Skip to content

Commit aa72d48

Browse files
jeohistjeohist
committed
Remove pyOpenSSL
Since we are only using pyOpenSSL to generate certificates, and this functionality is now deprecated... Move functionality to cryptography instead
1 parent 8c49274 commit aa72d48

3 files changed

Lines changed: 86 additions & 50 deletions

File tree

‎requirements-dev.in‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ pytest==8.2.2
44
pytest-timer==1.0.0
55
pytest-timeout==2.3.1
66
pylint==3.2.7
7-
pyopenssl==24.0.0
87
randomname==0.2.1
98
requests-mock==1.12.1
109
ruff==0.6.4

‎tests/integration/test_certificate_authorities.py‎

Lines changed: 38 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,11 @@
11
import base64
2+
from datetime import datetime, timedelta
23
from socket import gethostname
34

4-
from OpenSSL import crypto
5+
from cryptography import x509
6+
from cryptography.hazmat.primitives import hashes, serialization
7+
from cryptography.hazmat.primitives.asymmetric import rsa
8+
from cryptography.x509.oid import NameOID
59

610
from tests.integration import basetest
711

@@ -15,28 +19,40 @@ def setUp(self):
1519
self.certificate = self._create_self_signed_cert()
1620

1721
def _create_self_signed_cert(self):
22+
# Generate a private key
23+
private_key = rsa.generate_private_key(
24+
public_exponent=65537,
25+
key_size=2048,
26+
)
27+
28+
# Create a self-signed certificate
29+
subject = issuer = x509.Name([
30+
x509.NameAttribute(NameOID.COUNTRY_NAME, "NL"),
31+
x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, "Rotterdam"),
32+
x509.NameAttribute(NameOID.LOCALITY_NAME, "Rotterdam"),
33+
x509.NameAttribute(NameOID.ORGANIZATION_NAME, "Mendix"),
34+
x509.NameAttribute(NameOID.ORGANIZATIONAL_UNIT_NAME, "Mendix"),
35+
x509.NameAttribute(NameOID.COMMON_NAME, gethostname()),
36+
])
37+
cert = x509.CertificateBuilder().subject_name(
38+
subject
39+
).issuer_name(
40+
issuer
41+
).public_key(
42+
private_key.public_key()
43+
).serial_number(
44+
1000
45+
).not_valid_before(
46+
datetime.utcnow()
47+
).not_valid_after(
48+
datetime.utcnow() + timedelta(days=365*10)
49+
).add_extension(
50+
x509.BasicConstraints(ca=True, path_length=None), critical=True,
51+
).sign(private_key, hashes.SHA256())
52+
53+
cert_pem = cert.public_bytes(serialization.Encoding.PEM)
1854

19-
# Create a key pair
20-
k = crypto.PKey()
21-
k.generate_key(crypto.TYPE_RSA, 1024)
22-
23-
# Create a self-signed cert
24-
cert = crypto.X509()
25-
cert.get_subject().C = "NL"
26-
cert.get_subject().ST = "Rotterdam"
27-
cert.get_subject().L = "Rotterdam"
28-
cert.get_subject().O = "Mendix" # noqa: E741
29-
cert.get_subject().OU = "Mendix"
30-
cert.get_subject().CN = gethostname()
31-
cert.set_serial_number(1000)
32-
cert.gmtime_adj_notBefore(0)
33-
cert.gmtime_adj_notAfter(10 * 365 * 24 * 60 * 60)
34-
cert.set_issuer(cert.get_subject())
35-
cert.set_pubkey(k)
36-
cert.sign(k, "sha1")
37-
38-
# Return a .PEM certificate
39-
return crypto.dump_certificate(crypto.FILETYPE_PEM, cert)
55+
return cert_pem
4056

4157
def test_certificate_authorities(self):
4258
self.stage_container(

‎tests/unit/test_runtime_configuration.py‎

Lines changed: 48 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,19 @@
11
import base64
22
import json
33
import os
4+
from datetime import datetime, timedelta
45
from socket import gethostname
56
from unittest import TestCase, mock
67

8+
from cryptography import x509
9+
from cryptography.hazmat.primitives import hashes, serialization
10+
from cryptography.hazmat.primitives.asymmetric import rsa
11+
from cryptography.hazmat.primitives.serialization import pkcs12
12+
from cryptography.x509.oid import NameOID
13+
714
from buildpack import util
815
from buildpack.core import runtime, security
916
from lib.m2ee.version import MXVersion
10-
from OpenSSL import crypto
1117

1218

1319
class M2EEMock:
@@ -87,34 +93,49 @@ def test_custom_runtime_setting_is_set(self):
8793
)
8894

8995

90-
def _create_self_signed_cert():
91-
# Create a key pair
92-
k = crypto.PKey()
93-
k.generate_key(crypto.TYPE_RSA, 1024)
94-
95-
# Create a self-signed cert
96-
cert = crypto.X509()
97-
cert.get_subject().C = "NL"
98-
cert.get_subject().ST = "Rotterdam"
99-
cert.get_subject().L = "Rotterdam"
100-
cert.get_subject().O = "Mendix" # noqa: E741
101-
cert.get_subject().OU = "Mendix"
102-
cert.get_subject().CN = gethostname()
103-
cert.set_serial_number(1000)
104-
cert.gmtime_adj_notBefore(0)
105-
cert.gmtime_adj_notAfter(10 * 365 * 24 * 60 * 60)
106-
cert.set_issuer(cert.get_subject())
107-
cert.set_pubkey(k)
108-
cert.sign(k, "sha1")
109-
110-
# Create a P12 container
111-
p12 = crypto.PKCS12()
112-
p12.set_certificate(cert)
113-
114-
return p12.export()
96+
class TestClientCertificateConfiguration(TestCase):
97+
def _create_self_signed_cert(): # pylint: disable=no-method-argument
98+
# Generate a private key
99+
private_key = rsa.generate_private_key(
100+
public_exponent=65537,
101+
key_size=2048,
102+
)
115103

104+
# Create a self-signed certificate
105+
subject = issuer = x509.Name([
106+
x509.NameAttribute(NameOID.COUNTRY_NAME, "NL"),
107+
x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, "Rotterdam"),
108+
x509.NameAttribute(NameOID.LOCALITY_NAME, "Rotterdam"),
109+
x509.NameAttribute(NameOID.ORGANIZATION_NAME, "Mendix"),
110+
x509.NameAttribute(NameOID.ORGANIZATIONAL_UNIT_NAME, "Mendix"),
111+
x509.NameAttribute(NameOID.COMMON_NAME, gethostname()),
112+
])
113+
cert = x509.CertificateBuilder().subject_name(
114+
subject
115+
).issuer_name(
116+
issuer
117+
).public_key(
118+
private_key.public_key()
119+
).serial_number(
120+
1000
121+
).not_valid_before(
122+
datetime.utcnow()
123+
).not_valid_after(
124+
datetime.utcnow() + timedelta(days=365*10)
125+
).add_extension(
126+
x509.BasicConstraints(ca=True, path_length=None), critical=True,
127+
).sign(private_key, hashes.SHA256())
128+
129+
# Serialize private key and certificate to a PKCS12 container
130+
p12 = pkcs12.serialize_key_and_certificates(
131+
name=b"selfsigned",
132+
key=private_key,
133+
cert=cert,
134+
cas=None,
135+
encryption_algorithm=serialization.NoEncryption()
136+
)
116137

117-
class TestClientCertificateConfiguration(TestCase):
138+
return p12
118139

119140
CERTIFICATE_ENV = {
120141
"CLIENT_CERTIFICATES": json.dumps(

0 commit comments

Comments
 (0)