22.04-LTS-SP4分支的python-jwcrypto 编译失败-python-jwcrypto-AtomGit

已开启

22.04-LTS-SP4分支的python-jwcrypto 编译失败 #7

AtomGit-Bot创建于 2025年7月30日

2025年7月30日创建

https://gitee.com/src-openeuler/python-cryptography/commit/68db0101315e35deb1422cd0b0adade26e12fe21
此提交导致22.04-LTS-SP4分支的python-jwcrypto 失败

2025年7月30日评论：

Hi zhang-liang-pengkun, welcome to the openEuler Community.
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here.
If you have any questions, please contact the SIG: sig-python-modules, and any of the maintainers: @myeuler , @shinwell_hu , @yangzhao_kl , any of the committers: @randy1568 , @cherry530

A AtomGit-Bot

2025年7月30日创建了任务

openeuler-ci-bot成员

2025年7月30日添加了   sig/sig-python-modul 标签

AtomGit-Bot

2025年7月30日评论：

@tong_1001

AtomGit-Bot

2025年7月30日评论：

似乎是PKCS#1v1.5的问题

AtomGit-Bot

2025年7月30日评论：

[ 39s] _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
[ 39s] jwcrypto/jwt.py:602: in make_encrypted_token
[ 39s] t.add_recipient(key)
[ 39s] jwcrypto/jwe.py:240: in add_recipient
[ 39s] wrapped = alg.wrap(key, enc.wrap_key_size, self.cek, jh)
[ 39s] jwcrypto/jwa.py:364: in wrap
[ 39s] ek = rk.encrypt(cek, self.padfn)
[ 39s] /usr/lib64/python3.9/site-packages/cryptography/hazmat/backends/openssl/rsa.py:539: in encrypt
[ 39s] return _enc_dec_rsa(self._backend, self, plaintext, padding)
[ 39s] /usr/lib64/python3.9/site-packages/cryptography/hazmat/backends/openssl/rsa.py:87: in _enc_dec_rsa
[ 39s] return _enc_dec_rsa_pkey_ctx(backend, key, data, padding_enum, padding)
[ 39s] _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
[ 39s]
[ 39s] backend = <OpenSSLBackend(version: OpenSSL 1.1.1m 14 Dec 2021, FIPS: False)>
[ 39s] key = <cryptography.hazmat.backends.openssl.rsa._RSAPublicKey object at 0xffffa084dca0>
[ 39s] data = b'l\x0ed\xdde\xfaU\x82~\xe8\xc3\xc2'\xd2\x8f\xe5=H_M\x03w\xde"\x15@\xfe\xdcY\xc5\x87\xfb'
[ 39s] padding_enum = 1
[ 39s] padding = <cryptography.hazmat.primitives.asymmetric.padding.PKCS1v15 object at 0xffffa084d5e0>
[ 39s]
[ 39s] def _enc_dec_rsa_pkey_ctx(
[ 39s] backend,
[ 39s] key: typing.Union["_RSAPrivateKey", "_RSAPublicKey"],
[ 39s] data: bytes,
[ 39s] padding_enum: int,
[ 39s] padding: AsymmetricPadding,
[ 39s] ) -> bytes:
[ 39s] if isinstance(padding, PKCS1v15):
[ 39s] > raise ValueError("RSA PKCS#1v1.5 has security problems and it has been banned.")
[ 39s] E ValueError: RSA PKCS#1v1.5 has security problems and it has been banned.
[ 39s]
[ 39s] /usr/lib64/python3.9/site-packages/cryptography/hazmat/backends/openssl/rsa.py:98: ValueError
[ 39s] =========================== short test summary info ============================
[ 39s] FAILED jwcrypto/tests-cookbook.py::Cookbook08JWETests::test_5_1_encryption - ...
[ 39s] FAILED jwcrypto/tests.py::TestJWE::test_A2 - ValueError: RSA PKCS#1v1.5 has s...
[ 39s] FAILED jwcrypto/tests.py::TestJWE::test_A4 - ValueError: RSA PKCS#1v1.5 has s...
[ 39s] FAILED jwcrypto/tests.py::TestJWT::test_A1 - ValueError: RSA PKCS#1v1.5 has s...
[ 39s] FAILED jwcrypto/tests.py::TestJWT::test_A2 - jwcrypto.jwe.InvalidJWEData: No ...
[ 39s] FAILED jwcrypto/tests.py::TestJWT::test_claim_params - ValueError: RSA PKCS#1...
[ 39s] FAILED jwcrypto/tests.py::TestJWT::test_decrypt_keyset - ValueError: RSA PKCS...
[ 39s] FAILED jwcrypto/tests.py::TestJWT::test_decrypt_keyset_dup_kid - ValueError: ...
[ 39s] FAILED jwcrypto/tests.py::TestJWT::test_invalid_claim_type - ValueError: RSA ...
[ 39s] ======================== 9 failed, 110 passed in 14.70s ========================
[ 40s] error: Bad exit status from /var/tmp/rpm-tmp.aQGIhq (%check)
[ 40s]
[ 40s]
[ 40s] RPM build errors:

