starred/certbot-certbot-2
1
0
Fork 0
mirror of https://github.com/certbot/certbot.git synced 2026-07-28 00:24:35 +02:00
Code Issues Packages Projects Releases Wiki Activity

update ocsp api (#10181)

Browse Source 
this does the simple and more urgent fix described in
https://github.com/certbot/certbot/issues/10053. i created
https://github.com/certbot/certbot/issues/10180 to track fixing up our
tests to generally help prevent this kind of problem in the future
This commit is contained in:
Brad Warren
2025-02-05 14:08:14 -08:00
committed by GitHub
parent 2535a7bb29
commit 87e5dcbc83
7 changed files with 25 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files
acme/setup.py
+1 -1
View File
@@ -6,7 +6,7 @@ from setuptools import setup
version = '3.2.0.dev0'
install_requires = [
'cryptography>=42.0.0',
'cryptography>=43.0.0',
# Josepy 2+ may introduce backward incompatible changes by droping usage of
# deprecated PyOpenSSL APIs.
'josepy>=1.13.0, <2',
certbot/CHANGELOG.md
+1 -1
View File
@@ -11,7 +11,7 @@ Certbot adheres to [Semantic Versioning](https://semver.org/).
### Changed
* certbot-nginx now requires pyparsing>=2.4.7.
* certbot and its acme library now require cryptography>=42.0.0.
* certbot and its acme library now require cryptography>=43.0.0.
* certbot-nginx and our acme library now require pyOpenSSL>=25.0.0.
* Deprecated `gen_ss_cert` in `acme.crypto_util` as it uses deprecated
pyOpenSSL API.
certbot/certbot/_internal/tests/ocsp_test.py
+2 -23
View File
@@ -6,14 +6,12 @@ from datetime import timedelta
import sys
import unittest
from unittest import mock
import warnings
from cryptography import x509
from cryptography.exceptions import InvalidSignature
from cryptography.exceptions import UnsupportedAlgorithm
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import hashes
from cryptography.utils import CryptographyDeprecationWarning
from cryptography.x509 import ocsp as ocsp_lib
import pytest
import pytz
@@ -286,25 +284,6 @@ class OSCPTestCryptography(unittest.TestCase):
revoked = self.checker.ocsp_revoked(self.cert_obj)
assert revoked is False
def test_this_update_warning(self):
with _ocsp_mock(ocsp_lib.OCSPCertStatus.GOOD,
ocsp_lib.OCSPResponseStatus.SUCCESSFUL) as mocks:
value = mocks['mock_response'].return_value.this_update
def warn_first():
msg = ('Properties that return a naïve datetime object have been deprecated. Please '
'switch to this_update_utc.')
warnings.warn(msg, CryptographyDeprecationWarning)
return value
property_mock = mock.PropertyMock(side_effect=warn_first)
# Using type() in this way is recommended in mock's documentation at
# https://docs.python.org/3/library/unittest.mock.html#unittest.mock.PropertyMock
type(mocks['mock_response'].return_value).this_update = property_mock
revoked = self.checker.ocsp_revoked(self.cert_obj)
assert revoked is False
@contextlib.contextmanager
def _ocsp_mock(certificate_status, response_status,
@@ -345,8 +324,8 @@ def _construct_mock_ocsp_response(certificate_status, response_status):
responder_name=responder.subject,
certificates=[responder],
hash_algorithm=hashes.SHA1(),
next_update=datetime.now(pytz.UTC).replace(tzinfo=None) + timedelta(days=1),
this_update=datetime.now(pytz.UTC).replace(tzinfo=None) - timedelta(days=1),
next_update_utc=datetime.now(pytz.UTC) + timedelta(days=1),
this_update_utc=datetime.now(pytz.UTC) - timedelta(days=1),
signature_algorithm_oid=x509.oid.SignatureAlgorithmOID.RSA_WITH_SHA1,
)
certbot/certbot/ocsp.py
+7 -13
View File
@@ -7,7 +7,6 @@ import subprocess
from subprocess import PIPE
from typing import Optional
from typing import Tuple
import warnings
from cryptography import x509
from cryptography.exceptions import InvalidSignature
@@ -235,18 +234,13 @@ def _check_ocsp_response(response_ocsp: 'ocsp.OCSPResponse', request_ocsp: 'ocsp
# See OpenSSL implementation as a reference:
# https://github.com/openssl/openssl/blob/ef45aa14c5af024fcb8bef1c9007f3d1c115bd85/crypto/ocsp/ocsp_cl.c#L338-L391
# thisUpdate/nextUpdate are expressed in UTC/GMT time zone
now = datetime.now(pytz.UTC).replace(tzinfo=None)
# The this_update and next_update attributes were deprecated in cryptography's 43.0.0 release.
# Updating the code and tests to (also) work with the new API is being tracked in
# https://github.com/certbot/certbot/issues/10053.
with warnings.catch_warnings():
warnings.filterwarnings('ignore', message='Properties that return.*datetime object')
if not response_ocsp.this_update:
raise AssertionError('param thisUpdate is not set.')
