diff --git a/CHANGELOG.rst b/CHANGELOG.rst index d375b8d83..245eaef25 100644 --- a/CHANGELOG.rst +++ b/CHANGELOG.rst @@ -8,8 +8,11 @@ Changelog .. note:: This version is not yet released and is under active development. -* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL 2.9.x and 3.0.x. The new - minimum LibreSSL version is 3.1+. +* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL 2.9.x and 3.0.x. + The new minimum LibreSSL version is 3.1+. +* Deprecated OpenSSL 1.1.0 support. OpenSSL 1.1.0 is no longer supported by + the OpenSSL project. Support for compiling with OpenSSL 1.1.0 will be + removed in a future release. .. _v36-0-0: diff --git a/docs/installation.rst b/docs/installation.rst index 71603a623..6a5e18e97 100644 --- a/docs/installation.rst +++ b/docs/installation.rst @@ -36,6 +36,10 @@ OpenSSL releases: In addition we test against several versions of LibreSSL and the latest commit in BoringSSL. +.. warning:: + + Cryptography 37.0.0 has deprecated support for OpenSSL 1.1.0. + Building cryptography on Windows -------------------------------- diff --git a/src/cryptography/hazmat/bindings/openssl/binding.py b/src/cryptography/hazmat/bindings/openssl/binding.py index 92d5b2448..752409769 100644 --- a/src/cryptography/hazmat/bindings/openssl/binding.py +++ b/src/cryptography/hazmat/bindings/openssl/binding.py @@ -7,6 +7,7 @@ import collections import threading import types import typing +import warnings import cryptography from cryptography import utils @@ -179,6 +180,20 @@ class Binding(object): cls._ensure_ffi_initialized() +def _verify_openssl_version(lib): + if ( + lib.CRYPTOGRAPHY_OPENSSL_LESS_THAN_111 + and not lib.CRYPTOGRAPHY_IS_LIBRESSL + and not lib.CRYPTOGRAPHY_IS_BORINGSSL + ): + warnings.warn( + "OpenSSL version 1.1.0 is no longer supported by the OpenSSL " + "project, please upgrade. A future version of cryptography will " + "drop support for it.", + utils.DeprecatedIn37, + ) + + def _verify_package_version(version): # Occasionally we run into situations where the version of the Python # package does not match the version of the shared object that is loaded. @@ -203,3 +218,5 @@ def _verify_package_version(version): _verify_package_version(cryptography.__version__) Binding.init_static_locks() + +_verify_openssl_version(Binding.lib) diff --git a/src/cryptography/utils.py b/src/cryptography/utils.py index 2b84db216..1b0e4bb70 100644 --- a/src/cryptography/utils.py +++ b/src/cryptography/utils.py @@ -25,6 +25,7 @@ PersistentlyDeprecated2017 = CryptographyDeprecationWarning PersistentlyDeprecated2019 = CryptographyDeprecationWarning DeprecatedIn35 = CryptographyDeprecationWarning DeprecatedIn36 = CryptographyDeprecationWarning +DeprecatedIn37 = CryptographyDeprecationWarning def _check_bytes(name: str, value: bytes) -> None: