Merge remote-tracking branch 'origin/main' into mldsa

jku · jku · commit 7637c2aaef5b · 2026-06-11T13:26:38.000+03:00
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,18 @@
 # Changelog
 
+## securesystemslib v1.4.0
+
+### Fixed
+
+* HSMSigner: Fix usage with multi-byte keyids (#1107)
+
+### Changed
+
+* SigstoreSigner: Update to current sigstore-python API (#1035)
+* Deprecate Python 3.9 support (#1069)
+* Various testing changes -- note that AWS is currently not tested
+  in CI (see #1104)
+
 ## securesystemslib v1.3.1
 
 ### Fixed
diff --git a/requirements-aws.txt b/requirements-aws.txt
@@ -1,2 +1,2 @@
-boto3~=1.42.64
-botocore~=1.42.64
+boto3~=1.43.22
+botocore~=1.43.22
diff --git a/requirements-build.txt b/requirements-build.txt
@@ -1 +1 @@
-build==1.4.3
+build==1.5.0
diff --git a/requirements-lint.txt b/requirements-lint.txt
@@ -1,3 +1,3 @@
-mypy==1.20.2
-ruff==0.15.12
-zizmor==1.24.1
+mypy==2.1.0
+ruff==0.15.15
+zizmor==1.25.2
diff --git a/requirements-test.txt b/requirements-test.txt
@@ -1,2 +1,2 @@
 # additional test tools
-coverage==7.13.5
+coverage==7.14.1
diff --git a/securesystemslib/__init__.py b/securesystemslib/__init__.py
@@ -1,6 +1,6 @@
 import logging
 
-__version__ = "1.3.1"
+__version__ = "1.4.0"
 
 # Configure a basic 'securesystemslib' top-level logger with a StreamHandler
 # (print to console) and the WARNING log level (print messages of type
diff --git a/securesystemslib/signer/_hsm_signer.py b/securesystemslib/signer/_hsm_signer.py
@@ -210,11 +210,13 @@ def _find_key(
         if key_type is None:
             key_type = PyKCS11.CKO_PUBLIC_KEY
 
+        cka_id_filter = list(keyid.to_bytes((keyid.bit_length() + 7) // 8 or 1, "big"))
+
         keys = session.findObjects(
             [
                 (PyKCS11.CKA_CLASS, key_type),
                 (PyKCS11.CKA_KEY_TYPE, PyKCS11.CKK_ECDSA),
-                (PyKCS11.CKA_ID, (keyid,)),
+                (PyKCS11.CKA_ID, cka_id_filter),
             ]
         )
         if not keys:
diff --git a/tests/data/pems/ecdsa_private_encrypted.pem b/tests/data/pems/ecdsa_private_encrypted.pem
diff --git a/tests/data/pems/ed25519_private_encrypted.pem b/tests/data/pems/ed25519_private_encrypted.pem
diff --git a/tests/data/pems/rsa_private_encrypted.pem b/tests/data/pems/rsa_private_encrypted.pem
diff --git a/tests/test_hsm_signer.py b/tests/test_hsm_signer.py
@@ -30,13 +30,16 @@ class TestHSM(unittest.TestCase):
 
     hsm_keyid = 1
     hsm_keyid_default = 2
+    hsm_keyid_odd = 258
     hsm_user_pin = "123456"
 
     @staticmethod
     def _generate_key_pair(session, keyid, curve):
         "Create ecdsa key pair on hsm"
         params = ECDomainParameters(name="named", value=NamedCurve(curve.name)).dump()
 
+        cka_id = list(keyid.to_bytes((keyid.bit_length() + 7) // 8 or 1, "big"))
+
         public_template = [
             (PyKCS11.CKA_CLASS, PyKCS11.CKO_PUBLIC_KEY),
             (PyKCS11.CKA_PRIVATE, PyKCS11.CK_FALSE),
@@ -47,7 +50,7 @@ def _generate_key_pair(session, keyid, curve):
             (PyKCS11.CKA_KEY_TYPE, PyKCS11.CKK_ECDSA),
             (PyKCS11.CKA_EC_PARAMS, params),
             (PyKCS11.CKA_LABEL, curve.name),
-            (PyKCS11.CKA_ID, (keyid,)),
+            (PyKCS11.CKA_ID, cka_id),
         ]
         private_template = [
             (PyKCS11.CKA_CLASS, PyKCS11.CKO_PRIVATE_KEY),
@@ -58,7 +61,7 @@ def _generate_key_pair(session, keyid, curve):
             (PyKCS11.CKA_SIGN, PyKCS11.CK_TRUE),
             (PyKCS11.CKA_UNWRAP, PyKCS11.CK_FALSE),
             (PyKCS11.CKA_LABEL, curve.name),
-            (PyKCS11.CKA_ID, (keyid,)),
+            (PyKCS11.CKA_ID, cka_id),
         ]
 
         session.generateKeyPair(
@@ -100,6 +103,7 @@ def setUpClass(cls):
         # Generate test ecdsa key pairs for curves secp256r1 and secp384r1 on test token
         cls._generate_key_pair(session, cls.hsm_keyid, SECP256R1)
         cls._generate_key_pair(session, cls.hsm_keyid_default, SECP384R1)
+        cls._generate_key_pair(session, cls.hsm_keyid_odd, SECP256R1)
 
         session.logout()
         session.closeSession()
@@ -113,7 +117,7 @@ def tearDownClass(cls):
     def test_hsm(self):
         """Test HSM key export and signing."""
 
-        for hsm_keyid in [self.hsm_keyid, self.hsm_keyid_default]:
+        for hsm_keyid in [self.hsm_keyid, self.hsm_keyid_default, self.hsm_keyid_odd]:
             _, key = HSMSigner.import_(hsm_keyid, self.token_filter)
             signer = HSMSigner(
                 hsm_keyid, self.token_filter, key, lambda sec: self.hsm_user_pin

Original file line number	Diff line number	Diff line change
`@@ -1,2 +1,2 @@`
`1`	`1`	`# additional test tools`
`2`		`-coverage==7.13.5`
	`2`	`+coverage==7.14.1`
Original file line number	Diff line number	Diff line change
`@@ -210,11 +210,13 @@ def _find_key(`
`210`	`210`	`if key_type is None:`
`211`	`211`	`key_type = PyKCS11.CKO_PUBLIC_KEY`
`212`	`212`
	`213`	`+ cka_id_filter = list(keyid.to_bytes((keyid.bit_length() + 7) // 8 or 1, "big"))`
	`214`	`+`
`213`	`215`	`keys = session.findObjects(`
`214`	`216`	`[`
`215`	`217`	`(PyKCS11.CKA_CLASS, key_type),`
`216`	`218`	`(PyKCS11.CKA_KEY_TYPE, PyKCS11.CKK_ECDSA),`
`217`		`- (PyKCS11.CKA_ID, (keyid,)),`
	`219`	`+ (PyKCS11.CKA_ID, cka_id_filter),`
`218`	`220`	`]`
`219`	`221`	`)`
`220`	`222`	`if not keys:`