aboutsummaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* nit: line wrapping change (#4004)Alex Gaynor2017-10-281-2/+1
|
* buster is 3.6 now (#4003)Alex Gaynor2017-10-281-1/+1
|
* clearly error out on older setuptools (#4000)Alex Gaynor2017-10-281-0/+10
| | | | | | * clearly error out on older setuptools * use the right thing
* Forward port 2.1.2 changelog (#3998)Alex Gaynor2017-10-241-0/+8
|
* Fixes #3947 -- remove the docutils.conf (#3995)Alex Gaynor2017-10-232-4/+2
| | | | | | * Fixes #3947 -- remove the docutils.conf * include minimum versions
* Latest flake8 has some rules about variable names (#3996)Alex Gaynor2017-10-232-4/+4
|
* rolling has 36 now that it is artful (#3991)Alex Gaynor2017-10-211-1/+1
|
* fixed #3986 -- properly use unicode for DNSName (#3988)Alex Gaynor2017-10-191-4/+4
|
* Add Multifernet.rotate method (#3979)Chris Wolfe2017-10-196-3/+126
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * add rotate method * add some more tests for the failure modes * start adding some documentation for the rotate method * operate on a single token at a time, leave lists to the caller * add versionadded add versionadded, drop rotate from class doctest * give rotate a doctest * single level, not aligned * add changelog for mf.rotate * show that, once rotated, the old fernet instance can no longer decrypt the token * add the instead of just the how * update docs to reflect removal of ttl from rotate * update tests * refactor internal methods so that we can extract the timestamp * implement rotate * update wordlist (case sensitive?) * lints * consistent naming * get_token_data/get_unverified_token_data -> better name * doc changes * use the static method, do not treat as imethod * move up to MultiFernet docs * add to authors * alter wording * monkeypatch time to make it less possible for the test to pass simply due to calls occuring in less than one second * set the time after encryption to make sure that the time is preserved as part of re-encryption
* Make changelog for A-label more readable (#3977)Christian Heimes2017-10-171-7/+9
| | | | | "value, value, and value" isn't very helpful. Signed-off-by: Christian Heimes <cheimes@redhat.com>
* use the correct modern API (#3984)Alex Gaynor2017-10-171-1/+1
|
* port 2.1.1 changelog (#3975)Paul Kehrer2017-10-121-0/+7
|
* add a faq entry for a message outdated pip/setuptools can output (#3971)Paul Kehrer2017-10-121-0/+7
| | | | | | * add a faq entry for a message outdated pip/setuptools can output * attention to detail is not my strong suit
* random hack to maybe support older pips (#3970)Alex Gaynor2017-10-121-1/+1
|
* bump libressl to 2.6.2 (#3967)Alex Gaynor2017-10-121-1/+1
|
* Inline calls to bit_length now that it's trivial (#3966)Alex Gaynor2017-10-128-12/+18
| | | | | | | | * Inline calls to bit_length now that it's trivial * unused imports * An comment
* Debian sid is python3.6 now (#3968)Alex Gaynor2017-10-122-1/+4
| | | | | | * Debian sid is python3.6 now * Workaround because apparently measuring coverage correctly isn't a legitimate use case
* expunge python 2.6 (#3962)Paul Kehrer2017-10-1112-45/+15
| | | | | | | | | | * expunge python 2.6 * how did THAT happen * remove another unsupported python from the tox envlist * hypothesis can now be unconditionally imported
* increment deprecation for the 2.2 release cycle (#3961)Paul Kehrer2017-10-111-2/+1
|
* start the twenty second release cycle (#3960)Paul Kehrer2017-10-113-2/+9
|
* update changelog release date and bump version for 2.1 release (#3958)Paul Kehrer2017-10-113-6/+4
|
* Update docs and changelog for URI, RFC822Name, and DNSName (#3955)Paul Kehrer2017-10-114-77/+58
| | | | | | | | | | | | | | | | * Update docs and changelog for URI, RFC822Name, and DNSName As of 2.1 we want users to pass A-label strings, but we still accept U-label strings and auto-encode on their behalf (with a deprecation warning). However, we do not return U-label in the value attribute so we are making a backwards incompatible change for users that utilize internationalized domain names. * language updates * add presentational to the word list * the linux dictionary is pathetic
* let's talk about bits baby (#3956)Paul Kehrer2017-10-118-57/+71
|
* parallelize docs work and always give full traceback on exception (#3957)Paul Kehrer2017-10-111-4/+4
| | | | In local testing this didn't seem to gain much, but it also doesn't hurt so what the hell.
