cert-utils 0.1.18__tar.gz → 0.2.0__tar.gz

cert_utils-0.2.0/CHANGES.txt

@@ -0,0 +1,60 @@
+0.2.0
+    * replaced pyopenssl with cryptography.
+      pyopenssl was originally used because certbot required it and this package
+      was originally developed to troubleshoot certbot installations;
+      however certbot uses cryptography, so we can consider that to be available
+      and it is the officially preferred interface by both projects and the psf.
+    * split the package into multiple files
+      this is for internal use and organization is subject to change.
+      please access the main namespace.
+    * dropped Python3.6
+      this package requires cryptography>=42.0.0, specifically for chain verification
+      cryptography dropped Python3.6 in v41.0.0
+
+0.1.9
+    pulled ari serial_no decoder into a separate unction
+    parsing akid defensively against edge case variants:
+        in web pki it is almost always "keyid:"
+        however the rfc allows for "uri:"+"serial:", 
+        either in addition to keyid or replacing it
+    this should be the final release in the 0.1.x branch;
+    work has been started for 0.2.0, which will migrate away from openssl
+
+0.1.8
+    added cert_info cli tool
+
+0.1.7
+    ARI support
+        * ari_construct_identifier()
+    added `serial` to parse_cert dicts
+    testing on py13
+
+0.1.6
+    updated LetsEncrypt data
+
+0.1.5 [deleted from PyPi]
+    updated typing and tests
+    updated LetsEncrypt data
+    
+0.1.4
+    updated typing for dependencies
+
+0.1.3
+    new mypy version caught an issue
+
+0.1.2
+    docs improvements
+    raise a new `FallbackError_FilepathRequired` exception when missing a
+        required fallback filepath
+
+0.1.1
+    minor formatting
+    Conditional Imports
+        imports are tried "one at a time"; not "all or nothing".
+        functions that use imports should test for all necessary options
+    new extended tests for lacking specific libraries
+    tests now monitor logs to ensure fallback behavior is triggered correctly
+
+0.1.0
+    initial release
+    forked from peter_sslers

{cert_utils-0.1.18 → cert_utils-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: cert_utils
-Version: 0.1.18
+Version: 0.2.0
 Summary: TLS/SSL Certiicate Utilities
 Home-page: https://github.com/aptise/cert_utils
 Author: Jonathan Vanasco
@@ -11,7 +11,6 @@ Platform: UNKNOWN
 Classifier: Intended Audience :: Developers
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.6
 Classifier: Programming Language :: Python :: 3.7
 Classifier: Programming Language :: Python :: 3.8
 Classifier: Programming Language :: Python :: 3.9
@@ -31,12 +30,13 @@ cert_utils
 ==========
 
 **cert_utils** offers support for common operations when dealing with SSL
-Certificates within the LetsEncrypt ecosystem.
+Certificates, specifically within the LetsEncrypt ecosystem.
 
 This library was originally developed as a toolkit for bugfixing and
 troubleshooting large ACME installations.
 
-**cert_utils** will attempt to process operations with Python when possible.
+**cert_utils** will attempt to process operations with Python via the modern
+[Cryptography](https://cryptography.io/en/latest/) package when possible.
 If the required Python libraries are not installed, it will fallback to using
 OpenSSL commandline via subprocesses.  **cert_utils** does a bit of work to
 standardize certificate operations across versions of Python and OpenSSL that

{cert_utils-0.1.18 → cert_utils-0.2.0}/README.md

@@ -4,12 +4,13 @@ cert_utils
 ==========
 
 **cert_utils** offers support for common operations when dealing with SSL
-Certificates within the LetsEncrypt ecosystem.
+Certificates, specifically within the LetsEncrypt ecosystem.
 
 This library was originally developed as a toolkit for bugfixing and
 troubleshooting large ACME installations.
 
-**cert_utils** will attempt to process operations with Python when possible.
+**cert_utils** will attempt to process operations with Python via the modern
+[Cryptography](https://cryptography.io/en/latest/) package when possible.
 If the required Python libraries are not installed, it will fallback to using
 OpenSSL commandline via subprocesses.  **cert_utils** does a bit of work to
 standardize certificate operations across versions of Python and OpenSSL that

cert_utils-0.2.0/pyproject.toml

@@ -0,0 +1,2 @@
+[tool.black]
+target-version = ['py37']

{cert_utils-0.1.18 → cert_utils-0.2.0}/setup.cfg

@@ -8,9 +8,15 @@ import_order_style = appnexus
 per-file-ignores = 
 	setup.py: E501
 	src/cert_utils/core.py: E501
+	src/cert_utils/compat/cryptography.py: E501
+	src/cert_utils/compat/openssl.py: E501
+	src/cert_utils/compat/pyopenssl.py: E501
+	src/cert_utils/conditionals.py: E501
+	src/cert_utils/convert.py: E501
 	src/cert_utils/letsencrypt_info.py: E501
+	src/cert_utils/model.py: E501
+	src/cert_utils/scripts/cert_info.py: E501
 	src/cert_utils/utils.py: E203, E501
-	
 	tests/_utils.py: E501
 	tests/test_data/long_chains/TestA/_demo.py: E501
 	tests/test_unit.py: E501, F841

{cert_utils-0.1.18 → cert_utils-0.2.0}/setup.py

@@ -2,7 +2,6 @@
 """
 import os
 import re
-import sys
 
 from setuptools import find_packages
 from setuptools import setup
@@ -26,7 +25,7 @@ requires = [
 ]
 tests_require = [
     "certbot",
-    "cryptography",
+    "cryptography>=42.0.0",
     "josepy",
     "mypy",
     "pytest",
@@ -35,20 +34,6 @@ tests_require = [
     "types-requests",
 ]
 
-# PyOpenSSL Version Pinning
-#   23.1.0 is a bad release, see
-#   https://github.com/pyca/pyopenssl/issues/1199
-if (sys.version_info.major == 3) and (sys.version_info.minor == 6):
-    # PyOpenSSl 23.2.0 introduces a backwards incompatible change
-    #   Invalid versions are now rejected in OpenSSL.crypto.X509Req.set_version.
-    # The `acme` package (via Certbot) ends support for py3.6 on version `v1.23.0`
-    #   v1.23.0 calls make_csr with a bad version, and does not pin PyOpenSSL
-    tests_require.append("PyOpenSSL>=17.5.0,!=23.1.0,<23.2.0")
-    tests_require.append("types-PyOpenSSL>=17.5.0,!=23.1.0,<23.2.0")
-else:
-    tests_require.append("PyOpenSSL>=17.5.0,!=23.1.0")
-    tests_require.append("types-PyOpenSSL>=17.5.0,!=23.1.0")
-
 testing_extras = tests_require + []
 
 setup(
@@ -79,7 +64,6 @@ setup(
         "Intended Audience :: Developers",
         "Programming Language :: Python",
         "Programming Language :: Python :: 3",
-        "Programming Language :: Python :: 3.6",
         "Programming Language :: Python :: 3.7",
         "Programming Language :: Python :: 3.8",
         "Programming Language :: Python :: 3.9",

{cert_utils-0.1.18 → cert_utils-0.2.0}/src/cert_utils/__init__.py

@@ -1,5 +1,7 @@
+from .convert import *  # noqa: F401, F403
 from .core import *  # noqa: F401, F403
+from .utils import *  # noqa: F401, F403
 
 # ==============================================================================
 
-__VERSION__ = "0.1.18"
+__VERSION__ = "0.2.0"

cert_utils-0.2.0/src/cert_utils/compat/cryptography.py

@@ -0,0 +1,168 @@
+# stdlib
+import base64
+import binascii
+import hashlib
+from typing import List
+from typing import Optional
+from typing import Tuple
+from typing import TYPE_CHECKING
+from typing import Union
+
+# locals
+from .. import conditionals
+from ..utils import CERT_PEM_REGEX
+
+if TYPE_CHECKING:
+    from cryptography.x509 import Certificate
+    from cryptography.x509 import CertificateSigningRequest
+    from cryptography.x509.name import Name
+    from ..core import _TYPES_CRYPTOGRAPHY_PUBLICKEY
+    from ..core import _TYPES_CRYPTOGRAPHY_KEYS
+    from ..core import _TYPES_CRYPTOGRAPHY_PUBLICKEY_EXTENDED
+
+
+# ==============================================================================
+
+
+def _format_cryptography_components(
+    x509_name: "Name",
+) -> str:
+    """
+    :param data: input
+
+
+    `get_components()` is somewhat structured
+    the following are valid:
+    * [('CN', 'Pebble Intermediate CA 601ea1')]
+    * [('C', 'US'), ('O', 'Internet Security Research Group'), ('CN', 'ISRG Root X2')]
+    * [('C', 'US'), ('O', 'Internet Security Research Group'), ('CN', 'ISRG Root X1')]
+    * [('O', 'Digital Signature Trust Co.'), ('CN', 'DST Root CA X3')]
+    cert = openssl_crypto.load_certificate(openssl_crypto.FILETYPE_PEM, cert_pem)
+    _issuer = cert.get_issuer().get_components()
+    _subject = cert.get_subject().get_components()
+    """
+    # ";".join(["%s=%s" % (i[0], i[1]) for i in x509_name])
+    _out = []
+    for attr in x509_name:
+        _converted = [i.decode("utf8") if isinstance(i, bytes) else i for i in (attr.rfc4514_attribute_name, attr.value)]  # type: ignore[attr-defined]
+        _out.append("=".join(_converted))
+    out = "\n".join(_out).strip()
+    return out
+
+
+def _cryptography__public_key_technology(
+    publickey: "_TYPES_CRYPTOGRAPHY_PUBLICKEY",
+) -> Optional[str]:
+    """
+    :param key: key object
+    :type key: instance of
+    :returns: type of key: RSA, EC, DSA
+    :rtype: str
+    """
+    if TYPE_CHECKING:
+        assert conditionals.crypto_rsa is not None
+        assert conditionals.crypto_ec is not None
+    if isinstance(publickey, conditionals.crypto_rsa.RSAPublicKey):
+        return "RSA"
+    elif isinstance(publickey, conditionals.crypto_ec.EllipticCurvePublicKey):
+        return "EC"
+    return None
+
+
+def _cryptography__public_key_spki_sha256(
+    cryptography_publickey: Union[
+        "_TYPES_CRYPTOGRAPHY_KEYS", "_TYPES_CRYPTOGRAPHY_PUBLICKEY_EXTENDED"
+    ],
+    as_b64: Optional[bool] = None,
+) -> str:
+    """
+    :param cryptography_publickey: a PublicKey from the cryptography package
+    :type cryptography_publickey: cryptography.hazmat.backends.openssl.rsa._RSAPublicKey
+    :param as_b64: Should the result be returned in Base64 encoding? default None
+    :type as_b64: boolean
+    :returns: spki_sha256
+    :rtype: str
+    """
+    assert (
+        conditionals.crypto_serialization is not None
+    )  # nest under `if TYPE_CHECKING` not needed
+    _public_bytes = cryptography_publickey.public_bytes(  # type: ignore[union-attr]
+        conditionals.crypto_serialization.Encoding.DER,
+        conditionals.crypto_serialization.PublicFormat.SubjectPublicKeyInfo,
+    )
+    spki_sha256 = hashlib.sha256(_public_bytes).digest()
+    if as_b64:
+        spki_sha256 = base64.b64encode(spki_sha256)
+    else:
+        spki_sha256 = binascii.b2a_hex(spki_sha256)
+        spki_sha256 = spki_sha256.upper()
+    _spki_sha256 = spki_sha256.decode("utf8")
+    return _spki_sha256
+
+
+def _cryptography__cert_or_req__all_names(
+    loaded_cert_or_req: Union["Certificate", "CertificateSigningRequest"],
+) -> List[str]:
+    assert conditionals.cryptography is not None
+    cn: Optional[str] = None
+    try:
+        _cn = loaded_cert_or_req.subject.get_attributes_for_oid(
+            conditionals.cryptography.x509.oid.NameOID.COMMON_NAME
+        )[0].value
+        cn = _cn.decode() if isinstance(_cn, bytes) else _cn
+    except IndexError:
+        pass
+    sans: List[str] = []
+    try:
+        ext = loaded_cert_or_req.extensions.get_extension_for_oid(
+            conditionals.cryptography.x509.oid.ExtensionOID.SUBJECT_ALTERNATIVE_NAME
+        )
+        _sans = ext.value.get_values_for_type(conditionals.cryptography.x509.DNSName)  # type: ignore[attr-defined]
+        sans = [san.decode() if isinstance(san, bytes) else san for san in _sans]
+
+    except conditionals.cryptography.x509.ExtensionNotFound:
+        pass
+    if cn is None:
+        return sans
+    return [cn] + [d for d in sans if d != cn]
+
+
+def cryptography__cert_and_chain_from_fullchain(fullchain_pem: str) -> Tuple[str, str]:
+    """Split fullchain_pem into cert_pem and chain_pem
+
+    :param str fullchain_pem: concatenated cert + chain
+
+    :returns: tuple of string cert_pem and chain_pem
+    :rtype: tuple
+
+    :raises errors.Error: If there are less than 2 certificates in the chain.
+
+    """
+    # First pass: find the boundary of each certificate in the chain.
+    # TODO: This will silently skip over any "explanatory text" in between boundaries,
+    # which is prohibited by RFC8555.
+    if TYPE_CHECKING:
+        assert conditionals.cryptography is not None
+        assert conditionals.crypto_serialization is not None
+
+    certs = CERT_PEM_REGEX.findall(fullchain_pem)
+    if len(certs) < 2:
+        raise ValueError(
+            "failed to parse fullchain into cert and chain: "
+            + "less than 2 certificates in chain"
+        )
+
+    # Second pass: for each certificate found, parse it using OpenSSL and re-encode it,
+    # with the effect of normalizing any encoding variations (e.g. CRLF, whitespace).
+    certs_normalized = []
+    for cert_pem in certs:
+        cert = conditionals.cryptography.x509.load_pem_x509_certificate(
+            cert_pem.encode()
+        )
+        cert_pem = cert.public_bytes(
+            conditionals.crypto_serialization.Encoding.PEM
+        ).decode()
+        certs_normalized.append(cert_pem)
+
+    # Since each normalized cert has a newline suffix, no extra newlines are required.
+    return (certs_normalized[0], "".join(certs_normalized[1:]))

cert_utils-0.2.0/src/cert_utils/compat/deprecated.py

@@ -0,0 +1,24 @@
+# local
+from ..errors import OpenSslError
+
+
+# ==============================================================================
+
+
+def _cleanup_openssl_md5(data: bytes) -> str:
+    """
+    some versions of openssl handle the md5 as:
+        '1231231231'
+    others handle as
+        "(stdin)= 123123'
+    """
+    data = data.strip()
+    data_str = data.decode("utf8")
+    if len(data_str) == 32 and (data_str[:9] != "(stdin)= "):
+        return data_str
+    if data_str[:9] != "(stdin)= " or not data_str:
+        raise OpenSslError("error reading md5 (i)")
+    data_str = data_str[9:]
+    if len(data_str) != 32:
+        raise OpenSslError("error reading md5 (ii)")
+    return data_str