repin cryptography for openssl security update (#9565)

* repin cryptography for openssl security update

https://www.openssl.org/news/secadv/20230207.txt
https://cryptography.io/en/latest/changelog/#v39-0-1

* fix type hints

* remove outdated comments

certbot/certbot/_internal/storage.py

@@ -7,6 +7,7 @@ import re
 import shutil
 import stat
 from typing import Any
+from typing import cast
 from typing import Dict
 from typing import Iterable
 from typing import List
@@ -1133,7 +1134,7 @@ class RenewableCert(interfaces.RenewableCert):
                 password=None,
                 backend=default_backend()
             )
-            return key
+            return cast(Union[RSAPrivateKey, EllipticCurvePrivateKey], key)
 
     @property
     def private_key_type(self) -> str:

certbot/certbot/crypto_util.py

@@ -45,6 +45,8 @@ from certbot.compat import os
 if TYPE_CHECKING:
     from cryptography.hazmat.primitives.asymmetric.ed448 import Ed448PublicKey
     from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+    from cryptography.hazmat.primitives.asymmetric.x448 import X448PublicKey
+    from cryptography.hazmat.primitives.asymmetric.x25519 import X25519PublicKey
 
 logger = logging.getLogger(__name__)
 
@@ -243,11 +245,7 @@ def make_key(bits: int = 1024, key_type: str = "rsa",
             raise errors.Error("Unsupported elliptic curve: {}".format(elliptic_curve))
         except UnsupportedAlgorithm as e:
             raise e from errors.Error(str(e))
-        # This type ignore directive is required due to an outdated version of types-cryptography.
-        # It can be removed once package types-pyOpenSSL depends on cryptography instead of
-        # types-cryptography and so types-cryptography is not installed anymore.
-        # See https://github.com/python/typeshed/issues/5618
-        _key_pem = _key.private_bytes(  # type: ignore
+        _key_pem = _key.private_bytes(
             encoding=Encoding.PEM,
             format=PrivateFormat.TraditionalOpenSSL,
             encryption_algorithm=NoEncryption()
@@ -306,6 +304,7 @@ def verify_renewable_cert_sig(renewable_cert: interfaces.RenewableCert) -> None:
         with open(renewable_cert.cert_path, 'rb') as cert_file:
             cert = x509.load_pem_x509_certificate(cert_file.read(), default_backend())
         pk = chain.public_key()
+        assert cert.signature_hash_algorithm # always present for RSA and ECDSA
         verify_signed_payload(pk, cert.signature, cert.tbs_certificate_bytes,
                                 cert.signature_hash_algorithm)
     except (IOError, ValueError, InvalidSignature) as e:
@@ -316,7 +315,8 @@ def verify_renewable_cert_sig(renewable_cert: interfaces.RenewableCert) -> None:
 
 
 def verify_signed_payload(public_key: Union[DSAPublicKey, 'Ed25519PublicKey', 'Ed448PublicKey',
-                                            EllipticCurvePublicKey, RSAPublicKey],
+                                            EllipticCurvePublicKey, RSAPublicKey,
+                                            'X25519PublicKey', 'X448PublicKey'],
                           signature: bytes, payload: bytes,
                           signature_hash_algorithm: hashes.HashAlgorithm) -> None:
     """Check the signature of a payload.

certbot/certbot/ocsp.py

@@ -285,6 +285,7 @@ def _check_ocsp_response_signature(response_ocsp: 'ocsp.OCSPResponse',
 
         # Following line may raise UnsupportedAlgorithm
         chosen_cert_hash = responder_cert.signature_hash_algorithm
+        assert chosen_cert_hash # always present for RSA and ECDSA certificates.
         # For a delegate OCSP responder, we need first check that its certificate is effectively
         # signed by the certificate issuer.
         crypto_util.verify_signed_payload(issuer_cert.public_key(), responder_cert.signature,

certbot/certbot/tests/util.py

@@ -20,6 +20,7 @@ from unittest import mock
 
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
 import josepy as jose
 from OpenSSL import crypto
 import pkg_resources
@@ -128,8 +129,9 @@ def load_rsa_private_key(*names: str) -> jose.ComparableRSAKey:
         loader_fn = serialization.load_pem_private_key
     else:
         loader_fn = serialization.load_der_private_key
-    return jose.ComparableRSAKey(loader_fn(
-        load_vector(*names), password=None, backend=default_backend()))
+    return jose.ComparableRSAKey(
+        cast(RSAPrivateKey,
+             loader_fn(load_vector(*names), password=None, backend=default_backend())))
 
 
 def load_pyopenssl_private_key(*names: str) -> crypto.PKey: