python-nss-ng 1.1.0__tar.gz → 1.2.1__tar.gz

python_nss_ng-1.2.1/.git_archival.txt

@@ -0,0 +1,4 @@
+node: 0dedcdfba5bdf88fee5c42918949cb6403738886
+node-date: 2026-06-30T09:23:01-06:00
+describe-name: v1.2.1
+ref-names: grafted, HEAD, tag: v1.2.1, origin/main, origin/HEAD

{python_nss_ng-1.1.0 → python_nss_ng-1.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: python-nss-ng
-Version: 1.1.0
+Version: 1.2.1
 Summary: Python bindings for Network Security Services (NSS) and Netscape Portable Runtime (NSPR)
 Keywords: nss,nspr,cryptography,ssl,tls,pki,x509,security
 Author-Email: John Dennis <jdennis@redhat.com>, Matthew Watkins <mwatkins@linuxfoundation.org>

python_nss_ng-1.2.1/SECURITY.md

@@ -0,0 +1,77 @@
+<!--
+SPDX-License-Identifier: Apache-2.0
+SPDX-FileCopyrightText: 2026 The Linux Foundation
+-->
+
+# Security Policy
+
+This document describes the security policy for this repository, including
+which versions receive security updates and how to report vulnerabilities.
+
+## Supported Versions
+
+Maintainers develop and merge security fixes on the default branch
+(`main`) and publish those fixes in the latest tagged release. Older
+releases and tags do not receive security updates. Users should track
+the latest tagged release for security patches.
+
+| Version               | Supported          |
+| --------------------- | ------------------ |
+| Latest tagged release | :white_check_mark: |
+| Older releases/tags   | :x:                |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability in this project, please report it
+**privately** so that maintainers can investigate and release a fix before
+the issue becomes publicly known.
+
+### Preferred: GitHub Private Vulnerability Reporting
+
+Use GitHub's private vulnerability reporting feature:
+
+1. Navigate to the **Security** tab of this repository.
+2. Click **Report a vulnerability**.
+3. Provide as much detail as possible (see below).
+
+This creates a private advisory visible to maintainers.
+
+### Alternative: Email
+
+If you cannot use GitHub's private reporting, send an email to the Linux
+Foundation Release Engineering team at:
+
+- **<releng@linuxfoundation.org>**
+
+Please do **not** report security vulnerabilities through public GitHub
+issues, discussions, or pull requests.
+
+### What to Include
+
+To help maintainers triage and resolve the report, please include:
+
+- A clear description of the vulnerability and its potential impact.
+- Steps to reproduce the issue (proof-of-concept code or commands).
+- The affected version(s), commit SHA, or release tag.
+- Any known mitigations or workarounds.
+- Your name and contact details for follow-up (optional).
+
+## Response Process
+
+Maintainers will acknowledge receipt of vulnerability reports within
+**5 business days**. We aim to:
+
+1. Confirm the vulnerability and determine its severity.
+2. Develop and test a fix in a private branch or advisory.
+3. Coordinate a disclosure timeline with the reporter.
+4. Release a patched version and publish a security advisory.
+
+We follow a responsible disclosure process and credit reporters in the
+published advisory unless they request to remain anonymous.
+
+## Scope
+
+This policy covers the source code, configuration, and documentation
+in this repository. Please report vulnerabilities in upstream
+dependencies to their respective maintainers; this project will update
+affected dependencies once fixes become available.

python_nss_ng-1.2.1/_version.txt

@@ -0,0 +1 @@
+1.2.1

{python_nss_ng-1.1.0 → python_nss_ng-1.2.1}/pyproject.toml

@@ -319,3 +319,9 @@ before-all = "yum install -y nss-devel nspr-devel pkg-config || apt-get update &
 
 [tool.cibuildwheel.macos]
 before-all = "brew install nss nspr pkg-config"
+
+[tool.uv]
+# Supply-chain cooldown: do not resolve anything published in the last
+# 7 days (rolling window; uv records it as a relative span in uv.lock).
+# Requires uv >= 0.9.17 for the relative-duration ("7 days") form.
+exclude-newer = "7 days"

{python_nss_ng-1.1.0 → python_nss_ng-1.2.1}/test/setup_certs.py

@@ -667,7 +667,7 @@ def setup_certs(args):
             logging.info('Certificate nickname "%s"\n%s', nickname, format_cert(options, nickname))
 
     logging.info("---------- Summary ----------")
-    logging.info('NSS database name="%s", password="%s"', options.db_name, options.db_passwd)
+    logging.info('NSS database name="%s", password="[REDACTED]"', options.db_name)
     logging.info("system FIPS mode=%s", get_system_fips_enabled())
     logging.info("DB FIPS mode=%s", get_db_fips_enabled(options.db_name))
     logging.info('CA nickname="%s", CA subject="%s"', options.ca_nickname, options.ca_subject)

