internlm/SWE-Fixer-Train-110K huggingface dataset:
Repository: pyca/cryptography

Issue:
python setup.py check is deprecated, switch to twine check
We run `setup.py check` as part of our docs job, but it has been deprecated:

```
warning: Check: This command has been deprecated. Use `twine check` instead: https://packaging.python.org/guides/making-a-pypi-friendly-readme#validating-restructuredtext-markup
```

We should switch to twine check.


Discussion:

Resolving patch:
diff --git a/setup.py b/setup.py
--- a/setup.py
+++ b/setup.py
@@ -303,7 +303,7 @@ def run_tests(self):
         "docstest": [
             "doc8",
             "pyenchant >= 1.6.11",
-            "readme_renderer >= 16.0",
+            "twine >= 1.12.0",
             "sphinxcontrib-spelling >= 4.0.1",
         ],
         "pep8test": [


Test patch:
Repository: pyca/cryptography

Issue:
Incorrect != in x509 types due to missing __ne__ in #4819
```pycon
~/p/cryptography ❯❯❯ python
Python 2.7.16 (default, Mar  4 2019, 09:01:38)
[GCC 4.2.1 Compatible Apple LLVM 10.0.0 (clang-1000.11.45.5)] on darwin
Type "help", "copyright", "credits" or "license" for more information.
>>> from cryptography import x509
>>> x1 = x509.OCSPNoCheck()
>>> x2 = x509.OCSPNoCheck()
>>> x1 == x2
True
>>> x1 != x2
True
```


Discussion:
cc @mathiasertl 

Resolving patch:
diff --git a/src/cryptography/x509/extensions.py b/src/cryptography/x509/extensions.py
--- a/src/cryptography/x509/extensions.py
+++ b/src/cryptography/x509/extensions.py
@@ -862,6 +862,9 @@ def __eq__(self, other):
 
         return True
 
+    def __ne__(self, other):
+        return not self == other
+
     def __hash__(self):
         return hash(OCSPNoCheck)
 
@@ -879,6 +882,9 @@ def __eq__(self, other):
 
         return True
 
+    def __ne__(self, other):
+        return not self == other
+
     def __hash__(self):
         return hash(PrecertPoison)
 


Test patch:
diff --git a/tests/x509/test_x509_ext.py b/tests/x509/test_x509_ext.py
--- a/tests/x509/test_x509_ext.py
+++ b/tests/x509/test_x509_ext.py
@@ -4404,9 +4404,12 @@ def test_hash(self):
         assert hash(onc1) == hash(onc2)
 
     def test_ne(self):
-        onc = x509.OCSPNoCheck()
+        onc1 = x509.OCSPNoCheck()
+        onc2 = x509.OCSPNoCheck()
 
-        assert onc != object()
+        assert onc1 == onc2
+        assert (onc1 != onc2) is False
+        assert onc1 != object()
 
     def test_repr(self):
         onc = x509.OCSPNoCheck()
@@ -4929,9 +4932,12 @@ def test_hash(self):
         assert hash(pcp1) == hash(pcp2)
 
     def test_ne(self):
-        pcp = x509.PrecertPoison()
+        pcp1 = x509.PrecertPoison()
+        pcp2 = x509.PrecertPoison()
 
-        assert pcp != object()
+        assert pcp1 == pcp2
+        assert (pcp1 != pcp2) is False
+        assert pcp1 != object()
 
     def test_repr(self):
         pcp = x509.PrecertPoison()
Repository: pyca/cryptography

Issue:
PrecertPoison ExtensionOID  has no name
In cryptography 2.6.1, the PrecertPoison extension has no name defined:

```
>>> import cryptography
>>> cryptography.__version__
'2.6.1'
>>> from cryptography.x509.oid import ExtensionOID
>>> ExtensionOID.KEY_USAGE
<ObjectIdentifier(oid=2.5.29.15, name=keyUsage)>
>>> ExtensionOID.PRECERT_POISON
<ObjectIdentifier(oid=1.3.6.1.4.1.11129.2.4.3, name=Unknown OID)>
```


Discussion:
We should add that to `x509.oid._OID_NAMES`. Are you aware of a camelCase style name? I don't see one in the typical OID registries. Hooray non-canonical friendly names...
> Are you aware of a camelCase style name?

