azure-cli
azure-cli copied to clipboard
Published
20 hours ago •
Azure
Azure
{Packaging} Bump cryptography to 42.0.5 and pyOpenSSL to 24.0.0
Bumps cryptography from 41.0.6 to 42.0.0.
Changelog
Sourced from cryptography's changelog.
42.0.0 - 2024-01-22
* **BACKWARDS INCOMPATIBLE:** Dropped support for LibreSSL < 3.7. * **BACKWARDS INCOMPATIBLE:** Loading a PKCS7 with no content field using :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_pem_pkcs7_certificates` or :func:`~cryptography.hazmat.primitives.serialization.pkcs7.load_der_pkcs7_certificates` will now raise a ``ValueError`` rather than return an empty list. * Parsing SSH certificates no longer permits malformed critical options with values, as documented in the 41.0.2 release notes. * Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.2.0. * Updated the minimum supported Rust version (MSRV) to 1.63.0, from 1.56.0. * We now publish both ``py37`` and ``py39`` ``abi3`` wheels. This should resolve some errors relating to initializing a module multiple times per process. * Support :class:`~cryptography.hazmat.primitives.asymmetric.padding.PSS` for X.509 certificate signing requests and certificate revocation lists with the keyword-only argument ``rsa_padding`` on the ``sign`` methods for :class:`~cryptography.x509.CertificateSigningRequestBuilder` and :class:`~cryptography.x509.CertificateRevocationListBuilder`. * Added support for obtaining X.509 certificate signing request signature algorithm parameters (including PSS) via :meth:`~cryptography.x509.CertificateSigningRequest.signature_algorithm_parameters`. * Added support for obtaining X.509 certificate revocation list signature algorithm parameters (including PSS) via :meth:`~cryptography.x509.CertificateRevocationList.signature_algorithm_parameters`. * Added ``mgf`` property to :class:`~cryptography.hazmat.primitives.asymmetric.padding.PSS`. * Added ``algorithm`` and ``mgf`` properties to :class:`~cryptography.hazmat.primitives.asymmetric.padding.OAEP`. * Added the following properties that return timezone-aware ``datetime`` objects: :meth:`~cryptography.x509.Certificate.not_valid_before_utc`, :meth:`~cryptography.x509.Certificate.not_valid_after_utc`, :meth:`~cryptography.x509.RevokedCertificate.revocation_date_utc`, :meth:`~cryptography.x509.CertificateRevocationList.next_update_utc`, :meth:`~cryptography.x509.CertificateRevocationList.last_update_utc`. These are timezone-aware variants of existing properties that return naïve ``datetime`` objects. * Deprecated the following properties that return naïve ``datetime`` objects: :meth:`~cryptography.x509.Certificate.not_valid_before`, :meth:`~cryptography.x509.Certificate.not_valid_after`, :meth:`~cryptography.x509.RevokedCertificate.revocation_date`, :meth:`~cryptography.x509.CertificateRevocationList.next_update`, :meth:`~cryptography.x509.CertificateRevocationList.last_update` in favor of the new timezone-aware variants mentioned above. * Added support for :class:`~cryptography.hazmat.primitives.ciphers.algorithms.ChaCha20` on LibreSSL. * Added support for RSA PSS signatures in PKCS7 with </tr></table>
... (truncated)
Commits
4e64baf42.0.0 version bump (#10232)7cb13a3we'll ship 3.2.0 for 42 (#9951)605c74eBump x509-limbo and/or wycheproof in CI (#10231)97578b9Bump BoringSSL and/or OpenSSL in CI (#10230)972a7b5verification: add test_verify_tz_aware (#10229)41daf2dMigrate PKCS7 backend to Rust (#10228)d54093eRemove some skips in tests that aren't needed anymore (#10223)71929bdRemove binding that's not used anymore (#10224)7ea4b89fixed formatting in changelog (#10225)410f4a1Allow brainpool on libressl (#10222)- Additional commits viewable in compare view
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the Security Alerts page.
