Ticket #66 (closed defect: fixed)

Opened 6 months ago

Last modified 6 months ago

install requires pyOpenSSL (for secure mode)

Reported by: zooko Assigned to: warner
Priority: major Milestone: 0.2.8
Component: packaging Version: 0.2.5
Keywords: Cc:

Description

Using easy_install to install foolscap with its ability to have secure connections fails because foolscap doesn't declare its dependency on pyOpenSSL, although it does declare its dependency on twisted:

setup.py

We could define, in setuptools terms an "extra" feature of foolscap, which is secure connections.

http://peak.telecommunity.com/DevCenter/setuptools#declaring-extras-optional-features-with-their-own-dependencies

This could be expressed in the setup.py as something like this: 

extras_require = {
        'secure_connections':  ["pyOpenSSL>=0.6"],
}

However it might be better to simply make foolscap always require pyOpenSSL (and for that matter it might be better to make it always create and use secure connections). This idea in the general case has been persuasively advocated by Ian Grigg: There Is Only One Mode And It Is Secure..

In order to do that, of course, we simply need add "pyOpenSSL >= 0.6" to the list of install_requires in the setup.py.

Change History

06/02/08 16:31:29 changed by warner

It will take me some time to decide whether Foolscap will require pyOpenSSL unconditionally. While I agree with your and Ian's philosophy, there are users of foolscap who have preferred to not use crypto for various reasons, and I need to make sure I respect their interests (or convince them otherwise).

Adding it as an 'extras' seems feasible in the shorter term. If you want this for Tahoe #438, it sounds like we need a new Foolscap release at least a couple of days before the Tahoe release, which means this change needs to be in, like, yesterday.

06/03/08 16:01:18 changed by warner

  • milestone changed from undecided to 0.2.8.

06/04/08 09:14:37 changed by zooko

Note that because of http://twistedmatrix.com/trac/ticket/3218 -- http://allmydata.org/trac/tahoe/ticket/402 , you might want to require a version of pyOpenSSL not == 0.7, which would be expressed. 

extras_require = {
        'secure_connections':  ["pyOpenSSL>=0.6,!=0.6"],
}

06/04/08 09:36:16 changed by zooko

Whoops, that should have said: 

extras_require = {
        'secure_connections':  ["pyOpenSSL>=0.6,!=0.7"],
}

06/04/08 09:38:39 changed by zooko

Now that https://bugs.launchpad.net/pyopenssl/+bug/236190 (funny permission bits in pyOpenSSL-0.6.tar.gz confuse tarfile.py) is resolved, people who use easy_install or setuptools (including the default process to install Tahoe from source) will be able to resolve the dependency on pyOpenSSL.

Currently, they will do this by getting pyOpenSSL v0.6, and in the future when a new pyOpenSSL is released, they will get that.

Hm. This means that if the pyOpenSSL maintainers release a new version of pyOpenSSL with a version number higher than 0.6 and not equal to 0.7, and if that new version still has this bug in it, then this bug will start hitting us again. Hm. Weird packaging issue.

I guess for the moment we are going to bet that the pyOpenSSL maintainers won't do that. I suppose the alternative is to require pyOpenSSL == 0.6, so that people can't conveniently use foolscap with a newer pyOpenSSL until Brian releases a new foolscap that loosens that requirement.

06/04/08 10:00:25 changed by zooko

Hm. Actually writing "pyOpenSSL>=0.6,!=0.7" is incorrect.

Newer version of pyOpenSSL can come out which are unchanged with respect to this issue. Newer versions of Twisted, on the other hand, will hopefully fix this issue.

Since setuptools doesn't allow the expression of disjunctions of requirements, the only correct answer for now is "pyOpenSSL==0.6".

Here is a wishlist ticket for setuptools to support more expressive requirements:

http://bugs.python.org/setuptools/issue22 (wish: more expressive requirements)

06/04/08 12:20:37 changed by warner

  • owner set to warner.
  • status changed from new to assigned.

I'm going to declare an "extras" dependency on pyOpenSSL (unversioned), because:

  • pyOpenSSL 0.6 basically works, it just causes unit test failures (the #62 bug only affects waiting for connection shutdown, which is pretty rare in actual application code)
  • debian/sid has pyOpenSSL 0.7 now, and is likely to until upstream makes a new release with a fix, and if foolscap refuses to run with 0.7 then those debian systems (on which the admins haven't pinned 0.6 in place) will unnecessarily fail

When pyOpenSSL 0.8 is in debian, I'll revisit the dependency declaration to make it avoid 0.7 .

06/04/08 12:47:54 changed by warner

  • status changed from assigned to closed.
  • resolution set to fixed.

done, in [9e8a43ae8550221b0c561bee04a67056e62a8c21].

I've opened a new ticket to consider whether foolscap should unconditionally require pyOpenSSL: #67.