* backwards incompatible change to UniformResourceIdentifier (#3954)Paul Kehrer2017-10-105-228/+199
| | | | | | | | | | | | | | | * backwards incompatible change to UniformResourceIdentifier During this release cycle we decided to officially deprecate passing U-labels to our GeneralName constructors. At first we tried changing this in a purely backwards compatible way but get_values_for_type made that untenable. This PR modifies URI to accept two types: U-label strings (which raises a deprecation warning) and A-label strings (the new preferred type). There is also a constructor for URI that bypasses validation so we can parse garbage out of certificates (and round trip it if necessary) * nonsense empty commit 2.6 and codecov are the worst
* backwards incompatible change to RFC822Name (#3953)Paul Kehrer2017-10-105-85/+79
| | | | | | | | | | | | | | | * backwards incompatible change to RFC822Name During this release cycle we decided to officially deprecate passing U-labels to our GeneralName constructors. At first we tried changing this in a purely backwards compatible way but get_values_for_type made that untenable. This PR modifies RFC822Name to accept two types: U-label strings (which raises a deprecation warning) and A-label strings (the new preferred type). There is also a constructor for RFC822Name that bypasses validation so we can parse garbage out of certificates (and round trip it if necessary) * whoops
* Backwards incompatible change to DNSName (#3951)Paul Kehrer2017-10-107-194/+193
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Backwards incompatible change to DNSName During this release cycle we decided to officially deprecate passing U-labels to our GeneralName constructors. At first we tried changing this in a purely backwards compatible way but get_values_for_type made that untenable. This PR modifies DNSName to take three different types. U-label strings (which raises a deprecation warning), A-label strings (the new preferred type), and bytes (which are assumed to be decodable to unicode strings). The latter, while supported, is primarily intended for use by our parser and allows us to return the actual encoded data in a certificate even if it has not been properly encoded to A-label before the certificate is created. (Of course, if the certificate contains invalid utf8 sequences this will still fail, but let's handle one catastrophic failure at a time). * coverage * don't delete that asterisk from a test. it does things. * no bytes in DNSName. Private constructor for bypassing validation * test unicode in dnsname (yuck) * fix docs * empty commit, you disappoint me codecov * CI is the worst
* add utf8 DNSName x509 vector (#3952)Paul Kehrer2017-10-092-0/+43
|
* update security docs to indicate we staticaly link openssl on linux too (#3949)Alex Gaynor2017-10-051-4/+4
| | | | | | * update security docs to indicate we staticaly link openssl there too * spelling
* do downstream builds as part of our normal parallel jenkins pipeline (#3948)Paul Kehrer2017-10-031-7/+3
| | | | | | * do downstream builds as part of our normal parallel jenkins pipeline * empty
* disable smart quotes in sphinx to workaround a spellchecker issue (#3946)Paul Kehrer2017-10-032-1/+3
| | | | This makes it so we don't have to pin sphinx while we wait for sphinxcontrib-spelling to properly handle smart quotes
* Add support for AES XTS (#3900)Paul Kehrer2017-10-019-11/+168
| | | | | | | | | | | | | | | | | | | | | | | | * Add support for AES XTS We drop the non-byte aligned test vectors because according to NIST http://csrc.nist.gov/groups/STM/cavp/documents/aes/XTSVS.pdf "An implementation may support a data unit length that is not a multiple of 8 bits." OpenSSL does not support this, so we can't use those test vectors. * fix docs and pep8 * docs fix * the spellchecker is so frustrating * add note about AES 192 for XTS (it's not supported) * docs work * enforce key length on ECB mode in AES as well (thanks XTS) * a few more words about why we exclude some test vectors for XTS
* Declare that 2.1 is the last version to support Python 2.6 (#3944)Alex Gaynor2017-10-013-3/+5
| | | | | | * Declare that 2.1 is the last version to support Python 2.6 * It's the Final Countdown!
* add ChaCha20 support (#3919)Paul Kehrer2017-09-286-1/+146
| | | | | | | | | | * add ChaCha20 support * review feedback * 256 divided by 8 is what again? * ...
* Expose FIPS funcs for OpenSSL. (#3939)Scott Sturdivant2017-09-273-0/+37
| | | | | | | | | | | | | * Expose FIPS funcs for OpenSSL. * Remove FIPS customization / conditionals. It seems that the FIPS functions are always defined, regardless of if the FIPS module is present. * Do not include FIPS_selftest_check func. * Libressl does not have FIPS.
* Update the list of macOS versions we test on to match reality (#3942)Alex Gaynor2017-09-271-1/+1
|
* both parse and encode the ASN1 string type for Name attributes (#3896)Paul Kehrer2017-09-256-23/+107
| | | | | | | | | | | | | | | * both parse and encode the ASN1 string type for Name attributes Previously cryptography encoded everything (except country names) as UTF8String. This caused problems with chain building in libraries like NSS where the subject and issuer are expected to match byte-for-byte. With this change we now parse and store the ASN1 string type as a private _type in NameAttribute. We then use this to encode when issuing a new certificate. This allows the CertificateBuilder to properly construct an identical issuer and fixes the issue with NSS. * make the sentinel private too
* blacklist yet another version of sphinx (#3940)Alex Gaynor2017-09-261-1/+1
|
* FreshestCRL extension support (#3937)Paul Kehrer2017-09-238-7/+344
| | | | | | | | | | * add freshest CRL support * add tests * add changelog * add tests for FreshestCRL generation
* support delta crl indicator extension (#3936)Paul Kehrer2017-09-2210-5/+121
| | | This is an extension for CRLs
* refactor rsa signature/verification logic to remove duplication (#3903)Paul Kehrer2017-09-211-91/+34
|
* parametrize a bunch of x509 extension tests that were identical (#3931)Paul Kehrer2017-09-211-377/+139
|
* docs for what bytes means for DNSName, URI, and RFC822Name (#3904)Paul Kehrer2017-09-202-9/+41
|
* add Freshest CRL and Delta CRL Indicator test vectors (#3932)Paul Kehrer2017-09-203-0/+34
|
* Mark our custom sphinx extension as parallel safe (#3935)Alex Gaynor2017-09-201-0/+4
|
* correct the docs for CRLReason (#3930)Paul Kehrer2017-09-201-2/+1
|
* Switch NIST PDFs from nvlpubs to csrc which is HTTPS (#3929)Alex Gaynor2017-09-205-8/+8
|
* disable travis mac builders and add a mac jenkins build (#3933)Paul Kehrer2017-09-202-41/+41
| | | | we'll re-enable mac builders when travis recovers and remove the jenkins build
* Update the rest of the NIST urls to their new HTTPS homes (#3928)Alex Gaynor2017-09-203-4/+4
|
* add unique identifier test vector (#3925)Paul Kehrer2017-09-192-2/+15
| | | | | | * add unique identifier test vector * wrap a line I didn't even touch...
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-09 20:39:13 +0000