openbadgeslib 3.6.0__tar.gz → 3.8.0__tar.gz

{openbadgeslib-3.6.0 → openbadgeslib-3.8.0}/Changelog.txt

@@ -4,6 +4,92 @@ OpenBadgesLib - Changelog
 Newest first. Dates are ISO 8601 (YYYY-MM-DD).
 
 
+* v3.8.0 - 2026-07-08
+
+  - security(ob3): status lists gain replay protection and opt-in proof
+    verification, closing two documented trust gaps. (1) A per-badge
+    `status_validity_days` makes published lists carry a `validUntil`, and the
+    reader now enforces the list's validFrom/validUntil window — a lapsed
+    (replayed, or no-longer-republished) `revocation.jwt` is rejected instead
+    of silently resurrecting a revoked badge. (2)
+    `check_credential_status(..., verify_list=True)` (and
+    `OB3Verifier.check_status(..., verify_list=True)`) additionally verifies
+    the status list credential's own JWT-VC proof and binds its issuer to the
+    badge's, so a compromised status host cannot serve a validly-shaped list
+    that silently un-revokes. The list is signed with the badge key, so that
+    same key (reused automatically) verifies it; a did:web/did:key issuer is
+    resolved otherwise. Both are opt-in — the default stays a single
+    offline-friendly fetch, no behaviour break. (#164)
+
+
+* v3.7.0 - 2026-07-08
+
+  - security(deps): `keys.py` (and the OB1 key-loading path) are ported to
+    `cryptography`, and both `pycryptodome` and `python-ecdsa` are dropped as
+    dependencies. They only generated and parsed key material here — signing
+    always went through PyJWT+`cryptography` — all of which `cryptography`
+    (already a hard dependency via `PyJWT[crypto]`) covers. This removes
+    python-ecdsa's permanent pip-audit flag (CVE-2024-23342 "Minerva", wontfix
+    upstream), moves ECC key generation onto constant-time code, and shrinks
+    the install to a single crypto backend. PEM output is byte-compatible
+    (PKCS#1 `RSA PRIVATE KEY`, SEC1 `EC PRIVATE KEY`, SubjectPublicKeyInfo
+    public keys), so existing key files round-trip. `key_to_pem` still accepts
+    a live pycryptodome/python-ecdsa key object via a soft import, for a caller
+    predating the port. (#167)
+
+  - feat(cli): `--json` machine-readable output and a documented exit-code
+    contract for `openbadges-signer`, `openbadges-publish` and
+    `openbadges-keygenerator` (the verifier already had one), so issuance can
+    be automated without scraping human text. Each prints exactly one JSON
+    object to stdout — the signer `{ob_version, badge_file, jti, status_index,
+    proof_format}`, the keygenerator `{key_type, private_key, public_key}`,
+    publish `{did, files_written, status_operation, skipped}`, and
+    `--list`/`--status` the queried records — under a shared exit contract:
+    `0` success, `2` partial (some badges skipped), `1` any error (reported as
+    `{"error": "..."}`). Human output and its historical (inconsistent) exit
+    codes are untouched — unifying those is reserved for 4.0.0. `publish
+    --json` is OpenBadges 3.0 only. (#166)
+
+  - feat(ob3): JWT-VC verification now honours the token's `kid` header for a
+    multi-key did:web issuer. `OB3Verifier.for_issuer_did` fetches the DID
+    document once and selects the exact `verificationMethod` the kid names (an
+    absolute `did:web:…#badge_N` URL, or a bare `#badge_N` resolved against the
+    issuer DID), so issuers that rotate keys or publish one key per badge now
+    verify without pinning `-k`/`-l` — closing the gap where only the first
+    listed key worked. Fails closed when the kid names a method of a *different*
+    DID (the header is attacker-controlled) or one absent from the document; a
+    token with no kid still falls back to the first method. (#163)
+
+  - feat(ob1): OpenBadges 1.0 is now deprecated (removal scheduled for the
+    grouped 4.0.0 release, #170). Reaching the legacy import surface — the
+    `openbadgeslib.ob1` package, the top-level `openbadgeslib.badge` /
+    `openbadgeslib.signer` / `openbadgeslib.verifier` shims, and the
+    unprefixed `openbadgeslib.Signer` / `Verifier` / `Badge` / … re-exports —
+    now emits a `DeprecationWarning`, and the `-V 1` CLI paths (signer,
+    verifier, publish) print a `[!]` notice (suppressed under the verifier's
+    `--json`, so machine output stays clean). OB1 stays fully functional; a
+    bare `import openbadgeslib` and the OB2/OB3 APIs stay silent. OpenBadges
+    2.0 is **not** affected — it remains fully supported. The lifecycle policy
+    and the rejected alternatives (a `[legacy]` extra, a separate PyPI
+    package) are recorded on the "Python API OB1" wiki page. (#159)
+
+  - feat(publish): `openbadges-publish -V 3` gains two read-only registry
+    query commands, closing the credential lifecycle from the CLI
+    (issue → revoke → audit). `--list [-b badge]` tabulates every issued
+    credential — jti, recipient, issue date and state (active / REVOKED /
+    SUSPENDED); `--status <jti|email>` prints the full record of the matching
+    credential(s), including the revocation or suspension date and reason.
+    Both read only the private status registries, so neither needs an output
+    directory (`-o`). (#157)
+
+  - refactor(cli): `openbadges-keygenerator` no longer accepts the decorative
+    `-V/--ob-version` flag. Key material never depended on the OpenBadges
+    version (the algorithm comes from the badge's `key_type`), so the flag only
+    changed a log line. Internal tidy-ups alongside it: a dead `if args.badge`
+    guard in the signer (`-b` is required), the redundant `tests/runtests.sh`
+    wrapper, and an inaccurate conftest comment. (#156)
+
+
 * v3.6.0 - 2026-07-08
 
   - feat(ob3): the verifier now exposes the raw, already-validated VC document

{openbadgeslib-3.6.0/openbadgeslib.egg-info → openbadgeslib-3.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openbadgeslib
-Version: 3.6.0
+Version: 3.8.0
 Summary: Production-ready Python library & CLI for Open Badges 3.0 (W3C Verifiable Credentials): issue, verify, and revoke JWT-VC credentials with Bitstring Status Lists and did:web — plus strict OB 2.0 and legacy OB 1.0.
 Author-email: Luis González Fernández <luisgf@luisgf.es>, Jesús Cea Avión <jcea@jcea.es>
 License: LGPLv3
@@ -29,8 +29,6 @@ Classifier: License :: OSI Approved :: GNU Lesser General Public License v3 (LGP
 Requires-Python: >=3.10
 Description-Content-Type: text/markdown
 License-File: LICENSE.txt
-Requires-Dist: pycryptodome>=3.20
-Requires-Dist: ecdsa>=0.19
 Requires-Dist: pypng>=0.20220715.0
 Requires-Dist: PyJWT[crypto]>=2.8
 Requires-Dist: cryptography>=42
@@ -136,8 +134,6 @@ all three OB versions.
 ## Requirements
 
 - Python >= 3.10 (tested on 3.10–3.14)
-- [pycryptodome](https://pypi.org/project/pycryptodome/) >= 3.20
-- [ecdsa](https://pypi.org/project/ecdsa/) >= 0.19
 - [pypng](https://pypi.org/project/pypng/) >= 0.20220715.0
 - [PyJWT[crypto]](https://pypi.org/project/PyJWT/) >= 2.8
 - [cryptography](https://pypi.org/project/cryptography/) >= 42

{openbadgeslib-3.6.0 → openbadgeslib-3.8.0}/README.md

@@ -85,8 +85,6 @@ all three OB versions.
 ## Requirements
 
 - Python >= 3.10 (tested on 3.10–3.14)
-- [pycryptodome](https://pypi.org/project/pycryptodome/) >= 3.20
-- [ecdsa](https://pypi.org/project/ecdsa/) >= 0.19
 - [pypng](https://pypi.org/project/pypng/) >= 0.20220715.0
 - [PyJWT[crypto]](https://pypi.org/project/PyJWT/) >= 2.8
 - [cryptography](https://pypi.org/project/cryptography/) >= 42

