|
| 1 | +From bf18b564122e8f976681a2398862fde1eafd84ba Mon Sep 17 00:00:00 2001 |
| 2 | +From: Thomas Petazzoni < [email protected]> |
| 3 | +Date: Thu, 6 Jan 2022 23:15:00 +0100 |
| 4 | +Subject: [PATCH] mozilla/certdata2pem.py: make cryptography module optional |
| 5 | + |
| 6 | +The Python cryptography module is only used to verify if trusted |
| 7 | +certificates have expired, but this is only a warning. For some build |
| 8 | +systems and distributions, providing Python cryptography is costly, |
| 9 | +especially since it's now partly written in Rust. |
| 10 | + |
| 11 | +As the check is only a warning, it's anyway going to be overlooked by |
| 12 | +most people. This commit changes the check to be optional: if the |
| 13 | +cryptography Python module is there, we perform the check, otherwise |
| 14 | +the check is skipped. |
| 15 | + |
| 16 | +Signed-off-by: Thomas Petazzoni < [email protected]> |
| 17 | +--- |
| 18 | + mozilla/certdata2pem.py | 18 ++++++++++-------- |
| 19 | + 1 file changed, 10 insertions(+), 8 deletions(-) |
| 20 | + |
| 21 | +diff --git a/mozilla/certdata2pem.py b/mozilla/certdata2pem.py |
| 22 | +index ede23d4..a6261f8 100644 |
| 23 | +--- a/mozilla/certdata2pem.py |
| 24 | ++++ b/mozilla/certdata2pem.py |
| 25 | +@@ -28,9 +28,6 @@ import sys |
| 26 | + import textwrap |
| 27 | + import io |
| 28 | + |
| 29 | +-from cryptography import x509 |
| 30 | +- |
| 31 | +- |
| 32 | + objects = [] |
| 33 | + |
| 34 | + # Dirty file parser. |
| 35 | +@@ -122,11 +119,16 @@ for obj in objects: |
| 36 | + if not obj['CKA_LABEL'] in trust or not trust[obj['CKA_LABEL']]: |
| 37 | + continue |
| 38 | + |
| 39 | +- cert = x509.load_der_x509_certificate(obj['CKA_VALUE']) |
| 40 | +- if cert.not_valid_after < datetime.datetime.now(): |
| 41 | +- print('!'*74) |
| 42 | +- print('Trusted but expired certificate found: %s' % obj['CKA_LABEL']) |
| 43 | +- print('!'*74) |
| 44 | ++ try: |
| 45 | ++ from cryptography import x509 |
| 46 | ++ |
| 47 | ++ cert = x509.load_der_x509_certificate(obj['CKA_VALUE']) |
| 48 | ++ if cert.not_valid_after < datetime.datetime.now(): |
| 49 | ++ print('!'*74) |
| 50 | ++ print('Trusted but expired certificate found: %s' % obj['CKA_LABEL']) |
| 51 | ++ print('!'*74) |
| 52 | ++ except ImportError: |
| 53 | ++ pass |
| 54 | + |
| 55 | + bname = obj['CKA_LABEL'][1:-1].replace('/', '_')\ |
| 56 | + .replace(' ', '_')\ |
| 57 | +-- |
| 58 | +2.33.1 |
| 59 | + |
0 commit comments