internlm/SWE-Fixer-Train-110K huggingface dataset:
Repository: pyca/cryptography

Issue:
x509 AuthorityKeyIdentifier and SubjectKeyIdentifier have inconsistent APIs
[x509.AuthorityKeyIdentifier](
https://github.com/pyca/cryptography/blob/96801ff92e861c8ee333c14afda691d1025e5e8f/src/cryptography/x509/extensions.py#L172) and [x509.SubjectKeyIdentifier](
https://github.com/pyca/cryptography/blob/96801ff92e861c8ee333c14afda691d1025e5e8f/src/cryptography/x509/extensions.py#L275) have different APIs to access and compare the key identifiers.

For example, to compare key identifiers one might use `ski.digest == aki.key_identifier`. On one end, the `__hash__` of `AuthorityKeyIdentifier` includes extra stuff like the serial number while the `__hash__` (same as `digest()` of `SubjectKeyIdentifier` is the key identifier). I am not sure if we want to make `AuthorityKeyIdentifier` and `SubjectKeyIdentifier` directly comparable (using `__eq__`) but I think a consistent API would be nicer.

I use these extensions to reconstruct a certificate path.


Discussion:

Resolving patch:
diff --git a/src/cryptography/x509/extensions.py b/src/cryptography/x509/extensions.py
--- a/src/cryptography/x509/extensions.py
+++ b/src/cryptography/x509/extensions.py
@@ -288,6 +288,10 @@ def from_public_key(
     def digest(self) -> bytes:
         return self._digest
 
+    @property
+    def key_identifier(self) -> bytes:
+        return self._digest
+
     def __repr__(self):
         return "<SubjectKeyIdentifier(digest={0!r})>".format(self.digest)
 


Test patch:
diff --git a/tests/x509/test_x509_ext.py b/tests/x509/test_x509_ext.py
--- a/tests/x509/test_x509_ext.py
+++ b/tests/x509/test_x509_ext.py
@@ -994,6 +994,7 @@ def test_properties(self):
         value = binascii.unhexlify(b"092384932230498bc980aa8098456f6ff7ff3ac9")
         ski = x509.SubjectKeyIdentifier(value)
         assert ski.digest == value
+        assert ski.key_identifier == value
 
     def test_repr(self):
         ski = x509.SubjectKeyIdentifier(
Repository: pyca/cryptography

Issue:
Add type stubs for rust module
In https://github.com/pyca/cryptography/pull/5965 we replaced two Python functions with functions from our new rust bindings. However, we lost type hinting with that. We should add type stubs for the methods we're adding.

We should also try to figure out how to enforce that we keep public methods in the module and type signatures in sync. This may not be feasible until we can add more mypy flags though.


Discussion:

Resolving patch:
diff --git a/src/cryptography/hazmat/backends/openssl/decode_asn1.py b/src/cryptography/hazmat/backends/openssl/decode_asn1.py
--- a/src/cryptography/hazmat/backends/openssl/decode_asn1.py
+++ b/src/cryptography/hazmat/backends/openssl/decode_asn1.py
@@ -210,17 +210,19 @@ def parse(self, x509_obj):
                 # The extension contents are a SEQUENCE OF INTEGERs.
                 data = self._backend._lib.X509_EXTENSION_get_data(ext)
                 data_bytes = _asn1_string_to_bytes(self._backend, data)
-                value = asn1.parse_tls_feature(data_bytes)
+                tls_feature = asn1.parse_tls_feature(data_bytes)
 
-                extensions.append(x509.Extension(oid, critical, value))
+                extensions.append(x509.Extension(oid, critical, tls_feature))
                 seen_oids.add(oid)
                 continue
             elif oid == ExtensionOID.PRECERT_POISON:
                 data = self._backend._lib.X509_EXTENSION_get_data(ext)
                 data_bytes = _asn1_string_to_bytes(self._backend, data)
-                value = asn1.parse_precert_poison(data_bytes)
+                precert_poison = asn1.parse_precert_poison(data_bytes)
 
-                extensions.append(x509.Extension(oid, critical, value))
+                extensions.append(
+                    x509.Extension(oid, critical, precert_poison)
+                )
                 seen_oids.add(oid)
                 continue
 