{openbadgeslib-3.6.0 → openbadgeslib-3.8.0}/openbadgeslib/__init__.py

@@ -21,17 +21,7 @@
         License along with this library.
 """
 
-# ── OpenBadges 1.0 (legacy) ─────────────────────────────────────────────────────
-# The classes formerly exposed as "OpenBadges 2.0" are the pre-2.0 wire format
-# (no @context/type, uid, verify{}, Unix timestamps). They are re-exported here
-# unchanged for backward compatibility; the strict OB 2.0 implementation lives
-# in openbadgeslib.ob2 (OB2Signer/OB2Verifier).
-from .ob1 import (  # noqa: F401
-    Signer, Verifier, VerifyInfo,
-    Badge, BadgeSigned, Assertion,
-    BadgeStatus, BadgeImgType, BadgeType,
-    extract_svg_assertion, extract_png_assertion,
-)
+from typing import Any
 
 # ── OpenBadges 2.0 (strict) ──────────────────────────────────────────────────
 from .ob2 import (  # noqa: F401
@@ -47,3 +37,34 @@ from .ob3 import (  # noqa: F401
 # ── Shared utilities ────────────────────────────────────────────────────────────
 from .keys import KeyFactory, KeyRSA, KeyECC  # noqa: F401
 from .util import __version__  # noqa: F401
+
+
+# ── OpenBadges 1.0 (legacy) ──────────────────────────────────────────────────
+# The unprefixed OB1 names (Signer, Verifier, Badge, …) stay importable from
+# the top-level package for backward compatibility, but they are the legacy
+# OpenBadges 1.0 surface: accessing one now emits a DeprecationWarning
+# (removal in 4.0.0). Modern code uses openbadgeslib.ob2 / openbadgeslib.ob3.
+# They are resolved lazily from the ob1 leaf modules (PEP 562), so a bare
+# `import openbadgeslib` neither warns nor drags in the ob1 package.
+_OB1_API = {
+    'Signer': 'signer', 'Verifier': 'verifier', 'VerifyInfo': 'verifier',
+    'Badge': 'badge', 'BadgeSigned': 'badge', 'Assertion': 'badge',
+    'BadgeStatus': 'badge', 'BadgeImgType': 'badge', 'BadgeType': 'badge',
+    'extract_svg_assertion': 'badge', 'extract_png_assertion': 'badge',
+}
+
+
+def __getattr__(name: str) -> Any:
+    module = _OB1_API.get(name)
+    if module is None:
+        raise AttributeError(
+            'module %r has no attribute %r' % (__name__, name))
+    import importlib
+    import warnings
+    warnings.warn(
+        'openbadgeslib.%s is the legacy OpenBadges 1.0 API and is deprecated; '
+        'it will be removed in openbadgeslib 4.0.0. Use openbadgeslib.ob2 '
+        '(strict OB 2.0) or openbadgeslib.ob3 (OB 3.0). See the "OpenBadges '
+        '1.0 lifecycle" wiki page.' % name,
+        DeprecationWarning, stacklevel=2)
+    return getattr(importlib.import_module('.ob1.' + module, __name__), name)

{openbadgeslib-3.6.0 → openbadgeslib-3.8.0}/openbadgeslib/badge.py

@@ -1,10 +1,19 @@
 """OpenBadges 1.0 (legacy) badge objects — compatibility shim, re-exports from openbadgeslib.ob1."""
+import warnings
+
 from .ob1.badge import (
     BadgeStatus, BadgeImgType, BadgeType,
     Assertion, Badge, BadgeSigned,
     extract_svg_assertion, extract_png_assertion,
 )
 
+warnings.warn(
+    'openbadgeslib.badge is a legacy OpenBadges 1.0 compatibility shim and is '
+    'deprecated; it will be removed in openbadgeslib 4.0.0. Import from '
+    'openbadgeslib.ob2 (strict OB 2.0) or openbadgeslib.ob3 (OB 3.0) instead. '
+    'See the "OpenBadges 1.0 lifecycle" wiki page.',
+    DeprecationWarning, stacklevel=2)
+
 __all__ = [
     'BadgeStatus', 'BadgeImgType', 'BadgeType',
     'Assertion', 'Badge', 'BadgeSigned',

{openbadgeslib-3.6.0 → openbadgeslib-3.8.0}/openbadgeslib/confparser.py

@@ -105,6 +105,7 @@ class OB3StatusConfig:
     size_bits: int
     registry_path: str            # private index registry JSON
     list_urls: Dict[str, str]     # purpose -> public status list URL
+    validity_days: Optional[int] = None   # validUntil horizon; None => no bound
 
 
 def ob3_status_config(conf: ConfigParser,
@@ -140,6 +141,22 @@ def ob3_status_config(conf: ConfigParser,
         raise ValueError("[%s] status_size_bits must be an integer"
                          % badge_section) from None
 
+    # Optional validUntil horizon: when set, published status lists carry a
+    # validUntil = now + N days, and a verifier rejects a stale copy (replay
+    # protection). Unset => no bound (offline-friendly default). The issuer
+    # must republish within the window (see the wiki).
+    validity_raw = (conf[badge_section].get('status_validity_days') or '').strip()
+    validity_days: Optional[int] = None
+    if validity_raw:
+        try:
+            validity_days = int(validity_raw)
+        except ValueError:
+            raise ValueError("[%s] status_validity_days must be an integer"
+                             % badge_section) from None
+        if validity_days <= 0:
+            raise ValueError("[%s] status_validity_days must be positive"
+                             % badge_section)
+
     base_status = conf['paths'].get('base_status') or \
         os.path.join(conf['paths']['base'], 'status')
     registry_path = os.path.join(base_status, badge_section + '.json')
@@ -151,7 +168,8 @@ def ob3_status_config(conf: ConfigParser,
     list_urls = {p: urljoin(status_base, p + '.jwt') for p in purposes}
 
     return OB3StatusConfig(purposes=purposes, size_bits=size_bits,
-                           registry_path=registry_path, list_urls=list_urls)
+                           registry_path=registry_path, list_urls=list_urls,
+                           validity_days=validity_days)
 
 
 class ConfParser():

{openbadgeslib-3.6.0 → openbadgeslib-3.8.0}/openbadgeslib/keys.py

@@ -21,11 +21,17 @@
         License along with this library.
 """
 
+# Key material generation and parsing. All backed by ``cryptography`` (already
+# a hard dependency through PyJWT[crypto]); pycryptodome and python-ecdsa were
+# dropped in the 3.7 port (#167) — they only ever generated/parsed keys here,
+# never signed, and python-ecdsa carried a permanent pip-audit CVE flag
+# (CVE-2024-23342, Minerva). ``key_to_pem`` still accepts a live pycryptodome /
+# python-ecdsa key object via a soft import, for a caller predating the port.
+
 from typing import Any, Optional, Tuple, Union, cast
 from .errors import PublicKeyReadError, UnknownKeyType
-from ecdsa import SigningKey, VerifyingKey, NIST256p
-from Crypto.PublicKey import RSA
 from cryptography.hazmat.primitives import serialization as _crypto_serialization
+from cryptography.hazmat.primitives.asymmetric import ec, rsa
 from cryptography.hazmat.primitives.asymmetric.ed25519 import (
     Ed25519PrivateKey, Ed25519PublicKey)
 from enum import Enum
@@ -52,6 +58,27 @@ def KeyFactory(key_type: 'KeyType' = KeyType.RSA) -> 'Union[KeyRSA, KeyECC, KeyE
         raise UnknownKeyType()
 
 
+def _pem_bytes(key_pem: Union[str, bytes]) -> bytes:
+    return key_pem.encode('utf-8') if isinstance(key_pem, str) else key_pem
+
+
+def _private_pem(key: Any) -> bytes:
+    """Serialise an RSA/EC private key to a TraditionalOpenSSL PEM — PKCS#1
+    ``RSA PRIVATE KEY`` / SEC1 ``EC PRIVATE KEY``, exactly what pycryptodome and
+    python-ecdsa emitted, so existing key files round-trip unchanged."""
+    return cast(bytes, key.private_bytes(
+        _crypto_serialization.Encoding.PEM,
+        _crypto_serialization.PrivateFormat.TraditionalOpenSSL,
+        _crypto_serialization.NoEncryption()))
+
+
+def _public_pem(key: Any) -> bytes:
+    """Serialise a public key to a SubjectPublicKeyInfo ``PUBLIC KEY`` PEM."""
+    return cast(bytes, key.public_bytes(
+        _crypto_serialization.Encoding.PEM,
+        _crypto_serialization.PublicFormat.SubjectPublicKeyInfo))
+
+
 class KeyBase():
     def __init__(self) -> None:
         self.priv_key: Any = None         # crypto Object
@@ -73,67 +100,56 @@ class KeyRSA(KeyBase):
 
