Hello,
It was recently discovered that the latest pykmip release is not compatible[1][2] with cryptography>42.0.0, which is currently in upper constraints for master and 2024.1.
The latest release of pykmip is incompatible with even cryptography >= 39.0.0, because no release has been created since the compatibility fix[2] was merged. The stable/2023.2 branch currently uses cryptography 40.0.2 so the pykmip library has been broken since 2023.2, it seems.
I wonder what would be the appropriate step to mitigate the problem, and I would like to ask for opinions. Especially the first question is a bit urgent because we have quite a short period to make deprecation for 2024.1 .
1. (To the barbican team and the operators subscribing this list) Can we deprecate the kmip secret store plugin in 2024.1 so that we can drop it in 2024.2 ? Or does anyone have any concern with removing it in a future release ?
2. (To requirements team) In case the proposed fix[3] is merged and a new pykmip release is created, can we bump the version in 2024.1 u-c and 2023.2 u-c ? As far as I've checked, pykmip is used only by Barbican so bumping it would have quite limited impact.
Thank you, Takashi
[1] https://meetings.opendev.org/irclogs/%23openstack-barbican/%23openstack-barb... [2] https://github.com/OpenKMIP/PyKMIP/issues/713 [3] https://github.com/OpenKMIP/PyKMIP/commit/652d5cab [4] https://github.com/OpenKMIP/PyKMIP/pull/714