[openstack-dev] [nova][glance][barbican][kite][requirements] pycrypto vs pycryptodome

Beliveau, Ludovic Ludovic.Beliveau at windriver.com
Tue Feb 16 21:38:35 UTC 2016

I'm getting these nova tox errors now (from pip-missing-reqs):
Missing requirements:
nova/crypto.py:29 dist=pycrypto module=Crypto.PublicKey.RSA

I think requirements.txt should now include pycrypto ?  Or am I missing something.


-----Original Message-----
From: Davanum Srinivas [mailto:davanum at gmail.com] 
Sent: Sunday, February 14, 2016 5:16 PM
To: OpenStack Development Mailing List (not for usage questions)
Subject: [openstack-dev] [nova][glance][barbican][kite][requirements] pycrypto vs pycryptodome


Short Story:
pycryptodome if installed inadvertently will break several projects:
Example : https://review.openstack.org/#/c/279926/

Long Story:
There's a new kid in town pycryptodome:

Because pycrypto itself has not been maintained for a while:

So folks like pysaml2 and paramiko are trying to switch over:

In fact pysaml2===4.0.3 has already switched over. So the requirements bot/script has been trying to alert us to this new dependency, you can see Nova fail.

Why does it fail? For example, the new library is strict about getting bytes for keys and has dropped some parameters in methods. for

Another problem, if pycrypto gets installed last then things will work, if it pycryptodome gets installed last, things will fail. So we definitely cannot allow both in our global-requirements and upper-constraints. We can always try to pin stuff, but things will fail as there are a lot of jobs that do not honor upper-constraints.
And things will fail in the field for Mitaka.

So what can we do? One possibility is to pin requirements and hope for the best. Another is to tolerate the install of either pycrypto or pycryptodome and test both combinations so we don't have to fight this battle.

Example for Nova : https://review.openstack.org/#/c/279909/
Example for Glance : https://review.openstack.org/#/c/280008/
Example for Barbican : https://review.openstack.org/#/c/280014/

What do you think?


Davanum Srinivas :: https://twitter.com/dims

OpenStack Development Mailing List (not for usage questions)
Unsubscribe: OpenStack-dev-request at lists.openstack.org?subject:unsubscribe

More information about the OpenStack-dev mailing list