Cryptography: AttributeError: 'EntryPoint' object has no attribute 'resolve'

[clarius-deploy]

Started getting the following error on our CircleCi build service containers today.

Collecting cryptography
/usr/local/lib/python2.7/dist-packages/pip/_vendor/requests/packages/urllib3/util/ssl_.py:315: SNIMissingWarning: An HTTPS request has been made, but the SNI (Subject Name Indication) extension to TLS is not available on this platform. This may cause the server to present an incorrect TLS certificate, which can cause validation failures. For more information, see https://urllib3.readthedocs.org/en/latest/security.html#snimissingwarning.
  SNIMissingWarning
/usr/local/lib/python2.7/dist-packages/pip/_vendor/requests/packages/urllib3/util/ssl_.py:120: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. For more information, see https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning.
  InsecurePlatformWarning
  Downloading cryptography-1.3.tar.gz (383kB)
    100% |████████████████████████████████| 385kB 1.2MB/s 
Collecting idna>=2.0 (from cryptography)
  Downloading idna-2.0-py2.py3-none-any.whl (61kB)
    100% |████████████████████████████████| 61kB 5.5MB/s 
Collecting pyasn1>=0.1.8 (from cryptography)
  Downloading pyasn1-0.1.9-py2.py3-none-any.whl
Collecting six>=1.4.1 (from cryptography)
  Downloading six-1.10.0-py2.py3-none-any.whl
Collecting setuptools>=11.3 (from cryptography)
  Downloading setuptools-20.3.1-py2.py3-none-any.whl (508kB)
    100% |████████████████████████████████| 512kB 990kB/s 
Collecting enum34 (from cryptography)
  Downloading enum34-1.1.2.tar.gz (46kB)
    100% |████████████████████████████████| 49kB 6.8MB/s 
Collecting ipaddress (from cryptography)
  Downloading ipaddress-1.0.16-py27-none-any.whl
Collecting cffi>=1.4.1 (from cryptography)
  Downloading cffi-1.5.2.tar.gz (388kB)
    100% |████████████████████████████████| 389kB 1.2MB/s 
Collecting pycparser (from cffi>=1.4.1->cryptography)
  Downloading pycparser-2.14.tar.gz (223kB)
    100% |████████████████████████████████| 225kB 2.0MB/s 
Installing collected packages: idna, pyasn1, six, setuptools, enum34, ipaddress, pycparser, cffi, cryptography
  Running setup.py install for enum34 ... - done
  Running setup.py install for pycparser ... - \ done
  Running setup.py install for cffi ... - \ | done
  Running setup.py install for cryptography ... - \ | / - \ done
Successfully installed cffi-1.5.2 cryptography-1.3 enum34-1.1.2 idna-2.0 ipaddress-1.0.16 pyasn1-0.1.9 pycparser-2.14 setuptools-3.4.4 six-1.10.0
/usr/local/lib/python2.7/dist-packages/pip/_vendor/requests/packages/urllib3/util/ssl_.py:120: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. For more information, see https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning.
  InsecurePlatformWarning
You are using pip version 8.0.3, however version 8.1.1 is available.
You should consider upgrading via the 'pip install --upgrade pip' command.
Collecting six
  Using cached six-1.10.0-py2.py3-none-any.whl
Collecting boto3 (from -r requirements.txt (line 1))
/usr/local/lib/python2.7/dist-packages/pip/_vendor/requests/packages/urllib3/util/ssl_.py:315: SNIMissingWarning: An HTTPS request has been made, but the SNI (Subject Name Indication) extension to TLS is not available on this platform. This may cause the server to present an incorrect TLS certificate, which can cause validation failures. For more information, see https://urllib3.readthedocs.org/en/latest/security.html#snimissingwarning.
  SNIMissingWarning
/usr/local/lib/python2.7/dist-packages/pip/_vendor/requests/packages/urllib3/util/ssl_.py:120: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. For more information, see https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning.
  InsecurePlatformWarning
  Downloading boto3-1.3.0-py2.py3-none-any.whl (112kB)
    100% |████████████████████████████████| 114kB 2.1MB/s 
Collecting cryptography==1.2.1 (from -r requirements.txt (line 2))
  Downloading cryptography-1.2.1.tar.gz (372kB)
    100% |████████████████████████████████| 376kB 1.3MB/s 
Collecting futures<4.0.0,>=2.2.0 (from boto3->-r requirements.txt (line 1))
  Downloading futures-3.0.5-py2-none-any.whl
Collecting jmespath<1.0.0,>=0.7.1 (from boto3->-r requirements.txt (line 1))
  Downloading jmespath-0.9.0-py2.py3-none-any.whl
Collecting botocore<1.5.0,>=1.4.1 (from boto3->-r requirements.txt (line 1))
  Downloading botocore-1.4.5-py2.py3-none-any.whl (2.2MB)
    100% |████████████████████████████████| 2.2MB 186kB/s 
Collecting idna>=2.0 (from cryptography==1.2.1->-r requirements.txt (line 2))
  Using cached idna-2.0-py2.py3-none-any.whl
Collecting pyasn1>=0.1.8 (from cryptography==1.2.1->-r requirements.txt (line 2))
  Using cached pyasn1-0.1.9-py2.py3-none-any.whl
Collecting setuptools>=1.0 (from cryptography==1.2.1->-r requirements.txt (line 2))
  Using cached setuptools-20.3.1-py2.py3-none-any.whl
Collecting enum34 (from cryptography==1.2.1->-r requirements.txt (line 2))
  Using cached enum34-1.1.2.tar.gz
Collecting ipaddress (from cryptography==1.2.1->-r requirements.txt (line 2))
  Using cached ipaddress-1.0.16-py27-none-any.whl
Collecting cffi>=1.4.1 (from cryptography==1.2.1->-r requirements.txt (line 2))
  Using cached cffi-1.5.2.tar.gz
Collecting python-dateutil<3.0.0,>=2.1 (from botocore<1.5.0,>=1.4.1->boto3->-r requirements.txt (line 1))
  Downloading python_dateutil-2.5.1-py2.py3-none-any.whl (200kB)
    100% |████████████████████████████████| 204kB 2.2MB/s 
Collecting docutils>=0.10 (from botocore<1.5.0,>=1.4.1->boto3->-r requirements.txt (line 1))
  Downloading docutils-0.12.tar.gz (1.6MB)
    100% |████████████████████████████████| 1.6MB 295kB/s 
Collecting pycparser (from cffi>=1.4.1->cryptography==1.2.1->-r requirements.txt (line 2))
  Using cached pycparser-2.14.tar.gz
Installing collected packages: six, futures, jmespath, python-dateutil, docutils, botocore, boto3, idna, pyasn1, setuptools, enum34, ipaddress, pycparser, cffi, cryptography
  Running setup.py install for docutils ... - \ done
  Running setup.py install for enum34 ... - done
  Running setup.py install for pycparser ... - done
  Running setup.py install for cffi ... - \ done
  Running setup.py install for cryptography ... - \ | / - done
Successfully installed boto3-1.3.0 botocore-1.3.30 cffi-1.5.2 cryptography-1.3 docutils-0.12 enum34-1.1.2 futures-3.0.5 idna-2.0 ipaddress-1.0.16 jmespath-0.9.0 pyasn1-0.1.9 pycparser-2.14 python-dateutil-2.4.2 setuptools-3.4.4 six-1.10.0
You are using pip version 8.0.3, however version 8.1.1 is available.
You should consider upgrading via the 'pip install --upgrade pip' command.
secrets2git: Starting
Traceback (most recent call last):
  File "secrets2git.py", line 148, in <module>
    main()
  File "secrets2git.py", line 136, in main
    fernet = Fernet(fernet_key.encode('ascii'))
  File "/usr/local/lib/python2.7/dist-packages/cryptography/fernet.py", line 32, in __init__
    backend = default_backend()
  File "/usr/local/lib/python2.7/dist-packages/cryptography/hazmat/backends/__init__.py", line 35, in default_backend
    _default_backend = MultiBackend(_available_backends())
  File "/usr/local/lib/python2.7/dist-packages/cryptography/hazmat/backends/__init__.py", line 22, in _available_backends
    "cryptography.backends"

.ci/setup.sh returned exit code 1

AttributeError: 'EntryPoint' object has no attribute 'resolve' 

[crizCraig]

Rolling back to cryptography==1.2.1 fixed the issue.

[reaperhulk]

This is occurring because you have an old setuptools in your environment. Upgrade it and the issue should go away.

[jvehent]

I think you should reopen this. I'm seeing the same issue on El Capitan, with the latest setuptools==1.1.6 and the latest cryptography==1.3.1: https://travis-ci.org/mozilla/sops/jobs/118283251#L195

[reaperhulk]

The latest setuptools is definitely not 1.1.6, but rather 20.3.1. Our minimum version is 11.3 (https://github.com/pyca/cryptography/blob/master/setup.py#L40)

[jvehent]

I'm no python expert, so maybe Python has some concept of versions I don't understand here, but this is what I see.

$ pip install --user setuptools==20.3.1
Collecting setuptools==20.3.1
  Using cached setuptools-20.3.1-py2.py3-none-any.whl
Installing collected packages: setuptools
Successfully installed setuptools-1.1.6

$ pip freeze --all |grep setuptools
setuptools==1.1.6

[reaperhulk]

using the --user flag means it will install into site.USER_BASE (see Python docs for information about where that is) and is not necessarily automatically injected into the PYTHONPATH. You'll have better success just creating a virtualenv and pip install -U setuptools without the --user invocation.

[jvehent]

I should add that, following this pip install --user setuptools==20.3.1, I can reproduce the AttributeError: 'EntryPoint' object has no attribute 'resolve' error with cryptography==1.3.1 but not with 1.2.1.

[reaperhulk]

cc @dstufft on the fact that when installing with --user pip will potentially say it successfully installed a completely different version.

[jvehent]

Thanks for the help! Indeed if I change my python path to $ export PYTHONPATH=$HOME/Library/Python/2.7/lib/python/site-packages/:$PYTHONPATH, it all works fine.

[ransage]

I saw this when I installed on debian from testing using apt-get -t testing install letsencrypt python-letsencrypt-apache (e.g., as described at https://www.rootatwc.com/blog/article/4).

Thanks to the info above (i.e. that this is caused by setuptools), I was able to resolve this with apt-get -t testing install python-setuptools.

[wallrj]

I think it's also related to https://github.com/pypa/pip/issues/988

That issue suggests that pip will only honour the first dependency that it encounters. Which in this case is setuptools from:

• https://github.com/zopefoundation/zope.interface/blob/3e0b584b084815a3601e6efcf77976f19e84c417/setup.py#L98

install_requires = ['setuptools'],

Later, you'll see

Collecting cryptography==1.3.2 (from -r /tmp/workspace/ClusterHQ-flocker/dependencies-FLOC-4408/_run_trial_for_gce_storage_driver_on_CentOS_7_flocker.node.agents.functional/requirements/flocker.txt (line 50))
  Using cached cryptography-1.3.2.tar.gz

And then:

Requirement already satisfied (use --upgrade to upgrade): setuptools in /tmp/venv-richardw-6/lib/python2.7/site-packages (from zope.interface==4.1.3->-r /tmp/workspace/ClusterHQ-flocker/dependencies-FLOC-4408/_run_trial_for_gce_storage_driver_on_CentOS_7_flocker.node.agents.functional/requirements/flocker.txt (line 43))

(venv-richardw-1)[jenkins@jenkins-centos7-slave-1 ~]$ /tmp/29280/bin/python
Python 2.7.5 (default, Nov 20 2015, 02:00:19) 
[GCC 4.8.5 20150623 (Red Hat 4.8.5-4)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> from flocker.provision._ssh import _conch
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/tmp/workspace/ClusterHQ-flocker/dependencies-FLOC-4408/_run_trial_for_gce_storage_driver_on_CentOS_7_flocker.node.agents.functional/flocker/provision/__init__.py", line 8, in <module>
    from ._install import (
  File "/tmp/workspace/ClusterHQ-flocker/dependencies-FLOC-4408/_run_trial_for_gce_storage_driver_on_CentOS_7_flocker.node.agents.functional/flocker/provision/_install.py", line 35, in <module>
    from ._ssh._conch import make_dispatcher
  File "/tmp/workspace/ClusterHQ-flocker/dependencies-FLOC-4408/_run_trial_for_gce_storage_driver_on_CentOS_7_flocker.node.agents.functional/flocker/provision/_ssh/_conch.py", line 17, in <module>
    from twisted.conch.endpoints import (
  File "/tmp/29280/lib/python2.7/site-packages/twisted/conch/endpoints.py", line 27, in <module>
    from twisted.conch.ssh.transport import SSHClientTransport
  File "/tmp/29280/lib/python2.7/site-packages/twisted/conch/ssh/transport.py", line 338, in <module>
    class SSHTransportBase(protocol.Protocol):
  File "/tmp/29280/lib/python2.7/site-packages/twisted/conch/ssh/transport.py", line 462, in SSHTransportBase
    supportedCiphers = _getSupportedCiphers()
  File "/tmp/29280/lib/python2.7/site-packages/twisted/conch/ssh/transport.py", line 328, in _getSupportedCiphers
    backend=default_backend(),
  File "/tmp/29280/lib/python2.7/site-packages/cryptography/hazmat/backends/__init__.py", line 35, in default_backend
    _default_backend = MultiBackend(_available_backends())
  File "/tmp/29280/lib/python2.7/site-packages/cryptography/hazmat/backends/__init__.py", line 22, in _available_backends
    "cryptography.backends"
AttributeError: 'EntryPoint' object has no attribute 'resolve'
>>> 
(venv-richardw-1)[jenkins@jenkins-centos7-slave-1 ~]$ /tmp/29280/bin/pip install --upgrade setuptools
Collecting setuptools
  Downloading setuptools-21.2.1-py2.py3-none-any.whl (509kB)
    100% |████████████████████████████████| 512kB 2.2MB/s 
Installing collected packages: setuptools
  Found existing installation: setuptools 0.9.8
    Uninstalling setuptools-0.9.8:
      Successfully uninstalled setuptools-0.9.8
Successfully installed setuptools-21.2.1
(venv-richardw-1)[jenkins@jenkins-centos7-slave-1 ~]$ /tmp/29280/bin/python
Python 2.7.5 (default, Nov 20 2015, 02:00:19) 

[dreench]

Solution for freebsd.
Update all python modules:
pip freeze --local | grep -v '^-e' | cut -d = -f 1 | xargs -n1 pip install -U

after update - "certbot certonly --webroot ..." work fine.

[mailming]

cryptography==1.2.3 will also works,

This issue happens in El Capitan.

[sargue]

I am experiencing this problem in Debian 8. Tried to install python-setuptools from testing as suggested in the Debian bug report but same result.

This is what I get:

$ sudo certbot renew
-------------------------------------------------------------------------------
Processing /etc/letsencrypt/renewal/vader.sargue.net.conf
-------------------------------------------------------------------------------
2016-09-23 09:54:57,923:WARNING:certbot.renewal:Attempting to renew cert from /etc/letsencrypt/renewal/vader.sargue.net.conf produced an unexpected error: 'EntryPoint' object has no attribute 'resolve'. Skipping.

All renewal attempts failed. The following certs could not be renewed:
  /etc/letsencrypt/live/vader.sargue.net/fullchain.pem (failure)
1 renew failure(s), 0 parse failure(s)

Package versions:

ii  certbot                     0.8.1-2~bpo8+1     all                automatically configure HTTPS using Let's Encrypt
ii  python-certbot-apache       0.8.1-1~bpo8+1     all                Apache plugin for Certbot
ii  python-setuptools           27.1.2-1           all                Python Distutils Enhancements

[naveensinghal]

@sargue See if this link can help: https://github.com/pyca/cryptography/issues/3149

[sargue]

@naveensinghal Thanks for the link. It doesn't seem to be the same case. I think I don't haveany virtualenv. I don't even have pip installed. I've tried the command to list all resources but everything points to standard Debian locations (/usr, lib...)

[dstufft]

How did you install cryptography?

[sargue]

Ops, just saw I've commented on this issue but I wanted to do it on the certbot project. Sorry about that.

BTW, @dstufft, I didn't install cryptography per se. I just installed certbot which pulled the relevant python packages.

[dstufft]

How did you do that?

[sargue]

I first followed the official instructions:

$ sudo apt-get install python-certbot-apache -t jessie-backports

It worked for a time. Eventually (some upgrade in between I guess) it started to complain. The certbot renew is executed from cron and it only tries to renew certificates near expiration.

When I got the error I did some research and I saw the suggestion to upgrade python-setuptools. I managed to update it to testing but the error remains.

[dstufft]

@sargue what version of python-pkg-resources is installed?

[sargue]

27.1.2-1

BTW, I found a workaround. You were right about the virtual env. I installed, some time ago, the letsencrypt-wrapper which creates a virtual environtment. More details at certbot#3140.