340 lines
14 KiB
Markdown
340 lines
14 KiB
Markdown
|
# changelog
|
||
|
|
|
||
|
|
## 0.24.0
|
||
|
|
|
||
|
|
- `x509.Certificate().self_signed` will no longer return `"yes"` under any
|
||
|
|
circumstances. This helps prevent confusion since the library does not
|
||
|
|
verify the signature. Instead a library like oscrypto should be used
|
||
|
|
to confirm if a certificate is self-signed.
|
||
|
|
- Added various OIDs to `x509.KeyPurposeId()`
|
||
|
|
- Added `x509.Certificate().private_key_usage_period_value`
|
||
|
|
- Added structures for parsing common subject directory attributes for
|
||
|
|
X.509 certificates, including `x509.SubjectDirectoryAttribute()`
|
||
|
|
- Added `algos.AnyAlgorithmIdentifier()` for situations where an
|
||
|
|
algorithm identifier may contain a digest, signed digest or encryption
|
||
|
|
algorithm OID
|
||
|
|
- Fixed a bug with `x509.Certificate().subject_directory_attributes_value`
|
||
|
|
not returning the correct value
|
||
|
|
- Fixed a bug where explicitly-tagged fields in a `core.Sequence()` would
|
||
|
|
not function properly when the field had a default value
|
||
|
|
- Fixed a bug with type checking in `pem.armor()`
|
||
|
|
|
||
|
|
## 0.23.0
|
||
|
|
|
||
|
|
- Backwards compatibility break: the `tag_type`, `explicit_tag` and
|
||
|
|
`explicit_class` attributes on `core.Asn1Value` no longer exist and were
|
||
|
|
replaced by the `implicit` and `explicit` attributes. Field param dicts
|
||
|
|
may use the new `explicit` and `implicit` keys, or the old `tag_type` and
|
||
|
|
`tag` keys. The attribute changes will likely to have little to no impact
|
||
|
|
since they were primarily an implementation detail.
|
||
|
|
- Teletex strings used inside of X.509 certificates are now interpreted
|
||
|
|
using Windows-1252 (a superset of ISO-8859-1). This enables compatibility
|
||
|
|
with certificates generated by OpenSSL. Strict parsing of Teletex strings
|
||
|
|
can be retained by using the `x509.strict_teletex()` context manager.
|
||
|
|
- Added support for nested explicit tagging, supporting values that are
|
||
|
|
defined with explicit tagging and then added as a field of another
|
||
|
|
structure using explicit tagging.
|
||
|
|
- Fixed a `UnicodeDecodeError` when trying to find the (optional) dependency
|
||
|
|
OpenSSL on Python 2
|
||
|
|
- Fixed `next_update` field of `crl.TbsCertList` to be optional
|
||
|
|
- Added the `x509.Certificate.sha256_fingerprint` property
|
||
|
|
- `x509.Certificate.ocsp_urls` and `x509.DistributionPoint.url` will now
|
||
|
|
return `https://`, `ldap://` and `ldaps://` URLs in addition to `http://`.
|
||
|
|
- Added CMS Attribute Protection definitions from RFC 6211
|
||
|
|
- Added OIDs from RFC 6962
|
||
|
|
|
||
|
|
## 0.22.0
|
||
|
|
|
||
|
|
- Added `parser.peek()`
|
||
|
|
- Implemented proper support for BER-encoded indefinite length strings of
|
||
|
|
all kinds - `core.BitString`, `core.OctetString` and all of the `core`
|
||
|
|
classes that are natively represented as Python unicode strings
|
||
|
|
- Fixed a bug with encoding LDAP URLs in `x509.URI`
|
||
|
|
- Correct `x509.DNSName` to allow a leading `.`, such as when used with
|
||
|
|
`x509.NameConstraints`
|
||
|
|
- Fixed an issue with dumping the parsed contents of `core.Any` when
|
||
|
|
explicitly tagged
|
||
|
|
- Custom `setup.py clean` now accepts the short `-a` flag for compatibility
|
||
|
|
|
||
|
|
## 0.21.1
|
||
|
|
|
||
|
|
- Fixed a regression where explicit tagging of a field containing a
|
||
|
|
`core.Choice` would result in an incorrect header
|
||
|
|
- Fixed a bug where an `IndexError` was being raised instead of a `ValueError`
|
||
|
|
when a value was truncated to not include enough bytes for the header
|
||
|
|
- Corrected the spec for the `value` field of `pkcs12.Attribute`
|
||
|
|
- Added support for `2.16.840.1.113894.746875.1.1` OID to
|
||
|
|
`pkcs12.AttributeType`
|
||
|
|
|
||
|
|
## 0.21.0
|
||
|
|
|
||
|
|
- Added `core.load()` for loading standard, universal types without knowing
|
||
|
|
the spec beforehand
|
||
|
|
- Added a `strict` keyword arg to the various `load()` methods and functions in
|
||
|
|
`core` that checks for trailing data and raises a `ValueError` when found
|
||
|
|
- Added `asn1crypto.parser` submodule with `emit()` and `parse()` functions for
|
||
|
|
low-level integration
|
||
|
|
- Added `asn1crypto.version` for version introspection without side-effects
|
||
|
|
- Added `algos.DSASignature`
|
||
|
|
- Fixed a bug with the `_header` attribute of explicitly-tagged values only
|
||
|
|
containing the explicit tag header instead of both the explicit tag header
|
||
|
|
and the encapsulated value header
|
||
|
|
|
||
|
|
## 0.20.0
|
||
|
|
|
||
|
|
- Added support for year 0
|
||
|
|
- Added the OID for unique identifier to `x509.NameType`
|
||
|
|
- Fixed a bug creating the native representation of a `core.BitString` with
|
||
|
|
leading null bytes
|
||
|
|
- Added a `.cast()` method to allow converting between different
|
||
|
|
representations of the same data, e.g. `core.BitString` and
|
||
|
|
`core.OctetBitString`
|
||
|
|
|
||
|
|
## 0.19.0
|
||
|
|
|
||
|
|
- Force `algos.DigestAlgorithm` to encoding `parameters` as `Null` when the
|
||
|
|
`algorithm` is `sha1`, `sha224`, `sha256`, `sha384` or `sha512` per RFC 4055
|
||
|
|
- Resolved an issue where a BER-encoded indefinite-length value could not be
|
||
|
|
properly parsed when embedded inside of a `core.Sequence` or `core.Set`
|
||
|
|
- Fix `x509.Name.build()` to properly handle dotted OID type values
|
||
|
|
- `core.Choice` can now be constructed from a single-element `dict` or a
|
||
|
|
two-element `tuple` to allow for better usability when constructing values
|
||
|
|
from native Python values
|
||
|
|
- All `core` objects can now be passed to `print()` with an exception being
|
||
|
|
raised
|
||
|
|
|
||
|
|
## 0.18.5
|
||
|
|
|
||
|
|
- Don't fail importing if `ctypes` or `_ctypes` is not available
|
||
|
|
|
||
|
|
## 0.18.4
|
||
|
|
|
||
|
|
- `core.Sequence` will now raise an exception when an unknown field is provided
|
||
|
|
- Prevent `UnicodeDecodeError` on Python 2 when calling
|
||
|
|
`core.OctetString.debug()`
|
||
|
|
- Corrected the default value for the `hash_algorithm` field of
|
||
|
|
`tsp.ESSCertIDv2`
|
||
|
|
- Fixed a bug constructing a `cms.SignedData` object
|
||
|
|
- Ensure that specific RSA OIDs are always paired with `parameters` set to
|
||
|
|
`core.Null`
|
||
|
|
|
||
|
|
## 0.18.3
|
||
|
|
|
||
|
|
- Fixed DER encoding of `core.BitString` when a `_map` is specified (i.e. a
|
||
|
|
"named bit list") to omit trailing zero bits. This fixes compliance of
|
||
|
|
various `x509` structures with RFC 5280.
|
||
|
|
- Corrected a side effect in `keys.PrivateKeyInfo.wrap()` that would cause the
|
||
|
|
original `keys.ECPrivateKey` structure to become corrupt
|
||
|
|
- `core.IntegerOctetString` now correctly encodes the integer as an unsigned
|
||
|
|
value when converting to bytes. Previously decoding was unsigned, but
|
||
|
|
encoding was signed.
