<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">In the past, we've been very conservative about updating to require new versions of pyOpenSSL and cryptography.<div class=""><br class=""></div><div class="">Right now we have a patch, <<a href="https://github.com/twisted/twisted/pull/146" class="">https://github.com/twisted/twisted/pull/146</a>> (<<a href="https://twistedmatrix.com/trac/ticket/8441#comment:1" class="">https://twistedmatrix.com/trac/ticket/8441#comment:1</a>>), that I'd like to just land. However, it establishes a dependency on a new version of pyOpenSSL, which transitively establishes a dependency on a new version of Cryptography.</div><div class=""><br class=""></div><div class="">Generally, my thinking has evolved over the last few years to think that security dependencies like this should move fast, especially on projects (like pyOpenSSL and cryptography specifically) that don't maintain "stable" branches which do security patch-releases.</div><div class=""><br class=""></div><div class="">In this specific case, the fix is not urgent; as it turns out, the netscape SPKI APIs actually <i class="">do</i> do the desired thing, which is just hashing the DER bytes of the key. (At the time I made the change to use Netscape SPKI, I thought it might be including somet other junk in the hash; we just lucked out here.) It's just a gross API for doing it which we should stop using now that better APIs have been exposed to do the same thing.</div><div class=""><br class=""></div><div class="">However, it bears discussing - what are the things that hold us to older versions of pyOpenSSL and cryptography? Is there any good reason <i class="">not</i> to move our version pins forward whenever there's a new API or feature that we'd like, even for something simple like this cleanup?</div><div class=""><br class=""></div><div class="">My default position is "upgrade upgrade upgrade" so if there's not a lot of interest in this discussion I'll probably just land the PR in question as-is.</div><div class=""><br class=""></div><div class="">Thanks all,</div><div class=""><br class=""></div><div class=""><div class=""><div class=""><div class="">-glyph</div></div></div></div></body></html>