josepy icon indicating copy to clipboard operation
josepy copied to clipboard

Refactoring to drop deprecated usages in `pyOpenSSL` & drop Python 3.7 support

Open adferrand opened this issue 1 year ago • 3 comments

Fixes #181

Caution: This PR introduces backward incompatible changes to the library. A major version of josepy should be issued when this PR is merged. Caution: Defensive PR on Certbot should be merged first -> https://github.com/certbot/certbot/pull/9993

This PR removes the APIs deprecated by pyopenssl in version 24.2+.

As a consequence, several changes of josepy public API are made:

  • josepy.ComparableX509 is removed since the underlying wrapped object is now objects from cryptography API (Certificate or CertificateSigningRequest) and these objects support equality checks.
  • methods encode_csr, decode_csr, encode_cert and decode_cert now manipulates objects from cryptography API
  • underlying tests are updated.

Aside these changes, the support of Python 3.7 is dropped, given this PR will require a new major version anyway.

adferrand avatar Aug 27 '24 10:08 adferrand

This should resolve advisories: (needs Python 3.7 dropped)

  • https://github.com/certbot/josepy/security/dependabot/26
  • https://github.com/certbot/josepy/security/dependabot/26
  • https://github.com/certbot/josepy/security/dependabot/25

zoracon avatar Sep 06 '24 04:09 zoracon

Any movement on this? 👀

jharrisonSV avatar Sep 13 '24 11:09 jharrisonSV

I opened https://github.com/certbot/josepy/pull/186 to drop Python 3.7 and fix security alerts.

As for this PR in itself, we will likely do this and/or deprecate this library entirely as discussed at https://github.com/certbot/certbot/issues/8322 and the comments on https://github.com/certbot/certbot/pull/9993 in the next few months. We just need to map out what that transition will look like for the code in https://github.com/certbot/certbot.

bmw avatar Sep 17 '24 19:09 bmw

while we haven't done a release dropping pyopenssl use yet, i believe this has been done through other PRs so i'm closing this

thanks for writing this up though

bmw avatar Feb 03 '25 17:02 bmw