|
||
|
|
- Fix `util.int_from_bytes()` on Python 2 to return `0` from an empty byte
|
||
|
|
string
|
||
|
|
|
||
|
|
## 0.18.2
|
||
|
|
|
||
|
|
- Allow `_perf` submodule to be removed from source tree when embedding
|
||
|
|
|
||
|
|
## 0.18.1
|
||
|
|
|
||
|
|
- Fixed DER encoding of `core.Set` and `core.SetOf`
|
||
|
|
- Fixed a bug in `x509.Name.build()` that could generate invalid DER encoding
|
||
|
|
- Improved exception messages when parsing nested structures via the `.native`
|
||
|
|
attribute
|
||
|
|
- `algos.SignedDigestAlgorithm` now ensures the `parameters` are set to
|
||
|
|
`Null` when `algorithm` is `sha224_rsa`, `sha256_rsa`, `sha384_rsa` or
|
||
|
|
`sha512_rsa`, per RFC 4055
|
||
|
|
- Corrected the definition of `pdf.AdobeTimestamp` to mark the
|
||
|
|
`requires_auth` field as optional
|
||
|
|
- Add support for the OID `1.2.840.113549.1.9.16.2.14` to
|
||
|
|
`cms.CMSAttributeType`
|
||
|
|
- Improve attribute support for `cms.AttributeCertificateV2`
|
||
|
|
- Handle `cms.AttributeCertificateV2` when incorrectly tagged as
|
||
|
|
`cms.AttributeCertificateV1` in `cms.CertificateChoices`
|
||
|
|
|
||
|
|
## 0.18.0
|
||
|
|
|
||
|
|
- Improved general parsing performance by 10-15%
|
||
|
|
- Add support for Windows XP
|
||
|
|
- Added `core.ObjectIdentifier.dotted` attribute to always return dotted
|
||
|
|
integer unicode string
|
||
|
|
- Added `core.ObjectIdentifier.map()` and `core.ObjectIdentifier.unmap()`
|
||
|
|
class methods to map dotted integer unicode strings to user-friendly unicode
|
||
|
|
strings and back
|
||
|
|
- Added various Apple OIDs to `x509.KeyPurposeId`
|
||
|
|
- Fixed a bug parsing nested indefinite-length-encoded values
|
||
|
|
- Fixed a bug with `x509.Certificate.issuer_alt_name_value` if it is the first
|
||
|
|
extension queried
|
||
|
|
- `keys.PublicKeyInfo.bit_size` and `keys.PrivateKeyInfo.bit_size` values are
|
||
|
|
now rounded up to the next closest multiple of 8
|
||
|
|
|
||
|
|
## 0.17.1
|
||
|
|
|
||
|
|
- Fix a bug in `x509.URI` parsing IRIs containing explicit port numbers on
|
||
|
|
Python 3.x
|
||
|
|
|
||
|
|
## 0.17.0
|
||
|
|
|
||
|
|
- Added `x509.TrustedCertificate` for handling OpenSSL auxiliary certificate
|
||
|
|
information appended after a certificate
|
||
|
|
- Added `core.Concat` class for situations such as `x509.TrustedCertificate`
|
||
|
|
- Allow "broken" X.509 certificates to use `core.IA5String` where an
|
||
|
|
`x509.DirectoryString` should be used instead
|
||
|
|
- Added `keys.PrivateKeyInfo.public_key_info` attribute
|
||
|
|
- Added a bunch of OIDs to `x509.KeyPurposeId`
|
||
|
|
|
||
|
|
## 0.16.0
|
||
|
|
|
||
|
|
- Added DH key exchange structures: `algos.KeyExchangeAlgorithm`,
|
||
|
|
`algos.KeyExchangeAlgorithmId` and `algos.DHParameters`.
|
||
|
|
- Added DH public key support to `keys.PublicKeyInfo`,
|
||
|
|
`keys.PublicKeyAlgorithm` and `keys.PublicKeyAlgorithmId`. New structures
|
||
|
|
include `keys.DomainParameters` and `keys.ValidationParms`.
