Accepting request 1196403 from devel:languages:python

- Add patch add-aki-to-child-certs.patch
  * Also add Authority Key Identifiers to children certs.

OBS-URL: https://build.opensuse.org/request/show/1196403
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/python-trustme?expand=0&rev=14

add-aki-to-child-certs.patch

@@ -0,0 +1,96 @@
+From 84e347d9221e304f0158330e5101d23969d424d0 Mon Sep 17 00:00:00 2001
+From: Illia Volochii <illia.volochii@gmail.com>
+Date: Wed, 27 Mar 2024 11:45:41 +0000
+Subject: [PATCH 1/3] Add AKI to child CA certificates
+
+---
+ src/trustme/__init__.py | 14 +++++++++++---
+ tests/test_trustme.py   |  5 +++++
+ 2 files changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/src/trustme/__init__.py b/src/trustme/__init__.py
+index 5fb24fb..0db1bb0 100644
+--- a/src/trustme/__init__.py
++++ b/src/trustme/__init__.py
+@@ -250,14 +250,22 @@ def __init__(
+             sign_key = parent_cert._private_key
+             parent_certificate = parent_cert._certificate
+             issuer = parent_certificate.subject
+-
+-        self._certificate = (
++            ski_ext = parent_certificate.extensions.get_extension_for_class(
++                x509.SubjectKeyIdentifier)
++            aki = x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(ski_ext.value)
++        else:
++            aki = None
++        cert_builder = (
+             _cert_builder_common(name, issuer, self._private_key.public_key())
+             .add_extension(
+                 x509.BasicConstraints(ca=True, path_length=path_length),
+                 critical=True,
+             )
+-            .add_extension(
++        )
++        if aki:
++            cert_builder = cert_builder.add_extension(aki, critical=False)
++        self._certificate = (
++            cert_builder.add_extension(
+                 x509.KeyUsage(
+                     digital_signature=True,  # OCSP
+                     content_commitment=False,
+diff --git a/tests/test_trustme.py b/tests/test_trustme.py
+index 1d901ad..581716e 100644
+--- a/tests/test_trustme.py
++++ b/tests/test_trustme.py
+@@ -200,6 +200,11 @@ def test_intermediate() -> None:
+     assert_is_ca(child_ca_cert)
+     assert child_ca_cert.issuer == ca_cert.subject
+     assert _path_length(child_ca_cert) == 8
++    aki = child_ca_cert.extensions.get_extension_for_class(x509.AuthorityKeyIdentifier)
++    assert aki.critical is False
++    expected_aki_key_id = ca_cert.extensions.get_extension_for_class(
++        x509.SubjectKeyIdentifier).value.digest
++    assert aki.value.key_identifier == expected_aki_key_id
+ 
+     child_server = child_ca.issue_cert("test-host.example.org")
+     assert len(child_server.cert_chain_pems) == 2
+
+From f507a28e0f4d97d63716aa5a81669bb747235f07 Mon Sep 17 00:00:00 2001
+From: Illia Volochii <illia.volochii@gmail.com>
+Date: Wed, 27 Mar 2024 12:02:59 +0000
+Subject: [PATCH 2/3] Fix a typing issue
+
+---
+ src/trustme/__init__.py | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/trustme/__init__.py b/src/trustme/__init__.py
+index 0db1bb0..d126180 100644
+--- a/src/trustme/__init__.py
++++ b/src/trustme/__init__.py
+@@ -246,6 +246,7 @@ def __init__(
+         )
+         issuer = name
+         sign_key = self._private_key
++        aki: Optional[x509.AuthorityKeyIdentifier]
+         if parent_cert is not None:
+             sign_key = parent_cert._private_key
+             parent_certificate = parent_cert._certificate
+
+From cdd2fd61aae9c92f902932bacd6b39189ecde4b1 Mon Sep 17 00:00:00 2001
+From: Illia Volochii <illia.volochii@gmail.com>
+Date: Wed, 27 Mar 2024 12:09:38 +0000
+Subject: [PATCH 3/3] Add a news entry
+
+---
+ newsfragments/642.bugfix.rst | 1 +
+ 1 file changed, 1 insertion(+)
+ create mode 100644 newsfragments/642.bugfix.rst
+
+diff --git a/newsfragments/642.bugfix.rst b/newsfragments/642.bugfix.rst
+new file mode 100644
+index 0000000..9d75e7a
+--- /dev/null
++++ b/newsfragments/642.bugfix.rst
+@@ -0,0 +1 @@
++Add the Authority Key Identifier extension to child CA certificates.

python-trustme.changes

@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Wed Aug 28 06:38:39 UTC 2024 - Steve Kowalik <steven.kowalik@suse.com>
+
+- Add patch add-aki-to-child-certs.patch
+  * Also add Authority Key Identifiers to children certs.
+
 -------------------------------------------------------------------
 Tue Mar  5 02:52:27 UTC 2024 - Steve Kowalik <steven.kowalik@suse.com>
 

python-trustme.spec

@@ -25,6 +25,8 @@ License:        Apache-2.0 OR MIT
 URL:            https://github.com/python-trio/trustme
 Source:         https://files.pythonhosted.org/packages/source/t/trustme/trustme-%{version}.tar.gz
 Patch0:         fix2038.patch
+# PATCH-FIX-UPSTREAM gh#python-trio/trustme#642
+Patch1:         add-aki-to-child-certs.patch
 BuildRequires:  %{python_module cryptography}
 BuildRequires:  %{python_module idna}
 BuildRequires:  %{python_module pip}