Troubles with conflicting cryptography and cffi

Open
#1,461 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
42/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Quiet
Tech stack
cryptography, python
Domain
security, tooling

Research direction

Start by reproducing the reported command against the QGIS Earth Engine plugin with Bandit 1.9.1 on Python 3.14, then inspect Bandit's dependency constraints for cryptography and cffi. Determine whether a compatible combination avoids the macOS code-signature ImportError, and document the required constraints or the upstream coordination needed with cryptography, cffi, or google-auth.

Written by the indexing model from the issue text.

Description

bug
Describe the bug

I'm adding a but to bandit as it is the reason for https://github.com/gee-community/qgis-earthengine-plugin/issues/439. bandit is flagging cryptography and cffi, but forcing them to be recent leads to this:

ImportError: dlopen(.../cryptography/hazmat/bindings/_[rust.abi3.so](http://rust.abi3.so/), ...):
  code signature ... not valid for use in process:
  mapping process and mapped file (non-platform) have different Team IDs

This likely needs to work from both https://github.com/pyca/cryptography and https://github.com/python-cffi/cffi. And possibly https://github.com/googleapis/google-cloud-python/tree/main/packages/google-auth

@zacdezgeo

Reproduction steps
Ran bandit on https://github.com/gee-community/qgis-earthengine-plugin
Expected behavior

Being able to specify a recent cryptography + cffi combination that doesn't have any issues.

Bandit version

1.9.1 (Default)

Python version

3.14 (Default)

Additional context

No response

Dominant language
Python
Stars
8.3k
Forks
836
Avg merge
5d 3h
Merged PRs (30d)
1

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from PyCQA/bandit

All issues in PyCQA/bandit

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.