Pin cryptography to 3.3.2

[finlaysawyer]

Is your feature request related to a problem? Please describe.
Yesterday an update to cryptography was released which adds rust as a dependency for building it. This breaks compatibility with many systems and pip versions. I'm encountering an error when running az devops login:

Traceback (most recent call last):
      File "<string>", line 1, in <module>
      File "/tmp/pip-build-cdqmxaug/cryptography/setup.py", line 14, in <module>
        from setuptools_rust import RustExtension
    ModuleNotFoundError: No module named 'setuptools_rust'
Cleaning up...
Command "python setup.py egg_info" failed with error code 1 in /tmp/pip-build-cdqmxaug/cryptography/
Exception information:
Traceback (most recent call last):
  File "/usr/lib64/az/lib/python3.6/site-packages/pip/basecommand.py", line 215, in main
    status = self.run(options, args)
  File "/usr/lib64/az/lib/python3.6/site-packages/pip/commands/install.py", line 346, in run
    requirement_set.prepare_files(finder)
  File "/usr/lib64/az/lib/python3.6/site-packages/pip/req/req_set.py", line 381, in prepare_files
    ignore_dependencies=self.ignore_dependencies))
  File "/usr/lib64/az/lib/python3.6/site-packages/pip/req/req_set.py", line 637, in _prepare_file
    abstract_dist.prep_for_dist()
  File "/usr/lib64/az/lib/python3.6/site-packages/pip/req/req_set.py", line 130, in prep_for_dist
    self.req_to_install.run_egg_info()
  File "/usr/lib64/az/lib/python3.6/site-packages/pip/req/req_install.py", line 439, in run_egg_info
    command_desc='python setup.py egg_info')
  File "/usr/lib64/az/lib/python3.6/site-packages/pip/utils/__init__.py", line 717, in call_subprocess
    % (command_desc, proc.returncode, cwd))
pip.exceptions.InstallationError: Command "python setup.py egg_info" failed with error code 1 in /tmp/pip-build-cdqmxaug/cryptography/

Describe the solution you'd like
Cryptography should be pinned to 3.3.2 to give people time to fix their pip version. For example, I'm using the installation script from the documentation shown here - Install Azure CLI Linux which no longer works because python3-pip 9.0.3-8.el7 is not compatible.

Describe alternatives you've considered
Upgrade pip

Additional context
pyca/cryptography#5753
pyca/cryptography#5771

[amansahni1]

Will the Pin be applied to azure_mgmt_core too??
I think we would need that too.

Collecting azure_mgmt_core-1.2.0-py2.py3-none-any.whl\n
Collecting cryptography>=2.1.4 (from azure-keyvault==1.1.0->-r /proj/local/artifact/drop/edp_libraries/src/requirements_utils.txt (line 3))\n
Downloading https://files.pythonhosted.org/packages/06/ed/cb79cc94ec58d9d92557238fc6c629cd6e07d72334d2de556aecc2211370/cryptography-3.4.1.tar.gz (544kB)\n
Traceback (most recent call last):\n File "", line 1, in \n File "/tmp/pip-build-jpryc8r6/cryptography/setup.py", line 14, in \n
from setuptools_rust import RustExtension\n ModuleNotFoundError: No module named 'setuptools_rust'\n

[geoffrax]

There's been a bit of a change in pyca/cryptography - Alpine and other images that don't have rust can't install azure-cli & azure_mgmt_core, probably most of the azure packages. Might be good to lock it down for the moment to 3.3.2

[yonzhan]

@fengzhou-msft @jiasli for awareness

[finlaysawyer]

On CentOS 7, Upgrading pip directly into the az installation seems to fix this for the time being... I can then run az devops login etc without issue

python3 -m pip install --upgrade pip --target /usr/lib64/az/lib/python3.6/site-packages/

[fengzhou-msft]

@houk-ms for awareness.

[amansahni1]

Here is how I worked around the issue.

1. Upgraded the pip to the latest version
2. Installed the cryptography==3.3.2

You might be able to get away doing number 2. I have done that anyway.

