You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In #101929 we have many important programs (e.g. cachix) still using python2 in their builds. This list doesn't constitute python2 applications, but rather packages which have python2Packages.cryptography somewhere in their dependency graph. So these will be affected when python2Packages.cryptography does get marked as vulnerable.
This issue to track the conversion process over to python3, packages still needing to be converted are listed below. This list isn't exhaustive, just those that use the soon-to-be-marked-vulnerable pythonPackages.cryptography:
Finding the dependency
For most dependencies, it should be pretty obvious where python2 comes from, for more "difficult" packages. You may need to do some digging.
nix-tree + nix-instantiate
you can run nix-shell -p nix-tree --run "nix-tree $(nix-instantiate default.nix -A <package>) to get the entire build dependency tree, then search for the cryptography package, and then you should be able to trace which dependencies are introducing it.
nix why-depends
alternatively, you can use nix why-depends nix why-depends --all -f default.nix <package> python2Packages.cryptography can also be used, however, this will require you to re-build the package, which may take more time than parsing the dependency tree above
In #101929 we have many important programs (e.g.
cachix) still using python2 in their builds. This list doesn't constitute python2 applications, but rather packages which have python2Packages.cryptography somewhere in their dependency graph. So these will be affected whenpython2Packages.cryptographydoes get marked as vulnerable.This issue to track the conversion process over to python3, packages still needing to be converted are listed below. This list isn't exhaustive, just those that use the soon-to-be-marked-vulnerable pythonPackages.cryptography:
Finding the dependency
For most dependencies, it should be pretty obvious where python2 comes from, for more "difficult" packages. You may need to do some digging.
nix-tree + nix-instantiate
you can run
nix-shell -p nix-tree --run "nix-tree $(nix-instantiate default.nix -A <package>)to get the entire build dependency tree, then search for the cryptography package, and then you should be able to trace which dependencies are introducing it.nix why-depends
alternatively, you can use
nix why-dependsnix why-depends --all -f default.nix <package> python2Packages.cryptographycan also be used, however, this will require you to re-build the package, which may take more time than parsing the dependency tree above