Bug: Current PyPI release (0.18.0) fails at runtime due to outdated SSL dependency chain

[AshishJii]

Summary

The current published release (0.18.0) installs successfully but fails immediately at runtime in modern Python environments due to incompatibilities in the certbot/acme/pyOpenSSL dependency chain.

The develop branch appears to already contain a fix for this issue, but no updated release has been published yet.

As a result, new users following the standard installation instructions are currently unable to use frappe-manager.

---

Environment

• OS: Tested on Fedora 44, MacOS 26

• Installation method:

  uv tool install --python 3.13 frappe-manager

---

Current behavior

Installation succeeds, but running fm crashes with:

AttributeError: module 'OpenSSL.crypto' has no attribute 'X509Extension'

Full traceback:

Traceback (most recent call last):
  ...
  File ".../acme/crypto_util.py", line 504, in <module>
    extensions: Optional[List[crypto.X509Extension]] = None,
                              ^^^^^^^^^^^^^^^^^^^^
  File ".../cryptography/utils.py", line 76, in __getattr__
    obj = getattr(self._module, name)
AttributeError: module 'OpenSSL.crypto' has no attribute 'X509Extension'

---

Cause

0.18.0 still depends on:

• certbot
• acme
• pyOpenSSL

The dependency chain is no longer compatible with current pyOpenSSL/cryptography versions because deprecated OpenSSL APIs such as OpenSSL.crypto.X509Extension were removed.

---

Observation

The develop branch appears to have already removed this dependency chain and migrated to direct cryptography usage.

The issue only affects the currently published release artifact.

---

Impact

The README currently recommends:

uv tool install --python 3.13 frappe-manager

However, the latest published release is not runnable in a modern environment after installation.

This may confuse new users because:

• installation succeeds
• runtime fails immediately

---

Suggested resolution

One of the following would help:

1. Publish a new PyPI release containing the dependency/SSL refactor already present in develop
2. Temporarily document that users should install from develop

[lukastom]

This is a critical error. Without a fix in a stable release, I am afraid that Frappe Manager is not usable on production as such. I would not use "develop" on prod.

This fixed it for me (libraries downgrade):

    uv pip install --python ~/.local/share/uv/tools/frappe-manager/bin/python \
    "pyOpenSSL==25.3.0" \
    "cryptography==46.0.3"

[asieftejani]

Thanks for this guys - we were struggling at https://discuss.frappe.io/t/python-3-14-error-in-erpnext-v16-installation-with-frappe-manager-on-docker-wsl/163036/7

Is it possible we help the maintainer instead of just raising issues... I am still a beginner in python otherwise I would have tried to do something myself
Whoever can to his capacity raise a PR as I only see issues and no PR
Not complaining - just suggesting as this is an amazing tool that has helped me out a lot and the maintainer seems to be super busy

[asieftejani]

"pyOpenSSL==25.3.0" \ "cryptography==46.0.3"

Also just for my learning if someone can help me understand .. I can see "cryptography>=46.0.0,<47.0.0" in pyproject.toml of fm but I cant see pyOpenSSL
Any easy way to trace which dependency needed it and installed it?

[asieftejani]

Got it - in case it can help other people: -

1. head -1 $(which fm)
2. pipdeptree --python /home//.local/share/pipx/venvs/frappe-manager/bin/python

Lots and lots of dependencies (hell) and sub-dependencies - its crazy