[amansahni1]

@finlaysawyer Pip3 isn't version locked here. Are we ever likely to run into issues with pip3 being suddenly upgraded and breaking things? I think upgrading to the latest is generally recommended (even by pip3). What would you recommend.

[missa112]

Help please, I can not install "pip3 install pgpy" on Centos 7, an error occurs.

Traceback (most recent call last):
File "", line 1, in
File "/tmp/pip-build-_lndkep4/cryptography/setup.py", line 14, in
from setuptools_rust import RustExtension
ModuleNotFoundError: No module named 'setuptools_rust'

What to do?

[jvleminc]

Help please, I can not install "pip3 install pgpy" on Centos 7, an error occurs.

Traceback (most recent call last):
File "", line 1, in
File "/tmp/pip-build-_lndkep4/cryptography/setup.py", line 14, in
from setuptools_rust import RustExtension
ModuleNotFoundError: No module named 'setuptools_rust'

What to do?

Upgrade pip to latest

[mnoskoski]

I execute a az devops login on my azure-pipelines, my agents run in docker, but still received error:

Command:
echo $(System.AccessToken) | az devops login

Message return:
Unable to use secure credential store in this environment.
Please refer to alternate methods at https://aka.ms/azure-devops-cli-auth using Environment variable or use 'az login' An error occurred. Pip failed with status code 1 for package keyring~=17.1.1. Use --debug for more information.

Thanks..

[mnoskoski]

I resolve my problem add in my Dockerfile of Docker agent azure the follow command:

RUN python3 -m pip install -U pip
RUN python3 -m pip install --upgrade pip --target /usr/lib64/az/lib/python3.6/site-packages/

I includes the lines commands after line the install the az cli.

[juanpandiello]

I resolve my problem add in my Dockerfile of Docker agent azure the follow command:

RUN python3 -m pip install -U pip
RUN python3 -m pip install --upgrade pip --target /usr/lib64/az/lib/python3.6/site-packages/

I includes the lines commands after line the install the az cli.

It works perfectly ! Thanks @mnoskoski

[a-cowling]

I resolve my problem add in my Dockerfile of Docker agent azure the follow command:

RUN python3 -m pip install -U pip
RUN python3 -m pip install --upgrade pip --target /usr/lib64/az/lib/python3.6/site-packages/

I includes the lines commands after line the install the az cli.

Thanks @mnoskoski ! 😄

We had to tweak your fix slightly for Debian flavoured OS':

python3 -m pip install -U pip
python3 -m pip install --upgrade pip --target /opt/az/lib/python3.6/site-packages/

Notice the difference in the site-packages path, hopefully this helps someone else 👍🏻

[Azrrael]

Thanks @mnoskoski and @andrew-cowling !! I can confirm that the fix works on ubuntu:20.04 docker images running as build/release agents for Azure DevOps, but I had to change it slightly to:

RUN apt update && apt-get install -y python3 python3-setuptools
RUN python3 -m easy_install install pip
(...)
RUN python3 -m pip install --upgrade pip --target /opt/az/lib/python3.6/site-packages/

Hope this helps someone else 🤞

[dareyes90]

Hi all, I found that the trouble is related with the version of python installed with azure devops cli.

What I do was just update pip to the target directory /opt/az/lib/python3.6/site-packages/ with this command:
pip install --upgrade pip --target /opt/az/lib/python3.6/site-packages/

Hope this work for all!

[albertmenglongli]

Here is how I worked around the issue.

1. Upgraded the pip to the latest version
2. Installed the cryptography==3.3.2

You might be able to get away doing number 2. I have done that anyway.

Works for me

[PushkarVaity]

We were able to update pip in target location /usr/lib64/az/lib/python3.6/site-packages/ which fixed the issues for some time but now we started seeing the problems again.
It's on CentOS 7 machines. Is there a different target location?

[miguelvaara]

This helped me:

python3 -m pip install --upgrade pip

..and after this just try again! :-)

[fengzhou-msft]

Please try with Azure CLI 2.21.0. The issue should be resolved.

[finlaysawyer]

Please try with Azure CLI 2.21.0. The issue should be resolved.

Yep, all working now that the pip upgrade is performed. Thanks