internlm/SWE-Fixer-Train-110K huggingface dataset:
Repository: pyca/cryptography

Issue:
SSL_renegotiate is not present in OpenSSL bindings
The function 'SSL_renegotiate' is present in OpenSSL but does not appear to be present in the bindings.



Discussion:
`int SSL_renegotiate(SSL *)` is the signature.

I don't understand why the binding isn't present - I can't find the signature in the _conditional.py file

Things have to be explicitly bound, they don't automatically show up.

Where are they bound (in which file)?


Resolving patch:
diff --git a/src/_cffi_src/openssl/ssl.py b/src/_cffi_src/openssl/ssl.py
--- a/src/_cffi_src/openssl/ssl.py
+++ b/src/_cffi_src/openssl/ssl.py
@@ -205,6 +205,7 @@
 int SSL_get_error(const SSL *, int);
 int SSL_do_handshake(SSL *);
 int SSL_shutdown(SSL *);
+int SSL_renegotiate(SSL *);
 const char *SSL_get_cipher_list(const SSL *, int);
 Cryptography_STACK_OF_SSL_CIPHER *SSL_get_ciphers(const SSL *);
 


Test patch:
Repository: pyca/cryptography

Issue:
Copy/paste error in load_elliptic_curve_private_numbers
In hazmat/backends/interfaces.py, the following function is defined:

``` python
    @abc.abstractmethod
    def load_elliptic_curve_private_numbers(self, numbers):
        """
        Return an EllipticCurvePublicKey provider using the given numbers.
        """
```

The comment here should say that it returns an EllipticCurvePrivateKey, not public key. This appears to be a copy/paste error from the function above it.



Discussion:
Nice catch, thanks!


Resolving patch:
diff --git a/src/cryptography/hazmat/backends/interfaces.py b/src/cryptography/hazmat/backends/interfaces.py
--- a/src/cryptography/hazmat/backends/interfaces.py
+++ b/src/cryptography/hazmat/backends/interfaces.py
@@ -212,7 +212,7 @@ def load_elliptic_curve_public_numbers(self, numbers):
     @abc.abstractmethod
     def load_elliptic_curve_private_numbers(self, numbers):
         """
-        Return an EllipticCurvePublicKey provider using the given numbers.
+        Return an EllipticCurvePrivateKey provider using the given numbers.
         """
 
 


Test patch:
Repository: pyca/cryptography

Issue:
Add __repr__ for x509.Extensions
x509.Extensions should have a **repr**



Discussion:

Resolving patch:
diff --git a/src/cryptography/x509/extensions.py b/src/cryptography/x509/extensions.py
--- a/src/cryptography/x509/extensions.py
+++ b/src/cryptography/x509/extensions.py
@@ -104,6 +104,11 @@ def __iter__(self):
     def __len__(self):
         return len(self._extensions)
 
+    def __repr__(self):
+        return (
+            "<Extensions({0})>".format(self._extensions)
+        )
+
 
 @utils.register_interface(ExtensionType)
 class AuthorityKeyIdentifier(object):


Test patch:
diff --git a/tests/test_x509_ext.py b/tests/test_x509_ext.py
--- a/tests/test_x509_ext.py
+++ b/tests/test_x509_ext.py
@@ -857,6 +857,20 @@ def test_one_extension_get_for_class(self, backend):
         assert ext is not None
         assert isinstance(ext.value, x509.BasicConstraints)
 
+    def test_repr(self, backend):
+        cert = _load_cert(
+            os.path.join(
+                "x509", "custom", "basic_constraints_not_critical.pem"
+            ),
+            x509.load_pem_x509_certificate,
+            backend
+        )
+        assert repr(cert.extensions) == (
+            "<Extensions([<Extension(oid=<ObjectIdentifier(oid=2.5.29.19, name"
+            "=basicConstraints)>, critical=False, value=<BasicConstraints(ca=F"
+            "alse, path_length=None)>)>])>"
+        )
+
 
 @pytest.mark.requires_backend_interface(interface=RSABackend)
 @pytest.mark.requires_backend_interface(interface=X509Backend)
Repository: pyca/cryptography

Issue:
cryptography.x509.Name implements __eq__ but not __hash__



Discussion:

Resolving patch:
diff --git a/src/cryptography/x509/name.py b/src/cryptography/x509/name.py
--- a/src/cryptography/x509/name.py
+++ b/src/cryptography/x509/name.py
@@ -40,6 +40,9 @@ def __eq__(self, other):
     def __ne__(self, other):
         return not self == other
 
+    def __hash__(self):
+        return hash((self.oid, self.value))
+
     def __repr__(self):
         return "<NameAttribute(oid={0.oid}, value={0.value!r})>".format(self)
 
@@ -60,6 +63,11 @@ def __eq__(self, other):
     def __ne__(self, other):
         return not self == other
 
+    def __hash__(self):
+        # TODO: this is relatively expensive, if this looks like a bottleneck
+        # for you, consider optimizing!
+        return hash(tuple(self._attributes))
+
     def __iter__(self):
         return iter(self._attributes)
 


Test patch:
diff --git a/tests/test_x509.py b/tests/test_x509.py
--- a/tests/test_x509.py
+++ b/tests/test_x509.py
@@ -2755,6 +2755,23 @@ def test_ne(self):
         assert name1 != name2
         assert name1 != object()
 
+    def test_hash(self):
+        name1 = x509.Name([
+            x509.NameAttribute(x509.ObjectIdentifier('oid'), u'value1'),
+            x509.NameAttribute(x509.ObjectIdentifier('oid2'), u'value2'),
+        ])
+        name2 = x509.Name([
+            x509.NameAttribute(x509.ObjectIdentifier('oid'), u'value1'),
+            x509.NameAttribute(x509.ObjectIdentifier('oid2'), u'value2'),
+        ])
+        name3 = x509.Name([
+            x509.NameAttribute(x509.ObjectIdentifier('oid2'), u'value2'),
+            x509.NameAttribute(x509.ObjectIdentifier('oid'), u'value1'),
+        ])
+
+        assert hash(name1) == hash(name2)
+        assert hash(name1) != hash(name3)
+
     def test_repr(self):
         name = x509.Name([
             x509.NameAttribute(NameOID.COMMON_NAME, u'cryptography.io'),
Repository: pyca/cryptography

Issue:
EllipticCurvePrivateNumbers and EllipticCurvePublicNumbers should have an __repr__



Discussion:

Resolving patch:
diff --git a/src/cryptography/hazmat/primitives/asymmetric/ec.py b/src/cryptography/hazmat/primitives/asymmetric/ec.py
--- a/src/cryptography/hazmat/primitives/asymmetric/ec.py
+++ b/src/cryptography/hazmat/primitives/asymmetric/ec.py
@@ -302,6 +302,12 @@ def __eq__(self, other):
     def __ne__(self, other):
         return not self == other
 
+    def __repr__(self):
+        return (
+            "<EllipticCurvePublicNumbers(curve={0.curve.name}, x={0.x}, "
+            "y={0.y}>".format(self)
+        )
+
 
 class EllipticCurvePrivateNumbers(object):
     def __init__(self, private_value, public_numbers):


Test patch:
diff --git a/tests/hazmat/primitives/test_ec.py b/tests/hazmat/primitives/test_ec.py
--- a/tests/hazmat/primitives/test_ec.py
+++ b/tests/hazmat/primitives/test_ec.py
@@ -215,6 +215,11 @@ def test_from_encoded_point_not_a_curve():
         )
 
 
+def test_ec_public_numbers_repr():
+    pn = ec.EllipticCurvePublicNumbers(2, 3, ec.SECP256R1())
+    assert repr(pn) == "<EllipticCurvePublicNumbers(curve=secp256r1, x=2, y=3>"
+
+
 @pytest.mark.requires_backend_interface(interface=EllipticCurveBackend)
 class TestECWithNumbers(object):
     @pytest.mark.parametrize(
Repository: pyca/cryptography

