Fix R11: pin cryptography>=44.0.1 with hash lock #16

leora · 2026-10-06T06:23:50+08:00

leora commented

2026-10-06 06:23:50 +08:00

Summary

R11: raise cryptography floor to >=44.0.1 (CVE-2024-12797) and add a lock.

Changes

requirements.txt: cryptography>=44.0.1,<45
constraints.txt: exact 44.0.1
requirements.lock.txt: --require-hashes pin for cryptography + cffi + pycparser
Runbook/README pointers

Test plan

156 tests pass (library behaviour unchanged; box may still have 43.0.0 until ops upgrade)

## Summary **R11:** raise cryptography floor to >=44.0.1 (CVE-2024-12797) and add a lock. ## Changes - `requirements.txt`: `cryptography>=44.0.1,<45` - `constraints.txt`: exact `44.0.1` - `requirements.lock.txt`: `--require-hashes` pin for cryptography + cffi + pycparser - Runbook/README pointers ## Test plan - [x] 156 tests pass (library behaviour unchanged; box may still have 43.0.0 until ops upgrade)

leora added 1 commit 2026-10-06 06:23:50 +08:00

Fix R11: pin cryptography>=44.0.1 and add hash lock 9e76d68344

Raise the floor past CVE-2024-12797-affected wheels (43.x / 44.0.0).
Add constraints.txt (exact 44.0.1) and requirements.lock.txt with
sha256 hashes for cryptography and its runtime deps.

leora merged commit a5bbbccb29 into sigil-initial

2026-10-06 06:23:51 +08:00

leora referenced this issue from a commit

2026-10-06 06:23:51 +08:00

Merge pull request 'Fix R11: pin cryptography>=44.0.1 with hash lock' (#16) from leora/fix-r11-cryptography-pin into sigil-initial

leora referenced this pull request

2026-10-06 06:24:04 +08:00

Sigil: agent identity for the new internet #1

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: bigpickle/sigil#16