Skip to content

chore: remove unused code in command.py as upgraded to pyOpenSSL 26.0.0#1917

Merged
sameer-google merged 1 commit into
GoogleCloudPlatform:masterfrom
gurusai-voleti:cmd_updates
Apr 23, 2026
Merged

chore: remove unused code in command.py as upgraded to pyOpenSSL 26.0.0#1917
sameer-google merged 1 commit into
GoogleCloudPlatform:masterfrom
gurusai-voleti:cmd_updates

Conversation

@gurusai-voleti
Copy link
Copy Markdown
Contributor

@gurusai-voleti gurusai-voleti commented Apr 23, 2026

The original code in gslib/command.py was wrapped in a try...except ImportError: block. Because we removed pycrypto from the dependencies, if gsutil ran that code today, it would simply fail to find the library, catch the ImportError gracefully, and move on. It wouldn't crash the application.

Even though it is "dead code" now, leaving from Crypto import Random in gslib/command.py is a huge risk for security scanners. If a scanner sees from Crypto ..., it will flag gsutil for using pycrypto (CVE-2018-6594), causing false positives and blocking customer deployments.

By physically deleting the _CryptoRandomAtFork function and its imports, we guarantee a clean audit and completely sever gsutil's ties to the deprecated library. Furthermore, modern cryptographic libraries (like cryptography) handle process forking natively and securely, so the workaround is completely obsolete anyway.

@sameer-google
Copy link
Copy Markdown
Collaborator

can you update the description with the following:

The original code in gslib/command.py was wrapped in a try...except ImportError: block. Because we removed pycrypto from the dependencies, if gsutil ran that code today, it would simply fail to find the library, catch the ImportError gracefully, and move on. It wouldn't crash the application.

Even though it is "dead code" now, leaving from Crypto import Random in gslib/command.py is a huge risk for security scanners. If a scanner sees from Crypto ..., it will flag gsutil for using pycrypto (CVE-2018-6594), causing false positives and blocking customer deployments.

By physically deleting the _CryptoRandomAtFork function and its imports, we guarantee a clean audit and completely sever gsutil's ties to the deprecated library. Furthermore, modern cryptographic libraries (like cryptography) handle process forking natively and securely, so the workaround is completely obsolete anyway.

@sameer-google
Copy link
Copy Markdown
Collaborator

I see all necessary tests are green, can you perform manual sign url testing logs for this change too and close this

@gurusai-voleti
Copy link
Copy Markdown
Contributor Author

I see all necessary tests are green, can you perform manual sign url testing logs for this change too and close this

all automation and manual test cases are green

@sameer-google sameer-google merged commit d5617bf into GoogleCloudPlatform:master Apr 23, 2026
40 of 47 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants