From: Tim Orling <[email protected]> * Update python3-cryptography-crates.inc * Refresh 0001-pyproject.toml-remove-benchmark-disable-option.patch
For full comparison of changes (298 commits, 202 files changed), see: https://github.com/pyca/cryptography/compare/49.0.0...50.0.0 Upstream release notes: https://cryptography.io/en/50.0.0/changelog/#v50-0-0 50.0.0 - 2026-07-31 SECURITY ISSUE: pkcs7_decrypt_der() and its PEM and S/MIME variants no longer expose distinguishable errors or timing when unwrapping a RecipientInfo’s encryptedKey, which could act as a Bleichenbacher oracle for callers that decrypt untrusted messages. A random key is now substituted on failure, as described in RFC 3218. Credit to X1AOxiang for reporting the issue Deprecated Diffie-Hellman key exchange over finite fields (FFDH). Everything FFDH is deprecated, including the types in cryptography.hazmat.primitives.asymmetric.dh and loading FFDH keys or parameters with the key loading APIs. Users should migrate to a more modern key exchange algorithm. Added xof() class methods to SHAKE128 and SHAKE256 for constructing algorithm instances configured for use with XOFHash. The X.509 verification APIs are now considered stable and are subject to our API stability policy. Added the Cobblestone (streaming symmetric encryption) recipe, an implementation of the Cobblestone-128 and Cobblestone-256 instantiations of the C2SP chunked-encryption specification for streaming authenticated encryption of large messages. Parsing a Signed Certificate Timestamp list now rejects encodings that carry trailing bytes after the list or after an individual SCT, instead of silently ignoring them. Added support for using Name as a field type in the ASN.1 module. Loading a public key or an EC private key now rejects DER where the subjectPublicKey (or EC publicKey) BIT STRING declares a non-zero number of unused bits, instead of silently ignoring it. Parsing a CRL entry’s InvalidityDate extension now rejects a GeneralizedTime that carries fractional seconds or another non-DER form, matching the strict encoding already required for every other X.509 time field. load_der_ocsp_request() and load_der_ocsp_response() now reject a request or response whose version field is not v1, the only version defined by RFC 6960, matching the version validation already performed when loading certificates, CSRs and CRLs. XOFHash is now supported when building against AWS-LC. HMAC (and therefore PBKDF2-HMAC) with SHA-3 hashes is now supported when building against AWS-LC. Diffie-Hellman (Diffie-Hellman key exchange) is now supported when building against AWS-LC. load_der_public_key() and load_pem_public_key() now reject Diffie-Hellman public keys whose modulus is smaller than 512 bits, matching the minimum already enforced when loading DH private keys and when constructing DHParameterNumbers. Added MLDSAMuHasher for incrementally computing the ML-DSA mu (message representative) used by the external-mu signing and verification APIs. The builtin HashAlgorithm classes and the classes in padding can now be compared with ==. CertificateBuilder now supports creating unsigned certificates (RFC 9925) with the create_unsigned method. The X.509 verification APIs now permit ML-DSA-44, ML-DSA-65, and ML-DSA-87 (RFC 9881) public keys and signatures by default. Signed-off-by: Tim Orling <[email