![dependabot[bot] avatar](https://avatars.githubusercontent.com/in/29110?v=4 "Published by a pub.dev verified publisher"){kind=small}
️✔️AzureCLI-FullTest
️✔️acr
️✔️2020-09-01-hybrid
️✔️3.11
️✔️3.9
️✔️latest
️✔️3.11
️✔️3.9
️✔️acs
️✔️2020-09-01-hybrid
️✔️3.11
️✔️3.9
️✔️latest
️✔️3.11
️✔️3.9
️✔️advisor
️✔️latest
️✔️3.11
️✔️3.9
️✔️ams
️✔️latest
️✔️3.11
️✔️3.9
️✔️apim
️✔️latest
️✔️3.11
️✔️3.9
️✔️appconfig
️✔️latest
️✔️3.11
️✔️3.9
️✔️appservice
️✔️latest
️✔️3.11
️✔️3.9
️✔️aro
️✔️latest
️✔️3.11
️✔️3.9
️✔️backup
️✔️latest
️✔️3.11
️✔️3.9
️✔️batch
️✔️latest
️✔️3.11
️✔️3.9
️✔️batchai
️✔️latest
️✔️3.11
️✔️3.9
️✔️billing
️✔️latest
️✔️3.11
️✔️3.9
️✔️botservice
️✔️latest
️✔️3.11
️✔️3.9
️✔️cdn
️✔️latest
️✔️3.11
️✔️3.9
️✔️cloud
️✔️latest
️✔️3.11
️✔️3.9
️✔️cognitiveservices
️✔️latest
️✔️3.11
️✔️3.9
️✔️config
️✔️latest
️✔️3.11
️✔️3.9
️✔️configure
️✔️latest
️✔️3.11
️✔️3.9
️✔️consumption
️✔️latest
️✔️3.11
️✔️3.9
️✔️container
️✔️latest
️✔️3.11
️✔️3.9
️✔️containerapp
️✔️latest
️✔️3.11
️✔️3.9
️✔️core
️✔️2018-03-01-hybrid
️✔️3.11
️✔️3.9
️✔️2019-03-01-hybrid
️✔️3.11
️✔️3.9
️✔️2020-09-01-hybrid
️✔️3.11
️✔️3.9
️✔️latest
️✔️3.11
️✔️3.9
️✔️cosmosdb
️✔️latest
️✔️3.11
️✔️3.9
️✔️databoxedge
️✔️2019-03-01-hybrid
️✔️3.11
️✔️3.9
️✔️2020-09-01-hybrid
️✔️3.11
️✔️3.9
️✔️latest
️✔️3.11
️✔️3.9
️✔️dla
️✔️latest
️✔️3.11
️✔️3.9
️✔️dls
️✔️latest
️✔️3.11
️✔️3.9
️✔️dms
️✔️latest
️✔️3.11
️✔️3.9
️✔️eventgrid
️✔️latest
️✔️3.11
️✔️3.9
️✔️eventhubs
️✔️latest
️✔️3.11
️✔️3.9
️✔️feedback
️✔️latest
️✔️3.11
️✔️3.9
️✔️find
️✔️latest
️✔️3.11
️✔️3.9
️✔️hdinsight
️✔️latest
️✔️3.11
️✔️3.9
️✔️identity
️✔️latest
️✔️3.11
️✔️3.9
️✔️iot
️✔️2019-03-01-hybrid
️✔️3.11
️✔️3.9
️✔️2020-09-01-hybrid
️✔️3.11
️✔️3.9
️✔️latest
️✔️3.11
️✔️3.9
️✔️keyvault
️✔️2018-03-01-hybrid
️✔️3.11
️✔️3.9
️✔️2020-09-01-hybrid
️✔️3.11
️✔️3.9
️✔️latest
️✔️3.11
️✔️3.9
️✔️kusto
️✔️latest
️✔️3.11
️✔️3.9
️✔️lab
️✔️latest
️✔️3.11
️✔️3.9
️✔️managedservices
️✔️latest
️✔️3.11
️✔️3.9
️✔️maps
️✔️latest
️✔️3.11
️✔️3.9
️✔️marketplaceordering
️✔️latest