     def generate_keypair(self) -> Tuple[bytes, bytes]:
         """ Generate a RSA Key, returning in PEM Format """
-
-        # RSA Key Generation
-        self.priv_key = RSA.generate(self._key_size)
-        priv_key_pem = self.priv_key.export_key('PEM')
-        self.pub_key = self.priv_key.publickey()
-        pub_key_pem = self.pub_key.export_key('PEM')
-
-        return priv_key_pem, pub_key_pem
+        self.priv_key = rsa.generate_private_key(
+            public_exponent=65537, key_size=self._key_size)
+        self.pub_key = self.priv_key.public_key()
+        return self.get_priv_key_pem(), self.get_pub_key_pem()
 
     def read_private_key(self, key_pem: Any = None) -> None:
         """ Read the private key from param in PEM format """
-        self.priv_key = RSA.import_key(key_pem)
+        self.priv_key = _crypto_serialization.load_pem_private_key(
+            _pem_bytes(key_pem), password=None)
 
     def read_public_key(self, key_pem: Any = None) -> None:
         """ Read the public key from param in PEM format """
-        self.pub_key = RSA.import_key(key_pem)
+        self.pub_key = _crypto_serialization.load_pem_public_key(
+            _pem_bytes(key_pem))
 
     def get_priv_key_pem(self) -> bytes:
-        return cast(bytes, self.priv_key.export_key('PEM'))
+        return _private_pem(self.priv_key)
 
     def get_pub_key_pem(self) -> bytes:
-        return cast(bytes, self.pub_key.export_key('PEM'))
+        return _public_pem(self.pub_key)
 
 
 class KeyECC(KeyBase):
-    """ Elliptic Curve Cryptography Factory class """
+    """ Elliptic Curve Cryptography Factory class (NIST P-256 / ES256) """
 
-    def __init__(self, key_curve: Any = NIST256p) -> None:
-        self._key_curve = key_curve
+    def __init__(self, key_curve: Any = None) -> None:
+        self._key_curve = key_curve or ec.SECP256R1()
         super().__init__()
 
     def generate_keypair(self) -> Tuple[bytes, bytes]:
-        """ Generate a ECDSA keypair """
-
-        # Private key generation
-        self.priv_key = SigningKey.generate(curve=self._key_curve)
-        priv_key_pem = self.priv_key.to_pem()
-
-        # Derive the public (verifying) key from the private key.
-        self.pub_key = self.priv_key.get_verifying_key()
-        pub_key_pem = self.pub_key.to_pem()
-
-        return priv_key_pem, pub_key_pem
+        """ Generate an ECDSA keypair """
+        self.priv_key = ec.generate_private_key(self._key_curve)
+        self.pub_key = self.priv_key.public_key()
+        return self.get_priv_key_pem(), self.get_pub_key_pem()
 
-    def read_private_key(self, key_pem: Optional[Union[str, bytes]] = None) -> None:
+    def read_private_key(self, key_pem: Any = None) -> None:
         """ Read the private key from param in PEM format """
-        self.priv_key = SigningKey.from_pem(key_pem)
+        self.priv_key = _crypto_serialization.load_pem_private_key(
+            _pem_bytes(key_pem), password=None)
 
-    def read_public_key(self, key_pem: Optional[Union[str, bytes]] = None) -> None:
+    def read_public_key(self, key_pem: Any = None) -> None:
         """ Read the public key from param in PEM format """
-        self.pub_key = VerifyingKey.from_pem(key_pem)
+        self.pub_key = _crypto_serialization.load_pem_public_key(
+            _pem_bytes(key_pem))
 
     def get_priv_key_pem(self) -> bytes:
-        return cast(bytes, self.priv_key.to_pem())
+        return _private_pem(self.priv_key)
 
     def get_pub_key_pem(self) -> bytes:
-        return cast(bytes, self.pub_key.to_pem())
-
-
-def _pem_bytes(key_pem: Union[str, bytes]) -> bytes:
-    return key_pem.encode('utf-8') if isinstance(key_pem, str) else key_pem
+        return _public_pem(self.pub_key)
 
 
 def _load_ed25519_private_key(key_pem: Optional[Union[str, bytes]]) -> Ed25519PrivateKey:
@@ -158,8 +174,8 @@ class KeyEd25519(KeyBase):
     """Edwards-curve Ed25519 (EdDSA) key class, backed by ``cryptography``.
 
     Kept separate from KeyECC: Ed25519 is an EdDSA curve, not an ECDSA NIST
-    curve. It maps to the JWS ``EdDSA`` algorithm, and the ``ecdsa`` library
-    used for the NIST curves would misread its PEM (see detect_key_type).
+    curve. It maps to the JWS ``EdDSA`` algorithm, and its PEM is PKCS#8
+    (Ed25519 has no TraditionalOpenSSL encoding).
     """
 
     def generate_keypair(self) -> Tuple[bytes, bytes]:
@@ -183,9 +199,7 @@ class KeyEd25519(KeyBase):
             _crypto_serialization.NoEncryption()))
 
     def get_pub_key_pem(self) -> bytes:
-        return cast(bytes, self.pub_key.public_bytes(
-            _crypto_serialization.Encoding.PEM,
-            _crypto_serialization.PublicFormat.SubjectPublicKeyInfo))
+        return _public_pem(self.pub_key)
 
 
 def alg_for_key_type(key_type: 'KeyType') -> str:
@@ -199,28 +213,54 @@ def alg_for_key_type(key_type: 'KeyType') -> str:
     raise UnknownKeyType('No signing algorithm for key type: %r' % (key_type,))
 
 
+def _legacy_key_to_pem(key: Any) -> Optional[Union[str, bytes]]:
+    """Best-effort PEM for a live pycryptodome RSA or python-ecdsa key object.
+
+    Kept for backward compatibility with a caller still holding one from before
+    the cryptography port (#167). Both libraries were dropped as dependencies,
+    so this soft-imports them and returns ``None`` when they are absent (or the
+    object is neither) — the caller then raises UnknownKeyType.
+    """
+    try:
+        from Crypto.PublicKey import RSA as _RSA
+        if isinstance(key, _RSA.RsaKey):
+            return cast(bytes, key.export_key('PEM'))
+    except ImportError:
+        pass
+    try:
+        from ecdsa import SigningKey as _SigningKey, VerifyingKey as _VerifyingKey
+        if isinstance(key, (_SigningKey, _VerifyingKey)):
+            return cast(Union[str, bytes], key.to_pem())
+    except ImportError:
+        pass
+    return None
+
+
 def key_to_pem(key: Any) -> Union[str, bytes]:
-    """Convert a pycryptodome RSA or ecdsa key object to PEM bytes.
+    """Convert a key object to PEM bytes.
 
-    Bytes/str are passed through unchanged. Centralised here so the OB2 JWS
-    layer and both OB3 signer/verifier share one implementation instead of
-    three hand-maintained copies.
+    Handles ``cryptography`` key objects (what keys.py and ob1.badge now
+    produce) and passes bytes/str through unchanged; a live pycryptodome /
+    python-ecdsa object is still accepted via :func:`_legacy_key_to_pem`.
+    Centralised here so the OB1/OB2 JWS layer and both OB3 signer/verifier
+    share one implementation instead of hand-maintained copies.
     """
-    if isinstance(key, RSA.RsaKey):
-        return key.export_key('PEM')
-    if isinstance(key, (SigningKey, VerifyingKey)):
-        return cast(Union[str, bytes], key.to_pem())
+    if isinstance(key, (bytes, str)):
+        return key
+    if isinstance(key, (rsa.RSAPrivateKey, ec.EllipticCurvePrivateKey)):
+        return _private_pem(key)
+    if isinstance(key, (rsa.RSAPublicKey, ec.EllipticCurvePublicKey)):
+        return _public_pem(key)
     if isinstance(key, Ed25519PrivateKey):
         return key.private_bytes(
             _crypto_serialization.Encoding.PEM,
             _crypto_serialization.PrivateFormat.PKCS8,
             _crypto_serialization.NoEncryption())
     if isinstance(key, Ed25519PublicKey):
-        return key.public_bytes(
-            _crypto_serialization.Encoding.PEM,
-            _crypto_serialization.PublicFormat.SubjectPublicKeyInfo)
-    if isinstance(key, (bytes, str)):
-        return key
+        return _public_pem(key)
+    legacy = _legacy_key_to_pem(key)
+    if legacy is not None:
+        return legacy
     raise UnknownKeyType('Unsupported key object type: %r' % type(key))
 
