diff --git a/acme/setup.py b/acme/setup.py index 613209ea9..9fb0eb108 100644 --- a/acme/setup.py +++ b/acme/setup.py @@ -6,7 +6,7 @@ from setuptools import setup version = '3.2.0.dev0' install_requires = [ - 'cryptography>=42.0.0', + 'cryptography>=43.0.0', # Josepy 2+ may introduce backward incompatible changes by droping usage of # deprecated PyOpenSSL APIs. 'josepy>=1.13.0, <2', diff --git a/certbot/CHANGELOG.md b/certbot/CHANGELOG.md index ba66b6eda..02a2bd897 100644 --- a/certbot/CHANGELOG.md +++ b/certbot/CHANGELOG.md @@ -11,7 +11,7 @@ Certbot adheres to [Semantic Versioning](https://semver.org/). ### Changed * certbot-nginx now requires pyparsing>=2.4.7. -* certbot and its acme library now require cryptography>=42.0.0. +* certbot and its acme library now require cryptography>=43.0.0. * certbot-nginx and our acme library now require pyOpenSSL>=25.0.0. * Deprecated `gen_ss_cert` in `acme.crypto_util` as it uses deprecated pyOpenSSL API. diff --git a/certbot/certbot/_internal/tests/ocsp_test.py b/certbot/certbot/_internal/tests/ocsp_test.py index 20034e012..8429afac7 100644 --- a/certbot/certbot/_internal/tests/ocsp_test.py +++ b/certbot/certbot/_internal/tests/ocsp_test.py @@ -6,14 +6,12 @@ from datetime import timedelta import sys import unittest from unittest import mock -import warnings from cryptography import x509 from cryptography.exceptions import InvalidSignature from cryptography.exceptions import UnsupportedAlgorithm from cryptography.hazmat.backends import default_backend from cryptography.hazmat.primitives import hashes -from cryptography.utils import CryptographyDeprecationWarning from cryptography.x509 import ocsp as ocsp_lib import pytest import pytz @@ -286,25 +284,6 @@ class OSCPTestCryptography(unittest.TestCase): revoked = self.checker.ocsp_revoked(self.cert_obj) assert revoked is False - def test_this_update_warning(self): - with _ocsp_mock(ocsp_lib.OCSPCertStatus.GOOD, - ocsp_lib.OCSPResponseStatus.SUCCESSFUL) as mocks: - value = mocks['mock_response'].return_value.this_update - - def warn_first(): - msg = ('Properties that return a naïve datetime object have been deprecated. Please ' - 'switch to this_update_utc.') - warnings.warn(msg, CryptographyDeprecationWarning) - return value - - property_mock = mock.PropertyMock(side_effect=warn_first) - # Using type() in this way is recommended in mock's documentation at - # https://docs.python.org/3/library/unittest.mock.html#unittest.mock.PropertyMock - type(mocks['mock_response'].return_value).this_update = property_mock - - revoked = self.checker.ocsp_revoked(self.cert_obj) - assert revoked is False - @contextlib.contextmanager def _ocsp_mock(certificate_status, response_status, @@ -345,8 +324,8 @@ def _construct_mock_ocsp_response(certificate_status, response_status): responder_name=responder.subject, certificates=[responder], hash_algorithm=hashes.SHA1(), - next_update=datetime.now(pytz.UTC).replace(tzinfo=None) + timedelta(days=1), - this_update=datetime.now(pytz.UTC).replace(tzinfo=None) - timedelta(days=1), + next_update_utc=datetime.now(pytz.UTC) + timedelta(days=1), + this_update_utc=datetime.now(pytz.UTC) - timedelta(days=1), signature_algorithm_oid=x509.oid.SignatureAlgorithmOID.RSA_WITH_SHA1, ) diff --git a/certbot/certbot/ocsp.py b/certbot/certbot/ocsp.py index 82937c7ea..8be95f8fe 100644 --- a/certbot/certbot/ocsp.py +++ b/certbot/certbot/ocsp.py @@ -7,7 +7,6 @@ import subprocess from subprocess import PIPE from typing import Optional from typing import Tuple -import warnings from cryptography import x509 from cryptography.exceptions import InvalidSignature @@ -235,18 +234,13 @@ def _check_ocsp_response(response_ocsp: 'ocsp.OCSPResponse', request_ocsp: 'ocsp # See OpenSSL implementation as a reference: # https://github.com/openssl/openssl/blob/ef45aa14c5af024fcb8bef1c9007f3d1c115bd85/crypto/ocsp/ocsp_cl.c#L338-L391 # thisUpdate/nextUpdate are expressed in UTC/GMT time zone - now = datetime.now(pytz.UTC).replace(tzinfo=None) - # The this_update and next_update attributes were deprecated in cryptography's 43.0.0 release. - # Updating the code and tests to (also) work with the new API is being tracked in - # https://github.com/certbot/certbot/issues/10053. - with warnings.catch_warnings(): - warnings.filterwarnings('ignore', message='Properties that return.*datetime object') - if not response_ocsp.this_update: - raise AssertionError('param thisUpdate is not set.') - if response_ocsp.this_update > now + timedelta(minutes=5): - raise AssertionError('param thisUpdate is in the future.') - if response_ocsp.next_update and response_ocsp.next_update < now - timedelta(minutes=5): - raise AssertionError('param nextUpdate is in the past.') + now = datetime.now(pytz.UTC) + if not response_ocsp.this_update_utc: + raise AssertionError('param thisUpdate is not set.') + if response_ocsp.this_update_utc > now + timedelta(minutes=5): + raise AssertionError('param thisUpdate is in the future.') + if response_ocsp.next_update_utc and response_ocsp.next_update_utc < now - timedelta(minutes=5): + raise AssertionError('param nextUpdate is in the past.') def _check_ocsp_response_signature(response_ocsp: 'ocsp.OCSPResponse', diff --git a/certbot/setup.py b/certbot/setup.py index ac14b70f3..7f069e08f 100644 --- a/certbot/setup.py +++ b/certbot/setup.py @@ -30,7 +30,7 @@ install_requires = [ f'acme>={version}', 'ConfigArgParse>=1.5.3', 'configobj>=5.0.6', - 'cryptography>=42.0.0', + 'cryptography>=43.0.0', 'distro>=1.0.1', 'importlib_metadata>=4.6; python_version < "3.10"', # Josepy 2+ may introduce backward incompatible changes by droping usage of diff --git a/tools/oldest_constraints.txt b/tools/oldest_constraints.txt index bafa13479..3b8caa427 100644 --- a/tools/oldest_constraints.txt +++ b/tools/oldest_constraints.txt @@ -3,11 +3,11 @@ apacheconfig==0.3.2 ; python_version >= "3.9" and python_version < "3.10" asn1crypto==0.24.0 ; python_version >= "3.9" and python_version < "3.10" astroid==3.3.8 ; python_version >= "3.9" and python_version < "3.10" -beautifulsoup4==4.12.3 ; python_version >= "3.9" and python_version < "3.10" +beautifulsoup4==4.13.3 ; python_version >= "3.9" and python_version < "3.10" boto3==1.15.15 ; python_version >= "3.9" and python_version < "3.10" botocore==1.18.15 ; python_version >= "3.9" and python_version < "3.10" -cachetools==5.5.0 ; python_version >= "3.9" and python_version < "3.10" -certifi==2024.12.14 ; python_version >= "3.9" and python_version < "3.10" +cachetools==5.5.1 ; python_version >= "3.9" and python_version < "3.10" +certifi==2025.1.31 ; python_version >= "3.9" and python_version < "3.10" cffi==1.12.3 ; python_version >= "3.9" and python_version < "3.10" chardet==3.0.4 ; python_version >= "3.9" and python_version < "3.10" cloudflare==1.5.1 ; python_version >= "3.9" and python_version < "3.10" @@ -15,7 +15,7 @@ colorama==0.4.6 ; python_version >= "3.9" and python_version < "3.10" and sys_pl configargparse==1.5.3 ; python_version >= "3.9" and python_version < "3.10" configobj==5.0.6 ; python_version >= "3.9" and python_version < "3.10" coverage==7.6.10 ; python_version >= "3.9" and python_version < "3.10" -cryptography==42.0.0 ; python_version >= "3.9" and python_version < "3.10" +cryptography==43.0.0 ; python_version >= "3.9" and python_version < "3.10" cython==0.29.37 ; python_version >= "3.9" and python_version < "3.10" dill==0.3.9 ; python_version >= "3.9" and python_version < "3.10" distlib==0.3.9 ; python_version >= "3.9" and python_version < "3.10" @@ -24,7 +24,7 @@ dns-lexicon==3.15.1 ; python_version >= "3.9" and python_version < "3.10" dnspython==2.6.1 ; python_version >= "3.9" and python_version < "3.10" exceptiongroup==1.2.2 ; python_version >= "3.9" and python_version < "3.10" execnet==2.1.1 ; python_version >= "3.9" and python_version < "3.10" -filelock==3.16.1 ; python_version >= "3.9" and python_version < "3.10" +filelock==3.17.0 ; python_version >= "3.9" and python_version < "3.10" funcsigs==0.4 ; python_version >= "3.9" and python_version < "3.10" future==1.0.0 ; python_version >= "3.9" and python_version < "3.10" google-api-python-client==1.6.5 ; python_version >= "3.9" and python_version < "3.10" @@ -34,19 +34,19 @@ idna==2.6 ; python_version >= "3.9" and python_version < "3.10" importlib-metadata==4.6.4 ; python_version >= "3.9" and python_version < "3.10" iniconfig==2.0.0 ; python_version >= "3.9" and python_version < "3.10" ipaddress==1.0.16 ; python_version >= "3.9" and