From cd620df6f1e7d4d234d5f6627d4e9b359509f793 Mon Sep 17 00:00:00 2001
From: Will Greenberg <willg@eff.org>
Date: Thu, 26 Feb 2026 16:20:42 -0800
Subject: [PATCH] fix lint warnings, add coverage

as it turns out, a test for a deprecated function was the only test
coverage for acme.crypto_util.get_names_from_subject_and_extensions
---
 .../acme/_internal/tests/crypto_util_test.py  | 53 ++++++++++++++++++-
 acme/src/acme/crypto_util.py                  | 13 +----
 .../_internal/tests/crypto_util_test.py       |  1 -
 certbot/src/certbot/crypto_util.py            |  1 -
 4 files changed, 52 insertions(+), 16 deletions(-)

diff --git a/acme/src/acme/_internal/tests/crypto_util_test.py b/acme/src/acme/_internal/tests/crypto_util_test.py
index 9a0771d6c..c0033ba9b 100644
--- a/acme/src/acme/_internal/tests/crypto_util_test.py
+++ b/acme/src/acme/_internal/tests/crypto_util_test.py
@@ -3,8 +3,6 @@ import ipaddress
 import itertools
 import sys
 import unittest
-from unittest import mock
-import warnings
 
 import pytest
 from cryptography import x509
@@ -97,6 +95,57 @@ class CryptographyCertOrReqSANTest(unittest.TestCase):
                          ['chicago-cubs.venafi.example', 'cubs.venafi.example']
 
 
+class GetNamesFromSubjectAndExtensionsTest(unittest.TestCase):
+    """Test for get_names_from_subject_and_extensions."""
+
+    @classmethod
+    def _call_cert(cls, name: str):
+        from acme.crypto_util import get_names_from_subject_and_extensions
+        cert = test_util.load_cert(name)
+        return get_names_from_subject_and_extensions(cert.subject, cert.extensions)
+
+    @classmethod
+    def _call_csr(cls, name: str):
+        from acme.crypto_util import get_names_from_subject_and_extensions
+        csr = test_util.load_csr(name)
+        return get_names_from_subject_and_extensions(csr.subject, csr.extensions)
+
+    def test_cert_one_cn_no_sans(self):
+        assert self._call_cert('cert.pem') == ['example.com']
+
+    def test_cert_two_sans(self):
+        assert self._call_cert('cert-san.pem') == \
+                         ['example.com', 'www.example.com']
+
+    def test_cert_hundred_sans(self):
+        assert self._call_cert('cert-100sans.pem') == \
+                         ['example.com'] + ['example{0}.com'.format(i) for i in range(1, 101)]
+
+    def test_csr_one_cn_no_sans(self):
+        assert self._call_csr('csr-nosans.pem') == ['example.org']
+
+    def test_csr_one_san(self):
+        assert self._call_csr('csr.pem') == ['example.com']
+
+    def test_csr_two_sans(self):
+        assert self._call_csr('csr-san.pem') == \
+                         ['example.com', 'www.example.com']
+
+    def test_csr_six_sans(self):
+        assert self._call_csr('csr-6sans.pem') == \
+                         ['example.com', 'example.org', 'example.net',
+                          'example.info', 'subdomain.example.com',
+                          'other.subdomain.example.com']
+
+    def test_csr_hundred_sans(self):
+        assert self._call_csr('csr-100sans.pem') == \
+                        ['example.com'] + ['example{0}.com'.format(i) for i in range(1, 101)]
+
+    def test_critical_san(self):
+        assert self._call_cert('critical-san.pem') == \
+                         ['chicago-cubs.venafi.example', 'cubs.venafi.example']
+
+
 class MakeCSRTest(unittest.TestCase):
     """Test for standalone functions."""
 
diff --git a/acme/src/acme/crypto_util.py b/acme/src/acme/crypto_util.py
index d968dd6b5..22b57e481 100644
--- a/acme/src/acme/crypto_util.py
+++ b/acme/src/acme/crypto_util.py
@@ -1,20 +1,14 @@
 """Crypto utilities."""
-import enum
-from datetime import datetime, timedelta, timezone
 import ipaddress
 import logging
-from types import ModuleType
 import typing
-from typing import Any
 from typing import Literal
 from typing import Optional
 from typing import Union
-import warnings
-import sys
 
 from cryptography import x509
 from cryptography.hazmat.primitives import hashes, serialization
-from cryptography.hazmat.primitives.asymmetric import dsa, rsa, ec, ed25519, ed448, types
+from cryptography.hazmat.primitives.asymmetric import dsa, rsa, ec, ed25519, ed448
 from cryptography.hazmat.primitives.serialization import Encoding
 
 logger = logging.getLogger(__name__)
@@ -174,11 +168,6 @@ def _cryptography_cert_or_req_san(
     return san_ext.value.get_values_for_type(x509.DNSName)
 
 
-# Helper function that can be mocked in unit tests
-def _now() -> datetime:
-    return datetime.now(tz=timezone.utc)
-
-
 def dump_cryptography_chain(
     chain: list[x509.Certificate],
     encoding: Literal[Encoding.PEM, Encoding.DER] = Encoding.PEM,
diff --git a/certbot/src/certbot/_internal/tests/crypto_util_test.py b/certbot/src/certbot/_internal/tests/crypto_util_test.py
index 7d6655f3c..0c123883a 100644
--- a/certbot/src/certbot/_internal/tests/crypto_util_test.py
+++ b/certbot/src/certbot/_internal/tests/crypto_util_test.py
@@ -11,7 +11,6 @@ from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric import ec
 from cryptography.hazmat.primitives.serialization import Encoding
 
-from acme import crypto_util as acme_crypto_util
 from certbot import errors
 from certbot import util
 from certbot.compat import filesystem
diff --git a/certbot/src/certbot/crypto_util.py b/certbot/src/certbot/crypto_util.py
index fccd17613..b1b2bbe51 100644
--- a/certbot/src/certbot/crypto_util.py
+++ b/certbot/src/certbot/crypto_util.py
@@ -12,7 +12,6 @@ import re
 from typing import Optional
 from typing import TYPE_CHECKING
 from typing import Union
-import warnings
 
 from cryptography import x509
 from cryptography.exceptions import InvalidSignature