fix: add missing dashboard Python deps + fix crypto NameError

Add python3-jmespath and python3-xmltodict to snap stage-packages —
required by ceph-mgr-dashboard for OAuth2 SSO role mapping and RGW
client respectively.

Fix 0004 patch to properly remove the dead crypto.load_privatekey block
in verify_tls_files() that crashes the dashboard with NameError after
the Tentacle cryptotools refactor. The subsequent verify_tls() call
already validates cert+key via get_crypto_caller() (ProcessCryptoCaller).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: jamesbeedy

patches/0004-fix-dashboard-crypto-nameerror.patch

@@ -1,29 +1,38 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
-From: Local Builder <local@example.com>
-Date: Fri, 29 May 2026 00:00:00 +0000
-Subject: [PATCH] mgr/dashboard: import OpenSSL crypto in verify_tls_files
-
-Fix the dashboard TLS validation path in Ceph 20.2.0 packaging where
-verify_tls_files references crypto without importing it at function scope,
-which crashes the mgr dashboard module with:
-
-  NameError: name 'crypto' is not defined
+From: James Beedy <james@vantagecompute.ai>
+Date: Fri, 30 May 2026 00:00:00 +0000
+Subject: [PATCH] mgr: fix NameError in verify_tls_files after cryptotools
+ refactor
 
+Fix by removing the standalone private-key validation block that used
+OpenSSL.crypto directly. The subsequent verify_tls() call already
+validates both cert and key via get_crypto_caller().
 ---
- share/ceph/mgr/mgr_util.py | 1 +
- 1 file changed, 1 insertion(+)
+ share/ceph/mgr/mgr_util.py | 10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
 
-diff --git a/share/ceph/mgr/mgr_util.py b/share/ceph/mgr/mgr_util.py
-index abcdef1..1234567 100644
---- a/share/ceph/mgr/mgr_util.py
-+++ b/share/ceph/mgr/mgr_util.py
-@@-1,6 +1,7 @@
-     if not os.path.isfile(pkey_fname):
+--- a/share/ceph/mgr/mgr_util.py	2026-05-30 01:12:33.198837423 +0000
++++ b/share/ceph/mgr/mgr_util.py	2026-05-30 01:12:33.201837419 +0000
+@@ -709,18 +709,10 @@
+     elif not os.path.isfile(pkey_fname):
          raise ServerConfigException('private key %s does not exist' % pkey_fname)
-
-+    from OpenSSL import crypto, SSL
+ 
+-
+-    try:
+-        with open(pkey_fname) as f:
+-            pkey = crypto.load_privatekey(crypto.FILETYPE_PEM, f.read())
+-            pkey.check()
+-    except (ValueError, crypto.Error) as e:
+-        raise ServerConfigException(
+-            'Invalid private key {}: {}'.format(pkey_fname, str(e)))
      try:
-         with open(pkey_fname) as f:
-             pkey = crypto.load_privatekey(crypto.FILETYPE_PEM, f.read())
+         with open(pkey_fname) as key_file, open(cert_fname) as cert_file:
+             verify_tls(cert_file.read(), key_file.read())
+-    except (ServerConfigException) as e:
++    except ServerConfigException as e:
+         raise ServerConfigException(str(e))
+ 
+ 
+
 -- 
 2.43.0

snap/snapcraft.yaml

@@ -287,6 +287,8 @@ parts:
       - libatomic1
       - python3-ceph-common # used by microceph-orch
       - python3-openssl # used by ceph-mgr-dashboard for SSL
+      - python3-jmespath # used by dashboard OAuth2 SSO role mapping
+      - python3-xmltodict # used by dashboard RGW client
 
     organize:
       sbin/: bin/