2025年7月31日评论：

[ 39s] _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
[ 39s] jwcrypto/jwt.py:602: in make_encrypted_token
[ 39s] t.add_recipient(key)
[ 39s] jwcrypto/jwe.py:240: in add_recipient
[ 39s] wrapped = alg.wrap(key, enc.wrap_key_size, self.cek, jh)
[ 39s] jwcrypto/jwa.py:364: in wrap
[ 39s] ek = rk.encrypt(cek, self.padfn)
[ 39s] /usr/lib64/python3.9/site-packages/cryptography/hazmat/backends/openssl/rsa.py:539: in encrypt
[ 39s] return _enc_dec_rsa(self._backend, self, plaintext, padding)
[ 39s] /usr/lib64/python3.9/site-packages/cryptography/hazmat/backends/openssl/rsa.py:87: in _enc_dec_rsa
[ 39s] return _enc_dec_rsa_pkey_ctx(backend, key, data, padding_enum, padding)
[ 39s] _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
[ 39s]
[ 39s] backend = <OpenSSLBackend(version: OpenSSL 1.1.1m 14 Dec 2021, FIPS: False)>
[ 39s] key = <cryptography.hazmat.backends.openssl.rsa._RSAPublicKey object at 0xffffa084dca0>
[ 39s] data = b'l\x0ed\xdde\xfaU\x82~\xe8\xc3\xc2'\xd2\x8f\xe5=H_M\x03w\xde"\x15@\xfe\xdcY\xc5\x87\xfb'
[ 39s] padding_enum = 1
[ 39s] padding = <cryptography.hazmat.primitives.asymmetric.padding.PKCS1v15 object at 0xffffa084d5e0>
[ 39s]
[ 39s] def _enc_dec_rsa_pkey_ctx(
[ 39s] backend,
[ 39s] key: typing.Union["_RSAPrivateKey", "_RSAPublicKey"],
[ 39s] data: bytes,
[ 39s] padding_enum: int,
[ 39s] padding: AsymmetricPadding,
[ 39s] ) -> bytes:
[ 39s] if isinstance(padding, PKCS1v15):
[ 39s] > raise ValueError("RSA PKCS#1v1.5 has security problems and it has been banned.")
[ 39s] E ValueError: RSA PKCS#1v1.5 has security problems and it has been banned.
[ 39s]
[ 39s] /usr/lib64/python3.9/site-packages/cryptography/hazmat/backends/openssl/rsa.py:98: ValueError
[ 39s] =========================== short test summary info ============================
[ 39s] FAILED jwcrypto/tests-cookbook.py::Cookbook08JWETests::test_5_1_encryption - ...
[ 39s] FAILED jwcrypto/tests.py::TestJWE::test_A2 - ValueError: RSA PKCS#1v1.5 has s...
[ 39s] FAILED jwcrypto/tests.py::TestJWE::test_A4 - ValueError: RSA PKCS#1v1.5 has s...
[ 39s] FAILED jwcrypto/tests.py::TestJWT::test_A1 - ValueError: RSA PKCS#1v1.5 has s...
[ 39s] FAILED jwcrypto/tests.py::TestJWT::test_A2 - jwcrypto.jwe.InvalidJWEData: No ...
[ 39s] FAILED jwcrypto/tests.py::TestJWT::test_claim_params - ValueError: RSA PKCS#1...
[ 39s] FAILED jwcrypto/tests.py::TestJWT::test_decrypt_keyset - ValueError: RSA PKCS...
[ 39s] FAILED jwcrypto/tests.py::TestJWT::test_decrypt_keyset_dup_kid - ValueError: ...
[ 39s] FAILED jwcrypto/tests.py::TestJWT::test_invalid_claim_type - ValueError: RSA ...
[ 39s] ======================== 9 failed, 110 passed in 14.70s ========================
[ 40s] error: Bad exit status from /var/tmp/rpm-tmp.aQGIhq (%check)
[ 40s]
[ 40s]
[ 40s] RPM build errors:

