service-identity

Highlights

There is only one notable change in this release and it's @alex ripping out some gnarly code using gnarly, deprecated APIs.

Special Thanks

This release would not be possible without my generous sponsors! Thank you to all of you making sustainable maintenance possible! If you would like to join them, go to https://github.com/sponsors/hynek and check out the sweet perks!

Above and Beyond

Variomedia AG (@variomedia), Tidelift (@tidelift), Klaviyo (@klaviyo), FilePreviews (@filepreviews), Privacy Solutions GmbH (@privacy-solutions), Daniel Fortunov (@asqui), Kevin P. Fleming (@kpfleming), and Polar (@polarsource).

Maintenance Sustainers

Buttondown (@buttondown), Christopher Dignam (@chdsbd), Stefan Hagen (@sthagen), Magnus Watn (@magnuswatn), David Cramer (@dcramer), Jesse Snyder (@jessesnyder), Rivo Laks (@rivol), Chris Withers (@cjw296), Mike Fiedler (@miketheman), Duncan Hill (@cricalix), Colin Marquardt (@cmarqu), Pieter Swinkels (@swinkels), Nick Libertini (@libertininick), Adam Hill (@adamghill), Moving Content AG (@moving-content), ProteinQure (@ProteinQure), The Westervelt Company (@westerveltco), Philippe Galvan (@PhilippeGalvan), Sławomir Ehlert (@slafs), Mostafa Khalil (@khadrawy), Filip Mularczyk (@mukiblejlok), Thomas Klinger (@thmsklngr), Andreas Poehlmann (@ap--), August Bigelow (@atbigelow), Carlton Gibson (@carltongibson), and Roboflow (@roboflow).

Not to forget 12 more amazing humans who chose to be generous but anonymous!

Full Changelog

Added

• Python 3.13 is now officially supported. #74

Changed

• pyOpenSSL's identity extraction has been reimplemented using cryptography's primitives instead of deprecated pyOpenSSL APIs. As a result, the oldest supported pyOpenSSL version is now 17.1.0. #70

This release contains contributions from @alex, and @hynek.

Artifact Attestations

You can verify this release's artifact attestions using GitHub's CLI tool by downloading the sdist and wheel from PyPI and running:

$ gh attestation verify --owner pyca service_identity-24.2.0.tar.gz

and

$ gh attestation verify --owner pyca service_identity-24.2.0-py3-none-any.whl

Highlights

Only one visible change: if a certificate has not subjectAltNames, meaning there's nothing to verify against, a service_identity.CertificateError is raised now instead of a VerificationError. This change was prompted by the difficulty to debug the problem with certificates that still only carry a commonName that has been ignored since 23.1.0.

Special Thanks

This release would not be possible without my generous sponsors! Thank you to all of you making sustainable maintenance possible! If you would like to join them, go to https://github.com/sponsors/hynek and check out the sweet perks!

Above and Beyond

Variomedia AG (@variomedia), Tidelift (@tidelift), FilePreviews (@filepreviews), Daniel Fortunov (@asqui), Kevin P. Fleming (@kpfleming), and Sören Weber (@SoerenWeber).

Maintenance Sustainers

Jeff Triplett (@jefftriplett), Adam Hill (@adamghill), Dan Groshev (@si14), Magnus Watn (@magnuswatn), David Cramer (@dcramer), Moving Content AG (@moving-content), ProteinQure (@ProteinQure), Jesse Snyder (@jessesnyder), Rivo Laks (@rivol), Ionel Cristian Mărieș (@ionelmc), The Westervelt Company (@westerveltco), Philippe Galvan (@PhilippeGalvan), Birk Jernström (@birkjernstrom), Tim Schilling (@tim-schilling), Chris Withers (@cjw296), Christopher Dignam (@chdsbd), Stefan Hagen (@sthagen), Sławomir Ehlert (@slafs), Mostafa Khalil (@khadrawy), Filip Mularczyk (@mukiblejlok), Mike Fiedler (@miketheman), and Michel Vittória (@michelvittoria).

Not to forget 5 more amazing humans who chose to be generous but anonymous!

Full Changelog

Changed

• If a certificate doesn't contain any subjectAltNames, we now raise service_identity.CertificateError instead of service_identity.VerificationError to make the problem easier to debug. #67

Highlights

Since there wasn't any interest in adding more verification methods, this release makes the service identity pattern extraction from pyOpenSSL and PyCA cryptography certificate public APIs. Check out service_identity.cryptography.extract_patterns() and service_identity.pyopenssl.extract_patterns()!

It also adds type hints and removes support for commonName. Otherwise there's no changes to how service identities are extracted or compared.

Special Thanks

This release would not be possible without my generous sponsors! Thank you to all of you making sustainable maintenance possible! If you would like to join them, go to https://github.com/sponsors/hynek and check out the sweet perks!

