repin cryptography for openssl security update (#9565)

* repin cryptography for openssl security update

https://www.openssl.org/news/secadv/20230207.txt
https://cryptography.io/en/latest/changelog/#v39-0-1

* fix type hints

* remove outdated comments

certbot-ci/certbot_integration_tests/certbot_tests/assertions.py

@@ -22,13 +22,13 @@ SYSTEM_SID = 'S-1-5-18'
 ADMINS_SID = 'S-1-5-32-544'
 
 
-def assert_elliptic_key(key: str, curve: Type[EllipticCurve]) -> None:
+def assert_elliptic_key(key_path: str, curve: Type[EllipticCurve]) -> None:
     """
     Asserts that the key at the given path is an EC key using the given curve.
-    :param key: path to key
+    :param key_path: path to key
     :param EllipticCurve curve: name of the expected elliptic curve
     """
-    with open(key, 'rb') as file:
+    with open(key_path, 'rb') as file:
         privkey1 = file.read()
 
     key = load_pem_private_key(data=privkey1, password=None, backend=default_backend())
@@ -37,13 +37,13 @@ def assert_elliptic_key(key: str, curve: Type[EllipticCurve]) -> None:
     assert isinstance(key.curve, curve), f"should have curve {curve} but was {key.curve}"
 
 
-def assert_rsa_key(key: str, key_size: Optional[int] = None) -> None:
+def assert_rsa_key(key_path: str, key_size: Optional[int] = None) -> None:
     """
     Asserts that the key at the given path is an RSA key.
-    :param str key: path to key
+    :param str key_path: path to key
     :param int key_size: if provided, assert that the RSA key is of this size
     """
-    with open(key, 'rb') as file:
+    with open(key_path, 'rb') as file:
         privkey1 = file.read()
 
     key = load_pem_private_key(data=privkey1, password=None, backend=default_backend())

certbot-ci/certbot_integration_tests/certbot_tests/test_main.py

@@ -916,7 +916,7 @@ def test_preferred_chain(context: IntegrationTestsContext) -> None:
     except NotImplementedError:
         pytest.skip('This ACME server does not support alternative issuers.')
 
-    names = [i.issuer.get_attributes_for_oid(NameOID.COMMON_NAME)[0].value \
+    names = [str(i.issuer.get_attributes_for_oid(NameOID.COMMON_NAME)[0].value) \
              for i in issuers]
 
     domain = context.get_domain('preferred-chain')
@@ -929,9 +929,9 @@ def test_preferred_chain(context: IntegrationTestsContext) -> None:
         context.certbot(args)
 
         dumped = misc.read_certificate(cert_path)
-        assert 'Issuer: CN={}'.format(expected) in dumped, \
-               'Expected chain issuer to be {} when preferring {}'.format(expected, requested)
+        assert f'Issuer: CN={expected}'in dumped, \
+               f'Expected chain issuer to be {expected} when preferring {requested}'
 
         with open(conf_path, 'r') as f:
-            assert 'preferred_chain = {}'.format(requested) in f.read(), \
+            assert f'preferred_chain = {requested}' in f.read(), \
                    'Expected preferred_chain to be set in renewal config'

certbot-ci/certbot_integration_tests/utils/misc.py

@@ -230,11 +230,7 @@ def generate_csr(domains: Iterable[str], key_path: str, csr_path: str,
             # Ignore a warning on some old versions of cryptography
             warnings.simplefilter('ignore', category=PendingDeprecationWarning)
             _key = ec.generate_private_key(ec.SECP384R1(), default_backend())
-        # This type ignore directive is required due to an outdated version of types-cryptography.
-        # It can be removed once package types-pyOpenSSL depends on cryptography instead of
-        # types-cryptography and so types-cryptography is not installed anymore.
-        # See https://github.com/python/typeshed/issues/5618
-        _bytes = _key.private_bytes(encoding=Encoding.PEM,  # type: ignore
+        _bytes = _key.private_bytes(encoding=Encoding.PEM,
                                     format=PrivateFormat.TraditionalOpenSSL,
                                     encryption_algorithm=NoEncryption())
         key = crypto.load_privatekey(crypto.FILETYPE_PEM, _bytes)

certbot-ci/certbot_integration_tests/utils/pebble_ocsp_server.py

@@ -11,9 +11,13 @@ from cryptography import x509
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import hashes
 from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePrivateKey
+from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
 from cryptography.x509 import ocsp
 from dateutil import parser
 import requests
+from typing import cast
+from typing import Union
 
 from certbot_integration_tests.utils.constants import MOCK_OCSP_SERVER_PORT
 from certbot_integration_tests.utils.constants import PEBBLE_MANAGEMENT_URL
@@ -25,7 +29,9 @@ class _ProxyHandler(BaseHTTPServer.BaseHTTPRequestHandler):
     def do_POST(self) -> None:
         request = requests.get(PEBBLE_MANAGEMENT_URL + '/intermediate-keys/0',
                                verify=False, timeout=10)
-        issuer_key = serialization.load_pem_private_key(request.content, None, default_backend())
+        issuer_key = cast(
+            Union[RSAPrivateKey, EllipticCurvePrivateKey],
+            serialization.load_pem_private_key(request.content, None, default_backend()))
 
         request = requests.get(PEBBLE_MANAGEMENT_URL + '/intermediates/0',
                                verify=False, timeout=10)