Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-trustme for openSUSE:Factory checked in at 2024-08-29 15:42:49 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-trustme (Old) and /work/SRC/openSUSE:Factory/.python-trustme.new.2698 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-trustme" Thu Aug 29 15:42:49 2024 rev:14 rq:1196403 version:1.1.0 Changes: -------- --- /work/SRC/openSUSE:Factory/python-trustme/python-trustme.changes 2024-03-06 23:03:16.982597122 +0100 +++ /work/SRC/openSUSE:Factory/.python-trustme.new.2698/python-trustme.changes 2024-08-29 15:43:12.956854455 +0200 @@ -1,0 +2,6 @@ +Wed Aug 28 06:38:39 UTC 2024 - Steve Kowalik <steven.kowa...@suse.com> + +- Add patch add-aki-to-child-certs.patch + * Also add Authority Key Identifiers to children certs. + +------------------------------------------------------------------- New: ---- add-aki-to-child-certs.patch BETA DEBUG BEGIN: New: - Add patch add-aki-to-child-certs.patch * Also add Authority Key Identifiers to children certs. BETA DEBUG END: ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-trustme.spec ++++++ --- /var/tmp/diff_new_pack.k7CRiP/_old 2024-08-29 15:43:14.072900858 +0200 +++ /var/tmp/diff_new_pack.k7CRiP/_new 2024-08-29 15:43:14.072900858 +0200 @@ -25,6 +25,8 @@ URL: https://github.com/python-trio/trustme Source: https://files.pythonhosted.org/packages/source/t/trustme/trustme-%{version}.tar.gz Patch0: fix2038.patch +# PATCH-FIX-UPSTREAM gh#python-trio/trustme#642 +Patch1: add-aki-to-child-certs.patch BuildRequires: %{python_module cryptography} BuildRequires: %{python_module idna} BuildRequires: %{python_module pip} ++++++ add-aki-to-child-certs.patch ++++++ >From 84e347d9221e304f0158330e5101d23969d424d0 Mon Sep 17 00:00:00 2001 From: Illia Volochii <illia.voloc...@gmail.com> Date: Wed, 27 Mar 2024 11:45:41 +0000 Subject: [PATCH 1/3] Add AKI to child CA certificates --- src/trustme/__init__.py | 14 +++++++++++--- tests/test_trustme.py | 5 +++++ 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/src/trustme/__init__.py b/src/trustme/__init__.py index 5fb24fb..0db1bb0 100644 --- a/src/trustme/__init__.py +++ b/src/trustme/__init__.py @@ -250,14 +250,22 @@ def __init__( sign_key = parent_cert._private_key parent_certificate = parent_cert._certificate issuer = parent_certificate.subject - - self._certificate = ( + ski_ext = parent_certificate.extensions.get_extension_for_class( + x509.SubjectKeyIdentifier) + aki = x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(ski_ext.value) + else: + aki = None + cert_builder = ( _cert_builder_common(name, issuer, self._private_key.public_key()) .add_extension( x509.BasicConstraints(ca=True, path_length=path_length), critical=True, ) - .add_extension( + ) + if aki: + cert_builder = cert_builder.add_extension(aki, critical=False) + self._certificate = ( + cert_builder.add_extension( x509.KeyUsage( digital_signature=True, # OCSP content_commitment=False, diff --git a/tests/test_trustme.py b/tests/test_trustme.py index 1d901ad..581716e 100644 --- a/tests/test_trustme.py +++ b/tests/test_trustme.py @@ -200,6 +200,11 @@ def test_intermediate() -> None: assert_is_ca(child_ca_cert) assert child_ca_cert.issuer == ca_cert.subject assert _path_length(child_ca_cert) == 8 + aki = child_ca_cert.extensions.get_extension_for_class(x509.AuthorityKeyIdentifier) + assert aki.critical is False + expected_aki_key_id = ca_cert.extensions.get_extension_for_class( + x509.SubjectKeyIdentifier).value.digest + assert aki.value.key_identifier == expected_aki_key_id child_server = child_ca.issue_cert("test-host.example.org") assert len(child_server.cert_chain_pems) == 2 >From f507a28e0f4d97d63716aa5a81669bb747235f07 Mon Sep 17 00:00:00 2001 From: Illia Volochii <illia.voloc...@gmail.com> Date: Wed, 27 Mar 2024 12:02:59 +0000 Subject: [PATCH 2/3] Fix a typing issue --- src/trustme/__init__.py | 1 + 1 file changed, 1 insertion(+) diff --git a/src/trustme/__init__.py b/src/trustme/__init__.py index 0db1bb0..d126180 100644 --- a/src/trustme/__init__.py +++ b/src/trustme/__init__.py @@ -246,6 +246,7 @@ def __init__( ) issuer = name sign_key = self._private_key + aki: Optional[x509.AuthorityKeyIdentifier] if parent_cert is not None: sign_key = parent_cert._private_key parent_certificate = parent_cert._certificate >From cdd2fd61aae9c92f902932bacd6b39189ecde4b1 Mon Sep 17 00:00:00 2001 From: Illia Volochii <illia.voloc...@gmail.com> Date: Wed, 27 Mar 2024 12:09:38 +0000 Subject: [PATCH 3/3] Add a news entry --- newsfragments/642.bugfix.rst | 1 + 1 file changed, 1 insertion(+) create mode 100644 newsfragments/642.bugfix.rst diff --git a/newsfragments/642.bugfix.rst b/newsfragments/642.bugfix.rst new file mode 100644 index 0000000..9d75e7a --- /dev/null +++ b/newsfragments/642.bugfix.rst @@ -0,0 +1 @@ +Add the Authority Key Identifier extension to child CA certificates.