If you mean if I'm aware of a standard that mandates these names: I'm not aware of any.

btw, maybe a good idea: write a test that loops over all `ExtensionOID` members and see if it's in `OID_NAMES`.

Resolving patch:
diff --git a/src/cryptography/x509/oid.py b/src/cryptography/x509/oid.py
--- a/src/cryptography/x509/oid.py
+++ b/src/cryptography/x509/oid.py
@@ -196,6 +196,7 @@ class CertificatePoliciesOID(object):
     ExtensionOID.PRECERT_SIGNED_CERTIFICATE_TIMESTAMPS: (
         "signedCertificateTimestampList"
     ),
+    ExtensionOID.PRECERT_POISON: "ctPoison",
     CRLEntryExtensionOID.CRL_REASON: "cRLReason",
     CRLEntryExtensionOID.INVALIDITY_DATE: "invalidityDate",
     CRLEntryExtensionOID.CERTIFICATE_ISSUER: "certificateIssuer",


Test patch:
diff --git a/tests/x509/test_x509_ext.py b/tests/x509/test_x509_ext.py
--- a/tests/x509/test_x509_ext.py
+++ b/tests/x509/test_x509_ext.py
@@ -23,7 +23,7 @@
 from cryptography.x509.general_name import _lazy_import_idna
 from cryptography.x509.oid import (
     AuthorityInformationAccessOID, ExtendedKeyUsageOID, ExtensionOID,
-    NameOID, ObjectIdentifier
+    NameOID, ObjectIdentifier, _OID_NAMES
 )
 
 from .test_x509 import _load_cert
@@ -5215,3 +5215,10 @@ def test_hash(self):
         nonce3 = x509.OCSPNonce(b"1" * 5)
         assert hash(nonce1) == hash(nonce2)
         assert hash(nonce1) != hash(nonce3)
+
+
+def test_all_extension_oid_members_have_names_defined():
+    for oid in dir(ExtensionOID):
+        if oid[:2] == '__':
+            continue
+        assert getattr(ExtensionOID, oid) in _OID_NAMES
Repository: pyca/cryptography

Issue:
Implement env var for OpenSSL 1.0.1 support
As part of #4923 we need to add `CRYPTOGRAPHY_ALLOW_OPENSSL_101` and update CI to test using that.


Discussion:

Resolving patch:
diff --git a/src/cryptography/hazmat/bindings/openssl/binding.py b/src/cryptography/hazmat/bindings/openssl/binding.py
--- a/src/cryptography/hazmat/bindings/openssl/binding.py
+++ b/src/cryptography/hazmat/bindings/openssl/binding.py
@@ -5,6 +5,7 @@
 from __future__ import absolute_import, division, print_function
 
 import collections
+import os
 import threading
 import types
 import warnings
@@ -156,12 +157,19 @@ def _verify_openssl_version(lib):
         lib.CRYPTOGRAPHY_OPENSSL_LESS_THAN_102 and
         not lib.CRYPTOGRAPHY_IS_LIBRESSL
     ):
-        warnings.warn(
-            "OpenSSL version 1.0.1 is no longer supported by the OpenSSL "
-            "project, please upgrade. The next version of cryptography will "
-            "drop support for it.",
-            utils.CryptographyDeprecationWarning
-        )
+        if os.environ.get("CRYPTOGRAPHY_ALLOW_OPENSSL_101"):
+            warnings.warn(
+                "OpenSSL version 1.0.1 is no longer supported by the OpenSSL "
+                "project, please upgrade. The next version of cryptography "
+                "will completely remove support for it.",
+                utils.CryptographyDeprecationWarning
+            )
+        else:
+            raise RuntimeError(
+                "You are linking against OpenSSL 1.0.1, which is no longer "
+                "supported by the OpenSSL project. You need to upgrade to a "
+                "newer version of OpenSSL."
+            )
 
 
 def _verify_package_version(version):


