From 4159c73db22130c89bbe09e1dff3d9fac581318d Mon Sep 17 00:00:00 2001
From: Rick Elrod <rick@elrod.me>
Date: Mon, 26 Oct 2020 13:44:16 -0500
Subject: [PATCH] [ansible-test] Limit cryptography to <3.2 (#72342) (#72345)

Change:
- Cryptography 3.2 drops support for OpenSSL 1.0.2. Some of our CI
  infrastructure still uses this version (FreeBSD, namely). For now,
  just add a constraint to use old cryptography.

Test Plan:
- CI

Signed-off-by: Rick Elrod <rick@elrod.me>
---
 .../ansible-test-constraints-cryptography-old-openssl.yml       | 2 ++
 test/lib/ansible_test/_data/requirements/constraints.txt        | 1 +
 2 files changed, 3 insertions(+)
 create mode 100644 changelogs/fragments/ansible-test-constraints-cryptography-old-openssl.yml

diff --git a/changelogs/fragments/ansible-test-constraints-cryptography-old-openssl.yml b/changelogs/fragments/ansible-test-constraints-cryptography-old-openssl.yml
new file mode 100644
index 00000000000..2349f35444b
--- /dev/null
+++ b/changelogs/fragments/ansible-test-constraints-cryptography-old-openssl.yml
@@ -0,0 +1,2 @@
+minor_changes:
+  - ansible-test - python-cryptography is now bounded at <3.2, as 3.2 drops support for OpenSSL 1.0.2 upon which some of our CI infrastructure still depends.
diff --git a/test/lib/ansible_test/_data/requirements/constraints.txt b/test/lib/ansible_test/_data/requirements/constraints.txt
index 33daaadead2..48d5636e8d3 100644
--- a/test/lib/ansible_test/_data/requirements/constraints.txt
+++ b/test/lib/ansible_test/_data/requirements/constraints.txt
@@ -2,6 +2,7 @@ coverage >= 4.5.1, < 5.0.0 ; python_version <  '3.7' # coverage 4.4 required for
 coverage >= 4.5.2, < 5.0.0 ; python_version == '3.7' # coverage 4.5.2 fixes bugs in support for python 3.7, coverage 5.0+ incompatible
 coverage >= 4.5.4, < 5.0.0 ; python_version >  '3.7' # coverage had a bug in < 4.5.4 that would cause unit tests to hang in Python 3.8, coverage 5.0+ incompatible
 cryptography < 2.2 ; python_version < '2.7' # cryptography 2.2 drops support for python 2.6
+cryptography < 3.2 ; python_version >= '2.7'  # cryptography 3.2 drops support for OpenSSL 1.0.2 which some of our CI hosts (FreeBSD) still use
 deepdiff < 4.0.0 ; python_version < '3' # deepdiff 4.0.0 and later require python 3
 jinja2 < 2.11 ; python_version < '2.7' # jinja2 2.11 and later require python 2.7 or later
 urllib3 < 1.24 ; python_version < '2.7' # urllib3 1.24 and later require python 2.7 or later