Remove use of deprecated verifier with cryptography (#9105)

This was deprecated in version 2.1 and cryptography will be
removing it soon. The replacement function is available in all
versions of cryptography that certbot supports (2.1+)
This commit is contained in:
Paul Kehrer
2021-11-23 10:18:22 -08:00
committed by GitHub
parent 6766786049
commit 267fb94478
+4 -11
View File
@@ -363,7 +363,6 @@ def verify_renewable_cert_sig(renewable_cert: interfaces.RenewableCert) -> None:
with open(renewable_cert.cert_path, 'rb') as cert_file:
cert = x509.load_pem_x509_certificate(cert_file.read(), default_backend())
pk = chain.public_key()
with warnings.catch_warnings():
verify_signed_payload(pk, cert.signature, cert.tbs_certificate_bytes,
cert.signature_hash_algorithm)
except (IOError, ValueError, InvalidSignature) as e:
@@ -387,20 +386,14 @@ def verify_signed_payload(public_key: Union[DSAPublicKey, 'Ed25519PublicKey', 'E
:raises InvalidSignature: If signature verification fails.
:raises errors.Error: If public key type is not supported
"""
with warnings.catch_warnings():
warnings.simplefilter("ignore")
if isinstance(public_key, RSAPublicKey):
verifier = public_key.verifier(
signature, PKCS1v15(), signature_hash_algorithm
public_key.verify(
signature, payload, PKCS1v15(), signature_hash_algorithm
)
verifier.update(payload)
verifier.verify()
elif isinstance(public_key, EllipticCurvePublicKey):
verifier = public_key.verifier(
signature, ECDSA(signature_hash_algorithm)
public_key.verify(
signature, payload, ECDSA(signature_hash_algorithm)
)
verifier.update(payload)
verifier.verify()
else:
raise errors.Error("Unsupported public key type.")