Added check to turn off CC backend for OS X version < 10.8

[Ayrx]

No description provided.

[public]

Is 10.8 the lowest version that actually works?

[jenkins-cryptography]

Test PASSed.
Refer to this link for build results: http://jenkins.cryptography.io/job/cryptography-pr-experimental/1001/

[Ayrx]

@public I think so and the guy that opened #740 says so as well. I can't find official support of this though, Apple's documentation is really difficult to search through.

[reaperhulk]

Yes, I explicitly wrote it to support only 10.8+. There are several major missing features in older CC (like GCM).

[public]

Of course I have no idea how we get test coverage for this. You could re-write the if/else to be like
return version >= parse_version("10.8") instead of branching I suppose?

[reaperhulk]

Have the whole thing invoke a function that you pass the version to, then you can pass it < 10.8 as a test.

[public]

That sounds ugly and doesn't really tell you very much?

[reaperhulk]

Gets you coverage :) I prefer your solution provided coverage doesn't think there's an uncovered branch.

[askholme]

Now checking my source(http://sourceforge.net/p/fink/mailman/fink-users/thread/[email protected]/) it might actually be that the KeyDeriviation file is available from 10.7 (but there is additional changes in 10.8)

On apple open source the file is copyright 2010, making inclusion in 10.7 likely
(http://www.opensource.apple.com/source/CommonCrypto/CommonCrypto-55010/CommonCrypto/CommonKeyDerivation.h) - Would be good to have someone confirm though

[reaperhulk]

KDF is indeed in 10.7, but AES GCM and several other primitives are not available in 10.7 that were added in 10.8 so we made the decision to limit the CC backend to 10.8+ (at least for now).

[jenkins-cryptography]

Test PASSed.
Refer to this link for build results: http://jenkins.cryptography.io/job/cryptography-pr-experimental/1002/

[coveralls]

Coverage remained the same when pulling d2fd08a on Ayrx:osx-version-check into 1e8aa9b on pyca:master.

[jenkins-cryptography]

Test PASSed.
Refer to this link for build results: http://jenkins.cryptography.io/job/cryptography-pr-experimental/1003/

[coveralls]

Coverage remained the same when pulling e4880e6 on Ayrx:osx-version-check into 1e8aa9b on pyca:master.

[alex]

Err, what does this do under a non-OS X OS?

[reaperhulk]

It returns an empty tuple, which makes me uncomfortable since I don't know if that's a guarantee or just a coincidence. I'd prefer to do this using platform.uname() I think (Darwin >=12 is 10.8+).

[dstufft]

If sys.platform =="Darwin" and platform.mac_ver() something something

On Mar 6, 2014, at 6:27 PM, Paul Kehrer [email protected] wrote:

In cryptography/hazmat/bindings/commoncrypto/binding.py:

@@ -46,4 +48,5 @@ def _ensure_ffi_initialized(cls):

 @classmethod
 def is_available(cls):

•    return sys.platform == "darwin"
  

•    version = parse_version(platform.mac_ver()[0])
  

•    return version >= parse_version("10.8")
  

  It returns an empty tuple, which makes me uncomfortable since I don't know if that's a guarantee or just a coincidence. I'd prefer to do this using platform.uname() I think (Darwin >=12 is 10.8+).

—
Reply to this email directly or view it on GitHub.

[Ayrx]

@reaperhulk The docs state

Entries which cannot be determined are set to ''. All tuple entries are strings.

so I assumed that it is guaranteed to be an empty tuple for non OS X systems.

[public]

I thought you were going to keep the sys.platform check?

[jenkins-cryptography]

Test FAILed.
Refer to this link for build results: http://jenkins.cryptography.io/job/cryptography-pr-experimental/1042/

[jenkins-cryptography]

Test FAILed.
Refer to this link for build results: http://jenkins.cryptography.io/job/cryptography-pr-experimental/1043/

[coveralls]

Coverage remained the same when pulling 4dd97e5 on Ayrx:osx-version-check into c24003e on pyca:master.

[jenkins-cryptography]

Test PASSed.
Refer to this link for build results: http://jenkins.cryptography.io/job/cryptography-pr-experimental/1045/

[coveralls]

Coverage remained the same when pulling 3558fd0 on Ayrx:osx-version-check into c24003e on pyca:master.