{python_nss_ng-1.1.0 → python_nss_ng-1.2.1}/test/test_client_server.py

@@ -272,7 +272,7 @@ def get_free_port():
     happens quickly enough that this is rarely an issue in practice.
     """
     with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
-        s.bind(("", 0))
+        s.bind(("127.0.0.1", 0))
         s.listen(1)
         port = s.getsockname()[1]
     return port
@@ -283,8 +283,10 @@ def server(test_port):
         print("starting server:")
 
     # Initialize
-    # Setup an IP Address to listen on any of our interfaces
-    net_addr = io.NetworkAddress(io.PR_IpAddrAny, test_port)
+    # Setup an IP Address to listen on the loopback interface only.
+    # The tests are entirely local (the client connects via localhost),
+    # so there is no need to listen on all interfaces.
+    net_addr = io.NetworkAddress(io.PR_IpAddrLoopback, test_port)
 
     if use_ssl:
         if info:

{python_nss_ng-1.1.0 → python_nss_ng-1.2.1}/uv.lock

@@ -9,6 +9,10 @@ resolution-markers = [
     "python_full_version < '3.12'",
 ]
 
+[options]
+exclude-newer = "0001-01-01T00:00:00Z" # This has no effect and is included for backwards compatibility when using relative exclude-newer values.
+exclude-newer-span = "P7D"
+
 [[package]]
 name = "ast-serialize"
 version = "0.3.0"

python_nss_ng-1.1.0/.git_archival.txt

@@ -1,4 +0,0 @@
-node: ceb747232755bf570e5ceacb4e3a82f5d31ca085
-node-date: 2026-06-09T07:15:24-06:00
-describe-name: v1.1.0
-ref-names: grafted, HEAD, tag: v1.1.0, origin/main, origin/HEAD

