łukasz


>
We have definitely not introduced any new system dependencies.
>
> Alex
>
> On Thu, Apr 15, 2021 at 8:10 AM Łukasz Hanuszczak via Cryptography-dev <
> cryptography-dev at python.org> wrote:
>
>> Hello,
>>
>> Our team uses two continuous integration systems that build and package
>> the Windows distribution of our project. One of them is internal and runs
>> on Windows 7, the other one is AppVeyor (running Windows 2012, which is
>> based on Windows 8 best to my knowledge) that works with our open-source
>> repository on GitHub.
>>
>> Both systems use the same script that initializes the virtual
>> environment, upgrades pip, installs dependencies. The only significant
>> difference is that the internal pipeline does not have internet access and
>> uses vendored wheels (though downloaded from PyPI upfront).
>>
>> Both systems use exactly the same version of Python and pip, as witnessed
>> by the output of `pip debug --verbose`:
>>
>> ```
>> (...)
>> pip version: pip 21.0.1 from c:\buildenv\python_64\lib\site-packages\pip
>> (python 3.6)
>> sys.version: 3.6.8 (tags/v3.6.8:3c6b436a57, Dec 24 2018, 00:16:47) [MSC
>> v.1916 64 bit (AMD64)]
>> (...)
>> ```
>>
>> Unfortunately, after upgrading `cryptography` from 2.9.2 to 3.3.2, the
>> AppVeyor task started to fail with the following error (during runtime, the
>> package installation process itself works fine):
>>
>> ```
>> (...)
>>   File
>> "c:\buildenv\python_64\lib\site-packages\cryptography\hazmat\backends\openssl\__init__.py",
>> line 7, in <module>
>>     from cryptography.hazmat.backends.openssl.backend import backend
>>   File
>> "c:\buildenv\python_64\lib\site-packages\cryptography\hazmat\backends\openssl\backend.py",
>> line 117, in <module>
>>     from cryptography.hazmat.bindings.openssl import binding
>>   File
>> "c:\buildenv\python_64\lib\site-packages\cryptography\hazmat\bindings\openssl\binding.py",
>> line 14, in <module>
>>     from cryptography.hazmat.bindings._openssl import ffi, lib
>> ImportError: DLL load failed: The specified module could not be found.
>> ```
>>
>> I have verified that on both systems there is the `cryptography` OpenSSL
>> DLL available
>> (`c:\buildenv\python_64\lib\site-packages\cryptography\hazmat\bindings\_openssl.pyd`)
>> and that it has exactly the same size (3,107,328 bytes). I have also
>> checked and tried using a newer version of `cryptography` (3.4.7) on
>> AppVeyor but the problem does not go away.
>>
>> Has there been any change in handling of the OpenSSL DLL between 2.9.2
>> and 3.3.2? Or is there any other reason that might hint the source of
>> issues? Is it possible that the DLL itself introduced some new system
>> dependency that has to be installed first?
>>
>> Thank you,
>> Łukasz
>> _______________________________________________
>> Cryptography-dev mailing list
>> Cryptography-dev at python.org
>> https://mail.python.org/mailman/listinfo/cryptography-dev
>>
>
>
> --
> All that is necessary for evil to succeed is for good people to do nothing.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mail.python.org/pipermail/cryptography-dev/attachments/20210421/96e27d17/attachment.html>