bug: Oscrypto related error on recent OS

[AlexandreEXFO]

There is an issue with a transitive dependency (oscrypto) of signify that does not work well on recent OS like Ubuntu 24.04 [OpenSSL 3.0.13 30 Jan 2024 (Library: OpenSSL 3.0.13 30 Jan 2024)] and Alpine 3.22. The library is not detected well and even creating a symbolic link to help it find the library results in a library detection problem: oscrypto.errors.LibraryNotFoundError: Error detecting the version of libcrypto

[ralphje]

As you have correctly identified, this is an issue with a dependency of a dependency. The issue was already identified in wbond/oscrypto#78 and fixed in the git repository, but not released to PyPI.

Given that the project owner appears unresponsive as of yet to requests of releasing the fix to PyPI, in the long run, we may need to figure out some kind of resolution beyond simply waiting for a fix to be released.
However, some of our direct dependencies, such as asn1crypto and certvalidator are created by the same author, so this may have a much wider impact on this entire Signify project.

For now, adding oscrypto through a GitHub link as an additional project requirement in your project may fix the issue on a per-project basis. Since Signify is commonly used in malware analysis, and that is quite often done in internet-disconnected environments, I'm not sure whether the best approach would be doing that for Signify itself.