Test patch:
diff --git a/tests/hazmat/bindings/test_openssl.py b/tests/hazmat/bindings/test_openssl.py
--- a/tests/hazmat/bindings/test_openssl.py
+++ b/tests/hazmat/bindings/test_openssl.py
@@ -4,11 +4,14 @@
 
 from __future__ import absolute_import, division, print_function
 
+import pretend
+
 import pytest
 
 from cryptography.exceptions import InternalError
 from cryptography.hazmat.bindings.openssl.binding import (
-    Binding, _consume_errors, _openssl_assert, _verify_package_version
+    Binding, _consume_errors, _openssl_assert, _verify_openssl_version,
+    _verify_package_version
 )
 
 
@@ -122,3 +125,12 @@ def test_check_startup_errors_are_allowed(self):
     def test_version_mismatch(self):
         with pytest.raises(ImportError):
             _verify_package_version("nottherightversion")
+
+    def test_verify_openssl_version(self, monkeypatch):
+        monkeypatch.delenv("CRYPTOGRAPHY_ALLOW_OPENSSL_101", raising=False)
+        lib = pretend.stub(
+            CRYPTOGRAPHY_OPENSSL_LESS_THAN_102=True,
+            CRYPTOGRAPHY_IS_LIBRESSL=False
+        )
+        with pytest.raises(RuntimeError):
+            _verify_openssl_version(lib)
Repository: pyca/cryptography

Issue:
Pass test_invalid_version_cert if the certificate is rejected.
OpenSSL currently accepts certificates with invalid versions, leaving
the `cert.version` getter to reject unknown ones. Stricter X.509
implementations may reject them at parse time. Tolerate this in the
tests.


Discussion:
Ok, here's a new proposal: Let's always raise on cert load for bad version, even on OpenSSL, instead of raising in the `version` accessor.

This will give us consistent behavior, and make testing easier.
I have no idea what the breakage is going to be here, but it seems unlikely to be high. You have to try to create a cert with an invalid version. Let's switch to erroring on parse and see what happens in the real world I guess.

Resolving patch:
diff --git a/src/cryptography/hazmat/backends/openssl/x509.py b/src/cryptography/hazmat/backends/openssl/x509.py
--- a/src/cryptography/hazmat/backends/openssl/x509.py
+++ b/src/cryptography/hazmat/backends/openssl/x509.py
@@ -24,9 +24,19 @@
 
 @utils.register_interface(x509.Certificate)
 class _Certificate(object):
-    def __init__(self, backend, x509):
+    def __init__(self, backend, x509_cert):
         self._backend = backend
-        self._x509 = x509
+        self._x509 = x509_cert
+
+        version = self._backend._lib.X509_get_version(self._x509)
+        if version == 0:
+            self._version = x509.Version.v1
+        elif version == 2:
+            self._version = x509.Version.v3
+        else:
+            raise x509.InvalidVersion(
+                "{} is not a valid X509 version".format(version), version
+            )
 
     def __repr__(self):
         return "<Certificate(subject={}, ...)>".format(self.subject)
@@ -49,17 +59,7 @@ def fingerprint(self, algorithm):
         h.update(self.public_bytes(serialization.Encoding.DER))
         return h.finalize()
 
-    @property
-    def version(self):
-        version = self._backend._lib.X509_get_version(self._x509)
-        if version == 0:
-            return x509.Version.v1
-        elif version == 2:
-            return x509.Version.v3
-        else:
-            raise x509.InvalidVersion(
-                "{} is not a valid X509 version".format(version), version
-            )
+    version = utils.read_only_property("_version")
 
     @property
     def serial_number(self):


Test patch:
diff --git a/tests/x509/test_x509.py b/tests/x509/test_x509.py
--- a/tests/x509/test_x509.py
+++ b/tests/x509/test_x509.py
@@ -1000,13 +1000,12 @@ def test_generalized_time_not_after_cert(self, backend):
         assert cert.version is x509.Version.v3
 
     def test_invalid_version_cert(self, backend):
-        cert = _load_cert(
-            os.path.join("x509", "custom", "invalid_version.pem"),
-            x509.load_pem_x509_certificate,
-            backend
-        )
         with pytest.raises(x509.InvalidVersion) as exc:
-            cert.version
+            _load_cert(
+                os.path.join("x509", "custom", "invalid_version.pem"),
+                x509.load_pem_x509_certificate,
+                backend
+            )
 
         assert exc.value.parsed_version == 7
Repository: pyca/cryptography

Issue:
Doc mistake in example.
Example for extentions [here](https://cryptography.io/en/latest/x509/reference/#cryptography.x509.Certificate.extensions) contains errors:

` <Extension(oid=<ObjectIdentifier(oid=2.5.29.15, name=keyUsage)>, critical=True, value=<KeyUsage(digital_signature=False, content_commitment=False, key_encipherment=False, data_encipherment=False, key_agreement=False, key_cert_sign=True, crl_sign=True, encipher_only=None, decipher_only=None)>`

Last two parameters should also be False, as per documentation. Otherwise certificate creation fails. 


Discussion:
This is perhaps a bit confusing but is not a bug in the docs. The `__repr__` shown there says None because in this case `encipher_only` and `decipher_only` have no meaning when `key_agreement` is not `True`. We represent this in the repr by saying `None`, but `None` is not allowed in the `__init__` of the class itself.

Since this is confusing and also causes a bug to manifest if you attempt to use this structure in certificate creation we should probably revisit this (and likely enforce boolean as well).
If the example is failing to build, then this example is wrong in my book, so please correct for the benefit of those who will try to use it in future.

Resolving patch:
diff --git a/src/cryptography/x509/extensions.py b/src/cryptography/x509/extensions.py
--- a/src/cryptography/x509/extensions.py
+++ b/src/cryptography/x509/extensions.py
@@ -1054,8 +1054,11 @@ def __repr__(self):
             encipher_only = self.encipher_only
             decipher_only = self.decipher_only
         except ValueError:
-            encipher_only = None
-            decipher_only = None
+            # Users found None confusing because even though encipher/decipher
+            # have no meaning unless key_agreement is true, to construct an
+            # instance of the class you still need to pass False.
+            encipher_only = False
+            decipher_only = False
 
         return ("<KeyUsage(digital_signature={0.digital_signature}, "
                 "content_commitment={0.content_commitment}, "


Test patch:
diff --git a/tests/x509/test_x509_ext.py b/tests/x509/test_x509_ext.py
--- a/tests/x509/test_x509_ext.py
+++ b/tests/x509/test_x509_ext.py
@@ -896,8 +896,8 @@ def test_repr_key_agreement_false(self):
         assert repr(ku) == (
             "<KeyUsage(digital_signature=True, content_commitment=True, key_en"
             "cipherment=False, data_encipherment=False, key_agreement=False, k"
-            "ey_cert_sign=True, crl_sign=False, encipher_only=None, decipher_o"
-            "nly=None)>"
+            "ey_cert_sign=True, crl_sign=False, encipher_only=False, decipher_"
+            "only=False)>"
         )
 
     def test_repr_key_agreement_true(self):
Repository: pyca/cryptography

Issue:
Deprecate OpenSSL 1.0.2 support
It's currently about 19% of our sdist installs, primarily Ubuntu 16.04 and Amazon Linux. We should start thinking about deprecating it, as it's not supported by OpenSSL upstream any longer.

I propose that our 3.1 release begin emitting a warning, with no particular timeline attached, to get this ball rolling.


Discussion:
Looking at only 2.9.2 downloads, the latest release, 1.0.2 is only 6.8% of sdist installs, confirming that this should be ok.

Resolving patch:
diff --git a/src/_cffi_src/openssl/cryptography.py b/src/_cffi_src/openssl/cryptography.py
--- a/src/_cffi_src/openssl/cryptography.py
+++ b/src/_cffi_src/openssl/cryptography.py
@@ -66,6 +66,7 @@
 static const int CRYPTOGRAPHY_OPENSSL_110F_OR_GREATER;
 