if response_ocsp.this_update > now + timedelta(minutes=5):
raise AssertionError('param thisUpdate is in the future.')
if response_ocsp.next_update and response_ocsp.next_update < now - timedelta(minutes=5):
raise AssertionError('param nextUpdate is in the past.')
now = datetime.now(pytz.UTC)
if not response_ocsp.this_update_utc:
raise AssertionError('param thisUpdate is not set.')
if response_ocsp.this_update_utc > now + timedelta(minutes=5):
raise AssertionError('param thisUpdate is in the future.')
if response_ocsp.next_update_utc and response_ocsp.next_update_utc < now - timedelta(minutes=5):
raise AssertionError('param nextUpdate is in the past.')
def _check_ocsp_response_signature(response_ocsp: 'ocsp.OCSPResponse',
certbot/setup.py
+1 -1
View File
@@ -30,7 +30,7 @@ install_requires = [
f'acme>={version}',
'ConfigArgParse>=1.5.3',
'configobj>=5.0.6',
'cryptography>=42.0.0',
'cryptography>=43.0.0',
'distro>=1.0.1',
'importlib_metadata>=4.6; python_version < "3.10"',
# Josepy 2+ may introduce backward incompatible changes by droping usage of
tools/oldest_constraints.txt
+12 -14
View File
@@ -3,11 +3,11 @@
apacheconfig==0.3.2 ; python_version >= "3.9" and python_version < "3.10"
asn1crypto==0.24.0 ; python_version >= "3.9" and python_version < "3.10"
astroid==3.3.8 ; python_version >= "3.9" and python_version < "3.10"
beautifulsoup4==4.12.3 ; python_version >= "3.9" and python_version < "3.10"
beautifulsoup4==4.13.3 ; python_version >= "3.9" and python_version < "3.10"
boto3==1.15.15 ; python_version >= "3.9" and python_version < "3.10"
botocore==1.18.15 ; python_version >= "3.9" and python_version < "3.10"
cachetools==5.5.0 ; python_version >= "3.9" and python_version < "3.10"
certifi==2024.12.14 ; python_version >= "3.9" and python_version < "3.10"
cachetools==5.5.1 ; python_version >= "3.9" and python_version < "3.10"
certifi==2025.1.31 ; python_version >= "3.9" and python_version < "3.10"
cffi==1.12.3 ; python_version >= "3.9" and python_version < "3.10"
chardet==3.0.4 ; python_version >= "3.9" and python_version < "3.10"
cloudflare==1.5.1 ; python_version >= "3.9" and python_version < "3.10"
@@ -15,7 +15,7 @@ colorama==0.4.6 ; python_version >= "3.9" and python_version < "3.10" and sys_pl
configargparse==1.5.3 ; python_version >= "3.9" and python_version < "3.10"
configobj==5.0.6 ; python_version >= "3.9" and python_version < "3.10"
coverage==7.6.10 ; python_version >= "3.9" and python_version < "3.10"
cryptography==42.0.0 ; python_version >= "3.9" and python_version < "3.10"
cryptography==43.0.0 ; python_version >= "3.9" and python_version < "3.10"
cython==0.29.37 ; python_version >= "3.9" and python_version < "3.10"
dill==0.3.9 ; python_version >= "3.9" and python_version < "3.10"
distlib==0.3.9 ; python_version >= "3.9" and python_version < "3.10"
@@ -24,7 +24,7 @@ dns-lexicon==3.15.1 ; python_version >= "3.9" and python_version < "3.10"
dnspython==2.6.1 ; python_version >= "3.9" and python_version < "3.10"
exceptiongroup==1.2.2 ; python_version >= "3.9" and python_version < "3.10"
execnet==2.1.1 ; python_version >= "3.9" and python_version < "3.10"
filelock==3.16.1 ; python_version >= "3.9" and python_version < "3.10"
filelock==3.17.0 ; python_version >= "3.9" and python_version < "3.10"
funcsigs==0.4 ; python_version >= "3.9" and python_version < "3.10"
future==1.0.0 ; python_version >= "3.9" and python_version < "3.10"
google-api-python-client==1.6.5 ; python_version >= "3.9" and python_version < "3.10"
@@ -34,19 +34,19 @@ idna==2.6 ; python_version >= "3.9" and python_version < "3.10"
importlib-metadata==4.6.4 ; python_version >= "3.9" and python_version < "3.10"
iniconfig==2.0.0 ; python_version >= "3.9" and python_version < "3.10"
ipaddress==1.0.16 ; python_version >= "3.9" and python_version < "3.10"
isort==5.13.2 ; python_version >= "3.9" and python_version < "3.10"
isort==6.0.0 ; python_version >= "3.9" and python_version < "3.10"