@zhang-liang-pengkun RSA PKCS#1v1.5算法不安全，存在CVE漏洞，cryptography难以修复，需要升级openssl才可能修复。安全起见，建议禁用cryptography包的RSA PKCS#1v1.5算法。

AtomGit-Bot

2025年7月31日评论：

[ 39s] _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
[ 39s] jwcrypto/jwt.py:602: in make_encrypted_token
[ 39s] t.add_recipient(key)
[ 39s] jwcrypto/jwe.py:240: in add_recipient
[ 39s] wrapped = alg.wrap(key, enc.wrap_key_size, self.cek, jh)
[ 39s] jwcrypto/jwa.py:364: in wrap
[ 39s] ek = rk.encrypt(cek, self.padfn)
[ 39s] /usr/lib64/python3.9/site-packages/cryptography/hazmat/backends/openssl/rsa.py:539: in encrypt
[ 39s] return _enc_dec_rsa(self._backend, self, plaintext, padding)
[ 39s] /usr/lib64/python3.9/site-packages/cryptography/hazmat/backends/openssl/rsa.py:87: in _enc_dec_rsa
[ 39s] return _enc_dec_rsa_pkey_ctx(backend, key, data, padding_enum, padding)
[ 39s] _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
[ 39s]
[ 39s] backend = <OpenSSLBackend(version: OpenSSL 1.1.1m 14 Dec 2021, FIPS: False)>
[ 39s] key = <cryptography.hazmat.backends.openssl.rsa._RSAPublicKey object at 0xffffa084dca0>
[ 39s] data = b'l\x0ed\xdde\xfaU\x82~\xe8\xc3\xc2'\xd2\x8f\xe5=H_M\x03w\xde"\x15@\xfe\xdcY\xc5\x87\xfb'
[ 39s] padding_enum = 1
[ 39s] padding = <cryptography.hazmat.primitives.asymmetric.padding.PKCS1v15 object at 0xffffa084d5e0>
[ 39s]
[ 39s] def _enc_dec_rsa_pkey_ctx(
[ 39s] backend,
[ 39s] key: typing.Union["_RSAPrivateKey", "_RSAPublicKey"],
[ 39s] data: bytes,
[ 39s] padding_enum: int,
[ 39s] padding: AsymmetricPadding,
[ 39s] ) -> bytes:
[ 39s] if isinstance(padding, PKCS1v15):
[ 39s] > raise ValueError("RSA PKCS#1v1.5 has security problems and it has been banned.")
[ 39s] E ValueError: RSA PKCS#1v1.5 has security problems and it has been banned.
[ 39s]
[ 39s] /usr/lib64/python3.9/site-packages/cryptography/hazmat/backends/openssl/rsa.py:98: ValueError
[ 39s] =========================== short test summary info ============================
[ 39s] FAILED jwcrypto/tests-cookbook.py::Cookbook08JWETests::test_5_1_encryption - ...
[ 39s] FAILED jwcrypto/tests.py::TestJWE::test_A2 - ValueError: RSA PKCS#1v1.5 has s...
[ 39s] FAILED jwcrypto/tests.py::TestJWE::test_A4 - ValueError: RSA PKCS#1v1.5 has s...
[ 39s] FAILED jwcrypto/tests.py::TestJWT::test_A1 - ValueError: RSA PKCS#1v1.5 has s...
[ 39s] FAILED jwcrypto/tests.py::TestJWT::test_A2 - jwcrypto.jwe.InvalidJWEData: No ...
[ 39s] FAILED jwcrypto/tests.py::TestJWT::test_claim_params - ValueError: RSA PKCS#1...
[ 39s] FAILED jwcrypto/tests.py::TestJWT::test_decrypt_keyset - ValueError: RSA PKCS...
[ 39s] FAILED jwcrypto/tests.py::TestJWT::test_decrypt_keyset_dup_kid - ValueError: ...
[ 39s] FAILED jwcrypto/tests.py::TestJWT::test_invalid_claim_type - ValueError: RSA ...
[ 39s] ======================== 9 failed, 110 passed in 14.70s ========================
[ 40s] error: Bad exit status from /var/tmp/rpm-tmp.aQGIhq (%check)
[ 40s]
[ 40s]
[ 40s] RPM build errors:

这导致python-jwcrypto的测试用例失败，有解决方案吗

2025年7月31日评论：

这导致python-jwcrypto的测试用例失败，有解决方案吗

@zhang-liang-pengkun 只能修改用例，或者跳过这部分用例。

L lipengyu001

6月24日关联了pull request：skip rsa1_5 tests when disabled

L lipengyu001

7月9日关联了pull request：fix cve-2026-39373 and skip-rsa1_5-tests-when-disabled