 
@@ -232,7 +272,6 @@ def public_jwk_from_pem(pubkey_pem: Union[str, bytes]) -> dict[str, Any]:
     verification keys in a did:web DID document.
     """
     import json
-    from cryptography.hazmat.primitives.asymmetric import ec, rsa
     from jwt.algorithms import ECAlgorithm, OKPAlgorithm, RSAAlgorithm
     try:
         pub = _crypto_serialization.load_pem_public_key(_pem_bytes(pubkey_pem))
@@ -262,7 +301,6 @@ def ec_curve_from_pem(pem_data: Union[str, bytes]) -> Optional[str]:
     uses this to pick the ES256 vs ES384 signing backend — the ECDSA curve
     fixes the JOSE algorithm.
     """
-    from cryptography.hazmat.primitives.asymmetric import ec
     data = _pem_bytes(pem_data)
     for load in (
         lambda: _crypto_serialization.load_pem_public_key(data),
@@ -279,53 +317,30 @@ def ec_curve_from_pem(pem_data: Union[str, bytes]) -> Optional[str]:
     return None
 
 
-def _is_ed25519_pem(pem_data: Union[str, bytes]) -> bool:
-    """True if pem_data is an Ed25519 public or private key.
+def detect_key_type(pem_data: Union[str, bytes]) -> 'KeyType':
+    """Positive key-type detection via ``cryptography``'s PEM loaders.
 
-    Probed before the RSA/ECC checks in detect_key_type: the ``ecdsa`` library's
-    VerifyingKey/SigningKey.from_pem *accept* an Ed25519 PEM and would otherwise
-    misclassify it as KeyType.ECC, pinning the wrong (ES*) algorithm family.
-    ``cryptography``'s loaders are unambiguous about the key type.
+    Accepts a public or private PEM and distinguishes Ed25519/RSA/EC by the
+    loaded key's concrete type — cryptography's loaders are unambiguous, unlike
+    the old python-ecdsa loader which accepted an Ed25519 PEM as an EC key and
+    forced the wrong (ES*) algorithm family.
     """
     data = _pem_bytes(pem_data)
-    try:
-        if isinstance(_crypto_serialization.load_pem_public_key(data), Ed25519PublicKey):
-            return True
-    except Exception:
-        pass
-    try:
-        if isinstance(_crypto_serialization.load_pem_private_key(data, password=None),
-                      Ed25519PrivateKey):
-            return True
-    except Exception:
-        pass
-    return False
-
-
-def detect_key_type(pem_data: Union[str, bytes]) -> 'KeyType':
-    """ Positive Key type detection """
+    key: Any = None
+    for load in (
+        lambda: _crypto_serialization.load_pem_public_key(data),
+        lambda: _crypto_serialization.load_pem_private_key(data, password=None),
+    ):
+        try:
+            key = load()
+            break
+        except Exception:
+            continue
 
-    # Ed25519 first: see _is_ed25519_pem — the ecdsa library would otherwise
-    # claim an Ed25519 PEM as ECC below.
-    if _is_ed25519_pem(pem_data):
+    if isinstance(key, (Ed25519PrivateKey, Ed25519PublicKey)):
         return KeyType.ED25519
-
-    try:
-        RSA.import_key(pem_data)
+    if isinstance(key, (rsa.RSAPrivateKey, rsa.RSAPublicKey)):
         return KeyType.RSA
-    except Exception:
-        pass
-
-    try:
-        VerifyingKey.from_pem(pem_data)
-        return KeyType.ECC
-    except Exception:
-        pass
-
-    try:
-        SigningKey.from_pem(pem_data)
+    if isinstance(key, (ec.EllipticCurvePrivateKey, ec.EllipticCurvePublicKey)):
         return KeyType.ECC
-    except Exception:
-        pass
-
     raise UnknownKeyType('Unable to guess Key type')

{openbadgeslib-3.6.0 → openbadgeslib-3.8.0}/openbadgeslib/mail.py

@@ -29,7 +29,7 @@ from email.mime.multipart import MIMEMultipart
 from email.mime.text import MIMEText
 from email.utils import formatdate
 from email.header import Header
-from .ob1 import BadgeImgType
+from .ob1.badge import BadgeImgType  # leaf import: avoids the ob1 deprecation warning
 from .errors import BadgeImgFormatUnsupported
 
 

openbadgeslib-3.8.0/openbadgeslib/ob1/__init__.py

@@ -0,0 +1,61 @@
+"""
+        OpenBadges Library
+
+        Copyright (c) 2014-2026, Luis González Fernández, luisgf@luisgf.es
+        Copyright (c) 2014-2026, Jesús Cea Avión, jcea@jcea.es
+
+        All rights reserved.
+
+        This library is free software; you can redistribute it and/or
+        modify it under the terms of the GNU Lesser General Public
+        License as published by the Free Software Foundation; either
+        version 3.0 of the License, or (at your option) any later version.
+
+        This library is distributed in the hope that it will be useful,
+        but WITHOUT ANY WARRANTY; without even the implied warranty of
+        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+        Lesser General Public License for more details.
+
+        You should have received a copy of the GNU Lesser General Public
+        License along with this library.
+"""
+
+# OpenBadges 1.0 is a dead format (Mozilla Backpack shut down in 2019) and is
+# deprecated: it will be removed in openbadgeslib 4.0.0 (see the "OpenBadges
+# 1.0 lifecycle" wiki page). Reaching the OB1 API *through this package* —
+# `from openbadgeslib.ob1 import Signer`, `openbadgeslib.ob1.Badge` — emits a
+# DeprecationWarning. Migrate to openbadgeslib.ob2 (strict OB 2.0) or
+# openbadgeslib.ob3 (OB 3.0).
+#
+# The symbols are resolved lazily (PEP 562) from their leaf modules, so the
+# warning fires on the deprecated *package* surface only. Library internals
+# that still need the shared, config-driven badge model import it straight
+# from openbadgeslib.ob1.badge (BadgeImgType, Badge) and stay silent.
+import importlib
+import warnings
+from typing import Any
+
+#: Public OB1 name -> the leaf submodule that defines it.
+_OB1_API = {
+    'BadgeStatus': 'badge', 'BadgeImgType': 'badge', 'BadgeType': 'badge',
+    'Assertion': 'badge', 'Badge': 'badge', 'BadgeSigned': 'badge',
+    'extract_svg_assertion': 'badge', 'extract_png_assertion': 'badge',
+    'Signer': 'signer', 'Verifier': 'verifier', 'VerifyInfo': 'verifier',
+}
+
+__all__ = list(_OB1_API)
+
+_OB1_DEPRECATION = (
+    'openbadgeslib.ob1 (OpenBadges 1.0) is deprecated and will be removed in '
+    'openbadgeslib 4.0.0; migrate to openbadgeslib.ob2 (strict OB 2.0) or '
+    'openbadgeslib.ob3 (OB 3.0). See the "OpenBadges 1.0 lifecycle" wiki page.'
+)
+
+
+def __getattr__(name: str) -> Any:
+    module = _OB1_API.get(name)
+    if module is None:
+        raise AttributeError(
+            'module %r has no attribute %r' % (__name__, name))
+    warnings.warn(_OB1_DEPRECATION, DeprecationWarning, stacklevel=2)
+    return getattr(importlib.import_module('.' + module, __name__), name)