Handle cryptography 3.4

[sbesson]

crytpography 3.4 released yesterday afternoon broke all the scheduled Molecule builds - see e.g. https://github.com/ome/ansible-role-sudoers/runs/1850565089

Collecting cryptography (from ansible==2.8.18->ome-ansible-molecule==0.5.*)
  Downloading https://files.pythonhosted.org/packages/ea/d8/2afd2890fe451a3c109d2bdb6bc4ded55ec43059e524344d5e0004e36412/cryptography-3.4.tar.gz (544kB)
    Complete output from command python setup.py egg_info:
    Traceback (most recent call last):
      File "<string>", line 1, in <module>
      File "/tmp/pip-build-x1m88z5j/cryptography/setup.py", line 13, in <module>
        from setuptools_rust import RustExtension
    ModuleNotFoundError: No module named 'setuptools_rust'

As discussed in pyca/cryptography#5753, the installation can be restored with a more recent version of pip.

This leaves us three options:

• update molecule.yml to use runs-on: ubuntu-20.04 for the test phase
• update https://github.com/ome/action-ome-ansible-molecule to run pip install -U pip before installing the ome-ansible-molecule package
• cap cryptography to 3.3.x in https://github.com/ome/ome-ansible-molecule for now

[joshmoore]

oy vey... If I understand correctly, there's no impact on end users? Since rolling molecule.yml changes out will require quite a number of commits, it seems like pip install -U pip causes the least churn.

[sbesson]

I agree solution 2 is the less costly in terms of number of changes at once. I'll test it and report.

Re impact on end users, I think the main one is that pip install ansible==2.8.* will now fail on a default virtual environment on CentOS 7 or Ubuntu 18.04. But this is very much an upstream issue and I don't think there is anything we can do except be aware of it and support our community if they encounter the problem.

[sbesson]

See sbesson/action-ome-ansible-molecule@77de549 now tested via https://github.com/sbesson/ansible-role-sudoers/actions/runs/547386811 for an implementation of option 2

[sbesson]

Pushed https://github.com/ome/action-ome-ansible-molecule/releases/tag/v2.0.1 to fix the broken CI pipeline for roles and playbooks immediately. Will keep watching the upstream repositories to see if we need to implement others mitigation/upgrade the platforms.

[joshmoore]

Looks like ansible will be doing this as well: ansible-community/antsibull-build@d9385c9