Markéta Machová
b60b3a6941
* Add support for Python 3.13. (#664) * Allow setting of cert's notBefore attribute (#628) * Add the Authority Key Identifier extension to child CA certificates. (#642) * Remove support for Python 3.8 and PyPy 3.9. (#664) - Drop add-aki-to-child-certs.patch, merged upstream - Drop fix2038.patch, fixed upstream - Update BuildRequires from pyproject.toml OBS-URL: https://build.opensuse.org/package/show/devel:languages:python/python-trustme?expand=0&rev=31
97 lines
3.5 KiB
Diff
97 lines
3.5 KiB
Diff
From 84e347d9221e304f0158330e5101d23969d424d0 Mon Sep 17 00:00:00 2001
|
|
From: Illia Volochii <illia.volochii@gmail.com>
|
|
Date: Wed, 27 Mar 2024 11:45:41 +0000
|
|
Subject: [PATCH 1/3] Add AKI to child CA certificates
|
|
|
|
---
|
|
src/trustme/__init__.py | 14 +++++++++++---
|
|
tests/test_trustme.py | 5 +++++
|
|
2 files changed, 16 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/src/trustme/__init__.py b/src/trustme/__init__.py
|
|
index 5fb24fb..0db1bb0 100644
|
|
--- a/src/trustme/__init__.py
|
|
+++ b/src/trustme/__init__.py
|
|
@@ -250,14 +250,22 @@ def __init__(
|
|
sign_key = parent_cert._private_key
|
|
parent_certificate = parent_cert._certificate
|
|
issuer = parent_certificate.subject
|
|
-
|
|
- self._certificate = (
|
|
+ ski_ext = parent_certificate.extensions.get_extension_for_class(
|
|
+ x509.SubjectKeyIdentifier)
|
|
+ aki = x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(ski_ext.value)
|
|
+ else:
|
|
+ aki = None
|
|
+ cert_builder = (
|
|
_cert_builder_common(name, issuer, self._private_key.public_key())
|
|
.add_extension(
|
|
x509.BasicConstraints(ca=True, path_length=path_length),
|
|
critical=True,
|
|
)
|
|
- .add_extension(
|
|
+ )
|
|
+ if aki:
|
|
+ cert_builder = cert_builder.add_extension(aki, critical=False)
|
|
+ self._certificate = (
|
|
+ cert_builder.add_extension(
|
|
x509.KeyUsage(
|
|
digital_signature=True, # OCSP
|
|
content_commitment=False,
|
|
diff --git a/tests/test_trustme.py b/tests/test_trustme.py
|
|
index 1d901ad..581716e 100644
|
|
--- a/tests/test_trustme.py
|
|
+++ b/tests/test_trustme.py
|
|
@@ -200,6 +200,11 @@ def test_intermediate() -> None:
|
|
assert_is_ca(child_ca_cert)
|
|
assert child_ca_cert.issuer == ca_cert.subject
|
|
assert _path_length(child_ca_cert) == 8
|
|
+ aki = child_ca_cert.extensions.get_extension_for_class(x509.AuthorityKeyIdentifier)
|
|
+ assert aki.critical is False
|
|
+ expected_aki_key_id = ca_cert.extensions.get_extension_for_class(
|
|
+ x509.SubjectKeyIdentifier).value.digest
|
|
+ assert aki.value.key_identifier == expected_aki_key_id
|
|
|
|
child_server = child_ca.issue_cert("test-host.example.org")
|
|
assert len(child_server.cert_chain_pems) == 2
|
|
|
|
From f507a28e0f4d97d63716aa5a81669bb747235f07 Mon Sep 17 00:00:00 2001
|
|
From: Illia Volochii <illia.volochii@gmail.com>
|
|
Date: Wed, 27 Mar 2024 12:02:59 +0000
|
|
Subject: [PATCH 2/3] Fix a typing issue
|
|
|
|
---
|
|
src/trustme/__init__.py | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
diff --git a/src/trustme/__init__.py b/src/trustme/__init__.py
|
|
index 0db1bb0..d126180 100644
|
|
--- a/src/trustme/__init__.py
|
|
+++ b/src/trustme/__init__.py
|
|
@@ -246,6 +246,7 @@ def __init__(
|
|
)
|
|
issuer = name
|
|
sign_key = self._private_key
|
|
+ aki: Optional[x509.AuthorityKeyIdentifier]
|
|
if parent_cert is not None:
|
|
sign_key = parent_cert._private_key
|
|
parent_certificate = parent_cert._certificate
|
|
|
|
From cdd2fd61aae9c92f902932bacd6b39189ecde4b1 Mon Sep 17 00:00:00 2001
|
|
From: Illia Volochii <illia.volochii@gmail.com>
|
|
Date: Wed, 27 Mar 2024 12:09:38 +0000
|
|
Subject: [PATCH 3/3] Add a news entry
|
|
|
|
---
|
|
newsfragments/642.bugfix.rst | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
create mode 100644 newsfragments/642.bugfix.rst
|
|
|
|
diff --git a/newsfragments/642.bugfix.rst b/newsfragments/642.bugfix.rst
|
|
new file mode 100644
|
|
index 0000000..9d75e7a
|
|
--- /dev/null
|
|
+++ b/newsfragments/642.bugfix.rst
|
|
@@ -0,0 +1 @@
|
|
+Add the Authority Key Identifier extension to child CA certificates.
|