|
||
|
|
|
||
|
|
## 0.15.1
|
||
|
|
|
||
|
|
- Fixed `cms.CMSAttributes` to be a `core.SetOf` instead of `core.SequenceOf`
|
||
|
|
- `cms.CMSAttribute` can now parse unknown attribute contrustruct without an
|
||
|
|
exception being raised
|
||
|
|
- `x509.PolicyMapping` now uses `x509.PolicyIdentifier` for field types
|
||
|
|
- Fixed `pdf.RevocationInfoArchival` so that all fields are now of the type
|
||
|
|
`core.SequenceOf` instead of a single value
|
||
|
|
- Added support for the `name_distinguisher`, `telephone_number` and
|
||
|
|
`organization_identifier` OIDs to `x509.Name`
|
||
|
|
- Fixed `x509.Name.native` to not accidentally create nested lists when three
|
||
|
|
of more values for a single type are part of the name
|
||
|
|
- `x509.Name.human_friendly` now reverses the order of fields when the data
|
||
|
|
in an `x509.Name` was encoded in most-specific to least-specific order, which
|
||
|
|
is the opposite of the standard way of least-specific to most-specific.
|
||
|
|
- `x509.NameType.human_friendly` no longer raises an exception when an
|
||
|
|
unknown OID is encountered
|
||
|
|
- Raise a `ValueError` when parsing a `core.Set` and an unknown field is
|
||
|
|
encountered
|
||
|
|
|
||
|
|
## 0.15.0
|
||
|
|
|
||
|
|
- Added support for the TLS feature extension from RFC 7633
|
||
|
|
- `x509.Name.build()` now accepts a keyword parameter `use_printable` to force
|
||
|
|
string encoding to be `core.PrintableString` instead of `core.UTF8String`
|
||
|
|
- Added the functions `util.uri_to_iri()` and `util.iri_to_uri()`
|
||
|
|
- Changed `algos.SignedDigestAlgorithmId` to use the preferred OIDs when
|
||
|
|
mapping a unicode string name to an OID. Previously there were multiple OIDs
|
||
|
|
for some algorithms, and different OIDs would sometimes be selected due to
|
||
|
|
the fact that the `_map` `dict` is not ordered.
|
||
|
|
|
||
|
|
## 0.14.1
|
||
|
|
|
||
|
|
- Fixed a bug generating `x509.Certificate.sha1_fingerprint` on Python 2
|
||
|
|
|
||
|
|
## 0.14.0
|
||
|
|
|
||
|
|
- Added the `x509.Certificate.sha1_fingerprint` attribute
|
||
|
|
|
||
|
|
## 0.13.0
|
||
|
|
|
||
|
|
- Backwards compatibility break: the native representation of some
|
||
|
|
`algos.EncryptionAlgorithmId` values changed. `aes128` became `aes128_cbc`,
|
||
|
|
`aes192` became `aes192_cbc` and `aes256` became `aes256_cbc`.
|
||
|
|
- Added more OIDs to `algos.EncryptionAlgorithmId`
|
||
|
|
- Added more OIDs to `cms.KeyEncryptionAlgorithmId`
|
||
|
|
- `x509.Name.human_friendly` now properly supports multiple values per
|
||
|
|
`x509.NameTypeAndValue` object
|
||
|
|
- Added `ocsp.OCSPResponse.basic_ocsp_response` and
|
||
|
|
`ocsp.OCSPResponse.response_data` properties
|
||
|
|
- Added `algos.EncryptionAlgorithm.encryption_mode` property
|
||
|
|
- Fixed a bug with parsing times containing timezone offsets in Python 3
|
||
|
|
- The `attributes` field of `csr.CertificationRequestInfo` is now optional,
|
||
|
|
for compatibility with other ASN.1 parsers
|
||
|
|
|
||
|
|
## 0.12.2
|
||
|
|
|
||
|
|
- Correct `core.Sequence.__setitem__()` so set `core.VOID` to an optional
|
||
|
|
field when `None` is set
|
||
|
|
|
||
|
|
## 0.12.1
|
||
|
|
|
||
|
|
- Fixed a `unicode`/`bytes` bug with `x509.URI.dump()` on Python 2
|
||
|
|
|
||
|
|
## 0.12.0
|
||
|
|
|
||
|
|
- Backwards Compatibility Break: `core.NoValue` was renamed to `core.Void` and
|
||
|
|
a singleton was added as `core.VOID`
|
||
|
|
- 20-30% improvement in parsing performance
|
||
|
|
- `core.Void` now implements `__nonzero__`
