Accepting request 1332853 from devel:languages:python

OBS-URL: https://build.opensuse.org/request/show/1332853
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-cryptography?expand=0&rev=107

cryptography-46.0.2.tar.gz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:21b6fc8c71a3f9a604f028a329e5560009cc4a3a828bfea5fcba8eb7647d88fe
-size 749293

cryptography-46.0.5.tar.gz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:abace499247268e3757271b2f1e244b36b06f8515cf27c4d49468fc9eb16e93d
+size 750064

no-pytest_benchmark.patch

@@ -1,10 +1,10 @@
-Index: cryptography-46.0.2/pyproject.toml
+Index: cryptography-46.0.5/pyproject.toml
 ===================================================================
---- cryptography-46.0.2.orig/pyproject.toml
-+++ cryptography-46.0.2/pyproject.toml
+--- cryptography-46.0.5.orig/pyproject.toml
++++ cryptography-46.0.5/pyproject.toml
 @@ -72,8 +72,6 @@ nox = ["nox[uv] >=2024.04.15"]
  test = [
-     "cryptography_vectors==46.0.2",
+     "cryptography_vectors==46.0.5",
      "pytest >=7.4.0",
 -    "pytest-benchmark >=4.0",
 -    "pytest-cov >=2.10.1",
@@ -51,10 +51,10 @@ Index: cryptography-46.0.2/pyproject.toml
  [tool.ruff]
  line-length = 79
  
-Index: cryptography-46.0.2/tests/bench/test_aead.py
+Index: cryptography-46.0.5/tests/bench/test_aead.py
 ===================================================================
---- cryptography-46.0.2.orig/tests/bench/test_aead.py
-+++ cryptography-46.0.2/tests/bench/test_aead.py
+--- cryptography-46.0.5.orig/tests/bench/test_aead.py
++++ cryptography-46.0.5/tests/bench/test_aead.py
 @@ -26,84 +26,84 @@ def _aead_supported(cls):
      not _aead_supported(ChaCha20Poly1305),
      reason="Requires OpenSSL with ChaCha20Poly1305 support",
@@ -160,10 +160,10 @@ Index: cryptography-46.0.2/tests/bench/test_aead.py
      ct = aes.encrypt(b"\x00" * 12, b"hello world plaintext", None)
 -    benchmark(aes.decrypt, b"\x00" * 12, ct, None)
 +    aes.decrypt(b"\x00" * 12, ct, None)
-Index: cryptography-46.0.2/tests/bench/test_ec_load.py
+Index: cryptography-46.0.5/tests/bench/test_ec_load.py
 ===================================================================
---- cryptography-46.0.2.orig/tests/bench/test_ec_load.py
-+++ cryptography-46.0.2/tests/bench/test_ec_load.py
+--- cryptography-46.0.5.orig/tests/bench/test_ec_load.py
++++ cryptography-46.0.5/tests/bench/test_ec_load.py
 @@ -5,9 +5,9 @@
  from ..hazmat.primitives.fixtures_ec import EC_KEY_SECP256R1
  
@@ -178,10 +178,10 @@ Index: cryptography-46.0.2/tests/bench/test_ec_load.py
 -    benchmark(EC_KEY_SECP256R1.private_key)
 +def test_load_ec_private_numbers():
 +    EC_KEY_SECP256R1.private_key()
-Index: cryptography-46.0.2/tests/bench/test_hashes.py
+Index: cryptography-46.0.5/tests/bench/test_hashes.py
 ===================================================================
---- cryptography-46.0.2.orig/tests/bench/test_hashes.py
-+++ cryptography-46.0.2/tests/bench/test_hashes.py
+--- cryptography-46.0.5.orig/tests/bench/test_hashes.py
++++ cryptography-46.0.5/tests/bench/test_hashes.py
 @@ -5,10 +5,10 @@
  from cryptography.hazmat.primitives import hashes
  
@@ -195,10 +195,10 @@ Index: cryptography-46.0.2/tests/bench/test_hashes.py
  
 -    benchmark(bench)
 +    bench()
-Index: cryptography-46.0.2/tests/bench/test_hmac.py
+Index: cryptography-46.0.5/tests/bench/test_hmac.py
 ===================================================================
---- cryptography-46.0.2.orig/tests/bench/test_hmac.py
-+++ cryptography-46.0.2/tests/bench/test_hmac.py
+--- cryptography-46.0.5.orig/tests/bench/test_hmac.py
++++ cryptography-46.0.5/tests/bench/test_hmac.py
 @@ -5,10 +5,10 @@
  from cryptography.hazmat.primitives import hashes, hmac
  
@@ -212,10 +212,10 @@ Index: cryptography-46.0.2/tests/bench/test_hmac.py
  
 -    benchmark(bench)
 +    bench()
-Index: cryptography-46.0.2/tests/bench/test_x509.py
+Index: cryptography-46.0.5/tests/bench/test_x509.py
 ===================================================================
---- cryptography-46.0.2.orig/tests/bench/test_x509.py
-+++ cryptography-46.0.2/tests/bench/test_x509.py
+--- cryptography-46.0.5.orig/tests/bench/test_x509.py
++++ cryptography-46.0.5/tests/bench/test_x509.py
 @@ -13,40 +13,40 @@ from cryptography import x509
  from ..utils import load_vectors_from_file
  

python-cryptography.changes

@@ -1,3 +1,22 @@
+-------------------------------------------------------------------
+Thu Feb 12 16:31:39 UTC 2026 - Nico Krapp <nico.krapp@suse.com>
+
+- Update to 46.0.5 (fixes CVE-2026-26007, bsc#1258074)
+  * An attacker could create a malicious public key that reveals portions of
+    your private key when using certain uncommon elliptic curves (binary
+    curves). This version now includes additional security checks to prevent
+    this attack. This issue only affects binary elliptic curves, which are
+    rarely used in real-world applications. Credit to XlabAI Team of Tencent
+    Xuanwu Lab and Atuin Automated Vulnerability Discovery Engine for reporting
+    the issue. CVE-2026-26007
+  * Support for SECT* binary elliptic curves is deprecated and will be removed
+    in the next release.
+- Update to 46.0.4
+  * Dropped support for win_arm64 wheels.
+  * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.5.5.
+- Update to 46.0.3
+  * Fixed compilation when using LibreSSL 4.2.0.
+
 -------------------------------------------------------------------
 Mon Dec  8 04:29:15 UTC 2025 - Steve Kowalik <steven.kowalik@suse.com>
 

python-cryptography.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package python-cryptography
 #
-# Copyright (c) 2025 SUSE LLC and contributors
+# Copyright (c) 2026 SUSE LLC and contributors
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -28,7 +28,7 @@
 %{?sle15_python_module_pythons}
 Name:           python-cryptography%{psuffix}
 # ALWAYS KEEP IN SYNC WITH python-cryptography-vectors!
-Version:        46.0.2
+Version:        46.0.5
 Release:        0
 Summary:        Python library which exposes cryptographic recipes and primitives
 License:        Apache-2.0 OR BSD-3-Clause

vendor.tar.zst

@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:ea523052eeeb087bbce1ae07a0202f4ec17c525855d21d34e9162b51bc30f50d
-size 2684695
+oid sha256:968dfced752b75a13ce032f858c6398326144b7279ae649f1137461cd1e388e1
+size 2772260