Update to pyo3-0.23 #11954

ngoldbaum · 2024-11-15T00:47:34Z

No description provided.

alex · 2024-11-15T01:02:50Z

Is tehre a reason not to push a change to cargo.toml to point at git? Or are there patches on top of github that are still needed?

alex · 2024-11-15T01:32:57Z

With sadness, you'll need to rebase on main, we moved the pyo3 dep to be a workspace one.

ngoldbaum · 2024-11-15T01:42:57Z

Is tehre a reason not to push a change to cargo.toml to point at git? Or are there patches on top of github that are still needed?

Nope no particular reason, I just had it pointed at a local clone with path. Pointing it at github seems fine for now.

alex · 2024-11-15T01:50:02Z

this should fix it

diff --git a/src/rust/src/x509/certificate.rs b/src/rust/src/x509/certificate.rs
index 5758acccb..66afa08f1 100644
--- a/src/rust/src/x509/certificate.rs
+++ b/src/rust/src/x509/certificate.rs
@@ -716,7 +716,7 @@ pub(crate) fn parse_access_descriptions(
 
 fn parse_naming_authority<'p>(
     py: pyo3::Python<'p>,
-    authority: NamingAuthority<'p>,
+    authority: NamingAuthority<'_>,
 ) -> CryptographyResult<pyo3::Bound<'p, pyo3::PyAny>> {
     let py_id = match &authority.id {
         Some(data) => oid_to_py_oid(py, data)?,
@@ -736,10 +736,10 @@ fn parse_naming_authority<'p>(
         .call1((py_id, py_url, py_text))?)
 }
 
-fn parse_profession_infos<'a>(
-    py: pyo3::Python<'a>,
+fn parse_profession_infos<'p, 'a>(
+    py: pyo3::Python<'p>,
     profession_infos: &asn1::SequenceOf<'a, ProfessionInfo<'a>>,
-) -> CryptographyResult<pyo3::Bound<'a, pyo3::PyAny>> {
+) -> CryptographyResult<pyo3::Bound<'p, pyo3::PyAny>> {
     let py_infos = pyo3::types::PyList::empty(py);
     for info in profession_infos.clone() {
         let py_naming_authority = match info.naming_authority {
@@ -782,10 +782,10 @@ fn parse_profession_infos<'a>(
     Ok(py_infos.into_any())
 }
 
-fn parse_admissions<'a>(
-    py: pyo3::Python<'a>,
+fn parse_admissions<'p, 'a>(
+    py: pyo3::Python<'p>,
     admissions: &asn1::SequenceOf<'a, Admission<'a>>,
-) -> CryptographyResult<pyo3::Bound<'a, pyo3::PyAny>> {
+) -> CryptographyResult<pyo3::Bound<'p, pyo3::PyAny>> {
     let py_admissions = pyo3::types::PyList::empty(py);
     for admission in admissions.clone() {
         let py_admission_authority = match admission.admission_authority {

ngoldbaum · 2024-11-15T15:23:43Z

woohoo, tests pass!

alex

Sorry for the zillion duplicate comments, just wanted to be able to quickly see if they were resolved.

Thanks so much for your work on this!

alex · 2024-11-15T15:23:48Z

src/rust/src/backend/ec.rs

@@ -34,8 +34,8 @@ fn curve_from_py_curve(
    if !py_curve.is_instance(&types::ELLIPTIC_CURVE.get(py)?)? {
        if allow_curve_class {
            let warning_cls = types::DEPRECATED_IN_42.get(py)?;
-            let warning_msg = "Curve argument must be an instance of an EllipticCurve class. Did you pass a class by mistake? This will be an exception in a future version of cryptography.";
-            pyo3::PyErr::warn_bound(py, &warning_cls, warning_msg, 1)?;
+            let warning_msg = std::ffi::CString::new("Curve argument must be an instance of an EllipticCurve class. Did you pass a class by mistake? This will be an exception in a future version of cryptography.").unwrap();


We can use CStr::from_bytes_with_nul and save an allocation here

alex · 2024-11-15T15:28:22Z

src/rust/src/x509/certificate.rs

-                "Properties that return a naïve datetime object have been deprecated. Please switch to not_valid_before_utc.",
-                1,
-            )?;
+        let message = std::ffi::CString::new("Properties that return a naïve datetime object have been deprecated. Please switch to not_valid_before_utc.").unwrap();


alex · 2024-11-15T15:28:29Z

src/rust/src/x509/certificate.rs

-                "Properties that return a naïve datetime object have been deprecated. Please switch to not_valid_after_utc.",
-                1,
-            )?;
+        let message = std::ffi::CString::new("Properties that return a naïve datetime object have been deprecated. Please switch to not_valid_after_utc.").unwrap();


alex · 2024-11-15T15:28:35Z

src/rust/src/x509/certificate.rs

-            "Parsed a negative serial number, which is disallowed by RFC 5280. Loading this certificate will cause an exception in the next release of cryptography.",
-            1,
-        )?;
+        let message = std::ffi::CString::new("Parsed a negative serial number, which is disallowed by RFC 5280. Loading this certificate will cause an exception in the next release of cryptography.").unwrap();


alex · 2024-11-15T15:28:40Z

src/rust/src/x509/certificate.rs

-                "The parsed certificate contains a NULL parameter value in its signature algorithm parameters. This is invalid and will be rejected in a future version of cryptography. If this certificate was created via Java, please upgrade to JDK21+ or the latest JDK11/17 once a fix is issued. If this certificate was created in some other fashion please report the issue to the cryptography issue tracker. See https://github.com/pyca/cryptography/issues/8996 and https://github.com/pyca/cryptography/issues/9253 for more details.",
-                2,
-            )?;
+            let message = std::ffi::CString::new("The parsed certificate contains a NULL parameter value in its signature algorithm parameters. This is invalid and will be rejected in a future version of cryptography. If this certificate was created via Java, please upgrade to JDK21+ or the latest JDK11/17 once a fix is issued. If this certificate was created in some other fashion please report the issue to the cryptography issue tracker. See https://github.com/pyca/cryptography/issues/8996 and https://github.com/pyca/cryptography/issues/9253 for more details.").unwrap();


alex · 2024-11-15T15:31:10Z