protected]> --- .../python/python3-cryptography-common.inc | 2 +- .../python/python3-cryptography-crates.inc | 40 +++++++++---------- .../python/python3-cryptography-vectors.bb | 2 +- .../python/python3-cryptography.bb | 2 +- ...toml-remove-benchmark-disable-option.patch | 12 +++--- 5 files changed, 30 insertions(+), 28 deletions(-) diff --git a/meta/recipes-devtools/python/python3-cryptography-common.inc b/meta/recipes-devtools/python/python3-cryptography-common.inc index fe43af3f13..298c52d1d3 100644 --- a/meta/recipes-devtools/python/python3-cryptography-common.inc +++ b/meta/recipes-devtools/python/python3-cryptography-common.inc @@ -3,4 +3,4 @@ # # Additionally AUH will detect that they share this .inc file and # perform a lockstep upgrade for both. -PV = "49.0.0" +PV = "50.0.0" diff --git a/meta/recipes-devtools/python/python3-cryptography-crates.inc b/meta/recipes-devtools/python/python3-cryptography-crates.inc index ab54bae6bc..f626556e13 100644 --- a/meta/recipes-devtools/python/python3-cryptography-crates.inc +++ b/meta/recipes-devtools/python/python3-cryptography-crates.inc @@ -4,33 +4,33 @@ SRC_URI += " \ crate://crates.io/asn1/0.24.1 \ crate://crates.io/asn1_derive/0.24.1 \ - crate://crates.io/base64/0.22.1 \ - crate://crates.io/bitflags/2.13.0 \ - crate://crates.io/cc/1.2.64 \ + crate://crates.io/base64/0.23.0 \ + crate://crates.io/bitflags/2.13.1 \ + crate://crates.io/cc/1.4.0 \ crate://crates.io/cfg-if/1.0.4 \ crate://crates.io/find-msvc-tools/0.1.9 \ crate://crates.io/foreign-types/0.3.2 \ crate://crates.io/foreign-types-shared/0.1.1 \ crate://crates.io/heck/0.5.0 \ crate://crates.io/itoa/1.0.18 \ - crate://crates.io/libc/0.2.186 \ + crate://crates.io/libc/0.2.189 \ crate://crates.io/once_cell/1.21.4 \ crate://crates.io/openssl/0.10.81 \ crate://crates.io/openssl-macros/0.1.1 \ crate://crates.io/openssl-sys/0.9.117 \ - crate://crates.io/pem/3.0.6 \ + crate://crates.io/pem/4.0.0 \ crate://crates.io/pkg-config/0.3.33 \ - crate://crates.io/portable-atomic/1.13.1 \ - crate://crates.io/proc-macro2/1.0.106 \ + crate://crates.io/portable-atomic/1.14.0 \ + crate://crates.io/proc-macro2/1.0.107 \ crate://crates.io/pyo3/0.29.0 \ crate://crates.io/pyo3-build-config/0.29.0 \ crate://crates.io/pyo3-ffi/0.29.0 \ crate://crates.io/pyo3-macros/0.29.0 \ crate://crates.io/pyo3-macros-backend/0.29.0 \ - crate://crates.io/quote/1.0.45 \ - crate://crates.io/self_cell/1.2.2 \ + crate://crates.io/quote/1.0.47 \ + crate://crates.io/self_cell/1.3.0 \ crate://crates.io/shlex/2.0.1 \ - crate://crates.io/syn/2.0.117 \ + crate://crates.io/syn/2.0.119 \ crate://crates.io/target-lexicon/0.13.5 \ crate://crates.io/unicode-ident/1.0.24 \ crate://crates.io/vcpkg/0.2.15 \ @@ -38,33 +38,33 @@ SRC_URI += " \ SRC_URI[asn1-0.24.1.sha256sum] = "c9795210620c0cb3f9a7ce4f882808c38e1ef7b347c90591dceae0886e031fb1" SRC_URI[asn1_derive-0.24.1.sha256sum] = "909e307f1cc32bb8bccbd98f446e6d1bf03fa30f7b53a4337da7181ad30fa11a" -SRC_URI[base64-0.22.1.sha256sum] = "72b3254f16251a8381aa12e40e3c4d2f0199f8c6508fbecb9d91f575e0fbb8c6" -SRC_URI[bitflags-2.13.0.sha256sum] = "b4388bee8683e3d04af747c73422af53102d2bd24d9eadb6cbc100baef4b43f8" -SRC_URI[cc-1.2.64.sha256sum] = "dad887fd958be91b5098c0248def011f4523ab786cd411be668777e55063501f" +SRC_URI[base64-0.23.0.sha256sum] = "b25655df2c3cdd83c5e5b293b88acd880332b2ddadd7c30ac43144fdc0033da9" +SRC_URI[bitflags-2.13.1.sha256sum] = "b588b76d00fde79687d7646a9b5bdf3cc0f655e0bbd080335a95d7e96f3587da" +SRC_URI[cc-1.4.0.sha256sum] = "5add81bb678e6cb321aff7fa0dc7689ad82b112dbc032cea19f91d6b8e3582b9" SRC_URI[cfg-if-1.0.4.sha256sum] = "9330f8b2ff13f34540b44e946ef35111825727b38d33286ef986142615121801" SRC_URI[find-msvc-tools-0.1.9.sha256sum] = "5baebc0774151f905a1a2cc41989300b1e6fbb29aff0ceffa1064fdd3088d582" SRC_URI[foreign-types-0.3.2.sha256sum] = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1" SRC_URI[foreign-types-shared-0.1.1.sha256sum] = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b" SRC_URI[heck-0.5.0.sha256sum] = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea" SRC_URI[itoa-1.0.18.sha256sum] = "8f42a60cbdf9a97f5d2305f08a87dc4e09308d1276d28c869c684d7777685682" -SRC_URI[libc-0.2.186.sha256sum] = "68ab91017fe16c622486840e4c83c9a37afeff978bd239b5293d61ece587de66" +SRC_URI[libc-0.2.189.sha256sum] = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2" SRC_URI[once_cell-1.21.4.sha256sum] = "9f7c3e4beb33f85d45ae3e3a1792185706c8e16d043238c593331cc7cd313b50" SRC_URI[openssl-0.10.81.sha256sum] = "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45" SRC_URI[openssl-macros-0.1.1.sha256sum] = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c" SRC_URI[openssl-sys-0.9.117.sha256sum] = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695" -SRC_URI[pem-3.0.6.sha256sum] = "1d30c53c26bc5b31a98cd02d20f25a7c8567146caf63ed593a9d87b2775291be" +SRC_URI[pem-4.0.0.sha256sum] = "d354a98a3d1251555de99e8fdd8afda05573c31b82f59063a7b0a29b5527f120" SRC_URI[pkg-config-0.3.33.sha256sum] = "19f132c84eca552bf34cab8ec81f1c1dcc229b811638f9d283dceabe58c5569e" -SRC_URI[portable-atomic-1.13.1.sha256sum] = "c33a9471896f1c69cecef8d20cbe2f7accd12527ce60845ff44c153bb2a21b49" -SRC_URI[proc-macro2-1.0.106.sha256sum] = "8fd00f0bb2e90d81d1044c2b32617f68fcb9fa3bb7640c23e9c748e53fb30934" +SRC_URI[portable-atomic-1.14.0.sha256sum] = "3d20d5497ef88037a52ff98267d066e7f11fcc5e99bbfbd58a42336193aacec3" +SRC_URI[proc-macro2-1.0.107.sha256sum] = "985e7ec9bb745e6ce6535b544d84d6cd6f7ad8bd711c398938ae983b91a766d9" SRC_URI[pyo3-0.29.0.sha256sum] = "cd274650b21d4bfc26a0a47587962c1edb425f69287324355cd040c3ea66071c" SRC_URI[pyo3-build-config-0.29.0.sha256sum] = "c5e2a7d2f0d013342f295c048ad19237add5154a55b1c5a254c0ec93d4109078" SRC_URI[pyo3-ffi-0.29.0.sha256sum] = "ca85c467da1bbc8d866eea5deff9cf29ea5f7785054a17da36e65bda9c05845b" SRC_URI[pyo3-macros-0.29.0.sha256sum] = "9ac53762fd065daa3194dd09337a38bd793a188100fd1a9304c4ab312d901771" SRC_URI[pyo3-macros-backend-0.29.0.sha256sum] = "4ca3a1557399783172dc5bf39cfca835157732532cba56b71d2292161e53b362" -SRC_URI[quote-1.0.45.sha256sum] = "41f2619966050689382d2b44f664f4bc593e129785a36d6ee376ddf37259b924" -SRC_URI[self_cell-1.2.2.sha256sum] = "b12e76d157a900eb52e81bc6e9f3069344290341720e9178cde2407113ac8d89" +SRC_URI[quote-1.0.47.sha256sum] = "1fbf4db142a473a8d80c26bbf18454ed458bf8d26c8219c331daecfdbd079001" +SRC_URI[self_cell-1.3.0.sha256sum] = "2ab42ca02749e120097e328d91d415325bdf43b1c72c4c8badf37375fe40a813" SRC_URI[shlex-2.0.1.sha256sum] = "f8fadd59c855ef2080decdef8ff161eb6661b86933c9d82e5ba29dc602a55aba" -SRC_URI[syn-2.0.117.sha256sum] = "e665b8803e7b1d2a727f4023456bbbbe74da67099c585258af0ad9c5013b9b99" +SRC_URI[syn-2.0.119.sha256sum] = "872831b642d1a07999a962a351ed35b955ea2cfc8f3862091e2a240a84f17297" SRC_URI[target-lexicon-0.13.5.sha256sum] = "adb6935a6f5c20170eeceb1a3835a49e12e19d792f6dd344ccc76a985ca5a6ca" SRC_URI[unicode-ident-1.0.24.sha256sum] = "e6e4313cd5fcd3dad5cafa179702e2b244f760991f45397d14d4ebf38247da75" SRC_URI[vcpkg-0.2.15.sha256sum] = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426" diff --git a/meta/recipes-devtools/python/python3-cryptography-vectors.bb b/meta/recipes-devtools/python/python3-cryptography-vectors.bb index f5dd5757a4..d62d681c6d 100644 --- a/meta/recipes-devtools/python/python3-cryptography-vectors.bb +++ b/meta/recipes-devtools/python/python3-cryptography-vectors.bb @@ -9,7 +9,7 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=8c3617db4fb6fae01f1d253ab91511e4 \ # NOTE: Make sure to keep this recipe at the same version as python3-cryptography # Upgrade both recipes at the same time require python3-cryptography-common.inc -SRC_URI[sha256sum] = "9e3352b1e652d2f986755edf79228a385f6b0bd53d5b248c087ff79b24a7b516" +SRC_URI[sha256sum] = "6760814930443e6d73a6afcad09463d3ffdc42084ee0bdcfb2f05697250c3c8d" PYPI_PACKAGE = "cryptography_vectors" diff --git a/meta/recipes-devtools/python/python3-cryptography.bb b/meta/recipes-devtools/python/python3-cryptography.bb index caffb0a24e..d6a1bb53f3 100644 --- a/meta/recipes-devtools/python/python3-cryptography.bb +++ b/meta/recipes-devtools/python/python3-cryptography.bb @@ -11,7 +11,7 @@ LDSHARED += "-pthread" # NOTE: Make sure to keep this recipe at the same version as python3-cryptography-vectors # Upgrade both recipes at the same time require python3-cryptography-common.inc -SRC_URI[sha256sum] = "f89660a348f4f78a92366240a61404e337586ef7f5909a2fef59ca88ef505493" +SRC_URI[sha256sum] = "eeac2acb5a20ed25e0ad6d1df9891a520b78b404266b6d11778f25d5d691a6c9" SRC_URI += "file://0001-pyproject.toml-remove-benchmark-disable-option.patch \ file://check-memfree.py \ diff --git a/meta/recipes-devtools/python/python3-cryptography/0001-pyproject.toml-remove-benchmark-disable-option.patch b/meta/recipes-devtools/python/python3-cryptography/0001-pyproject.toml-remove-benchmark-disable-option.patch index 42b4c56c0d..967b661c6e 100644 --- a/meta/recipes-devtools/python/python3-cryptography/0001-pyproject.toml-remove-benchmark-disable-option.patch +++ b/meta/recipes-devtools/python/python3-cryptography/0001-pyproject.toml-remove-benchmark-disable-option.patch @@ -19,22 +19,24 @@ Upstream-Status: Inappropriate [OE specific] Signed-off-by: Mingli Yu <[email protected]> -Refresh for 42.02 +Refresh for 50.0.0 Signed-off-by: Tim Orling <[email protected]> --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml -index cddaf7f..921badf 100644 +index fb8185913..29d0b3e08 100644 --- a/pyproject.toml +++ b/pyproject.toml -@@ -139,7 +139,7 @@ exclude = [ +@@ -140,7 +140,7 @@ exclude = [ ] - + [tool.pytest.ini_options] -addopts = "-r s --capture=no --strict-markers --benchmark-disable" +addopts = "-r s --capture=no --strict-markers" + testpaths = ["tests"] console_output_style = "progress-even-when-capture-no" markers = [ - "skip_fips: this test is not executed in FIPS mode", +-- +2.43.0 -- 2.47.3
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#242673): https://lists.openembedded.org/g/openembedded-core/message/242673 Mute This Topic: https://lists.openembedded.org/mt/120586506/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
