Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package python-pysaml2 for openSUSE:Factory checked in at 2026-08-14 22:06:06 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/python-pysaml2 (Old) and /work/SRC/openSUSE:Factory/.python-pysaml2.new.1258 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "python-pysaml2" Fri Aug 14 22:06:06 2026 rev:35 rq:1370948 version:7.5.4 Changes: -------- --- /work/SRC/openSUSE:Factory/python-pysaml2/python-pysaml2.changes 2025-04-08 17:53:06.119201696 +0200 +++ /work/SRC/openSUSE:Factory/.python-pysaml2.new.1258/python-pysaml2.changes 2026-08-14 22:06:08.973222128 +0200 @@ -1,0 +2,13 @@ +Thu Aug 13 06:25:15 UTC 2026 - Steve Kowalik <[email protected]> + +- Update to 7.5.4: + * Minor refactor to handle shelve.open and dbm errors + * Remove import of deprecated cgi module + * Replace deprecated datetime.utcnow() by datetime.now(timezone.utc) + * deps: Remove the importlib_metadata dependency + * deps: Remove the importlib_resources dependency + * Fix prepare_for_negotiated_authenticate to avoid double signing redirect + requests +- Refresh patch use-cryptography.patch + +------------------------------------------------------------------- Old: ---- v7.5.2.tar.gz New: ---- v7.5.4.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ python-pysaml2.spec ++++++ --- /var/tmp/diff_new_pack.encezK/_old 2026-08-14 22:06:09.972257788 +0200 +++ /var/tmp/diff_new_pack.encezK/_new 2026-08-14 22:06:09.973257824 +0200 @@ -1,7 +1,7 @@ # # spec file for package python-pysaml2 # -# Copyright (c) 2025 SUSE LLC +# Copyright (c) 2026 SUSE LLC and contributors # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed @@ -19,7 +19,7 @@ %global modname pysaml2 %{?sle15_python_module_pythons} Name: python-pysaml2 -Version: 7.5.2 +Version: 7.5.4 Release: 0 Summary: Python implementation of SAML Version 2 to be used in a WSGI environment License: Apache-2.0 @@ -37,7 +37,6 @@ BuildRequires: %{python_module pymongo >= 3.5} BuildRequires: %{python_module pytest} BuildRequires: %{python_module python-dateutil} -BuildRequires: %{python_module pytz} BuildRequires: %{python_module requests >= 1.0.0} BuildRequires: %{python_module responses} BuildRequires: %{python_module xmlschema >= 2} @@ -49,16 +48,14 @@ BuildRequires: python-rpm-macros BuildRequires: update-alternatives BuildRequires: xmlsec1 -Requires: python-Paste -Requires: python-cryptography >= 3.1 +Requires: python-cryptography >= 40.0 Requires: python-defusedxml -Requires: python-pyOpenSSL Requires: python-pymongo >= 3.5 Requires: python-python-dateutil -Requires: python-pytz Requires: python-requests >= 1.0.0 Requires: python-xmlschema >= 1.2.1 -Requires: python-zope.interface +Recommends: python-Paste +Recommends: python-zope.interface Requires(post): update-alternatives Requires(postun): update-alternatives # We need to have arch build to make ifarch condition below working @@ -90,16 +87,16 @@ %python_expand %fdupes %{buildroot}%{$python_sitelib} %check -# https://github.com/IdentityPython/pysaml2/issues/858 -sed -i 's:import mock:from unittest import mock:' tests/test_41_response.py -sed -i 's:mock.mock:unittest.mock:' tests/test_52_default_sign_alg.py -# Excluded tests for i586 gh#IdentityPython/pysaml2#682 and gh#IdentityPython/pysaml2#759 # Exclude broken namespace test (https://github.com/IdentityPython/pysaml2/issues/921) -%ifarch %{ix86} -%pytest -k "not (test_namespace_processing or test_assertion_consumer_service or test_swamid_sp or test_swamid_idp or test_other_response or test_mta or test_unknown_subject or test_filter_ava_registration_authority_1)" tests -%else -%pytest -k "not test_namespace_processing" tests -%endif +# test_valid_saml_response_doc broken with new xmlschema release +donttest="test_namespace_processing or test_valid_saml_response_doc" +# Excluded tests for i586 gh#IdentityPython/pysaml2#682 and gh#IdentityPython/pysaml2#759 +if [ $(getconf LONG_BIT) -eq 32 ]; then + donttest+=" or test_assertion_consumer_service or test_swamid_sp" + donttest+=" or test_swamid_idp or test_other_response or test_mta" + donttest+=" or test_unknown_subject or test_filter_ava_registration_authority_1" +fi +%pytest --ignore tests/test_schema_validator.py -k "not ($donttest)" tests %post %python_install_alternative make_metadata parse_xsd2 mdexport merge_metadata ++++++ use-cryptography.patch ++++++ --- /var/tmp/diff_new_pack.encezK/_old 2026-08-14 22:06:10.033259965 +0200 +++ /var/tmp/diff_new_pack.encezK/_new 2026-08-14 22:06:10.037260108 +0200 @@ -9,31 +9,31 @@ src/saml2/sigver.py | 12 +-- 3 files changed, 105 insertions(+), 88 deletions(-) -diff --git a/pyproject.toml b/pyproject.toml -index 985692043..8a7cd9185 100644 ---- a/pyproject.toml -+++ b/pyproject.toml -@@ -37,12 +37,11 @@ parse_xsd2 = "saml2.tools.parse_xsd2:main" - - [tool.poetry.dependencies] - python = "^3.9" --cryptography = ">=3.1" -+cryptography = ">=40.0" - defusedxml = "*" - importlib-metadata = {version = ">=1.7.0", python = "<3.8"} - importlib-resources = {python = "<3.9", version = "*"} - paste = {optional = true, version = "*"} --pyopenssl = "<24.3.0" - python-dateutil = "*" - pytz = "*" - "repoze.who" = {optional = true, version = "*"} -diff --git a/src/saml2/cert.py b/src/saml2/cert.py -index c5f626601..1759b9b24 100644 ---- a/src/saml2/cert.py -+++ b/src/saml2/cert.py -@@ -5,7 +5,11 @@ +Index: pysaml2-7.5.4/pyproject.toml +=================================================================== +--- pysaml2-7.5.4.orig/pyproject.toml ++++ pysaml2-7.5.4/pyproject.toml +@@ -23,9 +23,8 @@ classifiers = [ + ] + requires-python = ">= 3.9" + dependencies = [ +- "cryptography >=3.1", ++ "cryptography >=40", + "defusedxml", +- "pyopenssl <24.3.0", + "python-dateutil", + "requests >=2.0.0,<3.0.0", # ^2 means compatible with 2.x + "xmlschema >=2.0.0,<3.0.0" +Index: pysaml2-7.5.4/src/saml2/cert.py +=================================================================== +--- pysaml2-7.5.4.orig/src/saml2/cert.py ++++ pysaml2-7.5.4/src/saml2/cert.py +@@ -4,9 +4,14 @@ import base64 from os import remove from os.path import join + from datetime import datetime ++from datetime import timedelta + from datetime import timezone -from OpenSSL import crypto +from cryptography import x509 @@ -42,9 +42,9 @@ +from cryptography.hazmat.primitives.asymmetric import rsa +from cryptography.x509.oid import NameOID import dateutil.parser - import pytz -@@ -36,7 +40,6 @@ def create_certificate( + import saml2.cryptography.pki +@@ -36,7 +41,6 @@ class OpenSSLWrapper: valid_to=315360000, sn=1, key_length=1024, @@ -52,7 +52,7 @@ write_to_file=False, cert_dir="", cipher_passphrase=None, -@@ -87,8 +90,6 @@ def create_certificate( +@@ -87,8 +91,6 @@ class OpenSSLWrapper: is 1. :param key_length: Length of the key to be generated. Defaults to 1024. @@ -61,7 +61,7 @@ :param write_to_file: True if you want to write the certificate to a file. The method will then return a tuple with path to certificate file and -@@ -131,49 +132,68 @@ def create_certificate( +@@ -131,49 +133,68 @@ class OpenSSLWrapper: k_f = join(cert_dir, key_file) # create a key pair @@ -109,13 +109,13 @@ - cert.set_issuer(cert.get_subject()) - cert.set_pubkey(k) - cert.sign(k, hash_alg) -+ now = datetime.datetime.now(datetime.UTC) ++ now = datetime.now(timezone.utc) + builder = builder.serial_number( + sn, + ).not_valid_before( -+ now + datetime.timedelta(seconds=valid_from), ++ now + timedelta(seconds=valid_from), + ).not_valid_after( -+ now + datetime.timedelta(seconds=valid_to), ++ now + timedelta(seconds=valid_to), + ).issuer_name( + subject_name, + ).public_key( @@ -157,7 +157,7 @@ return c_f, k_f return tmp_cert, tmp_key except Exception as ex: -@@ -198,7 +218,6 @@ def create_cert_signed_certificate( +@@ -198,7 +219,6 @@ class OpenSSLWrapper: sign_cert_str, sign_key_str, request_cert_str, @@ -165,7 +165,7 @@ valid_from=0, valid_to=315360000, sn=1, -@@ -222,8 +241,6 @@ def create_cert_signed_certificate( +@@ -222,8 +242,6 @@ class OpenSSLWrapper: the requested certificate. If you only have a file use the method read_str_from_file to get a string representation. @@ -174,7 +174,7 @@ :param valid_from: When the certificate starts to be valid. Amount of seconds from when the certificate is generated. -@@ -237,27 +254,29 @@ def create_cert_signed_certificate( +@@ -237,27 +255,29 @@ class OpenSSLWrapper: :return: String representation of the signed certificate. """ @@ -185,7 +185,13 @@ - else: - ca_key = crypto.load_privatekey(crypto.FILETYPE_PEM, sign_key_str) - req_cert = crypto.load_certificate_request(crypto.FILETYPE_PEM, request_cert_str) -- ++ if isinstance(sign_cert_str, str): ++ sign_cert_str = sign_cert_str.encode("utf-8") ++ ca_cert = x509.load_pem_x509_certificate(sign_cert_str) ++ ca_key = serialization.load_pem_private_key( ++ sign_key_str, password=passphrase) ++ req_cert = x509.load_pem_x509_csr(request_cert_str) + - cert = crypto.X509() - cert.set_subject(req_cert.get_subject()) - cert.set_serial_number(sn) @@ -199,22 +205,15 @@ - if isinstance(cert_dump, str): - return cert_dump - return cert_dump.decode("utf-8") -+ if isinstance(sign_cert_str, str): -+ sign_cert_str = sign_cert_str.encode("utf-8") -+ ca_cert = x509.load_pem_x509_certificate(sign_cert_str) -+ ca_key = serialization.load_pem_private_key( -+ sign_key_str, password=passphrase) -+ req_cert = x509.load_pem_x509_csr(request_cert_str) -+ -+ now = datetime.datetime.now(datetime.UTC) ++ now = datetime.now(timezone.utc) + cert = x509.CertificateBuilder().subject_name( + req_cert.subject, + ).serial_number( + sn, + ).not_valid_before( -+ now + datetime.timedelta(seconds=valid_from), ++ now + timedelta(seconds=valid_from), + ).not_valid_after( -+ now + datetime.timedelta(seconds=valid_to), ++ now + timedelta(seconds=valid_to), + ).issuer_name( + ca_cert.subject, + ).public_key( @@ -225,13 +224,13 @@ def verify_chain(self, cert_chain_str_list, cert_str): """ -@@ -276,13 +295,6 @@ def verify_chain(self, cert_chain_str_list, cert_str): +@@ -276,13 +296,6 @@ class OpenSSLWrapper: cert_str = tmp_cert_str return (True, "Signed certificate is valid and correctly signed by CA " "certificate.") - def certificate_not_valid_yet(self, cert): - starts_to_be_valid = dateutil.parser.parse(cert.get_notBefore()) -- now = pytz.UTC.localize(datetime.datetime.utcnow()) +- now = datetime.now(timezone.utc) - if starts_to_be_valid < now: - return False - return True @@ -239,22 +238,21 @@ def verify(self, signing_cert_str, cert_str): """ Verifies if a certificate is valid and signed by a given certificate. -@@ -303,34 +315,34 @@ def verify(self, signing_cert_str, cert_str): +@@ -303,34 +316,34 @@ class OpenSSLWrapper: Message = Why the validation failed. """ try: - ca_cert = crypto.load_certificate(crypto.FILETYPE_PEM, signing_cert_str) - cert = crypto.load_certificate(crypto.FILETYPE_PEM, cert_str) -- -- if self.certificate_not_valid_yet(ca_cert): + if isinstance(signing_cert_str, str): + signing_cert_str = signing_cert_str.encode("utf-8") + if isinstance(cert_str, str): + cert_str = cert_str.encode("utf-8") + ca_cert = x509.load_pem_x509_certificate(signing_cert_str) + cert = x509.load_pem_x509_certificate(cert_str) -+ now = datetime.datetime.now(datetime.UTC) -+ ++ now = datetime.now(timezone.utc) + +- if self.certificate_not_valid_yet(ca_cert): + if ca_cert.not_valid_before_utc >= now: return False, "CA certificate is not valid yet." @@ -290,7 +288,7 @@ return False, f"Certificate is incorrectly signed: {str(e)}" except Exception as e: return False, f"Certificate is not valid for an unknown reason. {str(e)}" -@@ -352,8 +364,14 @@ def read_cert_from_file(cert_file, cert_type="pem"): +@@ -352,8 +365,14 @@ def read_cert_from_file(cert_file, cert_ data = fp.read() try: @@ -307,20 +305,20 @@ except Exception as e: raise CertificateError(e) -diff --git a/src/saml2/sigver.py b/src/saml2/sigver.py -index f3af1ec99..98d11b1d1 100644 ---- a/src/saml2/sigver.py -+++ b/src/saml2/sigver.py -@@ -28,7 +28,7 @@ - +Index: pysaml2-7.5.4/src/saml2/sigver.py +=================================================================== +--- pysaml2-7.5.4.orig/src/saml2/sigver.py ++++ pysaml2-7.5.4/src/saml2/sigver.py +@@ -18,7 +18,7 @@ from time import mktime from urllib import parse + from uuid import uuid4 as gen_random_key -from OpenSSL import crypto +from cryptography import x509 - import pytz + import dateutil from saml2 import ExtensionElement -@@ -383,14 +383,14 @@ def active_cert(key): +@@ -373,14 +373,14 @@ def active_cert(key): """ try: cert_str = pem_format(key) @@ -329,11 +327,10 @@ except AttributeError: return False -- now = pytz.UTC.localize(datetime.datetime.utcnow()) + now = datetime.now(timezone.utc) - valid_from = dateutil.parser.parse(cert.get_notBefore()) - valid_to = dateutil.parser.parse(cert.get_notAfter()) - active = not cert.has_expired() and valid_from <= now < valid_to -+ now = datetime.datetime.now(datetime.UTC) + valid_from = cert.not_valid_before_utc + valid_to = cert.not_valid_after_utc + active = valid_from <= now < valid_to ++++++ v7.5.2.tar.gz -> v7.5.4.tar.gz ++++++ ++++ 1767 lines of diff (skipped)
