I’m using cryptography in a project that is targeting both EL8 and EL9 (we’re using Rocky Linux 8/9). We’re using python3.9 in both cases. The problem/doubt I’m having is that OpenSSL v3 is not available on EL8 (unless built from sources which is not something we’re doing), yet when I install cryptography v42, it reports that it is running against OpenSSL v3:

$ docker run -it --rm rockylinux:8 /bin/bash
$ openssl version
OpenSSL 1.1.1k  FIPS 25 Mar 2021
$ yum install -y python39 python39-pip
$ pip3 install cryptography
$ python3
>>> import cryptography.hazmat.backends.openssl
>>> cryptography.hazmat.backends.openssl.backend.openssl_version_text()
'OpenSSL 3.2.1 30 Jan 2024'

My initial interpretation of what is going on here was that pip is installing a wheel that has been built against OpenSSL v3 headers which is the version that openssl_version_text() is reporting, yet the documentation for the openssl_version_text() clearly states that it is the run-time version of the OpenSSL:

This is not necessarily the same version as it was compiled against.

I’ve browsed both the Pypi wheel and the installed package (pip3 show cryptography -> ls -la /usr/local/lib64/python3.9/site-packages) but only saw a bunch of .pyc files and none of the binaries/dynamic libraries.

I’m not familiar with the nuances of the pyca/cryptography build process and with how Python wheels work. Does anyone know what is actually happening here and can explain it?