python_nss_ng-1.1.0/_version.txt

@@ -1 +0,0 @@
-1.1.0

python_nss_ng-1.1.0/mutants/pyproject.toml

@@ -1,216 +0,0 @@
-# SPDX-License-Identifier: MPL-2.0
-# SPDX-FileCopyrightText: 2025 The Linux Foundation
-
-[build-system]
-requires = [
-    "meson-python>=0.18.0",
-    "meson>=1.10.0",
-    "ninja",
-]
-build-backend = "mesonpy"
-
-[project]
-name = "python-nss-ng"
-version = "1.0.1"
-description = "Python bindings for Network Security Services (NSS) and Netscape Portable Runtime (NSPR)"
-readme = "README.md"
-license = "MPL-2.0 OR GPL-2.0-or-later OR LGPL-2.0-or-later"
-license-files = ["LICENSE", "LICENSES/MPL-2.0.txt"]
-requires-python = ">=3.10"
-authors = [
-    {name = "John Dennis", email = "jdennis@redhat.com"},
-    {name = "Matthew Watkins", email = "mwatkins@linuxfoundation.org"},
-]
-maintainers = [
-    {name = "Matthew Watkins", email = "mwatkins@linuxfoundation.org"},
-]
-keywords = [
-    "nss",
-    "nspr",
-    "cryptography",
-    "ssl",
-    "tls",
-    "pki",
-    "x509",
-    "security",
-]
-classifiers = [
-    "Development Status :: 5 - Production/Stable",
-    "Intended Audience :: Developers",
-
-    "Operating System :: POSIX",
-    "Operating System :: POSIX :: Linux",
-    "Operating System :: MacOS",
-    "Programming Language :: C",
-    "Programming Language :: Python :: 3",
-    "Programming Language :: Python :: 3.10",
-    "Programming Language :: Python :: 3.11",
-    "Programming Language :: Python :: 3.12",
-    "Programming Language :: Python :: 3.13",
-    "Programming Language :: Python :: 3.14",
-    "Programming Language :: Python :: Implementation :: CPython",
-    "Topic :: Security",
-    "Topic :: Security :: Cryptography",
-    "Topic :: Software Development :: Libraries :: Python Modules",
-]
-
-[project.optional-dependencies]
-test = [
-    "pytest>=9.0.2",
-    "pytest-cov>=7.0.0",
-    "coverage[toml]>=7.13.1",
-    "pytest-xdist>=3.8.0",
-    "mypy>=1.0.0",
-    "hypothesis>=6.0.0",
-    "mutmut>=2.4.0",
-    "meson>=1.10.0",
-    "meson-python>=0.18.0",
-    "ninja",
-]
-dev = [
-    "pytest>=9.0.2",
-    "pytest-cov>=7.0.0",
-    "coverage[toml]>=7.13.1",
-    "pytest-xdist>=3.8.0",
-    "mypy>=1.0.0",
-    "hypothesis>=6.0.0",
-    "mutmut>=2.4.0",
-    "ruff>=0.14.10",
-    "build>=1.3.0",
-    "meson>=1.10.0",
-    "meson-python>=0.18.0",
-    "ninja",
-]
-
-[project.urls]
-Homepage = "http://www.mozilla.org/projects/security/pki/python-nss-ng"
-Documentation = "http://www.mozilla.org/projects/security/pki/python-nss-ng"
-Repository = "https://github.com/lfreleng-actions/python-nss-ng"
-Issues = "https://github.com/lfreleng-actions/python-nss-ng/issues"
-
-[tool.meson-python.args]
-# Meson build arguments can be specified here if needed
-# For example, to enable debug builds:
-# setup = ['-Dbuildtype=debug']
-
-[tool.pytest.ini_options]
-testpaths = ["test"]
-python_files = ["test_*.py"]
-python_classes = ["Test*"]
-python_functions = ["test_*"]
-# Note: Use -n0 for serial execution for 100% reliability
-# Parallel execution (-n=auto) may have intermittent failures in PKCS12 tests
-addopts = [
-    "-v",
-    "--strict-markers",
-    "--tb=short",
-    "--cov=nss",
-    "--cov-report=xml",
-    "--cov-report=html",
-]
-markers = [
-    "nss_init: mark test as requiring NSS initialization",
-    "requires_db: mark test as requiring NSS database",
-    "slow: mark test as slow running",
-    "allow_insecure: mark test as allowing insecure/legacy configurations",
-]
-
-[tool.coverage.run]
-source = ["nss"]
-branch = true
-data_file = ".coverage"
-omit = [
-    "*/test/*",
-    "*/tests/*",
-    "*/_version.py",
-]
-
-[tool.coverage.xml]
-output = "coverage.xml"
-
-[tool.coverage.report]
-exclude_lines = [
-    "pragma: no cover",
-    "def __repr__",
-    "raise AssertionError",
-    "raise NotImplementedError",
-    "if __name__ == .__main__.:",
-    "if TYPE_CHECKING:",
-]
-
-[tool.ruff]
-line-length = 100
-target-version = "py39"
-exclude = [
-    ".git",
-    "__pycache__",
-    "build",
-    "dist",
-    ".eggs",
-    "*.egg-info",
-    ".pytest_cache",
-]
-
-[tool.ruff.lint]
-select = [
-    "E",   # pycodestyle errors
-    "W",   # pycodestyle warnings
-    "F",   # pyflakes
-    "I",   # isort
-    "B",   # flake8-bugbear
-    "C4",  # flake8-comprehensions
-    "UP",  # pyupgrade
-    "S",   # flake8-bandit (security)
-    "T20", # flake8-print
-    "PT",  # flake8-pytest-style
-    "RET", # flake8-return
-    "SIM", # flake8-simplify
-    "TCH", # flake8-type-checking
-    "RUF", # Ruff-specific rules
-]
-ignore = [
-    "E501",  # line too long, handled by formatter
-    "B008",  # do not perform function calls in argument defaults
-    "C901",  # too complex
-    "S101",  # assert detected (allow in tests)
-    "T201",  # print found (intentional in examples)
-    "UP006", # Use `X` instead of `typing.X` for type annotations (Python 3.9 compat)
-    "UP007", # Use `X | Y` for union types (Python 3.9 compat)
-    "UP035", # Import from `typing` is deprecated (Python 3.9 compat)
-]
-
-[tool.ruff.lint.per-file-ignores]
-"test_*.py" = ["E402", "S101", "S105", "S106"]  # Allow asserts and hardcoded passwords in tests
-"doc/examples/*.py" = ["T201", "S105", "S106"]  # Allow prints and test passwords in examples
-"test/setup_certs.py" = ["S603", "S607"]  # Allow subprocess calls in cert setup
-
-[tool.ruff.lint.isort]
-known-first-party = ["nss"]
-
-[tool.mypy]
-python_version = "3.9"
-warn_unused_ignores = true
-disallow_any_generics = true
-disallow_incomplete_defs = true
-no_implicit_optional = true
-strict_equality = true
-warn_redundant_casts = true
-warn_return_any = true
-check_untyped_defs = true
-
-[tool.mutmut]
-paths_to_mutate = ["src/deprecations.py", "src/secure_logging.py", "src/nss_context.py"]
-backup = false
-runner = "python -m pytest -x -q"
-tests_dir = "test/"
-dict_synonyms = ["Struct", "Named"]
-
-[tool.cibuildwheel]
-skip = ["pp*", "*-musllinux*"]
-build-verbosity = 1
-
-[tool.cibuildwheel.linux]
-before-all = "yum install -y nss-devel nspr-devel pkg-config || apt-get update && apt-get install -y libnss3-dev libnspr4-dev pkg-config"
-
-[tool.cibuildwheel.macos]
-before-all = "brew install nss nspr pkg-config"