Bug: Error on sam build command

[getanwar]

Description:

I can not build projects after upgrading sam cli from 1.65.0 to 1.67.0
After facing the issue for a couple of times I thought it might fix if I remove python3.8 manually and reinstall aws-sam-cli. But it did not solve it. I confirmed that python3.8 was reinstall with aws-sam-cli

Steps to reproduce:

1. run brew upgrade aws-sam-cli
2. try to build any sam project

I encountered the following error after doing that.

Observed result:

sam build --debug

  File "/opt/homebrew/bin/sam", line 8, in <module>
    sys.exit(cli())
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/click/core.py", line 1130, in __call__
    return self.main(*args, **kwargs)
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/click/core.py", line 1055, in main
    rv = self.invoke(ctx)
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/click/core.py", line 1651, in invoke
    cmd_name, cmd, args = self.resolve_command(ctx, args)
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/click/core.py", line 1698, in resolve_command
    cmd = self.get_command(ctx, cmd_name)
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/samcli/cli/command.py", line 133, in get_command
    mod = importlib.import_module(pkg_name)
  File "/opt/homebrew/Cellar/python@3.8/3.8.16/Frameworks/Python.framework/Versions/3.8/lib/python3.8/importlib/__init__.py", line 127, in import_module
    return _bootstrap._gcd_import(name[level:], package, level)
  File "<frozen importlib._bootstrap>", line 1014, in _gcd_import
  File "<frozen importlib._bootstrap>", line 991, in _find_and_load
  File "<frozen importlib._bootstrap>", line 975, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 671, in _load_unlocked
  File "<frozen importlib._bootstrap_external>", line 843, in exec_module
  File "<frozen importlib._bootstrap>", line 219, in _call_with_frames_removed
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/samcli/commands/build/__init__.py", line 6, in <module>
    from .command import cli  # noqa
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/samcli/commands/build/command.py", line 12, in <module>
    from samcli.commands._utils.options import (
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/samcli/commands/_utils/options.py", line 21, in <module>
    from samcli.commands._utils.template import get_template_data, TemplateNotFoundException
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/samcli/commands/_utils/template.py", line 10, in <module>
    from botocore.utils import set_value_from_jmespath
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/botocore/utils.py", line 37, in <module>
    import botocore.httpsession
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/botocore/httpsession.py", line 46, in <module>
    from urllib3.contrib.pyopenssl import (
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/urllib3/contrib/pyopenssl.py", line 50, in <module>
    import OpenSSL.crypto
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/OpenSSL/__init__.py", line 8, in <module>
    from OpenSSL import crypto, SSL
  File "/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/lib/python3.8/site-packages/OpenSSL/crypto.py", line 3268, in <module>
    _lib.OpenSSL_add_all_algorithms()
AttributeError: module 'lib' has no attribute 'OpenSSL_add_all_algorithms'

Expected result:

Additional environment details (Ex: Windows, Mac, Amazon Linux etc)

1. OS: MacOS 12.4 (Monterey)
2. sam --version: SAM CLI, version 1.67.0
3. AWS region: us-east-2

Add --debug flag to command you are running

[JoL0712]

cryptography 39.0.0 no longer supports openssl 1.1.0 or older and thus is causing this issue.
Reference:

• AttributeError: module 'lib' has no attribute 'OpenSSL_add_all_algorithms'. AWS sam build failure. pyca/cryptography#7959
• https://cryptography.io/en/latest/changelog/#v39-0-0

aws-sam-cli uses the latest cryptography while using pyopenssl 22.0.0. These two are incompatible.
As a workaround until the dependencies are fixed, you can force install cryptography 38.0.4 and sam should work (I just verified with my CI/CD builds which all got broken today due to the cryptography update).

[nszeitli]

Getting this in all our github actions using aws-actions/setup-sam. New years day dependency bomb!

[getanwar]

cryptography 39.0.0 no longer supports openssl 1.1.0 or older and thus is causing this issue. Reference:

• AttributeError: module 'lib' has no attribute 'OpenSSL_add_all_algorithms' pyca/cryptography#7959
• https://cryptography.io/en/latest/changelog/#v39-0-0

aws-sam-cli uses the latest cryptography while using pyopenssl 22.0.0. These two are incompatible. As a workaround until the dependencies are fixed, you can force install cryptography 38.0.4 and sam should work (I just verified with my CI/CD builds which all got broken today due to the cryptography update).

Thank you so much. I got it work!

[reaperhulk]

pyOpenSSL declares a lower and upper bound on its own dependencies to avoid this sort of issue, however it didn't start to do so until version 22.1.0. This repository currently pins 22.0.0

aws-sam-cli/requirements/base.txt

Line 21 in 07fa5f4

pyopenssl==22.0.0

Once the pin is updated you won't see this type of issue again in the future.

Note that the drop of OpenSSL 1.1.0 is not really related to this issue, as over 98% of cryptography's downloads come from wheels (which we do against openssl3-latest) rather than being locally built.

[Obrecsys]

How did you get it to work?

[karimdaghari]

cryptography 39.0.0 no longer supports openssl 1.1.0 or older and thus is causing this issue.
Reference:

pyca/cryptography#7959
https://cryptography.io/en/latest/changelog/#v39-0-0
aws-sam-cli uses the latest cryptography while using pyopenssl 22.0.0. These two are incompatible.
As a workaround until the dependencies are fixed, you can force install cryptography 38.0.4 and sam should work (I just verified with my CI/CD builds which all got broken today due to the cryptography update).

If you're on MacOS/Homebrew here's how to implement the workaround:

/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/bin/pip install --force-reinstall "cryptography==38.0.4"

[korostelevm]

Having this issue in codebuild as well (aws/codebuild/standard:5.0)