From 40791ac9da2ba3b16b800397abf785fe78a62b84 Mon Sep 17 00:00:00 2001 From: Kevin Fenzi Date: Tue, 13 Sep 2022 14:26:58 -0700 Subject: [PATCH 01/43] Enable all tests and drop no longer needed test patch. Signed-off-by: Kevin Fenzi --- python-requests.spec | 15 +++++---------- requests-2.28.1-tests_nonet.patch | 11 ----------- 2 files changed, 5 insertions(+), 21 deletions(-) delete mode 100644 requests-2.28.1-tests_nonet.patch diff --git a/python-requests.spec b/python-requests.spec index 24ff321..7e7ffb6 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -10,7 +10,7 @@ Name: python-requests Version: 2.28.1 -Release: 2%{?dist} +Release: 3%{?dist} Summary: HTTP library, written in Python, for human beings License: ASL 2.0 @@ -20,13 +20,6 @@ Source0: https://github.com/requests/requests/archive/v%{version}/request # https://bugzilla.redhat.com/show_bug.cgi?id=904614 Patch0: requests-2.28.1-system-certs.patch -# Use 127.0.0.1 not localhost for socket.bind() in the Server test -# class, to fix tests in Koji's no-network environment -# This probably isn't really upstreamable, because I guess localhost -# could technically be IPv6 or something, and our no-network env is -# a pretty odd one so this is a niche requirement. -Patch1: requests-2.28.1-tests_nonet.patch - BuildArch: noarch %description @@ -90,8 +83,7 @@ sed -i 's/ --doctest-modules//' pyproject.toml %if %{with tests} %check -# Omitted tests use a TARPIT server so require network connection -%pytest -v -k "not (test_connect_timeout or test_total_timeout_connect)" +%pytest -v %endif @@ -101,6 +93,9 @@ sed -i 's/ --doctest-modules//' pyproject.toml %changelog +* Tue Sep 13 2022 Kevin Fenzi - 2.28.1-3 +- Enable all tests and drop no longer needed test patch. + * Fri Jul 22 2022 Fedora Release Engineering - 2.28.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild diff --git a/requests-2.28.1-tests_nonet.patch b/requests-2.28.1-tests_nonet.patch deleted file mode 100644 index 32e96ee..0000000 --- a/requests-2.28.1-tests_nonet.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- requests-2.28.1/tests/testserver/server.py 2022-06-29 08:09:11.000000000 -0700 -+++ requests-2.28.1/tests/testserver/server.py.new 2022-07-12 14:04:30.218077055 -0700 -@@ -29,7 +29,7 @@ - def __init__( - self, - handler=None, -- host="localhost", -+ host="127.0.0.1", - port=0, - requests_to_handle=1, - wait_to_close_event=None, From e2cec88d94129efbf5761e67f97d4304b719d25c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 20 Jan 2023 16:53:48 +0000 Subject: [PATCH 02/43] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- python-requests.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/python-requests.spec b/python-requests.spec index 7e7ffb6..238feae 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -10,7 +10,7 @@ Name: python-requests Version: 2.28.1 -Release: 3%{?dist} +Release: 4%{?dist} Summary: HTTP library, written in Python, for human beings License: ASL 2.0 @@ -93,6 +93,9 @@ sed -i 's/ --doctest-modules//' pyproject.toml %changelog +* Fri Jan 20 2023 Fedora Release Engineering - 2.28.1-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Tue Sep 13 2022 Kevin Fenzi - 2.28.1-3 - Enable all tests and drop no longer needed test patch. From 040845c23cacfa3d11db19cb70e459894fd62af4 Mon Sep 17 00:00:00 2001 From: Lumir Balhar Date: Thu, 19 Jan 2023 17:41:17 +0100 Subject: [PATCH 03/43] Update to 2.28.2 --- .gitignore | 1 + python-requests.spec | 9 +++-- requests-2.28.1-system-certs.patch | 37 ------------------- sources | 2 +- system-certs.patch | 57 ++++++++++++++++++++++++++++++ 5 files changed, 65 insertions(+), 41 deletions(-) delete mode 100644 requests-2.28.1-system-certs.patch create mode 100644 system-certs.patch diff --git a/.gitignore b/.gitignore index 0ccf83c..7a32ee7 100644 --- a/.gitignore +++ b/.gitignore @@ -50,3 +50,4 @@ /requests-v2.27.0.tar.gz /requests-v2.27.1.tar.gz /requests-v2.28.1.tar.gz +/requests-v2.28.2.tar.gz diff --git a/python-requests.spec b/python-requests.spec index 238feae..662f94e 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -9,8 +9,8 @@ Name: python-requests -Version: 2.28.1 -Release: 4%{?dist} +Version: 2.28.2 +Release: 1%{?dist} Summary: HTTP library, written in Python, for human beings License: ASL 2.0 @@ -18,7 +18,7 @@ URL: https://pypi.io/project/requests Source0: https://github.com/requests/requests/archive/v%{version}/requests-v%{version}.tar.gz # Explicitly use the system certificates in ca-certificates. # https://bugzilla.redhat.com/show_bug.cgi?id=904614 -Patch0: requests-2.28.1-system-certs.patch +Patch0: system-certs.patch BuildArch: noarch @@ -93,6 +93,9 @@ sed -i 's/ --doctest-modules//' pyproject.toml %changelog +* Wed Feb 01 2023 Lumír Balhar - 2.28.2-1 +- Update to 2.28.2 (rhbz#2160527) + * Fri Jan 20 2023 Fedora Release Engineering - 2.28.1-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild diff --git a/requests-2.28.1-system-certs.patch b/requests-2.28.1-system-certs.patch deleted file mode 100644 index 58bd6b3..0000000 --- a/requests-2.28.1-system-certs.patch +++ /dev/null @@ -1,37 +0,0 @@ ---- requests-2.28.1/requests/certs.py 2022-07-12 13:55:25.378079641 -0700 -+++ requests-2.28.1/requests/certs.py.new 2022-07-12 13:57:03.834621295 -0700 -@@ -9,8 +9,13 @@ - If you are packaging Requests, e.g., for a Linux distribution or a managed - environment, you can change the definition of where() to return a separately - packaged CA bundle. -+ -+This Fedora-patched package returns "/etc/pki/tls/certs/ca-bundle.crt" provided -+by the ca-certificates RPM package. - """ --from certifi import where -+def where(): -+ """Return the absolute path to the system CA bundle.""" -+ return '/etc/pki/tls/certs/ca-bundle.crt' - - if __name__ == "__main__": - print(where()) ---- requests-2.28.1/setup.py 2022-06-29 08:09:11.000000000 -0700 -+++ requests-2.28.1/setup.py.new 2022-07-12 13:58:33.830116402 -0700 -@@ -62,7 +62,6 @@ - "charset_normalizer>=2,<3", - "idna>=2.5,<4", - "urllib3>=1.21.1,<1.27", -- "certifi>=2017.4.17", - ] - test_requirements = [ - "pytest-httpbin==0.0.7", ---- requests-2.28.1/setup.cfg 2022-06-29 08:09:11.000000000 -0700 -+++ requests-2.28.1/setup.cfg.new 2022-07-12 13:58:19.619038220 -0700 -@@ -4,7 +4,6 @@ - socks - use_chardet_on_py3 - requires-dist = -- certifi>=2017.4.17 - charset_normalizer>=2,<3 - idna>=2.5,<4 - urllib3>=1.21.1,<1.27 diff --git a/sources b/sources index 6918890..9f2da1e 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (requests-v2.28.1.tar.gz) = caed2d08340c79af9448eefaa1df796f9112a7c8da30b218d5f342326a9629d95928c0978b9600e4bd7f56a297ef41afb088af390738be431b91b8c7429e741b +SHA512 (requests-v2.28.2.tar.gz) = 88c5a92ea51cd18e7edd49a6259d7b56bc0c17f86067f796b5f668ed35202b8bc1395e4811ee2089350e08893dcd304c9801dbf087abfaff1d14859e31bce8ac diff --git a/system-certs.patch b/system-certs.patch new file mode 100644 index 0000000..1778958 --- /dev/null +++ b/system-certs.patch @@ -0,0 +1,57 @@ +From f21606c102368ad7a6e8bcab5a0c65dcddbbf9e5 Mon Sep 17 00:00:00 2001 +From: Lumir Balhar +Date: Thu, 19 Jan 2023 17:35:02 +0100 +Subject: [PATCH] system certs + +--- + requests/certs.py | 7 ++++++- + setup.cfg | 1 - + setup.py | 1 - + 3 files changed, 6 insertions(+), 3 deletions(-) + +diff --git a/requests/certs.py b/requests/certs.py +index 1f30a45..9224f62 100644 +--- a/requests/certs.py ++++ b/requests/certs.py +@@ -9,8 +9,13 @@ only one — the one from the certifi package. + If you are packaging Requests, e.g., for a Linux distribution or a managed + environment, you can change the definition of where() to return a separately + packaged CA bundle. ++ ++This Fedora-patched package returns "/etc/pki/tls/certs/ca-bundle.crt" provided ++by the ca-certificates RPM package. + """ +-from certifi import where ++def where(): ++ """Return the absolute path to the system CA bundle.""" ++ return '/etc/pki/tls/certs/ca-bundle.crt' + + if __name__ == "__main__": + print(where()) +diff --git a/setup.cfg b/setup.cfg +index bf21c81..906c0f1 100644 +--- a/setup.cfg ++++ b/setup.cfg +@@ -4,7 +4,6 @@ provides-extra = + socks + use_chardet_on_py3 + requires-dist = +- certifi>=2017.4.17 + charset_normalizer>=2,<4 + idna>=2.5,<4 + urllib3>=1.21.1,<1.27 +diff --git a/setup.py b/setup.py +index 092b40d..c6c0ad5 100755 +--- a/setup.py ++++ b/setup.py +@@ -62,7 +62,6 @@ requires = [ + "charset_normalizer>=2,<4", + "idna>=2.5,<4", + "urllib3>=1.21.1,<1.27", +- "certifi>=2017.4.17", + ] + test_requirements = [ + "pytest-httpbin==0.0.7", +-- +2.39.0 + From 8d03190e2562698b7b1f2a6f735cd152134e371b Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Tue, 16 May 2023 17:36:43 -0400 Subject: [PATCH 04/43] Disable tests by default in RHEL builds RHEL does not include the test dependencies. This is based on c9s: https://gitlab.com/redhat/centos-stream/rpms/python-requests/-/commit/488327aa0f28e74b9e90c64f3aed8f5a8f1d82fa --- python-requests.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/python-requests.spec b/python-requests.spec index 662f94e..8a67450 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -1,6 +1,7 @@ -%if 0%{?_module_build} +%if 0%{?_module_build} || 0%{?rhel} # Don't run tests on module-build for now # See: https://bugzilla.redhat.com/show_bug.cgi?id=1450608 +# RHEL does not include the test dependencies %bcond_with tests %else # When bootstrapping Python, we cannot test this yet From d9c9c5dd57c680d8dbd84f1b3c6b964994ea2df6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 23 May 2023 10:13:09 +0200 Subject: [PATCH 05/43] Security fix for CVE-2023-32681 https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q --- CVE-2023-32681.patch | 56 ++++++++++++++++++++++++++++++++++++++++++++ python-requests.spec | 9 ++++++- 2 files changed, 64 insertions(+), 1 deletion(-) create mode 100644 CVE-2023-32681.patch diff --git a/CVE-2023-32681.patch b/CVE-2023-32681.patch new file mode 100644 index 0000000..2b4cd79 --- /dev/null +++ b/CVE-2023-32681.patch @@ -0,0 +1,56 @@ +From 74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5 Mon Sep 17 00:00:00 2001 +From: Nate Prewitt +Date: Mon, 22 May 2023 08:08:57 -0700 +Subject: [PATCH] Merge pull request from GHSA-j8r2-6x86-q33q + +--- + requests/sessions.py | 4 +++- + tests/test_requests.py | 20 ++++++++++++++++++++ + 2 files changed, 23 insertions(+), 1 deletion(-) + +diff --git a/requests/sessions.py b/requests/sessions.py +index 6cb3b4dae3..dbcf2a7b0e 100644 +--- a/requests/sessions.py ++++ b/requests/sessions.py +@@ -324,7 +324,9 @@ def rebuild_proxies(self, prepared_request, proxies): + except KeyError: + username, password = None, None + +- if username and password: ++ # urllib3 handles proxy authorization for us in the standard adapter. ++ # Avoid appending this to TLS tunneled requests where it may be leaked. ++ if not scheme.startswith('https') and username and password: + headers["Proxy-Authorization"] = _basic_auth_str(username, password) + + return new_proxies +diff --git a/tests/test_requests.py b/tests/test_requests.py +index b1c8dd4534..b420c44d73 100644 +--- a/tests/test_requests.py ++++ b/tests/test_requests.py +@@ -647,6 +647,26 @@ def test_proxy_authorization_preserved_on_request(self, httpbin): + + assert sent_headers.get("Proxy-Authorization") == proxy_auth_value + ++ ++ @pytest.mark.parametrize( ++ "url,has_proxy_auth", ++ ( ++ ('http://example.com', True), ++ ('https://example.com', False), ++ ), ++ ) ++ def test_proxy_authorization_not_appended_to_https_request(self, url, has_proxy_auth): ++ session = requests.Session() ++ proxies = { ++ 'http': 'http://test:pass@localhost:8080', ++ 'https': 'http://test:pass@localhost:8090', ++ } ++ req = requests.Request('GET', url) ++ prep = req.prepare() ++ session.rebuild_proxies(prep, proxies) ++ ++ assert ('Proxy-Authorization' in prep.headers) is has_proxy_auth ++ + def test_basicauth_with_netrc(self, httpbin): + auth = ("user", "pass") + wrong_auth = ("wronguser", "wrongpass") diff --git a/python-requests.spec b/python-requests.spec index 8a67450..63c8792 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -11,7 +11,7 @@ Name: python-requests Version: 2.28.2 -Release: 1%{?dist} +Release: 2%{?dist} Summary: HTTP library, written in Python, for human beings License: ASL 2.0 @@ -21,6 +21,9 @@ Source0: https://github.com/requests/requests/archive/v%{version}/request # https://bugzilla.redhat.com/show_bug.cgi?id=904614 Patch0: system-certs.patch +# Security fix for CVE-2023-32681 +Patch1: https://github.com/psf/requests/commit/74ea7cf7a6.patch#/CVE-2023-32681.patch + BuildArch: noarch %description @@ -94,6 +97,10 @@ sed -i 's/ --doctest-modules//' pyproject.toml %changelog +* Tue May 23 2023 Miro Hrončok - 2.28.2-2 +- Security fix for CVE-2023-32681 +- https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q + * Wed Feb 01 2023 Lumír Balhar - 2.28.2-1 - Update to 2.28.2 (rhbz#2160527) From f5181bf610de6c2b4010df8f12cffe12dcb1bb32 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Wed, 14 Jun 2023 00:12:25 +0200 Subject: [PATCH 06/43] Bootstrap for Python 3.12 --- python-requests.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/python-requests.spec b/python-requests.spec index 63c8792..3d78541 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -1,3 +1,4 @@ +%global _without_tests 1 %if 0%{?_module_build} || 0%{?rhel} # Don't run tests on module-build for now # See: https://bugzilla.redhat.com/show_bug.cgi?id=1450608 @@ -11,7 +12,7 @@ Name: python-requests Version: 2.28.2 -Release: 2%{?dist} +Release: 3%{?dist} Summary: HTTP library, written in Python, for human beings License: ASL 2.0 @@ -97,6 +98,9 @@ sed -i 's/ --doctest-modules//' pyproject.toml %changelog +* Tue Jun 13 2023 Python Maint - 2.28.2-3 +- Bootstrap for Python 3.12 + * Tue May 23 2023 Miro Hrončok - 2.28.2-2 - Security fix for CVE-2023-32681 - https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q From 375e8589990ba1509fcae6351d4a0dbc4b4dba21 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Sat, 1 Jul 2023 13:04:01 +0200 Subject: [PATCH 07/43] Rebuilt for Python 3.12 --- python-requests.spec | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/python-requests.spec b/python-requests.spec index 3d78541..cdf383e 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -1,4 +1,3 @@ -%global _without_tests 1 %if 0%{?_module_build} || 0%{?rhel} # Don't run tests on module-build for now # See: https://bugzilla.redhat.com/show_bug.cgi?id=1450608 @@ -12,7 +11,7 @@ Name: python-requests Version: 2.28.2 -Release: 3%{?dist} +Release: 4%{?dist} Summary: HTTP library, written in Python, for human beings License: ASL 2.0 @@ -98,6 +97,9 @@ sed -i 's/ --doctest-modules//' pyproject.toml %changelog +* Sat Jul 01 2023 Python Maint - 2.28.2-4 +- Rebuilt for Python 3.12 + * Tue Jun 13 2023 Python Maint - 2.28.2-3 - Bootstrap for Python 3.12 From 767bf299586f46e69c74860c491c5468a9dad00c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 21 Jul 2023 13:35:41 +0000 Subject: [PATCH 08/43] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- python-requests.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/python-requests.spec b/python-requests.spec index cdf383e..8afaa3e 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -11,7 +11,7 @@ Name: python-requests Version: 2.28.2 -Release: 4%{?dist} +Release: 5%{?dist} Summary: HTTP library, written in Python, for human beings License: ASL 2.0 @@ -97,6 +97,9 @@ sed -i 's/ --doctest-modules//' pyproject.toml %changelog +* Fri Jul 21 2023 Fedora Release Engineering - 2.28.2-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Sat Jul 01 2023 Python Maint - 2.28.2-4 - Rebuilt for Python 3.12 From 6b892527036031831c378b00a29d77f33ffc7258 Mon Sep 17 00:00:00 2001 From: Karolina Surma Date: Tue, 8 Aug 2023 17:13:42 +0200 Subject: [PATCH 09/43] Declare the license as an SPDX expression --- python-requests.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/python-requests.spec b/python-requests.spec index 8afaa3e..f6e1624 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -11,10 +11,10 @@ Name: python-requests Version: 2.28.2 -Release: 5%{?dist} +Release: 6%{?dist} Summary: HTTP library, written in Python, for human beings -License: ASL 2.0 +License: Apache-2.0 URL: https://pypi.io/project/requests Source0: https://github.com/requests/requests/archive/v%{version}/requests-v%{version}.tar.gz # Explicitly use the system certificates in ca-certificates. @@ -97,6 +97,9 @@ sed -i 's/ --doctest-modules//' pyproject.toml %changelog +* Tue Aug 08 2023 Karolina Surma - 2.28.2-6 +- Declare the license as an SPDX expression + * Fri Jul 21 2023 Fedora Release Engineering - 2.28.2-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From b3699e581096c31100a997a02bfecb8e7627f384 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 10 Oct 2023 13:49:46 +0200 Subject: [PATCH 10/43] Remove redundant things from the spec file - %pyproject_buildrequires -r has been the default for a while now - Sources and Patches don't need to be enumerated - %python_provide is redundant and deprecated - pyproject-rpm-macros does not need to be explicitly BuildRequired - the Summary does not need to be repeated - modularity was retired --- python-requests.spec | 19 +++++-------------- 1 file changed, 5 insertions(+), 14 deletions(-) diff --git a/python-requests.spec b/python-requests.spec index f6e1624..5b816d6 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -1,6 +1,4 @@ -%if 0%{?_module_build} || 0%{?rhel} -# Don't run tests on module-build for now -# See: https://bugzilla.redhat.com/show_bug.cgi?id=1450608 +%if 0%{?rhel} # RHEL does not include the test dependencies %bcond_with tests %else @@ -16,13 +14,13 @@ Summary: HTTP library, written in Python, for human beings License: Apache-2.0 URL: https://pypi.io/project/requests -Source0: https://github.com/requests/requests/archive/v%{version}/requests-v%{version}.tar.gz +Source: https://github.com/requests/requests/archive/v%{version}/requests-v%{version}.tar.gz # Explicitly use the system certificates in ca-certificates. # https://bugzilla.redhat.com/show_bug.cgi?id=904614 -Patch0: system-certs.patch +Patch: system-certs.patch # Security fix for CVE-2023-32681 -Patch1: https://github.com/psf/requests/commit/74ea7cf7a6.patch#/CVE-2023-32681.patch +Patch: https://github.com/psf/requests/commit/74ea7cf7a6.patch#/CVE-2023-32681.patch BuildArch: noarch @@ -33,12 +31,9 @@ capabilities you should need, but the API is thoroughly broken. This library is designed to make HTTP requests easy for developers. %package -n python%{python3_pkgversion}-requests -Summary: HTTP library, written in Python, for human beings - -%{?python_provide:%python_provide python%{python3_pkgversion}-requests} +Summary: %{summary} BuildRequires: python%{python3_pkgversion}-devel -BuildRequires: pyproject-rpm-macros %if %{with tests} BuildRequires: python3dist(pytest) @@ -57,11 +52,7 @@ designed to make HTTP requests easy for developers. %pyproject_extras_subpkg -n python%{python3_pkgversion}-requests security socks %generate_buildrequires -%if %{with tests} -%pyproject_buildrequires -r -%else %pyproject_buildrequires -%endif %prep From 92130db6320a9758f42e032461a115ab630100aa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 10 Oct 2023 13:57:53 +0200 Subject: [PATCH 11/43] Use a newer and more understandable %bcond syntax --- python-requests.spec | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/python-requests.spec b/python-requests.spec index 5b816d6..e1448c0 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -1,11 +1,6 @@ -%if 0%{?rhel} -# RHEL does not include the test dependencies -%bcond_with tests -%else # When bootstrapping Python, we cannot test this yet -%bcond_without tests -%endif - +# RHEL does not include the test dependencies +%bcond tests %{undefined rhel} Name: python-requests Version: 2.28.2 From 85302c38d754b932aab836a5475c5f37bd66c541 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 10 Oct 2023 14:04:07 +0200 Subject: [PATCH 12/43] Disable extras on RHEL, explicitly BuildRequire them on Fedora Once urllib3 stops pulling in pysocks by default, a test would fail without an explicit dependency. --- python-requests.spec | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/python-requests.spec b/python-requests.spec index e1448c0..a95454b 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -1,10 +1,12 @@ # When bootstrapping Python, we cannot test this yet # RHEL does not include the test dependencies %bcond tests %{undefined rhel} +# The extras are disabled on RHEL to avoid pysocks and deprecated requests[security] +%bcond extras %{undefined rhel} Name: python-requests Version: 2.28.2 -Release: 6%{?dist} +Release: 7%{?dist} Summary: HTTP library, written in Python, for human beings License: Apache-2.0 @@ -44,10 +46,12 @@ cumbersome. Python’s built-in urllib2 module provides most of the HTTP capabilities you should need, but the API is thoroughly broken. This library is designed to make HTTP requests easy for developers. +%if %{with extras} %pyproject_extras_subpkg -n python%{python3_pkgversion}-requests security socks +%endif %generate_buildrequires -%pyproject_buildrequires +%pyproject_buildrequires %{?with_extras:-x security,socks} %prep @@ -73,7 +77,8 @@ sed -i 's/ --doctest-modules//' pyproject.toml %if %{with tests} %check -%pytest -v +# test_use_proxy_from_environment needs pysocks +%pytest -v %{!?with_extras:-k "not test_use_proxy_from_environment"} %endif @@ -83,6 +88,10 @@ sed -i 's/ --doctest-modules//' pyproject.toml %changelog +* Tue Oct 10 2023 Miro Hrončok - 2.28.2-7 +- Do not package requests[security] and requests[socks] on RHEL +- Make the package build even when urllib3 won't pull in pysocks + * Tue Aug 08 2023 Karolina Surma - 2.28.2-6 - Declare the license as an SPDX expression From a5e331ad3f2790bf1249dbbd85957d5fbd47d3e2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 10 Oct 2023 14:13:33 +0200 Subject: [PATCH 13/43] Always run at least an import check in %check --- python-requests.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/python-requests.spec b/python-requests.spec index a95454b..46597f3 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -75,8 +75,9 @@ sed -i 's/ --doctest-modules//' pyproject.toml %pyproject_save_files requests -%if %{with tests} %check +%pyproject_check_import +%if %{with tests} # test_use_proxy_from_environment needs pysocks %pytest -v %{!?with_extras:-k "not test_use_proxy_from_environment"} %endif From ab88e0da153ae8c2fccdee73878e75a069b74dcc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 10 Oct 2023 14:08:28 +0200 Subject: [PATCH 14/43] Move lines around to resemble the example Python specfile https://docs.fedoraproject.org/en-US/packaging-guidelines/Python/#_example_spec_file --- python-requests.spec | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/python-requests.spec b/python-requests.spec index 46597f3..56e98ed 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -12,6 +12,7 @@ Summary: HTTP library, written in Python, for human beings License: Apache-2.0 URL: https://pypi.io/project/requests Source: https://github.com/requests/requests/archive/v%{version}/requests-v%{version}.tar.gz + # Explicitly use the system certificates in ca-certificates. # https://bugzilla.redhat.com/show_bug.cgi?id=904614 Patch: system-certs.patch @@ -20,18 +21,7 @@ Patch: system-certs.patch Patch: https://github.com/psf/requests/commit/74ea7cf7a6.patch#/CVE-2023-32681.patch BuildArch: noarch - -%description -Most existing Python modules for sending HTTP requests are extremely verbose and -cumbersome. Python’s built-in urllib2 module provides most of the HTTP -capabilities you should need, but the API is thoroughly broken. This library is -designed to make HTTP requests easy for developers. - -%package -n python%{python3_pkgversion}-requests -Summary: %{summary} - BuildRequires: python%{python3_pkgversion}-devel - %if %{with tests} BuildRequires: python3dist(pytest) BuildRequires: python3dist(pytest-httpbin) @@ -39,6 +29,15 @@ BuildRequires: python3dist(pytest-mock) BuildRequires: python3dist(trustme) %endif +%description +Most existing Python modules for sending HTTP requests are extremely verbose and +cumbersome. Python’s built-in urllib2 module provides most of the HTTP +capabilities you should need, but the API is thoroughly broken. This library is +designed to make HTTP requests easy for developers. + + +%package -n python%{python3_pkgversion}-requests +Summary: %{summary} %description -n python%{python3_pkgversion}-requests Most existing Python modules for sending HTTP requests are extremely verbose and @@ -46,10 +45,12 @@ cumbersome. Python’s built-in urllib2 module provides most of the HTTP capabilities you should need, but the API is thoroughly broken. This library is designed to make HTTP requests easy for developers. + %if %{with extras} %pyproject_extras_subpkg -n python%{python3_pkgversion}-requests security socks %endif + %generate_buildrequires %pyproject_buildrequires %{?with_extras:-x security,socks} From 46169880a4284a332635d6552176a4dc1a9441f3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= Date: Tue, 17 Oct 2023 11:21:31 +0200 Subject: [PATCH 15/43] Update to 2.31.0 --- .gitignore | 1 + CVE-2023-32681.patch | 56 -------------------------------------------- python-requests.spec | 13 +++++----- sources | 2 +- system-certs.patch | 15 ++++++------ 5 files changed, 17 insertions(+), 70 deletions(-) delete mode 100644 CVE-2023-32681.patch diff --git a/.gitignore b/.gitignore index 7a32ee7..67de33d 100644 --- a/.gitignore +++ b/.gitignore @@ -51,3 +51,4 @@ /requests-v2.27.1.tar.gz /requests-v2.28.1.tar.gz /requests-v2.28.2.tar.gz +/requests-v2.31.0.tar.gz diff --git a/CVE-2023-32681.patch b/CVE-2023-32681.patch deleted file mode 100644 index 2b4cd79..0000000 --- a/CVE-2023-32681.patch +++ /dev/null @@ -1,56 +0,0 @@ -From 74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5 Mon Sep 17 00:00:00 2001 -From: Nate Prewitt -Date: Mon, 22 May 2023 08:08:57 -0700 -Subject: [PATCH] Merge pull request from GHSA-j8r2-6x86-q33q - ---- - requests/sessions.py | 4 +++- - tests/test_requests.py | 20 ++++++++++++++++++++ - 2 files changed, 23 insertions(+), 1 deletion(-) - -diff --git a/requests/sessions.py b/requests/sessions.py -index 6cb3b4dae3..dbcf2a7b0e 100644 ---- a/requests/sessions.py -+++ b/requests/sessions.py -@@ -324,7 +324,9 @@ def rebuild_proxies(self, prepared_request, proxies): - except KeyError: - username, password = None, None - -- if username and password: -+ # urllib3 handles proxy authorization for us in the standard adapter. -+ # Avoid appending this to TLS tunneled requests where it may be leaked. -+ if not scheme.startswith('https') and username and password: - headers["Proxy-Authorization"] = _basic_auth_str(username, password) - - return new_proxies -diff --git a/tests/test_requests.py b/tests/test_requests.py -index b1c8dd4534..b420c44d73 100644 ---- a/tests/test_requests.py -+++ b/tests/test_requests.py -@@ -647,6 +647,26 @@ def test_proxy_authorization_preserved_on_request(self, httpbin): - - assert sent_headers.get("Proxy-Authorization") == proxy_auth_value - -+ -+ @pytest.mark.parametrize( -+ "url,has_proxy_auth", -+ ( -+ ('http://example.com', True), -+ ('https://example.com', False), -+ ), -+ ) -+ def test_proxy_authorization_not_appended_to_https_request(self, url, has_proxy_auth): -+ session = requests.Session() -+ proxies = { -+ 'http': 'http://test:pass@localhost:8080', -+ 'https': 'http://test:pass@localhost:8090', -+ } -+ req = requests.Request('GET', url) -+ prep = req.prepare() -+ session.rebuild_proxies(prep, proxies) -+ -+ assert ('Proxy-Authorization' in prep.headers) is has_proxy_auth -+ - def test_basicauth_with_netrc(self, httpbin): - auth = ("user", "pass") - wrong_auth = ("wronguser", "wrongpass") diff --git a/python-requests.spec b/python-requests.spec index 56e98ed..94f1c59 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -5,8 +5,8 @@ %bcond extras %{undefined rhel} Name: python-requests -Version: 2.28.2 -Release: 7%{?dist} +Version: 2.31.0 +Release: 1%{?dist} Summary: HTTP library, written in Python, for human beings License: Apache-2.0 @@ -17,9 +17,6 @@ Source: https://github.com/requests/requests/archive/v%{version}/request # https://bugzilla.redhat.com/show_bug.cgi?id=904614 Patch: system-certs.patch -# Security fix for CVE-2023-32681 -Patch: https://github.com/psf/requests/commit/74ea7cf7a6.patch#/CVE-2023-32681.patch - BuildArch: noarch BuildRequires: python%{python3_pkgversion}-devel %if %{with tests} @@ -80,7 +77,7 @@ sed -i 's/ --doctest-modules//' pyproject.toml %pyproject_check_import %if %{with tests} # test_use_proxy_from_environment needs pysocks -%pytest -v %{!?with_extras:-k "not test_use_proxy_from_environment"} +%pytest -v tests %{!?with_extras:-k "not test_use_proxy_from_environment"} %endif @@ -90,6 +87,10 @@ sed -i 's/ --doctest-modules//' pyproject.toml %changelog +* Mon Oct 16 2023 Tomáš Hrnčiar - 2.31.0-1 +- Update to 2.31.0 +- Fixes: rhbz#2189970 + * Tue Oct 10 2023 Miro Hrončok - 2.28.2-7 - Do not package requests[security] and requests[socks] on RHEL - Make the package build even when urllib3 won't pull in pysocks diff --git a/sources b/sources index 9f2da1e..3e4fef8 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (requests-v2.28.2.tar.gz) = 88c5a92ea51cd18e7edd49a6259d7b56bc0c17f86067f796b5f668ed35202b8bc1395e4811ee2089350e08893dcd304c9801dbf087abfaff1d14859e31bce8ac +SHA512 (requests-v2.31.0.tar.gz) = 43f536bdb2360fcceb24ef98e995ffa66cdefc2c502629f17a5722445bfa9ad8489201958c846c2aaef37e427f95a4d56e321a91095c69754680abfd83b39150 diff --git a/system-certs.patch b/system-certs.patch index 1778958..0e323f8 100644 --- a/system-certs.patch +++ b/system-certs.patch @@ -1,8 +1,9 @@ -From f21606c102368ad7a6e8bcab5a0c65dcddbbf9e5 Mon Sep 17 00:00:00 2001 -From: Lumir Balhar -Date: Thu, 19 Jan 2023 17:35:02 +0100 +From fbe9d1e38da72d8caac365841794b06614523ac9 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= +Date: Tue, 17 Oct 2023 10:44:42 +0200 Subject: [PATCH] system certs +Co-authored-by: Lumir Balhar --- requests/certs.py | 7 ++++++- setup.cfg | 1 - @@ -41,17 +42,17 @@ index bf21c81..906c0f1 100644 idna>=2.5,<4 urllib3>=1.21.1,<1.27 diff --git a/setup.py b/setup.py -index 092b40d..c6c0ad5 100755 +index 0123545..ec3fd1d 100755 --- a/setup.py +++ b/setup.py @@ -62,7 +62,6 @@ requires = [ "charset_normalizer>=2,<4", "idna>=2.5,<4", - "urllib3>=1.21.1,<1.27", + "urllib3>=1.21.1,<3", - "certifi>=2017.4.17", ] test_requirements = [ - "pytest-httpbin==0.0.7", + "pytest-httpbin==2.0.0", -- -2.39.0 +2.41.0 From 2c49b3aa6338854efc267d5e84fe911c77f78959 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Mon, 22 Jan 2024 06:28:29 +0000 Subject: [PATCH 16/43] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- python-requests.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/python-requests.spec b/python-requests.spec index 94f1c59..20d0473 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -6,7 +6,7 @@ Name: python-requests Version: 2.31.0 -Release: 1%{?dist} +Release: 2%{?dist} Summary: HTTP library, written in Python, for human beings License: Apache-2.0 @@ -87,6 +87,9 @@ sed -i 's/ --doctest-modules//' pyproject.toml %changelog +* Mon Jan 22 2024 Fedora Release Engineering - 2.31.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Mon Oct 16 2023 Tomáš Hrnčiar - 2.31.0-1 - Update to 2.31.0 - Fixes: rhbz#2189970 From 37f4fc1429d4911351739290719c94cc7d66ea05 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 26 Jan 2024 10:08:10 +0000 Subject: [PATCH 17/43] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- python-requests.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/python-requests.spec b/python-requests.spec index 20d0473..ef31a1d 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -6,7 +6,7 @@ Name: python-requests Version: 2.31.0 -Release: 2%{?dist} +Release: 3%{?dist} Summary: HTTP library, written in Python, for human beings License: Apache-2.0 @@ -87,6 +87,9 @@ sed -i 's/ --doctest-modules//' pyproject.toml %changelog +* Fri Jan 26 2024 Fedora Release Engineering - 2.31.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Mon Jan 22 2024 Fedora Release Engineering - 2.31.0-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 4d1f850e1f73cdc1fb8523ac4d7598199fcea92b Mon Sep 17 00:00:00 2001 From: Lumir Balhar Date: Thu, 11 Apr 2024 10:28:48 +0200 Subject: [PATCH 18/43] Fix compatibility with pytest 8 --- python-requests.spec | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/python-requests.spec b/python-requests.spec index ef31a1d..631990b 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -6,7 +6,7 @@ Name: python-requests Version: 2.31.0 -Release: 3%{?dist} +Release: 4%{?dist} Summary: HTTP library, written in Python, for human beings License: Apache-2.0 @@ -63,6 +63,10 @@ sed -i '/#!\/usr\/.*python/d' requests/certs.py # change the docs. Thus, we set pytest not to run doctests at all. sed -i 's/ --doctest-modules//' pyproject.toml +# Fix compatibility with pytest 8 +# Upstream report: https://github.com/psf/requests/issues/6679 +sed -i "/pytest.warns/s/None//" tests/test_requests.py + %build %pyproject_wheel @@ -87,6 +91,9 @@ sed -i 's/ --doctest-modules//' pyproject.toml %changelog +* Thu Apr 11 2024 Lumír Balhar - 2.31.0-4 +- Fix compatibility with pytest 8 + * Fri Jan 26 2024 Fedora Release Engineering - 2.31.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 576af2d63fb3cb1d61e07dc3fa195eb383e2f655 Mon Sep 17 00:00:00 2001 From: Lumir Balhar Date: Tue, 14 May 2024 18:42:57 +0200 Subject: [PATCH 19/43] Add support for IPv6 CIDR in no_proxy setting --- python-requests.spec | 12 +- support_IPv6_CIDR_in_no_proxy.patch | 272 ++++++++++++++++++++++++++++ 2 files changed, 283 insertions(+), 1 deletion(-) create mode 100644 support_IPv6_CIDR_in_no_proxy.patch diff --git a/python-requests.spec b/python-requests.spec index 631990b..2fd5d3e 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -6,7 +6,7 @@ Name: python-requests Version: 2.31.0 -Release: 4%{?dist} +Release: 5%{?dist} Summary: HTTP library, written in Python, for human beings License: Apache-2.0 @@ -17,6 +17,13 @@ Source: https://github.com/requests/requests/archive/v%{version}/request # https://bugzilla.redhat.com/show_bug.cgi?id=904614 Patch: system-certs.patch +# Add support for IPv6 CIDR in no_proxy setting +# This functionality is needed in Openshift and it has been +# proposed for upstream in 2021 but the PR unfortunately stalled. +# Upstream PR: https://github.com/psf/requests/pull/5953 +# This change is backported also into RHEL 9.4 (via CS) +Patch: support_IPv6_CIDR_in_no_proxy.patch + BuildArch: noarch BuildRequires: python%{python3_pkgversion}-devel %if %{with tests} @@ -91,6 +98,9 @@ sed -i "/pytest.warns/s/None//" tests/test_requests.py %changelog +* Tue May 14 2024 Lumír Balhar - 2.31.0-5 +- Add support for IPv6 CIDR in no_proxy setting + * Thu Apr 11 2024 Lumír Balhar - 2.31.0-4 - Fix compatibility with pytest 8 diff --git a/support_IPv6_CIDR_in_no_proxy.patch b/support_IPv6_CIDR_in_no_proxy.patch new file mode 100644 index 0000000..f8b7285 --- /dev/null +++ b/support_IPv6_CIDR_in_no_proxy.patch @@ -0,0 +1,272 @@ +From 4f89a66430e4f701b11fdeb9e253af87e29e6f0b Mon Sep 17 00:00:00 2001 +From: Derek Higgins +Date: Fri, 8 Oct 2021 11:12:27 +0100 +Subject: [PATCH] Add ipv6 support to should_bypass_proxies + +Add support to should_bypass_proxies to support +IPv6 ipaddresses and CIDRs in no_proxy. Includes +adding IPv6 support to various other helper functions. +--- + requests/utils.py | 83 ++++++++++++++++++++++++++++++++++++------- + tests/test_utils.py | 66 +++++++++++++++++++++++++++++++--- + 2 files changed, 132 insertions(+), 17 deletions(-) + +diff --git a/src/requests/utils.py b/src/requests/utils.py +index 1ae77d68ff..6a026e2d32 100644 +--- a/requests/utils.py ++++ b/requests/utils.py +@@ -674,18 +674,46 @@ def requote_uri(uri): + return quote(uri, safe=safe_without_percent) + + ++def _get_mask_bits(mask, totalbits=32): ++ """Converts a mask from /xx format to a int ++ to be used as a mask for IP's in int format ++ ++ Example: if mask is 24 function returns 0xFFFFFF00 ++ if mask is 24 and totalbits=128 function ++ returns 0xFFFFFF00000000000000000000000000 ++ ++ :rtype: int ++ """ ++ bits = ((1 << mask) - 1) << (totalbits - mask) ++ return bits ++ ++ + def address_in_network(ip, net): + """This function allows you to check if an IP belongs to a network subnet + + Example: returns True if ip = 192.168.1.1 and net = 192.168.1.0/24 + returns False if ip = 192.168.1.1 and net = 192.168.100.0/24 ++ returns True if ip = 1:2:3:4::1 and net = 1:2:3:4::/64 + + :rtype: bool + """ +- ipaddr = struct.unpack("=L", socket.inet_aton(ip))[0] + netaddr, bits = net.split("/") +- netmask = struct.unpack("=L", socket.inet_aton(dotted_netmask(int(bits))))[0] +- network = struct.unpack("=L", socket.inet_aton(netaddr))[0] & netmask ++ if is_ipv4_address(ip) and is_ipv4_address(netaddr): ++ ipaddr = struct.unpack(">L", socket.inet_aton(ip))[0] ++ netmask = _get_mask_bits(int(bits)) ++ network = struct.unpack(">L", socket.inet_aton(netaddr))[0] ++ elif is_ipv6_address(ip) and is_ipv6_address(netaddr): ++ ipaddr_msb, ipaddr_lsb = struct.unpack( ++ ">QQ", socket.inet_pton(socket.AF_INET6, ip) ++ ) ++ ipaddr = (ipaddr_msb << 64) ^ ipaddr_lsb ++ netmask = _get_mask_bits(int(bits), 128) ++ network_msb, network_lsb = struct.unpack( ++ ">QQ", socket.inet_pton(socket.AF_INET6, netaddr) ++ ) ++ network = (network_msb << 64) ^ network_lsb ++ else: ++ return False + return (ipaddr & netmask) == (network & netmask) + + +@@ -705,12 +733,39 @@ def is_ipv4_address(string_ip): + :rtype: bool + """ + try: +- socket.inet_aton(string_ip) ++ socket.inet_pton(socket.AF_INET, string_ip) ++ except OSError: ++ return False ++ return True ++ ++ ++def is_ipv6_address(string_ip): ++ """ ++ :rtype: bool ++ """ ++ try: ++ socket.inet_pton(socket.AF_INET6, string_ip) + except OSError: + return False + return True + + ++def compare_ips(a, b): ++ """ ++ Compare 2 IP's, uses socket.inet_pton to normalize IPv6 IPs ++ ++ :rtype: bool ++ """ ++ if a == b: ++ return True ++ try: ++ return socket.inet_pton(socket.AF_INET6, a) == socket.inet_pton( ++ socket.AF_INET6, b ++ ) ++ except OSError: ++ return False ++ ++ + def is_valid_cidr(string_network): + """ + Very simple check of the cidr format in no_proxy variable. +@@ -718,17 +773,19 @@ def is_valid_cidr(string_network): + :rtype: bool + """ + if string_network.count("/") == 1: ++ address, mask = string_network.split("/") + try: +- mask = int(string_network.split("/")[1]) ++ mask = int(mask) + except ValueError: + return False + +- if mask < 1 or mask > 32: +- return False +- +- try: +- socket.inet_aton(string_network.split("/")[0]) +- except OSError: ++ if is_ipv4_address(address): ++ if mask < 1 or mask > 32: ++ return False ++ elif is_ipv6_address(address): ++ if mask < 1 or mask > 128: ++ return False ++ else: + return False + else: + return False +@@ -785,12 +842,12 @@ def get_proxy(key): + # the end of the hostname, both with and without the port. + no_proxy = (host for host in no_proxy.replace(" ", "").split(",") if host) + +- if is_ipv4_address(parsed.hostname): ++ if is_ipv4_address(parsed.hostname) or is_ipv6_address(parsed.hostname): + for proxy_ip in no_proxy: + if is_valid_cidr(proxy_ip): + if address_in_network(parsed.hostname, proxy_ip): + return True +- elif parsed.hostname == proxy_ip: ++ elif compare_ips(parsed.hostname, proxy_ip): + # If no_proxy ip was defined in plain IP notation instead of cidr notation & + # matches the IP of the index + return True +diff --git a/tests/test_utils.py b/tests/test_utils.py +index 8988eaf69c..44a3b790d2 100644 +--- a/tests/test_utils.py ++++ b/tests/test_utils.py +@@ -14,9 +14,11 @@ + from requests.cookies import RequestsCookieJar + from requests.structures import CaseInsensitiveDict + from requests.utils import ( ++ _get_mask_bits, + _parse_content_type_header, + add_dict_to_cookiejar, + address_in_network, ++ compare_ips, + dotted_netmask, + extract_zipped_paths, + get_auth_from_url, +@@ -263,8 +265,15 @@ def test_invalid(self, value): + + + class TestIsValidCIDR: +- def test_valid(self): +- assert is_valid_cidr("192.168.1.0/24") ++ @pytest.mark.parametrize( ++ "value", ++ ( ++ "192.168.1.0/24", ++ "1:2:3:4::/64", ++ ), ++ ) ++ def test_valid(self, value): ++ assert is_valid_cidr(value) + + @pytest.mark.parametrize( + "value", +@@ -274,6 +283,11 @@ def test_valid(self): + "192.168.1.0/128", + "192.168.1.0/-1", + "192.168.1.999/24", ++ "1:2:3:4::1", ++ "1:2:3:4::/a", ++ "1:2:3:4::0/321", ++ "1:2:3:4::/-1", ++ "1:2:3:4::12211/64", + ), + ) + def test_invalid(self, value): +@@ -287,6 +301,12 @@ def test_valid(self): + def test_invalid(self): + assert not address_in_network("172.16.0.1", "192.168.1.0/24") + ++ def test_valid_v6(self): ++ assert address_in_network("1:2:3:4::1111", "1:2:3:4::/64") ++ ++ def test_invalid_v6(self): ++ assert not address_in_network("1:2:3:4:1111", "1:2:3:4::/124") ++ + + class TestGuessFilename: + @pytest.mark.parametrize( +@@ -722,6 +742,11 @@ def test_urldefragauth(url, expected): + ("http://172.16.1.12:5000/", False), + ("http://google.com:5000/v1.0/", False), + ("file:///some/path/on/disk", True), ++ ("http://[1:2:3:4:5:6:7:8]:5000/", True), ++ ("http://[1:2:3:4::1]/", True), ++ ("http://[1:2:3:9::1]/", True), ++ ("http://[1:2:3:9:0:0:0:1]/", True), ++ ("http://[1:2:3:9::2]/", False), + ), + ) + def test_should_bypass_proxies(url, expected, monkeypatch): +@@ -730,11 +755,11 @@ def test_should_bypass_proxies(url, expected, monkeypatch): + """ + monkeypatch.setenv( + "no_proxy", +- "192.168.0.0/24,127.0.0.1,localhost.localdomain,172.16.1.1, google.com:6000", ++ "192.168.0.0/24,127.0.0.1,localhost.localdomain,1:2:3:4::/64,1:2:3:9::1,172.16.1.1, google.com:6000", + ) + monkeypatch.setenv( + "NO_PROXY", +- "192.168.0.0/24,127.0.0.1,localhost.localdomain,172.16.1.1, google.com:6000", ++ "192.168.0.0/24,127.0.0.1,localhost.localdomain,1:2:3:4::/64,1:2:3:9::1,172.16.1.1, google.com:6000", + ) + assert should_bypass_proxies(url, no_proxy=None) == expected + +@@ -924,3 +949,36 @@ def test_set_environ_raises_exception(): + raise Exception("Expected exception") + + assert "Expected exception" in str(exception.value) ++ ++ ++@pytest.mark.parametrize( ++ "mask, totalbits, maskbits", ++ ( ++ (24, None, 0xFFFFFF00), ++ (31, None, 0xFFFFFFFE), ++ (0, None, 0x0), ++ (4, 4, 0xF), ++ (24, 128, 0xFFFFFF00000000000000000000000000), ++ ), ++) ++def test__get_mask_bits(mask, totalbits, maskbits): ++ args = {"mask": mask} ++ if totalbits: ++ args["totalbits"] = totalbits ++ assert _get_mask_bits(**args) == maskbits ++ ++ ++@pytest.mark.parametrize( ++ "a, b, expected", ++ ( ++ ("1.2.3.4", "1.2.3.4", True), ++ ("1.2.3.4", "2.2.3.4", False), ++ ("1::4", "1.2.3.4", False), ++ ("1::4", "1::4", True), ++ ("1::4", "1:0:0:0:0:0:0:4", True), ++ ("1::4", "1:0:0:0:0:0::4", True), ++ ("1::4", "1:0:0:0:0:0:1:4", False), ++ ), ++) ++def test_compare_ips(a, b, expected): ++ assert compare_ips(a, b) == expected From a4e6c6d8c000004f225694a59f6b50f2be20e001 Mon Sep 17 00:00:00 2001 From: Lumir Balhar Date: Wed, 29 May 2024 15:23:36 +0200 Subject: [PATCH 20/43] Fix FTBFS --- bf24b7.patch | 22 ++++++++++++++++++++++ python-requests.spec | 4 ++++ 2 files changed, 26 insertions(+) create mode 100644 bf24b7.patch diff --git a/bf24b7.patch b/bf24b7.patch new file mode 100644 index 0000000..7b5e21d --- /dev/null +++ b/bf24b7.patch @@ -0,0 +1,22 @@ +From bf24b7d8d17da34be720c19e5978b2d3bf94a53b Mon Sep 17 00:00:00 2001 +From: franekmagiera +Date: Sun, 12 May 2024 22:08:24 +0200 +Subject: [PATCH] Use an invalid URI that will not cause httpbin to throw 500 + +--- + tests/test_requests.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tests/test_requests.py b/tests/test_requests.py +index d05febeef5..b4e9fe92ae 100644 +--- a/tests/test_requests.py ++++ b/tests/test_requests.py +@@ -2721,7 +2721,7 @@ def test_preparing_bad_url(self, url): + with pytest.raises(requests.exceptions.InvalidURL): + r.prepare() + +- @pytest.mark.parametrize("url, exception", (("http://localhost:-1", InvalidURL),)) ++ @pytest.mark.parametrize("url, exception", (("http://:1", InvalidURL),)) + def test_redirecting_to_bad_url(self, httpbin, url, exception): + with pytest.raises(exception): + requests.get(httpbin("redirect-to"), params={"url": url}) diff --git a/python-requests.spec b/python-requests.spec index 2fd5d3e..1fd1522 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -24,6 +24,9 @@ Patch: system-certs.patch # This change is backported also into RHEL 9.4 (via CS) Patch: support_IPv6_CIDR_in_no_proxy.patch +# Fix FTBFS (test_redirecting_to_bad_url) +Patch: https://github.com/psf/requests/commit/bf24b7.patch + BuildArch: noarch BuildRequires: python%{python3_pkgversion}-devel %if %{with tests} @@ -100,6 +103,7 @@ sed -i "/pytest.warns/s/None//" tests/test_requests.py %changelog * Tue May 14 2024 Lumír Balhar - 2.31.0-5 - Add support for IPv6 CIDR in no_proxy setting +- Fix FTBFS * Thu Apr 11 2024 Lumír Balhar - 2.31.0-4 - Fix compatibility with pytest 8 From 4916dd33717af8e24d107dd59a7c4d4b0ee9dddd Mon Sep 17 00:00:00 2001 From: Python Maint Date: Fri, 7 Jun 2024 12:15:06 +0200 Subject: [PATCH 21/43] Bootstrap for Python 3.13 --- python-requests.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/python-requests.spec b/python-requests.spec index 1fd1522..51a5bb5 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -1,3 +1,4 @@ +%global _without_tests 1 # When bootstrapping Python, we cannot test this yet # RHEL does not include the test dependencies %bcond tests %{undefined rhel} @@ -6,7 +7,7 @@ Name: python-requests Version: 2.31.0 -Release: 5%{?dist} +Release: 6%{?dist} Summary: HTTP library, written in Python, for human beings License: Apache-2.0 @@ -101,6 +102,9 @@ sed -i "/pytest.warns/s/None//" tests/test_requests.py %changelog +* Fri Jun 07 2024 Python Maint - 2.31.0-6 +- Bootstrap for Python 3.13 + * Tue May 14 2024 Lumír Balhar - 2.31.0-5 - Add support for IPv6 CIDR in no_proxy setting - Fix FTBFS From 2e1de3d0e8fe81af34f6728901de0254aae64702 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Sun, 9 Jun 2024 13:00:54 +0200 Subject: [PATCH 22/43] Rebuilt for Python 3.13 --- python-requests.spec | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/python-requests.spec b/python-requests.spec index 51a5bb5..ebc7e28 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -1,4 +1,3 @@ -%global _without_tests 1 # When bootstrapping Python, we cannot test this yet # RHEL does not include the test dependencies %bcond tests %{undefined rhel} @@ -7,7 +6,7 @@ Name: python-requests Version: 2.31.0 -Release: 6%{?dist} +Release: 7%{?dist} Summary: HTTP library, written in Python, for human beings License: Apache-2.0 @@ -102,6 +101,9 @@ sed -i "/pytest.warns/s/None//" tests/test_requests.py %changelog +* Sun Jun 09 2024 Python Maint - 2.31.0-7 +- Rebuilt for Python 3.13 + * Fri Jun 07 2024 Python Maint - 2.31.0-6 - Bootstrap for Python 3.13 From 89e46163b4f409425db78ab1861234214e0fa10e Mon Sep 17 00:00:00 2001 From: Lumir Balhar Date: Wed, 19 Jun 2024 14:12:29 +0200 Subject: [PATCH 23/43] Update to 2.32.3 (rhbz#2281881) and fix CVE-2024-35195 (rhbz#2282205) --- .gitignore | 1 + bf24b7.patch | 22 ----------- python-requests.spec | 20 +++++----- sources | 2 +- support_IPv6_CIDR_in_no_proxy.patch | 45 +++++++++++---------- system-certs.patch | 61 +++++++++++++++-------------- 6 files changed, 67 insertions(+), 84 deletions(-) delete mode 100644 bf24b7.patch diff --git a/.gitignore b/.gitignore index 67de33d..7c27bec 100644 --- a/.gitignore +++ b/.gitignore @@ -52,3 +52,4 @@ /requests-v2.28.1.tar.gz /requests-v2.28.2.tar.gz /requests-v2.31.0.tar.gz +/requests-v2.32.3.tar.gz diff --git a/bf24b7.patch b/bf24b7.patch deleted file mode 100644 index 7b5e21d..0000000 --- a/bf24b7.patch +++ /dev/null @@ -1,22 +0,0 @@ -From bf24b7d8d17da34be720c19e5978b2d3bf94a53b Mon Sep 17 00:00:00 2001 -From: franekmagiera -Date: Sun, 12 May 2024 22:08:24 +0200 -Subject: [PATCH] Use an invalid URI that will not cause httpbin to throw 500 - ---- - tests/test_requests.py | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/tests/test_requests.py b/tests/test_requests.py -index d05febeef5..b4e9fe92ae 100644 ---- a/tests/test_requests.py -+++ b/tests/test_requests.py -@@ -2721,7 +2721,7 @@ def test_preparing_bad_url(self, url): - with pytest.raises(requests.exceptions.InvalidURL): - r.prepare() - -- @pytest.mark.parametrize("url, exception", (("http://localhost:-1", InvalidURL),)) -+ @pytest.mark.parametrize("url, exception", (("http://:1", InvalidURL),)) - def test_redirecting_to_bad_url(self, httpbin, url, exception): - with pytest.raises(exception): - requests.get(httpbin("redirect-to"), params={"url": url}) diff --git a/python-requests.spec b/python-requests.spec index ebc7e28..5006660 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -5,8 +5,8 @@ %bcond extras %{undefined rhel} Name: python-requests -Version: 2.31.0 -Release: 7%{?dist} +Version: 2.32.3 +Release: 1%{?dist} Summary: HTTP library, written in Python, for human beings License: Apache-2.0 @@ -24,9 +24,6 @@ Patch: system-certs.patch # This change is backported also into RHEL 9.4 (via CS) Patch: support_IPv6_CIDR_in_no_proxy.patch -# Fix FTBFS (test_redirecting_to_bad_url) -Patch: https://github.com/psf/requests/commit/bf24b7.patch - BuildArch: noarch BuildRequires: python%{python3_pkgversion}-devel %if %{with tests} @@ -66,17 +63,13 @@ designed to make HTTP requests easy for developers. %autosetup -p1 -n requests-%{version} # env shebang in nonexecutable file -sed -i '/#!\/usr\/.*python/d' requests/certs.py +sed -i '/#!\/usr\/.*python/d' src/requests/certs.py # Some doctests use the internet and fail to pass in Koji. Since doctests don't have names, I don't # know a way to skip them. We also don't want to patch them out, because patching them out will # change the docs. Thus, we set pytest not to run doctests at all. sed -i 's/ --doctest-modules//' pyproject.toml -# Fix compatibility with pytest 8 -# Upstream report: https://github.com/psf/requests/issues/6679 -sed -i "/pytest.warns/s/None//" tests/test_requests.py - %build %pyproject_wheel @@ -90,8 +83,9 @@ sed -i "/pytest.warns/s/None//" tests/test_requests.py %check %pyproject_check_import %if %{with tests} +# test_unicode_header_name - reported: https://github.com/psf/requests/issues/6734 # test_use_proxy_from_environment needs pysocks -%pytest -v tests %{!?with_extras:-k "not test_use_proxy_from_environment"} +%pytest -v tests -k "not test_unicode_header_name %{!?with_extras:and not test_use_proxy_from_environment}" %endif @@ -101,6 +95,10 @@ sed -i "/pytest.warns/s/None//" tests/test_requests.py %changelog +* Wed Jun 19 2024 Lumír Balhar - 2.32.3-1 +- Update to 2.32.3 (rhbz#2281881) +- Fix for CVE-2024-35195 (rhbz#2282205) + * Sun Jun 09 2024 Python Maint - 2.31.0-7 - Rebuilt for Python 3.13 diff --git a/sources b/sources index 3e4fef8..2c91835 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (requests-v2.31.0.tar.gz) = 43f536bdb2360fcceb24ef98e995ffa66cdefc2c502629f17a5722445bfa9ad8489201958c846c2aaef37e427f95a4d56e321a91095c69754680abfd83b39150 +SHA512 (requests-v2.32.3.tar.gz) = ea3e85e035efed0fe22bf8640491ffb20c2ac50359bb1e11c9147ed850cac5e4a6a36ab58a48fc6c6d6a44df2b511e8a5d902444c034da6baa6adc5f9417697f diff --git a/support_IPv6_CIDR_in_no_proxy.patch b/support_IPv6_CIDR_in_no_proxy.patch index f8b7285..93bcff9 100644 --- a/support_IPv6_CIDR_in_no_proxy.patch +++ b/support_IPv6_CIDR_in_no_proxy.patch @@ -1,21 +1,23 @@ -From 4f89a66430e4f701b11fdeb9e253af87e29e6f0b Mon Sep 17 00:00:00 2001 +From 91526670ad66e83e799459cb23b031b88bb680b4 Mon Sep 17 00:00:00 2001 From: Derek Higgins -Date: Fri, 8 Oct 2021 11:12:27 +0100 -Subject: [PATCH] Add ipv6 support to should_bypass_proxies +Date: Thu, 30 May 2024 11:15:18 +0200 +Subject: [PATCH 2/2] Add ipv6 support to should_bypass_proxies Add support to should_bypass_proxies to support IPv6 ipaddresses and CIDRs in no_proxy. Includes adding IPv6 support to various other helper functions. + +Co-authored-by: Lumir Balhar --- - requests/utils.py | 83 ++++++++++++++++++++++++++++++++++++------- + src/requests/utils.py | 83 ++++++++++++++++++++++++++++++++++++------- tests/test_utils.py | 66 +++++++++++++++++++++++++++++++--- 2 files changed, 132 insertions(+), 17 deletions(-) diff --git a/src/requests/utils.py b/src/requests/utils.py -index 1ae77d68ff..6a026e2d32 100644 ---- a/requests/utils.py -+++ b/requests/utils.py -@@ -674,18 +674,46 @@ def requote_uri(uri): +index ae6c42f..0363698 100644 +--- a/src/requests/utils.py ++++ b/src/requests/utils.py +@@ -679,18 +679,46 @@ def requote_uri(uri): return quote(uri, safe=safe_without_percent) @@ -65,7 +67,7 @@ index 1ae77d68ff..6a026e2d32 100644 return (ipaddr & netmask) == (network & netmask) -@@ -705,12 +733,39 @@ def is_ipv4_address(string_ip): +@@ -710,12 +738,39 @@ def is_ipv4_address(string_ip): :rtype: bool """ try: @@ -106,7 +108,7 @@ index 1ae77d68ff..6a026e2d32 100644 def is_valid_cidr(string_network): """ Very simple check of the cidr format in no_proxy variable. -@@ -718,17 +773,19 @@ def is_valid_cidr(string_network): +@@ -723,17 +778,19 @@ def is_valid_cidr(string_network): :rtype: bool """ if string_network.count("/") == 1: @@ -133,7 +135,7 @@ index 1ae77d68ff..6a026e2d32 100644 return False else: return False -@@ -785,12 +842,12 @@ def get_proxy(key): +@@ -790,12 +847,12 @@ def should_bypass_proxies(url, no_proxy): # the end of the hostname, both with and without the port. no_proxy = (host for host in no_proxy.replace(" ", "").split(",") if host) @@ -149,10 +151,10 @@ index 1ae77d68ff..6a026e2d32 100644 # matches the IP of the index return True diff --git a/tests/test_utils.py b/tests/test_utils.py -index 8988eaf69c..44a3b790d2 100644 +index 5e9b56e..befbb46 100644 --- a/tests/test_utils.py +++ b/tests/test_utils.py -@@ -14,9 +14,11 @@ +@@ -14,9 +14,11 @@ from requests._internal_utils import unicode_is_ascii from requests.cookies import RequestsCookieJar from requests.structures import CaseInsensitiveDict from requests.utils import ( @@ -164,7 +166,7 @@ index 8988eaf69c..44a3b790d2 100644 dotted_netmask, extract_zipped_paths, get_auth_from_url, -@@ -263,8 +265,15 @@ def test_invalid(self, value): +@@ -263,8 +265,15 @@ class TestIsIPv4Address: class TestIsValidCIDR: @@ -182,7 +184,7 @@ index 8988eaf69c..44a3b790d2 100644 @pytest.mark.parametrize( "value", -@@ -274,6 +283,11 @@ def test_valid(self): +@@ -274,6 +283,11 @@ class TestIsValidCIDR: "192.168.1.0/128", "192.168.1.0/-1", "192.168.1.999/24", @@ -194,7 +196,7 @@ index 8988eaf69c..44a3b790d2 100644 ), ) def test_invalid(self, value): -@@ -287,6 +301,12 @@ def test_valid(self): +@@ -287,6 +301,12 @@ class TestAddressInNetwork: def test_invalid(self): assert not address_in_network("172.16.0.1", "192.168.1.0/24") @@ -233,10 +235,10 @@ index 8988eaf69c..44a3b790d2 100644 ) assert should_bypass_proxies(url, no_proxy=None) == expected -@@ -924,3 +949,36 @@ def test_set_environ_raises_exception(): - raise Exception("Expected exception") - - assert "Expected exception" in str(exception.value) +@@ -956,3 +981,36 @@ def test_should_bypass_proxies_win_registry_ProxyOverride_value(monkeypatch): + monkeypatch.setattr(winreg, "OpenKey", OpenKey) + monkeypatch.setattr(winreg, "QueryValueEx", QueryValueEx) + assert should_bypass_proxies("http://example.com/", None) is False + + +@pytest.mark.parametrize( @@ -270,3 +272,6 @@ index 8988eaf69c..44a3b790d2 100644 +) +def test_compare_ips(a, b, expected): + assert compare_ips(a, b) == expected +-- +2.45.1 + diff --git a/system-certs.patch b/system-certs.patch index 0e323f8..efc0010 100644 --- a/system-certs.patch +++ b/system-certs.patch @@ -1,36 +1,17 @@ -From fbe9d1e38da72d8caac365841794b06614523ac9 Mon Sep 17 00:00:00 2001 +From bb733473e91e71b812ada46bc110f607630f9327 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= -Date: Tue, 17 Oct 2023 10:44:42 +0200 -Subject: [PATCH] system certs +Date: Thu, 30 May 2024 11:10:29 +0200 +Subject: [PATCH 1/2] system certs Co-authored-by: Lumir Balhar --- - requests/certs.py | 7 ++++++- - setup.cfg | 1 - - setup.py | 1 - - 3 files changed, 6 insertions(+), 3 deletions(-) + setup.cfg | 1 - + setup.py | 1 - + src/requests/certs.py | 8 +++++++- + 3 files changed, 7 insertions(+), 3 deletions(-) -diff --git a/requests/certs.py b/requests/certs.py -index 1f30a45..9224f62 100644 ---- a/requests/certs.py -+++ b/requests/certs.py -@@ -9,8 +9,13 @@ only one — the one from the certifi package. - If you are packaging Requests, e.g., for a Linux distribution or a managed - environment, you can change the definition of where() to return a separately - packaged CA bundle. -+ -+This Fedora-patched package returns "/etc/pki/tls/certs/ca-bundle.crt" provided -+by the ca-certificates RPM package. - """ --from certifi import where -+def where(): -+ """Return the absolute path to the system CA bundle.""" -+ return '/etc/pki/tls/certs/ca-bundle.crt' - - if __name__ == "__main__": - print(where()) diff --git a/setup.cfg b/setup.cfg -index bf21c81..906c0f1 100644 +index 8d44e0e..fa10a53 100644 --- a/setup.cfg +++ b/setup.cfg @@ -4,7 +4,6 @@ provides-extra = @@ -40,9 +21,9 @@ index bf21c81..906c0f1 100644 - certifi>=2017.4.17 charset_normalizer>=2,<4 idna>=2.5,<4 - urllib3>=1.21.1,<1.27 + urllib3>=1.21.1,<3 diff --git a/setup.py b/setup.py -index 0123545..ec3fd1d 100755 +index 1b0eb37..03d19b0 100755 --- a/setup.py +++ b/setup.py @@ -62,7 +62,6 @@ requires = [ @@ -53,6 +34,26 @@ index 0123545..ec3fd1d 100755 ] test_requirements = [ "pytest-httpbin==2.0.0", +diff --git a/src/requests/certs.py b/src/requests/certs.py +index be422c3..9aee713 100644 +--- a/src/requests/certs.py ++++ b/src/requests/certs.py +@@ -10,8 +10,14 @@ only one — the one from the certifi package. + If you are packaging Requests, e.g., for a Linux distribution or a managed + environment, you can change the definition of where() to return a separately + packaged CA bundle. ++ ++This Fedora-patched package returns "/etc/pki/tls/certs/ca-bundle.crt" provided ++by the ca-certificates RPM package. + """ +-from certifi import where ++ ++def where(): ++ """Return the absolute path to the system CA bundle.""" ++ return '/etc/pki/tls/certs/ca-bundle.crt' + + if __name__ == "__main__": + print(where()) -- -2.41.0 +2.45.1 From bb3f7150b77abf41c00094918d898aac6e7040a1 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 19 Jul 2024 15:22:55 +0000 Subject: [PATCH 24/43] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- python-requests.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/python-requests.spec b/python-requests.spec index 5006660..d2e69d7 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -6,7 +6,7 @@ Name: python-requests Version: 2.32.3 -Release: 1%{?dist} +Release: 2%{?dist} Summary: HTTP library, written in Python, for human beings License: Apache-2.0 @@ -95,6 +95,9 @@ sed -i 's/ --doctest-modules//' pyproject.toml %changelog +* Fri Jul 19 2024 Fedora Release Engineering - 2.32.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Wed Jun 19 2024 Lumír Balhar - 2.32.3-1 - Update to 2.32.3 (rhbz#2281881) - Fix for CVE-2024-35195 (rhbz#2282205) From 5c20e1e89b2087acba07195be52a4b6f1c63bc1f Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Thu, 1 Aug 2024 13:08:06 -0700 Subject: [PATCH 25/43] Backport PR #6781 to fix crash on import (#2297632) --- ...ault-SSLContext-if-CA-bundle-isn-t-p.patch | 36 +++++++++++++++++++ python-requests.spec | 10 +++++- 2 files changed, 45 insertions(+), 1 deletion(-) create mode 100644 0001-Don-t-create-default-SSLContext-if-CA-bundle-isn-t-p.patch diff --git a/0001-Don-t-create-default-SSLContext-if-CA-bundle-isn-t-p.patch b/0001-Don-t-create-default-SSLContext-if-CA-bundle-isn-t-p.patch new file mode 100644 index 0000000..14ca3a1 --- /dev/null +++ b/0001-Don-t-create-default-SSLContext-if-CA-bundle-isn-t-p.patch @@ -0,0 +1,36 @@ +From 08e863f94fe93b4b3bd2e8267234be7a23350b1d Mon Sep 17 00:00:00 2001 +From: Adam Williamson +Date: Thu, 1 Aug 2024 12:58:38 -0700 +Subject: [PATCH] Don't create default SSLContext if CA bundle isn't present + +Similar to e18879932287c2bf4bcee4ddf6ccb8a69b6fc656 , this also +skips creation of the default SSLContext on FileNotFoundError, +which is raised if DEFAULT_CA_BUNDLE_PATH does not exist. + +See: https://bugzilla.redhat.com/show_bug.cgi?id=2297632 + +Signed-off-by: Adam Williamson +--- + src/requests/adapters.py | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/src/requests/adapters.py b/src/requests/adapters.py +index 9a58b160..fb151a95 100644 +--- a/src/requests/adapters.py ++++ b/src/requests/adapters.py +@@ -81,9 +81,10 @@ try: + _preloaded_ssl_context.load_verify_locations( + extract_zipped_paths(DEFAULT_CA_BUNDLE_PATH) + ) +-except ImportError: ++except (ImportError, FileNotFoundError): + # Bypass default SSLContext creation when Python +- # interpreter isn't built with the ssl module. ++ # interpreter isn't built with the ssl module, or ++ # DEFAULT_CA_BUNDLE_PATH isn't present + _preloaded_ssl_context = None + + +-- +2.45.2 + diff --git a/python-requests.spec b/python-requests.spec index d2e69d7..ce41620 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -6,7 +6,7 @@ Name: python-requests Version: 2.32.3 -Release: 2%{?dist} +Release: 3%{?dist} Summary: HTTP library, written in Python, for human beings License: Apache-2.0 @@ -24,6 +24,11 @@ Patch: system-certs.patch # This change is backported also into RHEL 9.4 (via CS) Patch: support_IPv6_CIDR_in_no_proxy.patch +# Fix crash on import if /etc/pki/tls/certs/ca-bundle.crt is missing +# https://bugzilla.redhat.com/show_bug.cgi?id=2297632 +# https://github.com/psf/requests/pull/6781 +Patch: 0001-Don-t-create-default-SSLContext-if-CA-bundle-isn-t-p.patch + BuildArch: noarch BuildRequires: python%{python3_pkgversion}-devel %if %{with tests} @@ -95,6 +100,9 @@ sed -i 's/ --doctest-modules//' pyproject.toml %changelog +* Thu Aug 01 2024 Adam Williamson - 2.32.3-3 +- Backport PR #6781 to fix crash on import if CA cert bundle is missing (#2297632) + * Fri Jul 19 2024 Fedora Release Engineering - 2.32.3-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From 15fe6d3df847daf840e28eeade6461b72d4b0d71 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Thu, 1 Aug 2024 13:36:56 -0700 Subject: [PATCH 26/43] Add a note that PR #6781 should be superseded by #6767 --- python-requests.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/python-requests.spec b/python-requests.spec index ce41620..0c455c0 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -27,6 +27,8 @@ Patch: support_IPv6_CIDR_in_no_proxy.patch # Fix crash on import if /etc/pki/tls/certs/ca-bundle.crt is missing # https://bugzilla.redhat.com/show_bug.cgi?id=2297632 # https://github.com/psf/requests/pull/6781 +# Note: this can be replaced by https://github.com/psf/requests/pull/6767 +# when it is ready, or dropped in a release where that is merged Patch: 0001-Don-t-create-default-SSLContext-if-CA-bundle-isn-t-p.patch BuildArch: noarch From 37d17a50d9fb192898601aa899e73d7de39e139e Mon Sep 17 00:00:00 2001 From: Karolina Surma Date: Tue, 6 Aug 2024 13:58:54 +0200 Subject: [PATCH 27/43] CI: Add the tmt plan and metadata --- .fmf/version | 1 + plan.fmf | 5 +++++ 2 files changed, 6 insertions(+) create mode 100644 .fmf/version create mode 100644 plan.fmf diff --git a/.fmf/version b/.fmf/version new file mode 100644 index 0000000..d00491f --- /dev/null +++ b/.fmf/version @@ -0,0 +1 @@ +1 diff --git a/plan.fmf b/plan.fmf new file mode 100644 index 0000000..32fd69f --- /dev/null +++ b/plan.fmf @@ -0,0 +1,5 @@ +execute: + how: tmt +discover: + how: fmf + From 4b98833b9fcd478bbc995c4c72aa35e509786028 Mon Sep 17 00:00:00 2001 From: Adam Kolar Date: Tue, 6 Aug 2024 13:49:33 +0200 Subject: [PATCH 28/43] Import CI smoke test from RHEL This is taken and edited from RHEL distgit tests/python-requests, directory Sanity/smoke. The commit hash this was copied from: 050c2979f27cc70506ddf669f9e0803a7b67c2d5 Only the necessary files were kept. Co-authored-by: Lukas Zachar --- tests/smoke/main.fmf | 6 +++++ tests/smoke/runtest.sh | 54 ++++++++++++++++++++++++++++++++++++++++++ tests/smoke/test.py | 11 +++++++++ 3 files changed, 71 insertions(+) create mode 100644 tests/smoke/main.fmf create mode 100755 tests/smoke/runtest.sh create mode 100644 tests/smoke/test.py diff --git a/tests/smoke/main.fmf b/tests/smoke/main.fmf new file mode 100644 index 0000000..b10b038 --- /dev/null +++ b/tests/smoke/main.fmf @@ -0,0 +1,6 @@ +summary: Basic sanity test for python-requests +test: ./runtest.sh +framework: beakerlib +require: + - python3-requests +duration: 5m diff --git a/tests/smoke/runtest.sh b/tests/smoke/runtest.sh new file mode 100755 index 0000000..3a28ed0 --- /dev/null +++ b/tests/smoke/runtest.sh @@ -0,0 +1,54 @@ +#!/bin/bash +# vim: dict=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/python-requests/Sanity/smoke +# Description: Basic sanity test for python-requests module. +# Author: Adam Kolar +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2013 Red Hat, Inc. All rights reserved. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGES=${PACKAGES:-"python3-requests"} + +PYTHON=${PYTHON:-"python"} +TEST="test.py" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm --all + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "cp $TEST $TmpDir" + rlRun "pushd $TmpDir" + rlPhaseEnd + + rlPhaseStartTest + rlRun "$PYTHON $TEST" 0 "Running sanity test for python requests" + rlPhaseEnd + + rlPhaseStartCleanup + rlRun "popd" + rlRun "rm -r $TmpDir" 0 "Removing tmp directory" + rlPhaseEnd +rlJournalPrintText +rlJournalEnd diff --git a/tests/smoke/test.py b/tests/smoke/test.py new file mode 100644 index 0000000..e296ef0 --- /dev/null +++ b/tests/smoke/test.py @@ -0,0 +1,11 @@ +import requests +from requests import * + +class ExceptionRequests(Exception): + pass + +if __name__=="__main__": + r=requests.get('https://redhat.com') + if r.status_code!=200 or \ + not r.text or r.encoding.lower() != 'utf-8': + raise ExceptionRequests("Sanity error") From 8cc6ff985774cad944e9ad3f93367d4875565377 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luk=C3=A1=C5=A1=20Zachar?= Date: Tue, 6 Aug 2024 13:57:28 +0200 Subject: [PATCH 29/43] Import CI ipv6-noproxy-cidr test from RHEL This is from RHEL distgit tests/python-requests, directory Sanity/ipv6-noproxy-cidr. The commit hash this was copied from: 050c2979f27cc70506ddf669f9e0803a7b67c2d5 Only the necessary files were kept. --- tests/ipv6-noproxy-cidr/main.fmf | 7 +++ tests/ipv6-noproxy-cidr/repro.py | 74 +++++++++++++++++++++++++++++++ tests/ipv6-noproxy-cidr/server.py | 25 +++++++++++ 3 files changed, 106 insertions(+) create mode 100644 tests/ipv6-noproxy-cidr/main.fmf create mode 100644 tests/ipv6-noproxy-cidr/repro.py create mode 100644 tests/ipv6-noproxy-cidr/server.py diff --git a/tests/ipv6-noproxy-cidr/main.fmf b/tests/ipv6-noproxy-cidr/main.fmf new file mode 100644 index 0000000..d1fbe51 --- /dev/null +++ b/tests/ipv6-noproxy-cidr/main.fmf @@ -0,0 +1,7 @@ +require: +- nmap-ncat +- python3 +- python3-requests + +test: "${PYTHON:-python3} repro.py" +tty: "true" diff --git a/tests/ipv6-noproxy-cidr/repro.py b/tests/ipv6-noproxy-cidr/repro.py new file mode 100644 index 0000000..000ca17 --- /dev/null +++ b/tests/ipv6-noproxy-cidr/repro.py @@ -0,0 +1,74 @@ +import subprocess +import requests +import os +import time +import atexit + +subprocesses = [] + +python = os.environ.get("PYTHON","python3") +server_url = os.environ.get("SERVER_URL", None) +testing_no_proxy = os.environ.get("TESTING_NO_PROXY", None) + +# Clean up +@atexit.register +def cleanup(): + print("Cleaning up subprocesses") + for process in subprocesses: + process.terminate() + + time.sleep(1) + + for process in subprocesses: + process.wait() + +# Part one, assert that everything works +if server_url is None: + print("starting server") + p = subprocess.Popen([python, "server.py"], stdout=subprocess.PIPE, stderr=subprocess.PIPE) + subprocesses.append(p) + time.sleep(1) + server_url = "http://[::1]:8888" + no_proxy = "::1/128" +else: + print(f"using provided {server_url} as server") + print(f"using provided {testing_no_proxy} as NO_PROXY value") + assert testing_no_proxy, "TESTING_NO_PROXY envar missing" + +# Send request and check the response + +print("sending first request") +assert requests.get(server_url, timeout=2).text.startswith("Hello") + + +# Part two, dummy proxy causes timeout, that's fine + +# Start proxy +print("starting proxy") +p = subprocess.Popen(["nc", "-k", "-l", "10000"], stdout=subprocess.PIPE, stderr=subprocess.PIPE) +subprocesses.append(p) +time.sleep(1) + +# Set proxy to environment +os.environ["HTTP_PROXY"] = "http://127.0.0.1:10000" + +# Send request, expect timeout because proxy is dummy and do not respond +print("Sending request via proxy") +try: + requests.get(server_url, timeout=2) +except requests.exceptions.ReadTimeout: + print("timeout is fine, expected") + pass + +# Part three, NO_PROXY bypass the proxy and the request should work as before + +os.environ["NO_PROXY"] = testing_no_proxy or no_proxy + +print("sending last request") +try: + assert requests.get(server_url, timeout=2).text.startswith("Hello") +except requests.exceptions.ReadTimeout: + print("PROBLEM - the last request timed out, NO_PROXY setting does not work!") + raise SystemExit(1) +else: + print("OK - NO_PROXY setting works fine - the last request bypassed proxy") diff --git a/tests/ipv6-noproxy-cidr/server.py b/tests/ipv6-noproxy-cidr/server.py new file mode 100644 index 0000000..2d2c603 --- /dev/null +++ b/tests/ipv6-noproxy-cidr/server.py @@ -0,0 +1,25 @@ +from http.server import SimpleHTTPRequestHandler, HTTPServer +import socket +import sys +class IPv6OnlyHandler(SimpleHTTPRequestHandler): + def do_GET(self): + client_address = self.client_address[0] + # Check if the client address is an IPv6 address + if ":" in client_address: + self.send_response(200) + self.send_header('Content-type', 'text/plain') + self.end_headers() + self.wfile.write(b'Hello') + else: + # Raise a RuntimeError if the client address is an IPv4 address + raise SystemExit(f"IPv4 address ({client_address}) detected. Only IPv6 addresses are allowed.") + +class HTTPServerV6(HTTPServer): + address_family = socket.AF_INET6 + +if __name__ == '__main__': + # Use IPv6 address and port 8080 + server_address = ('::', 8888) + httpd = HTTPServerV6(server_address, IPv6OnlyHandler) + print('Server running on port 8888...') + httpd.serve_forever() From c5fddd17930c997e57fc64b8c394608e939cf1c5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Luk=C3=A1=C5=A1=20Zachar?= Date: Tue, 6 Aug 2024 13:54:29 +0200 Subject: [PATCH 30/43] Import CI upstream test from RHEL This is cherry-picked and edited from RHEL distgit tests/python-requests, directory Sanity/upstream. The commit hash this was copied from: 050c2979f27cc70506ddf669f9e0803a7b67c2d5 Only the necessary files were kept. python3-httpbin is installed from Fedora repositories, as installing it from PyPI requires compiling greenlet which doesn't have wheels for Python 3.13 yet. --- tests/upstream/main.fmf | 14 +++++++ tests/upstream/runtest.sh | 80 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 94 insertions(+) create mode 100644 tests/upstream/main.fmf create mode 100755 tests/upstream/runtest.sh diff --git a/tests/upstream/main.fmf b/tests/upstream/main.fmf new file mode 100644 index 0000000..d5d026a --- /dev/null +++ b/tests/upstream/main.fmf @@ -0,0 +1,14 @@ +summary: Runs upstream test suite +require: + - python3-requests + - python3-pip + - python3-pytest + - python3-cryptography + - python3-devel + - python3-httpbin + - rpm-build + - gcc + - gcc-c++ +test: ./runtest.sh +framework: beakerlib +duration: 30m diff --git a/tests/upstream/runtest.sh b/tests/upstream/runtest.sh new file mode 100755 index 0000000..b57824e --- /dev/null +++ b/tests/upstream/runtest.sh @@ -0,0 +1,80 @@ +#!/bin/bash +# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# runtest.sh of /CoreOS/python-requests/Sanity/upstream +# Description: Runs upstream test suite +# Author: Lukas Zachar +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +# +# Copyright (c) 2019 Red Hat, Inc. +# +# This copyrighted material is made available to anyone wishing +# to use, modify, copy, or redistribute it subject to the terms +# and conditions of the GNU General Public License version 2. +# +# This program is distributed in the hope that it will be +# useful, but WITHOUT ANY WARRANTY; without even the implied +# warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR +# PURPOSE. See the GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public +# License along with this program; if not, write to the Free +# Software Foundation, Inc., 51 Franklin Street, Fifth Floor, +# Boston, MA 02110-1301, USA. +# +# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + +# Include Beaker environment +. /usr/share/beakerlib/beakerlib.sh || exit 1 + +PACKAGES="${PACKAGES:-python3-requests}" +PYTHON="${PYTHON:-python}" + +rlJournalStart + rlPhaseStartSetup + rlAssertRpm --all + rlRun "TmpDir=\$(mktemp -d)" 0 "Creating tmp directory" + rlRun "pushd $TmpDir" + + # So we can inject version of srpm + if [[ -z "$FORCE_SRPM" ]]; then + rlRun "rlFetchSrcForInstalled $(rpm --qf '%{name}' -qf $($PYTHON -c 'import requests;print(requests.__file__)'))" + else + rlRun "rlRpmDownload $FORCE_SRPM" + fi + rlRun "rpm -i --define '_topdir $TmpDir' --nodeps *rpm" + rlRun "rpmbuild -bp --define '_topdir $TmpDir' --nodeps $TmpDir/SPECS/*" + + # Remove module from extracted sources so installed one is used + rlRun "rm -rf $TmpDir/BUILD/*requests*/requests*/src" + + # pip-install libraries not in the repos + # pytest is installed in fmf requirement + rlRun "$PYTHON -m pip install pytest-mock==3.12.0 trustme==1.1.0 werkzeug==3.0.3 \ + pytest-httpbin==2.0.0" + + # Move to test dir, print what is there + rlRun "cd $(dirname $TmpDir/BUILD/*requests*/requests*/tests)" + rlRun "touch tests/requirements-dev.txt" + rlRun "find . -type f" + rlRun "yum repolist" + rlRun "$PYTHON -m pip list" + rlPhaseEnd + + rlPhaseStartTest "$EXTRA_PARAMS" + # test_unicode_header_name hangs with urllib3 < 2 + rlRun 'pytest -v -p no:warnings --junit-xml $TmpDir/result.xml -k "not test_use_proxy_from_environment and not test_unicode_header_name"' + + rlAssertGrep ' Date: Sun, 11 Aug 2024 22:02:15 -0400 Subject: [PATCH 31/43] Add extras to ELN builds RHEL 10 only ships the core module with no extras, but the extras are needed for other things in EPEL (e.g. azure-cli). ELN covers both without adding the extras build dependencies so as to not add them to the future RHEL buildroot. These changes allow a single ELN build to serve both ELN and ELN Extras without polluting the ELN buildroot. --- python-requests.spec | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/python-requests.spec b/python-requests.spec index 0c455c0..950ebc7 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -2,7 +2,8 @@ # RHEL does not include the test dependencies %bcond tests %{undefined rhel} # The extras are disabled on RHEL to avoid pysocks and deprecated requests[security] -%bcond extras %{undefined rhel} +%bcond extras %[%{undefined rhel} || %{defined eln}] +%bcond extradeps %{undefined rhel} Name: python-requests Version: 2.32.3 @@ -63,7 +64,7 @@ designed to make HTTP requests easy for developers. %generate_buildrequires -%pyproject_buildrequires %{?with_extras:-x security,socks} +%pyproject_buildrequires %{?with_extradeps:-x security,socks} %prep @@ -92,7 +93,7 @@ sed -i 's/ --doctest-modules//' pyproject.toml %if %{with tests} # test_unicode_header_name - reported: https://github.com/psf/requests/issues/6734 # test_use_proxy_from_environment needs pysocks -%pytest -v tests -k "not test_unicode_header_name %{!?with_extras:and not test_use_proxy_from_environment}" +%pytest -v tests -k "not test_unicode_header_name %{!?with_extradeps:and not test_use_proxy_from_environment}" %endif From 003986f6c0d0517b1629242f362d4d9e9e758cc7 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 18 Jan 2025 18:48:49 +0000 Subject: [PATCH 32/43] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- python-requests.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/python-requests.spec b/python-requests.spec index 950ebc7..5514b4a 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -7,7 +7,7 @@ Name: python-requests Version: 2.32.3 -Release: 3%{?dist} +Release: 4%{?dist} Summary: HTTP library, written in Python, for human beings License: Apache-2.0 @@ -103,6 +103,9 @@ sed -i 's/ --doctest-modules//' pyproject.toml %changelog +* Sat Jan 18 2025 Fedora Release Engineering - 2.32.3-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Thu Aug 01 2024 Adam Williamson - 2.32.3-3 - Backport PR #6781 to fix crash on import if CA cert bundle is missing (#2297632) From 97f1d2362881b1af5206dce981af54e8de79640a Mon Sep 17 00:00:00 2001 From: "Benjamin A. Beasley" Date: Tue, 15 Apr 2025 10:47:10 -0400 Subject: [PATCH 33/43] Backport test-cert. fixes for urllib3 2.4.0 compatibility --- ...09661335bd3dd8a7e39f04d07b42e519becc.patch | 31 + 6924.patch | 55 ++ ...bdef98a6aacfbedcf2ca61ba0eaecc2563f4.patch | 685 ++++++++++++++++++ python-requests.spec | 28 +- 4 files changed, 798 insertions(+), 1 deletion(-) create mode 100644 507409661335bd3dd8a7e39f04d07b42e519becc.patch create mode 100644 6924.patch create mode 100644 9ebebdef98a6aacfbedcf2ca61ba0eaecc2563f4.patch diff --git a/507409661335bd3dd8a7e39f04d07b42e519becc.patch b/507409661335bd3dd8a7e39f04d07b42e519becc.patch new file mode 100644 index 0000000..13b0001 --- /dev/null +++ b/507409661335bd3dd8a7e39f04d07b42e519becc.patch @@ -0,0 +1,31 @@ +From 507409661335bd3dd8a7e39f04d07b42e519becc Mon Sep 17 00:00:00 2001 +From: Colin Watson +Date: Mon, 17 Feb 2025 00:39:07 +0000 +Subject: [PATCH] Add CA constraint to test CA + +Otherwise recent versions of OpenSSL reject it as an invalid CA +certificate (at least once the test certificates are regenerated). + +Fixes: #6896 +--- + tests/certs/expired/ca/ca.cnf | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/tests/certs/expired/ca/ca.cnf b/tests/certs/expired/ca/ca.cnf +index 8c4b823053..1443cb9374 100644 +--- a/tests/certs/expired/ca/ca.cnf ++++ b/tests/certs/expired/ca/ca.cnf +@@ -4,9 +4,13 @@ prompt = no + default_md = sha256 + encrypt_key = no + distinguished_name = dn ++x509_extensions = v3_ca + + [dn] + C = US # country code + O = Python Software Foundation # organization + OU = python-requests # organization unit/department + CN = Self-Signed Root CA # common name / your cert name ++ ++[v3_ca] ++basicConstraints = critical, CA:true diff --git a/6924.patch b/6924.patch new file mode 100644 index 0000000..02bf4e7 --- /dev/null +++ b/6924.patch @@ -0,0 +1,55 @@ +From 2019450b43511289d45c6b3e7376f2813e1c27b4 Mon Sep 17 00:00:00 2001 +From: Richard van den Berg +Date: Sat, 29 Mar 2025 14:53:45 +0100 +Subject: [PATCH] Add key usage extension to test ca.crt + +--- + tests/certs/expired/ca/ca.cnf | 1 + + tests/certs/expired/ca/ca.crt | 20 ++++++++++---------- + 2 files changed, 11 insertions(+), 10 deletions(-) + +diff --git a/tests/certs/expired/ca/ca.cnf b/tests/certs/expired/ca/ca.cnf +index 1443cb9374..09fcb6de1c 100644 +--- a/tests/certs/expired/ca/ca.cnf ++++ b/tests/certs/expired/ca/ca.cnf +@@ -14,3 +14,4 @@ CN = Self-Signed Root CA # common name / your cert name + + [v3_ca] + basicConstraints = critical, CA:true ++keyUsage = critical, cRLSign, digitalSignature, keyCertSign +diff --git a/tests/certs/expired/ca/ca.crt b/tests/certs/expired/ca/ca.crt +index f08b2d67a5..2c8ebd44ae 100644 +--- a/tests/certs/expired/ca/ca.crt ++++ b/tests/certs/expired/ca/ca.crt +@@ -1,8 +1,8 @@ + -----BEGIN CERTIFICATE----- +-MIIDlDCCAnygAwIBAgIUG/CTOPIQbH2BI36TyThUChQyR8wwDQYJKoZIhvcNAQEL ++MIIDpDCCAoygAwIBAgIUQt0yyZmppkHKNx4aXRrmD5tvjbswDQYJKoZIhvcNAQEL + BQAwajELMAkGA1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3Vu + ZGF0aW9uMRgwFgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYt +-U2lnbmVkIFJvb3QgQ0EwHhcNMjUwMjE3MDAzODIyWhcNNDUwMjEyMDAzODIyWjBq ++U2lnbmVkIFJvb3QgQ0EwHhcNMjUwMzI5MTM1MTQ1WhcNNDUwMzI0MTM1MTQ1WjBq + MQswCQYDVQQGEwJVUzEjMCEGA1UECgwaUHl0aG9uIFNvZnR3YXJlIEZvdW5kYXRp + b24xGDAWBgNVBAsMD3B5dGhvbi1yZXF1ZXN0czEcMBoGA1UEAwwTU2VsZi1TaWdu + ZWQgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ9lSHzZ +@@ -11,12 +11,12 @@ dqlagCS2jI9dJz8Y3MnMLBmiiXvET6ub/S9u7VdtRxByoHydBEvNMKEMga64PwMe + ztuZ6fX2xPmRnLQIippzfzdxDFHxbUWzjzEQEl+4EGbKX5vPi6A9yL3ofgMi4APZ + C8/YoqAaqzjLIM9KZ/zqT36iQ6wsxBXAacd63L5M8lrAKfZoJeX6uYxNIIfaxQRz + zVxdpVBjHJ/odqoadwKzU7YzN5Fs+6ATNvkrhlUzg1i0MyTGtCdkUIAt/hc6ZrW6 +-/kqHpCgUwUc4Dq0CAwEAAaMyMDAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU +-CEaIPf7XQsGt0xbf6P9x5cxdKpwwDQYJKoZIhvcNAQELBQADggEBAHMgyQNA3DQG +-0l9eX8RMl4YNwhAXChU/wOTcvD+F4OsJcPqzy6QHFh1AbBBGOI9/HN7du+EiKwGZ +-wE+69FEsSbhSv22XidPm+kHPTguWl1eKveeWrrT5MPl9F48s14lKb/8yMEa1/ryG +-Iu8NQ6ZL91JbTXdkLoBDya9HZqyXjwcGkXLE8fSqTibJ7EhWS5Q3Ic7WPgUoGAum +-b5ygoxqhm+SEyXC2/LAktwmFawkv1SsMeYpT790VIFqJ/TVVnUl+gQ2RjSEl2WLb +-UO4Hwq4FZbWF9NrY6JVThLmbcr8eW6+UxWfiXHLw/qTRre4/3367QAUQRt7EuEsb +-KOWpOS3fbsI= ++/kqHpCgUwUc4Dq0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8E ++BAMCAYYwHQYDVR0OBBYEFAhGiD3+10LBrdMW3+j/ceXMXSqcMA0GCSqGSIb3DQEB ++CwUAA4IBAQBRT21cyZ0Jx0JLA2ilYTLvpMsSryGyWrCOXlmRlBt1MAhmxdTRgCmu ++UB3UU2pfnrC16UeMVVS411lhzjowFXkXrjAqSUBRcetUIYHlpnGgDdUl4dV/X5kx ++HxD9VUBx/QwGeyzFhjzjeN89M2v9kPnhU/kkVfcsafwYiHdC6pwN6zeZNz7JP+GS ++rmI+KVpm5C+Nz6ekm3TR8rFgPIsiDTbY3qj/DNYX2+NhpU1DZfm687vhOr3Ekljx ++NHNu9++STEjGpirrI8EqQnK+FP2fRJ5D82YZM0d++8tmHKpY0+FRCr8//459sgun ++CojmhIobDa2NuF81Jx6Cc7lagCPG3/Ts + -----END CERTIFICATE----- diff --git a/9ebebdef98a6aacfbedcf2ca61ba0eaecc2563f4.patch b/9ebebdef98a6aacfbedcf2ca61ba0eaecc2563f4.patch new file mode 100644 index 0000000..003973f --- /dev/null +++ b/9ebebdef98a6aacfbedcf2ca61ba0eaecc2563f4.patch @@ -0,0 +1,685 @@ +From 9ebebdef98a6aacfbedcf2ca61ba0eaecc2563f4 Mon Sep 17 00:00:00 2001 +From: Colin Watson +Date: Mon, 17 Feb 2025 00:41:30 +0000 +Subject: [PATCH] Regenerate test certificates + +Created using the following command with OpenSSL 3.4.0: + + for cert in expired mtls valid/server; do + make -C tests/certs/$cert clean all + done +--- + tests/certs/expired/ca/ca-private.key | 52 +++++++++--------- + tests/certs/expired/ca/ca.crt | 38 ++++++------- + tests/certs/expired/ca/ca.srl | 2 +- + tests/certs/expired/server/server.csr | 24 ++++----- + tests/certs/expired/server/server.key | 52 +++++++++--------- + tests/certs/expired/server/server.pem | 77 ++++++++++++++------------- + tests/certs/mtls/client/client.csr | 24 ++++----- + tests/certs/mtls/client/client.key | 52 +++++++++--------- + tests/certs/mtls/client/client.pem | 77 ++++++++++++++------------- + tests/certs/valid/server/server.csr | 24 ++++----- + tests/certs/valid/server/server.key | 52 +++++++++--------- + tests/certs/valid/server/server.pem | 77 +++++++++++++-------------- + 12 files changed, 279 insertions(+), 272 deletions(-) + +diff --git a/tests/certs/expired/ca/ca-private.key b/tests/certs/expired/ca/ca-private.key +index 507b1f5623..8aa400e043 100644 +--- a/tests/certs/expired/ca/ca-private.key ++++ b/tests/certs/expired/ca/ca-private.key +@@ -1,28 +1,28 @@ + -----BEGIN PRIVATE KEY----- +-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDHlIhe7GLCeSk8 +-RZOKdtmyKns6KdZgGw/LcxPkYvQlu1g0zV8X0DqVr2LdMumWUTNCc9sPdSlAG+He +-mQp2TMoWUMumMuwDtit9RT0Sb6Eh9svWgjY9ferovPJRfCWUTsA2Ug8uoh0wyEXK +-na7X6fHt5E3B9vj0+b9a4vDibdBXV11FheLT02/uEmAEJDdP/zeBgvVbhcVyumO6 +-fAGMIWzR2ukhe8z/ma5H9zoi4gZA8nsK6reZUD8+6affnPe+jIt/AdzggtV9jkWm +-zSpr+RHeZ0y+q4eik2ZNUGg4XcF6JsJ9yu/AqLBXxd38uLdFfgyhP2y6K628yzgy +-e6lzFyWnAgMBAAECggEAFwzHhzcD3PQDWCus85PwZoxTeQ817BmUBGpBBOKM0gLG +-GCsT7XsmGP2NjICBy9OK+QTKawmb/wR5XK0OMUWDHXqtWn+NFIyojyo8+HEeCf8n +-4ZleTFHLnJ+d2N1etbc2qc9mY3tjpaurq8/0Tol9YH06ock1TY2+lO+a5HvMURnY +-hcWs70CamL+5B/6n67DhjzMtIW3dIXuEEceM1BW/jW8SKq0JHpQ3t+OJwID7zFaJ +-bLyOwAVheMzVGvN3yphf8tll3tMA65bNjdOzgOfZSjAy7EGjW3DyAolDw9jKLRyu +-E0gw/exNGe618oMIeUDv0KParlL4RjdiUP8l0xYOwQKBgQD3eYj9rWeqZquI9vKP +-gaSv6urb2UJLngShZUpEZRNJgBO+Ewiof0w8tpQdsnuMvWudxMLbzgiUNA+NyC/K +-CpzIXFkWnWx+A/pxs8ZO8moOfajVRayJgeOLsQZb7c4fXGsVGApbN4+cPNhTNG6d +-ucErv6tae/SzAzcLc5Vkw/ELxwKBgQDOdJ5Wl5JeKAvU/3kF6+MYWCrXxZqMjoHS +-y1BtyMX5RbdaWTCfDUu1aV3qJOJjjWQ9DJdJQcEsrTjOpD4bVdZx4w/XEG0JXAa3 +-jRypVHGdeG/TjhUGJA8U+KX3a1DkcdqM9pqFYRw5Ie95Wz9YRroI+YkixqpK8d7W +-C+5BodxXIQKBgCk8Lv9V7XgPM3XW8APJbk+BrTCEuu8unUbnQcCztssAdEmvkjnB +-PErBgVyRaNTCmzPmnTFS20sWgaD2QkBAFG+uM4n5ISK+NvTLJ7fv3IwdlAw1V9Jx +-uiCElrKqpTXEiHMzVkZss5ks6j6y9duCIBXSEhM5pERPvNRDphjsLTXxAoGARSNC +-nyb1Kjjo9XR0V+pNy6pC9q1C+00B5tCVZ55zxe114Hi70pfGQcM+YxnlAoeoCNW9 +-mBfAFDESNAlGjyrovIzYkiH7EcZSrYdBEOepgJ2DfWo4Wi0bK9+03K2AknAaS1iO +-GJqTtAJMSuymwu40gKroJNA42Q40nKO0LyCARGECgYEAiFRHkblBtStv22SpZxNC +-jim9yuM0ikh7Ij1lEHysc/GWb2RQNxQVk54BU2kQ0d9xwMZQTKvpF3VE9t7uGdwt +-AasWPr/tWYt35Ud0D4bNlagJJ4Xdslf8n1nkq3qqqDQbd7kkQRgwGzVr0uVg7ZfS +-26qSPQ0/aF9nagb5eHX3AuU= ++MIIEuwIBADANBgkqhkiG9w0BAQEFAASCBKUwggShAgEAAoIBAQCfZUh82dF/r9GW ++89IN2vqOiMMuikIAO3SEI3+uSGCdWT13C+NnrFJ7XF/D6UGy1mvm8KfhSnapWoAk ++toyPXSc/GNzJzCwZool7xE+rm/0vbu1XbUcQcqB8nQRLzTChDIGuuD8DHs7bmen1 ++9sT5kZy0CIqac383cQxR8W1Fs48xEBJfuBBmyl+bz4ugPci96H4DIuAD2QvP2KKg ++Gqs4yyDPSmf86k9+okOsLMQVwGnHety+TPJawCn2aCXl+rmMTSCH2sUEc81cXaVQ ++Yxyf6HaqGncCs1O2MzeRbPugEzb5K4ZVM4NYtDMkxrQnZFCALf4XOma1uv5Kh6Qo ++FMFHOA6tAgMBAAECgf9YadXLawbJzLx0/smE5fIVHccmCYqSlmgK46XvBjaREO8H ++GZEJ8IvP4W09PiUzDbzMXLDCRouLZKevtZJB82nRlfjh9l5/2aho/nsytVO6+8yq ++sfK5LNvYQ0Aey7ItosJMJ+bL1ErphHZB+J9Jz3scYaCAC5CFMC+lREVYZEEI9QD4 ++P2D5QbmaSeu8jmL/H3fWHjNXWDprue3W/MIf96NZa3qJew45go4TAYYMe5i757KW ++Ja40VNfmsgbz4uI9oDXaYL/NkWUaQP1lnh+Mfrm1YnBe2wsLcP/WuM5h0bYzJW/1 ++ZeSrZM3fqCMW6SJyrVE1qzqvtw1xQBlrq0B6q0ECgYEA0fi4+ySFGR+mL6k5UjP1 ++roREqQgKaLgdhOvD88EnO93Nl6tJ3Qk8LyzPUNbxe1/xTUEKMtglBKOoxCHJJZlg ++xXnKBAQUtlmrLFKIGe+UCD+r+wfSpS6Sl7BUDmeCSczG9dPN5vnyZA4ixUke2SCC ++k4Eb9Q0AHyNnbXv928r0sfkCgYEAwlZRYmGTVva6cY2YEmMrqbWy4Wxm2Zmdo+Uq ++Xu1RZF9a3tGzNbGsyYdeLNY7vVZoVOm1paMJCA8ScNLFtCux2jEPqwqd1OZ8OLhA ++1VF3/kYtUSdqwLzWoS1RdD6mZCAHeOE+N0pone4lt3A2o8wtpHsaDA+XSTw2rHLR ++LVS+b1UCgYEAtezJ4Ze31pfMdrkpmCa69JVXpBj6Y9c6hGN+aWFuq/k22/WmTuRk ++h/9MNR+3JQ1w1l3HB1ytXkKqxBz92hz1csReG3Kpu4EfxYxQriAdY7Q/P4Z8pXAf ++xVwayEw439aUgIQef8UKllSFHeiH2NrJKCKSZZT5CQG06HCo+Fn1/4kCgYAYuwtY ++TbqGUpefY7l6fYxM6IZ/EWB1SIs7FCq0MdctwsS5nk4EAzxN2SAu7IRlr91PEP7A ++uWKo1+Is4WWva/ASKDQqPAuh0EL2pNv7SYbPoPabYTzAkkdt82puNJrQGxNYWrGk ++L5/omSnLkkghyBX23IOQDVvfQf5jK6la73HckQKBgAI+iLECAkle9HvnJ3flicau ++9FAU1/9pOdM+WogSanhYQ/P2rAwRiyCIkqu62/OoZR5g4kLxWqOOmVvsK3j+gs5F ++FtwN7gauq06MAHnWr6qC8ZltzMsGZTVDvqSH2vgV4T1V6ovVpTBPKQ1gWtABEmpm ++dyfeA6HHeRAHx8VRGpL6 + -----END PRIVATE KEY----- +diff --git a/tests/certs/expired/ca/ca.crt b/tests/certs/expired/ca/ca.crt +index c332b7cb7b..f08b2d67a5 100644 +--- a/tests/certs/expired/ca/ca.crt ++++ b/tests/certs/expired/ca/ca.crt +@@ -1,20 +1,22 @@ + -----BEGIN CERTIFICATE----- +-MIIDWzCCAkMCFA9wdtNh/V99DRwYp8vXjPxSjJnWMA0GCSqGSIb3DQEBCwUAMGox +-CzAJBgNVBAYTAlVTMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlv +-bjEYMBYGA1UECwwPcHl0aG9uLXJlcXVlc3RzMRwwGgYDVQQDDBNTZWxmLVNpZ25l +-ZCBSb290IENBMB4XDTI0MDMxMjIxMDQwM1oXDTQ0MDMwNzIxMDQwM1owajELMAkG +-A1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3VuZGF0aW9uMRgw +-FgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYtU2lnbmVkIFJv +-b3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHlIhe7GLCeSk8 +-RZOKdtmyKns6KdZgGw/LcxPkYvQlu1g0zV8X0DqVr2LdMumWUTNCc9sPdSlAG+He +-mQp2TMoWUMumMuwDtit9RT0Sb6Eh9svWgjY9ferovPJRfCWUTsA2Ug8uoh0wyEXK +-na7X6fHt5E3B9vj0+b9a4vDibdBXV11FheLT02/uEmAEJDdP/zeBgvVbhcVyumO6 +-fAGMIWzR2ukhe8z/ma5H9zoi4gZA8nsK6reZUD8+6affnPe+jIt/AdzggtV9jkWm +-zSpr+RHeZ0y+q4eik2ZNUGg4XcF6JsJ9yu/AqLBXxd38uLdFfgyhP2y6K628yzgy +-e6lzFyWnAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAGymNVTsKSAq8Ju6zV+AWAyV +-GcUNBmLpgzDA0e7pkVYhHTdWKlGH4GnrRcp0nvnSbr6iq1Ob/8yEUUoRzK55Flws +-Kt1OLwnZyhfRoSUesoEqpP68vzWEgiYv0QuIWvzNt0YfAAvEgGoc3iri44MelKLn +-9ZMT8m91nVamA35R8ZjfeAkNp2xcz0a67V0ww6o4wSXrG7o5ZRXyjqZ/9K7SfwUJ +-rV9RciccsjH/MzKbfrx73QwsbPWiFmjzHopdasIO0lDlmgm/r9gKfkbzfKoGCgLZ +-6an6FlmLftLSXijf/QwtqeSP9fODeE3dzBmnTM3jdoVS53ZegUDWNl14o25v2Kg= ++MIIDlDCCAnygAwIBAgIUG/CTOPIQbH2BI36TyThUChQyR8wwDQYJKoZIhvcNAQEL ++BQAwajELMAkGA1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3Vu ++ZGF0aW9uMRgwFgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYt ++U2lnbmVkIFJvb3QgQ0EwHhcNMjUwMjE3MDAzODIyWhcNNDUwMjEyMDAzODIyWjBq ++MQswCQYDVQQGEwJVUzEjMCEGA1UECgwaUHl0aG9uIFNvZnR3YXJlIEZvdW5kYXRp ++b24xGDAWBgNVBAsMD3B5dGhvbi1yZXF1ZXN0czEcMBoGA1UEAwwTU2VsZi1TaWdu ++ZWQgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ9lSHzZ ++0X+v0Zbz0g3a+o6Iwy6KQgA7dIQjf65IYJ1ZPXcL42esUntcX8PpQbLWa+bwp+FK ++dqlagCS2jI9dJz8Y3MnMLBmiiXvET6ub/S9u7VdtRxByoHydBEvNMKEMga64PwMe ++ztuZ6fX2xPmRnLQIippzfzdxDFHxbUWzjzEQEl+4EGbKX5vPi6A9yL3ofgMi4APZ ++C8/YoqAaqzjLIM9KZ/zqT36iQ6wsxBXAacd63L5M8lrAKfZoJeX6uYxNIIfaxQRz ++zVxdpVBjHJ/odqoadwKzU7YzN5Fs+6ATNvkrhlUzg1i0MyTGtCdkUIAt/hc6ZrW6 ++/kqHpCgUwUc4Dq0CAwEAAaMyMDAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU ++CEaIPf7XQsGt0xbf6P9x5cxdKpwwDQYJKoZIhvcNAQELBQADggEBAHMgyQNA3DQG ++0l9eX8RMl4YNwhAXChU/wOTcvD+F4OsJcPqzy6QHFh1AbBBGOI9/HN7du+EiKwGZ ++wE+69FEsSbhSv22XidPm+kHPTguWl1eKveeWrrT5MPl9F48s14lKb/8yMEa1/ryG ++Iu8NQ6ZL91JbTXdkLoBDya9HZqyXjwcGkXLE8fSqTibJ7EhWS5Q3Ic7WPgUoGAum ++b5ygoxqhm+SEyXC2/LAktwmFawkv1SsMeYpT790VIFqJ/TVVnUl+gQ2RjSEl2WLb ++UO4Hwq4FZbWF9NrY6JVThLmbcr8eW6+UxWfiXHLw/qTRre4/3367QAUQRt7EuEsb ++KOWpOS3fbsI= + -----END CERTIFICATE----- +diff --git a/tests/certs/expired/ca/ca.srl b/tests/certs/expired/ca/ca.srl +index fab68405ed..0d6f69d6fe 100644 +--- a/tests/certs/expired/ca/ca.srl ++++ b/tests/certs/expired/ca/ca.srl +@@ -1 +1 @@ +-4F36C3A7E075BA6452D10EEB81E7F189FF489B74 ++4F36C3A7E075BA6452D10EEB81E7F189FF489B83 +diff --git a/tests/certs/expired/server/server.csr b/tests/certs/expired/server/server.csr +index 5e3c177647..d8ba3a5bf2 100644 +--- a/tests/certs/expired/server/server.csr ++++ b/tests/certs/expired/server/server.csr +@@ -2,18 +2,18 @@ + MIIDHjCCAgYCAQAwbTELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkRFMSMwIQYDVQQK + DBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlvbjEYMBYGA1UECwwPcHl0aG9uLXJl + cXVlc3RzMRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IB +-DwAwggEKAoIBAQCKulIMpo633iCgbkKv1UoiLC4sQt5xWpgguujywu3hLYwmPFp9 +-kvPt//imqtl8FhuhKqJ8FCGrVl2YIGj1RJIB3GW7MSPNCuIBFL/gwNi35LxDPtoA +-IPyXytIR7VH9+ch9DFInJaoA/BekMuKvbXk54VW9whpHbwkXSG2lBS2vKL0XemYh +-9VjvtuRDji2iOZpznlVE2PEN80bojArp6oYKakv2kYzgzgxAJiI/NZGvC7mbSI4e +-ja7ad3R9G0kB1FzNj36jrNO5WtxHO/mrRiXSpDeyUbitYvt0HKoM0vhTnOR+BspP +-IltfwOQh8qq2Q2AaMHNcVjMH3gHCZADfhk/zAgMBAAGgbDBqBgkqhkiG9w0BCQ4x ++DwAwggEKAoIBAQDcRRwk8IU1YoNu8CHzB5Vh8HP/yLfBtU69LLZq+7rDG31JlR5s ++lmcwLLoZ8opUQ5rg8JMRZ7toh5zB4Uc0B4Sg8RhQMSOZYBIJkXdHuqQkciR0vWnN ++vD/5CkWEhnj4dxE7xTbDufBlxmwAthC/u72UIsZHavAyLCBqsONa7xuTiogz/d+3 ++G+525JrfVr05hhJpT4Ypx5YY+ABkIOuOk/XuudbGm5SquuX6BgjmgaGtDjAuE/Rn ++BnliIavCDrG0v3KGbG3Xxt7lFTu+98foForwGCbbQBraty27oZrzAtLltfIHlJRn ++jPz0JA9akNDhAihxEsTUhk2d7jFszsd0Ev7DAgMBAAGgbDBqBgkqhkiG9w0BCQ4x + XTBbMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMB + MCwGA1UdEQQlMCOCCWxvY2FsaG9zdIcEfwAAAYcQAAAAAAAAAAAAAAAAAAAAATAN +-BgkqhkiG9w0BAQsFAAOCAQEAfAhEhrulsZae71YFqgvzwJHm/hzXh47hErtgDXVJ +-mFqAxgF6XrnzYujlt3XQXUx/8vdrU7jH+Pe8WO1rDvFwRPMDGoBF3RX29SzyX/2F +-e102egnoRR+Hlf0Ixqu0CuTjEVnD+g4mRgXhV7LPKP4W6qGwzcVbaJ3c/zRcfqNR +-g9gN6Q6Qt4fXDc7wlx2T3nOszBLQ2XCsIyzVtOJ2sSuadqKH9Aj+mrkrLBdzVFHD +-FHnTMJ0t0+anZwd+AWDNsCr5lIwBGL634zw7/yJepMHuPFd2X24S3u8EaWPkfVQn +-lV6rLQMGjXYTe2xuYzlUCUYnKvkyPTMjSXDkxWa+WSNwyQ== ++BgkqhkiG9w0BAQsFAAOCAQEAVVIxJlDrgeG0bOSufgVVRqDQx7XSd15mGlT+CynM ++lEFJ3Q9k98T2vRNNGVYYYZAnbdSOW9ACwWGcYm2bzIjbgZV0H2Kz0dLD/GrNuEY+ ++O9j6K2toFKc57G7UUkve+N74ldq+hkR4zbb6FQmTlnL2YaPp2dv5TxdMKfHEfPNf ++Bg8xpbXdoRc7CYW1ZACme+d2U063GVqQsrIfwGJ+BtE6aNo62T/oEm+G4Wy5iBay ++jNv/imwf+JKQ75bTvha9YLUg2scqdYwJj8JlBw7cvkBIHW8GydA3fX4dtV9YBbFi ++8RTlWhhLgCXpYbLoDGOqF6f/MuPSIGkV1wVhCUfYA+p+Gw== + -----END CERTIFICATE REQUEST----- +diff --git a/tests/certs/expired/server/server.key b/tests/certs/expired/server/server.key +index 27ddafd1ca..c48457b39a 100644 +--- a/tests/certs/expired/server/server.key ++++ b/tests/certs/expired/server/server.key +@@ -1,28 +1,28 @@ + -----BEGIN PRIVATE KEY----- +-MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCKulIMpo633iCg +-bkKv1UoiLC4sQt5xWpgguujywu3hLYwmPFp9kvPt//imqtl8FhuhKqJ8FCGrVl2Y +-IGj1RJIB3GW7MSPNCuIBFL/gwNi35LxDPtoAIPyXytIR7VH9+ch9DFInJaoA/Bek +-MuKvbXk54VW9whpHbwkXSG2lBS2vKL0XemYh9VjvtuRDji2iOZpznlVE2PEN80bo +-jArp6oYKakv2kYzgzgxAJiI/NZGvC7mbSI4eja7ad3R9G0kB1FzNj36jrNO5WtxH +-O/mrRiXSpDeyUbitYvt0HKoM0vhTnOR+BspPIltfwOQh8qq2Q2AaMHNcVjMH3gHC +-ZADfhk/zAgMBAAECggEAFSF9RvUFzyb0BEvXN44+/QaKv+4tkMmSW4Xs3rFnZ4G3 +-E8nkpLUCF9ICD2z9tKNvcPScDFdKq5z7o6ToJ9faf5MRIdrBz8UlGLIO6g6l1Bjw +-vjNwJE3h+8MGjXl/IDbwXW/HgbQAeabsePPRSJRdvz2+ACn1M8VLdrLvFJA93ayW +-+n3Bk0bXdsrzqBGdoDiNzmIHI3WqdONiR9TymuJe41NJtMKxQDF+c6Y1n/X1OtBk +-s9L+u9Xr+R3H72xSYrf1KH1mFZJfTnIPoOmdEU2tVZnZj03rZhT7p8R1fVNX6OHu +-NX1Dy9VA6J7dbcqdPvTI743ByQeb+hNnqI/3hmV5eQKBgQC++1Wn3v/dxtczjA+I +-tN4a7zyjhazpB25lde55HVfCQPxmYxIYct+j6S0JkMaoLrjiEDb4pnu4Gt4MDqZa +-r0Xm8t3wD1YKUUbhpBEGvsMhAEZEIsBOcwkTiEwsoF0mKFa2mTyqAImgIQa8uFt8 +-Y/oTj55XFe1x6pZKEJRg+K+QSwKBgQC59ONVkMSBirLGS+G+b2kqiBdwZB/3s3wr +-feS1xTa+deL3AChnKT9+MsVqOkxdE2TRj/mAeF+5Woa5bPMvgr9Kl7u8bulTH80l +-YA/N6FneO11/ncnkgK9wN54kd5TiOtGsGB5S5t/nEAIMUIwWrM/cRau72xNEWOhT +-Tvw7TOSF+QKBgQCa/texeiYmE24sA4vH4yIuseKAw8hlBwbtiRyVZt8GZD9zyQuy +-k+g02tUWYk0XyXN65LX4bwURkZyMJIeWKZGNsaW1YnzturDQB5tZ4g/zBIoCWkHA +-aVQAaimIPk3a3foiD5NQVUdckfEp0GVPOsSGg5R6EO23+i8mxPXnDW1OqQKBgGvf +-lelTO8tyLFdAOcqBUt6rZ/1499p3snaAZ6bSqvk95dYnr0h48y5AQaln/FiaIYg4 +-HyLZsZ4S18jFXSWYkWOyNeQP6yafciBWY5StT0TN52VaoX3+8McGXKUHAcVjHbLZ +-ou2wpP6jmKyQJVQaF9LOT9uAMOMbOFrrnQLBjmfxAoGAQAnUhMFG5mwi9Otxt6Mz +-g+Gr+3JTlzwC3L7UwGdlFc3G2vSdGx/yOrfzpxPImfIBS95mibDfdvEBMer26pvw +-a/ycqybyX9d/5nPDIaJ1lc4M4cbHC/cB52JI6avr/1g8OMK7lR7b/FsPVHS1w8kl +-n6uwEjVt2+gP2o9DFTGs158= ++MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDcRRwk8IU1YoNu ++8CHzB5Vh8HP/yLfBtU69LLZq+7rDG31JlR5slmcwLLoZ8opUQ5rg8JMRZ7toh5zB ++4Uc0B4Sg8RhQMSOZYBIJkXdHuqQkciR0vWnNvD/5CkWEhnj4dxE7xTbDufBlxmwA ++thC/u72UIsZHavAyLCBqsONa7xuTiogz/d+3G+525JrfVr05hhJpT4Ypx5YY+ABk ++IOuOk/XuudbGm5SquuX6BgjmgaGtDjAuE/RnBnliIavCDrG0v3KGbG3Xxt7lFTu+ ++98foForwGCbbQBraty27oZrzAtLltfIHlJRnjPz0JA9akNDhAihxEsTUhk2d7jFs ++zsd0Ev7DAgMBAAECggEAUZjCX8a/ufJ3+OE42lQdWO4fsonS1I3LENYe70u4OC2X ++QGpenmAq8pQnDpSj/KocliZYfLKeII9YGRRQcaw1S/9z/8TsSJVnqSa7dpVj1+J2 ++sc43AxEw65sL/Jdp+bT169vXOTNIpBMYkDzhwH0WMemd5Pfu6c8h5RQI7Pc1knYn ++nPNY848qSYCWOUjZS3QmBik/gp9X//yxVCyvxB3xVnb1cpvc952D90Va6nFIWfgN ++ix4NgFgAvwIxCFpWI2z7JF8uBdAHPeFAx8pFukQpAzwhaEILlgt3WbvEob9CsdP5 ++E39SUkzxiIfVM1du+hRquk9SJ/X56OSLnEjxLarSIQKBgQDyVU00yrv7lG7TJLZ5 ++YyfE20A7eUtYdcfatTKfsxKO4KVV+p0mGsNnFhhKziuT5/xtVunbUNFEOaUfmTUP ++dCjy4XkDbE/ufxzIm1WTSqknUluVoJRWKmLI5gbDFxu/XGRQNLxQbMK54l3N69PT ++EO4kz/jqBYbd4aEmtaSx2R8JowKBgQDosUTgBGDxDE2ODPVoXc+YjReOmVHvGMKK ++tA+KDBEs4spxaqhH0OFh6mewx3jA4VHbcIgM50STXrq1VL/QqYclDlY9/VWzkmqp ++2Ekc4NoAl3H022pgcbmXx3qapC4Z3hokNFOlbtD9xQf9NMx6c5djTKMYTBrBBWXH ++oFhSz6PIYQKBgQCMGqkydmvMffq89CLTd3JMq/4s5GmdUSsk1VHZZuy50kOEvAoT ++N7H1bZ7J0Pz83Eji5jb6Z3U1nqZK6Ib20k/CbH1Mb1ifKLp5eOU27Rly9Hiiv15D ++munWALe0Hy4Zqs8MWBDv5pGGasuU/F1RUB5/BgaBNoTMz2AeQzJe6Iq7RQKBgCca ++Ku3OLpAzNhEp4k9wfEMxaoT/BMK+EWsHiRj0oCo/zi8y8iZnVoiCwHv3eTZIZt4O ++Uf6BGof9QjjYjgc9hcVXXGy8Vpt/fkceXmLo8hlpWbAA8yZT1hFIZzT3Y/va09/D ++n07MiXgrlQUay0XEiOsZ5Mpfd5t6EblzG4SG+gnhAoGAZ+shbacxhji7cUUYJLrO ++9uZJCDCZiyq8yZ+lMzX1kILQwaP6VmSvF4TzKrkrCuD2HzUYcqebko/TvckeTp/a ++oYC2put3zt0CHBf/keeeJwjhff19qVyE9mpZwoo7PuS5zmM7pQOLxzCyAM9MdsCz ++kmnbborcfh74fkfRcwXm6G8= + -----END PRIVATE KEY----- +diff --git a/tests/certs/expired/server/server.pem b/tests/certs/expired/server/server.pem +index 05a2a4dac8..8304c04e49 100644 +--- a/tests/certs/expired/server/server.pem ++++ b/tests/certs/expired/server/server.pem +@@ -1,41 +1,44 @@ + -----BEGIN CERTIFICATE----- +-MIIDXjCCAkYCFE82w6fgdbpkUtEO64Hn8Yn/SJt0MA0GCSqGSIb3DQEBCwUAMGox +-CzAJBgNVBAYTAlVTMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlv +-bjEYMBYGA1UECwwPcHl0aG9uLXJlcXVlc3RzMRwwGgYDVQQDDBNTZWxmLVNpZ25l +-ZCBSb290IENBMB4XDTI0MDMxMzIxMTQ0NVoXDTI0MDMxMzIxMTQ0NVowbTELMAkG +-A1UEBhMCVVMxCzAJBgNVBAgMAkRFMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUg +-Rm91bmRhdGlvbjEYMBYGA1UECwwPcHl0aG9uLXJlcXVlc3RzMRIwEAYDVQQDDAls +-b2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCKulIMpo63 +-3iCgbkKv1UoiLC4sQt5xWpgguujywu3hLYwmPFp9kvPt//imqtl8FhuhKqJ8FCGr +-Vl2YIGj1RJIB3GW7MSPNCuIBFL/gwNi35LxDPtoAIPyXytIR7VH9+ch9DFInJaoA +-/BekMuKvbXk54VW9whpHbwkXSG2lBS2vKL0XemYh9VjvtuRDji2iOZpznlVE2PEN +-80bojArp6oYKakv2kYzgzgxAJiI/NZGvC7mbSI4eja7ad3R9G0kB1FzNj36jrNO5 +-WtxHO/mrRiXSpDeyUbitYvt0HKoM0vhTnOR+BspPIltfwOQh8qq2Q2AaMHNcVjMH +-3gHCZADfhk/zAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAGeQdB4+iDbJ78eKhCMV +-49Cm8nyYi9215rRRJ24Bw6BtVw1ECwymxLVOEB0gHCu8kKdsFnniFBtChts/ilFg +-blIyPKTsb3+kQW9YV9QwVdFdC4mTIljujCSQ4HNUC/Vjfnz85SDKf9/3PMKRr36+ +-GtSLIozudPvkNmCv68jy3RRXyCwWHc43BLMSZKPD/W+DEuXShI9OIpIlSLBx16Hz +-4ce3/1pGuITWcsw6UcRqW31oPR31QmNs5fsq5ZCojDNFzEFCA1t9LiR6UOftFUKy +-yOZWfZeAGGdK75U+XDqS9Xkr5/ic5jE0I5rT7e7r3lpvQdgIj8lSx493fczLOGHr +-YA0= ++MIIDpzCCAo+gAwIBAgIUTzbDp+B1umRS0Q7rgefxif9Im4EwDQYJKoZIhvcNAQEL ++BQAwajELMAkGA1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3Vu ++ZGF0aW9uMRgwFgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYt ++U2lnbmVkIFJvb3QgQ0EwHhcNMjUwMjE3MDAzODIyWhcNMjUwMjE3MDAzODIyWjBt ++MQswCQYDVQQGEwJVUzELMAkGA1UECAwCREUxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0 ++d2FyZSBGb3VuZGF0aW9uMRgwFgYDVQQLDA9weXRob24tcmVxdWVzdHMxEjAQBgNV ++BAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANxF ++HCTwhTVig27wIfMHlWHwc//It8G1Tr0stmr7usMbfUmVHmyWZzAsuhnyilRDmuDw ++kxFnu2iHnMHhRzQHhKDxGFAxI5lgEgmRd0e6pCRyJHS9ac28P/kKRYSGePh3ETvF ++NsO58GXGbAC2EL+7vZQixkdq8DIsIGqw41rvG5OKiDP937cb7nbkmt9WvTmGEmlP ++hinHlhj4AGQg646T9e651sablKq65foGCOaBoa0OMC4T9GcGeWIhq8IOsbS/coZs ++bdfG3uUVO773x+gWivAYJttAGtq3LbuhmvMC0uW18geUlGeM/PQkD1qQ0OECKHES ++xNSGTZ3uMWzOx3QS/sMCAwEAAaNCMEAwHQYDVR0OBBYEFFK1WmMqRSzUD2isk8TL ++M3JfsVczMB8GA1UdIwQYMBaAFAhGiD3+10LBrdMW3+j/ceXMXSqcMA0GCSqGSIb3 ++DQEBCwUAA4IBAQCekjxplL/AI32WtODgw7FpTXNXdyNy8PWEhn3ufL0MqiyseYOZ ++bIa0PAecsArlKs5hXJzB7p/hu5CZdvaCButw1jyWQBySCpeJXn3FmGdTkBvhwBHv ++y6npmBoy/nbLkIRNRcoLbALlfn/0iGWfmDTRblT7vRNWJmZCZCTA/+ILXJ36ItbF ++3JCs3ARF6XWORuZs5Y8cNloOy2brAC/4EHnTfOZBQf8cL8CfHlcNa+nbG1j+wVNO ++60e/0v9zTxa2wNzdnLBCW4rqJFJ44aGClxat5tWuypv0snA/0xrqIYWTQGXZPVT6 ++rET47dfVbj1QxmW3sAyuy5PskZA9T7pOhcjR + -----END CERTIFICATE----- + -----BEGIN CERTIFICATE----- +-MIIDWzCCAkMCFA9wdtNh/V99DRwYp8vXjPxSjJnWMA0GCSqGSIb3DQEBCwUAMGox +-CzAJBgNVBAYTAlVTMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlv +-bjEYMBYGA1UECwwPcHl0aG9uLXJlcXVlc3RzMRwwGgYDVQQDDBNTZWxmLVNpZ25l +-ZCBSb290IENBMB4XDTI0MDMxMjIxMDQwM1oXDTQ0MDMwNzIxMDQwM1owajELMAkG +-A1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3VuZGF0aW9uMRgw +-FgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYtU2lnbmVkIFJv +-b3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHlIhe7GLCeSk8 +-RZOKdtmyKns6KdZgGw/LcxPkYvQlu1g0zV8X0DqVr2LdMumWUTNCc9sPdSlAG+He +-mQp2TMoWUMumMuwDtit9RT0Sb6Eh9svWgjY9ferovPJRfCWUTsA2Ug8uoh0wyEXK +-na7X6fHt5E3B9vj0+b9a4vDibdBXV11FheLT02/uEmAEJDdP/zeBgvVbhcVyumO6 +-fAGMIWzR2ukhe8z/ma5H9zoi4gZA8nsK6reZUD8+6affnPe+jIt/AdzggtV9jkWm +-zSpr+RHeZ0y+q4eik2ZNUGg4XcF6JsJ9yu/AqLBXxd38uLdFfgyhP2y6K628yzgy +-e6lzFyWnAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAGymNVTsKSAq8Ju6zV+AWAyV +-GcUNBmLpgzDA0e7pkVYhHTdWKlGH4GnrRcp0nvnSbr6iq1Ob/8yEUUoRzK55Flws +-Kt1OLwnZyhfRoSUesoEqpP68vzWEgiYv0QuIWvzNt0YfAAvEgGoc3iri44MelKLn +-9ZMT8m91nVamA35R8ZjfeAkNp2xcz0a67V0ww6o4wSXrG7o5ZRXyjqZ/9K7SfwUJ +-rV9RciccsjH/MzKbfrx73QwsbPWiFmjzHopdasIO0lDlmgm/r9gKfkbzfKoGCgLZ +-6an6FlmLftLSXijf/QwtqeSP9fODeE3dzBmnTM3jdoVS53ZegUDWNl14o25v2Kg= ++MIIDlDCCAnygAwIBAgIUG/CTOPIQbH2BI36TyThUChQyR8wwDQYJKoZIhvcNAQEL ++BQAwajELMAkGA1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3Vu ++ZGF0aW9uMRgwFgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYt ++U2lnbmVkIFJvb3QgQ0EwHhcNMjUwMjE3MDAzODIyWhcNNDUwMjEyMDAzODIyWjBq ++MQswCQYDVQQGEwJVUzEjMCEGA1UECgwaUHl0aG9uIFNvZnR3YXJlIEZvdW5kYXRp ++b24xGDAWBgNVBAsMD3B5dGhvbi1yZXF1ZXN0czEcMBoGA1UEAwwTU2VsZi1TaWdu ++ZWQgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ9lSHzZ ++0X+v0Zbz0g3a+o6Iwy6KQgA7dIQjf65IYJ1ZPXcL42esUntcX8PpQbLWa+bwp+FK ++dqlagCS2jI9dJz8Y3MnMLBmiiXvET6ub/S9u7VdtRxByoHydBEvNMKEMga64PwMe ++ztuZ6fX2xPmRnLQIippzfzdxDFHxbUWzjzEQEl+4EGbKX5vPi6A9yL3ofgMi4APZ ++C8/YoqAaqzjLIM9KZ/zqT36iQ6wsxBXAacd63L5M8lrAKfZoJeX6uYxNIIfaxQRz ++zVxdpVBjHJ/odqoadwKzU7YzN5Fs+6ATNvkrhlUzg1i0MyTGtCdkUIAt/hc6ZrW6 ++/kqHpCgUwUc4Dq0CAwEAAaMyMDAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU ++CEaIPf7XQsGt0xbf6P9x5cxdKpwwDQYJKoZIhvcNAQELBQADggEBAHMgyQNA3DQG ++0l9eX8RMl4YNwhAXChU/wOTcvD+F4OsJcPqzy6QHFh1AbBBGOI9/HN7du+EiKwGZ ++wE+69FEsSbhSv22XidPm+kHPTguWl1eKveeWrrT5MPl9F48s14lKb/8yMEa1/ryG ++Iu8NQ6ZL91JbTXdkLoBDya9HZqyXjwcGkXLE8fSqTibJ7EhWS5Q3Ic7WPgUoGAum ++b5ygoxqhm+SEyXC2/LAktwmFawkv1SsMeYpT790VIFqJ/TVVnUl+gQ2RjSEl2WLb ++UO4Hwq4FZbWF9NrY6JVThLmbcr8eW6+UxWfiXHLw/qTRre4/3367QAUQRt7EuEsb ++KOWpOS3fbsI= + -----END CERTIFICATE----- +diff --git a/tests/certs/mtls/client/client.csr b/tests/certs/mtls/client/client.csr +index 9a5713d5c7..35c8c2f325 100644 +--- a/tests/certs/mtls/client/client.csr ++++ b/tests/certs/mtls/client/client.csr +@@ -2,12 +2,12 @@ + MIIEGjCCAwICAQAwbDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkRFMSMwIQYDVQQK + DBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlvbjEYMBYGA1UECwwPcHl0aG9uLXJl + cXVlc3RzMREwDwYDVQQDDAhyZXF1ZXN0czCCASIwDQYJKoZIhvcNAQEBBQADggEP +-ADCCAQoCggEBAMn3iQycTjUzpKJChRNkcm33UB282cUwpxeqKN4ahHxBpS09HRhk +-cQYO7yErEUQwzQnBQEcIpzzeIMZIqHuCkgnySjeEJd95AIzNzGyoLLkS51TcJwgR +-v83AvT8ljA88s9h38qGTy4/TCxJgf76pfHIuC1qoKVQh3AuHj9nOxIZLUsrdDbWF +-WoLqKSVyTby+RXvSAppAR+cuBCaWStQ6xFORn48RHfc6t30ggD4rDAjyU6Vz6oR8 +-ot3XmGdK0h42UdqidUWkRJajEbpkCnQSXS21IvfXKxF5sFqAXJrj9iVbUfpNPpaa +-W8IrHByngyV8amazGZrASstUVRFtWrnrcWECAwEAAaCCAWcwggFjBgkqhkiG9w0B ++ADCCAQoCggEBAJrdvu5kvCy5g6w67gczETk/u6K0UBmf6Mv0lqXCp3Voyt5fv6SI ++/OPWrFV1+m4imNe5bLM7JUoUfkqkmULsjTTh7sxVLjW226vLSYOWWy7PA+OSwUTN ++LjydF1dazlPedHPYdmhVShCmyoOd1pUCDQn0/4cEA/WW4mtzZImmoCf/pyAM3XAC ++9RBcSSJRywOTe6n9LY6Ko0YUW94ay2M4ClVblDxswDemaAsLFuciKmi53gKx4H/l ++areo8p60dgubooiMbcc4E9bzp0oJpfh7xhwKeJtCNEpOik1AiiQIZtwqmkkIHvtI ++Go3SZ7WAQU9Eh2r+u3E6aSl+N0PMXK4Y4JsCAwEAAaCCAWcwggFjBgkqhkiG9w0B + CQ4xggFUMIIBUDAJBgNVHRMEAjAAMAsGA1UdDwQEAwIFoDATBgNVHSUEDDAKBggr + BgEFBQcDAjCCAR8GA1UdEQSCARYwggESggsqLmxvY2FsaG9zdIcEfwAAAYcQAAAA + AAAAAAAAAAAAAAAAAYZNc3BpZmZlOi8vdHJ1c3QucHl0aG9uLm9yZy92MC9tYWlu +@@ -15,10 +15,10 @@ dGFpbmVyL3NpZ21hdmlydXMyNC9wcm9qZWN0L3JlcXVlc3RzL29yZy9wc2aGTXNw + aWZmZTovL3RydXN0LnB5dGhvbi5vcmcvdjEvbWFpbnRhaW5lcjpzaWdtYXZpcnVz + MjQvcHJvamVjdDpyZXF1ZXN0cy9vcmc6cHNmhk1zcGlmZmU6Ly90cnVzdC5weXRo + b24ub3JnL3YxL21haW50YWluZXI9c2lnbWF2aXJ1czI0L3Byb2plY3Q9cmVxdWVz +-dHMvb3JnPXBzZjANBgkqhkiG9w0BAQsFAAOCAQEAwP1KJ+Evddn2RV1FM6BFkoDK +-MPDO9qwb8ea3j57SIJXZlpw168DljmuGzxJw9oys2O6FYcspbHIocAkfFwiYgVAr +-NEog6xlCdPxNBJgC3YFIKwnmBjMPG6ZCWiJn940qTbaJ/j6ZviN17uW4K7Sl+THp +-IkMv29uQTWkfg+GbZ9q1hm2m2GHhYLGLAUdJdtv7JI+yq5uxdsWaCANpH6kc8SnK +-2rik6D3iItDhHCmToHBpdEnP8J+KDzf5pJrv/g3WH8XVrl4ZzBsOhmciWF4C3Hbf +-9eu8eAsp1AsIrZOEGTfClBd7vFCES5DmI0/iRs4czQooqZPnHjOw3Azp/LujrA== ++dHMvb3JnPXBzZjANBgkqhkiG9w0BAQsFAAOCAQEAMOwYPyq+OpMRQUAgoRjfxTQO ++DiqfBzCsjUsPAacLTtebbWBx8y6TkLSb+/Qn3amq3ESo4iBqKpmVwdlAS4P486GD ++9f78W3zkZ29jGcnQ+XHb7WvPvzBRoXImE276F9JGqJ+9q39Cbxzh0U2+ofBx2iGY ++sSutzU0B/l/FKZRc8thuFoeKqHwVePLGD9p2+2nYI9I08QoGqEokTcFAq0tZ858F ++9PdxBZYOKOMpnLZhiJ8qZo23v3ycBXPOjg5ILtQ9EzHoNEA5Mxx/mfNLKJ0NktZD ++KXANLWKbXm+w9gTcBLtCPWNeqj5DIGPsHSfq/Bmjbp/o+uOJs6oq3s5rA7WrAA== + -----END CERTIFICATE REQUEST----- +diff --git a/tests/certs/mtls/client/client.key b/tests/certs/mtls/client/client.key +index 8107125399..b6cea90813 100644 +--- a/tests/certs/mtls/client/client.key ++++ b/tests/certs/mtls/client/client.key +@@ -1,28 +1,28 @@ + -----BEGIN PRIVATE KEY----- +-MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDJ94kMnE41M6Si +-QoUTZHJt91AdvNnFMKcXqijeGoR8QaUtPR0YZHEGDu8hKxFEMM0JwUBHCKc83iDG +-SKh7gpIJ8ko3hCXfeQCMzcxsqCy5EudU3CcIEb/NwL0/JYwPPLPYd/Khk8uP0wsS +-YH++qXxyLgtaqClUIdwLh4/ZzsSGS1LK3Q21hVqC6iklck28vkV70gKaQEfnLgQm +-lkrUOsRTkZ+PER33Ord9IIA+KwwI8lOlc+qEfKLd15hnStIeNlHaonVFpESWoxG6 +-ZAp0El0ttSL31ysRebBagFya4/YlW1H6TT6WmlvCKxwcp4MlfGpmsxmawErLVFUR +-bVq563FhAgMBAAECggEABhWX97JJxN6JFNOjhgGzqiPA3R8lrFlv3zhNbODS9u9U +-q404xYBZIKaYhkucLzgNJUBrevhZbsL+V8WJQIH0JlU57nw5ATIjAHA+uqiXraen +-zRhTcLHK28b1AeRUA4LU+YN7jWnnawN075kf9WgjtfOJ0gcDimOkE7uCFjyyvPJA +-LG9bG+8enGjvUleKXNgmwP4Sq/GlEdGz9Qy+8ga3mtfAULUWe8haFNZXK8CN3xPp +-wmVqy7QzgH2TGN1p6Dyxib9ksSN/lOg0dShL8zgu+QXDNx2VwmVrI8Vr02vmB//0 +-bYxCo5pfICPIFLjLl5yo30dvrUfYqF29PperStHGlQKBgQD/TdemlLjJNP0fvSs7 +-KEVJj/22YuHK+wurNr2ZFbSdcF3v9sfiwysllmEyGr5cNYA56uUbfG+8VSw7kDll +-G+6BKK2UdlPH++6RahqWLqo4k6rsNrkq7elj8xG4gIjR5qzu2uLpjNwp2BGmIoUI +-eb1NcLfTlMcNCooV8RHjm1Z5WwKBgQDKhHkUPDcJm2/9Ltq2NZQMrCS7o4LV2uAI +-GhGpISfY+SfHkQQNZ9Fvbe6hrFeZs31nAvlTDpPEg/LGSVKA5I2EZT9gwzAQU1TD +-Cyol4xqqWFWlwze7w+RLYqX5LtXf7NJg2m5p+ZOoOzzqvTVpodDxqTlCNp2/6ICP +-vAIvWhbA8wKBgAYlr62ZIyHlHrsm6OWRwKlWyDseAmXKyasjtEj9Vs37qKdgf8ub +-+2v6RPjZ3/+EYkQCveV9h4s3WctNW7Rtib6eZh+PAdFs5X+m2GEJWpvmIlVxs9+u +-vtHjRmf04FZ9gWh26MPK2no/c51Wc3GSzNYSgrqbeHd963k/xrh+QwTFAoGAZZjb +-3UjwG4O9RPjyhCKQ6WKa8v9urbamWaoqXfziLrmgOUAJFmiU6x/tbXI2aEdhjAIz +-7nULsLS5YLx8BWmjjV3106dYP3hut4KsXGF4iSjTnts25J27tA4DUeUrKrF2QVyT +-s9qfNvCw+Np/J0Uku3e33/3iWdpcVL9vIS5C5/0CgYBEuxb3dffNRqEiNkpOUrCD +-mQTqbO3X+hin9zT3GrxQE+7KpfCfdDIqdK6c5UWHirR3HUjUPZmIFLSx8msfLl3k +-hgQw37NMV+asg0Wy3P908qbtnEA2P6aDOMQeHJoC7qEHIDOcOQ1KP3FMvOrdscwS +-f0IIDygTH6fYr329s0iXjg== ++MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCa3b7uZLwsuYOs ++Ou4HMxE5P7uitFAZn+jL9Jalwqd1aMreX7+kiPzj1qxVdfpuIpjXuWyzOyVKFH5K ++pJlC7I004e7MVS41ttury0mDllsuzwPjksFEzS48nRdXWs5T3nRz2HZoVUoQpsqD ++ndaVAg0J9P+HBAP1luJrc2SJpqAn/6cgDN1wAvUQXEkiUcsDk3up/S2OiqNGFFve ++GstjOApVW5Q8bMA3pmgLCxbnIipoud4CseB/5Wq3qPKetHYLm6KIjG3HOBPW86dK ++CaX4e8YcCnibQjRKTopNQIokCGbcKppJCB77SBqN0me1gEFPRIdq/rtxOmkpfjdD ++zFyuGOCbAgMBAAECggEABHa5xyNOLTfXrMIyFDELoQvOO71YxbRPQHm3UeXPb9nq ++Zwh5fKOaLnMEmp4A7uW+ZBFrKatdwsnebgZaiIxK8ahFesxFvbScllIQt2NBE5NR +++GBFg9cqKwMYJiNu6Qnzb1dg6lbzAJHeKncFNVxOxeey6dBa0NxdgF1eG32bBiwT ++yIr6JO7cK5JfcExls5yxdZMZiW08quaeFMQR6Wocod2caDgJUBVbZwivEoNI3ak4 ++/kzQaxvRoDMM8uN3LrVH2YUJgURUxSbpOLu8ycZtfg8JRArprUYI0P0OD6iDlly1 ++3FhJXqBEY0dWQPmZKP/Elt3ywC1oncW+AqPh9cchiQKBgQDMriOKoBrTmplw0kbo ++EEuxTU1A23BqcZfn2+PoUww6UxOvStL/s7iupjl3g4CXw0RgIfyOuJQldLdq7mh6 ++W7BpK855fH2CLy1VMdIFY1umHSgJ5Bayd5NmyKdfORUw88PTFFSARYyr5DDqufWg ++jI77BMjqHtbyujQKspV+9U66ZwKBgQDBsi5YptfaqMdzh343G5zAtCiGCd3m9NZO ++atEEvgq9LKqEVwvJ/FD+3QPAS1MN+ms9KcfJ3G05VUhhEsPGRKibgcE0FNA/VBDO ++jS2HK6kZ1M0clC5kHmQfLZxp1q3tA5nW6zqjVFdqYzJsis7G5YxFKhnzui0lgP6V ++I1Io+3QvrQKBgQCK6D+sq92o8AnkfICsq6qDCKA+PO68/pyGOUAiAoKQ7qK0W0Z5 ++TMIwnRTxHCjgViAIUehx/6hjByQXiPcU2zcNGTLGVgtjl5rfb7FGANlJEg6DL+2L ++bwV1QwX75OSR1U136hsy9oByg6oDEvM040+B4gxsf0OHdYEuJWa5w8eLTwKBgCJt ++CM+416SFWu2tp0EkJzgYzRsFpermmTBWy8+L91yoE6Zx0iaUMdEadxA2Uwyo9WZp ++hpjaFI+cGMEoFKOokE8TQMOA74JR7qrHbNAZcnSk3c+2hohE3oasFKC7By6Y9T69 ++kC53TxIZj1y7TwUKx2ODmBk5fcysoJLhNDkUeBIBAoGAQ/YMeMN/pSvTDCPhubbk ++9bF0SwoN6DWrzw7gzMMhHlVSPM4fjdBA+wXbhnYF7hiNan7uShtRHVhwyfj+glBz ++KIkDxETjxTWx5mbo3tNf8xEMsbHZBe8KPlKxizdAOvShLvkpthTCPiyqn6XTvbs4 ++vC0zZrsQWCYT4Wbm7gcOOAU= + -----END PRIVATE KEY----- +diff --git a/tests/certs/mtls/client/client.pem b/tests/certs/mtls/client/client.pem +index 0a11d4d472..0e3091d0e4 100644 +--- a/tests/certs/mtls/client/client.pem ++++ b/tests/certs/mtls/client/client.pem +@@ -1,41 +1,44 @@ + -----BEGIN CERTIFICATE----- +-MIIDXTCCAkUCFE82w6fgdbpkUtEO64Hn8Yn/SJtzMA0GCSqGSIb3DQEBCwUAMGox +-CzAJBgNVBAYTAlVTMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlv +-bjEYMBYGA1UECwwPcHl0aG9uLXJlcXVlc3RzMRwwGgYDVQQDDBNTZWxmLVNpZ25l +-ZCBSb290IENBMB4XDTI0MDMxMzE4MzUwNFoXDTI2MDMxMzE4MzUwNFowbDELMAkG +-A1UEBhMCVVMxCzAJBgNVBAgMAkRFMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUg +-Rm91bmRhdGlvbjEYMBYGA1UECwwPcHl0aG9uLXJlcXVlc3RzMREwDwYDVQQDDAhy +-ZXF1ZXN0czCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMn3iQycTjUz +-pKJChRNkcm33UB282cUwpxeqKN4ahHxBpS09HRhkcQYO7yErEUQwzQnBQEcIpzze +-IMZIqHuCkgnySjeEJd95AIzNzGyoLLkS51TcJwgRv83AvT8ljA88s9h38qGTy4/T +-CxJgf76pfHIuC1qoKVQh3AuHj9nOxIZLUsrdDbWFWoLqKSVyTby+RXvSAppAR+cu +-BCaWStQ6xFORn48RHfc6t30ggD4rDAjyU6Vz6oR8ot3XmGdK0h42UdqidUWkRJaj +-EbpkCnQSXS21IvfXKxF5sFqAXJrj9iVbUfpNPpaaW8IrHByngyV8amazGZrASstU +-VRFtWrnrcWECAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAHHgMckLDRV72p1FEVmCh +-AAPZjCswiPZFrwGPN57JqSWjoRB9ilKvo87aPosEO7vfa05OD/qkM/T9Qykuhati +-I1T1T7qX4Ymb5kTJIBouuflAO3uKVaq+ga2Q/HLlU5w/VoMU4RuK7+RaiRUEE3xL +-iPSMBvZpoMj695LnzcGrT5oLkFI0bTIlpQt1SFjDpHFtOj/ZdwgSbZYLoTCBXQK3 +-7Y29qAj/XwEiCH63n8tJKvZcD8/ssMIMIdWhNmu+0jOWica/3WSih9Geoy6Ydtxi +-I5t9vRjC4LIipMUAF86AJIfvHJyI6aCNT420LaR6NRW0FQn5CPTHPAsKg3JkAywn +-Ew== ++MIIDpjCCAo6gAwIBAgIUTzbDp+B1umRS0Q7rgefxif9Im4IwDQYJKoZIhvcNAQEL ++BQAwajELMAkGA1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3Vu ++ZGF0aW9uMRgwFgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYt ++U2lnbmVkIFJvb3QgQ0EwHhcNMjUwMjE3MDAzODIzWhcNMjcwMjE3MDAzODIzWjBs ++MQswCQYDVQQGEwJVUzELMAkGA1UECAwCREUxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0 ++d2FyZSBGb3VuZGF0aW9uMRgwFgYDVQQLDA9weXRob24tcmVxdWVzdHMxETAPBgNV ++BAMMCHJlcXVlc3RzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmt2+ ++7mS8LLmDrDruBzMROT+7orRQGZ/oy/SWpcKndWjK3l+/pIj849asVXX6biKY17ls ++szslShR+SqSZQuyNNOHuzFUuNbbbq8tJg5ZbLs8D45LBRM0uPJ0XV1rOU950c9h2 ++aFVKEKbKg53WlQINCfT/hwQD9Zbia3NkiaagJ/+nIAzdcAL1EFxJIlHLA5N7qf0t ++joqjRhRb3hrLYzgKVVuUPGzAN6ZoCwsW5yIqaLneArHgf+Vqt6jynrR2C5uiiIxt ++xzgT1vOnSgml+HvGHAp4m0I0Sk6KTUCKJAhm3CqaSQge+0gajdJntYBBT0SHav67 ++cTppKX43Q8xcrhjgmwIDAQABo0IwQDAdBgNVHQ4EFgQU3Ujw+VSuTzPgHqU+KFwO ++T4t2MHswHwYDVR0jBBgwFoAUCEaIPf7XQsGt0xbf6P9x5cxdKpwwDQYJKoZIhvcN ++AQELBQADggEBAEvrKXWHRRDIf26j2fH9hanx0nh+lxvI4jSWYmK0rJXZA3htEvWn ++gcoUspmhmLlgmRMP88lGINMjTsogUubu2j6WF/WuKxAWWvl/hUgK8NzOwOHvByPB ++lhO/rSNGdOWGlnaW1TVO4kI8w6c6LwzOCpY8WvOZLW+v7duLhKUdhaJMR9X77Tbt ++ohHkyYm0gV79izaFRpA6mdYoyHOR4gyWAKaj942doU794fT4gqQacRNifl/kUbWI ++lilktTLyLnmBJgrxHVBxcGe8kwnPafA1k3Gb1w7mY5BSoGKglKjutTfqR3uTjAQb ++vskS4SGXmsEIjLrXYWFNHyoC3pCBXWhX6Kc= + -----END CERTIFICATE----- + -----BEGIN CERTIFICATE----- +-MIIDWzCCAkMCFA9wdtNh/V99DRwYp8vXjPxSjJnWMA0GCSqGSIb3DQEBCwUAMGox +-CzAJBgNVBAYTAlVTMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlv +-bjEYMBYGA1UECwwPcHl0aG9uLXJlcXVlc3RzMRwwGgYDVQQDDBNTZWxmLVNpZ25l +-ZCBSb290IENBMB4XDTI0MDMxMjIxMDQwM1oXDTQ0MDMwNzIxMDQwM1owajELMAkG +-A1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3VuZGF0aW9uMRgw +-FgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYtU2lnbmVkIFJv +-b3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHlIhe7GLCeSk8 +-RZOKdtmyKns6KdZgGw/LcxPkYvQlu1g0zV8X0DqVr2LdMumWUTNCc9sPdSlAG+He +-mQp2TMoWUMumMuwDtit9RT0Sb6Eh9svWgjY9ferovPJRfCWUTsA2Ug8uoh0wyEXK +-na7X6fHt5E3B9vj0+b9a4vDibdBXV11FheLT02/uEmAEJDdP/zeBgvVbhcVyumO6 +-fAGMIWzR2ukhe8z/ma5H9zoi4gZA8nsK6reZUD8+6affnPe+jIt/AdzggtV9jkWm +-zSpr+RHeZ0y+q4eik2ZNUGg4XcF6JsJ9yu/AqLBXxd38uLdFfgyhP2y6K628yzgy +-e6lzFyWnAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAGymNVTsKSAq8Ju6zV+AWAyV +-GcUNBmLpgzDA0e7pkVYhHTdWKlGH4GnrRcp0nvnSbr6iq1Ob/8yEUUoRzK55Flws +-Kt1OLwnZyhfRoSUesoEqpP68vzWEgiYv0QuIWvzNt0YfAAvEgGoc3iri44MelKLn +-9ZMT8m91nVamA35R8ZjfeAkNp2xcz0a67V0ww6o4wSXrG7o5ZRXyjqZ/9K7SfwUJ +-rV9RciccsjH/MzKbfrx73QwsbPWiFmjzHopdasIO0lDlmgm/r9gKfkbzfKoGCgLZ +-6an6FlmLftLSXijf/QwtqeSP9fODeE3dzBmnTM3jdoVS53ZegUDWNl14o25v2Kg= ++MIIDlDCCAnygAwIBAgIUG/CTOPIQbH2BI36TyThUChQyR8wwDQYJKoZIhvcNAQEL ++BQAwajELMAkGA1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3Vu ++ZGF0aW9uMRgwFgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYt ++U2lnbmVkIFJvb3QgQ0EwHhcNMjUwMjE3MDAzODIyWhcNNDUwMjEyMDAzODIyWjBq ++MQswCQYDVQQGEwJVUzEjMCEGA1UECgwaUHl0aG9uIFNvZnR3YXJlIEZvdW5kYXRp ++b24xGDAWBgNVBAsMD3B5dGhvbi1yZXF1ZXN0czEcMBoGA1UEAwwTU2VsZi1TaWdu ++ZWQgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ9lSHzZ ++0X+v0Zbz0g3a+o6Iwy6KQgA7dIQjf65IYJ1ZPXcL42esUntcX8PpQbLWa+bwp+FK ++dqlagCS2jI9dJz8Y3MnMLBmiiXvET6ub/S9u7VdtRxByoHydBEvNMKEMga64PwMe ++ztuZ6fX2xPmRnLQIippzfzdxDFHxbUWzjzEQEl+4EGbKX5vPi6A9yL3ofgMi4APZ ++C8/YoqAaqzjLIM9KZ/zqT36iQ6wsxBXAacd63L5M8lrAKfZoJeX6uYxNIIfaxQRz ++zVxdpVBjHJ/odqoadwKzU7YzN5Fs+6ATNvkrhlUzg1i0MyTGtCdkUIAt/hc6ZrW6 ++/kqHpCgUwUc4Dq0CAwEAAaMyMDAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU ++CEaIPf7XQsGt0xbf6P9x5cxdKpwwDQYJKoZIhvcNAQELBQADggEBAHMgyQNA3DQG ++0l9eX8RMl4YNwhAXChU/wOTcvD+F4OsJcPqzy6QHFh1AbBBGOI9/HN7du+EiKwGZ ++wE+69FEsSbhSv22XidPm+kHPTguWl1eKveeWrrT5MPl9F48s14lKb/8yMEa1/ryG ++Iu8NQ6ZL91JbTXdkLoBDya9HZqyXjwcGkXLE8fSqTibJ7EhWS5Q3Ic7WPgUoGAum ++b5ygoxqhm+SEyXC2/LAktwmFawkv1SsMeYpT790VIFqJ/TVVnUl+gQ2RjSEl2WLb ++UO4Hwq4FZbWF9NrY6JVThLmbcr8eW6+UxWfiXHLw/qTRre4/3367QAUQRt7EuEsb ++KOWpOS3fbsI= + -----END CERTIFICATE----- +diff --git a/tests/certs/valid/server/server.csr b/tests/certs/valid/server/server.csr +index 000d1facb2..60d082e8ef 100644 +--- a/tests/certs/valid/server/server.csr ++++ b/tests/certs/valid/server/server.csr +@@ -2,18 +2,18 @@ + MIIDKjCCAhICAQAwbTELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkRFMSMwIQYDVQQK + DBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlvbjEYMBYGA1UECwwPcHl0aG9uLXJl + cXVlc3RzMRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IB +-DwAwggEKAoIBAQChEKOx377ymuDg23By5Re1DHi2RiBKSHr85/ZTZuwP/69lHN7q +-TQEO//EMEFZ9+ZwezeJJsejjP2HO5lQZbcsWok3hbM0wVT+vApkogPvJ8WNFFWFe +-ZBnGLi/1WM9cSZpUsDJ0XCsG0RTtO27wfgZQlKQMZxTkfi971oPYxNVSjTm2JcLT +-kvwYIwxjJXPDTOgRo9TEAY3cWkCrBJN4w74GWBTM5KDDA230T7WwLuv81XD2LvYj +-YYdMBGcxPr5tYTIlp3LncbcrDRNk3pbYQk0bRJgkw2vUkteiRGjkt+dgVnLc6+MI +-W+VLXEpj+zsOZ5/R4d1pofqj9sDyDPhtNr1JAgMBAAGgeDB2BgkqhkiG9w0BCQ4x ++DwAwggEKAoIBAQDD3OzTz9TgOiJp/STy/au8G1EDVUuP3HWKAX5ZpkWSTYZfc7FF ++pgPQvBq83oh/K1+9Rw0/529N1+KeTp1i9vUBUM2wJ3EzykJP4rMFh+J/Nt6VFfJh ++05pTQiHnc85l4U8Qz7fHS6Lc9EG/Yp6yDxt5OeK8QAkNYjvxVhVdpif3GlnICx1e ++y1EcPxb9rslERyz0eiL6+BtVbhlSvup/rz2skvaYxoh/pP1RVwbu8VtS0it046Fm ++U0TnIdsjrdFjHXNJ2JSs5g6FDB9QEFhYdDOonL4KMcAkXxBLYXpjJ5fj8/X4LFkU ++FINry+Q2zdFKYsghCxlW98hmJVJTscVWznqpAgMBAAGgeDB2BgkqhkiG9w0BCQ4x + aTBnMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgWgMBYGA1UdJQEB/wQMMAoG + CCsGAQUFBwMBMC8GA1UdEQEB/wQlMCOCCWxvY2FsaG9zdIcEfwAAAYcQAAAAAAAA +-AAAAAAAAAAAAATANBgkqhkiG9w0BAQsFAAOCAQEAFTlFTn5Mn8JXtqB5bGjuiChe +-ClA6Y32Co4l7N0CtAlf+bExwLdpLOleTX3WnryIPALl9uBUI/67dy/STn/J1Yn86 +-jWPEFwpmYNSKgQljYWcwtBdYLWfIsJO11kKdaAkOUHBEN5DKrXJ46Vs4918bD1/Q +-6ztqdrThiKc646u9xB58Hg7F0IyMWbHfs0x16ZpcN9otrIkbqOE2wzTmc65O1t1i +-HDljcSk7OnNy3a9wtLEnyPiyMqHf2k/bTlmiDRVe3cSy9xieoqmzHTnOCSASe1y9 +-7lcEBQild18Jo4nACV4vCYOUwrMi/58LWW+lD6OmMnPiWUqOvMbgMffMNDpWPA== ++AAAAAAAAAAAAATANBgkqhkiG9w0BAQsFAAOCAQEAn8TdRWYAGL7L8JKpkX2FRMMY ++EuFOEeJ2UaQLRbVtb1RhkIkMT6UYulQ16K45dbFe4k8DT59/mHrTl0bJ6pqVPawa ++vo7vmKCrSYEz8GrImh1+i6lHaFiqbkAs1mJ6z86dZUofMYwfTPVh64ztamUqwBk7 ++Dey+MzWUQvpTVqoaP7cLgzMy+XfcyGuWSoL6pX5XKkt4+A2wiCTsHul1sXOn4vQz ++4xY96AUVnkKosXMWXvhbMkncLNH+gs+ZeQI0MekakuMa42N+0BAad3Zx60lifG3N ++ugyVUmvVI0Fq6QUlYp3YV6QQj3FDjbgOVsSJNh+2s4SIARJsb/k//Tddzxei7g== + -----END CERTIFICATE REQUEST----- +diff --git a/tests/certs/valid/server/server.key b/tests/certs/valid/server/server.key +index d6afaf59fe..387d5d67f1 100644 +--- a/tests/certs/valid/server/server.key ++++ b/tests/certs/valid/server/server.key +@@ -1,28 +1,28 @@ + -----BEGIN PRIVATE KEY----- +-MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQChEKOx377ymuDg +-23By5Re1DHi2RiBKSHr85/ZTZuwP/69lHN7qTQEO//EMEFZ9+ZwezeJJsejjP2HO +-5lQZbcsWok3hbM0wVT+vApkogPvJ8WNFFWFeZBnGLi/1WM9cSZpUsDJ0XCsG0RTt +-O27wfgZQlKQMZxTkfi971oPYxNVSjTm2JcLTkvwYIwxjJXPDTOgRo9TEAY3cWkCr +-BJN4w74GWBTM5KDDA230T7WwLuv81XD2LvYjYYdMBGcxPr5tYTIlp3LncbcrDRNk +-3pbYQk0bRJgkw2vUkteiRGjkt+dgVnLc6+MIW+VLXEpj+zsOZ5/R4d1pofqj9sDy +-DPhtNr1JAgMBAAECggEAIuLzBfXgCvXzlBjL2kMXd7p4EgkN+PEKnKmUr/t40b1Q +-zR6sBQWBX3GeET4fseElSQHQzCQaPNCve4xltm1S4jftFREHP7sTVHHEYWLQxuy/ +-Uwkewj5927CI6ERgg82YfVP91bjaA/u5I+pt7O7rKLyNbPdN7fEMEW+FNuhpiVvg +-JMrcK1BCFL6pmIT21LyTwkacMKZSPko58pWE24MA9aSCHk6cXdwQWQK0AfQT3XGT +-C4I0hRed7LgqMH+gMuhpakiO13t8yTwxt2iQC9+aa4oSHD3BOi/CwIWfe1mHwmlr +-cj4Kof1JSnK4SVTD16T++PlnWZkF6oaLUNg+/c2C9QKBgQDOFSYIY7+HzinT2hbI +-yTIJCHpp+Iee+WVvvxjdZIPMDINrlIiHcMfXb0itUdcUO6tz0KYDMDLRC9CSP0ar +-6mBWUTHfAKF2S4JpI9JYI4PNtIpOP1NiYuyJlnh5+ytU1yIeIvl39hmLcRwI9mgz +-njy/D7yEoDCrG1dhcltubKpNXQKBgQDIFAVg0A7MNcxBZDLlk1NAME2JKOSszX8E +-VNucvZD+9l+L9V9BmwwPQdzYifv/dNp3nYn+lxRPPgze3ZWu4+PeDuGudxu0I6ll +-beFdbIcp1wbeQguzHYLjBYJqsMb4Pao5HPInjPu/HWfZlg9oZpJbKVucQwbonJLX +-lgca9KaE3QKBgA+OUx+g/+0tZ8ThGoUvgsJhzHPBWeNrKfgEcckMdFJrw2PUg3XN +-0pf1g4PpwJV7Z5bHcjCda8iR3r2bXydM+tapLF2L+6QlUQPEu3UBwUo+zY3Yg9/S +-Xc6I+DEk/4FY9+9UboZaolT/RcF7cCQtVqKJeo58VRAlcTQe4L32H+jVAoGALXX3 +-Ht9HbXkP1w/YTLej4+LVy0OCag0rPiW13LBqALSkUx3GrhZ3sAPMFVuM6ad4eFNQ +-ZouXbsXvkLgSabGYNf11o/mmTtEHjWdhHKQrNgOIqPmixOkAs2quDmXqX79LLTz5 +-fKkZDny0+wiQqa0cth/4k9HbAQGKj/ej16kdKPUCgYAz08Y39NnJYxRNz3tu/7C6 +-jKyXKxhuZCZCt3cSWto5Tg0mVVB+2Jk2GhG1hCfZoRCP25R3FFBR1HOJgOc59T7C +-LL67FdO0+7mj/WNzHj3+9gyOYQyQgPVDaTmsJLbuzT2S+GpR94ZNliwL2NEa5baG +-B/Nb2ruRNj0GgZVw48N4XQ== ++MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDD3OzTz9TgOiJp ++/STy/au8G1EDVUuP3HWKAX5ZpkWSTYZfc7FFpgPQvBq83oh/K1+9Rw0/529N1+Ke ++Tp1i9vUBUM2wJ3EzykJP4rMFh+J/Nt6VFfJh05pTQiHnc85l4U8Qz7fHS6Lc9EG/ ++Yp6yDxt5OeK8QAkNYjvxVhVdpif3GlnICx1ey1EcPxb9rslERyz0eiL6+BtVbhlS ++vup/rz2skvaYxoh/pP1RVwbu8VtS0it046FmU0TnIdsjrdFjHXNJ2JSs5g6FDB9Q ++EFhYdDOonL4KMcAkXxBLYXpjJ5fj8/X4LFkUFINry+Q2zdFKYsghCxlW98hmJVJT ++scVWznqpAgMBAAECggEACY98I+6uJm/QBDpuFkpZmqn+r1n3gUMynZTrFPcvyC9u ++krQ0AAFViFfWOkfmg8abOsMAG5FxdmxGTJHrzsvdM748/A9A0FVcHUgkku2KGcmU ++3dQfa7UHgG7m9sRJW+G+mUR6ZQkFHyHxH6Vxt6FTJvyzW5sIlhWodWRNUK/unXoe ++5QNIh/PM9Mkg91wKVeg8AGdY27zfuUV0KLwhV052hCSwckayi7pjYrH2xDL8fahi ++Z/F43N1SI6Q7PTW6izDs2KrlGyexn97jOV+cooSXXaDvivTaB2K4RoidrPt+UAW4 ++/e1zw/LbeBvQXX4vsyC9vLO+Av1gYo2PxAZ/ezc5gQKBgQDvY/kgUud6stdMs73N ++Qavu9o/Ul4oeQa4fsmfUwj43OjquxpXbfV9sNTLFxFbsl5ADGkpqsR3WhP2090TK ++62vkyCBiaYZjyMY6WLDATEvrpfbc74ATEzTU+r9T1rEByq/atbWPZq/zoMo8aAdg ++Qk2X7gQO3pTpPeEpetYG42Di+QKBgQDRc9IqPeELQugXEuI0RZ8rsfGRSFKVRelQ ++Rz/KpD/S8SsE7ERL0w/w5KgE0IPPbh/SYX2KYxafCqTrPWDNaoguROvUoUJQvf4a ++uOMTCRkqdqj8j70zaPj2ohuIIZ3GZHyaXgl/isWtuZ5OeaoY5h3r+4gk5mO41Llz ++YikB71SRMQKBgGBNG18BetVFNI9Kj0QO8xeCYIHpJErfqShfIJ3aNiUJa6n7gTV2 ++zfg9vlsIjN9IaUqWPPGGprYxcc5m2mm3IwQ57a0pPkLN9dBq9U+mYbQ+Y3ylbCRA ++SbST2nvjlflejDezeYJikM21FSYPw0fZ5FUGDuPcbpMVrYp+O7MxrTwhAoGAcjQq ++xemTiWZj0iDzwfisP1D5HHRIwyepfaI7wCwquMPS5w5EduuQZ5LloipnlHTBWR7b ++Kte4f+N35OREofySYFgoFnoPBKNzp/Jjrf9p/2NP5NYjHaMBDMl7JZDezEwCPNFF ++cIukGYN6M+PWwVjHu+Ica7JLcX5b1/QP1ARBIiECgYAsdDa0CoYTVWMeqMq9GjF3 ++BElBKCLp6iYqpElWyKTj39LCnLhzRICyYQpblM8zZgtQIvRGT8DYh2HA1Q29yPzt ++Rgrz9yfFACdT5gUM5D6sx7L37xbtMQQ7YYOxEAfCUZ0qnMJgpNTJ8/ECkjGJZaif ++CXrx6XCdvrM/evZW2JZbyg== + -----END PRIVATE KEY----- +diff --git a/tests/certs/valid/server/server.pem b/tests/certs/valid/server/server.pem +index 0168cd3e3f..b4ad4c650d 100644 +--- a/tests/certs/valid/server/server.pem ++++ b/tests/certs/valid/server/server.pem +@@ -1,47 +1,46 @@ + -----BEGIN CERTIFICATE----- +-MIIEhTCCA22gAwIBAgIUTzbDp+B1umRS0Q7rgefxif9Im3wwDQYJKoZIhvcNAQEL ++MIIEEDCCAvigAwIBAgIUTzbDp+B1umRS0Q7rgefxif9Im4MwDQYJKoZIhvcNAQEL + BQAwajELMAkGA1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3Vu + ZGF0aW9uMRgwFgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYt +-U2lnbmVkIFJvb3QgQ0EwHhcNMjQwMzE0MDAxMDAzWhcNNDMxMTMwMDAxMDAzWjBt ++U2lnbmVkIFJvb3QgQ0EwHhcNMjUwMjE3MDAzODIzWhcNNDQxMTA0MDAzODIzWjBt + MQswCQYDVQQGEwJVUzELMAkGA1UECAwCREUxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0 + d2FyZSBGb3VuZGF0aW9uMRgwFgYDVQQLDA9weXRob24tcmVxdWVzdHMxEjAQBgNV +-BAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKEQ +-o7HfvvKa4ODbcHLlF7UMeLZGIEpIevzn9lNm7A//r2Uc3upNAQ7/8QwQVn35nB7N +-4kmx6OM/Yc7mVBltyxaiTeFszTBVP68CmSiA+8nxY0UVYV5kGcYuL/VYz1xJmlSw +-MnRcKwbRFO07bvB+BlCUpAxnFOR+L3vWg9jE1VKNObYlwtOS/BgjDGMlc8NM6BGj +-1MQBjdxaQKsEk3jDvgZYFMzkoMMDbfRPtbAu6/zVcPYu9iNhh0wEZzE+vm1hMiWn +-cudxtysNE2TelthCTRtEmCTDa9SS16JEaOS352BWctzr4whb5UtcSmP7Ow5nn9Hh +-3Wmh+qP2wPIM+G02vUkCAwEAAaOCAR4wggEaMAwGA1UdEwEB/wQCMAAwDgYDVR0P +-AQH/BAQDAgWgMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMBMC8GA1UdEQEB/wQlMCOC +-CWxvY2FsaG9zdIcEfwAAAYcQAAAAAAAAAAAAAAAAAAAAATAdBgNVHQ4EFgQUJ90a +-UnXKPP13yDprLhG39fUrnu8wgZEGA1UdIwSBiTCBhqFupGwwajELMAkGA1UEBhMC +-VVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3VuZGF0aW9uMRgwFgYDVQQL +-DA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYtU2lnbmVkIFJvb3QgQ0GC +-FA9wdtNh/V99DRwYp8vXjPxSjJnWMA0GCSqGSIb3DQEBCwUAA4IBAQCVh4hiraRv +-JzYbS/TombP//xfVEWHXDBEYsT5GgWf7GPJ/QtSvv6uJFsK7heqLzf9f+r4Z5xMh +-YAkb0oe/Ge0T30Mo1YaBEqkKuQL9lOMcP69S9uFz2VT6I/76I8qqAu2AFhu74p8f +-qudwmQyRYo1Ryg4R/SgRhSJKF/ST/2wOusNWSsBe1s8S2PmtOb4dr3cMBGihrUzS +-DmCQpWjuiuE23HXnnYDc/EUAnEEPkLDgCsE9iLq37FPUHcHjqdYIAhmImPBpv2EL +-ftXeRWfxN2hRHpS5Fn3QuAOwfJw5tUcVXojJCJfSpL+Ac97iSjxNaDIPlyomauKw +-1rgbUkSw+9JQ ++BAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMPc ++7NPP1OA6Imn9JPL9q7wbUQNVS4/cdYoBflmmRZJNhl9zsUWmA9C8GrzeiH8rX71H ++DT/nb03X4p5OnWL29QFQzbAncTPKQk/iswWH4n823pUV8mHTmlNCIedzzmXhTxDP ++t8dLotz0Qb9inrIPG3k54rxACQ1iO/FWFV2mJ/caWcgLHV7LURw/Fv2uyURHLPR6 ++Ivr4G1VuGVK+6n+vPayS9pjGiH+k/VFXBu7xW1LSK3TjoWZTROch2yOt0WMdc0nY ++lKzmDoUMH1AQWFh0M6icvgoxwCRfEEthemMnl+Pz9fgsWRQUg2vL5DbN0UpiyCEL ++GVb3yGYlUlOxxVbOeqkCAwEAAaOBqjCBpzAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB ++/wQEAwIFoDAWBgNVHSUBAf8EDDAKBggrBgEFBQcDATAvBgNVHREBAf8EJTAjggls ++b2NhbGhvc3SHBH8AAAGHEAAAAAAAAAAAAAAAAAAAAAEwHQYDVR0OBBYEFGg5Q9Ll ++ADkONmo02kmPg9+aiOxQMB8GA1UdIwQYMBaAFAhGiD3+10LBrdMW3+j/ceXMXSqc ++MA0GCSqGSIb3DQEBCwUAA4IBAQA1RlUI34tXrIdsRiALD8iLDFhh816B7qUi+F1j ++3dOkTNgYw0CnQ+Vm4wrQjCEVSDQ/9sry5DOfXeGziDpFlZmQ0UuAeM1EJJD5/42l ++C/eKquA09+IMEq2U03GPhijrC68sFCfr5wgoB/4HmcZ1c3kLYvRaJhEK7AHDgenY ++knKbvuKAiRbCd584eG8HFOW7xv+YqGZ257Ic9flbarkPrazmAJg2P709w7/fP83x ++7lnkPZY09jS3lcIpEdtWvzfm+anGF190hKA1yfPdO5bYPvUcEMxXdMtQ6/pbZd5i ++F6t95o9CPCqI/lLIn5jAf9Z+Iil3GmKefEZYIGmKJ85HGUqE + -----END CERTIFICATE----- + -----BEGIN CERTIFICATE----- +-MIIDWzCCAkMCFA9wdtNh/V99DRwYp8vXjPxSjJnWMA0GCSqGSIb3DQEBCwUAMGox +-CzAJBgNVBAYTAlVTMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlv +-bjEYMBYGA1UECwwPcHl0aG9uLXJlcXVlc3RzMRwwGgYDVQQDDBNTZWxmLVNpZ25l +-ZCBSb290IENBMB4XDTI0MDMxMjIxMDQwM1oXDTQ0MDMwNzIxMDQwM1owajELMAkG +-A1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3VuZGF0aW9uMRgw +-FgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYtU2lnbmVkIFJv +-b3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHlIhe7GLCeSk8 +-RZOKdtmyKns6KdZgGw/LcxPkYvQlu1g0zV8X0DqVr2LdMumWUTNCc9sPdSlAG+He +-mQp2TMoWUMumMuwDtit9RT0Sb6Eh9svWgjY9ferovPJRfCWUTsA2Ug8uoh0wyEXK +-na7X6fHt5E3B9vj0+b9a4vDibdBXV11FheLT02/uEmAEJDdP/zeBgvVbhcVyumO6 +-fAGMIWzR2ukhe8z/ma5H9zoi4gZA8nsK6reZUD8+6affnPe+jIt/AdzggtV9jkWm +-zSpr+RHeZ0y+q4eik2ZNUGg4XcF6JsJ9yu/AqLBXxd38uLdFfgyhP2y6K628yzgy +-e6lzFyWnAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAGymNVTsKSAq8Ju6zV+AWAyV +-GcUNBmLpgzDA0e7pkVYhHTdWKlGH4GnrRcp0nvnSbr6iq1Ob/8yEUUoRzK55Flws +-Kt1OLwnZyhfRoSUesoEqpP68vzWEgiYv0QuIWvzNt0YfAAvEgGoc3iri44MelKLn +-9ZMT8m91nVamA35R8ZjfeAkNp2xcz0a67V0ww6o4wSXrG7o5ZRXyjqZ/9K7SfwUJ +-rV9RciccsjH/MzKbfrx73QwsbPWiFmjzHopdasIO0lDlmgm/r9gKfkbzfKoGCgLZ +-6an6FlmLftLSXijf/QwtqeSP9fODeE3dzBmnTM3jdoVS53ZegUDWNl14o25v2Kg= ++MIIDlDCCAnygAwIBAgIUG/CTOPIQbH2BI36TyThUChQyR8wwDQYJKoZIhvcNAQEL ++BQAwajELMAkGA1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3Vu ++ZGF0aW9uMRgwFgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYt ++U2lnbmVkIFJvb3QgQ0EwHhcNMjUwMjE3MDAzODIyWhcNNDUwMjEyMDAzODIyWjBq ++MQswCQYDVQQGEwJVUzEjMCEGA1UECgwaUHl0aG9uIFNvZnR3YXJlIEZvdW5kYXRp ++b24xGDAWBgNVBAsMD3B5dGhvbi1yZXF1ZXN0czEcMBoGA1UEAwwTU2VsZi1TaWdu ++ZWQgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ9lSHzZ ++0X+v0Zbz0g3a+o6Iwy6KQgA7dIQjf65IYJ1ZPXcL42esUntcX8PpQbLWa+bwp+FK ++dqlagCS2jI9dJz8Y3MnMLBmiiXvET6ub/S9u7VdtRxByoHydBEvNMKEMga64PwMe ++ztuZ6fX2xPmRnLQIippzfzdxDFHxbUWzjzEQEl+4EGbKX5vPi6A9yL3ofgMi4APZ ++C8/YoqAaqzjLIM9KZ/zqT36iQ6wsxBXAacd63L5M8lrAKfZoJeX6uYxNIIfaxQRz ++zVxdpVBjHJ/odqoadwKzU7YzN5Fs+6ATNvkrhlUzg1i0MyTGtCdkUIAt/hc6ZrW6 ++/kqHpCgUwUc4Dq0CAwEAAaMyMDAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU ++CEaIPf7XQsGt0xbf6P9x5cxdKpwwDQYJKoZIhvcNAQELBQADggEBAHMgyQNA3DQG ++0l9eX8RMl4YNwhAXChU/wOTcvD+F4OsJcPqzy6QHFh1AbBBGOI9/HN7du+EiKwGZ ++wE+69FEsSbhSv22XidPm+kHPTguWl1eKveeWrrT5MPl9F48s14lKb/8yMEa1/ryG ++Iu8NQ6ZL91JbTXdkLoBDya9HZqyXjwcGkXLE8fSqTibJ7EhWS5Q3Ic7WPgUoGAum ++b5ygoxqhm+SEyXC2/LAktwmFawkv1SsMeYpT790VIFqJ/TVVnUl+gQ2RjSEl2WLb ++UO4Hwq4FZbWF9NrY6JVThLmbcr8eW6+UxWfiXHLw/qTRre4/3367QAUQRt7EuEsb ++KOWpOS3fbsI= + -----END CERTIFICATE----- diff --git a/python-requests.spec b/python-requests.spec index 5514b4a..5e470eb 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -7,7 +7,7 @@ Name: python-requests Version: 2.32.3 -Release: 4%{?dist} +Release: 5%{?dist} Summary: HTTP library, written in Python, for human beings License: Apache-2.0 @@ -32,6 +32,29 @@ Patch: support_IPv6_CIDR_in_no_proxy.patch # when it is ready, or dropped in a release where that is merged Patch: 0001-Don-t-create-default-SSLContext-if-CA-bundle-isn-t-p.patch +# Add CA constraint to test CA +# +# Otherwise recent versions of OpenSSL reject it as an invalid CA certificate +# (at least once the test certificates are regenerated). +# +# https://github.com/psf/requests/commit/507409661335bd3dd8a7e39f04d07b42e519becc +Patch: https://github.com/psf/requests/commit/507409661335bd3dd8a7e39f04d07b42e519becc.patch +# Regenerate test certificates +# https://github.com/psf/requests/commit/9ebebdef98a6aacfbedcf2ca61ba0eaecc2563f4 +Patch: https://github.com/psf/requests/commit/9ebebdef98a6aacfbedcf2ca61ba0eaecc2563f4.patch +# Add key usage extension to test ca.crt +# https://github.com/psf/requests/pull/6924 +Patch: https://github.com/psf/requests/pull/6924.patch +# Together, these three patches fix one of the three regressions reported in +# the following issue, and the only one that we see downstream: +# +# Test regressions with urllib3 2.4.0 on Python 3.13 +# https://github.com/psf/requests/issues/6934 +# +# See also: +# +# https://github.com/urllib3/urllib3/pull/3577#issuecomment-2765190031 + BuildArch: noarch BuildRequires: python%{python3_pkgversion}-devel %if %{with tests} @@ -103,6 +126,9 @@ sed -i 's/ --doctest-modules//' pyproject.toml %changelog +* Tue Apr 15 2025 Benjamin A. Beasley - 2.32.3-5 +- Backport test-cert. fixes for urllib3 2.4.0 compatibility + * Sat Jan 18 2025 Fedora Release Engineering - 2.32.3-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From ddd9aacc2328840d42ae683215a3e5ef7378876f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Wed, 16 Apr 2025 12:41:19 +0200 Subject: [PATCH 34/43] Convert to %autorelease and %autochangelog [skip changelog] --- changelog | 469 ++++++++++++++++++++++++++++++++++++++++++ python-requests.spec | 472 +------------------------------------------ 2 files changed, 471 insertions(+), 470 deletions(-) create mode 100644 changelog diff --git a/changelog b/changelog new file mode 100644 index 0000000..c8f4a2c --- /dev/null +++ b/changelog @@ -0,0 +1,469 @@ +* Tue Apr 15 2025 Benjamin A. Beasley - 2.32.3-5 +- Backport test-cert. fixes for urllib3 2.4.0 compatibility + +* Sat Jan 18 2025 Fedora Release Engineering - 2.32.3-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Thu Aug 01 2024 Adam Williamson - 2.32.3-3 +- Backport PR #6781 to fix crash on import if CA cert bundle is missing (#2297632) + +* Fri Jul 19 2024 Fedora Release Engineering - 2.32.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Wed Jun 19 2024 Lumír Balhar - 2.32.3-1 +- Update to 2.32.3 (rhbz#2281881) +- Fix for CVE-2024-35195 (rhbz#2282205) + +* Sun Jun 09 2024 Python Maint - 2.31.0-7 +- Rebuilt for Python 3.13 + +* Fri Jun 07 2024 Python Maint - 2.31.0-6 +- Bootstrap for Python 3.13 + +* Tue May 14 2024 Lumír Balhar - 2.31.0-5 +- Add support for IPv6 CIDR in no_proxy setting +- Fix FTBFS + +* Thu Apr 11 2024 Lumír Balhar - 2.31.0-4 +- Fix compatibility with pytest 8 + +* Fri Jan 26 2024 Fedora Release Engineering - 2.31.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Mon Jan 22 2024 Fedora Release Engineering - 2.31.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Mon Oct 16 2023 Tomáš Hrnčiar - 2.31.0-1 +- Update to 2.31.0 +- Fixes: rhbz#2189970 + +* Tue Oct 10 2023 Miro Hrončok - 2.28.2-7 +- Do not package requests[security] and requests[socks] on RHEL +- Make the package build even when urllib3 won't pull in pysocks + +* Tue Aug 08 2023 Karolina Surma - 2.28.2-6 +- Declare the license as an SPDX expression + +* Fri Jul 21 2023 Fedora Release Engineering - 2.28.2-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Sat Jul 01 2023 Python Maint - 2.28.2-4 +- Rebuilt for Python 3.12 + +* Tue Jun 13 2023 Python Maint - 2.28.2-3 +- Bootstrap for Python 3.12 + +* Tue May 23 2023 Miro Hrončok - 2.28.2-2 +- Security fix for CVE-2023-32681 +- https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q + +* Wed Feb 01 2023 Lumír Balhar - 2.28.2-1 +- Update to 2.28.2 (rhbz#2160527) + +* Fri Jan 20 2023 Fedora Release Engineering - 2.28.1-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Tue Sep 13 2022 Kevin Fenzi - 2.28.1-3 +- Enable all tests and drop no longer needed test patch. + +* Fri Jul 22 2022 Fedora Release Engineering - 2.28.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Tue Jul 12 2022 Adam Williamson - 2.28.1-1 +- Update to 2.28.1, rediff patches + +* Mon Jun 20 2022 Lumír Balhar - 2.27.1-5 +- Allow charset_normalizer 2.1.0 and newer up to 3.0.0 + +* Tue Jun 14 2022 Python Maint - 2.27.1-4 +- Rebuilt for Python 3.11 + +* Mon Jun 13 2022 Python Maint - 2.27.1-3 +- Bootstrap for Python 3.11 + +* Fri Jan 21 2022 Fedora Release Engineering - 2.27.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Sat Jan 08 2022 Kevin Fenzi - 2.27.1-1 +- Update to 2.27.1. Fixes rhbz#2037431 + +* Tue Jan 04 2022 Adam Williamson - 2.27.0-1 +- Update to 2.27.0 +- Re-enable test_https_warnings as it works with pytest-httpbin 1.0.0 now +- Re-enable test_pyopenssl_redirect, it seems to work too + +* Sun Jul 25 2021 Lumír Balhar - 2.26.0-1 +- Update to 2.26.0 +Resolves: rhbz#1981856 + +* Fri Jul 23 2021 Fedora Release Engineering - 2.25.1-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Fri Jun 04 2021 Python Maint - 2.25.1-3 +- Rebuilt for Python 3.10 + +* Wed Jun 02 2021 Python Maint - 2.25.1-2 +- Bootstrap for Python 3.10 + +* Tue Feb 02 2021 Kevin Fenzi - 2.25.1-1 +- Update 2.25.1. Fix is rhbz#1908487 + +* Wed Jan 27 2021 Fedora Release Engineering - 2.25.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Wed Nov 25 2020 Petr Viktorin - 2.25.0-1 +- Update to 2.25.0 + +* Fri Nov 13 2020 Miro Hrončok - 2.24.0-5 +- Don't BR pytest-cov + +* Fri Sep 18 2020 Petr Viktorin - 2.24.0-4 +- Port to pyproject macros + +* Fri Sep 18 2020 Miro Hrončok - 2.24.0-3 +- Build with pytest 6, older version is no longer required + +* Wed Jul 29 2020 Fedora Release Engineering - 2.24.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Fri Jul 10 2020 Miro Hrončok - 2.24.0-1 +- Update to 2.24.0 +- Resolves rhbz#1848104 + +* Fri Jul 10 2020 Miro Hrončok - 2.23.0-5 +- Add requests[security] and requests[socks] subpackages + +* Sat May 30 2020 Miro Hrončok - 2.23.0-4 +- Test with pytest 4, drop manual requires + +* Mon May 25 2020 Miro Hrončok - 2.23.0-3 +- Rebuilt for Python 3.9 + +* Fri May 22 2020 Miro Hrončok - 2.23.0-2 +- Bootstrap for Python 3.9 + +* Fri Feb 21 2020 Randy Barlow - 2.23.0-1 +- Update to 2.23.0 (#1804863). +- https://requests.readthedocs.io/en/latest/community/updates/ + +* Thu Jan 30 2020 Fedora Release Engineering - 2.22.0-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + +* Tue Oct 22 2019 Charalampos Stratakis - 2.22.0-7 +- Remove the python2 subpackage (rhbz#1761787) + +* Wed Sep 18 2019 Petr Viktorin - 2.22.0-6 +- Python 2: Remove tests and test dependencies + +* Mon Aug 19 2019 Miro Hrončok - 2.22.0-5 +- Rebuilt for Python 3.8 + +* Thu Aug 15 2019 Miro Hrončok - 2.22.0-4 +- Bootstrap for Python 3.8 + +* Fri Jul 26 2019 Fedora Release Engineering - 2.22.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Tue Jun 11 2019 Yatin Karel - 2.22.0-2 +- Add minimum requirement for chardet and urllib3 + +* Thu May 23 2019 Jeremy Cline - 2.22.0-1 +- Update to v2.22.0 + +* Sat Feb 02 2019 Fedora Release Engineering - 2.21.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Thu Dec 13 2018 Jeremy Cline - 2.21.0-1 +- Update to v2.21.0 +- Don't rely on certifi being patched properly to use the system CA bundle + +* Mon Nov 26 2018 Miro Hrončok - 2.20.0-2 +- No pytest-httpbin for Python 2 + +* Mon Oct 29 2018 Jeremy Cline - 2.20.0-1 +- Update to v2.20.0 + +* Sat Jul 14 2018 Fedora Release Engineering - 2.19.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Mon Jun 18 2018 Miro Hrončok - 2.19.1-2 +- Rebuilt for Python 3.7 + +* Thu Jun 14 2018 Jeremy Cline - 2.19.1-1 +- Update to v2.19.1 (rhbz 1591531) + +* Thu Jun 14 2018 Miro Hrončok - 2.19.0-2 +- Bootstrap for Python 3.7 + +* Tue Jun 12 2018 Jeremy Cline - 2.19.0-1 +- Update to v2.19.0 (rhbz 1590508) + +* Fri Jun 08 2018 Jeremy Cline - 2.18.4-6 +- Don't print runtime warning about urllib3 v1.23 (rhbz 1589306) + +* Tue Jun 05 2018 Jeremy Cline - 2.18.4-5 +- Allow urllib3 v1.23 (rhbz 1586311) + +* Mon Apr 16 2018 Jeremy Cline - 2.18.4-4 +- Stop injecting PyOpenSSL (rhbz 1567862) + +* Fri Feb 09 2018 Fedora Release Engineering - 2.18.4-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Mon Dec 11 2017 Iryna Shcherbina - 2.18.4-2 +- Fix ambiguous Python 2 dependency declarations + (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3) + +* Fri Aug 18 2017 Jeremy Cline - 2.18.4-1 +- Update to 2.18.4 + +* Wed Jul 26 2017 Igor Gnatenko - 2.18.2-1 +- Update to 2.18.2 + +* Tue Jun 20 2017 Jeremy Cline - 2.18.1-2 +- Drop the dependency on certifi in setup.py + +* Mon Jun 19 2017 Jeremy Cline - 2.18.1-1 +- Update to 2.18.1 (#1449432) +- Remove tests that require non-local network (#1450608) + +* Wed May 17 2017 Jeremy Cline - 2.14.2-1 +- Update to 2.14.2 (#1449432) +- Switch to autosetup to apply patches + +* Sun May 14 2017 Stephen Gallagher - 2.13.0-2 +- Don't run tests when building as a module + +* Thu Feb 09 2017 Jeremy Cline - 2.13.0-1 +- Update to 2.13.0 (#1418138) + +* Fri Dec 30 2016 Adam Williamson - 2.12.4-3 +- Include and enable tests (now python-pytest-httpbin is packaged) + +* Wed Dec 21 2016 Kevin Fenzi - 2.12.4-2 +- Rebuild for Python 3.6 again. + +* Tue Dec 20 2016 Jeremy Cline - 2.12.4-1 +- Update to 2.12.4. Fixes #1404680 + +* Tue Dec 13 2016 Stratakis Charalampos - 2.12.3-2 +- Rebuild for Python 3.6 + +* Thu Dec 01 2016 Jeremy Cline - 2.12.3-1 +- Update to 2.12.3. Fixes #1400601 + +* Wed Nov 30 2016 Jeremy Cline - 2.12.2-1 +- Update to 2.12.2 + +* Wed Nov 23 2016 Jeremy Cline - 2.12.1-2 +- Backport #3713. Fixes #1397149 + +* Thu Nov 17 2016 Jeremy Cline - 2.12.1-1 +- Update to 2.12.1. Fixes #1395469 +- Unbundle idna, a new upstream dependency + +* Sat Aug 27 2016 Kevin Fenzi - 2.11.1-1 +- Update to 2.11.1. Fixes #1370814 + +* Wed Aug 10 2016 Kevin Fenzi - 2.11.0-1 +- Update to 2.11.0. Fixes #1365332 + +* Tue Jul 19 2016 Fedora Release Engineering - 2.10.0-4 +- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages + +* Fri Jul 15 2016 Ralph Bean - 2.10.0-3 +- Update python2 packaging. + +* Thu Jun 02 2016 Ralph Bean - 2.10.0-2 +- Fix python2 subpackage to comply with guidelines. + +* Thu Feb 04 2016 Fedora Release Engineering - 2.9.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + +* Mon Dec 21 2015 Ralph Bean - 2.9.1-1 +- new version + +* Fri Dec 18 2015 Ralph Bean - 2.9.0-1 +- new version + +* Mon Dec 14 2015 Ralph Bean - 2.8.1-1 +- Latest upstream. +- Bump hard dep on urllib3 to 1.12. + +* Mon Nov 02 2015 Robert Kuska - 2.7.0-8 +- Rebuilt for Python3.5 rebuild + +* Sat Oct 10 2015 Ralph Bean - 2.7.0-7 +- Tell setuptools about what version of urllib3 we're unbundling + for https://github.com/kennethreitz/requests/issues/2816 + +* Thu Sep 17 2015 Ralph Bean - 2.7.0-6 +- Replace the provides macro with a plain provides field for now until we can + re-organize this package into two different subpackages. + +* Thu Sep 17 2015 Ralph Bean - 2.7.0-5 +- Remove 'provides: python2-requests' from the python3 subpackage, obviously. + +* Tue Sep 15 2015 Ralph Bean - 2.7.0-4 +- Employ %%python_provides macro to provide python2-requests. + +* Fri Sep 04 2015 Ralph Bean - 2.7.0-3 +- Lock down the python-urllib3 version to the specific version we unbundled. + https://bugzilla.redhat.com/show_bug.cgi?id=1253823 + +* Thu Jun 18 2015 Fedora Release Engineering - 2.7.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + +* Mon May 04 2015 Ralph Bean - 2.7.0-1 +- new version + +* Wed Apr 29 2015 Ralph Bean - 2.6.2-1 +- new version + +* Thu Apr 23 2015 Ralph Bean - 2.6.1-1 +- new version + +* Wed Apr 22 2015 Ralph Bean - 2.6.0-1 +- new version +- Remove patch for CVE-2015-2296, now included in the upstream release. + +* Mon Mar 16 2015 Ralph Bean - 2.5.3-2 +- Backport fix for CVE-2015-2296. + +* Thu Feb 26 2015 Ralph Bean - 2.5.3-1 +- new version + +* Wed Feb 18 2015 Ralph Bean - 2.5.1-1 +- new version + +* Tue Dec 16 2014 Ralph Bean - 2.5.0-3 +- Pin python-urllib3 requirement at 1.10. +- Fix requirement pinning syntax. + +* Thu Dec 11 2014 Ralph Bean - 2.5.0-2 +- Do the most basic of tests in the check section. + +* Thu Dec 11 2014 Ralph Bean - 2.5.0-1 +- Latest upstream, 2.5.0 for #1171068 + +* Wed Nov 05 2014 Ralph Bean - 2.4.3-1 +- Latest upstream, 2.4.3 for #1136283 + +* Wed Nov 05 2014 Ralph Bean - 2.3.0-4 +- Re-do unbundling by symlinking system libs into the requests/packages/ dir. + +* Sun Aug 3 2014 Tom Callaway - 2.3.0-3 +- fix license handling + +* Sat Jun 07 2014 Fedora Release Engineering - 2.3.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + +* Thu May 29 2014 Arun S A G - 2.3.0-1 +- Latest upstream + +* Wed May 14 2014 Bohuslav Kabrda - 2.0.0-2 +- Rebuilt for https://fedoraproject.org/wiki/Changes/Python_3.4 + +* Wed Sep 25 2013 Ralph Bean - 2.0.0-1 +- Latest upstream. +- Add doc macro to the python3 files section. +- Require python-urllib3 greater than or at 1.7.1. + +* Mon Aug 26 2013 Rex Dieter 1.2.3-5 +- fix versioned dep on python-urllib3 + +* Mon Aug 26 2013 Ralph Bean - 1.2.3-4 +- Explicitly versioned the requirements on python-urllib3. + +* Thu Aug 22 2013 Ralph Bean - 1.2.3-3 +- Release bump for a coupled update with python-urllib3. + +* Sun Aug 04 2013 Fedora Release Engineering - 1.2.3-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild + +* Mon Jul 01 2013 Ralph Bean - 1.2.3-1 +- Latest upstream. +- Fixed bogus date in changelog. + +* Tue Jun 11 2013 Ralph Bean - 1.1.0-4 +- Correct a rhel conditional on python-ordereddict + +* Thu Feb 28 2013 Ralph Bean - 1.1.0-3 +- Unbundled python-urllib3. Using system python-urllib3 now. +- Conditionally include python-ordereddict for el6. + +* Wed Feb 27 2013 Ralph Bean - 1.1.0-2 +- Unbundled python-charade/chardet. Using system python-chardet now. +- Removed deprecated comments and actions against oauthlib unbundling. + Those are no longer necessary in 1.1.0. +- Added links to bz tickets over Patch declarations. + +* Tue Feb 26 2013 Ralph Bean - 1.1.0-1 +- Latest upstream. +- Relicense to ASL 2.0 with upstream. +- Removed cookie handling patch (fixed in upstream tarball). +- Updated cert unbundling patch to match upstream. +- Added check section, but left it commented out for koji. + +* Fri Feb 8 2013 Toshio Kuratomi - 0.14.1-4 +- Let brp_python_bytecompile run again, take care of the non-python{2,3} modules + by removing them from the python{,3}-requests package that they did not belong + in. +- Use the certificates in the ca-certificates package instead of the bundled one + + https://bugzilla.redhat.com/show_bug.cgi?id=904614 +- Fix a problem with cookie handling + + https://bugzilla.redhat.com/show_bug.cgi?id=906924 + +* Mon Oct 22 2012 Arun S A G 0.14.1-1 +- Updated to latest upstream release + +* Sun Jun 10 2012 Arun S A G 0.13.1-1 +- Updated to latest upstream release 0.13.1 +- Use system provided ca-certificates +- No more async requests use grrequests https://github.com/kennethreitz/grequests +- Remove gevent as it is no longer required by requests + +* Sun Apr 01 2012 Arun S A G 0.11.1-1 +- Updated to upstream release 0.11.1 + +* Thu Mar 29 2012 Arun S A G 0.10.6-3 +- Support building package for EL6 + +* Tue Mar 27 2012 Rex Dieter 0.10.6-2 +- +python3-requests pkg + +* Sat Mar 3 2012 Arun SAG - 0.10.6-1 +- Updated to new upstream version + +* Sat Jan 21 2012 Arun SAG - 0.9.3-1 +- Updated to new upstream version 0.9.3 +- Include python-gevent as a dependency for requests.async +- Clean up shebangs in requests/setup.py,test_requests.py and test_requests_ext.py + +* Sat Jan 14 2012 Fedora Release Engineering - 0.8.2-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild + +* Sun Nov 27 2011 Arun SAG - 0.8.2-1 +- New upstream version +- keep alive support +- complete removal of cookiejar and urllib2 + +* Thu Nov 10 2011 Arun SAG - 0.7.6-1 +- Updated to new upstream release 0.7.6 + +* Thu Oct 20 2011 Arun SAG - 0.6.6-1 +- Updated to version 0.6.6 + +* Fri Aug 26 2011 Arun SAG - 0.6.1-1 +- Updated to version 0.6.1 + +* Sat Aug 20 2011 Arun SAG - 0.6.0-1 +- Updated to latest version 0.6.0 + +* Mon Aug 15 2011 Arun SAG - 0.5.1-2 +- Remove OPT_FLAGS from build section since it is a noarch package +- Fix use of mixed tabs and space +- Remove extra space around the word cumbersome in description + +* Sun Aug 14 2011 Arun SAG - 0.5.1-1 +- Initial package diff --git a/python-requests.spec b/python-requests.spec index 5e470eb..1efa0bf 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -7,7 +7,7 @@ Name: python-requests Version: 2.32.3 -Release: 5%{?dist} +Release: %autorelease Summary: HTTP library, written in Python, for human beings License: Apache-2.0 @@ -126,472 +126,4 @@ sed -i 's/ --doctest-modules//' pyproject.toml %changelog -* Tue Apr 15 2025 Benjamin A. Beasley - 2.32.3-5 -- Backport test-cert. fixes for urllib3 2.4.0 compatibility - -* Sat Jan 18 2025 Fedora Release Engineering - 2.32.3-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Thu Aug 01 2024 Adam Williamson - 2.32.3-3 -- Backport PR #6781 to fix crash on import if CA cert bundle is missing (#2297632) - -* Fri Jul 19 2024 Fedora Release Engineering - 2.32.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Wed Jun 19 2024 Lumír Balhar - 2.32.3-1 -- Update to 2.32.3 (rhbz#2281881) -- Fix for CVE-2024-35195 (rhbz#2282205) - -* Sun Jun 09 2024 Python Maint - 2.31.0-7 -- Rebuilt for Python 3.13 - -* Fri Jun 07 2024 Python Maint - 2.31.0-6 -- Bootstrap for Python 3.13 - -* Tue May 14 2024 Lumír Balhar - 2.31.0-5 -- Add support for IPv6 CIDR in no_proxy setting -- Fix FTBFS - -* Thu Apr 11 2024 Lumír Balhar - 2.31.0-4 -- Fix compatibility with pytest 8 - -* Fri Jan 26 2024 Fedora Release Engineering - 2.31.0-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Mon Jan 22 2024 Fedora Release Engineering - 2.31.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Mon Oct 16 2023 Tomáš Hrnčiar - 2.31.0-1 -- Update to 2.31.0 -- Fixes: rhbz#2189970 - -* Tue Oct 10 2023 Miro Hrončok - 2.28.2-7 -- Do not package requests[security] and requests[socks] on RHEL -- Make the package build even when urllib3 won't pull in pysocks - -* Tue Aug 08 2023 Karolina Surma - 2.28.2-6 -- Declare the license as an SPDX expression - -* Fri Jul 21 2023 Fedora Release Engineering - 2.28.2-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Sat Jul 01 2023 Python Maint - 2.28.2-4 -- Rebuilt for Python 3.12 - -* Tue Jun 13 2023 Python Maint - 2.28.2-3 -- Bootstrap for Python 3.12 - -* Tue May 23 2023 Miro Hrončok - 2.28.2-2 -- Security fix for CVE-2023-32681 -- https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q - -* Wed Feb 01 2023 Lumír Balhar - 2.28.2-1 -- Update to 2.28.2 (rhbz#2160527) - -* Fri Jan 20 2023 Fedora Release Engineering - 2.28.1-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Tue Sep 13 2022 Kevin Fenzi - 2.28.1-3 -- Enable all tests and drop no longer needed test patch. - -* Fri Jul 22 2022 Fedora Release Engineering - 2.28.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Tue Jul 12 2022 Adam Williamson - 2.28.1-1 -- Update to 2.28.1, rediff patches - -* Mon Jun 20 2022 Lumír Balhar - 2.27.1-5 -- Allow charset_normalizer 2.1.0 and newer up to 3.0.0 - -* Tue Jun 14 2022 Python Maint - 2.27.1-4 -- Rebuilt for Python 3.11 - -* Mon Jun 13 2022 Python Maint - 2.27.1-3 -- Bootstrap for Python 3.11 - -* Fri Jan 21 2022 Fedora Release Engineering - 2.27.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Sat Jan 08 2022 Kevin Fenzi - 2.27.1-1 -- Update to 2.27.1. Fixes rhbz#2037431 - -* Tue Jan 04 2022 Adam Williamson - 2.27.0-1 -- Update to 2.27.0 -- Re-enable test_https_warnings as it works with pytest-httpbin 1.0.0 now -- Re-enable test_pyopenssl_redirect, it seems to work too - -* Sun Jul 25 2021 Lumír Balhar - 2.26.0-1 -- Update to 2.26.0 -Resolves: rhbz#1981856 - -* Fri Jul 23 2021 Fedora Release Engineering - 2.25.1-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Fri Jun 04 2021 Python Maint - 2.25.1-3 -- Rebuilt for Python 3.10 - -* Wed Jun 02 2021 Python Maint - 2.25.1-2 -- Bootstrap for Python 3.10 - -* Tue Feb 02 2021 Kevin Fenzi - 2.25.1-1 -- Update 2.25.1. Fix is rhbz#1908487 - -* Wed Jan 27 2021 Fedora Release Engineering - 2.25.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Wed Nov 25 2020 Petr Viktorin - 2.25.0-1 -- Update to 2.25.0 - -* Fri Nov 13 2020 Miro Hrončok - 2.24.0-5 -- Don't BR pytest-cov - -* Fri Sep 18 2020 Petr Viktorin - 2.24.0-4 -- Port to pyproject macros - -* Fri Sep 18 2020 Miro Hrončok - 2.24.0-3 -- Build with pytest 6, older version is no longer required - -* Wed Jul 29 2020 Fedora Release Engineering - 2.24.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Fri Jul 10 2020 Miro Hrončok - 2.24.0-1 -- Update to 2.24.0 -- Resolves rhbz#1848104 - -* Fri Jul 10 2020 Miro Hrončok - 2.23.0-5 -- Add requests[security] and requests[socks] subpackages - -* Sat May 30 2020 Miro Hrončok - 2.23.0-4 -- Test with pytest 4, drop manual requires - -* Mon May 25 2020 Miro Hrončok - 2.23.0-3 -- Rebuilt for Python 3.9 - -* Fri May 22 2020 Miro Hrončok - 2.23.0-2 -- Bootstrap for Python 3.9 - -* Fri Feb 21 2020 Randy Barlow - 2.23.0-1 -- Update to 2.23.0 (#1804863). -- https://requests.readthedocs.io/en/latest/community/updates/ - -* Thu Jan 30 2020 Fedora Release Engineering - 2.22.0-8 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Tue Oct 22 2019 Charalampos Stratakis - 2.22.0-7 -- Remove the python2 subpackage (rhbz#1761787) - -* Wed Sep 18 2019 Petr Viktorin - 2.22.0-6 -- Python 2: Remove tests and test dependencies - -* Mon Aug 19 2019 Miro Hrončok - 2.22.0-5 -- Rebuilt for Python 3.8 - -* Thu Aug 15 2019 Miro Hrončok - 2.22.0-4 -- Bootstrap for Python 3.8 - -* Fri Jul 26 2019 Fedora Release Engineering - 2.22.0-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Tue Jun 11 2019 Yatin Karel - 2.22.0-2 -- Add minimum requirement for chardet and urllib3 - -* Thu May 23 2019 Jeremy Cline - 2.22.0-1 -- Update to v2.22.0 - -* Sat Feb 02 2019 Fedora Release Engineering - 2.21.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Thu Dec 13 2018 Jeremy Cline - 2.21.0-1 -- Update to v2.21.0 -- Don't rely on certifi being patched properly to use the system CA bundle - -* Mon Nov 26 2018 Miro Hrončok - 2.20.0-2 -- No pytest-httpbin for Python 2 - -* Mon Oct 29 2018 Jeremy Cline - 2.20.0-1 -- Update to v2.20.0 - -* Sat Jul 14 2018 Fedora Release Engineering - 2.19.1-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild - -* Mon Jun 18 2018 Miro Hrončok - 2.19.1-2 -- Rebuilt for Python 3.7 - -* Thu Jun 14 2018 Jeremy Cline - 2.19.1-1 -- Update to v2.19.1 (rhbz 1591531) - -* Thu Jun 14 2018 Miro Hrončok - 2.19.0-2 -- Bootstrap for Python 3.7 - -* Tue Jun 12 2018 Jeremy Cline - 2.19.0-1 -- Update to v2.19.0 (rhbz 1590508) - -* Fri Jun 08 2018 Jeremy Cline - 2.18.4-6 -- Don't print runtime warning about urllib3 v1.23 (rhbz 1589306) - -* Tue Jun 05 2018 Jeremy Cline - 2.18.4-5 -- Allow urllib3 v1.23 (rhbz 1586311) - -* Mon Apr 16 2018 Jeremy Cline - 2.18.4-4 -- Stop injecting PyOpenSSL (rhbz 1567862) - -* Fri Feb 09 2018 Fedora Release Engineering - 2.18.4-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - -* Mon Dec 11 2017 Iryna Shcherbina - 2.18.4-2 -- Fix ambiguous Python 2 dependency declarations - (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3) - -* Fri Aug 18 2017 Jeremy Cline - 2.18.4-1 -- Update to 2.18.4 - -* Wed Jul 26 2017 Igor Gnatenko - 2.18.2-1 -- Update to 2.18.2 - -* Tue Jun 20 2017 Jeremy Cline - 2.18.1-2 -- Drop the dependency on certifi in setup.py - -* Mon Jun 19 2017 Jeremy Cline - 2.18.1-1 -- Update to 2.18.1 (#1449432) -- Remove tests that require non-local network (#1450608) - -* Wed May 17 2017 Jeremy Cline - 2.14.2-1 -- Update to 2.14.2 (#1449432) -- Switch to autosetup to apply patches - -* Sun May 14 2017 Stephen Gallagher - 2.13.0-2 -- Don't run tests when building as a module - -* Thu Feb 09 2017 Jeremy Cline - 2.13.0-1 -- Update to 2.13.0 (#1418138) - -* Fri Dec 30 2016 Adam Williamson - 2.12.4-3 -- Include and enable tests (now python-pytest-httpbin is packaged) - -* Wed Dec 21 2016 Kevin Fenzi - 2.12.4-2 -- Rebuild for Python 3.6 again. - -* Tue Dec 20 2016 Jeremy Cline - 2.12.4-1 -- Update to 2.12.4. Fixes #1404680 - -* Tue Dec 13 2016 Stratakis Charalampos - 2.12.3-2 -- Rebuild for Python 3.6 - -* Thu Dec 01 2016 Jeremy Cline - 2.12.3-1 -- Update to 2.12.3. Fixes #1400601 - -* Wed Nov 30 2016 Jeremy Cline - 2.12.2-1 -- Update to 2.12.2 - -* Wed Nov 23 2016 Jeremy Cline - 2.12.1-2 -- Backport #3713. Fixes #1397149 - -* Thu Nov 17 2016 Jeremy Cline - 2.12.1-1 -- Update to 2.12.1. Fixes #1395469 -- Unbundle idna, a new upstream dependency - -* Sat Aug 27 2016 Kevin Fenzi - 2.11.1-1 -- Update to 2.11.1. Fixes #1370814 - -* Wed Aug 10 2016 Kevin Fenzi - 2.11.0-1 -- Update to 2.11.0. Fixes #1365332 - -* Tue Jul 19 2016 Fedora Release Engineering - 2.10.0-4 -- https://fedoraproject.org/wiki/Changes/Automatic_Provides_for_Python_RPM_Packages - -* Fri Jul 15 2016 Ralph Bean - 2.10.0-3 -- Update python2 packaging. - -* Thu Jun 02 2016 Ralph Bean - 2.10.0-2 -- Fix python2 subpackage to comply with guidelines. - -* Thu Feb 04 2016 Fedora Release Engineering - 2.9.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild - -* Mon Dec 21 2015 Ralph Bean - 2.9.1-1 -- new version - -* Fri Dec 18 2015 Ralph Bean - 2.9.0-1 -- new version - -* Mon Dec 14 2015 Ralph Bean - 2.8.1-1 -- Latest upstream. -- Bump hard dep on urllib3 to 1.12. - -* Mon Nov 02 2015 Robert Kuska - 2.7.0-8 -- Rebuilt for Python3.5 rebuild - -* Sat Oct 10 2015 Ralph Bean - 2.7.0-7 -- Tell setuptools about what version of urllib3 we're unbundling - for https://github.com/kennethreitz/requests/issues/2816 - -* Thu Sep 17 2015 Ralph Bean - 2.7.0-6 -- Replace the provides macro with a plain provides field for now until we can - re-organize this package into two different subpackages. - -* Thu Sep 17 2015 Ralph Bean - 2.7.0-5 -- Remove 'provides: python2-requests' from the python3 subpackage, obviously. - -* Tue Sep 15 2015 Ralph Bean - 2.7.0-4 -- Employ %%python_provides macro to provide python2-requests. - -* Fri Sep 04 2015 Ralph Bean - 2.7.0-3 -- Lock down the python-urllib3 version to the specific version we unbundled. - https://bugzilla.redhat.com/show_bug.cgi?id=1253823 - -* Thu Jun 18 2015 Fedora Release Engineering - 2.7.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild - -* Mon May 04 2015 Ralph Bean - 2.7.0-1 -- new version - -* Wed Apr 29 2015 Ralph Bean - 2.6.2-1 -- new version - -* Thu Apr 23 2015 Ralph Bean - 2.6.1-1 -- new version - -* Wed Apr 22 2015 Ralph Bean - 2.6.0-1 -- new version -- Remove patch for CVE-2015-2296, now included in the upstream release. - -* Mon Mar 16 2015 Ralph Bean - 2.5.3-2 -- Backport fix for CVE-2015-2296. - -* Thu Feb 26 2015 Ralph Bean - 2.5.3-1 -- new version - -* Wed Feb 18 2015 Ralph Bean - 2.5.1-1 -- new version - -* Tue Dec 16 2014 Ralph Bean - 2.5.0-3 -- Pin python-urllib3 requirement at 1.10. -- Fix requirement pinning syntax. - -* Thu Dec 11 2014 Ralph Bean - 2.5.0-2 -- Do the most basic of tests in the check section. - -* Thu Dec 11 2014 Ralph Bean - 2.5.0-1 -- Latest upstream, 2.5.0 for #1171068 - -* Wed Nov 05 2014 Ralph Bean - 2.4.3-1 -- Latest upstream, 2.4.3 for #1136283 - -* Wed Nov 05 2014 Ralph Bean - 2.3.0-4 -- Re-do unbundling by symlinking system libs into the requests/packages/ dir. - -* Sun Aug 3 2014 Tom Callaway - 2.3.0-3 -- fix license handling - -* Sat Jun 07 2014 Fedora Release Engineering - 2.3.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild - -* Thu May 29 2014 Arun S A G - 2.3.0-1 -- Latest upstream - -* Wed May 14 2014 Bohuslav Kabrda - 2.0.0-2 -- Rebuilt for https://fedoraproject.org/wiki/Changes/Python_3.4 - -* Wed Sep 25 2013 Ralph Bean - 2.0.0-1 -- Latest upstream. -- Add doc macro to the python3 files section. -- Require python-urllib3 greater than or at 1.7.1. - -* Mon Aug 26 2013 Rex Dieter 1.2.3-5 -- fix versioned dep on python-urllib3 - -* Mon Aug 26 2013 Ralph Bean - 1.2.3-4 -- Explicitly versioned the requirements on python-urllib3. - -* Thu Aug 22 2013 Ralph Bean - 1.2.3-3 -- Release bump for a coupled update with python-urllib3. - -* Sun Aug 04 2013 Fedora Release Engineering - 1.2.3-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild - -* Mon Jul 01 2013 Ralph Bean - 1.2.3-1 -- Latest upstream. -- Fixed bogus date in changelog. - -* Tue Jun 11 2013 Ralph Bean - 1.1.0-4 -- Correct a rhel conditional on python-ordereddict - -* Thu Feb 28 2013 Ralph Bean - 1.1.0-3 -- Unbundled python-urllib3. Using system python-urllib3 now. -- Conditionally include python-ordereddict for el6. - -* Wed Feb 27 2013 Ralph Bean - 1.1.0-2 -- Unbundled python-charade/chardet. Using system python-chardet now. -- Removed deprecated comments and actions against oauthlib unbundling. - Those are no longer necessary in 1.1.0. -- Added links to bz tickets over Patch declarations. - -* Tue Feb 26 2013 Ralph Bean - 1.1.0-1 -- Latest upstream. -- Relicense to ASL 2.0 with upstream. -- Removed cookie handling patch (fixed in upstream tarball). -- Updated cert unbundling patch to match upstream. -- Added check section, but left it commented out for koji. - -* Fri Feb 8 2013 Toshio Kuratomi - 0.14.1-4 -- Let brp_python_bytecompile run again, take care of the non-python{2,3} modules - by removing them from the python{,3}-requests package that they did not belong - in. -- Use the certificates in the ca-certificates package instead of the bundled one - + https://bugzilla.redhat.com/show_bug.cgi?id=904614 -- Fix a problem with cookie handling - + https://bugzilla.redhat.com/show_bug.cgi?id=906924 - -* Mon Oct 22 2012 Arun S A G 0.14.1-1 -- Updated to latest upstream release - -* Sun Jun 10 2012 Arun S A G 0.13.1-1 -- Updated to latest upstream release 0.13.1 -- Use system provided ca-certificates -- No more async requests use grrequests https://github.com/kennethreitz/grequests -- Remove gevent as it is no longer required by requests - -* Sun Apr 01 2012 Arun S A G 0.11.1-1 -- Updated to upstream release 0.11.1 - -* Thu Mar 29 2012 Arun S A G 0.10.6-3 -- Support building package for EL6 - -* Tue Mar 27 2012 Rex Dieter 0.10.6-2 -- +python3-requests pkg - -* Sat Mar 3 2012 Arun SAG - 0.10.6-1 -- Updated to new upstream version - -* Sat Jan 21 2012 Arun SAG - 0.9.3-1 -- Updated to new upstream version 0.9.3 -- Include python-gevent as a dependency for requests.async -- Clean up shebangs in requests/setup.py,test_requests.py and test_requests_ext.py - -* Sat Jan 14 2012 Fedora Release Engineering - 0.8.2-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild - -* Sun Nov 27 2011 Arun SAG - 0.8.2-1 -- New upstream version -- keep alive support -- complete removal of cookiejar and urllib2 - -* Thu Nov 10 2011 Arun SAG - 0.7.6-1 -- Updated to new upstream release 0.7.6 - -* Thu Oct 20 2011 Arun SAG - 0.6.6-1 -- Updated to version 0.6.6 - -* Fri Aug 26 2011 Arun SAG - 0.6.1-1 -- Updated to version 0.6.1 - -* Sat Aug 20 2011 Arun SAG - 0.6.0-1 -- Updated to latest version 0.6.0 - -* Mon Aug 15 2011 Arun SAG - 0.5.1-2 -- Remove OPT_FLAGS from build section since it is a noarch package -- Fix use of mixed tabs and space -- Remove extra space around the word cumbersome in description - -* Sun Aug 14 2011 Arun SAG - 0.5.1-1 -- Initial package +%autochangelog From d78a94dfe49e53f410fd3ecbc7b460c2b1f044b7 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Tue, 3 Jun 2025 10:26:13 +0200 Subject: [PATCH 35/43] Bootstrap for Python 3.14 --- python-requests.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/python-requests.spec b/python-requests.spec index 1efa0bf..6a3bb4d 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -1,3 +1,4 @@ +%global _without_tests 1 # When bootstrapping Python, we cannot test this yet # RHEL does not include the test dependencies %bcond tests %{undefined rhel} From 96f8226c90fff5ab4ebf293dbf3cd97f0167d269 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Wed, 4 Jun 2025 13:32:12 +0200 Subject: [PATCH 36/43] Rebuilt for Python 3.14 --- python-requests.spec | 1 - 1 file changed, 1 deletion(-) diff --git a/python-requests.spec b/python-requests.spec index 6a3bb4d..1efa0bf 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -1,4 +1,3 @@ -%global _without_tests 1 # When bootstrapping Python, we cannot test this yet # RHEL does not include the test dependencies %bcond tests %{undefined rhel} From e4b73fd858cd66e4735d3dea7393a237dc773fc1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Mon, 7 Jul 2025 11:59:04 +0200 Subject: [PATCH 37/43] Package %license via %pyproject_save_files [skip changelog] --- python-requests.spec | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/python-requests.spec b/python-requests.spec index 1efa0bf..26734bd 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -108,7 +108,7 @@ sed -i 's/ --doctest-modules//' pyproject.toml %install %pyproject_install -%pyproject_save_files requests +%pyproject_save_files -l requests %check @@ -121,7 +121,6 @@ sed -i 's/ --doctest-modules//' pyproject.toml %files -n python%{python3_pkgversion}-requests -f %{pyproject_files} -%license LICENSE %doc README.md HISTORY.md From 8607c2fb6581a3f649be34ed5adb77bd1c67fc6d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Mon, 7 Jul 2025 12:12:42 +0200 Subject: [PATCH 38/43] Update to 2.32.4 - Security fix for CVE-2024-47081: .netrc credentials leak via malicious URLs --- .gitignore | 1 + ...09661335bd3dd8a7e39f04d07b42e519becc.patch | 31 - 6924.patch | 55 -- ...bdef98a6aacfbedcf2ca61ba0eaecc2563f4.patch | 685 ------------------ python-requests.spec | 25 +- sources | 2 +- system-certs.patch | 12 +- tests/upstream/runtest.sh | 4 +- 8 files changed, 11 insertions(+), 804 deletions(-) delete mode 100644 507409661335bd3dd8a7e39f04d07b42e519becc.patch delete mode 100644 6924.patch delete mode 100644 9ebebdef98a6aacfbedcf2ca61ba0eaecc2563f4.patch diff --git a/.gitignore b/.gitignore index 7c27bec..da16a7b 100644 --- a/.gitignore +++ b/.gitignore @@ -53,3 +53,4 @@ /requests-v2.28.2.tar.gz /requests-v2.31.0.tar.gz /requests-v2.32.3.tar.gz +/requests-v2.32.4.tar.gz diff --git a/507409661335bd3dd8a7e39f04d07b42e519becc.patch b/507409661335bd3dd8a7e39f04d07b42e519becc.patch deleted file mode 100644 index 13b0001..0000000 --- a/507409661335bd3dd8a7e39f04d07b42e519becc.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 507409661335bd3dd8a7e39f04d07b42e519becc Mon Sep 17 00:00:00 2001 -From: Colin Watson -Date: Mon, 17 Feb 2025 00:39:07 +0000 -Subject: [PATCH] Add CA constraint to test CA - -Otherwise recent versions of OpenSSL reject it as an invalid CA -certificate (at least once the test certificates are regenerated). - -Fixes: #6896 ---- - tests/certs/expired/ca/ca.cnf | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/tests/certs/expired/ca/ca.cnf b/tests/certs/expired/ca/ca.cnf -index 8c4b823053..1443cb9374 100644 ---- a/tests/certs/expired/ca/ca.cnf -+++ b/tests/certs/expired/ca/ca.cnf -@@ -4,9 +4,13 @@ prompt = no - default_md = sha256 - encrypt_key = no - distinguished_name = dn -+x509_extensions = v3_ca - - [dn] - C = US # country code - O = Python Software Foundation # organization - OU = python-requests # organization unit/department - CN = Self-Signed Root CA # common name / your cert name -+ -+[v3_ca] -+basicConstraints = critical, CA:true diff --git a/6924.patch b/6924.patch deleted file mode 100644 index 02bf4e7..0000000 --- a/6924.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 2019450b43511289d45c6b3e7376f2813e1c27b4 Mon Sep 17 00:00:00 2001 -From: Richard van den Berg -Date: Sat, 29 Mar 2025 14:53:45 +0100 -Subject: [PATCH] Add key usage extension to test ca.crt - ---- - tests/certs/expired/ca/ca.cnf | 1 + - tests/certs/expired/ca/ca.crt | 20 ++++++++++---------- - 2 files changed, 11 insertions(+), 10 deletions(-) - -diff --git a/tests/certs/expired/ca/ca.cnf b/tests/certs/expired/ca/ca.cnf -index 1443cb9374..09fcb6de1c 100644 ---- a/tests/certs/expired/ca/ca.cnf -+++ b/tests/certs/expired/ca/ca.cnf -@@ -14,3 +14,4 @@ CN = Self-Signed Root CA # common name / your cert name - - [v3_ca] - basicConstraints = critical, CA:true -+keyUsage = critical, cRLSign, digitalSignature, keyCertSign -diff --git a/tests/certs/expired/ca/ca.crt b/tests/certs/expired/ca/ca.crt -index f08b2d67a5..2c8ebd44ae 100644 ---- a/tests/certs/expired/ca/ca.crt -+++ b/tests/certs/expired/ca/ca.crt -@@ -1,8 +1,8 @@ - -----BEGIN CERTIFICATE----- --MIIDlDCCAnygAwIBAgIUG/CTOPIQbH2BI36TyThUChQyR8wwDQYJKoZIhvcNAQEL -+MIIDpDCCAoygAwIBAgIUQt0yyZmppkHKNx4aXRrmD5tvjbswDQYJKoZIhvcNAQEL - BQAwajELMAkGA1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3Vu - ZGF0aW9uMRgwFgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYt --U2lnbmVkIFJvb3QgQ0EwHhcNMjUwMjE3MDAzODIyWhcNNDUwMjEyMDAzODIyWjBq -+U2lnbmVkIFJvb3QgQ0EwHhcNMjUwMzI5MTM1MTQ1WhcNNDUwMzI0MTM1MTQ1WjBq - MQswCQYDVQQGEwJVUzEjMCEGA1UECgwaUHl0aG9uIFNvZnR3YXJlIEZvdW5kYXRp - b24xGDAWBgNVBAsMD3B5dGhvbi1yZXF1ZXN0czEcMBoGA1UEAwwTU2VsZi1TaWdu - ZWQgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ9lSHzZ -@@ -11,12 +11,12 @@ dqlagCS2jI9dJz8Y3MnMLBmiiXvET6ub/S9u7VdtRxByoHydBEvNMKEMga64PwMe - ztuZ6fX2xPmRnLQIippzfzdxDFHxbUWzjzEQEl+4EGbKX5vPi6A9yL3ofgMi4APZ - C8/YoqAaqzjLIM9KZ/zqT36iQ6wsxBXAacd63L5M8lrAKfZoJeX6uYxNIIfaxQRz - zVxdpVBjHJ/odqoadwKzU7YzN5Fs+6ATNvkrhlUzg1i0MyTGtCdkUIAt/hc6ZrW6 --/kqHpCgUwUc4Dq0CAwEAAaMyMDAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU --CEaIPf7XQsGt0xbf6P9x5cxdKpwwDQYJKoZIhvcNAQELBQADggEBAHMgyQNA3DQG --0l9eX8RMl4YNwhAXChU/wOTcvD+F4OsJcPqzy6QHFh1AbBBGOI9/HN7du+EiKwGZ --wE+69FEsSbhSv22XidPm+kHPTguWl1eKveeWrrT5MPl9F48s14lKb/8yMEa1/ryG --Iu8NQ6ZL91JbTXdkLoBDya9HZqyXjwcGkXLE8fSqTibJ7EhWS5Q3Ic7WPgUoGAum --b5ygoxqhm+SEyXC2/LAktwmFawkv1SsMeYpT790VIFqJ/TVVnUl+gQ2RjSEl2WLb --UO4Hwq4FZbWF9NrY6JVThLmbcr8eW6+UxWfiXHLw/qTRre4/3367QAUQRt7EuEsb --KOWpOS3fbsI= -+/kqHpCgUwUc4Dq0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8E -+BAMCAYYwHQYDVR0OBBYEFAhGiD3+10LBrdMW3+j/ceXMXSqcMA0GCSqGSIb3DQEB -+CwUAA4IBAQBRT21cyZ0Jx0JLA2ilYTLvpMsSryGyWrCOXlmRlBt1MAhmxdTRgCmu -+UB3UU2pfnrC16UeMVVS411lhzjowFXkXrjAqSUBRcetUIYHlpnGgDdUl4dV/X5kx -+HxD9VUBx/QwGeyzFhjzjeN89M2v9kPnhU/kkVfcsafwYiHdC6pwN6zeZNz7JP+GS -+rmI+KVpm5C+Nz6ekm3TR8rFgPIsiDTbY3qj/DNYX2+NhpU1DZfm687vhOr3Ekljx -+NHNu9++STEjGpirrI8EqQnK+FP2fRJ5D82YZM0d++8tmHKpY0+FRCr8//459sgun -+CojmhIobDa2NuF81Jx6Cc7lagCPG3/Ts - -----END CERTIFICATE----- diff --git a/9ebebdef98a6aacfbedcf2ca61ba0eaecc2563f4.patch b/9ebebdef98a6aacfbedcf2ca61ba0eaecc2563f4.patch deleted file mode 100644 index 003973f..0000000 --- a/9ebebdef98a6aacfbedcf2ca61ba0eaecc2563f4.patch +++ /dev/null @@ -1,685 +0,0 @@ -From 9ebebdef98a6aacfbedcf2ca61ba0eaecc2563f4 Mon Sep 17 00:00:00 2001 -From: Colin Watson -Date: Mon, 17 Feb 2025 00:41:30 +0000 -Subject: [PATCH] Regenerate test certificates - -Created using the following command with OpenSSL 3.4.0: - - for cert in expired mtls valid/server; do - make -C tests/certs/$cert clean all - done ---- - tests/certs/expired/ca/ca-private.key | 52 +++++++++--------- - tests/certs/expired/ca/ca.crt | 38 ++++++------- - tests/certs/expired/ca/ca.srl | 2 +- - tests/certs/expired/server/server.csr | 24 ++++----- - tests/certs/expired/server/server.key | 52 +++++++++--------- - tests/certs/expired/server/server.pem | 77 ++++++++++++++------------- - tests/certs/mtls/client/client.csr | 24 ++++----- - tests/certs/mtls/client/client.key | 52 +++++++++--------- - tests/certs/mtls/client/client.pem | 77 ++++++++++++++------------- - tests/certs/valid/server/server.csr | 24 ++++----- - tests/certs/valid/server/server.key | 52 +++++++++--------- - tests/certs/valid/server/server.pem | 77 +++++++++++++-------------- - 12 files changed, 279 insertions(+), 272 deletions(-) - -diff --git a/tests/certs/expired/ca/ca-private.key b/tests/certs/expired/ca/ca-private.key -index 507b1f5623..8aa400e043 100644 ---- a/tests/certs/expired/ca/ca-private.key -+++ b/tests/certs/expired/ca/ca-private.key -@@ -1,28 +1,28 @@ - -----BEGIN PRIVATE KEY----- --MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDHlIhe7GLCeSk8 --RZOKdtmyKns6KdZgGw/LcxPkYvQlu1g0zV8X0DqVr2LdMumWUTNCc9sPdSlAG+He --mQp2TMoWUMumMuwDtit9RT0Sb6Eh9svWgjY9ferovPJRfCWUTsA2Ug8uoh0wyEXK --na7X6fHt5E3B9vj0+b9a4vDibdBXV11FheLT02/uEmAEJDdP/zeBgvVbhcVyumO6 --fAGMIWzR2ukhe8z/ma5H9zoi4gZA8nsK6reZUD8+6affnPe+jIt/AdzggtV9jkWm --zSpr+RHeZ0y+q4eik2ZNUGg4XcF6JsJ9yu/AqLBXxd38uLdFfgyhP2y6K628yzgy --e6lzFyWnAgMBAAECggEAFwzHhzcD3PQDWCus85PwZoxTeQ817BmUBGpBBOKM0gLG --GCsT7XsmGP2NjICBy9OK+QTKawmb/wR5XK0OMUWDHXqtWn+NFIyojyo8+HEeCf8n --4ZleTFHLnJ+d2N1etbc2qc9mY3tjpaurq8/0Tol9YH06ock1TY2+lO+a5HvMURnY --hcWs70CamL+5B/6n67DhjzMtIW3dIXuEEceM1BW/jW8SKq0JHpQ3t+OJwID7zFaJ --bLyOwAVheMzVGvN3yphf8tll3tMA65bNjdOzgOfZSjAy7EGjW3DyAolDw9jKLRyu --E0gw/exNGe618oMIeUDv0KParlL4RjdiUP8l0xYOwQKBgQD3eYj9rWeqZquI9vKP --gaSv6urb2UJLngShZUpEZRNJgBO+Ewiof0w8tpQdsnuMvWudxMLbzgiUNA+NyC/K --CpzIXFkWnWx+A/pxs8ZO8moOfajVRayJgeOLsQZb7c4fXGsVGApbN4+cPNhTNG6d --ucErv6tae/SzAzcLc5Vkw/ELxwKBgQDOdJ5Wl5JeKAvU/3kF6+MYWCrXxZqMjoHS --y1BtyMX5RbdaWTCfDUu1aV3qJOJjjWQ9DJdJQcEsrTjOpD4bVdZx4w/XEG0JXAa3 --jRypVHGdeG/TjhUGJA8U+KX3a1DkcdqM9pqFYRw5Ie95Wz9YRroI+YkixqpK8d7W --C+5BodxXIQKBgCk8Lv9V7XgPM3XW8APJbk+BrTCEuu8unUbnQcCztssAdEmvkjnB --PErBgVyRaNTCmzPmnTFS20sWgaD2QkBAFG+uM4n5ISK+NvTLJ7fv3IwdlAw1V9Jx --uiCElrKqpTXEiHMzVkZss5ks6j6y9duCIBXSEhM5pERPvNRDphjsLTXxAoGARSNC --nyb1Kjjo9XR0V+pNy6pC9q1C+00B5tCVZ55zxe114Hi70pfGQcM+YxnlAoeoCNW9 --mBfAFDESNAlGjyrovIzYkiH7EcZSrYdBEOepgJ2DfWo4Wi0bK9+03K2AknAaS1iO --GJqTtAJMSuymwu40gKroJNA42Q40nKO0LyCARGECgYEAiFRHkblBtStv22SpZxNC --jim9yuM0ikh7Ij1lEHysc/GWb2RQNxQVk54BU2kQ0d9xwMZQTKvpF3VE9t7uGdwt --AasWPr/tWYt35Ud0D4bNlagJJ4Xdslf8n1nkq3qqqDQbd7kkQRgwGzVr0uVg7ZfS --26qSPQ0/aF9nagb5eHX3AuU= -+MIIEuwIBADANBgkqhkiG9w0BAQEFAASCBKUwggShAgEAAoIBAQCfZUh82dF/r9GW -+89IN2vqOiMMuikIAO3SEI3+uSGCdWT13C+NnrFJ7XF/D6UGy1mvm8KfhSnapWoAk -+toyPXSc/GNzJzCwZool7xE+rm/0vbu1XbUcQcqB8nQRLzTChDIGuuD8DHs7bmen1 -+9sT5kZy0CIqac383cQxR8W1Fs48xEBJfuBBmyl+bz4ugPci96H4DIuAD2QvP2KKg -+Gqs4yyDPSmf86k9+okOsLMQVwGnHety+TPJawCn2aCXl+rmMTSCH2sUEc81cXaVQ -+Yxyf6HaqGncCs1O2MzeRbPugEzb5K4ZVM4NYtDMkxrQnZFCALf4XOma1uv5Kh6Qo -+FMFHOA6tAgMBAAECgf9YadXLawbJzLx0/smE5fIVHccmCYqSlmgK46XvBjaREO8H -+GZEJ8IvP4W09PiUzDbzMXLDCRouLZKevtZJB82nRlfjh9l5/2aho/nsytVO6+8yq -+sfK5LNvYQ0Aey7ItosJMJ+bL1ErphHZB+J9Jz3scYaCAC5CFMC+lREVYZEEI9QD4 -+P2D5QbmaSeu8jmL/H3fWHjNXWDprue3W/MIf96NZa3qJew45go4TAYYMe5i757KW -+Ja40VNfmsgbz4uI9oDXaYL/NkWUaQP1lnh+Mfrm1YnBe2wsLcP/WuM5h0bYzJW/1 -+ZeSrZM3fqCMW6SJyrVE1qzqvtw1xQBlrq0B6q0ECgYEA0fi4+ySFGR+mL6k5UjP1 -+roREqQgKaLgdhOvD88EnO93Nl6tJ3Qk8LyzPUNbxe1/xTUEKMtglBKOoxCHJJZlg -+xXnKBAQUtlmrLFKIGe+UCD+r+wfSpS6Sl7BUDmeCSczG9dPN5vnyZA4ixUke2SCC -+k4Eb9Q0AHyNnbXv928r0sfkCgYEAwlZRYmGTVva6cY2YEmMrqbWy4Wxm2Zmdo+Uq -+Xu1RZF9a3tGzNbGsyYdeLNY7vVZoVOm1paMJCA8ScNLFtCux2jEPqwqd1OZ8OLhA -+1VF3/kYtUSdqwLzWoS1RdD6mZCAHeOE+N0pone4lt3A2o8wtpHsaDA+XSTw2rHLR -+LVS+b1UCgYEAtezJ4Ze31pfMdrkpmCa69JVXpBj6Y9c6hGN+aWFuq/k22/WmTuRk -+h/9MNR+3JQ1w1l3HB1ytXkKqxBz92hz1csReG3Kpu4EfxYxQriAdY7Q/P4Z8pXAf -+xVwayEw439aUgIQef8UKllSFHeiH2NrJKCKSZZT5CQG06HCo+Fn1/4kCgYAYuwtY -+TbqGUpefY7l6fYxM6IZ/EWB1SIs7FCq0MdctwsS5nk4EAzxN2SAu7IRlr91PEP7A -+uWKo1+Is4WWva/ASKDQqPAuh0EL2pNv7SYbPoPabYTzAkkdt82puNJrQGxNYWrGk -+L5/omSnLkkghyBX23IOQDVvfQf5jK6la73HckQKBgAI+iLECAkle9HvnJ3flicau -+9FAU1/9pOdM+WogSanhYQ/P2rAwRiyCIkqu62/OoZR5g4kLxWqOOmVvsK3j+gs5F -+FtwN7gauq06MAHnWr6qC8ZltzMsGZTVDvqSH2vgV4T1V6ovVpTBPKQ1gWtABEmpm -+dyfeA6HHeRAHx8VRGpL6 - -----END PRIVATE KEY----- -diff --git a/tests/certs/expired/ca/ca.crt b/tests/certs/expired/ca/ca.crt -index c332b7cb7b..f08b2d67a5 100644 ---- a/tests/certs/expired/ca/ca.crt -+++ b/tests/certs/expired/ca/ca.crt -@@ -1,20 +1,22 @@ - -----BEGIN CERTIFICATE----- --MIIDWzCCAkMCFA9wdtNh/V99DRwYp8vXjPxSjJnWMA0GCSqGSIb3DQEBCwUAMGox --CzAJBgNVBAYTAlVTMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlv --bjEYMBYGA1UECwwPcHl0aG9uLXJlcXVlc3RzMRwwGgYDVQQDDBNTZWxmLVNpZ25l --ZCBSb290IENBMB4XDTI0MDMxMjIxMDQwM1oXDTQ0MDMwNzIxMDQwM1owajELMAkG --A1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3VuZGF0aW9uMRgw --FgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYtU2lnbmVkIFJv --b3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHlIhe7GLCeSk8 --RZOKdtmyKns6KdZgGw/LcxPkYvQlu1g0zV8X0DqVr2LdMumWUTNCc9sPdSlAG+He --mQp2TMoWUMumMuwDtit9RT0Sb6Eh9svWgjY9ferovPJRfCWUTsA2Ug8uoh0wyEXK --na7X6fHt5E3B9vj0+b9a4vDibdBXV11FheLT02/uEmAEJDdP/zeBgvVbhcVyumO6 --fAGMIWzR2ukhe8z/ma5H9zoi4gZA8nsK6reZUD8+6affnPe+jIt/AdzggtV9jkWm --zSpr+RHeZ0y+q4eik2ZNUGg4XcF6JsJ9yu/AqLBXxd38uLdFfgyhP2y6K628yzgy --e6lzFyWnAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAGymNVTsKSAq8Ju6zV+AWAyV --GcUNBmLpgzDA0e7pkVYhHTdWKlGH4GnrRcp0nvnSbr6iq1Ob/8yEUUoRzK55Flws --Kt1OLwnZyhfRoSUesoEqpP68vzWEgiYv0QuIWvzNt0YfAAvEgGoc3iri44MelKLn --9ZMT8m91nVamA35R8ZjfeAkNp2xcz0a67V0ww6o4wSXrG7o5ZRXyjqZ/9K7SfwUJ --rV9RciccsjH/MzKbfrx73QwsbPWiFmjzHopdasIO0lDlmgm/r9gKfkbzfKoGCgLZ --6an6FlmLftLSXijf/QwtqeSP9fODeE3dzBmnTM3jdoVS53ZegUDWNl14o25v2Kg= -+MIIDlDCCAnygAwIBAgIUG/CTOPIQbH2BI36TyThUChQyR8wwDQYJKoZIhvcNAQEL -+BQAwajELMAkGA1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3Vu -+ZGF0aW9uMRgwFgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYt -+U2lnbmVkIFJvb3QgQ0EwHhcNMjUwMjE3MDAzODIyWhcNNDUwMjEyMDAzODIyWjBq -+MQswCQYDVQQGEwJVUzEjMCEGA1UECgwaUHl0aG9uIFNvZnR3YXJlIEZvdW5kYXRp -+b24xGDAWBgNVBAsMD3B5dGhvbi1yZXF1ZXN0czEcMBoGA1UEAwwTU2VsZi1TaWdu -+ZWQgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ9lSHzZ -+0X+v0Zbz0g3a+o6Iwy6KQgA7dIQjf65IYJ1ZPXcL42esUntcX8PpQbLWa+bwp+FK -+dqlagCS2jI9dJz8Y3MnMLBmiiXvET6ub/S9u7VdtRxByoHydBEvNMKEMga64PwMe -+ztuZ6fX2xPmRnLQIippzfzdxDFHxbUWzjzEQEl+4EGbKX5vPi6A9yL3ofgMi4APZ -+C8/YoqAaqzjLIM9KZ/zqT36iQ6wsxBXAacd63L5M8lrAKfZoJeX6uYxNIIfaxQRz -+zVxdpVBjHJ/odqoadwKzU7YzN5Fs+6ATNvkrhlUzg1i0MyTGtCdkUIAt/hc6ZrW6 -+/kqHpCgUwUc4Dq0CAwEAAaMyMDAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU -+CEaIPf7XQsGt0xbf6P9x5cxdKpwwDQYJKoZIhvcNAQELBQADggEBAHMgyQNA3DQG -+0l9eX8RMl4YNwhAXChU/wOTcvD+F4OsJcPqzy6QHFh1AbBBGOI9/HN7du+EiKwGZ -+wE+69FEsSbhSv22XidPm+kHPTguWl1eKveeWrrT5MPl9F48s14lKb/8yMEa1/ryG -+Iu8NQ6ZL91JbTXdkLoBDya9HZqyXjwcGkXLE8fSqTibJ7EhWS5Q3Ic7WPgUoGAum -+b5ygoxqhm+SEyXC2/LAktwmFawkv1SsMeYpT790VIFqJ/TVVnUl+gQ2RjSEl2WLb -+UO4Hwq4FZbWF9NrY6JVThLmbcr8eW6+UxWfiXHLw/qTRre4/3367QAUQRt7EuEsb -+KOWpOS3fbsI= - -----END CERTIFICATE----- -diff --git a/tests/certs/expired/ca/ca.srl b/tests/certs/expired/ca/ca.srl -index fab68405ed..0d6f69d6fe 100644 ---- a/tests/certs/expired/ca/ca.srl -+++ b/tests/certs/expired/ca/ca.srl -@@ -1 +1 @@ --4F36C3A7E075BA6452D10EEB81E7F189FF489B74 -+4F36C3A7E075BA6452D10EEB81E7F189FF489B83 -diff --git a/tests/certs/expired/server/server.csr b/tests/certs/expired/server/server.csr -index 5e3c177647..d8ba3a5bf2 100644 ---- a/tests/certs/expired/server/server.csr -+++ b/tests/certs/expired/server/server.csr -@@ -2,18 +2,18 @@ - MIIDHjCCAgYCAQAwbTELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkRFMSMwIQYDVQQK - DBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlvbjEYMBYGA1UECwwPcHl0aG9uLXJl - cXVlc3RzMRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IB --DwAwggEKAoIBAQCKulIMpo633iCgbkKv1UoiLC4sQt5xWpgguujywu3hLYwmPFp9 --kvPt//imqtl8FhuhKqJ8FCGrVl2YIGj1RJIB3GW7MSPNCuIBFL/gwNi35LxDPtoA --IPyXytIR7VH9+ch9DFInJaoA/BekMuKvbXk54VW9whpHbwkXSG2lBS2vKL0XemYh --9VjvtuRDji2iOZpznlVE2PEN80bojArp6oYKakv2kYzgzgxAJiI/NZGvC7mbSI4e --ja7ad3R9G0kB1FzNj36jrNO5WtxHO/mrRiXSpDeyUbitYvt0HKoM0vhTnOR+BspP --IltfwOQh8qq2Q2AaMHNcVjMH3gHCZADfhk/zAgMBAAGgbDBqBgkqhkiG9w0BCQ4x -+DwAwggEKAoIBAQDcRRwk8IU1YoNu8CHzB5Vh8HP/yLfBtU69LLZq+7rDG31JlR5s -+lmcwLLoZ8opUQ5rg8JMRZ7toh5zB4Uc0B4Sg8RhQMSOZYBIJkXdHuqQkciR0vWnN -+vD/5CkWEhnj4dxE7xTbDufBlxmwAthC/u72UIsZHavAyLCBqsONa7xuTiogz/d+3 -+G+525JrfVr05hhJpT4Ypx5YY+ABkIOuOk/XuudbGm5SquuX6BgjmgaGtDjAuE/Rn -+BnliIavCDrG0v3KGbG3Xxt7lFTu+98foForwGCbbQBraty27oZrzAtLltfIHlJRn -+jPz0JA9akNDhAihxEsTUhk2d7jFszsd0Ev7DAgMBAAGgbDBqBgkqhkiG9w0BCQ4x - XTBbMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgWgMBMGA1UdJQQMMAoGCCsGAQUFBwMB - MCwGA1UdEQQlMCOCCWxvY2FsaG9zdIcEfwAAAYcQAAAAAAAAAAAAAAAAAAAAATAN --BgkqhkiG9w0BAQsFAAOCAQEAfAhEhrulsZae71YFqgvzwJHm/hzXh47hErtgDXVJ --mFqAxgF6XrnzYujlt3XQXUx/8vdrU7jH+Pe8WO1rDvFwRPMDGoBF3RX29SzyX/2F --e102egnoRR+Hlf0Ixqu0CuTjEVnD+g4mRgXhV7LPKP4W6qGwzcVbaJ3c/zRcfqNR --g9gN6Q6Qt4fXDc7wlx2T3nOszBLQ2XCsIyzVtOJ2sSuadqKH9Aj+mrkrLBdzVFHD --FHnTMJ0t0+anZwd+AWDNsCr5lIwBGL634zw7/yJepMHuPFd2X24S3u8EaWPkfVQn --lV6rLQMGjXYTe2xuYzlUCUYnKvkyPTMjSXDkxWa+WSNwyQ== -+BgkqhkiG9w0BAQsFAAOCAQEAVVIxJlDrgeG0bOSufgVVRqDQx7XSd15mGlT+CynM -+lEFJ3Q9k98T2vRNNGVYYYZAnbdSOW9ACwWGcYm2bzIjbgZV0H2Kz0dLD/GrNuEY+ -+O9j6K2toFKc57G7UUkve+N74ldq+hkR4zbb6FQmTlnL2YaPp2dv5TxdMKfHEfPNf -+Bg8xpbXdoRc7CYW1ZACme+d2U063GVqQsrIfwGJ+BtE6aNo62T/oEm+G4Wy5iBay -+jNv/imwf+JKQ75bTvha9YLUg2scqdYwJj8JlBw7cvkBIHW8GydA3fX4dtV9YBbFi -+8RTlWhhLgCXpYbLoDGOqF6f/MuPSIGkV1wVhCUfYA+p+Gw== - -----END CERTIFICATE REQUEST----- -diff --git a/tests/certs/expired/server/server.key b/tests/certs/expired/server/server.key -index 27ddafd1ca..c48457b39a 100644 ---- a/tests/certs/expired/server/server.key -+++ b/tests/certs/expired/server/server.key -@@ -1,28 +1,28 @@ - -----BEGIN PRIVATE KEY----- --MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCKulIMpo633iCg --bkKv1UoiLC4sQt5xWpgguujywu3hLYwmPFp9kvPt//imqtl8FhuhKqJ8FCGrVl2Y --IGj1RJIB3GW7MSPNCuIBFL/gwNi35LxDPtoAIPyXytIR7VH9+ch9DFInJaoA/Bek --MuKvbXk54VW9whpHbwkXSG2lBS2vKL0XemYh9VjvtuRDji2iOZpznlVE2PEN80bo --jArp6oYKakv2kYzgzgxAJiI/NZGvC7mbSI4eja7ad3R9G0kB1FzNj36jrNO5WtxH --O/mrRiXSpDeyUbitYvt0HKoM0vhTnOR+BspPIltfwOQh8qq2Q2AaMHNcVjMH3gHC --ZADfhk/zAgMBAAECggEAFSF9RvUFzyb0BEvXN44+/QaKv+4tkMmSW4Xs3rFnZ4G3 --E8nkpLUCF9ICD2z9tKNvcPScDFdKq5z7o6ToJ9faf5MRIdrBz8UlGLIO6g6l1Bjw --vjNwJE3h+8MGjXl/IDbwXW/HgbQAeabsePPRSJRdvz2+ACn1M8VLdrLvFJA93ayW --+n3Bk0bXdsrzqBGdoDiNzmIHI3WqdONiR9TymuJe41NJtMKxQDF+c6Y1n/X1OtBk --s9L+u9Xr+R3H72xSYrf1KH1mFZJfTnIPoOmdEU2tVZnZj03rZhT7p8R1fVNX6OHu --NX1Dy9VA6J7dbcqdPvTI743ByQeb+hNnqI/3hmV5eQKBgQC++1Wn3v/dxtczjA+I --tN4a7zyjhazpB25lde55HVfCQPxmYxIYct+j6S0JkMaoLrjiEDb4pnu4Gt4MDqZa --r0Xm8t3wD1YKUUbhpBEGvsMhAEZEIsBOcwkTiEwsoF0mKFa2mTyqAImgIQa8uFt8 --Y/oTj55XFe1x6pZKEJRg+K+QSwKBgQC59ONVkMSBirLGS+G+b2kqiBdwZB/3s3wr --feS1xTa+deL3AChnKT9+MsVqOkxdE2TRj/mAeF+5Woa5bPMvgr9Kl7u8bulTH80l --YA/N6FneO11/ncnkgK9wN54kd5TiOtGsGB5S5t/nEAIMUIwWrM/cRau72xNEWOhT --Tvw7TOSF+QKBgQCa/texeiYmE24sA4vH4yIuseKAw8hlBwbtiRyVZt8GZD9zyQuy --k+g02tUWYk0XyXN65LX4bwURkZyMJIeWKZGNsaW1YnzturDQB5tZ4g/zBIoCWkHA --aVQAaimIPk3a3foiD5NQVUdckfEp0GVPOsSGg5R6EO23+i8mxPXnDW1OqQKBgGvf --lelTO8tyLFdAOcqBUt6rZ/1499p3snaAZ6bSqvk95dYnr0h48y5AQaln/FiaIYg4 --HyLZsZ4S18jFXSWYkWOyNeQP6yafciBWY5StT0TN52VaoX3+8McGXKUHAcVjHbLZ --ou2wpP6jmKyQJVQaF9LOT9uAMOMbOFrrnQLBjmfxAoGAQAnUhMFG5mwi9Otxt6Mz --g+Gr+3JTlzwC3L7UwGdlFc3G2vSdGx/yOrfzpxPImfIBS95mibDfdvEBMer26pvw --a/ycqybyX9d/5nPDIaJ1lc4M4cbHC/cB52JI6avr/1g8OMK7lR7b/FsPVHS1w8kl --n6uwEjVt2+gP2o9DFTGs158= -+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDcRRwk8IU1YoNu -+8CHzB5Vh8HP/yLfBtU69LLZq+7rDG31JlR5slmcwLLoZ8opUQ5rg8JMRZ7toh5zB -+4Uc0B4Sg8RhQMSOZYBIJkXdHuqQkciR0vWnNvD/5CkWEhnj4dxE7xTbDufBlxmwA -+thC/u72UIsZHavAyLCBqsONa7xuTiogz/d+3G+525JrfVr05hhJpT4Ypx5YY+ABk -+IOuOk/XuudbGm5SquuX6BgjmgaGtDjAuE/RnBnliIavCDrG0v3KGbG3Xxt7lFTu+ -+98foForwGCbbQBraty27oZrzAtLltfIHlJRnjPz0JA9akNDhAihxEsTUhk2d7jFs -+zsd0Ev7DAgMBAAECggEAUZjCX8a/ufJ3+OE42lQdWO4fsonS1I3LENYe70u4OC2X -+QGpenmAq8pQnDpSj/KocliZYfLKeII9YGRRQcaw1S/9z/8TsSJVnqSa7dpVj1+J2 -+sc43AxEw65sL/Jdp+bT169vXOTNIpBMYkDzhwH0WMemd5Pfu6c8h5RQI7Pc1knYn -+nPNY848qSYCWOUjZS3QmBik/gp9X//yxVCyvxB3xVnb1cpvc952D90Va6nFIWfgN -+ix4NgFgAvwIxCFpWI2z7JF8uBdAHPeFAx8pFukQpAzwhaEILlgt3WbvEob9CsdP5 -+E39SUkzxiIfVM1du+hRquk9SJ/X56OSLnEjxLarSIQKBgQDyVU00yrv7lG7TJLZ5 -+YyfE20A7eUtYdcfatTKfsxKO4KVV+p0mGsNnFhhKziuT5/xtVunbUNFEOaUfmTUP -+dCjy4XkDbE/ufxzIm1WTSqknUluVoJRWKmLI5gbDFxu/XGRQNLxQbMK54l3N69PT -+EO4kz/jqBYbd4aEmtaSx2R8JowKBgQDosUTgBGDxDE2ODPVoXc+YjReOmVHvGMKK -+tA+KDBEs4spxaqhH0OFh6mewx3jA4VHbcIgM50STXrq1VL/QqYclDlY9/VWzkmqp -+2Ekc4NoAl3H022pgcbmXx3qapC4Z3hokNFOlbtD9xQf9NMx6c5djTKMYTBrBBWXH -+oFhSz6PIYQKBgQCMGqkydmvMffq89CLTd3JMq/4s5GmdUSsk1VHZZuy50kOEvAoT -+N7H1bZ7J0Pz83Eji5jb6Z3U1nqZK6Ib20k/CbH1Mb1ifKLp5eOU27Rly9Hiiv15D -+munWALe0Hy4Zqs8MWBDv5pGGasuU/F1RUB5/BgaBNoTMz2AeQzJe6Iq7RQKBgCca -+Ku3OLpAzNhEp4k9wfEMxaoT/BMK+EWsHiRj0oCo/zi8y8iZnVoiCwHv3eTZIZt4O -+Uf6BGof9QjjYjgc9hcVXXGy8Vpt/fkceXmLo8hlpWbAA8yZT1hFIZzT3Y/va09/D -+n07MiXgrlQUay0XEiOsZ5Mpfd5t6EblzG4SG+gnhAoGAZ+shbacxhji7cUUYJLrO -+9uZJCDCZiyq8yZ+lMzX1kILQwaP6VmSvF4TzKrkrCuD2HzUYcqebko/TvckeTp/a -+oYC2put3zt0CHBf/keeeJwjhff19qVyE9mpZwoo7PuS5zmM7pQOLxzCyAM9MdsCz -+kmnbborcfh74fkfRcwXm6G8= - -----END PRIVATE KEY----- -diff --git a/tests/certs/expired/server/server.pem b/tests/certs/expired/server/server.pem -index 05a2a4dac8..8304c04e49 100644 ---- a/tests/certs/expired/server/server.pem -+++ b/tests/certs/expired/server/server.pem -@@ -1,41 +1,44 @@ - -----BEGIN CERTIFICATE----- --MIIDXjCCAkYCFE82w6fgdbpkUtEO64Hn8Yn/SJt0MA0GCSqGSIb3DQEBCwUAMGox --CzAJBgNVBAYTAlVTMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlv --bjEYMBYGA1UECwwPcHl0aG9uLXJlcXVlc3RzMRwwGgYDVQQDDBNTZWxmLVNpZ25l --ZCBSb290IENBMB4XDTI0MDMxMzIxMTQ0NVoXDTI0MDMxMzIxMTQ0NVowbTELMAkG --A1UEBhMCVVMxCzAJBgNVBAgMAkRFMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUg --Rm91bmRhdGlvbjEYMBYGA1UECwwPcHl0aG9uLXJlcXVlc3RzMRIwEAYDVQQDDAls --b2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCKulIMpo63 --3iCgbkKv1UoiLC4sQt5xWpgguujywu3hLYwmPFp9kvPt//imqtl8FhuhKqJ8FCGr --Vl2YIGj1RJIB3GW7MSPNCuIBFL/gwNi35LxDPtoAIPyXytIR7VH9+ch9DFInJaoA --/BekMuKvbXk54VW9whpHbwkXSG2lBS2vKL0XemYh9VjvtuRDji2iOZpznlVE2PEN --80bojArp6oYKakv2kYzgzgxAJiI/NZGvC7mbSI4eja7ad3R9G0kB1FzNj36jrNO5 --WtxHO/mrRiXSpDeyUbitYvt0HKoM0vhTnOR+BspPIltfwOQh8qq2Q2AaMHNcVjMH --3gHCZADfhk/zAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAGeQdB4+iDbJ78eKhCMV --49Cm8nyYi9215rRRJ24Bw6BtVw1ECwymxLVOEB0gHCu8kKdsFnniFBtChts/ilFg --blIyPKTsb3+kQW9YV9QwVdFdC4mTIljujCSQ4HNUC/Vjfnz85SDKf9/3PMKRr36+ --GtSLIozudPvkNmCv68jy3RRXyCwWHc43BLMSZKPD/W+DEuXShI9OIpIlSLBx16Hz --4ce3/1pGuITWcsw6UcRqW31oPR31QmNs5fsq5ZCojDNFzEFCA1t9LiR6UOftFUKy --yOZWfZeAGGdK75U+XDqS9Xkr5/ic5jE0I5rT7e7r3lpvQdgIj8lSx493fczLOGHr --YA0= -+MIIDpzCCAo+gAwIBAgIUTzbDp+B1umRS0Q7rgefxif9Im4EwDQYJKoZIhvcNAQEL -+BQAwajELMAkGA1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3Vu -+ZGF0aW9uMRgwFgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYt -+U2lnbmVkIFJvb3QgQ0EwHhcNMjUwMjE3MDAzODIyWhcNMjUwMjE3MDAzODIyWjBt -+MQswCQYDVQQGEwJVUzELMAkGA1UECAwCREUxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0 -+d2FyZSBGb3VuZGF0aW9uMRgwFgYDVQQLDA9weXRob24tcmVxdWVzdHMxEjAQBgNV -+BAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANxF -+HCTwhTVig27wIfMHlWHwc//It8G1Tr0stmr7usMbfUmVHmyWZzAsuhnyilRDmuDw -+kxFnu2iHnMHhRzQHhKDxGFAxI5lgEgmRd0e6pCRyJHS9ac28P/kKRYSGePh3ETvF -+NsO58GXGbAC2EL+7vZQixkdq8DIsIGqw41rvG5OKiDP937cb7nbkmt9WvTmGEmlP -+hinHlhj4AGQg646T9e651sablKq65foGCOaBoa0OMC4T9GcGeWIhq8IOsbS/coZs -+bdfG3uUVO773x+gWivAYJttAGtq3LbuhmvMC0uW18geUlGeM/PQkD1qQ0OECKHES -+xNSGTZ3uMWzOx3QS/sMCAwEAAaNCMEAwHQYDVR0OBBYEFFK1WmMqRSzUD2isk8TL -+M3JfsVczMB8GA1UdIwQYMBaAFAhGiD3+10LBrdMW3+j/ceXMXSqcMA0GCSqGSIb3 -+DQEBCwUAA4IBAQCekjxplL/AI32WtODgw7FpTXNXdyNy8PWEhn3ufL0MqiyseYOZ -+bIa0PAecsArlKs5hXJzB7p/hu5CZdvaCButw1jyWQBySCpeJXn3FmGdTkBvhwBHv -+y6npmBoy/nbLkIRNRcoLbALlfn/0iGWfmDTRblT7vRNWJmZCZCTA/+ILXJ36ItbF -+3JCs3ARF6XWORuZs5Y8cNloOy2brAC/4EHnTfOZBQf8cL8CfHlcNa+nbG1j+wVNO -+60e/0v9zTxa2wNzdnLBCW4rqJFJ44aGClxat5tWuypv0snA/0xrqIYWTQGXZPVT6 -+rET47dfVbj1QxmW3sAyuy5PskZA9T7pOhcjR - -----END CERTIFICATE----- - -----BEGIN CERTIFICATE----- --MIIDWzCCAkMCFA9wdtNh/V99DRwYp8vXjPxSjJnWMA0GCSqGSIb3DQEBCwUAMGox --CzAJBgNVBAYTAlVTMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlv --bjEYMBYGA1UECwwPcHl0aG9uLXJlcXVlc3RzMRwwGgYDVQQDDBNTZWxmLVNpZ25l --ZCBSb290IENBMB4XDTI0MDMxMjIxMDQwM1oXDTQ0MDMwNzIxMDQwM1owajELMAkG --A1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3VuZGF0aW9uMRgw --FgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYtU2lnbmVkIFJv --b3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHlIhe7GLCeSk8 --RZOKdtmyKns6KdZgGw/LcxPkYvQlu1g0zV8X0DqVr2LdMumWUTNCc9sPdSlAG+He --mQp2TMoWUMumMuwDtit9RT0Sb6Eh9svWgjY9ferovPJRfCWUTsA2Ug8uoh0wyEXK --na7X6fHt5E3B9vj0+b9a4vDibdBXV11FheLT02/uEmAEJDdP/zeBgvVbhcVyumO6 --fAGMIWzR2ukhe8z/ma5H9zoi4gZA8nsK6reZUD8+6affnPe+jIt/AdzggtV9jkWm --zSpr+RHeZ0y+q4eik2ZNUGg4XcF6JsJ9yu/AqLBXxd38uLdFfgyhP2y6K628yzgy --e6lzFyWnAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAGymNVTsKSAq8Ju6zV+AWAyV --GcUNBmLpgzDA0e7pkVYhHTdWKlGH4GnrRcp0nvnSbr6iq1Ob/8yEUUoRzK55Flws --Kt1OLwnZyhfRoSUesoEqpP68vzWEgiYv0QuIWvzNt0YfAAvEgGoc3iri44MelKLn --9ZMT8m91nVamA35R8ZjfeAkNp2xcz0a67V0ww6o4wSXrG7o5ZRXyjqZ/9K7SfwUJ --rV9RciccsjH/MzKbfrx73QwsbPWiFmjzHopdasIO0lDlmgm/r9gKfkbzfKoGCgLZ --6an6FlmLftLSXijf/QwtqeSP9fODeE3dzBmnTM3jdoVS53ZegUDWNl14o25v2Kg= -+MIIDlDCCAnygAwIBAgIUG/CTOPIQbH2BI36TyThUChQyR8wwDQYJKoZIhvcNAQEL -+BQAwajELMAkGA1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3Vu -+ZGF0aW9uMRgwFgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYt -+U2lnbmVkIFJvb3QgQ0EwHhcNMjUwMjE3MDAzODIyWhcNNDUwMjEyMDAzODIyWjBq -+MQswCQYDVQQGEwJVUzEjMCEGA1UECgwaUHl0aG9uIFNvZnR3YXJlIEZvdW5kYXRp -+b24xGDAWBgNVBAsMD3B5dGhvbi1yZXF1ZXN0czEcMBoGA1UEAwwTU2VsZi1TaWdu -+ZWQgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ9lSHzZ -+0X+v0Zbz0g3a+o6Iwy6KQgA7dIQjf65IYJ1ZPXcL42esUntcX8PpQbLWa+bwp+FK -+dqlagCS2jI9dJz8Y3MnMLBmiiXvET6ub/S9u7VdtRxByoHydBEvNMKEMga64PwMe -+ztuZ6fX2xPmRnLQIippzfzdxDFHxbUWzjzEQEl+4EGbKX5vPi6A9yL3ofgMi4APZ -+C8/YoqAaqzjLIM9KZ/zqT36iQ6wsxBXAacd63L5M8lrAKfZoJeX6uYxNIIfaxQRz -+zVxdpVBjHJ/odqoadwKzU7YzN5Fs+6ATNvkrhlUzg1i0MyTGtCdkUIAt/hc6ZrW6 -+/kqHpCgUwUc4Dq0CAwEAAaMyMDAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU -+CEaIPf7XQsGt0xbf6P9x5cxdKpwwDQYJKoZIhvcNAQELBQADggEBAHMgyQNA3DQG -+0l9eX8RMl4YNwhAXChU/wOTcvD+F4OsJcPqzy6QHFh1AbBBGOI9/HN7du+EiKwGZ -+wE+69FEsSbhSv22XidPm+kHPTguWl1eKveeWrrT5MPl9F48s14lKb/8yMEa1/ryG -+Iu8NQ6ZL91JbTXdkLoBDya9HZqyXjwcGkXLE8fSqTibJ7EhWS5Q3Ic7WPgUoGAum -+b5ygoxqhm+SEyXC2/LAktwmFawkv1SsMeYpT790VIFqJ/TVVnUl+gQ2RjSEl2WLb -+UO4Hwq4FZbWF9NrY6JVThLmbcr8eW6+UxWfiXHLw/qTRre4/3367QAUQRt7EuEsb -+KOWpOS3fbsI= - -----END CERTIFICATE----- -diff --git a/tests/certs/mtls/client/client.csr b/tests/certs/mtls/client/client.csr -index 9a5713d5c7..35c8c2f325 100644 ---- a/tests/certs/mtls/client/client.csr -+++ b/tests/certs/mtls/client/client.csr -@@ -2,12 +2,12 @@ - MIIEGjCCAwICAQAwbDELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkRFMSMwIQYDVQQK - DBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlvbjEYMBYGA1UECwwPcHl0aG9uLXJl - cXVlc3RzMREwDwYDVQQDDAhyZXF1ZXN0czCCASIwDQYJKoZIhvcNAQEBBQADggEP --ADCCAQoCggEBAMn3iQycTjUzpKJChRNkcm33UB282cUwpxeqKN4ahHxBpS09HRhk --cQYO7yErEUQwzQnBQEcIpzzeIMZIqHuCkgnySjeEJd95AIzNzGyoLLkS51TcJwgR --v83AvT8ljA88s9h38qGTy4/TCxJgf76pfHIuC1qoKVQh3AuHj9nOxIZLUsrdDbWF --WoLqKSVyTby+RXvSAppAR+cuBCaWStQ6xFORn48RHfc6t30ggD4rDAjyU6Vz6oR8 --ot3XmGdK0h42UdqidUWkRJajEbpkCnQSXS21IvfXKxF5sFqAXJrj9iVbUfpNPpaa --W8IrHByngyV8amazGZrASstUVRFtWrnrcWECAwEAAaCCAWcwggFjBgkqhkiG9w0B -+ADCCAQoCggEBAJrdvu5kvCy5g6w67gczETk/u6K0UBmf6Mv0lqXCp3Voyt5fv6SI -+/OPWrFV1+m4imNe5bLM7JUoUfkqkmULsjTTh7sxVLjW226vLSYOWWy7PA+OSwUTN -+LjydF1dazlPedHPYdmhVShCmyoOd1pUCDQn0/4cEA/WW4mtzZImmoCf/pyAM3XAC -+9RBcSSJRywOTe6n9LY6Ko0YUW94ay2M4ClVblDxswDemaAsLFuciKmi53gKx4H/l -+areo8p60dgubooiMbcc4E9bzp0oJpfh7xhwKeJtCNEpOik1AiiQIZtwqmkkIHvtI -+Go3SZ7WAQU9Eh2r+u3E6aSl+N0PMXK4Y4JsCAwEAAaCCAWcwggFjBgkqhkiG9w0B - CQ4xggFUMIIBUDAJBgNVHRMEAjAAMAsGA1UdDwQEAwIFoDATBgNVHSUEDDAKBggr - BgEFBQcDAjCCAR8GA1UdEQSCARYwggESggsqLmxvY2FsaG9zdIcEfwAAAYcQAAAA - AAAAAAAAAAAAAAAAAYZNc3BpZmZlOi8vdHJ1c3QucHl0aG9uLm9yZy92MC9tYWlu -@@ -15,10 +15,10 @@ dGFpbmVyL3NpZ21hdmlydXMyNC9wcm9qZWN0L3JlcXVlc3RzL29yZy9wc2aGTXNw - aWZmZTovL3RydXN0LnB5dGhvbi5vcmcvdjEvbWFpbnRhaW5lcjpzaWdtYXZpcnVz - MjQvcHJvamVjdDpyZXF1ZXN0cy9vcmc6cHNmhk1zcGlmZmU6Ly90cnVzdC5weXRo - b24ub3JnL3YxL21haW50YWluZXI9c2lnbWF2aXJ1czI0L3Byb2plY3Q9cmVxdWVz --dHMvb3JnPXBzZjANBgkqhkiG9w0BAQsFAAOCAQEAwP1KJ+Evddn2RV1FM6BFkoDK --MPDO9qwb8ea3j57SIJXZlpw168DljmuGzxJw9oys2O6FYcspbHIocAkfFwiYgVAr --NEog6xlCdPxNBJgC3YFIKwnmBjMPG6ZCWiJn940qTbaJ/j6ZviN17uW4K7Sl+THp --IkMv29uQTWkfg+GbZ9q1hm2m2GHhYLGLAUdJdtv7JI+yq5uxdsWaCANpH6kc8SnK --2rik6D3iItDhHCmToHBpdEnP8J+KDzf5pJrv/g3WH8XVrl4ZzBsOhmciWF4C3Hbf --9eu8eAsp1AsIrZOEGTfClBd7vFCES5DmI0/iRs4czQooqZPnHjOw3Azp/LujrA== -+dHMvb3JnPXBzZjANBgkqhkiG9w0BAQsFAAOCAQEAMOwYPyq+OpMRQUAgoRjfxTQO -+DiqfBzCsjUsPAacLTtebbWBx8y6TkLSb+/Qn3amq3ESo4iBqKpmVwdlAS4P486GD -+9f78W3zkZ29jGcnQ+XHb7WvPvzBRoXImE276F9JGqJ+9q39Cbxzh0U2+ofBx2iGY -+sSutzU0B/l/FKZRc8thuFoeKqHwVePLGD9p2+2nYI9I08QoGqEokTcFAq0tZ858F -+9PdxBZYOKOMpnLZhiJ8qZo23v3ycBXPOjg5ILtQ9EzHoNEA5Mxx/mfNLKJ0NktZD -+KXANLWKbXm+w9gTcBLtCPWNeqj5DIGPsHSfq/Bmjbp/o+uOJs6oq3s5rA7WrAA== - -----END CERTIFICATE REQUEST----- -diff --git a/tests/certs/mtls/client/client.key b/tests/certs/mtls/client/client.key -index 8107125399..b6cea90813 100644 ---- a/tests/certs/mtls/client/client.key -+++ b/tests/certs/mtls/client/client.key -@@ -1,28 +1,28 @@ - -----BEGIN PRIVATE KEY----- --MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDJ94kMnE41M6Si --QoUTZHJt91AdvNnFMKcXqijeGoR8QaUtPR0YZHEGDu8hKxFEMM0JwUBHCKc83iDG --SKh7gpIJ8ko3hCXfeQCMzcxsqCy5EudU3CcIEb/NwL0/JYwPPLPYd/Khk8uP0wsS --YH++qXxyLgtaqClUIdwLh4/ZzsSGS1LK3Q21hVqC6iklck28vkV70gKaQEfnLgQm --lkrUOsRTkZ+PER33Ord9IIA+KwwI8lOlc+qEfKLd15hnStIeNlHaonVFpESWoxG6 --ZAp0El0ttSL31ysRebBagFya4/YlW1H6TT6WmlvCKxwcp4MlfGpmsxmawErLVFUR --bVq563FhAgMBAAECggEABhWX97JJxN6JFNOjhgGzqiPA3R8lrFlv3zhNbODS9u9U --q404xYBZIKaYhkucLzgNJUBrevhZbsL+V8WJQIH0JlU57nw5ATIjAHA+uqiXraen --zRhTcLHK28b1AeRUA4LU+YN7jWnnawN075kf9WgjtfOJ0gcDimOkE7uCFjyyvPJA --LG9bG+8enGjvUleKXNgmwP4Sq/GlEdGz9Qy+8ga3mtfAULUWe8haFNZXK8CN3xPp --wmVqy7QzgH2TGN1p6Dyxib9ksSN/lOg0dShL8zgu+QXDNx2VwmVrI8Vr02vmB//0 --bYxCo5pfICPIFLjLl5yo30dvrUfYqF29PperStHGlQKBgQD/TdemlLjJNP0fvSs7 --KEVJj/22YuHK+wurNr2ZFbSdcF3v9sfiwysllmEyGr5cNYA56uUbfG+8VSw7kDll --G+6BKK2UdlPH++6RahqWLqo4k6rsNrkq7elj8xG4gIjR5qzu2uLpjNwp2BGmIoUI --eb1NcLfTlMcNCooV8RHjm1Z5WwKBgQDKhHkUPDcJm2/9Ltq2NZQMrCS7o4LV2uAI --GhGpISfY+SfHkQQNZ9Fvbe6hrFeZs31nAvlTDpPEg/LGSVKA5I2EZT9gwzAQU1TD --Cyol4xqqWFWlwze7w+RLYqX5LtXf7NJg2m5p+ZOoOzzqvTVpodDxqTlCNp2/6ICP --vAIvWhbA8wKBgAYlr62ZIyHlHrsm6OWRwKlWyDseAmXKyasjtEj9Vs37qKdgf8ub --+2v6RPjZ3/+EYkQCveV9h4s3WctNW7Rtib6eZh+PAdFs5X+m2GEJWpvmIlVxs9+u --vtHjRmf04FZ9gWh26MPK2no/c51Wc3GSzNYSgrqbeHd963k/xrh+QwTFAoGAZZjb --3UjwG4O9RPjyhCKQ6WKa8v9urbamWaoqXfziLrmgOUAJFmiU6x/tbXI2aEdhjAIz --7nULsLS5YLx8BWmjjV3106dYP3hut4KsXGF4iSjTnts25J27tA4DUeUrKrF2QVyT --s9qfNvCw+Np/J0Uku3e33/3iWdpcVL9vIS5C5/0CgYBEuxb3dffNRqEiNkpOUrCD --mQTqbO3X+hin9zT3GrxQE+7KpfCfdDIqdK6c5UWHirR3HUjUPZmIFLSx8msfLl3k --hgQw37NMV+asg0Wy3P908qbtnEA2P6aDOMQeHJoC7qEHIDOcOQ1KP3FMvOrdscwS --f0IIDygTH6fYr329s0iXjg== -+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQCa3b7uZLwsuYOs -+Ou4HMxE5P7uitFAZn+jL9Jalwqd1aMreX7+kiPzj1qxVdfpuIpjXuWyzOyVKFH5K -+pJlC7I004e7MVS41ttury0mDllsuzwPjksFEzS48nRdXWs5T3nRz2HZoVUoQpsqD -+ndaVAg0J9P+HBAP1luJrc2SJpqAn/6cgDN1wAvUQXEkiUcsDk3up/S2OiqNGFFve -+GstjOApVW5Q8bMA3pmgLCxbnIipoud4CseB/5Wq3qPKetHYLm6KIjG3HOBPW86dK -+CaX4e8YcCnibQjRKTopNQIokCGbcKppJCB77SBqN0me1gEFPRIdq/rtxOmkpfjdD -+zFyuGOCbAgMBAAECggEABHa5xyNOLTfXrMIyFDELoQvOO71YxbRPQHm3UeXPb9nq -+Zwh5fKOaLnMEmp4A7uW+ZBFrKatdwsnebgZaiIxK8ahFesxFvbScllIQt2NBE5NR -++GBFg9cqKwMYJiNu6Qnzb1dg6lbzAJHeKncFNVxOxeey6dBa0NxdgF1eG32bBiwT -+yIr6JO7cK5JfcExls5yxdZMZiW08quaeFMQR6Wocod2caDgJUBVbZwivEoNI3ak4 -+/kzQaxvRoDMM8uN3LrVH2YUJgURUxSbpOLu8ycZtfg8JRArprUYI0P0OD6iDlly1 -+3FhJXqBEY0dWQPmZKP/Elt3ywC1oncW+AqPh9cchiQKBgQDMriOKoBrTmplw0kbo -+EEuxTU1A23BqcZfn2+PoUww6UxOvStL/s7iupjl3g4CXw0RgIfyOuJQldLdq7mh6 -+W7BpK855fH2CLy1VMdIFY1umHSgJ5Bayd5NmyKdfORUw88PTFFSARYyr5DDqufWg -+jI77BMjqHtbyujQKspV+9U66ZwKBgQDBsi5YptfaqMdzh343G5zAtCiGCd3m9NZO -+atEEvgq9LKqEVwvJ/FD+3QPAS1MN+ms9KcfJ3G05VUhhEsPGRKibgcE0FNA/VBDO -+jS2HK6kZ1M0clC5kHmQfLZxp1q3tA5nW6zqjVFdqYzJsis7G5YxFKhnzui0lgP6V -+I1Io+3QvrQKBgQCK6D+sq92o8AnkfICsq6qDCKA+PO68/pyGOUAiAoKQ7qK0W0Z5 -+TMIwnRTxHCjgViAIUehx/6hjByQXiPcU2zcNGTLGVgtjl5rfb7FGANlJEg6DL+2L -+bwV1QwX75OSR1U136hsy9oByg6oDEvM040+B4gxsf0OHdYEuJWa5w8eLTwKBgCJt -+CM+416SFWu2tp0EkJzgYzRsFpermmTBWy8+L91yoE6Zx0iaUMdEadxA2Uwyo9WZp -+hpjaFI+cGMEoFKOokE8TQMOA74JR7qrHbNAZcnSk3c+2hohE3oasFKC7By6Y9T69 -+kC53TxIZj1y7TwUKx2ODmBk5fcysoJLhNDkUeBIBAoGAQ/YMeMN/pSvTDCPhubbk -+9bF0SwoN6DWrzw7gzMMhHlVSPM4fjdBA+wXbhnYF7hiNan7uShtRHVhwyfj+glBz -+KIkDxETjxTWx5mbo3tNf8xEMsbHZBe8KPlKxizdAOvShLvkpthTCPiyqn6XTvbs4 -+vC0zZrsQWCYT4Wbm7gcOOAU= - -----END PRIVATE KEY----- -diff --git a/tests/certs/mtls/client/client.pem b/tests/certs/mtls/client/client.pem -index 0a11d4d472..0e3091d0e4 100644 ---- a/tests/certs/mtls/client/client.pem -+++ b/tests/certs/mtls/client/client.pem -@@ -1,41 +1,44 @@ - -----BEGIN CERTIFICATE----- --MIIDXTCCAkUCFE82w6fgdbpkUtEO64Hn8Yn/SJtzMA0GCSqGSIb3DQEBCwUAMGox --CzAJBgNVBAYTAlVTMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlv --bjEYMBYGA1UECwwPcHl0aG9uLXJlcXVlc3RzMRwwGgYDVQQDDBNTZWxmLVNpZ25l --ZCBSb290IENBMB4XDTI0MDMxMzE4MzUwNFoXDTI2MDMxMzE4MzUwNFowbDELMAkG --A1UEBhMCVVMxCzAJBgNVBAgMAkRFMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUg --Rm91bmRhdGlvbjEYMBYGA1UECwwPcHl0aG9uLXJlcXVlc3RzMREwDwYDVQQDDAhy --ZXF1ZXN0czCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMn3iQycTjUz --pKJChRNkcm33UB282cUwpxeqKN4ahHxBpS09HRhkcQYO7yErEUQwzQnBQEcIpzze --IMZIqHuCkgnySjeEJd95AIzNzGyoLLkS51TcJwgRv83AvT8ljA88s9h38qGTy4/T --CxJgf76pfHIuC1qoKVQh3AuHj9nOxIZLUsrdDbWFWoLqKSVyTby+RXvSAppAR+cu --BCaWStQ6xFORn48RHfc6t30ggD4rDAjyU6Vz6oR8ot3XmGdK0h42UdqidUWkRJaj --EbpkCnQSXS21IvfXKxF5sFqAXJrj9iVbUfpNPpaaW8IrHByngyV8amazGZrASstU --VRFtWrnrcWECAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAHHgMckLDRV72p1FEVmCh --AAPZjCswiPZFrwGPN57JqSWjoRB9ilKvo87aPosEO7vfa05OD/qkM/T9Qykuhati --I1T1T7qX4Ymb5kTJIBouuflAO3uKVaq+ga2Q/HLlU5w/VoMU4RuK7+RaiRUEE3xL --iPSMBvZpoMj695LnzcGrT5oLkFI0bTIlpQt1SFjDpHFtOj/ZdwgSbZYLoTCBXQK3 --7Y29qAj/XwEiCH63n8tJKvZcD8/ssMIMIdWhNmu+0jOWica/3WSih9Geoy6Ydtxi --I5t9vRjC4LIipMUAF86AJIfvHJyI6aCNT420LaR6NRW0FQn5CPTHPAsKg3JkAywn --Ew== -+MIIDpjCCAo6gAwIBAgIUTzbDp+B1umRS0Q7rgefxif9Im4IwDQYJKoZIhvcNAQEL -+BQAwajELMAkGA1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3Vu -+ZGF0aW9uMRgwFgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYt -+U2lnbmVkIFJvb3QgQ0EwHhcNMjUwMjE3MDAzODIzWhcNMjcwMjE3MDAzODIzWjBs -+MQswCQYDVQQGEwJVUzELMAkGA1UECAwCREUxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0 -+d2FyZSBGb3VuZGF0aW9uMRgwFgYDVQQLDA9weXRob24tcmVxdWVzdHMxETAPBgNV -+BAMMCHJlcXVlc3RzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAmt2+ -+7mS8LLmDrDruBzMROT+7orRQGZ/oy/SWpcKndWjK3l+/pIj849asVXX6biKY17ls -+szslShR+SqSZQuyNNOHuzFUuNbbbq8tJg5ZbLs8D45LBRM0uPJ0XV1rOU950c9h2 -+aFVKEKbKg53WlQINCfT/hwQD9Zbia3NkiaagJ/+nIAzdcAL1EFxJIlHLA5N7qf0t -+joqjRhRb3hrLYzgKVVuUPGzAN6ZoCwsW5yIqaLneArHgf+Vqt6jynrR2C5uiiIxt -+xzgT1vOnSgml+HvGHAp4m0I0Sk6KTUCKJAhm3CqaSQge+0gajdJntYBBT0SHav67 -+cTppKX43Q8xcrhjgmwIDAQABo0IwQDAdBgNVHQ4EFgQU3Ujw+VSuTzPgHqU+KFwO -+T4t2MHswHwYDVR0jBBgwFoAUCEaIPf7XQsGt0xbf6P9x5cxdKpwwDQYJKoZIhvcN -+AQELBQADggEBAEvrKXWHRRDIf26j2fH9hanx0nh+lxvI4jSWYmK0rJXZA3htEvWn -+gcoUspmhmLlgmRMP88lGINMjTsogUubu2j6WF/WuKxAWWvl/hUgK8NzOwOHvByPB -+lhO/rSNGdOWGlnaW1TVO4kI8w6c6LwzOCpY8WvOZLW+v7duLhKUdhaJMR9X77Tbt -+ohHkyYm0gV79izaFRpA6mdYoyHOR4gyWAKaj942doU794fT4gqQacRNifl/kUbWI -+lilktTLyLnmBJgrxHVBxcGe8kwnPafA1k3Gb1w7mY5BSoGKglKjutTfqR3uTjAQb -+vskS4SGXmsEIjLrXYWFNHyoC3pCBXWhX6Kc= - -----END CERTIFICATE----- - -----BEGIN CERTIFICATE----- --MIIDWzCCAkMCFA9wdtNh/V99DRwYp8vXjPxSjJnWMA0GCSqGSIb3DQEBCwUAMGox --CzAJBgNVBAYTAlVTMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlv --bjEYMBYGA1UECwwPcHl0aG9uLXJlcXVlc3RzMRwwGgYDVQQDDBNTZWxmLVNpZ25l --ZCBSb290IENBMB4XDTI0MDMxMjIxMDQwM1oXDTQ0MDMwNzIxMDQwM1owajELMAkG --A1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3VuZGF0aW9uMRgw --FgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYtU2lnbmVkIFJv --b3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHlIhe7GLCeSk8 --RZOKdtmyKns6KdZgGw/LcxPkYvQlu1g0zV8X0DqVr2LdMumWUTNCc9sPdSlAG+He --mQp2TMoWUMumMuwDtit9RT0Sb6Eh9svWgjY9ferovPJRfCWUTsA2Ug8uoh0wyEXK --na7X6fHt5E3B9vj0+b9a4vDibdBXV11FheLT02/uEmAEJDdP/zeBgvVbhcVyumO6 --fAGMIWzR2ukhe8z/ma5H9zoi4gZA8nsK6reZUD8+6affnPe+jIt/AdzggtV9jkWm --zSpr+RHeZ0y+q4eik2ZNUGg4XcF6JsJ9yu/AqLBXxd38uLdFfgyhP2y6K628yzgy --e6lzFyWnAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAGymNVTsKSAq8Ju6zV+AWAyV --GcUNBmLpgzDA0e7pkVYhHTdWKlGH4GnrRcp0nvnSbr6iq1Ob/8yEUUoRzK55Flws --Kt1OLwnZyhfRoSUesoEqpP68vzWEgiYv0QuIWvzNt0YfAAvEgGoc3iri44MelKLn --9ZMT8m91nVamA35R8ZjfeAkNp2xcz0a67V0ww6o4wSXrG7o5ZRXyjqZ/9K7SfwUJ --rV9RciccsjH/MzKbfrx73QwsbPWiFmjzHopdasIO0lDlmgm/r9gKfkbzfKoGCgLZ --6an6FlmLftLSXijf/QwtqeSP9fODeE3dzBmnTM3jdoVS53ZegUDWNl14o25v2Kg= -+MIIDlDCCAnygAwIBAgIUG/CTOPIQbH2BI36TyThUChQyR8wwDQYJKoZIhvcNAQEL -+BQAwajELMAkGA1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3Vu -+ZGF0aW9uMRgwFgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYt -+U2lnbmVkIFJvb3QgQ0EwHhcNMjUwMjE3MDAzODIyWhcNNDUwMjEyMDAzODIyWjBq -+MQswCQYDVQQGEwJVUzEjMCEGA1UECgwaUHl0aG9uIFNvZnR3YXJlIEZvdW5kYXRp -+b24xGDAWBgNVBAsMD3B5dGhvbi1yZXF1ZXN0czEcMBoGA1UEAwwTU2VsZi1TaWdu -+ZWQgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ9lSHzZ -+0X+v0Zbz0g3a+o6Iwy6KQgA7dIQjf65IYJ1ZPXcL42esUntcX8PpQbLWa+bwp+FK -+dqlagCS2jI9dJz8Y3MnMLBmiiXvET6ub/S9u7VdtRxByoHydBEvNMKEMga64PwMe -+ztuZ6fX2xPmRnLQIippzfzdxDFHxbUWzjzEQEl+4EGbKX5vPi6A9yL3ofgMi4APZ -+C8/YoqAaqzjLIM9KZ/zqT36iQ6wsxBXAacd63L5M8lrAKfZoJeX6uYxNIIfaxQRz -+zVxdpVBjHJ/odqoadwKzU7YzN5Fs+6ATNvkrhlUzg1i0MyTGtCdkUIAt/hc6ZrW6 -+/kqHpCgUwUc4Dq0CAwEAAaMyMDAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU -+CEaIPf7XQsGt0xbf6P9x5cxdKpwwDQYJKoZIhvcNAQELBQADggEBAHMgyQNA3DQG -+0l9eX8RMl4YNwhAXChU/wOTcvD+F4OsJcPqzy6QHFh1AbBBGOI9/HN7du+EiKwGZ -+wE+69FEsSbhSv22XidPm+kHPTguWl1eKveeWrrT5MPl9F48s14lKb/8yMEa1/ryG -+Iu8NQ6ZL91JbTXdkLoBDya9HZqyXjwcGkXLE8fSqTibJ7EhWS5Q3Ic7WPgUoGAum -+b5ygoxqhm+SEyXC2/LAktwmFawkv1SsMeYpT790VIFqJ/TVVnUl+gQ2RjSEl2WLb -+UO4Hwq4FZbWF9NrY6JVThLmbcr8eW6+UxWfiXHLw/qTRre4/3367QAUQRt7EuEsb -+KOWpOS3fbsI= - -----END CERTIFICATE----- -diff --git a/tests/certs/valid/server/server.csr b/tests/certs/valid/server/server.csr -index 000d1facb2..60d082e8ef 100644 ---- a/tests/certs/valid/server/server.csr -+++ b/tests/certs/valid/server/server.csr -@@ -2,18 +2,18 @@ - MIIDKjCCAhICAQAwbTELMAkGA1UEBhMCVVMxCzAJBgNVBAgMAkRFMSMwIQYDVQQK - DBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlvbjEYMBYGA1UECwwPcHl0aG9uLXJl - cXVlc3RzMRIwEAYDVQQDDAlsb2NhbGhvc3QwggEiMA0GCSqGSIb3DQEBAQUAA4IB --DwAwggEKAoIBAQChEKOx377ymuDg23By5Re1DHi2RiBKSHr85/ZTZuwP/69lHN7q --TQEO//EMEFZ9+ZwezeJJsejjP2HO5lQZbcsWok3hbM0wVT+vApkogPvJ8WNFFWFe --ZBnGLi/1WM9cSZpUsDJ0XCsG0RTtO27wfgZQlKQMZxTkfi971oPYxNVSjTm2JcLT --kvwYIwxjJXPDTOgRo9TEAY3cWkCrBJN4w74GWBTM5KDDA230T7WwLuv81XD2LvYj --YYdMBGcxPr5tYTIlp3LncbcrDRNk3pbYQk0bRJgkw2vUkteiRGjkt+dgVnLc6+MI --W+VLXEpj+zsOZ5/R4d1pofqj9sDyDPhtNr1JAgMBAAGgeDB2BgkqhkiG9w0BCQ4x -+DwAwggEKAoIBAQDD3OzTz9TgOiJp/STy/au8G1EDVUuP3HWKAX5ZpkWSTYZfc7FF -+pgPQvBq83oh/K1+9Rw0/529N1+KeTp1i9vUBUM2wJ3EzykJP4rMFh+J/Nt6VFfJh -+05pTQiHnc85l4U8Qz7fHS6Lc9EG/Yp6yDxt5OeK8QAkNYjvxVhVdpif3GlnICx1e -+y1EcPxb9rslERyz0eiL6+BtVbhlSvup/rz2skvaYxoh/pP1RVwbu8VtS0it046Fm -+U0TnIdsjrdFjHXNJ2JSs5g6FDB9QEFhYdDOonL4KMcAkXxBLYXpjJ5fj8/X4LFkU -+FINry+Q2zdFKYsghCxlW98hmJVJTscVWznqpAgMBAAGgeDB2BgkqhkiG9w0BCQ4x - aTBnMAwGA1UdEwEB/wQCMAAwDgYDVR0PAQH/BAQDAgWgMBYGA1UdJQEB/wQMMAoG - CCsGAQUFBwMBMC8GA1UdEQEB/wQlMCOCCWxvY2FsaG9zdIcEfwAAAYcQAAAAAAAA --AAAAAAAAAAAAATANBgkqhkiG9w0BAQsFAAOCAQEAFTlFTn5Mn8JXtqB5bGjuiChe --ClA6Y32Co4l7N0CtAlf+bExwLdpLOleTX3WnryIPALl9uBUI/67dy/STn/J1Yn86 --jWPEFwpmYNSKgQljYWcwtBdYLWfIsJO11kKdaAkOUHBEN5DKrXJ46Vs4918bD1/Q --6ztqdrThiKc646u9xB58Hg7F0IyMWbHfs0x16ZpcN9otrIkbqOE2wzTmc65O1t1i --HDljcSk7OnNy3a9wtLEnyPiyMqHf2k/bTlmiDRVe3cSy9xieoqmzHTnOCSASe1y9 --7lcEBQild18Jo4nACV4vCYOUwrMi/58LWW+lD6OmMnPiWUqOvMbgMffMNDpWPA== -+AAAAAAAAAAAAATANBgkqhkiG9w0BAQsFAAOCAQEAn8TdRWYAGL7L8JKpkX2FRMMY -+EuFOEeJ2UaQLRbVtb1RhkIkMT6UYulQ16K45dbFe4k8DT59/mHrTl0bJ6pqVPawa -+vo7vmKCrSYEz8GrImh1+i6lHaFiqbkAs1mJ6z86dZUofMYwfTPVh64ztamUqwBk7 -+Dey+MzWUQvpTVqoaP7cLgzMy+XfcyGuWSoL6pX5XKkt4+A2wiCTsHul1sXOn4vQz -+4xY96AUVnkKosXMWXvhbMkncLNH+gs+ZeQI0MekakuMa42N+0BAad3Zx60lifG3N -+ugyVUmvVI0Fq6QUlYp3YV6QQj3FDjbgOVsSJNh+2s4SIARJsb/k//Tddzxei7g== - -----END CERTIFICATE REQUEST----- -diff --git a/tests/certs/valid/server/server.key b/tests/certs/valid/server/server.key -index d6afaf59fe..387d5d67f1 100644 ---- a/tests/certs/valid/server/server.key -+++ b/tests/certs/valid/server/server.key -@@ -1,28 +1,28 @@ - -----BEGIN PRIVATE KEY----- --MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQChEKOx377ymuDg --23By5Re1DHi2RiBKSHr85/ZTZuwP/69lHN7qTQEO//EMEFZ9+ZwezeJJsejjP2HO --5lQZbcsWok3hbM0wVT+vApkogPvJ8WNFFWFeZBnGLi/1WM9cSZpUsDJ0XCsG0RTt --O27wfgZQlKQMZxTkfi971oPYxNVSjTm2JcLTkvwYIwxjJXPDTOgRo9TEAY3cWkCr --BJN4w74GWBTM5KDDA230T7WwLuv81XD2LvYjYYdMBGcxPr5tYTIlp3LncbcrDRNk --3pbYQk0bRJgkw2vUkteiRGjkt+dgVnLc6+MIW+VLXEpj+zsOZ5/R4d1pofqj9sDy --DPhtNr1JAgMBAAECggEAIuLzBfXgCvXzlBjL2kMXd7p4EgkN+PEKnKmUr/t40b1Q --zR6sBQWBX3GeET4fseElSQHQzCQaPNCve4xltm1S4jftFREHP7sTVHHEYWLQxuy/ --Uwkewj5927CI6ERgg82YfVP91bjaA/u5I+pt7O7rKLyNbPdN7fEMEW+FNuhpiVvg --JMrcK1BCFL6pmIT21LyTwkacMKZSPko58pWE24MA9aSCHk6cXdwQWQK0AfQT3XGT --C4I0hRed7LgqMH+gMuhpakiO13t8yTwxt2iQC9+aa4oSHD3BOi/CwIWfe1mHwmlr --cj4Kof1JSnK4SVTD16T++PlnWZkF6oaLUNg+/c2C9QKBgQDOFSYIY7+HzinT2hbI --yTIJCHpp+Iee+WVvvxjdZIPMDINrlIiHcMfXb0itUdcUO6tz0KYDMDLRC9CSP0ar --6mBWUTHfAKF2S4JpI9JYI4PNtIpOP1NiYuyJlnh5+ytU1yIeIvl39hmLcRwI9mgz --njy/D7yEoDCrG1dhcltubKpNXQKBgQDIFAVg0A7MNcxBZDLlk1NAME2JKOSszX8E --VNucvZD+9l+L9V9BmwwPQdzYifv/dNp3nYn+lxRPPgze3ZWu4+PeDuGudxu0I6ll --beFdbIcp1wbeQguzHYLjBYJqsMb4Pao5HPInjPu/HWfZlg9oZpJbKVucQwbonJLX --lgca9KaE3QKBgA+OUx+g/+0tZ8ThGoUvgsJhzHPBWeNrKfgEcckMdFJrw2PUg3XN --0pf1g4PpwJV7Z5bHcjCda8iR3r2bXydM+tapLF2L+6QlUQPEu3UBwUo+zY3Yg9/S --Xc6I+DEk/4FY9+9UboZaolT/RcF7cCQtVqKJeo58VRAlcTQe4L32H+jVAoGALXX3 --Ht9HbXkP1w/YTLej4+LVy0OCag0rPiW13LBqALSkUx3GrhZ3sAPMFVuM6ad4eFNQ --ZouXbsXvkLgSabGYNf11o/mmTtEHjWdhHKQrNgOIqPmixOkAs2quDmXqX79LLTz5 --fKkZDny0+wiQqa0cth/4k9HbAQGKj/ej16kdKPUCgYAz08Y39NnJYxRNz3tu/7C6 --jKyXKxhuZCZCt3cSWto5Tg0mVVB+2Jk2GhG1hCfZoRCP25R3FFBR1HOJgOc59T7C --LL67FdO0+7mj/WNzHj3+9gyOYQyQgPVDaTmsJLbuzT2S+GpR94ZNliwL2NEa5baG --B/Nb2ruRNj0GgZVw48N4XQ== -+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQDD3OzTz9TgOiJp -+/STy/au8G1EDVUuP3HWKAX5ZpkWSTYZfc7FFpgPQvBq83oh/K1+9Rw0/529N1+Ke -+Tp1i9vUBUM2wJ3EzykJP4rMFh+J/Nt6VFfJh05pTQiHnc85l4U8Qz7fHS6Lc9EG/ -+Yp6yDxt5OeK8QAkNYjvxVhVdpif3GlnICx1ey1EcPxb9rslERyz0eiL6+BtVbhlS -+vup/rz2skvaYxoh/pP1RVwbu8VtS0it046FmU0TnIdsjrdFjHXNJ2JSs5g6FDB9Q -+EFhYdDOonL4KMcAkXxBLYXpjJ5fj8/X4LFkUFINry+Q2zdFKYsghCxlW98hmJVJT -+scVWznqpAgMBAAECggEACY98I+6uJm/QBDpuFkpZmqn+r1n3gUMynZTrFPcvyC9u -+krQ0AAFViFfWOkfmg8abOsMAG5FxdmxGTJHrzsvdM748/A9A0FVcHUgkku2KGcmU -+3dQfa7UHgG7m9sRJW+G+mUR6ZQkFHyHxH6Vxt6FTJvyzW5sIlhWodWRNUK/unXoe -+5QNIh/PM9Mkg91wKVeg8AGdY27zfuUV0KLwhV052hCSwckayi7pjYrH2xDL8fahi -+Z/F43N1SI6Q7PTW6izDs2KrlGyexn97jOV+cooSXXaDvivTaB2K4RoidrPt+UAW4 -+/e1zw/LbeBvQXX4vsyC9vLO+Av1gYo2PxAZ/ezc5gQKBgQDvY/kgUud6stdMs73N -+Qavu9o/Ul4oeQa4fsmfUwj43OjquxpXbfV9sNTLFxFbsl5ADGkpqsR3WhP2090TK -+62vkyCBiaYZjyMY6WLDATEvrpfbc74ATEzTU+r9T1rEByq/atbWPZq/zoMo8aAdg -+Qk2X7gQO3pTpPeEpetYG42Di+QKBgQDRc9IqPeELQugXEuI0RZ8rsfGRSFKVRelQ -+Rz/KpD/S8SsE7ERL0w/w5KgE0IPPbh/SYX2KYxafCqTrPWDNaoguROvUoUJQvf4a -+uOMTCRkqdqj8j70zaPj2ohuIIZ3GZHyaXgl/isWtuZ5OeaoY5h3r+4gk5mO41Llz -+YikB71SRMQKBgGBNG18BetVFNI9Kj0QO8xeCYIHpJErfqShfIJ3aNiUJa6n7gTV2 -+zfg9vlsIjN9IaUqWPPGGprYxcc5m2mm3IwQ57a0pPkLN9dBq9U+mYbQ+Y3ylbCRA -+SbST2nvjlflejDezeYJikM21FSYPw0fZ5FUGDuPcbpMVrYp+O7MxrTwhAoGAcjQq -+xemTiWZj0iDzwfisP1D5HHRIwyepfaI7wCwquMPS5w5EduuQZ5LloipnlHTBWR7b -+Kte4f+N35OREofySYFgoFnoPBKNzp/Jjrf9p/2NP5NYjHaMBDMl7JZDezEwCPNFF -+cIukGYN6M+PWwVjHu+Ica7JLcX5b1/QP1ARBIiECgYAsdDa0CoYTVWMeqMq9GjF3 -+BElBKCLp6iYqpElWyKTj39LCnLhzRICyYQpblM8zZgtQIvRGT8DYh2HA1Q29yPzt -+Rgrz9yfFACdT5gUM5D6sx7L37xbtMQQ7YYOxEAfCUZ0qnMJgpNTJ8/ECkjGJZaif -+CXrx6XCdvrM/evZW2JZbyg== - -----END PRIVATE KEY----- -diff --git a/tests/certs/valid/server/server.pem b/tests/certs/valid/server/server.pem -index 0168cd3e3f..b4ad4c650d 100644 ---- a/tests/certs/valid/server/server.pem -+++ b/tests/certs/valid/server/server.pem -@@ -1,47 +1,46 @@ - -----BEGIN CERTIFICATE----- --MIIEhTCCA22gAwIBAgIUTzbDp+B1umRS0Q7rgefxif9Im3wwDQYJKoZIhvcNAQEL -+MIIEEDCCAvigAwIBAgIUTzbDp+B1umRS0Q7rgefxif9Im4MwDQYJKoZIhvcNAQEL - BQAwajELMAkGA1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3Vu - ZGF0aW9uMRgwFgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYt --U2lnbmVkIFJvb3QgQ0EwHhcNMjQwMzE0MDAxMDAzWhcNNDMxMTMwMDAxMDAzWjBt -+U2lnbmVkIFJvb3QgQ0EwHhcNMjUwMjE3MDAzODIzWhcNNDQxMTA0MDAzODIzWjBt - MQswCQYDVQQGEwJVUzELMAkGA1UECAwCREUxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0 - d2FyZSBGb3VuZGF0aW9uMRgwFgYDVQQLDA9weXRob24tcmVxdWVzdHMxEjAQBgNV --BAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKEQ --o7HfvvKa4ODbcHLlF7UMeLZGIEpIevzn9lNm7A//r2Uc3upNAQ7/8QwQVn35nB7N --4kmx6OM/Yc7mVBltyxaiTeFszTBVP68CmSiA+8nxY0UVYV5kGcYuL/VYz1xJmlSw --MnRcKwbRFO07bvB+BlCUpAxnFOR+L3vWg9jE1VKNObYlwtOS/BgjDGMlc8NM6BGj --1MQBjdxaQKsEk3jDvgZYFMzkoMMDbfRPtbAu6/zVcPYu9iNhh0wEZzE+vm1hMiWn --cudxtysNE2TelthCTRtEmCTDa9SS16JEaOS352BWctzr4whb5UtcSmP7Ow5nn9Hh --3Wmh+qP2wPIM+G02vUkCAwEAAaOCAR4wggEaMAwGA1UdEwEB/wQCMAAwDgYDVR0P --AQH/BAQDAgWgMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMBMC8GA1UdEQEB/wQlMCOC --CWxvY2FsaG9zdIcEfwAAAYcQAAAAAAAAAAAAAAAAAAAAATAdBgNVHQ4EFgQUJ90a --UnXKPP13yDprLhG39fUrnu8wgZEGA1UdIwSBiTCBhqFupGwwajELMAkGA1UEBhMC --VVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3VuZGF0aW9uMRgwFgYDVQQL --DA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYtU2lnbmVkIFJvb3QgQ0GC --FA9wdtNh/V99DRwYp8vXjPxSjJnWMA0GCSqGSIb3DQEBCwUAA4IBAQCVh4hiraRv --JzYbS/TombP//xfVEWHXDBEYsT5GgWf7GPJ/QtSvv6uJFsK7heqLzf9f+r4Z5xMh --YAkb0oe/Ge0T30Mo1YaBEqkKuQL9lOMcP69S9uFz2VT6I/76I8qqAu2AFhu74p8f --qudwmQyRYo1Ryg4R/SgRhSJKF/ST/2wOusNWSsBe1s8S2PmtOb4dr3cMBGihrUzS --DmCQpWjuiuE23HXnnYDc/EUAnEEPkLDgCsE9iLq37FPUHcHjqdYIAhmImPBpv2EL --ftXeRWfxN2hRHpS5Fn3QuAOwfJw5tUcVXojJCJfSpL+Ac97iSjxNaDIPlyomauKw --1rgbUkSw+9JQ -+BAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMPc -+7NPP1OA6Imn9JPL9q7wbUQNVS4/cdYoBflmmRZJNhl9zsUWmA9C8GrzeiH8rX71H -+DT/nb03X4p5OnWL29QFQzbAncTPKQk/iswWH4n823pUV8mHTmlNCIedzzmXhTxDP -+t8dLotz0Qb9inrIPG3k54rxACQ1iO/FWFV2mJ/caWcgLHV7LURw/Fv2uyURHLPR6 -+Ivr4G1VuGVK+6n+vPayS9pjGiH+k/VFXBu7xW1LSK3TjoWZTROch2yOt0WMdc0nY -+lKzmDoUMH1AQWFh0M6icvgoxwCRfEEthemMnl+Pz9fgsWRQUg2vL5DbN0UpiyCEL -+GVb3yGYlUlOxxVbOeqkCAwEAAaOBqjCBpzAMBgNVHRMBAf8EAjAAMA4GA1UdDwEB -+/wQEAwIFoDAWBgNVHSUBAf8EDDAKBggrBgEFBQcDATAvBgNVHREBAf8EJTAjggls -+b2NhbGhvc3SHBH8AAAGHEAAAAAAAAAAAAAAAAAAAAAEwHQYDVR0OBBYEFGg5Q9Ll -+ADkONmo02kmPg9+aiOxQMB8GA1UdIwQYMBaAFAhGiD3+10LBrdMW3+j/ceXMXSqc -+MA0GCSqGSIb3DQEBCwUAA4IBAQA1RlUI34tXrIdsRiALD8iLDFhh816B7qUi+F1j -+3dOkTNgYw0CnQ+Vm4wrQjCEVSDQ/9sry5DOfXeGziDpFlZmQ0UuAeM1EJJD5/42l -+C/eKquA09+IMEq2U03GPhijrC68sFCfr5wgoB/4HmcZ1c3kLYvRaJhEK7AHDgenY -+knKbvuKAiRbCd584eG8HFOW7xv+YqGZ257Ic9flbarkPrazmAJg2P709w7/fP83x -+7lnkPZY09jS3lcIpEdtWvzfm+anGF190hKA1yfPdO5bYPvUcEMxXdMtQ6/pbZd5i -+F6t95o9CPCqI/lLIn5jAf9Z+Iil3GmKefEZYIGmKJ85HGUqE - -----END CERTIFICATE----- - -----BEGIN CERTIFICATE----- --MIIDWzCCAkMCFA9wdtNh/V99DRwYp8vXjPxSjJnWMA0GCSqGSIb3DQEBCwUAMGox --CzAJBgNVBAYTAlVTMSMwIQYDVQQKDBpQeXRob24gU29mdHdhcmUgRm91bmRhdGlv --bjEYMBYGA1UECwwPcHl0aG9uLXJlcXVlc3RzMRwwGgYDVQQDDBNTZWxmLVNpZ25l --ZCBSb290IENBMB4XDTI0MDMxMjIxMDQwM1oXDTQ0MDMwNzIxMDQwM1owajELMAkG --A1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3VuZGF0aW9uMRgw --FgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYtU2lnbmVkIFJv --b3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDHlIhe7GLCeSk8 --RZOKdtmyKns6KdZgGw/LcxPkYvQlu1g0zV8X0DqVr2LdMumWUTNCc9sPdSlAG+He --mQp2TMoWUMumMuwDtit9RT0Sb6Eh9svWgjY9ferovPJRfCWUTsA2Ug8uoh0wyEXK --na7X6fHt5E3B9vj0+b9a4vDibdBXV11FheLT02/uEmAEJDdP/zeBgvVbhcVyumO6 --fAGMIWzR2ukhe8z/ma5H9zoi4gZA8nsK6reZUD8+6affnPe+jIt/AdzggtV9jkWm --zSpr+RHeZ0y+q4eik2ZNUGg4XcF6JsJ9yu/AqLBXxd38uLdFfgyhP2y6K628yzgy --e6lzFyWnAgMBAAEwDQYJKoZIhvcNAQELBQADggEBAGymNVTsKSAq8Ju6zV+AWAyV --GcUNBmLpgzDA0e7pkVYhHTdWKlGH4GnrRcp0nvnSbr6iq1Ob/8yEUUoRzK55Flws --Kt1OLwnZyhfRoSUesoEqpP68vzWEgiYv0QuIWvzNt0YfAAvEgGoc3iri44MelKLn --9ZMT8m91nVamA35R8ZjfeAkNp2xcz0a67V0ww6o4wSXrG7o5ZRXyjqZ/9K7SfwUJ --rV9RciccsjH/MzKbfrx73QwsbPWiFmjzHopdasIO0lDlmgm/r9gKfkbzfKoGCgLZ --6an6FlmLftLSXijf/QwtqeSP9fODeE3dzBmnTM3jdoVS53ZegUDWNl14o25v2Kg= -+MIIDlDCCAnygAwIBAgIUG/CTOPIQbH2BI36TyThUChQyR8wwDQYJKoZIhvcNAQEL -+BQAwajELMAkGA1UEBhMCVVMxIzAhBgNVBAoMGlB5dGhvbiBTb2Z0d2FyZSBGb3Vu -+ZGF0aW9uMRgwFgYDVQQLDA9weXRob24tcmVxdWVzdHMxHDAaBgNVBAMME1NlbGYt -+U2lnbmVkIFJvb3QgQ0EwHhcNMjUwMjE3MDAzODIyWhcNNDUwMjEyMDAzODIyWjBq -+MQswCQYDVQQGEwJVUzEjMCEGA1UECgwaUHl0aG9uIFNvZnR3YXJlIEZvdW5kYXRp -+b24xGDAWBgNVBAsMD3B5dGhvbi1yZXF1ZXN0czEcMBoGA1UEAwwTU2VsZi1TaWdu -+ZWQgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJ9lSHzZ -+0X+v0Zbz0g3a+o6Iwy6KQgA7dIQjf65IYJ1ZPXcL42esUntcX8PpQbLWa+bwp+FK -+dqlagCS2jI9dJz8Y3MnMLBmiiXvET6ub/S9u7VdtRxByoHydBEvNMKEMga64PwMe -+ztuZ6fX2xPmRnLQIippzfzdxDFHxbUWzjzEQEl+4EGbKX5vPi6A9yL3ofgMi4APZ -+C8/YoqAaqzjLIM9KZ/zqT36iQ6wsxBXAacd63L5M8lrAKfZoJeX6uYxNIIfaxQRz -+zVxdpVBjHJ/odqoadwKzU7YzN5Fs+6ATNvkrhlUzg1i0MyTGtCdkUIAt/hc6ZrW6 -+/kqHpCgUwUc4Dq0CAwEAAaMyMDAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU -+CEaIPf7XQsGt0xbf6P9x5cxdKpwwDQYJKoZIhvcNAQELBQADggEBAHMgyQNA3DQG -+0l9eX8RMl4YNwhAXChU/wOTcvD+F4OsJcPqzy6QHFh1AbBBGOI9/HN7du+EiKwGZ -+wE+69FEsSbhSv22XidPm+kHPTguWl1eKveeWrrT5MPl9F48s14lKb/8yMEa1/ryG -+Iu8NQ6ZL91JbTXdkLoBDya9HZqyXjwcGkXLE8fSqTibJ7EhWS5Q3Ic7WPgUoGAum -+b5ygoxqhm+SEyXC2/LAktwmFawkv1SsMeYpT790VIFqJ/TVVnUl+gQ2RjSEl2WLb -+UO4Hwq4FZbWF9NrY6JVThLmbcr8eW6+UxWfiXHLw/qTRre4/3367QAUQRt7EuEsb -+KOWpOS3fbsI= - -----END CERTIFICATE----- diff --git a/python-requests.spec b/python-requests.spec index 26734bd..044ccfb 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -6,7 +6,7 @@ %bcond extradeps %{undefined rhel} Name: python-requests -Version: 2.32.3 +Version: 2.32.4 Release: %autorelease Summary: HTTP library, written in Python, for human beings @@ -32,29 +32,6 @@ Patch: support_IPv6_CIDR_in_no_proxy.patch # when it is ready, or dropped in a release where that is merged Patch: 0001-Don-t-create-default-SSLContext-if-CA-bundle-isn-t-p.patch -# Add CA constraint to test CA -# -# Otherwise recent versions of OpenSSL reject it as an invalid CA certificate -# (at least once the test certificates are regenerated). -# -# https://github.com/psf/requests/commit/507409661335bd3dd8a7e39f04d07b42e519becc -Patch: https://github.com/psf/requests/commit/507409661335bd3dd8a7e39f04d07b42e519becc.patch -# Regenerate test certificates -# https://github.com/psf/requests/commit/9ebebdef98a6aacfbedcf2ca61ba0eaecc2563f4 -Patch: https://github.com/psf/requests/commit/9ebebdef98a6aacfbedcf2ca61ba0eaecc2563f4.patch -# Add key usage extension to test ca.crt -# https://github.com/psf/requests/pull/6924 -Patch: https://github.com/psf/requests/pull/6924.patch -# Together, these three patches fix one of the three regressions reported in -# the following issue, and the only one that we see downstream: -# -# Test regressions with urllib3 2.4.0 on Python 3.13 -# https://github.com/psf/requests/issues/6934 -# -# See also: -# -# https://github.com/urllib3/urllib3/pull/3577#issuecomment-2765190031 - BuildArch: noarch BuildRequires: python%{python3_pkgversion}-devel %if %{with tests} diff --git a/sources b/sources index 2c91835..1372986 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (requests-v2.32.3.tar.gz) = ea3e85e035efed0fe22bf8640491ffb20c2ac50359bb1e11c9147ed850cac5e4a6a36ab58a48fc6c6d6a44df2b511e8a5d902444c034da6baa6adc5f9417697f +SHA512 (requests-v2.32.4.tar.gz) = 7638061283a5e66c51f26107f5a88d090d35feecbf5a9075af842b67c0abd727af855346e2385130fa79738395a3821107be300e3de60a9a0e84fe69904288cd diff --git a/system-certs.patch b/system-certs.patch index efc0010..96f097e 100644 --- a/system-certs.patch +++ b/system-certs.patch @@ -1,7 +1,7 @@ -From bb733473e91e71b812ada46bc110f607630f9327 Mon Sep 17 00:00:00 2001 +From e0ce6c20989a205489df47f8abaff5369ed588ca Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Hrn=C4=8Diar?= Date: Thu, 30 May 2024 11:10:29 +0200 -Subject: [PATCH 1/2] system certs +Subject: [PATCH] system certs Co-authored-by: Lumir Balhar --- @@ -23,17 +23,17 @@ index 8d44e0e..fa10a53 100644 idna>=2.5,<4 urllib3>=1.21.1,<3 diff --git a/setup.py b/setup.py -index 1b0eb37..03d19b0 100755 +index 7d9b52b..17da826 100755 --- a/setup.py +++ b/setup.py -@@ -62,7 +62,6 @@ requires = [ +@@ -37,7 +37,6 @@ requires = [ "charset_normalizer>=2,<4", "idna>=2.5,<4", "urllib3>=1.21.1,<3", - "certifi>=2017.4.17", ] test_requirements = [ - "pytest-httpbin==2.0.0", + "pytest-httpbin==2.1.0", diff --git a/src/requests/certs.py b/src/requests/certs.py index be422c3..9aee713 100644 --- a/src/requests/certs.py @@ -55,5 +55,5 @@ index be422c3..9aee713 100644 if __name__ == "__main__": print(where()) -- -2.45.1 +2.50.0 diff --git a/tests/upstream/runtest.sh b/tests/upstream/runtest.sh index b57824e..5254bd6 100755 --- a/tests/upstream/runtest.sh +++ b/tests/upstream/runtest.sh @@ -52,8 +52,8 @@ rlJournalStart # pip-install libraries not in the repos # pytest is installed in fmf requirement - rlRun "$PYTHON -m pip install pytest-mock==3.12.0 trustme==1.1.0 werkzeug==3.0.3 \ - pytest-httpbin==2.0.0" + rlRun "$PYTHON -m pip install pytest-mock==3.14.0 trustme==1.2.0 werkzeug==3.1.3 \ + pytest-httpbin==2.1.0" # Move to test dir, print what is there rlRun "cd $(dirname $TmpDir/BUILD/*requests*/requests*/tests)" From 9d9296cdb3fd96f23f42c88ffd51584c2ab36319 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Tue, 25 Mar 2025 15:12:58 +0100 Subject: [PATCH 39/43] Use /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem - https://fedoraproject.org/wiki/Changes/dropingOfCertPemFile - Fixes: rhbz#2337320 --- python-requests.spec | 2 +- system-certs.patch | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/python-requests.spec b/python-requests.spec index 044ccfb..5164d3c 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -25,7 +25,7 @@ Patch: system-certs.patch # This change is backported also into RHEL 9.4 (via CS) Patch: support_IPv6_CIDR_in_no_proxy.patch -# Fix crash on import if /etc/pki/tls/certs/ca-bundle.crt is missing +# Fix crash on import if /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem is missing # https://bugzilla.redhat.com/show_bug.cgi?id=2297632 # https://github.com/psf/requests/pull/6781 # Note: this can be replaced by https://github.com/psf/requests/pull/6767 diff --git a/system-certs.patch b/system-certs.patch index 96f097e..42b8213 100644 --- a/system-certs.patch +++ b/system-certs.patch @@ -43,14 +43,14 @@ index be422c3..9aee713 100644 environment, you can change the definition of where() to return a separately packaged CA bundle. + -+This Fedora-patched package returns "/etc/pki/tls/certs/ca-bundle.crt" provided ++This Fedora-patched package returns "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem" provided +by the ca-certificates RPM package. """ -from certifi import where + +def where(): + """Return the absolute path to the system CA bundle.""" -+ return '/etc/pki/tls/certs/ca-bundle.crt' ++ return '/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem' if __name__ == "__main__": print(where()) From 15b4c097f298c881fe92ca831486a96cec535bc6 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 10:09:23 +0000 Subject: [PATCH 40/43] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild From 13de5714ceaa96d0cacfd0da1307948c91da46f8 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Fri, 15 Aug 2025 14:45:16 +0200 Subject: [PATCH 41/43] Rebuilt for Python 3.14.0rc2 bytecode From 0f0415395c621805e131989c0dcdf3bbb93d947e Mon Sep 17 00:00:00 2001 From: Lumir Balhar Date: Tue, 19 Aug 2025 10:58:29 +0200 Subject: [PATCH 42/43] Update to 2.32.5 (rhbz#2389307) --- .gitignore | 1 + ...ault-SSLContext-if-CA-bundle-isn-t-p.patch | 36 ------------------- python-requests.spec | 9 +---- sources | 2 +- 4 files changed, 3 insertions(+), 45 deletions(-) delete mode 100644 0001-Don-t-create-default-SSLContext-if-CA-bundle-isn-t-p.patch diff --git a/.gitignore b/.gitignore index da16a7b..2a551fe 100644 --- a/.gitignore +++ b/.gitignore @@ -54,3 +54,4 @@ /requests-v2.31.0.tar.gz /requests-v2.32.3.tar.gz /requests-v2.32.4.tar.gz +/requests-v2.32.5.tar.gz diff --git a/0001-Don-t-create-default-SSLContext-if-CA-bundle-isn-t-p.patch b/0001-Don-t-create-default-SSLContext-if-CA-bundle-isn-t-p.patch deleted file mode 100644 index 14ca3a1..0000000 --- a/0001-Don-t-create-default-SSLContext-if-CA-bundle-isn-t-p.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 08e863f94fe93b4b3bd2e8267234be7a23350b1d Mon Sep 17 00:00:00 2001 -From: Adam Williamson -Date: Thu, 1 Aug 2024 12:58:38 -0700 -Subject: [PATCH] Don't create default SSLContext if CA bundle isn't present - -Similar to e18879932287c2bf4bcee4ddf6ccb8a69b6fc656 , this also -skips creation of the default SSLContext on FileNotFoundError, -which is raised if DEFAULT_CA_BUNDLE_PATH does not exist. - -See: https://bugzilla.redhat.com/show_bug.cgi?id=2297632 - -Signed-off-by: Adam Williamson ---- - src/requests/adapters.py | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/src/requests/adapters.py b/src/requests/adapters.py -index 9a58b160..fb151a95 100644 ---- a/src/requests/adapters.py -+++ b/src/requests/adapters.py -@@ -81,9 +81,10 @@ try: - _preloaded_ssl_context.load_verify_locations( - extract_zipped_paths(DEFAULT_CA_BUNDLE_PATH) - ) --except ImportError: -+except (ImportError, FileNotFoundError): - # Bypass default SSLContext creation when Python -- # interpreter isn't built with the ssl module. -+ # interpreter isn't built with the ssl module, or -+ # DEFAULT_CA_BUNDLE_PATH isn't present - _preloaded_ssl_context = None - - --- -2.45.2 - diff --git a/python-requests.spec b/python-requests.spec index 5164d3c..4a7f997 100644 --- a/python-requests.spec +++ b/python-requests.spec @@ -6,7 +6,7 @@ %bcond extradeps %{undefined rhel} Name: python-requests -Version: 2.32.4 +Version: 2.32.5 Release: %autorelease Summary: HTTP library, written in Python, for human beings @@ -25,13 +25,6 @@ Patch: system-certs.patch # This change is backported also into RHEL 9.4 (via CS) Patch: support_IPv6_CIDR_in_no_proxy.patch -# Fix crash on import if /etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem is missing -# https://bugzilla.redhat.com/show_bug.cgi?id=2297632 -# https://github.com/psf/requests/pull/6781 -# Note: this can be replaced by https://github.com/psf/requests/pull/6767 -# when it is ready, or dropped in a release where that is merged -Patch: 0001-Don-t-create-default-SSLContext-if-CA-bundle-isn-t-p.patch - BuildArch: noarch BuildRequires: python%{python3_pkgversion}-devel %if %{with tests} diff --git a/sources b/sources index 1372986..e2adddc 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (requests-v2.32.4.tar.gz) = 7638061283a5e66c51f26107f5a88d090d35feecbf5a9075af842b67c0abd727af855346e2385130fa79738395a3821107be300e3de60a9a0e84fe69904288cd +SHA512 (requests-v2.32.5.tar.gz) = ca73dcaec9a12ecd7d16d5f30a9213fc520b9b9d659bd6d35e6f05f7b823e1bf6209c7ae48d5e301974794d92dbc8facb937ce99e22180b28dd80f6f2afa13ae From 5482485d62e5871f6a1b3baebb19dc4022d39228 Mon Sep 17 00:00:00 2001 From: Python Maint Date: Fri, 19 Sep 2025 14:19:18 +0200 Subject: [PATCH 43/43] Rebuilt for Python 3.14.0rc3 bytecode