jmespath==0.10.0 ; python_version >= "3.9" and python_version < "3.10"
josepy==1.14.0 ; python_version >= "3.9" and python_version < "3.10"
logger==1.4 ; python_version >= "3.9" and python_version < "3.10"
mccabe==0.7.0 ; python_version >= "3.9" and python_version < "3.10"
mypy-extensions==1.0.0 ; python_version >= "3.9" and python_version < "3.10"
mypy==1.14.1 ; python_version >= "3.9" and python_version < "3.10"
mypy==1.15.0 ; python_version >= "3.9" and python_version < "3.10"
ndg-httpsclient==0.3.2 ; python_version >= "3.9" and python_version < "3.10"
oauth2client==4.1.3 ; python_version >= "3.9" and python_version < "3.10"
packaging==24.2 ; python_version >= "3.9" and python_version < "3.10"
parsedatetime==2.4 ; python_version >= "3.9" and python_version < "3.10"
pbr==1.8.0 ; python_version >= "3.9" and python_version < "3.10"
pip==24.3.1 ; python_version >= "3.9" and python_version < "3.10"
pip==25.0 ; python_version >= "3.9" and python_version < "3.10"
platformdirs==4.3.6 ; python_version >= "3.9" and python_version < "3.10"
pluggy==1.5.0 ; python_version >= "3.9" and python_version < "3.10"
ply==3.4 ; python_version >= "3.9" and python_version < "3.10"
@@ -54,7 +54,7 @@ py==1.11.0 ; python_version >= "3.9" and python_version < "3.10"
pyasn1-modules==0.4.1 ; python_version >= "3.9" and python_version < "3.10"
pyasn1==0.4.8 ; python_version >= "3.9" and python_version < "3.10"
pycparser==2.14 ; python_version >= "3.9" and python_version < "3.10"
pylint==3.3.3 ; python_version >= "3.9" and python_version < "3.10"
pylint==3.3.4 ; python_version >= "3.9" and python_version < "3.10"
pyopenssl==25.0.0 ; python_version >= "3.9" and python_version < "3.10"
pyotp==2.9.0 ; python_version >= "3.9" and python_version < "3.10"
pyparsing==2.4.7 ; python_version >= "3.9" and python_version < "3.10"
@@ -79,19 +79,17 @@ tldextract==5.1.3 ; python_version >= "3.9" and python_version < "3.10"
tomli==2.2.1 ; python_version >= "3.9" and python_version < "3.10"
tomlkit==0.13.2 ; python_version >= "3.9" and python_version < "3.10"
tox==1.9.2 ; python_version >= "3.9" and python_version < "3.10"
types-cffi==1.16.0.20241221 ; python_version >= "3.9" and python_version < "3.10"
types-httplib2==0.22.0.20241221 ; python_version >= "3.9" and python_version < "3.10"
types-pyopenssl==24.1.0.20240722 ; python_version >= "3.9" and python_version < "3.10"
types-pyrfc3339==2.0.1.20241107 ; python_version >= "3.9" and python_version < "3.10"
types-python-dateutil==2.9.0.20241206 ; python_version >= "3.9" and python_version < "3.10"
types-pytz==2024.2.0.20241221 ; python_version >= "3.9" and python_version < "3.10"
types-pywin32==308.0.0.20241221 ; python_version >= "3.9" and python_version < "3.10"
types-pytz==2025.1.0.20250204 ; python_version >= "3.9" and python_version < "3.10"
types-pywin32==308.0.0.20250128 ; python_version >= "3.9" and python_version < "3.10"
types-requests==2.31.0.6 ; python_version >= "3.9" and python_version < "3.10"
types-setuptools==75.8.0.20250110 ; python_version >= "3.9" and python_version < "3.10"
types-urllib3==1.26.25.14 ; python_version >= "3.9" and python_version < "3.10"
typing-extensions==4.12.2 ; python_version >= "3.9" and python_version < "3.10"
uritemplate==3.0.1 ; python_version >= "3.9" and python_version < "3.10"
urllib3==1.24.2 ; python_version >= "3.9" and python_version < "3.10"
virtualenv==20.28.1 ; python_version >= "3.9" and python_version < "3.10"
virtualenv==20.29.1 ; python_version >= "3.9" and python_version < "3.10"
wheel==0.45.1 ; python_version >= "3.9" and python_version < "3.10"
zipp==3.21.0 ; python_version >= "3.9" and python_version < "3.10"
tools/pinning/oldest/pyproject.toml
+1 -1
View File
@@ -60,7 +60,7 @@ cffi = "1.12.3"
chardet = "3.0.4"
cloudflare = "1.5.1"
configobj = "5.0.6"
cryptography = "42.0.0"
cryptography = "43.0.0"
distro = "1.0.1"
dns-lexicon = "3.15.1"
dnspython = "2.6.1"