fedmsg uses PyCA cryptography and PyOpenSSL's OpenSSL.crypto module. Please consider t

<a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/us

Replace PyOpenSSL with PyCA Crytography about fedmsg HOT 4 OPEN

tiran commented on August 16, 2024

Replace PyOpenSSL with PyCA Crytography

from fedmsg.

Comments (4)

jeremycline commented on August 16, 2024

@tiran I'd be very happy to drop the PyOpenSSL dependency. If I recall correctly, I needed it to do certificate chain validation and cryptography didn't have an API for that. Is that still the case? I saw it was mentioned that Alex was working on an implementation, but I couldn't find a PR or changelog entry so I'm guessing that's not landed yet.

from fedmsg.

tiran commented on August 16, 2024

PyOpenSSL is implemented on top of cryptography. You should be able to do anything with cryptography, but cryptography may not have a public API for that. I'll get back to you.

from fedmsg.

tiran commented on August 16, 2024

For the record, cryptography does not have an API for cert chain validation against a CRL and trust anchors yet,

fedmsg/fedmsg/crypto/x509_ng.py

Lines 209 to 240 in 78c0ffa

 def _validate_signing_cert(ca_certificate, certificate, crl=None): 

 """ 

  Validate an X509 certificate using pyOpenSSL. 

  .. note:: 

  pyOpenSSL is a short-term solution to certificate validation. pyOpenSSL 

  is basically in maintenance mode and there's a desire in upstream to move 

  all the functionality into cryptography. 

  Args: 

  ca_certificate (str): A PEM-encoded Certificate Authority certificate to 

  validate the ``certificate`` with. 

  certificate (str): A PEM-encoded certificate that is in need of validation. 

  crl (str): A PEM-encoded Certificate Revocation List which, if provided, will 

  be taken into account when validating the certificate. 

  Raises: 

  X509StoreContextError: If the certificate failed validation. The 

  exception contains the details of the error. 

  """ 

 pyopenssl_cert = load_certificate(FILETYPE_PEM, certificate) 

 pyopenssl_ca_cert = load_certificate(FILETYPE_PEM, ca_certificate) 

 cert_store = X509Store() 

 cert_store.add_cert(pyopenssl_ca_cert) 

 if crl: 

 pyopenssl_crl = load_crl(FILETYPE_PEM, crl) 

 cert_store.add_crl(pyopenssl_crl) 

 cert_store.set_flags(X509StoreFlags.CRL_CHECK | X509StoreFlags.CRL_CHECK_ALL) 

 cert_store_context = X509StoreContext(cert_store, pyopenssl_cert) 

 cert_store_context.verify_certificate()

from fedmsg.

jeremycline commented on August 16, 2024

Thanks for looking into that. I think that in the medium to long term, fedmsg will drop the signing/verifying messages feature. ZeroMQ provides a feature that covers message authentication so fedmsg doesn't need its own. If the API shows up in cryptography great, but we really should get rid of all the crypto code anyway.

from fedmsg.

Replace PyOpenSSL with PyCA Crytography about fedmsg HOT 4 OPEN

Comments (4)

Related Issues (20)

Recommend Projects

React

Vue.js

Typescript

TensorFlow

Django

Laravel

D3

Recommend Topics

javascript

web

server

Machine learning

Visualization

Game

Recommend Org

Facebook

Microsoft

Google

Alibaba

D3

Tencent

	def _validate_signing_cert(ca_certificate, certificate, crl=None):
	"""
	Validate an X509 certificate using pyOpenSSL.

	.. note::
	pyOpenSSL is a short-term solution to certificate validation. pyOpenSSL
	is basically in maintenance mode and there's a desire in upstream to move
	all the functionality into cryptography.

	Args:
	ca_certificate (str): A PEM-encoded Certificate Authority certificate to
	validate the ``certificate`` with.
	certificate (str): A PEM-encoded certificate that is in need of validation.
	crl (str): A PEM-encoded Certificate Revocation List which, if provided, will
	be taken into account when validating the certificate.

	Raises:
	X509StoreContextError: If the certificate failed validation. The
	exception contains the details of the error.
	"""
	pyopenssl_cert = load_certificate(FILETYPE_PEM, certificate)
	pyopenssl_ca_cert = load_certificate(FILETYPE_PEM, ca_certificate)

	cert_store = X509Store()
	cert_store.add_cert(pyopenssl_ca_cert)
	if crl:
	pyopenssl_crl = load_crl(FILETYPE_PEM, crl)
	cert_store.add_crl(pyopenssl_crl)
	cert_store.set_flags(X509StoreFlags.CRL_CHECK \| X509StoreFlags.CRL_CHECK_ALL)

	cert_store_context = X509StoreContext(cert_store, pyopenssl_cert)
	cert_store_context.verify_certificate()