-
Fri Jan 24 2014 Daniel Mach <dmach@redhat.com> - 0.14.0-5
- Mass rebuild 2014-01-24
-
Fri Dec 27 2013 Daniel Mach <dmach@redhat.com> - 0.14.0-4
- Mass rebuild 2013-12-27
-
Fri Oct 18 2013 John Dennis <jdennis@redhat.com> - 0.14.0-3
- resolves: bug#1003979
- In coordination with QE with regards to bz 1019934 it was requested
the unittest patches be enhanced with a more robust version of
test_pkcs12, no actual bug, just better testing.
-
Tue Oct 08 2013 John Dennis <jdennis@redhat.com> - 0.14.0-2
- resolves: bug#1002589
- resolves: bug#1003979
- Rewrite setup_certs.py. No longer behaves like an expect script
which was fragile. By default now creates a sql style database.
- By default all examples & tests use new sql format for NSS database
- db-name is now used instead of dbdir to provide distinction between
the database directory and it's scheme (e.g. 'sql:')
- all examples and tests now default db-name to 'sql:pki'
- replaced legacy getopt & optparse command line argument handling
with modern argparse.
-
Mon May 13 2013 John Dennis <jdennis@redhat.com> - 0.14-1
External Changes:
-----------------
The primary enhancements in this version is support of certifcate
validation, OCSP support, and support for the certificate "Authority
Information Access" extension.
Enhanced certifcate validation including CA certs can be done via
Certificate.verify() or Certificate.is_ca_cert(). When cert
validation fails you can now obtain diagnostic information as to why
the cert failed to validate. This is encapsulated in the
CertVerifyLog class which is a iterable collection of
CertVerifyLogNode objects. Most people will probablby just print the
string representation of the returned CertVerifyLog object. Cert
validation logging is handled by the Certificate.verify() method.
Support has also been added for the various key usage and cert type
entities which feature prominently during cert validation.
* Certificate() constructor signature changed from
Certificate(data=None, der_is_signed=True)
to
Certificate(data, certdb=cert_get_default_certdb(), perm=False, nickname=None)
This change was necessary because all certs should be added to the
NSS temporary database when they are loaded, but earlier code
failed to to that. It's is not likely that an previous code was
failing to pass initialization data or the der_is_signed flag so
this change should be backwards compatible.
* Fix bug #922247, PKCS12Decoder.database_import() method. Importing into
a NSS database would sometimes fail or segfault.
* Error codes and descriptions were updated from upstream NSPR & NSS.
* The password callback did not allow for breaking out of a password
prompting loop, now if None is returned from the password callback
the password prompting is terminated.
* nss.nss_shutdown_context now called from InitContext destructor,
this assures the context is shutdown even if the programmer forgot
to. It's still best to explicitly shut it down, this is just
failsafe.
* Support was added for shutdown callbacks.
* The following classes were added:
- nss.CertVerifyLogNode
- nss.CertVerifyLog
- error.CertVerifyError (exception)
- nss.AuthorityInfoAccess
- nss.AuthorityInfoAccesses
* The following class methods were added:
- nss.Certificate.is_ca_cert
- nss.Certificate.verify
- nss.Certificate.verify_with_log
- nss.Certificate.get_cert_chain
- nss.Certificate.check_ocsp_status
- nss.PK11Slot.list_certs
- nss.CertVerifyLogNode.format_lines
- nss.CertVerifyLog.format_lines
- nss.CRLDistributionPts.format_lines
* The following class properties were added:
- nss.CertVerifyLogNode.certificate
- nss.CertVerifyLogNode.error
- nss.CertVerifyLogNode.depth
- nss.CertVerifyLog.count
* The following module functions were added:
- nss.x509_cert_type
- nss.key_usage_flags
- nss.list_certs
- nss.find_certs_from_email_addr
- nss.find_certs_from_nickname
- nss.nss_get_version
- nss.nss_version_check
- nss.set_shutdown_callback
- nss.get_use_pkix_for_validation
- nss.set_use_pkix_for_validation
- nss.enable_ocsp_checking
- nss.disable_ocsp_checking
- nss.set_ocsp_cache_settings
- nss.set_ocsp_failure_mode
- nss.set_ocsp_timeout
- nss.clear_ocsp_cache
- nss.set_ocsp_default_responder
- nss.enable_ocsp_default_responder
- nss.disable_ocsp_default_responder
* The following files were added:
src/py_traceback.h
doc/examples/verify_cert.py
test/test_misc.py
* The following constants were added:
- nss.KU_DIGITAL_SIGNATURE
- nss.KU_NON_REPUDIATION
- nss.KU_KEY_ENCIPHERMENT
- nss.KU_DATA_ENCIPHERMENT
- nss.KU_KEY_AGREEMENT
- nss.KU_KEY_CERT_SIGN
