[patch] Modified patch to include CryptographyDeprecationWarning import

certbot.patch (text/plain), 2.41 KB, created by Ian Pickworth on 2024-10-13 10:56:12 UTC

*** /usr/lib/python3.12/site-packages/certbot/ocsp.py.original	2024-10-13 11:36:24.016615903 +0100
--- /usr/lib/python3.12/site-packages/certbot/ocsp.py	2024-10-13 11:51:53.793615903 +0100
***************
*** 4,9 ****
--- 4,10 ----
  import logging
  import re
  import subprocess
+ import warnings
  from subprocess import PIPE
  from typing import Optional
  from typing import Tuple
***************
*** 15,20 ****
--- 16,22 ----
  from cryptography.hazmat.primitives import hashes
  from cryptography.hazmat.primitives import serialization
  from cryptography.x509 import ocsp
+ from cryptography.utils import CryptographyDeprecationWarning
  import pytz
  import requests
  
***************
*** 235,246 ****
      # https://github.com/openssl/openssl/blob/ef45aa14c5af024fcb8bef1c9007f3d1c115bd85/crypto/ocsp/ocsp_cl.c#L338-L391
      # thisUpdate/nextUpdate are expressed in UTC/GMT time zone
      now = datetime.now(pytz.UTC).replace(tzinfo=None)
!     if not response_ocsp.this_update:
!         raise AssertionError('param thisUpdate is not set.')
!     if response_ocsp.this_update > now + timedelta(minutes=5):
!         raise AssertionError('param thisUpdate is in the future.')
!     if response_ocsp.next_update and response_ocsp.next_update < now - timedelta(minutes=5):
!         raise AssertionError('param nextUpdate is in the past.')
  
  
  def _check_ocsp_response_signature(response_ocsp: 'ocsp.OCSPResponse',
--- 237,253 ----
      # https://github.com/openssl/openssl/blob/ef45aa14c5af024fcb8bef1c9007f3d1c115bd85/crypto/ocsp/ocsp_cl.c#L338-L391
      # thisUpdate/nextUpdate are expressed in UTC/GMT time zone
      now = datetime.now(pytz.UTC).replace(tzinfo=None)
!     with warnings.catch_warnings():
!         # Workaround for deprecation warnings w/ newer cryptography
!         # https://github.com/certbot/certbot/issues/9967 (bug #937889)
!         warnings.filterwarnings("ignore", category=CryptographyDeprecationWarning)
! 
!         if not response_ocsp.this_update:
!             raise AssertionError('param thisUpdate is not set.')
!         if response_ocsp.this_update > now + timedelta(minutes=5):
!             raise AssertionError('param thisUpdate is in the future.')
!         if response_ocsp.next_update and response_ocsp.next_update < now - timedelta(minutes=5):
!             raise AssertionError('param nextUpdate is in the past.')
  
  
  def _check_ocsp_response_signature(response_ocsp: 'ocsp.OCSPResponse',