Extension parsing: add new fallback code which uses the new cryptography API #331
Conversation
… using the new cryptography API.
|
ready_for_review |
|
pyca/cryptography#6346 has been merged. One thing that might get fixed are the differences for KeyUsage that crept into our tests (https:/ansible-collections/community.crypto/pull/331/files#diff-1f795e32ff22e33251b41bd3572823f7677804e01c3fcf8ceb56185c22014537R158, https:/ansible-collections/community.crypto/pull/331/files#diff-1f795e32ff22e33251b41bd3572823f7677804e01c3fcf8ceb56185c22014537R35, https:/ansible-collections/community.crypto/pull/331/files#diff-c809c2bf907465bdbbfa9115178aef8985383112034fa42b1c347eae05bd8c97R24), though we likely have to keep supporting both values since 35.0.0 already introduced this difference. (But maybe we can do something like only accept the other value if cryptography major version == 35. But that's something I would do in a follow-up PR on |
felixfontein
changed the title
|
@Ajpantuso thanks a lot for also reviewing this one! |
Backport to stable-1: 💚 backport PR created✅ Backport PR branch: Backported as #345 🤖 @patchback |
…phy API (#331) * Add new code as fallback which re-serializes de-serialized extensions using the new cryptography API. * Forgot Base64 encoding. * Add extension by OID tests. * There's one value which is different with the new code. * Differences in CI. * Working around older Jinjas. * Value depends on which SAN was included. * Force complete CI run now since cryptography 36.0.0 is out. ci_complete (cherry picked from commit 3f40795)
…back code which uses the new cryptography API (#345) * Extension parsing: add new fallback code which uses the new cryptography API (#331) * Add new code as fallback which re-serializes de-serialized extensions using the new cryptography API. * Forgot Base64 encoding. * Add extension by OID tests. * There's one value which is different with the new code. * Differences in CI. * Working around older Jinjas. * Value depends on which SAN was included. * Force complete CI run now since cryptography 36.0.0 is out. ci_complete (cherry picked from commit 3f40795) * Adjust tests. Co-authored-by: Felix Fontein <[email protected]>
SUMMARY
This adds a fallback to extension parsing which uses the new API from pyca/cryptography#6346. I've used the new code as a fallback since it is potentially a breaking change (as announced as upcoming eventually in the changelog for 2.0.0). Switching to it as a default should only happen in a new minor release, while this can (and should) go into a bugfix release.
ISSUE TYPE
COMPONENT NAME
get_certificate
openssl_csr_info
x509_certificate_info