Mailman 3 March 2015 - Cryptography-dev

Unsupported platforms?
by Alex Gaynor March 30, 2015

March 30, 2015

Hi folks, I'd like to propose we deprecate, with the intention of removing, support for Python 2.6. The reason for this is that Python 2.6 is no longer receiving support for the Python core developers in any form, including security releases. We provide a piece of security sensitive software, and I claim it would be irresponsible to say it's supported on platforms which are themselves not supported. This would affect our current downstreams, such as pyOpenSSL, Twisted, and OpenStack, as well as things we'd like to be our downstreams, such as Paramiko/Fabric. So I'm hoping some of them will chime in. By way of adding data around this: Django's latest release is 2.7/3.x only, however there has been some measure of requests to add additional long term support for a past release which has 2.6 support. I've seen numbers from Donald that (as of the end of last year) 2.6 is ~10-15% of PyPI downloads across the board. Thoughts? Alex -- "I disapprove of what you say, but I will defend to the death your right to say it." -- Evelyn Beatrice Hall (summarizing Voltaire) "The people's good is the highest law." -- Cicero GPG Key fingerprint: 125F 5C67 DFE9 4084

8 14

Dedicated Travis Builders
by Donald Stufft March 29, 2015

March 29, 2015

I was talking to the Travis CI folks and they mentioned they have the possibility of using openstack builders now (or in the near future). We talked a little bit about the possibility of getting PyCA it's own dedicated set of builders in Travis CI hosted inside of Rackspace on one of our cloud accounts. Currently the entirety of the PyPA organization on Github gets 10 concurrent builders (typically this number is 5) across all repositories. Assuming Travis CI is able to do it (they'd need to check with their ops team, and there would be some cost associated with things on their side as well) we could essentially control how much concurrency we want by just throwing more Rackspace VMs at our builds. Josh said they use a 2 vCPU machine w/ 4GB of ram, so looking at the Rackspace Compute1-4 which is similar we'd be looking at the ability to run ~27 of those VMs full time on the "standard" 2k/month free cloud offering that Rackspace offers OSS projects. However we'd actually be able to get more than that probably because Travis starts up the VMs on demand so anytime there aren't tests to run we won't have any VMs running. Independent of this, they are also working on the ability to run custom docker images (which means custom Linux OS images) that we can preinstall different software into. Is this something we'd want to explore? Assuming that the Travis CI ops team and such are OK with it, it could essentially let us scale up our concurrency on Travis to whatever amount of dollars of Rackspace cloud we want to throw at it. --- Donald Stufft PGP: 7C6B 7C5D 5E2B 6356 A926 F04F 6E3C BCE9 3372 DCFA

3 9

PyCA cryptography 0.8.1 release
by Paul Kehrer March 20, 2015

March 20, 2015

PyCA cryptography 0.8.1 has been released to PyPI. This version contains no changes outside of the Windows wheels, which are now built against OpenSSL 1.0.2a. -Paul Kehrer

1 0

X.509 certificate creation
by Jesus Cea March 16, 2015

March 16, 2015

A feature request :-). I would love to be able to manage a X.509 PKI infrastructure without touching OpenSSL. OpenSSL stock configuration misses a lot of options and knobs. For instance creating X.509 certificates with "subject alt name" field is really painful. I think this would be a selling point in some environments... :-). -- Jesús Cea Avión _/_/ _/_/_/ _/_/_/ jcea(a)jcea.es - http://www.jcea.es/ _/_/ _/_/ _/_/ _/_/ _/_/ Twitter: @jcea _/_/ _/_/ _/_/_/_/_/ jabber / xmpp:jcea@jabber.org _/_/ _/_/ _/_/ _/_/ _/_/ "Things are not so easy" _/_/ _/_/ _/_/ _/_/ _/_/ _/_/ "My name is Dump, Core Dump" _/_/_/ _/_/_/ _/_/ _/_/ "El amor es poner tu felicidad en la felicidad de otro" - Leibniz

2 1

PyCA cryptography 0.8 release
by Paul Kehrer March 9, 2015

March 9, 2015

On behalf of all the contributors to PyCA cryptography (https://github.com/pyca/cryptography) I’m extremely happy to announce that 0.8 has been tagged and released to PyPI. This release is one of our largest ever (complete changelog here: https://cryptography.io/en/latest/changelog/). Some highlights: * X509 name parsing support (subject and issuer on X509 certificates) * X509 signature algorithm support * Serialization support for both public and private asymmetric keys (see docs for details and current limitations) * Compiles against LibreSSL * Windows wheels are now built against OpenSSL 1.0.2 -Paul Kehrer

1 0

Help required for RSAPrivateKeyWithSerialization
by olivier sallou March 7, 2015

March 7, 2015

Hi, I followed examples to create an rsa (public/private) key and it works fine. I do not see however how to "save" my keys for later reuse/exchange. I see no "export/convertt to bytes" method to save keys in a file. In documentation, there are references to RSAPrivateKeyWithSerialization but I do not see how to get one from rsa.generate_private_key(). Could you help me? Thanks Olivier

2 2

PyNaCl-0.3.0 release
by Brian Warner March 4, 2015

March 4, 2015

I'm pleased to announce that we've released PyNaCl-0.3.0 to PyPI. https://pypi.python.org/pypi/PyNaCl/ "pynacl", as the package is known, is a python2/3/pypy binding to libsodium[1], which gives applications access to the "NaCl" cryptography library[2] (Curve25519 "Box" public-key authenticated encryption, Salsa20/Poly1305 secret-key authenticated encryption, and various lower-level primitives). It's been 17 months since the previous (0.2.3) release, so a lot of things have changed. The most important items, however, are: * "pip install pynacl" now works, as does using pynacl as a dependency of another pip-installed program (install_requires=["pynacl"]) * The raw "nacl.c" module has been removed, and replaced with "nacl.bindings" that offers the same functionality. The API is different, however (in particular the arguments now match other nacl/libsodium bindings), so we decided to remove the old module to avoid confusion. * a URLSafeBase64Encoder was added, for encoding messages and keys * upgraded to libsodium-1.0.1 (but note 1.0.2 is now the most recent) Thanks to everyone who's contributed code, testing, and eyeballs to this release! Please report any bugs to the github tracker[3]. cheers, -Brian [1]: https://github.com/jedisct1/libsodium/ [2]: http://nacl.cr.yp.to/ [3]: https://github.com/pyca/pynacl

1 0

PEM export for RSA private keys just landed
by Alex Gaynor March 1, 2015

March 1, 2015

Hey all, This has been a long time in the works -- thanks to Paul Kehrer for pushing through on this, and all the folks that contributed over 150 comments to the pull request! If this is a feature that you've been interested in (and we know there's a lot of you!), please check out the docs and kick the tires on the API: https://cryptography.io/en/latest/hazmat/primitives/asymmetric/rsa/#key-ser… Thanks, Alex -- "I disapprove of what you say, but I will defend to the death your right to say it." -- Evelyn Beatrice Hall (summarizing Voltaire) "The people's good is the highest law." -- Cicero GPG Key fingerprint: 125F 5C67 DFE9 4084

2 1