{"action":"created","issue":{"url":"https://api.github.com/repos/pyca/cryptography/issues/2299","labels_url":"https://api.github.com/repos/pyca/cryptography/issues/2299/labels{/name}","comments_url":"https://api.github.com/repos/pyca/cryptography/issues/2299/comments","events_url":"https://api.github.com/repos/pyca/cryptography/issues/2299/events","html_url":"https://github.com/pyca/cryptography/issues/2299","id":103565682,"number":2299,"title":"Regression: Cannot use cyrptography in embedded wsgi","user":{"login":"Naddiseo","id":115951,"avatar_url":"https://avatars.githubusercontent.com/u/115951?v=3","gravatar_id":"","url":"https://api.github.com/users/Naddiseo","html_url":"https://github.com/Naddiseo","followers_url":"https://api.github.com/users/Naddiseo/followers","following_url":"https://api.github.com/users/Naddiseo/following{/other_user}","gists_url":"https://api.github.com/users/Naddiseo/gists{/gist_id}","starred_url":"https://api.github.com/users/Naddiseo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Naddiseo/subscriptions","organizations_url":"https://api.github.com/users/Naddiseo/orgs","repos_url":"https://api.github.com/users/Naddiseo/repos","events_url":"https://api.github.com/users/Naddiseo/events{/privacy}","received_events_url":"https://api.github.com/users/Naddiseo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":15,"created_at":"2015-08-27T18:17:28Z","updated_at":"2015-09-08T15:07:01Z","closed_at":null,"body":"We have discovered at $work that the 1.0 cryptography release does not work with apache2+mod_wsgi. The error log spits out \"Truncated or oversized response headers received from daemon process\", which seems to happen if the wsgi process dies. We've tracked the issue down to an upgrade with cryptography, and something to do with threading and/or the Python GIL (a work around is in the wsgi config to set [WSGIApplicationGroup](https://code.google.com/p/modwsgi/wiki/ConfigurationDirectives#WSGIApplicationGroup) to `%{GLOBAL}`). \r\n\r\nI did a git bisect from 0.9.3 and 1.0, and found that the issue was introduced in commit b3d37a5d485bcd295d1933d638180e9cd5d23478.\r\n"},"comment":{"url":"https://api.github.com/repos/pyca/cryptography/issues/comments/138594843","html_url":"https://github.com/pyca/cryptography/issues/2299#issuecomment-138594843","issue_url":"https://api.github.com/repos/pyca/cryptography/issues/2299","id":138594843,"user":{"login":"alex","id":772,"avatar_url":"https://avatars.githubusercontent.com/u/772?v=3","gravatar_id":"","url":"https://api.github.com/users/alex","html_url":"https://github.com/alex","followers_url":"https://api.github.com/users/alex/followers","following_url":"https://api.github.com/users/alex/following{/other_user}","gists_url":"https://api.github.com/users/alex/gists{/gist_id}","starred_url":"https://api.github.com/users/alex/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alex/subscriptions","organizations_url":"https://api.github.com/users/alex/orgs","repos_url":"https://api.github.com/users/alex/repos","events_url":"https://api.github.com/users/alex/events{/privacy}","received_events_url":"https://api.github.com/users/alex/received_events","type":"User","site_admin":false},"created_at":"2015-09-08T15:07:01Z","updated_at":"2015-09-08T15:07:01Z","body":"FWIW, I'm strictly opposed to moving this code back itno C.\n\nOn Tue, Sep 8, 2015 at 11:05 AM, Paul Kehrer <notifications@github.com>\nwrote:\n\n> Okay, reviving this conversation. Proposal for the sake of discussion: To\n> avoid issues with sub-interpreters we should do the following:\n>\n>    - Move os random engine back to C\n>    - Make os random engine registration idempotent (we can hold a lock at\n>    the C layer which will prevent races with the sub-interpreters)\n>    - Move the locking callbacks to C (since they are presumably subject\n>    to the same issues)\n>    - Make locking callback registration idempotent (this part might be\n>    tricky if we want to detect locking callbacks already being registered by\n>    things like import _ssl)\n>\n> Do people agree that this would resolve the issue? If not, why not? And if\n> so, is there a way to do this without doing it all in C because obviously\n> we'd prefer to not do that...\n>\n> —\n> Reply to this email directly or view it on GitHub\n> <https://github.com/pyca/cryptography/issues/2299#issuecomment-138594505>.\n>\n\n\n\n-- \n\"I disapprove of what you say, but I will defend to the death your right to\nsay it.\" -- Evelyn Beatrice Hall (summarizing Voltaire)\n\"The people's good is the highest law.\" -- Cicero\nGPG Key fingerprint: 125F 5C67 DFE9 4084\n"}}