Above and Beyond

Variomedia AG (@variomedia), Tidelift (@tidelift), Sentry (@getsentry), HiredScore (@HiredScore), FilePreviews (@filepreviews), and Daniel Fortunov (@asqui).

Maintenance Sustainers

Adam Hill (@adamghill), Dan Groshev (@si14), Magnus Watn (@magnuswatn), David Cramer (@dcramer), Moving Content AG (@moving-content), Stein Magnus Jodal (@jodal), ProteinQure (@ProteinQure), Jesse Snyder (@jessesnyder), Rivo Laks (@rivol), Tom Ballinger (@thomasballinger), Ionel Cristian Mărieș (@ionelmc), The Westervelt Company (@westerveltco), Philippe Galvan (@PhilippeGalvan), Birk Jernström (@birkjernstrom), Tim Schilling (@tim-schilling), Chris Withers (@cjw296), Christopher Dignam (@chdsbd), and Stefan Hagen (@sthagen).

Not to forget 5 more amazing humans who chose to be generous but anonymous!

Full Changelog

Removed

• All Python versions up to and including 3.7 have been dropped.
• Support for commonName in certificates has been dropped. It has been deprecated since 2017 and isn't supported by any major browser.
• The oldest supported pyOpenSSL version (when using the pyopenssl backend) is now 17.0.0. When using such an old pyOpenSSL version, you have to pin cryptography yourself to ensure compatibility between them. Please check out contraints/oldest-pyopenssl.txt to verify what we are testing against.

Deprecated

• If you've used service_identity.(cryptography|pyopenssl).extract_ids(), please switch to the new names extract_patterns(). #56

Added

• service_identity.(cryptography|pyopenssl).extract_patterns() are now public APIs (FKA extract_ids()). You can use them to extract the patterns from a certificate without verifying anything. #55
• service-identity is now fully typed. #57

Removed

• Python 3.4 is not supported anymore. It has been unsupported by the Python core team for a while now, its PyPI downloads are negligible, and our CI provider removed it as a supported option.

  It's very unlikely that service-identity will break under 3.4 anytime soon, which is why we do not block its installation on Python 3.4. But we don't test it anymore and will block it once someone reports breakage.

Fixed

• service_identity.exceptions.VerificationError can now be pickled and is overall more well-behaved as an exception. This raises the requirement of attrs to 19.1.0.

Added

• pyOpenSSL is optional now if you use service_identity.cryptography.* only.
• Added support for iPAddress subjectAltNames. You can now verify whether a connection or a certificate is valid for an IP address using service_identity.pyopenssl.verify_ip_address() and service_identity.cryptography.verify_certificate_ip_address(). #12

Deprecated

• Since Chrome 58 and Firefox 48 both don't accept certificates that contain only a Common Name, its usage is hereby deprecated in service-identity too. We have been raising a warning since 16.0.0 and the support will be removed in mid-2018 for good.

Added

• When service_identity.SubjectAltNameWarning is raised, the Common Name of the certificate is now included in the warning message. #17
• Added cryptography.x509 backend for verifying certificates. #18

Changed

• Wildcards (*) are now only allowed if they are the leftmost label in a certificate. This is common practice by all major browsers. #19

Removed

• Python 3.3 and 2.6 aren't supported anymore. They may work by chance but any effort to keep them working has ceased.

  The last Python 2.6 release was on October 29, 2013 and isn't supported by the CPython core team anymore. Major Python packages like Django and Twisted dropped Python 2.6 a while ago already.

  Python 3.3 never had a significant user base and wasn't part of any distribution's LTS release.

• pyOpenSSL versions older than 0.14 are not tested anymore. They don't even build on recent OpenSSL versions. Please note that its support may break without further notice.

Added

• Officially support Python 3.5.
• A __str__ method to VerificationError.

Changed

• service_identity.SubjectAltNameWarning is now raised if the server certificate lacks a proper SubjectAltName. #9
• Port from characteristic to its spiritual successor attrs.

Changed

• Switch to year-based version numbers.
• Port to characteristic 14.0 (get rid of deprecation warnings).
• Package docs with source distributions.

Removed

• Drop support for Python 3.2. There is no justification to add complexity and unnecessary function calls for a Python version that nobody uses.

Changed

• Move into the Python Cryptography Authority’s GitHub account.
• Move exceptions into service_identity.exceptions so tracebacks don’t contain private module names.
• Promoting to stable since Twisted 14.0 is optionally depending on service-identity now.
• Use characteristic instead of a home-grown solution.

Fixed

• idna 0.6 did some backward-incompatible fixes that broke Python 3 support. This has been fixed now therefore service-identity only works with idna 0.6 and later. Unfortunately since idna doesn’t offer version introspection, service-identity can’t warn about it.