️✔️3.11
️✔️3.9
️✔️monitor
️✔️latest
️✔️3.11
️✔️3.9
️✔️mysql
️✔️latest
️✔️3.11
️✔️3.9
️✔️netappfiles
️✔️latest
️✔️3.11
️✔️3.9
️✔️network
️✔️2018-03-01-hybrid
️✔️3.11
️✔️3.9
️✔️latest
️✔️3.11
️✔️3.9
️✔️policyinsights
️✔️latest
️✔️3.11
️✔️3.9
️✔️privatedns
️✔️latest
️✔️3.11
️✔️3.9
️✔️profile
️✔️latest
️✔️3.11
️✔️3.9
️✔️rdbms
️✔️latest
️✔️3.11
️✔️3.9
️✔️redis
️✔️latest
️✔️3.11
️✔️3.9
️✔️relay
️✔️latest
️✔️3.11
️✔️3.9
️✔️resource
️✔️2018-03-01-hybrid
️✔️3.11
️✔️3.9
️✔️2019-03-01-hybrid
️✔️3.11
️✔️3.9
️✔️latest
️✔️3.11
️✔️3.9
️✔️role
️✔️latest
️✔️3.11
️✔️3.9
️✔️search
️✔️latest
️✔️3.11
️✔️3.9
️✔️security
️✔️latest
️✔️3.11
️✔️3.9
️✔️servicebus
️✔️latest
️✔️3.11
️✔️3.9
️✔️serviceconnector
️✔️latest
️✔️3.11
️✔️3.9
️✔️servicefabric
️✔️latest
️✔️3.11
️✔️3.9
️✔️signalr
️✔️latest
️✔️3.11
️✔️3.9
️✔️sql
️✔️latest
️✔️3.11
️✔️3.9
️✔️sqlvm
️✔️latest
️✔️3.11
️✔️3.9
️✔️storage
️✔️2018-03-01-hybrid
️✔️3.11
️✔️3.9
️✔️2019-03-01-hybrid
️✔️3.11
️✔️3.9
️✔️2020-09-01-hybrid
️✔️3.11
️✔️3.9
️✔️latest
️✔️3.11
️✔️3.9
️✔️synapse
️✔️latest
️✔️3.11
️✔️3.9
️✔️telemetry
️✔️2018-03-01-hybrid
️✔️3.11
️✔️3.9
️✔️2019-03-01-hybrid
️✔️3.11
️✔️3.9
️✔️2020-09-01-hybrid
️✔️3.11
️✔️3.9
️✔️latest
️✔️3.11
️✔️3.9
️✔️util
️✔️latest
️✔️3.11
️✔️3.9
️✔️vm
️✔️2018-03-01-hybrid
️✔️3.11
️✔️3.9
️✔️2019-03-01-hybrid
️✔️3.11
️✔️3.9
️✔️2020-09-01-hybrid
️✔️3.11
️✔️3.9
️✔️latest
️✔️3.11
️✔️3.9
![azure-client-tools-bot-prd[bot] avatar](https://avatars.githubusercontent.com/u/37600188?v=4 "Published by a pub.dev verified publisher"){kind=small}
️✔️AzureCLI-BreakingChangeTest
️✔️Non Breaking Changes
Thank you for your contribution! We will review the pull request and get back to you soon.
pyopenssl also needs to be bumped.
pyopenssl 23.2.0 depends on cryptography!=40.0.0, !=40.0.1, <42 and >=38.0.0
A newer version of cryptography exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.
WebappSSLCertTest.test_webapp_ssl fails after bumping pyOpenSSL to 24.0.0, because OpenSSL.crypto.loads_pkcs12 is removed in 23.3.0.
Ref: https://www.pyopenssl.org/en/latest/changelog.html
The error message is:
> self.cmd('webapp config ssl upload -g {} -n {} --certificate-file "{}" --certificate-password {} --certificate-name {}'.format(resource_group, webapp_name, pfx_file, cert_password, "test123"), checks=[
JMESPathCheck('thumbprint', cert_thumbprint),
JMESPathCheck('name', 'test123')
])
/opt/az/lib/python3.11/site-packages/azure/cli/command_modules/appservice/tests/latest/test_webapp_commands.py:1602:
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
/opt/az/lib/python3.11/site-packages/azure/cli/testsdk/base.py:175: in cmd
return execute(self.cli_ctx, command, expect_failure=expect_failure).assert_with_checks(checks)
/opt/az/lib/python3.11/site-packages/azure/cli/testsdk/base.py:250: in __init__
self._in_process_execute(cli_ctx, command, expect_failure=expect_failure)
/opt/az/lib/python3.11/site-packages/azure/cli/testsdk/base.py:313: in _in_process_execute
raise ex.exception
/opt/az/lib/python3.11/site-packages/knack/cli.py:233: in invoke
cmd_result = self.invocation.execute(args)
/opt/az/lib/python3.11/site-packages/azure/cli/core/commands/__init__.py:664: in execute
raise ex
/opt/az/lib/python3.11/site-packages/azure/cli/core/commands/__init__.py:729: in _run_jobs_serially
results.append(self._run_job(expanded_arg, cmd_copy))
/opt/az/lib/python3.11/site-packages/azure/cli/core/commands/__init__.py:698: in _run_job
result = cmd_copy(params)
/opt/az/lib/python3.11/site-packages/azure/cli/core/commands/__init__.py:334: in __call__
return self.handler(*args, **kwargs)
/opt/az/lib/python3.11/site-packages/azure/cli/core/commands/command_operation.py:121: in handler
return op(**command_args)
/opt/az/lib/python3.11/site-packages/azure/cli/command_modules/appservice/custom.py:3011: in upload_ssl_cert
thumb_print = _get_cert(certificate_password, certificate_file)
/opt/az/lib/python3.11/site-packages/azure/cli/command_modules/appservice/custom.py:3031: in _get_cert
p12 = OpenSSL.crypto.load_pkcs12(open(certificate_file, 'rb').read(), certificate_password)
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
self = <module 'OpenSSL.crypto' from '/opt/az/lib/python3.11/site-packages/OpenSSL/crypto.py'>
attr = 'load_pkcs12'
def __getattr__(self, attr: str) -> object:
> obj = getattr(self._module, attr)
E AttributeError: module 'OpenSSL.crypto' has no attribute 'load_pkcs12'
/opt/az/lib/python3.11/site-packages/cryptography/utils.py:72: AttributeError
https://github.com/Azure/azure-cli/pull/28306#issuecomment-1950852773 @shnjefff Could you please take a look at the webapp related issue?
There are also two modules that contain calls to load_pkcs12
- servicefabric @mwesigwaguma Please take a look~ https://github.com/Azure/azure-cli/blob/3b431981023c07fa8b55913136e4e377bbf5939a/src/azure-cli/azure/cli/command_modules/servicefabric/custom.py#L1389
- containerapp @Greedygre please take a look https://github.com/Azure/azure-cli/blob/3b431981023c07fa8b55913136e4e377bbf5939a/src/azure-cli/azure/cli/command_modules/containerapp/_utils.py#L1480
There are also two modules that contain calls to
load_pkcs12
- servicefabric @mwesigwaguma Please take a look~ https://github.com/Azure/azure-cli/blob/3b431981023c07fa8b55913136e4e377bbf5939a/src/azure-cli/azure/cli/command_modules/servicefabric/custom.py#L1389
- containerapp @Greedygre please take a look https://github.com/Azure/azure-cli/blob/3b431981023c07fa8b55913136e4e377bbf5939a/src/azure-cli/azure/cli/command_modules/containerapp/_utils.py#L1480
https://github.com/Azure/azure-cli/pull/28385
@zhoxing-ms Please help to review this PR.Thanks.
@zhoxing-ms, @bebound, @jiasli, @yonzhan will this change be included in Feb cli release? https://github.com/advisories/GHSA-3ww4-gg4f-jr7f
@FumingZhang There are still two modules which need to be revised before merging this PR. It's unlikely to include it into Feb release.
pyopensslalso needs to be bumped.pyopenssl 23.2.0 depends on cryptography!=40.0.0, !=40.0.1, <42 and >=38.0.0
pyopenssl 24.0.0 depends on "cryptography>=41.0.5,<43": https://github.com/pyca/pyopenssl/blob/7f3e4f94701a5e19ec66e3601119dd6d62043cec/setup.py#L95-L97
https://github.com/Azure/azure-cli/pull/28385 is an example for the OpenSSL.crypto.load_pkcs12 to cryptography.hazmat.primitives.serialization.pkcs12.load_pkcs12 migration.