aws-sam-cli: Bug: Error on sam build command

@nszeitli for aws-actions/setup-sam, you can add the following step to github workflow (worked for us):

      - name: sam fix https://github.com/aws/aws-sam-cli/issues/4527
        run: $(dirname $(readlink $(which sam)))/pip install --force-reinstall "cryptography==38.0.4"

cryptography 39.0.0 no longer supports openssl 1.1.0 or older and thus is causing this issue. Reference:

https://github.com/pyca/cryptography/issues/7959 https://cryptography.io/en/latest/changelog/#v39-0-0 aws-sam-cli uses the latest cryptography while using pyopenssl 22.0.0. These two are incompatible. As a workaround until the dependencies are fixed, you can force install cryptography 38.0.4 and sam should work (I just verified with my CI/CD builds which all got broken today due to the cryptography update).

If you’re on MacOS/Homebrew here’s how to implement the workaround:

/opt/homebrew/Cellar/aws-sam-cli/1.67.0/libexec/bin/pip install --force-reinstall "cryptography==38.0.4"

Getting this in all our github actions using aws-actions/setup-sam. New years day dependency bomb!

You can go up to version 1.59.0

Having this issue in codebuild as well (aws/codebuild/standard:5.0)

cryptography 39.0.0 no longer supports openssl 1.1.0 or older and thus is causing this issue. Reference:

• https://github.com/pyca/cryptography/issues/7959
• https://cryptography.io/en/latest/changelog/#v39-0-0

aws-sam-cli uses the latest cryptography while using pyopenssl 22.0.0. These two are incompatible. As a workaround until the dependencies are fixed, you can force install cryptography 38.0.4 and sam should work (I just verified with my CI/CD builds which all got broken today due to the cryptography update).

For github-actions, another solution is set a version:

- uses: aws-actions/setup-sam@v2
  with:
     version: 1.37.0

EDIT: Check version 1.59.0, see @ugocottin comment: https://github.com/aws/aws-sam-cli/issues/4527#issuecomment-1369814857

Closing as the fix has been released with AWS SAM CLI v1.68.0 - https://github.com/aws/aws-sam-cli/releases/tag/v1.68.0

Same issue in CodeBuild using pipenv. Workaround here is: pip install awscli aws-sam-cli --force-reinstall "cryptography==38.0.4"

as of now, github actions that depends on sam cli still failed

Edit: In the meantime, while waiting for the release of the fixes, you can try add this temporary workaround step right after this step: - uses: aws-actions/setup-sam@v2

pyOpenSSL declares a lower and upper bound on its own dependencies to avoid this sort of issue, however it didn’t start to do so until version 22.1.0. This repository currently pins 22.0.0 https://github.com/aws/aws-sam-cli/blob/07fa5f478dfa04c45521af188b39fbaff622cc72/requirements/base.txt#L21

Once the pin is updated you won’t see this type of issue again in the future.

Note that the drop of OpenSSL 1.1.0 is not really related to this issue, as over 98% of cryptography’s downloads come from wheels (which we do against openssl3-latest) rather than being locally built.

cryptography 39.0.0 no longer supports openssl 1.1.0 or older and thus is causing this issue. Reference:

• AttributeError: module ‘lib’ has no attribute ‘OpenSSL_add_all_algorithms’ pyca/cryptography#7959
• https://cryptography.io/en/latest/changelog/#v39-0-0

aws-sam-cli uses the latest cryptography while using pyopenssl 22.0.0. These two are incompatible. As a workaround until the dependencies are fixed, you can force install cryptography 38.0.4 and sam should work (I just verified with my CI/CD builds which all got broken today due to the cryptography update).

Thank you so much. I got it work!

I am very new to github/it in general. construction worker, just working on completing cloud-resume-challenge and a few days ago I had my tests working fine and github actions and workflows working fine. made a commit today and it fails! I wasnt sure what was going on. The fix listed here worked for me!

• uses: aws-actions/setup-sam@v2 with: version: 1.59.0

ons that depends on sam cli still failed

Kudos to @altaurog, his line of the fixed version of cryptography worked like a charm: This is our current setup, using Github for building:

      - name: Setup AWS SAM
        uses: aws-actions/setup-sam@v1
        with:
          version: 1.65.0
      - name: sam fix https://github.com/aws/aws-sam-cli/issues/4527
        run: $(dirname $(readlink $(which sam)))/pip install --force-reinstall "cryptography==38.0.4"

How did you get it to work?

This issue is only affecting the people who use pip to install AWS SAM CLI, or use the homebrew installation way on ARM architecture (linux or mac).

For macOS users, We recommend using the PKG installation approach, and For Linux users, we recommend the Command line installer way. You can find all the installation details here.

For pip installations, you can try the @karimdaghari workaround (Thanks @karimdaghari for your help 😃 )

We are working on the fix for this issue, we will update this issue once it got released.

Check which pip you are using @Gordonbaes . If it isn’t /home/htrinh/.local/bin/pip it won’t help you.

Thanks @Raul-CC ! As an aside, note that the latest version of aws-actions/setup-sam is v2. (Sorry, I realize this isn’t exactly on-topic)