Debian 10 buster bcrypt pip install breakage

So, as of today by Shaken Fist CI jobs for Debian 10 are failing to install bcrypt, with an error that looks like this:

Running install for bcrypt: started
    Running install for bcrypt: finished with status 'error'
    [ ... snip ... ]
    running build_rust
        =============================DEBUG ASSISTANCE=============================
        If you are seeing a compilation error please try the following steps to
        successfully install bcrypt:
        1) Upgrade to the latest pip and try again. This will fix errors for most
           users. See:
        2) Ensure you have a recent Rust toolchain installed. bcrypt requires
           rustc >= 1.56.0.
        Python: 3.7.3
        platform: Linux-4.19.0-21-amd64-x86_64-with-debian-10.12
        pip: 18.1
        setuptools: 65.2.0
        setuptools_rust: 1.5.1
        rustc: n/a
        =============================DEBUG ASSISTANCE=============================

I’m not really interested in debating why installing a python package requires a rust compiler, that has been dicussed elsewhere.

This specific breakage has been caused by bcrypt releasing 4.0.0, which has this in the changelog: “bcrypt is now implemented in Rust. Users building from source will need to have a Rust compiler available. Nothing will change for users downloading wheels.”

Unfortunately, you can’t just install rustc with apt, as it is both quite big (350mb), and too old (version 1.41.1 versus the required 1.56.0 or better). I also couldn’t find an Ubuntu PPA to misuse to get a more recent rustc.

Another answer here is to use rustup, which is yet another curl to a root shell installer, which isn’t a satisfying answer to me. The other option is of course just to pin bcrypt to pre 4.0.0, but I’d have to do that on every distribution, not just Debian 10 as best as I can tell.

Update: and then I re-read the ChangeLog. It turns out that pip wasn’t offering me wheels because the version of pip was too old. As long as you’re ok with not using an official Debian packaged version of pip, you can do this to get unstuck:

# pip3 install -U pip
# apt-get remove python3-pip
# /usr/local/bin/pip3 install -v bcrypt==4.0.0

3 thoughts on “Debian 10 buster bcrypt pip install breakage”

  1. Thanks for the tip here Mikal.

    I’m trying to get bcrypt 4.0.1 installed on Raspbian Bullseye but even after your upgrade/remove steps suggested above I’m still getting the “This package requires Rust >=1.56.0.” error.

    If I ‘which pip3’ I get ‘/usr/local/bin/pip3’ – and my install line is specifying same:
    sudo /usr/local/bin/pip3 install -v bcrypt==4.0.1

    … but when the install starts, this first line looks like it’s not honouring my version of pip3:

    Using pip 23.0 from /usr/local/lib/python3.9/dist-packages/pip (python 3.9)
    Looking in indexes:,
    Collecting bcrypt==4.0.1

    Any ideas what might be going on here?




  2. Do you have more than one pip installed perhaps? Debian (the base for Raspbian) will let you install more than one version of python3 if I recall correctly, and gives them names like “pip3.9”. I wonder if that’s what is happening to you?

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.