Issue:
Unpin pytest
revert https://github.com/pyca/cryptography/pull/2513

waiting on a pytest release with https://github.com/pytest-dev/pytest/issues/1238 landed



Discussion:
`pytest-2.8.5` is out now. :smile:


Resolving patch:
diff --git a/setup.py b/setup.py
--- a/setup.py
+++ b/setup.py
@@ -59,7 +59,7 @@
 
 # If you add a new dep here you probably need to add it in the tox.ini as well
 test_requirements = [
-    "pytest!=2.8.4",
+    "pytest",
     "pretend",
     "iso8601",
     "hypothesis",


Test patch:
Repository: pyca/cryptography

Issue:
CertificateBuilder should raise an error if not_valid_after is before not_valid_before



Discussion:

Resolving patch:
diff --git a/src/cryptography/x509/base.py b/src/cryptography/x509/base.py
--- a/src/cryptography/x509/base.py
+++ b/src/cryptography/x509/base.py
@@ -436,6 +436,11 @@ def not_valid_before(self, time):
         if time <= _UNIX_EPOCH:
             raise ValueError('The not valid before date must be after the unix'
                              ' epoch (1970 January 1).')
+        if self._not_valid_after is not None and time > self._not_valid_after:
+            raise ValueError(
+                'The not valid before date must be before the not valid after '
+                'date.'
+            )
         return CertificateBuilder(
             self._issuer_name, self._subject_name,
             self._public_key, self._serial_number, time,
@@ -453,6 +458,12 @@ def not_valid_after(self, time):
         if time <= _UNIX_EPOCH:
             raise ValueError('The not valid after date must be after the unix'
                              ' epoch (1970 January 1).')
+        if (self._not_valid_before is not None and
+                time < self._not_valid_before):
+            raise ValueError(
+                'The not valid after date must be after the not valid before '
+                'date.'
+            )
         return CertificateBuilder(
             self._issuer_name, self._subject_name,
             self._public_key, self._serial_number, self._not_valid_before,


Test patch:
diff --git a/tests/test_x509.py b/tests/test_x509.py
--- a/tests/test_x509.py
+++ b/tests/test_x509.py
@@ -1437,6 +1437,28 @@ def test_subject_name_may_only_be_set_once(self):
         with pytest.raises(ValueError):
             builder.subject_name(name)
 
+    def test_not_valid_before_after_not_valid_after(self):
+        builder = x509.CertificateBuilder()
+
+        builder = builder.not_valid_after(
+            datetime.datetime(2002, 1, 1, 12, 1)
+        )
+        with pytest.raises(ValueError):
+            builder.not_valid_before(
+                datetime.datetime(2003, 1, 1, 12, 1)
+            )
+
+    def test_not_valid_after_before_not_valid_before(self):
+        builder = x509.CertificateBuilder()
+
+        builder = builder.not_valid_before(
+            datetime.datetime(2002, 1, 1, 12, 1)
+        )
+        with pytest.raises(ValueError):
+            builder.not_valid_after(
+                datetime.datetime(2001, 1, 1, 12, 1)
+            )
+
     @pytest.mark.requires_backend_interface(interface=RSABackend)
     @pytest.mark.requires_backend_interface(interface=X509Backend)
     def test_public_key_must_be_public_key(self, backend):
Repository: pyca/cryptography

Issue:
Remove SSLv2 bindings
Nobody should use this, pyOpenSSL should already handle the case where it's unavailable since many OpenSSLs are compiled without it, let's just strip the whole thing.



Discussion:

Resolving patch:
diff --git a/src/_cffi_src/openssl/ssl.py b/src/_cffi_src/openssl/ssl.py
--- a/src/_cffi_src/openssl/ssl.py
+++ b/src/_cffi_src/openssl/ssl.py
@@ -301,15 +301,6 @@
 
 /*  methods */
 
-/* SSLv2 support is compiled out of some versions of OpenSSL.  These will
- * get special support when we generate the bindings so that if they are
- * available they will be wrapped, but if they are not they won't cause
- * problems (like link errors).
- */
-const SSL_METHOD *SSLv2_method(void);
-const SSL_METHOD *SSLv2_server_method(void);
-const SSL_METHOD *SSLv2_client_method(void);
-
 /*
  * TLSv1_1 and TLSv1_2 are recent additions.  Only sufficiently new versions of
  * OpenSSL support them.
@@ -441,14 +432,12 @@
 #else
 static const long Cryptography_HAS_SECURE_RENEGOTIATION = 1;
 #endif
-#ifdef OPENSSL_NO_SSL2
+
+/* Cryptography now compiles out all SSLv2 bindings. This exists to allow
+ * clients that use it to check for SSLv2 support to keep functioning as
+ * expected.
+ */
 static const long Cryptography_HAS_SSL2 = 0;
-SSL_METHOD* (*SSLv2_method)(void) = NULL;
-SSL_METHOD* (*SSLv2_client_method)(void) = NULL;
-SSL_METHOD* (*SSLv2_server_method)(void) = NULL;
-#else
-static const long Cryptography_HAS_SSL2 = 1;
-#endif
 
 #ifdef OPENSSL_NO_SSL3_METHOD
 static const long Cryptography_HAS_SSL3_METHOD = 0;
diff --git a/src/cryptography/hazmat/bindings/openssl/_conditional.py b/src/cryptography/hazmat/bindings/openssl/_conditional.py
--- a/src/cryptography/hazmat/bindings/openssl/_conditional.py
+++ b/src/cryptography/hazmat/bindings/openssl/_conditional.py
@@ -276,12 +276,6 @@
         "TLSv1_2_client_method",
     ],
 
-    "Cryptography_HAS_SSL2": [
-        "SSLv2_method",
-        "SSLv2_client_method",
-        "SSLv2_server_method",
-    ],
-
     "Cryptography_HAS_SSL3_METHOD": [
         "SSLv3_method",
         "SSLv3_client_method",


Test patch:
Repository: pyca/cryptography

Issue:
NameOID should have EV OIDs
We're at least missing `jurisdictionCountryName` (1.3.6.1.4.1.311.60.2.1.3). This OID was formerly called `jurisdictionOfIncorporationCountryName` (changed in this CAB ballot https://cabforum.org/2014/03/24/ballot-119-remove-ofincorporation-from-oid-descriptions-in-evg-9-2-5/)



Discussion:
Since there's some confusion, I mean the X509Name OIDs that are used in EV certificates, not the EV policy OIDs :)


Resolving patch:
diff --git a/src/cryptography/x509/oid.py b/src/cryptography/x509/oid.py
--- a/src/cryptography/x509/oid.py
+++ b/src/cryptography/x509/oid.py
@@ -80,6 +80,12 @@ class NameOID(object):
     PSEUDONYM = ObjectIdentifier("2.5.4.65")
     DOMAIN_COMPONENT = ObjectIdentifier("0.9.2342.19200300.100.1.25")
     EMAIL_ADDRESS = ObjectIdentifier("1.2.840.113549.1.9.1")
+    JURISDICTION_COUNTRY_NAME = ObjectIdentifier("1.3.6.1.4.1.311.60.2.1.3")
+    JURISDICTION_LOCALITY_NAME = ObjectIdentifier("1.3.6.1.4.1.311.60.2.1.1")
+    JURISDICTION_STATE_OR_PROVINCE_NAME = ObjectIdentifier(
+        "1.3.6.1.4.1.311.60.2.1.2"
+    )
+    BUSINESS_CATEGORY = ObjectIdentifier("2.5.4.15")
 
 
 class SignatureAlgorithmOID(object):
@@ -151,6 +157,13 @@ class CertificatePoliciesOID(object):
     NameOID.PSEUDONYM: "pseudonym",
     NameOID.DOMAIN_COMPONENT: "domainComponent",
     NameOID.EMAIL_ADDRESS: "emailAddress",
+    NameOID.JURISDICTION_COUNTRY_NAME: "jurisdictionCountryName",
+    NameOID.JURISDICTION_LOCALITY_NAME: "jurisdictionLocalityName",
+    NameOID.JURISDICTION_STATE_OR_PROVINCE_NAME: (
+        "jurisdictionStateOrProvinceName"
+    ),
+    NameOID.BUSINESS_CATEGORY: "businessCategory",
+
     SignatureAlgorithmOID.RSA_WITH_MD5: "md5WithRSAEncryption",
     SignatureAlgorithmOID.RSA_WITH_SHA1: "sha1WithRSAEncryption",
     SignatureAlgorithmOID.RSA_WITH_SHA224: "sha224WithRSAEncryption",


Test patch:
Repository: pyca/cryptography

Issue:
Set a minimum version on setuptools
Apparently it fails in hilarious ways with very very old setuptools (or even distribute). We should set a floor in `setup.py`.

@dstufft do you have opinions on what a reasonable floor would be?



Discussion:

Resolving patch:
diff --git a/setup.py b/setup.py
--- a/setup.py
+++ b/setup.py
@@ -37,7 +37,7 @@
     "idna>=2.0",
     "pyasn1>=0.1.8",
     "six>=1.4.1",
-    "setuptools",
+    "setuptools>=1.0",
 ]
 setup_requirements = []
 


Test patch:
Repository: pyca/cryptography

Issue:
Warn on OpenSSL 0.9.8?
Starting in 3.5 weeks OpenSSL 0.9.8 will officially be unsupported by the upstream team. It's unclear what this will mean for various downstreams (notable RHEL, CentOS, and OS X), but in practice it means there's likely to be a significantly decreased level of attention, research, and patching that goes into it.

I'd like to suggest that, starting with whatever release comes after January 1st, 2016, we emit a warning if users are linked against OpenSSL 0.9.8, suggesting they upgrade to a newer OpenSSL (or OS I guess?).



Discussion:

Resolving patch:
diff --git a/src/cryptography/hazmat/bindings/openssl/binding.py b/src/cryptography/hazmat/bindings/openssl/binding.py
--- a/src/cryptography/hazmat/bindings/openssl/binding.py
+++ b/src/cryptography/hazmat/bindings/openssl/binding.py
@@ -8,6 +8,7 @@
 import os
 import threading
 import types
+import warnings
 
 from cryptography.exceptions import InternalError
 from cryptography.hazmat.bindings._openssl import ffi, lib
@@ -180,3 +181,11 @@ def _lock_cb(cls, mode, n, file, line):
 # condition registering the OpenSSL locks. On Python 3.4+ the import lock
 # is per module so this approach will not work.
 Binding.init_static_locks()
+
+if Binding.lib.SSLeay() < 0x10001000:
+    warnings.warn(
+        "OpenSSL versions less than 1.0.1 are no longer supported by the "
+        "OpenSSL project, please upgrade. A future version of cryptography "
+        "will drop support for these versions.",
+        DeprecationWarning
+    )


Test patch:
Repository: pyca/cryptography

Issue:
Pending deprecation warning on fernet creation since 1.2.1
``` python
In [1]: from cryptography.fernet import Fernet

In [2]: key = Fernet.generate_key()

In [3]: fernet = Fernet(key)
/home/simon/.virtualenvs/project/local/lib/python2.7/site-packages/cryptography/x509/__init__.py:32: PendingDeprecationWarning: CRLExtensionOID has been renamed to CRLEntryExtensionOID
  from cryptography.x509.oid import (
```



Discussion:
Thanks for the report, definitely a bug we should fix.


Resolving patch:
diff --git a/src/cryptography/x509/__init__.py b/src/cryptography/x509/__init__.py
--- a/src/cryptography/x509/__init__.py
+++ b/src/cryptography/x509/__init__.py
@@ -4,6 +4,7 @@
 
 from __future__ import absolute_import, division, print_function
 
+from cryptography import utils
 from cryptography.x509.base import (
     Certificate, CertificateBuilder, CertificateRevocationList,
     CertificateRevocationListBuilder,
@@ -30,12 +31,19 @@
 )
 from cryptography.x509.name import Name, NameAttribute
 from cryptography.x509.oid import (
-    AuthorityInformationAccessOID, CRLEntryExtensionOID, CRLExtensionOID,
+    AuthorityInformationAccessOID, CRLEntryExtensionOID,
     CertificatePoliciesOID, ExtendedKeyUsageOID, ExtensionOID, NameOID,
     ObjectIdentifier, SignatureAlgorithmOID, _SIG_OIDS_TO_HASH
 )
 
 
+CRLExtensionOID = utils.deprecated(
+    CRLEntryExtensionOID,
+    __name__,
+    "CRLExtensionOID has been renamed to CRLEntryExtensionOID",
+    utils.DeprecatedIn12
+)
+
 OID_AUTHORITY_INFORMATION_ACCESS = ExtensionOID.AUTHORITY_INFORMATION_ACCESS
 OID_AUTHORITY_KEY_IDENTIFIER = ExtensionOID.AUTHORITY_KEY_IDENTIFIER
 OID_BASIC_CONSTRAINTS = ExtensionOID.BASIC_CONSTRAINTS


Test patch:
Repository: pyca/cryptography

Issue:
_ModuleWithDeprecations doesn't handle patching properly.
`_ModuleWithDeprecations` catches `__getattr__` and `__setattr__` to patch through to the underlying module, but does not intercept `__delattr__`. That means that if you're using something like `mock.patch`, the mock successfully lands in place, but cannot be removed: the mock was applied to the underlying module, but the delete comes from the proxy.

Should be easily fixed.



Discussion:

Resolving patch:
diff --git a/src/cryptography/utils.py b/src/cryptography/utils.py
--- a/src/cryptography/utils.py
+++ b/src/cryptography/utils.py
@@ -119,6 +119,13 @@ def __getattr__(self, attr):
     def __setattr__(self, attr, value):
         setattr(self._module, attr, value)
 
+    def __delattr__(self, attr):
+        obj = getattr(self._module, attr)
+        if isinstance(obj, _DeprecatedValue):
+            warnings.warn(obj.message, obj.warning_class, stacklevel=2)
+
+        delattr(self._module, attr)
+
     def __dir__(self):
         return ["_module"] + dir(self._module)
 


Test patch:
diff --git a/tests/test_warnings.py b/tests/test_warnings.py
--- a/tests/test_warnings.py
+++ b/tests/test_warnings.py
@@ -8,6 +8,8 @@
 import types
 import warnings
 
+import pytest
+
 from cryptography.utils import deprecated
 
 
@@ -45,3 +47,42 @@ def test_deprecated(self, monkeypatch):
         assert msg2.message.args == ("more deprecated text",)
 
         assert "Y" in dir(mod)
+
+    def test_deleting_deprecated_members(self, monkeypatch):
+        mod = types.ModuleType("TestDeprecated/test_deprecated")
+        monkeypatch.setitem(sys.modules, mod.__name__, mod)
+        mod.X = deprecated(
+            value=1,
+            module_name=mod.__name__,
+            message="deprecated message text",
+            warning_class=DeprecationWarning
+        )
+        mod.Y = deprecated(
+            value=2,
+            module_name=mod.__name__,
+            message="more deprecated text",
+            warning_class=PendingDeprecationWarning,
+        )
+        mod = sys.modules[mod.__name__]
+        mod.Z = 3
+
+        with warnings.catch_warnings(record=True) as log:
+            warnings.simplefilter("always", PendingDeprecationWarning)
+            warnings.simplefilter("always", DeprecationWarning)
+            del mod.X
+            del mod.Y
+            del mod.Z
+
+        [msg1, msg2] = log
+        assert msg1.category is DeprecationWarning
+        assert msg1.message.args == ("deprecated message text",)
+
+        assert msg2.category is PendingDeprecationWarning
+        assert msg2.message.args == ("more deprecated text",)
+
+        assert "X" not in dir(mod)
+        assert "Y" not in dir(mod)
+        assert "Z" not in dir(mod)
+
+        with pytest.raises(AttributeError):
+            del mod.X
Repository: pyca/cryptography

Issue:
Do the deprecation dance
We have a deprecation to complete from the 1.2 release.



Discussion:

Resolving patch:
diff --git a/src/cryptography/utils.py b/src/cryptography/utils.py
--- a/src/cryptography/utils.py
+++ b/src/cryptography/utils.py
@@ -15,7 +15,6 @@
 # the functions deprecated in 1.0 are on an arbitrarily extended deprecation
 # cycle and should not be removed until we agree on when that cycle ends.
 DeprecatedIn10 = DeprecationWarning
-DeprecatedIn12 = DeprecationWarning
 
 
 def read_only_property(name):
diff --git a/src/cryptography/x509/__init__.py b/src/cryptography/x509/__init__.py
--- a/src/cryptography/x509/__init__.py
+++ b/src/cryptography/x509/__init__.py
@@ -4,7 +4,6 @@
 
 from __future__ import absolute_import, division, print_function
 
-from cryptography import utils
 from cryptography.x509.base import (
     Certificate, CertificateBuilder, CertificateRevocationList,
     CertificateRevocationListBuilder,
@@ -38,13 +37,6 @@
 )
 
 
-CRLExtensionOID = utils.deprecated(
-    CRLEntryExtensionOID,
-    __name__,
-    "CRLExtensionOID has been renamed to CRLEntryExtensionOID",
-    utils.DeprecatedIn12
-)
-
 OID_AUTHORITY_INFORMATION_ACCESS = ExtensionOID.AUTHORITY_INFORMATION_ACCESS
 OID_AUTHORITY_KEY_IDENTIFIER = ExtensionOID.AUTHORITY_KEY_IDENTIFIER
 OID_BASIC_CONSTRAINTS = ExtensionOID.BASIC_CONSTRAINTS
@@ -174,7 +166,6 @@
     "OID_CA_ISSUERS",
     "OID_OCSP",
     "_GENERAL_NAMES",
-    "CRLExtensionOID",
     "CertificateIssuer",
     "CRLReason",
     "InvalidityDate",
diff --git a/src/cryptography/x509/oid.py b/src/cryptography/x509/oid.py
--- a/src/cryptography/x509/oid.py
+++ b/src/cryptography/x509/oid.py
@@ -94,14 +94,6 @@ class CRLEntryExtensionOID(object):
     INVALIDITY_DATE = ObjectIdentifier("2.5.29.24")
 
 
-CRLExtensionOID = utils.deprecated(
-    CRLEntryExtensionOID,
-    __name__,
-    "CRLExtensionOID has been renamed to CRLEntryExtensionOID",
-    utils.DeprecatedIn12
-)
-
-
 class NameOID(object):
     COMMON_NAME = ObjectIdentifier("2.5.4.3")
     COUNTRY_NAME = ObjectIdentifier("2.5.4.6")


Test patch:
Repository: pyca/cryptography

Issue:
Redundant exclude in setup.py's find_packages
I think the call can be reduced from 

``` python
find_packages(
    where="src", exclude=["_cffi_src", "_cffi_src.*", "tests", "tests.*"]
)
```

to

``` python
find_packages(where="src", exclude=["_cffi_src", "_cffi_src.*"])
```

because of the `where="src"`. I verified by printing the output from setup.py



Discussion:
Thanks for the report. Would you like to put in a PR to correct this?

Yeah, I'll create a PR shortly.


Resolving patch:
diff --git a/setup.py b/setup.py
--- a/setup.py
+++ b/setup.py
@@ -302,9 +302,7 @@ def run_tests(self):
     ],
 
     package_dir={"": "src"},
-    packages=find_packages(
-        where="src", exclude=["_cffi_src", "_cffi_src.*", "tests", "tests.*"]
-    ),
+    packages=find_packages(where="src", exclude=["_cffi_src", "_cffi_src.*"]),
     include_package_data=True,
 
     install_requires=requirements,


Test patch: