From b3af28773e255e0244f9cf28eaa07c8aad77fa98 Mon Sep 17 00:00:00 2001
From: Jeremy Cline <jeremycline@microsoft.com>
Date: Thu, 2 Jul 2026 09:18:39 -0400
Subject: [PATCH] Update to v49.0.0

This update includes a few backwards-incompatible changes. Aside from a
few simple renames, the other incompatibilities are correctness-related.

* **BACKWARDS INCOMPATIBLE:** Removed the deprecated
  ``PUBLIC_KEY_TYPES``, ``PRIVATE_KEY_TYPES``,
  ``CERTIFICATE_PRIVATE_KEY_TYPES``, ``CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES``,
  and ``CERTIFICATE_PUBLIC_KEY_TYPES`` type aliases. Use
  ``PublicKeyTypes``, ``PrivateKeyTypes``, ``CertificateIssuerPrivateKeyTypes``,
  ``CertificateIssuerPublicKeyTypes``, and ``CertificatePublicKeyTypes``
  instead. These were deprecated in version 40.0.
* **BACKWARDS INCOMPATIBLE:** :class:`~cryptography.hazmat.primitives.ciphers.algorithms.ChaCha20`
  now treats the first 4 bytes of the ``nonce`` as a 32-bit little-endian block
  counter (as defined in :rfc:`7539`) and tracks the number of bytes processed.
  Attempting to encrypt or decrypt more data than the counter allows before it
  would overflow now raises a :class:`ValueError` rather than silently diverging
  from RFC 7539. Setting the counter portion of the ``nonce`` to zero allows
  encrypting up to 256 GiB with a given nonce.
* **BACKWARDS INCOMPATIBLE:** Loading an X.509 certificate whose ECDSA or DSA
  signature ``AlgorithmIdentifier`` contains encoded NULL parameters now raises
  a :class:`ValueError`. Such certificates are invalid, but older versions of
  Java emitted them; previously they loaded with a deprecation warning.

Complete changelog: https://github.com/pyca/cryptography/blob/49.0.0/CHANGELOG.rst
---
 .gitignore                     | 2 ++
 0001-Lower-cc-dependency.patch | 4 ++--
 python-cryptography.spec       | 6 +++---
 sources                        | 4 ++--
 4 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/.gitignore b/.gitignore
index 634f328..d4474cd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -87,3 +87,5 @@
 /cryptography-47.0.0.tar.gz
 /cryptography-48.0.0.tar.gz
 /cryptography-48.0.0-vendor.tar.bz2
+/cryptography-49.0.0.tar.gz
+/cryptography-49.0.0-vendor.tar.bz2
diff --git a/0001-Lower-cc-dependency.patch b/0001-Lower-cc-dependency.patch
index ac4f92a..36b82f7 100644
--- a/0001-Lower-cc-dependency.patch
+++ b/0001-Lower-cc-dependency.patch
@@ -19,8 +19,8 @@ index d045bb077..680344f95 100644
  [workspace.dependencies]
  asn1 = { version = "0.24.1", default-features = false }
  base64 = "0.22"
--cc = "1.2.61"
-+cc = "1.2.60"
+-cc = "1.2.63"
++cc = "1.2.62"
  cfg-if = "1"
  foreign-types = "0.3"
  foreign-types-shared = "0.1"
diff --git a/python-cryptography.spec b/python-cryptography.spec
index a8a9fdf..fd8a6e3 100644
--- a/python-cryptography.spec
+++ b/python-cryptography.spec
@@ -5,7 +5,7 @@
 %global srcname cryptography
 
 Name:           python-%{srcname}
-Version:        48.0.0
+Version:        49.0.0
 Release:        %autorelease
 Summary:        PyCA's cryptography library
 
@@ -25,8 +25,8 @@ Source0:        https://github.com/pyca/cryptography/archive/%{version}/%{srcnam
 Source1:        cryptography-%{version}-vendor.tar.bz2
 Source2:        conftest-skipper.py
 
-# Temporarily drop cc dependency to .60 since it's the same as .61
-# except for a docblock change.
+# Temporarily drop cc dependency to .62 since it's the same as .63
+# except for a dependency bump
 Patch:          0001-Lower-cc-dependency.patch
 
 ExclusiveArch:  %{rust_arches}
diff --git a/sources b/sources
index 994ce71..af8ede9 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (cryptography-48.0.0.tar.gz) = b38d0ae952bd33149c5358bb1fe9c875b55cc438f62ab0c0ab4d30d651e9d44f2895b39194906e7e9503294ca95a19eba6d97b32d319ed36bb38fa05faf89c6b
-SHA512 (cryptography-48.0.0-vendor.tar.bz2) = fddc63507ce64f6e4a6174b043ed789d8b6f5aea7f6110d95a460eb2327ca39a3bef9a87d1e17732d7782a929358ac821c2b84f39682419cfbb101dbdaa94363
+SHA512 (cryptography-49.0.0.tar.gz) = 6a4435e90b981dfe1cc90479846041f800d618b8a673351ae55e308eeb7c152959ee56cb7a7188a7b46ae3228577192c651bc9801796f62fed55e7f8c3258f33
+SHA512 (cryptography-49.0.0-vendor.tar.bz2) = dc908b8b44ffc3205481fedcbc9e2a94331ee54b9b54a878755170437eff47d2d92b766fa268a916d525808a649fac8d7b8155692e28eef99e90c8a2ae3e434f