Feature crypto backend2

.github/workflows/check.yaml

@@ -11,11 +11,13 @@ on:
 
 jobs:
   build:
+    name: test-${{ matrix.python }}-${{ matrix.build-type }}
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
         python: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13"]
+        build-type: ["noopenssl", "legacy"]
     steps:
       - uses: actions/checkout@v3
       - name: Setup Python
@@ -34,7 +36,7 @@ jobs:
       - name: Install Poetry & Tox
         run: pip install poetry>1.0.0 tox>3.3.0
       - name: Run tox
-        run: tox
+        run: tox -e github-${{ matrix.build-type }}
   # This job runs our tests like external parties such as packagers.
   external:
     runs-on: ubuntu-latest

CHANGELOG.rst

@@ -7,6 +7,21 @@ Changelog
 * Dropped support for Python 3.7.
 * Support for Python 3.8 has been deprecated and will be removed in the next
   scheduled release.
+* Deprecated pyOpenSSL in favor of Cryptography and removed the required
+  dependency. The underlying storage format of the `josepy.util.ComparableX509`
+  has been switched to `cryptography.x509` objects, and the
+  `josepy.util.ComparableX509.wrapped` attribute will now be either a
+  `cryptography.x509.Certificate` or `cryptography.x509.CertificateSigningRequest`
+  - objects from the `opensssl.crypto` package will be automatically transcoded
+  to their Cryptography counterparts on initialization.  A new convenience
+  attribute, `josepy.util.ComparableX509.wrapped_legacy` will return an
+  `opensssl.crypto` object for affected projects that are unable to immediately
+  migrate code to the Cryptography objects. This is offered as a minimally
+  breaking change to aid in migration to Cryptography. Affected projects should
+  either pin to `1.14.0` or utilize the new attribute in a "hotfix" release.
+  Please note, due to the removal of `X509_V_FLAG_NOTIFY_POLICY` in pyOpenSSL
+  `23.2.0`, projects migrating to the new backend may experience a version
+  conflict during the code transition.
 
 1.14.0 (2023-11-01)
 -------------------

pyproject.toml

@@ -42,9 +42,11 @@ python = "^3.8"
 # load_pem_private/public_key (>=0.6)
 # rsa_recover_prime_factors (>=0.8)
 # add sign() and verify() to asymetric keys (RSA >=1.4, ECDSA >=1.5)
-cryptography = ">=1.5"
+# add not_valid_after_utc() in (>=42.0.0)
+cryptography = ">=42.0.0"
 # Connection.set_tlsext_host_name (>=0.13)
-pyopenssl = ">=0.13"
+# incompatibilities with cryptography; X509_V_FLAG_NOTIFY_POLICY removed (>=23.2.0)
+pyopenssl = {version = ">=23.2.0", optional=true}
 # >=4.3.0 is needed for Python 3.10 support
 sphinx = {version = ">=4.3.0", optional = true}
 sphinx-rtd-theme = {version = ">=1.0", optional = true}
@@ -73,10 +75,17 @@ docs = [
     "sphinx",
     "sphinx-rtd-theme",
 ]
+legacy = [
+    "pyopenssl",
+]
 
 [tool.poetry.scripts]
 jws = "josepy.jws:CLI.run"
 
+# pyopenssl is only needed for testing
+[tool.poetry.group.dev.dependencies]
+pyopenssl = ">=23.2.0"
+
 # Black tooling configuration
 [tool.black]
 line-length = 100

src/josepy/json_util.py

@@ -22,7 +22,8 @@
     TypeVar,
 )
 
-from OpenSSL import crypto
+from cryptography import x509
+from cryptography.hazmat.primitives.serialization import Encoding
 
 from josepy import b64, errors, interfaces, util
 
@@ -429,56 +430,52 @@ def decode_hex16(value: str, size: Optional[int] = None, minimum: bool = False)
 def encode_cert(cert: util.ComparableX509) -> str:
     """Encode certificate as JOSE Base-64 DER.
 
-    :type cert: `OpenSSL.crypto.X509` wrapped in `.ComparableX509`
+    :type cert: `x509.Certificate` wrapped in `.ComparableX509`
     :rtype: unicode
 
     """
-    if isinstance(cert.wrapped, crypto.X509Req):
+    if isinstance(cert._wrapped_new, x509.CertificateSigningRequest):
         raise ValueError("Error input is actually a certificate request.")
 
-    return encode_b64jose(crypto.dump_certificate(crypto.FILETYPE_ASN1, cert.wrapped))
+    return encode_b64jose(cert._wrapped_new.public_bytes(Encoding.DER))
 
 
 def decode_cert(b64der: str) -> util.ComparableX509:
     """Decode JOSE Base-64 DER-encoded certificate.
 
     :param unicode b64der:
-    :rtype: `OpenSSL.crypto.X509` wrapped in `.ComparableX509`
+    :rtype: `x509.Certificate` wrapped in `.ComparableX509`
 
     """
     try:
-        return util.ComparableX509(
-            crypto.load_certificate(crypto.FILETYPE_ASN1, decode_b64jose(b64der))
-        )
-    except crypto.Error as error:
+        return util.ComparableX509(x509.load_der_x509_certificate(decode_b64jose(b64der)))
+    except Exception as error:
         raise errors.DeserializationError(error)
 
 
 def encode_csr(csr: util.ComparableX509) -> str:
     """Encode CSR as JOSE Base-64 DER.
 
-    :type csr: `OpenSSL.crypto.X509Req` wrapped in `.ComparableX509`
+    :type csr: `x509.CertificateSigningRequest` wrapped in `.ComparableX509`
     :rtype: unicode
 
     """
-    if isinstance(csr.wrapped, crypto.X509):
+    if isinstance(csr._wrapped_new, x509.Certificate):
         raise ValueError("Error input is actually a certificate.")
 
-    return encode_b64jose(crypto.dump_certificate_request(crypto.FILETYPE_ASN1, csr.wrapped))
+    return encode_b64jose(csr._wrapped_new.public_bytes(Encoding.DER))
 
 
 def decode_csr(b64der: str) -> util.ComparableX509:
     """Decode JOSE Base-64 DER-encoded CSR.
 
     :param unicode b64der:
-    :rtype: `OpenSSL.crypto.X509Req` wrapped in `.ComparableX509`
+    :rtype: `cryptography.x509.CertificateSigningRequest` wrapped in `.ComparableX509`
 
     """
     try:
-        return util.ComparableX509(
-            crypto.load_certificate_request(crypto.FILETYPE_ASN1, decode_b64jose(b64der))
-        )
-    except crypto.Error as error:
+        return util.ComparableX509(x509.load_der_x509_csr(decode_b64jose(b64der)))
+    except Exception as error:
         raise errors.DeserializationError(error)
 
 

src/josepy/jws.py

@@ -15,7 +15,8 @@
     cast,
 )
 
-from OpenSSL import crypto
+from cryptography import x509
+from cryptography.hazmat.primitives.serialization import Encoding
 
 import josepy
 from josepy import b64, errors, json_util, jwa
@@ -138,21 +139,16 @@ def crit(unused_value: Any) -> Any:
 
     @x5c.encoder  # type: ignore
     def x5c(value):
-        return [
-            base64.b64encode(crypto.dump_certificate(crypto.FILETYPE_ASN1, cert.wrapped))
-            for cert in value
-        ]
+        return [base64.b64encode(cert._wrapped_new.public_bytes(Encoding.DER)) for cert in value]
 
     @x5c.decoder  # type: ignore
     def x5c(value):
         try:
             return tuple(
-                util.ComparableX509(
-                    crypto.load_certificate(crypto.FILETYPE_ASN1, base64.b64decode(cert))
-                )
+                util.ComparableX509(x509.load_der_x509_certificate(base64.b64decode(cert)))
                 for cert in value
             )
-        except crypto.Error as error:
+        except Exception as error:
             raise errors.DeserializationError(error)