|
||
|
|
- `core.Asn1Value.copy()` now performs a deep copy
|
||
|
|
- All `core` value classes are now compatible with the `copy` module
|
||
|
|
- `core.SequenceOf` and `core.SetOf` now implement `__contains__`
|
||
|
|
- Added `x509.Name.__len__()`
|
||
|
|
- Fixed a bug where `core.Choice.validate()` would not properly account for
|
||
|
|
explicit tagging
|
||
|
|
- `core.Choice.load()` now properly passes itself as the spec when parsing
|
||
|
|
- `x509.Certificate.crl_distribution_points` no longer throws an exception if
|
||
|
|
the `DistributionPoint` does not have a value for the `distribution_point`
|
||
|
|
field
|
||
|
|
|
||
|
|
## 0.11.1
|
||
|
|
|
||
|
|
- Corrected `core.UTCTime` to interpret year <= 49 as 20xx and >= 50 as 19xx
|
||
|
|
- `keys.PublicKeyInfo.hash_algo` can now handle DSA keys without parameters
|
||
|
|
- Added `crl.CertificateList.sha256` and `crl.CertificateList.sha1`
|
||
|
|
- Fixed `x509.Name.build()` to properly encode `country_name`, `serial_number`
|
||
|
|
and `dn_qualifier` as `core.PrintableString` as specified in RFC 5280,
|
||
|
|
instead of `core.UTF8String`
|
||
|
|
|
||
|
|
## 0.11.0
|
||
|
|
|
||
|
|
- Added Python 2.6 support
|
||
|
|
- Added ability to compare primitive type objects
|
||
|
|
- Implemented proper support for internationalized domains, URLs and email
|
||
|
|
addresses in `x509.Certificate`
|
||
|
|
- Comparing `x509.Name` and `x509.GeneralName` objects adheres to RFC 5280
|
||
|
|
- `x509.Certificate.self_signed` and `x509.Certificate.self_issued` no longer
|
||
|
|
require that certificate is for a CA
|
||
|
|
- Fixed `x509.Certificate.valid_domains` to adhere to RFC 6125
|
||
|
|
- Added `x509.Certificate.is_valid_domain_ip()`
|
||
|
|
- Added `x509.Certificate.sha1` and `x509.Certificate.sha256`
|
||
|
|
- Exposed `util.inet_ntop()` and `util.inet_pton()` for IP address encoding
|
||
|
|
- Improved exception messages for improper types to include type's module name
|
||
|
|
|
||
|
|
## 0.10.1
|
||
|
|
|
||
|
|
- Fixed bug in `core.Sequence` affecting Python 2.7 and pypy
|
||
|
|
|
||
|
|
## 0.10.0
|
||
|
|
|
||
|
|
- Added PEM encoding/decoding functionality
|
||
|
|
- `core.BitString` now uses item access instead of attributes for named bit
|
||
|
|
access
|
||
|
|
- `core.BitString.native` now uses a `set` of unicode strings when `_map` is
|
||
|
|
present
|
||
|
|
- Removed `core.Asn1Value.pprint()` method
|
||
|
|
- Added `core.ParsableOctetString` class
|
||
|
|
- Added `core.ParsableOctetBitString` class
|
||
|
|
- Added `core.Asn1Value.copy()` method
|
||
|
|
- Added `core.Asn1Value.debug()` method
|
||
|
|
- Added `core.SequenceOf.append()` method
|
||
|
|
- Added `core.Sequence.spec()` and `core.SequenceOf.spec()` methods
|
||
|
|
- Added correct IP address parsing to `x509.GeneralName`
|
||
|
|
- `x509.Name` and `x509.GeneralName` are now compared according to rules in
|
||
|
|
RFC 5280
|
||
|
|
- Added convenience attributes to:
|
||
|
|
- `algos.SignedDigestAlgorithm`
|
||
|
|
- `crl.CertificateList`
|
||
|
|
- `crl.RevokedCertificate`
|
||
|
|
- `keys.PublicKeyInfo`
|
||
|
|
- `ocsp.OCSPRequest`
|
||
|
|
- `ocsp.Request`
|
||
|
|
- `ocsp.OCSPResponse`
|
||
|
|
- `ocsp.SingleResponse`
|
||
|
|
- `x509.Certificate`
|
||
|
|
- `x509.Name`
|
||
|
|
- Added `asn1crypto.util` module with the following items:
|
||
|
|
- `int_to_bytes()`
|
||
|
|
- `int_from_bytes()`
|
||
|
|
- `timezone.utc`
|
||
|
|
- Added `setup.py clean` command
|
||
|
|
|
||
|
|
## 0.9.0
|
||
|
|
|
||
|
|
- Initial release
|