python - cryptography package - import error

Question

I'm working in an Alpine docker container, I'm experiencing the following ImportError while starting a python shell:

Traceback (most recent call last):
  File "manage.py", line 15, in <module>
    execute_from_command_line(sys.argv)
  File "/usr/lib/python3.6/site-packages/django/core/management/__init__.py", line 364, in execute_from_command_line
    utility.execute()
  File "/usr/lib/python3.6/site-packages/django/core/management/__init__.py", line 338, in execute
    django.setup()
  File "/usr/lib/python3.6/site-packages/django/__init__.py", line 27, in setup
    apps.populate(settings.INSTALLED_APPS)
  File "/usr/lib/python3.6/site-packages/django/apps/registry.py", line 108, in populate
    app_config.import_models()
  File "/usr/lib/python3.6/site-packages/django/apps/config.py", line 202, in import_models
    self.models_module = import_module(models_module_name)
  File "/usr/lib/python3.6/importlib/__init__.py", line 126, in import_module
    return _bootstrap._gcd_import(name[level:], package, level)
  File "<frozen importlib._bootstrap>", line 994, in _gcd_import
  File "<frozen importlib._bootstrap>", line 971, in _find_and_load
  File "<frozen importlib._bootstrap>", line 955, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 665, in _load_unlocked
  File "<frozen importlib._bootstrap_external>", line 678, in exec_module
  File "<frozen importlib._bootstrap>", line 219, in _call_with_frames_removed
  File "/var/www/cch_pop_app/cornerstone/models/__init__.py", line 1, in <module>
    from .models import *
  File "/var/www/cch_pop_app/cornerstone/models/models.py", line 18, in <module>
    from .abstract import AbstractCornerstoneUserProfile, AbstractOrganizationalUnit
  File "/var/www/cch_pop_app/cornerstone/models/abstract.py", line 22, in <module>
    from ..utils import CSODTokenDict
  File "/var/www/cch_pop_app/cornerstone/utils.py", line 19, in <module>
    import paramiko
  File "/usr/lib/python3.6/site-packages/paramiko/__init__.py", line 22, in <module>
    from paramiko.transport import SecurityOptions, Transport
  File "/usr/lib/python3.6/site-packages/paramiko/transport.py", line 129, in <module>
    class Transport(threading.Thread, ClosingContextManager):
  File "/usr/lib/python3.6/site-packages/paramiko/transport.py", line 190, in Transport
    if KexCurve25519.is_available():
  File "/usr/lib/python3.6/site-packages/paramiko/kex_curve25519.py", line 30, in is_available
    X25519PrivateKey.generate()
  File "/usr/lib/python3.6/site-packages/cryptography/hazmat/primitives/asymmetric/x25519.py", line 38, in generate
    from cryptography.hazmat.backends.openssl.backend import backend
  File "/usr/lib/python3.6/site-packages/cryptography/hazmat/backends/openssl/__init__.py", line 7, in <module>
    from cryptography.hazmat.backends.openssl.backend import backend
  File "/usr/lib/python3.6/site-packages/cryptography/hazmat/backends/openssl/backend.py", line 75, in <module>
    from cryptography.hazmat.bindings.openssl import binding
  File "/usr/lib/python3.6/site-packages/cryptography/hazmat/bindings/openssl/binding.py", line 16, in <module>
    from cryptography.hazmat.bindings._openssl import ffi, lib
ImportError: Error relocating /usr/lib/python3.6/site-packages/cryptography/hazmat/bindings/_openssl.abi3.so: RSA_get0_crt_params: symbol not found

those are the packages installed through pip :