python_version < "3.10" -isort==5.13.2 ; python_version >= "3.9" and python_version < "3.10" +isort==6.0.0 ; python_version >= "3.9" and python_version < "3.10" jmespath==0.10.0 ; python_version >= "3.9" and python_version < "3.10" josepy==1.14.0 ; python_version >= "3.9" and python_version < "3.10" logger==1.4 ; python_version >= "3.9" and python_version < "3.10" mccabe==0.7.0 ; python_version >= "3.9" and python_version < "3.10" mypy-extensions==1.0.0 ; python_version >= "3.9" and python_version < "3.10" -mypy==1.14.1 ; python_version >= "3.9" and python_version < "3.10" +mypy==1.15.0 ; python_version >= "3.9" and python_version < "3.10" ndg-httpsclient==0.3.2 ; python_version >= "3.9" and python_version < "3.10" oauth2client==4.1.3 ; python_version >= "3.9" and python_version < "3.10" packaging==24.2 ; python_version >= "3.9" and python_version < "3.10" parsedatetime==2.4 ; python_version >= "3.9" and python_version < "3.10" pbr==1.8.0 ; python_version >= "3.9" and python_version < "3.10" -pip==24.3.1 ; python_version >= "3.9" and python_version < "3.10" +pip==25.0 ; python_version >= "3.9" and python_version < "3.10" platformdirs==4.3.6 ; python_version >= "3.9" and python_version < "3.10" pluggy==1.5.0 ; python_version >= "3.9" and python_version < "3.10" ply==3.4 ; python_version >= "3.9" and python_version < "3.10" @@ -54,7 +54,7 @@ py==1.11.0 ; python_version >= "3.9" and python_version < "3.10" pyasn1-modules==0.4.1 ; python_version >= "3.9" and python_version < "3.10" pyasn1==0.4.8 ; python_version >= "3.9" and python_version < "3.10" pycparser==2.14 ; python_version >= "3.9" and python_version < "3.10" -pylint==3.3.3 ; python_version >= "3.9" and python_version < "3.10" +pylint==3.3.4 ; python_version >= "3.9" and python_version < "3.10" pyopenssl==25.0.0 ; python_version >= "3.9" and python_version < "3.10" pyotp==2.9.0 ; python_version >= "3.9" and python_version < "3.10" pyparsing==2.4.7 ; python_version >= "3.9" and python_version < "3.10" @@ -79,19 +79,17 @@ tldextract==5.1.3 ; python_version >= "3.9" and python_version < "3.10" tomli==2.2.1 ; python_version >= "3.9" and python_version < "3.10" tomlkit==0.13.2 ; python_version >= "3.9" and python_version < "3.10" tox==1.9.2 ; python_version >= "3.9" and python_version < "3.10" -types-cffi==1.16.0.20241221 ; python_version >= "3.9" and python_version < "3.10" types-httplib2==0.22.0.20241221 ; python_version >= "3.9" and python_version < "3.10" -types-pyopenssl==24.1.0.20240722 ; python_version >= "3.9" and python_version < "3.10" types-pyrfc3339==2.0.1.20241107 ; python_version >= "3.9" and python_version < "3.10" types-python-dateutil==2.9.0.20241206 ; python_version >= "3.9" and python_version < "3.10" -types-pytz==2024.2.0.20241221 ; python_version >= "3.9" and python_version < "3.10" -types-pywin32==308.0.0.20241221 ; python_version >= "3.9" and python_version < "3.10" +types-pytz==2025.1.0.20250204 ; python_version >= "3.9" and python_version < "3.10" +types-pywin32==308.0.0.20250128 ; python_version >= "3.9" and python_version < "3.10" types-requests==2.31.0.6 ; python_version >= "3.9" and python_version < "3.10" types-setuptools==75.8.0.20250110 ; python_version >= "3.9" and python_version < "3.10" types-urllib3==1.26.25.14 ; python_version >= "3.9" and python_version < "3.10" typing-extensions==4.12.2 ; python_version >= "3.9" and python_version < "3.10" uritemplate==3.0.1 ; python_version >= "3.9" and python_version < "3.10" urllib3==1.24.2 ; python_version >= "3.9" and python_version < "3.10" -virtualenv==20.28.1 ; python_version >= "3.9" and python_version < "3.10" +virtualenv==20.29.1 ; python_version >= "3.9" and python_version < "3.10" wheel==0.45.1 ; python_version >= "3.9" and python_version < "3.10" zipp==3.21.0 ; python_version >= "3.9" and python_version < "3.10" diff --git a/tools/pinning/oldest/pyproject.toml b/tools/pinning/oldest/pyproject.toml index a56befb2f..2afad9a5e 100644 --- a/tools/pinning/oldest/pyproject.toml +++ b/tools/pinning/oldest/pyproject.toml @@ -60,7 +60,7 @@ cffi = "1.12.3" chardet = "3.0.4" cloudflare = "1.5.1" configobj = "5.0.6" -cryptography = "42.0.0" +cryptography = "43.0.0" distro = "1.0.1" dns-lexicon = "3.15.1" dnspython = "2.6.1"