 static const int CRYPTOGRAPHY_OPENSSL_LESS_THAN_102I;
+static const int CRYPTOGRAPHY_OPENSSL_LESS_THAN_110;
 static const int CRYPTOGRAPHY_OPENSSL_LESS_THAN_111;
 static const int CRYPTOGRAPHY_OPENSSL_LESS_THAN_111B;
 static const int CRYPTOGRAPHY_NEEDS_OSRANDOM_ENGINE;
diff --git a/src/cryptography/hazmat/bindings/openssl/binding.py b/src/cryptography/hazmat/bindings/openssl/binding.py
--- a/src/cryptography/hazmat/bindings/openssl/binding.py
+++ b/src/cryptography/hazmat/bindings/openssl/binding.py
@@ -7,6 +7,7 @@
 import collections
 import threading
 import types
+import warnings
 
 import cryptography
 from cryptography import utils
@@ -153,6 +154,19 @@ def init_static_locks(cls):
             _openssl_assert(cls.lib, res == 1)
 
 
+def _verify_openssl_version(lib):
+    if (
+        lib.CRYPTOGRAPHY_OPENSSL_LESS_THAN_110
+        and not lib.CRYPTOGRAPHY_IS_LIBRESSL
+    ):
+        warnings.warn(
+            "OpenSSL version 1.0.2 is no longer supported by the OpenSSL "
+            "project, please upgrade. A future version of cryptography will "
+            "drop support for it.",
+            utils.CryptographyDeprecationWarning,
+        )
+
+
 def _verify_package_version(version):
     # Occasionally we run into situations where the version of the Python
     # package does not match the version of the shared object that is loaded.
@@ -182,3 +196,5 @@ def _verify_package_version(version):
 # condition registering the OpenSSL locks. On Python 3.4+ the import lock
 # is per module so this approach will not work.
 Binding.init_static_locks()
+
+_verify_openssl_version(Binding.lib)


Test patch:
Repository: pyca/cryptography

Issue:
Make OpenSSL 1.0.2 error (+ env var fallback)



Discussion:

Resolving patch:
diff --git a/src/cryptography/hazmat/bindings/openssl/binding.py b/src/cryptography/hazmat/bindings/openssl/binding.py
--- a/src/cryptography/hazmat/bindings/openssl/binding.py
+++ b/src/cryptography/hazmat/bindings/openssl/binding.py
@@ -5,6 +5,7 @@
 from __future__ import absolute_import, division, print_function
 
 import collections
+import os
 import threading
 import types
 import warnings
@@ -170,12 +171,19 @@ def _verify_openssl_version(lib):
         lib.CRYPTOGRAPHY_OPENSSL_LESS_THAN_110
         and not lib.CRYPTOGRAPHY_IS_LIBRESSL
     ):
-        warnings.warn(
-            "OpenSSL version 1.0.2 is no longer supported by the OpenSSL "
-            "project, please upgrade. The next version of cryptography will "
-            "drop support for it.",
-            utils.CryptographyDeprecationWarning,
-        )
+        if os.environ.get("CRYPTOGRAPHY_ALLOW_OPENSSL_102"):
+            warnings.warn(
+                "OpenSSL version 1.0.2 is no longer supported by the OpenSSL "
+                "project, please upgrade. The next version of cryptography "
+                "will completely remove support for it.",
+                utils.CryptographyDeprecationWarning,
+            )
+        else:
+            raise RuntimeError(
+                "You are linking against OpenSSL 1.0.2, which is no longer "
+                "supported by the OpenSSL project. You need to upgrade to a "
+                "newer version of OpenSSL."
+            )
 
 
 def _verify_package_version(version):


Test patch:
diff --git a/tests/hazmat/bindings/test_openssl.py b/tests/hazmat/bindings/test_openssl.py
--- a/tests/hazmat/bindings/test_openssl.py
+++ b/tests/hazmat/bindings/test_openssl.py
@@ -4,6 +4,8 @@
 
 from __future__ import absolute_import, division, print_function
 
+import pretend
+
 import pytest
 
 from cryptography.exceptions import InternalError
@@ -11,6 +13,7 @@
     Binding,
     _consume_errors,
     _openssl_assert,
+    _verify_openssl_version,
     _verify_package_version,
 )
 
@@ -125,3 +128,12 @@ def test_check_startup_errors_are_allowed(self):
     def test_version_mismatch(self):
         with pytest.raises(ImportError):
             _verify_package_version("nottherightversion")
+
+    def test_verify_openssl_version(self, monkeypatch):
+        monkeypatch.delenv("CRYPTOGRAPHY_ALLOW_OPENSSL_102", raising=False)
+        lib = pretend.stub(
+            CRYPTOGRAPHY_OPENSSL_LESS_THAN_110=True,
+            CRYPTOGRAPHY_IS_LIBRESSL=False,
+        )
+        with pytest.raises(RuntimeError):
+            _verify_openssl_version(lib)
Repository: pyca/cryptography

Issue:
Revisit _extra_compile_args in build_openssl.py
Now that we're dropping 1.0.2 in #5511, it's time to review that.


Discussion:

Resolving patch:
diff --git a/src/_cffi_src/build_openssl.py b/src/_cffi_src/build_openssl.py
--- a/src/_cffi_src/build_openssl.py
+++ b/src/_cffi_src/build_openssl.py
@@ -51,10 +51,9 @@ def _extra_compile_args(platform):
     We set -Wconversion args here so that we only do Wconversion checks on the
     code we're compiling and not on cffi itself (as passing -Wconversion in
     CFLAGS would do). We set no error on sign conversion because some
-    function signatures in OpenSSL have changed from long -> unsigned long
-    in the past. Since that isn't a precision issue we don't care.
-    When we drop support for CRYPTOGRAPHY_OPENSSL_LESS_THAN_110 we can
-    revisit this.
+    function signatures in LibreSSL differ from OpenSSL have changed on long
+    vs. unsigned long in the past. Since that isn't a precision issue we don't
+    care.
     """
     # make sure the compiler used supports the flags to be added
     is_gcc = False
@@ -117,13 +116,6 @@ def _extra_compile_args(platform):
         "callbacks",
     ],
     libraries=_get_openssl_libraries(sys.platform),
-    # These args are passed here so that we only do Wconversion checks on the
-    # code we're compiling and not on cffi itself (as passing -Wconversion in
-    # CFLAGS would do). We set no error on sign convesrion because some
-    # function signatures in OpenSSL have changed from long -> unsigned long
-    # in the past. Since that isn't a precision issue we don't care.
-    # When we drop support for CRYPTOGRAPHY_OPENSSL_LESS_THAN_110 we can
-    # revisit this.
     extra_compile_args=_extra_compile_args(sys.platform),
     extra_link_args=extra_link_args(compiler_type()),
 )


Test patch:
Repository: pyca/cryptography

Issue:
Testing with tar bundle complains about unknown pytest markers
The source bundle ``cryptography-3.3.1.tar.gz`` does not include tox.ini. The ini file is also used to define pytest markers and pytest configuration:

```
[pytest]
addopts = -r s
markers =
    requires_backend_interface: this test requires a specific backend interface
    skip_fips: this test is not executed in FIPS mode
    supported: parametrized test requiring only_if and skip_message
    wycheproof_tests: this test runs a wycheproof fixture

```

pytest complains about unknown markers. Downstream tests with the source bundle is flooding the log file with warnings like:

```
tests/test_fernet.py:43
  /builddir/build/BUILD/cryptography-3.3.1/tests/test_fernet.py:43: PytestUnknownMarkWarning: Unknown pytest.mark.requires_backend_interface - is this a typo?  You can register custom marks to avoid this warning - for details, see https://docs.pytest.org/en/stable/mark.html
    @pytest.mark.requires_backend_interface(interface=CipherBackend)
```

Suggested solutions:

* ship ``tox.ini`` in source distribution
* Move marker definitions to ``pytest.ini`` and ship that file
* Move marker definitions to ``pyproject.toml``
* Define markers on conftest.py

```
def pytest_configure(config):
    config.addinivalue_line("markers", "requires_backend_interface: this test requires a specific backend interface")
```


Discussion:

Resolving patch:
diff --git a/setup.py b/setup.py
--- a/setup.py
+++ b/setup.py
@@ -72,7 +72,7 @@
         setup_requires=setup_requirements,
         extras_require={
             "test": [
-                "pytest>=4.4.0",
+                "pytest>=6.0",
                 "pytest-cov",
                 "pytest-subtests",
                 "pytest-xdist",


Test patch: