gongomgra commented on issue #51833:
URL: https://github.com/apache/airflow/issues/51833#issuecomment-2981202494
Hi @potiuk
Thanks for your response. I'm facing this error with your official images.
This is the information I have been able to collect regarding the OS and the
OpenSSL version
```
$ k -n airflow describe po airflow-api-server-6449f95df8-hnj8b | grep -i
image | head -n 2
Image: apache/airflow:3.0.2
Image ID:
docker-pullable://apache/airflow@sha256:27665dff7bc6c0d7584e64427467e997a6644260b99efe3e807078d1620b37ff
$ k -n airflow exec -it airflow-api-server-6449f95df8-hnj8b -- bash
airflow@airflow-api-server-6449f95df8-hnj8b:/opt/airflow$ dpkg -l openssl
Desired=Unknown/Install/Remove/Purge/Hold
|
Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-==============-================-============-====================================================
ii openssl 3.0.16-1~deb12u1 arm64 Secure Sockets Layer
toolkit - cryptographic utility
airflow@airflow-api-server-6449f95df8-hnj8b:/opt/airflow$ cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
NAME="Debian GNU/Linux"
VERSION_ID="12"
VERSION="12 (bookworm)"
VERSION_CODENAME=bookworm
ID=debian
HOME_URL="https://www.debian.org/";
SUPPORT_URL="https://www.debian.org/support";
BUG_REPORT_URL="https://bugs.debian.org/";
```
I have been able to reproduce the error message from within the Python
console directly. It seems there is an incompatibility between the OpenSSL
version and the Werkzeug module. It works for the `pbkdf2` method (which seems
to be the default method for Werkzeug 2.2.3 according to [their GitHub
repo](https://github.com/pallets/werkzeug/blob/2.2.3/src/werkzeug/security.py#L60)),
but not for `scrypt`:
```
airflow@airflow-api-server-6449f95df8-hnj8b:/tmp$ pip list | grep -i werk
Werkzeug 2.2.3
airflow@airflow-api-server-6449f95df8-hnj8b:/tmp$ python
>>> import werkzeug.security
>>> werkzeug.security.generate_password_hash('test1234')
'pbkdf2:sha256:260000$pn0MkVydoxkqpo7W$56daa9162e8b881e52be6467ff8dd819e46371c1ecaad0838cbbdefc53448a9b'
>>> werkzeug.security.generate_password_hash(password='test1234',
method='scrypt')
Traceback (most recent call last):
File "/usr/local/lib/python3.12/hmac.py", line 60, in __init__
self._init_hmac(key, msg, digestmod)
File "/usr/local/lib/python3.12/hmac.py", line 67, in _init_hmac
self._hmac = _hashopenssl.hmac_new(key, msg, digestmod=digestmod)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
_hashlib.UnsupportedDigestmodError: [digital envelope routines] unsupported
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "/usr/local/lib/python3.12/hashlib.py", line 160, in __hash_new
return _hashlib.new(name, data, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
_hashlib.UnsupportedDigestmodError: [digital envelope routines] unsupported
During handling of the above exception, another exception occurred:
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File
"/home/airflow/.local/lib/python3.12/site-packages/werkzeug/security.py", line
88, in generate_password_hash
h, actual_method = _hash_internal(method, salt, password)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File
"/home/airflow/.local/lib/python3.12/site-packages/werkzeug/security.py", line
55, in _hash_internal
return hmac.new(salt, password, method).hexdigest(), method
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/hmac.py", line 184, in new
return HMAC(key, msg, digestmod)
^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/hmac.py", line 62, in __init__
self._init_old(key, msg, digestmod)
File "/usr/local/lib/python3.12/hmac.py", line 80, in _init_old
self._outer = digest_cons()
^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/hmac.py", line 75, in <lambda>
digest_cons = lambda d=b'': _hashlib.new(digestmod, d)
^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/hashlib.py", line 166, in __hash_new
return __get_builtin_constructor(name)(data)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.12/hashlib.py", line 123, in
__get_builtin_constructor
raise ValueError('unsupported hash type ' + name)
ValueError: unsupported hash type scrypt
```
I have also given a try to the next available version for Werkzeug
(`2.3.0`), and the `scrypt` hashing method works, but it looks like Airflow
does not work with it (I get an infinite redirect after login into the web UI).
I'm aware that using a newer Werkzeug version does break the defined
constraints, but I've simply updated it for testing purposes:
```
airflow@airflow-api-server-6449f95df8-hnj8b:/tmp$ pip install Werkzeug==2.3.0
Collecting Werkzeug==2.3.0
Downloading Werkzeug-2.3.0-py3-none-any.whl.metadata (4.2 kB)
Requirement already satisfied: MarkupSafe>=2.1.1 in
/home/airflow/.local/lib/python3.12/site-packages (from Werkzeug==2.3.0) (3.0.2)
Downloading Werkzeug-2.3.0-py3-none-any.whl (233 kB)
Installing collected packages: Werkzeug
Attempting uninstall: Werkzeug
Found existing installation: Werkzeug 2.2.3
Uninstalling Werkzeug-2.2.3:
Successfully uninstalled Werkzeug-2.2.3
ERROR: pip's dependency resolver does not currently take into account all
the packages that are installed. This behaviour is the source of the following
dependency conflicts.
connexion 2.14.2 requires werkzeug<2.3,>=1.0, but you have werkzeug 2.3.0
which is incompatible.
Successfully installed Werkzeug-2.3.0
airflow@airflow-api-server-6449f95df8-hnj8b:/tmp$ python
Python 3.12.11 (main, Jun 4 2025, 18:32:16) [GCC 12.2.0] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> import werkzeug.security
>>> werkzeug.security.generate_password_hash('test1234')
'pbkdf2:sha256:600000$3q7rvemNBaqHFEeM$46cddab9295b0979f1b138737943b384d89edbfeeb2bf6c9be284d261918afc1'
>>> werkzeug.security.generate_password_hash(password='test1234',
method='scrypt')
'scrypt:32768:8:1$nLlZs8E3ZuYUC9ay$ae903848f37a1cd251fefa57bd1eb2ff71e9171e34d761b5de47bf857173cc836ce12d6efc16b1da741cec3e08e86d26edfc72f60f755b3dcaf1120a973134e3'
```
Can you please take a look at this? Thanks in advance
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
