matrix-synapse/dont-bump-cryptography-with-system-openssl.patch

Index: synapse/synapse/python_dependencies.py
===================================================================
--- synapse.orig/synapse/python_dependencies.py
+++ synapse/synapse/python_dependencies.py
@@ -84,7 +84,8 @@ REQUIREMENTS = [
     "typing-extensions>=3.7.4",
     # We enforce that we have a `cryptography` version that bundles an `openssl`
     # with the latest security patches.
-    "cryptography>=3.4.7",
+    # opensuse we do not bump here as we do not use the intree copy
+    "cryptography",
     "ijson>=3.0",
 ]
Accepting request 891065 from home:darix:apps - Update to 1.33.1 OBS-URL: https://build.opensuse.org/request/show/891065 OBS-URL: https://build.opensuse.org/package/show/network:messaging:matrix/matrix-synapse?expand=0&rev=175 2021-05-10 19:56:48 +02:00			`Index: synapse/synapse/python_dependencies.py`
			`===================================================================`
			`--- synapse.orig/synapse/python_dependencies.py`
			`+++ synapse/synapse/python_dependencies.py`
Accepting request 903055 from home:darix:apps - Update to 1.37.0 OBS-URL: https://build.opensuse.org/request/show/903055 OBS-URL: https://build.opensuse.org/package/show/network:messaging:matrix/matrix-synapse?expand=0&rev=184 2021-06-29 14:02:35 +02:00			`@@ -84,7 +84,8 @@ REQUIREMENTS = [`
Accepting request 881504 from home:darix:apps - Update to 1.30.1 This release is identical to Synapse 1.30.0, with the exception of explicitly setting a minimum version of Python's Cryptography library to ensure that users of Synapse are protected from the recent OpenSSL security advisories, especially CVE-2021-3449. - Internal Changes - Enforce that `cryptography` dependency is up to date to ensure it has the most recent openssl patches. (#9697) - Note: we do not bump the cryptography dependency in our package as we use the system OpenSSL which gets the fix. Add dont-bump-cryptography-with-system-openssl.patch to comment out the dependency because otherwise the newer version requirement is enforced on startup OBS-URL: https://build.opensuse.org/request/show/881504 OBS-URL: https://build.opensuse.org/package/show/network:messaging:matrix/matrix-synapse?expand=0&rev=165 2021-03-27 04:03:37 +01:00			`"typing-extensions>=3.7.4",`
			# We enforce that we have a `cryptography` version that bundles an `openssl`
			`# with the latest security patches.`
Accepting request 891065 from home:darix:apps - Update to 1.33.1 OBS-URL: https://build.opensuse.org/request/show/891065 OBS-URL: https://build.opensuse.org/package/show/network:messaging:matrix/matrix-synapse?expand=0&rev=175 2021-05-10 19:56:48 +02:00			`- "cryptography>=3.4.7",`
			`+ # opensuse we do not bump here as we do not use the intree copy`
			`+ "cryptography",`
Accepting request 897230 from home:darix:apps - Update to v1.35.1: OBS-URL: https://build.opensuse.org/request/show/897230 OBS-URL: https://build.opensuse.org/package/show/network:messaging:matrix/matrix-synapse?expand=0&rev=180 2021-06-04 20:07:57 +02:00			`"ijson>=3.0",`
Accepting request 881504 from home:darix:apps - Update to 1.30.1 This release is identical to Synapse 1.30.0, with the exception of explicitly setting a minimum version of Python's Cryptography library to ensure that users of Synapse are protected from the recent OpenSSL security advisories, especially CVE-2021-3449. - Internal Changes - Enforce that `cryptography` dependency is up to date to ensure it has the most recent openssl patches. (#9697) - Note: we do not bump the cryptography dependency in our package as we use the system OpenSSL which gets the fix. Add dont-bump-cryptography-with-system-openssl.patch to comment out the dependency because otherwise the newer version requirement is enforced on startup OBS-URL: https://build.opensuse.org/request/show/881504 OBS-URL: https://build.opensuse.org/package/show/network:messaging:matrix/matrix-synapse?expand=0&rev=165 2021-03-27 04:03:37 +01:00			`]`