[FSSDK-10317] Remove PyOpenSSL and cryptography from requirements #435
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Mat001
changed the title
andrewleap-optimizely
approved these changes
Jun 25, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
PyOpenSSL and cryptography packages are no longer required and can potentially introduce a security risk as pointed out by PeterJCLaw in his reported GitHub issue.
Sdk used to use requests extra option requests[security] that included PyOpenSSL and cryptography packages to enhance SSL/TLS support, particularly for older versions of Python that lacked certain security features.
The requests[security] extra was officially deprecated in version 2.25.0 of the requests library, released on November 11, 2020. The deprecation notice indicated that this extra would be removed in version 2.26.0. The primary reason for deprecation was the improved native SSL/TLS support in modern Python versions, making the extra dependencies redundant.
Based on the above we replaced requests[security] with its components including PyOpenSSL and cryptography. But it looks like we didn't need to do so.
According to research, users are now encouraged to rely on the native SSL/TLS support provided by Python's standard library. The requests library itself continues to support secure HTTP requests (HTTPS) out of the box, leveraging the built-in ssl module in Python.
We removed Py v2.x and some older Py 3.x versions and so we can now use native SSL/TLS support in modern Python versions we're using. If all tests are passing then PyOpenSSL and cyptography can be safely removed.
Test plan
Issues