Django==1.11.29
Jinja2==2.10
MarkupSafe==1.0
Pillow==4.3.0
PyNaCl==1.4.0
Pygments==2.6.1
backcall==0.1.0
bcrypt==3.1.7
beautifulsoup4==4.9.1
boto3==1.13.16
botocore==1.16.16
bs4==0.0.1
certifi==2020.4.5.1
cffi==1.14.0
chardet==3.0.4
click==7.1.2
croniter==0.3.31
cryptography==2.9.2
csod==1.0.13
decorator==4.4.2
diff-match-patch==20181111
dj-database-url==0.4.2
django-cors-headers==2.1.0
django-environ==0.4.1
django-extensions==1.7.8
django-import-export==1.1.0
django-jsoneditor==0.1.4
django-model-utils==4.0.0
django-mptt==0.8.7
django-rq-scheduler==1.1.5
django-rq==2.1.0
django-s3-storage==0.12.1
django-sql-explorer==1.1.3
djangorestframework==3.7.1
docutils==0.15.2
gunicorn==19.7.1
idna==2.6
ipdb==0.13.2
ipython-genutils==0.2.0
ipython==7.15.0
jedi==0.17.0
jmespath==0.10.0
newrelic==2.102.0.85
olefile==0.46
packaging==20.4
paramiko==2.7.1
parso==0.7.0
pexpect==4.8.0
pickleshare==0.7.5
prompt-toolkit==3.0.5
psycopg2-binary==2.7.6.1
psycopg2==2.7
ptyprocess==0.6.0
pyOpenSSL==19.1.0
pyasn1==0.4.8
pycparser==2.20
pyparsing==2.4.7
python-dateutil==2.7.5
pytz==2016.10
redis==3.5.2
reportlab==3.5.32
requests==2.18.4
rq-scheduler==0.10.0
rq==1.3.0
s3transfer==0.3.3
six==1.15.0
soupsieve==2.0.1
sqlparse==0.3.1
suds-py3==1.3.3.0
tablib==2.0.0
traitlets==4.3.3
unicodecsv==0.14.1
urllib3==1.22
wcwidth==0.2.3

and those are the packages installed on the base system:

alpine-baselayout-3.0.5-r2 - Alpine base dir structure and init scripts
alpine-keys-2.1-r1 - Public keys for Alpine Linux packages
apk-tools-2.8.2-r0 - Alpine Package Keeper - package manager for alpine
binutils-2.30-r2 - Tools necessary to build programs
binutils-libs-2.30-r2 - Runtime libraries from binutils - libbfd and libopcodes
busybox-1.27.2-r7 - Size optimized toolbox of many common UNIX utilities
ca-certificates-20190108-r0 - Common CA certificates PEM files
db-5.3.28-r0 - The Berkeley DB embedded database system
expat-2.2.5-r0 - An XML Parser library written in C
freetype-2.8.1-r4 - TrueType font rendering library
freetype-dev-2.8.1-r4 - TrueType font rendering library (development files)
g++-6.4.0-r5 - GNU C++ standard library and compiler
gcc-6.4.0-r5 - The GNU Compiler Collection
gdbm-1.13-r1 - GNU dbm is a set of database routines that use extensible hashing
git-2.15.4-r0 - A distributed version control system
glibc-2.25-r0 - GNU C Library compatibility layer
glibc-bin-2.25-r0 - GNU C Library compatibility layer
gmp-6.1.2-r1 - A free library for arbitrary precision arithmetic
isl-0.18-r0 - An Integer Set Library for the Polyhedral Model
lcms2-2.8-r1 - Color Management Engine
lcms2-dev-2.8-r1 - Color Management Engine (development files)
libatomic-6.4.0-r5 - GCC Atomic library
libbz2-1.0.6-r6 - Shared library for bz2
libc-dev-0.7.1-r0 - Meta package to pull in correct libc
libc-utils-0.7.1-r0 - Meta package to pull in correct libc
libcrypto1.0-1.0.2t-r0 - Crypto library from openssl
libcurl-7.61.1-r3 - The multiprotocol file transfer library
libffi-3.2.1-r4 - A portable, high level programming interface to various calling conventions.
libffi-dev-3.2.1-r4 - A portable, high level programming interface to various calling conventions. (development files)
libgcc-6.4.0-r5 - GNU C compiler runtime libraries
libgomp-6.4.0-r5 - GCC shared-memory parallel programming API library
libjpeg-turbo-1.5.3-r3 - accelerated baseline JPEG compression and decompression library
libjpeg-turbo-dev-1.5.3-r3 - accelerated baseline JPEG compression and decompression library (development files)
libldap-2.4.48-r0 - OpenLDAP libraries
libpng-1.6.37-r0 - Portable Network Graphics library
libpng-dev-1.6.37-r0 - Portable Network Graphics library (development files)
libpq-10.10-r0 - PostgreSQL libraries
libressl-2.6.5-r0 - Version of the TLS/crypto stack forked from OpenSSL
libressl-dev-2.6.5-r0 - Version of the TLS/crypto stack forked from OpenSSL (development files)
libressl2.6-libcrypto-2.6.5-r0 - libressl libcrypto library
libressl2.6-libssl-2.6.5-r0 - libressl libssl library
libressl2.6-libtls-2.6.5-r0 - libressl libtls library
libsasl-2.1.26-r11 - Cyrus Simple Authentication and Security Layer (SASL) library
libssh2-1.9.0-r1 - library for accessing ssh1/ssh2 protocol servers
libssl1.0-1.0.2t-r0 - SSL shared libraries
libstdc++-6.4.0-r5 - GNU C++ standard runtime library
libwebp-0.6.0-r1 - Libraries for working with WebP images
libwebp-dev-0.6.0-r1 - Libraries for working with WebP images (development files)
make-4.2.1-r0 - GNU make utility to maintain groups of programs
mpc1-1.0.3-r1 - Multiprecision C library
mpfr3-3.1.5-r1 - multiple-precision floating-point library
musl-1.1.18-r4 - the musl c library (libc) implementation
musl-dev-1.1.18-r4 - the musl c library (libc) implementation (development files)
musl-utils-1.1.18-r4 - the musl c library (libc) implementation
ncurses-libs-6.0_p20171125-r0 - Ncurses libraries
ncurses-terminfo-6.0_p20171125-r0 - Console display library
ncurses-terminfo-base-6.0_p20171125-r0 - Descriptions of common terminals
openssh-7.5_p1-r10 - Port of OpenBSD's free SSH release
openssh-client-7.5_p1-r10 - OpenBSD's SSH client
openssh-keygen-7.5_p1-r10 - ssh helper program for generating keys
openssh-server-7.5_p1-r10 - OpenSSH server
openssh-server-common-7.5_p1-r10 - OpenSSH server configuration files
openssh-sftp-server-7.5_p1-r10 - ssh sftp server module
openssl-1.0.2t-r0 - Toolkit for SSL v2/v3 and TLS v1
pcre2-10.30-r0 - Perl-compatible regular expression library
pkgconf-1.3.10-r0 - development framework configuration tools
postgresql-dev-10.10-r0 - A sophisticated object-relational DBMS (development files)
postgresql-libs-10.10-r0 - A sophisticated object-relational DBMS (libraries)
py-setuptools-33.1.1-r1 - A collection of enhancements to the Python distutils
python2-2.7.15-r3 - A high-level scripting language
python3-3.6.9-r1 - A high-level scripting language
python3-dev-3.6.9-r1 - A high-level scripting language (development files)
readline-7.0.003-r0 - GNU readline library
scanelf-1.2.2-r1 - Scan ELF binaries for stuff
sqlite-libs-3.21.0-r0 - Sqlite3 library
tiff-4.0.10-r2 - Provides support for the Tag Image File Format or TIFF
tiff-dev-4.0.10-r2 - Provides support for the Tag Image File Format or TIFF (development files)
xz-libs-5.2.3-r1 - Library and command line tools for XZ and LZMA compressed files (libraries)
zlib-1.2.11-r1 - A compression/decompression Library
zlib-dev-1.2.11-r1 - A compression/decompression Library (development files)

What I already tried to do:

• install / reinstall cryptography through pip (even forcing to reinstall the latest version)

• install openssl with apk

None of those have helped.

• base system: Alpine 3.7

• Python version: 3.6.9

Anyone can help re this?

thanks

Answer 1

This is typically an issue caused by mismatch of headers and library version. Alpine 3.7 still shipped LibreSSL by default with optional OpenSSL (they have since switched back to just OpenSSL). I'd recommend upgrading your Alpine, which will likely fix this issue since it will be more difficult to end up with multiple OpenSSL-like objects on the system. Additionally, cryptography is dropping support for LibreSSL < 2.9.1 in the next release so you'll need to upgrade your Alpine version at that time anyway.