- nss.KU_CRL_SIGN
- nss.KU_ENCIPHER_ONLY
- nss.KU_ALL
- nss.KU_DIGITAL_SIGNATURE_OR_NON_REPUDIATION
- nss.KU_KEY_AGREEMENT_OR_ENCIPHERMENT
- nss.KU_NS_GOVT_APPROVED
- nss.PK11CertListUnique
- nss.PK11CertListUser
- nss.PK11CertListRootUnique
- nss.PK11CertListCA
- nss.PK11CertListCAUnique
- nss.PK11CertListUserUnique
- nss.PK11CertListAll
- nss.certUsageSSLClient
- nss.certUsageSSLServer
- nss.certUsageSSLServerWithStepUp
- nss.certUsageSSLCA
- nss.certUsageEmailSigner
- nss.certUsageEmailRecipient
- nss.certUsageObjectSigner
- nss.certUsageUserCertImport
- nss.certUsageVerifyCA
- nss.certUsageProtectedObjectSigner
- nss.certUsageStatusResponder
- nss.certUsageAnyCA
- nss.ocspMode_FailureIsVerificationFailure
- nss.ocspMode_FailureIsNotAVerificationFailure
* cert_dump.py extended to print NS_CERT_TYPE_EXTENSION
* cert_usage_flags, nss_init_flags now support optional repr_kind parameter
Internal Changes:
-----------------
* Reimplement exception handling
- NSPRError is now derived from StandardException instead of
EnvironmentError. It was never correct to derive from
EnvironmentError but was difficult to implement a new subclassed
exception with it's own attributes, using EnvironmentError had
been expedient.
- NSPRError now derived from StandardException, provides:
* errno (numeric error code)
* strerror (error description associated with error code)
* error_message (optional detailed message)
* error_code (alias for errno)
* error_desc (alias for strerror)
- CertVerifyError derived from NSPRError, extends with:
* usages (bitmask of returned usages)
* log (CertVerifyLog object)
* Expose error lookup to sibling modules
* Use macros for bitmask_to_list functions to reduce code
duplication and centralize logic.
* Add repr_kind parameter to cert_trust_flags_str()
* Add support for repr_kind AsEnumName to bitstring table lookup.
* Add cert_type_bitstr_to_tuple() lookup function
* Add PRTimeConvert(), used to convert Python time values
to PRTime, centralizes conversion logic, reduces duplication
* Add UTF8OrNoneConvert to better handle unicode parameters which
are optional.
* Add Certificate_summary_format_lines() utility to generate
concise certificate identification info for output.
* Certificate_new_from_CERTCertificate now takes add_reference parameter
to properly reference count certs, should fix shutdown busy problems.
* Add print_traceback(), print_cert() debugging support.
-
Mon Feb 18 2013 John Dennis <jdennis@redhat.com> - 0.13-1
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
-
Mon Oct 08 2012 John Dennis <jdennis@redhat.com> - 0.13-0
- Update to version 0.13
Introduced in 0.13:
* Fix NSS SECITEM_CompareItem bug via workaround.
* Fix incorrect format strings in PyArg_ParseTuple* for:
- GeneralName
- BasicConstraints
- cert_x509_key_usage
* Fix bug when decoding certificate BasicConstraints extension
* Fix hang in setup_certs.
* For NSS >= 3.13 support CERTDB_TERMINAL_RECORD
* You can now query for a specific certificate extension
Certficate.get_extension()
* The following classes were added:
- RSAGenParams
* The following class methods were added:
- nss.nss.Certificate.get_extension
- nss.nss.PK11Slot.generate_key_pair
- nss.nss.DSAPublicKey.format
- nss.nss.DSAPublicKey.format_lines
* The following module functions were added:
- nss.nss.pub_wrap_sym_key
* The following internal utilities were added:
- PyString_UTF8
- SecItem_new_alloc()
* The following class constructors were modified to accept
intialization parameters
- KEYPQGParams (DSA generation parameters)
* The PublicKey formatting (i.e. format_lines) was augmented
to format DSA keys (formerly it only recognized RSA keys).
* Allow lables and values to be justified when printing objects
* The following were deprecated:
- nss.nss.make_line_pairs (replaced by nss.nss.make_line_fmt_tuples)
Deprecated Functionality:
-------------------------
- make_line_pairs() has been replaced by make_line_fmt_tuples()
because 2-valued tuples were not sufficently general. It is
expected very few programs will have used this function, it's mostly
used internally but provided as a support utility.
-
Sat Jul 21 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.12-4
- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
-
Sat Jan 14 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.12-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
-
Thu Nov 17 2011 John Dennis <jdennis@redhat.com> - 0.12-2
- add patch python-nss-0.12-rsapssparams.patch to fix build problem
which appears only with nss 3.13 and later.