WIP: Add method Certificate._has_signature_of()

[KonstantinShemyak]

This PR is the first step in implementing #5116 . Here, we only check the validity of the cryptographic signature. As this method is likely to be used only inside Certificate.is_issued_by(), it is declared as internal. Huge line diff is caused by added test certificates, real code change is small.

[KonstantinShemyak]

CI step pyca/check has been stuck for two days 🤔

[alex]

Yes, it's a known issue. For now there's nothing to do but ignore that one job.

[KonstantinShemyak]

Now I think that it would be more appropriate to move this method under x509.base.Certificate? The method has nothing specific to OpenSSL and it will be equally well used by any other possible backend. Unless someone (@reaperhulk ?) has something to confront in this reasoning, I'll do the next version with the move.

[KonstantinShemyak]

Force-push: implemented suggestion to assert type.

[KonstantinShemyak]

Force-push: the new method is implemented completely under x509; no new code under hazmat anymore.

To remind, the final goal of this work is to implement certificate validation (#2381). This PR is the first step out of three. The second step is #5116, I have pushed a WIP branch (missing tests and documentation) showing how I plan to do it. The final step is doing checks as in #5116 along all computed chains of trust from the leaf to any of the provided trusted CAs.

GitHub seems to start requiring approval from project maintainers to run workflows :smiling_imp:

[KonstantinShemyak]

Force-push: rebase on updated main.

[KonstantinShemyak]

^ rebase on updated main.

@reaperhulk , @alex - what is your view on this approach? While this is only first step out of three, I believe it's also useful by itself, as now the user of the library needs non-trivial code to just verify the cryptographic part of the signature.

[alex]

First, I'm sorry we haven't given this PR much attention.

Second, I think I'm conceptually ok with this, but I'm on the fence about having it as a private method. I realize the goal is for it to be ultimately used by a more powerful (and safe) public API, but I do wonder if this shouldn't just be public as well.

I haven't reviewed the implementation of the PR yet. I also think we might want to iterate on the name a bit.

[KonstantinShemyak]

Branch updated on main. I'm 100% happy with making the method public and naming it in any way; the goal is to get the certificate validation :slightly_smiling_face:

[alex]

https://github.com/pyca/cryptography/commit/db7dd61de3c6f7c8d66d5615cbfbcf5c085c4448 incorporates this