Test patch:
Repository: pyca/cryptography

Issue:
_ModuleWithDeprecations should inherit from types.ModuleType
Steps for reproducing bug:
```python
import inspect
import cryptography.utils
inspect.getsourcefile(cryptography.utils)
```
This will produce the following error:
> TypeError: module, class, method, function, traceback, frame, or code object was expected, got _ModuleWithDeprecations

The fix looks straightforward in cryptography.utils:
```python
class _ModuleWithDeprecations(types.ModuleType):
    def __init__(self, module):
        super().__init__(module.__name__)
        self.__dict__["_module"] = module
```
Used versions:
* ``Python`` 3.8.5
* ``cryptography`` 3.4.7
* ``cffi`` 1.14.0
* ``pip`` 20.2.2
* ``setuptools`` 49.2.1

* ``cryptography`` was installed by conda



Discussion:

Resolving patch:
diff --git a/src/cryptography/utils.py b/src/cryptography/utils.py
--- a/src/cryptography/utils.py
+++ b/src/cryptography/utils.py
@@ -7,6 +7,7 @@
 import enum
 import inspect
 import sys
+import types
 import typing
 import warnings
 
@@ -113,8 +114,9 @@ def __init__(self, value, message, warning_class):
         self.warning_class = warning_class
 
 
-class _ModuleWithDeprecations(object):
+class _ModuleWithDeprecations(types.ModuleType):
     def __init__(self, module):
+        super().__init__(module.__name__)
         self.__dict__["_module"] = module
 
     def __getattr__(self, attr):


Test patch:
diff --git a/tests/test_utils.py b/tests/test_utils.py
--- a/tests/test_utils.py
+++ b/tests/test_utils.py
@@ -4,6 +4,7 @@
 
 
 import binascii
+import inspect
 import os
 import textwrap
 
@@ -12,6 +13,7 @@
 import pytest
 
 import cryptography
+import cryptography.utils
 from cryptography.exceptions import UnsupportedAlgorithm, _Reasons
 
 import cryptography_vectors
@@ -4444,3 +4446,13 @@ def test_raises_unsupported_algorithm():
             "An error.", _Reasons.BACKEND_MISSING_INTERFACE
         )
     assert exc_info.type is UnsupportedAlgorithm
+
+
+def test_inspect_deprecated_module():
+    # Check if inspection is supported by _ModuleWithDeprecations.
+    assert isinstance(
+        cryptography.utils, cryptography.utils._ModuleWithDeprecations
+    )
+    source_file = inspect.getsourcefile(cryptography.utils)
+    assert isinstance(source_file, str)
+    assert source_file.endswith("utils.py")
Repository: pyca/cryptography

Issue:
Missing Extended Keys Usages Microsoft Smartcard Logon & KDCAuth
I've come across [ExtendedKeyUsages](https://www.pki.dfn.de/fileadmin/PKI/anleitungen/DFN-PKI-Zertifikatprofile_Global.pdf) with are unknown to cryptography:

Microsoft Smartcard Logon 1.3.6.1.4.1.311.20.2.2
KDCAuth 1.3.6.1.5.2.3.5
(Rhode & Schwarz) TrustedDisk 1.3.6.1.4.1.30205.13.1.1

Is there any interest in getting Smartcard Logon & KDCAuth added?



Discussion:
EKUs can contain arbitrary OIDs, so in general we've chosen to only list the ones specified directly in relevant RFCs. I am a bit reluctant to add more since then we need to come up with a measurement of notability. KDCAuth isn't part of the PEN arc so maybe that one is worth adding, but Microsoft is also an important company. @commonism is this just a presentational issue for you or is cryptography failing to properly parse the OID value?
Just one datapoint, but Smartcard Logon & KDCAuth were already requested by another indirect cryptography user: mathiasertl/django-ca#46.
For that use case it appears that there's just a desire for a pre-existing OID object so that users don't have to construct it themselves? I'm okay with adding prominent ones on a case-by-case basis as long as we can have docs that describe what their use is.
If anyone wants to send a PR for this I'm happy to review.
Would do, for attributes I would propose:

* `SMARTCARD_LOGON` (don't use company name?)
* `KERBEROS_KEY_DISTRIBUTION_CENTER`  - what KDC actually stands for: https://docs.microsoft.com/en-us/windows-server/security/kerberos/kerberos-authentication-overview
* `TRUSTED_DISK` - again no company name?

Resolving patch:
diff --git a/src/cryptography/x509/oid.py b/src/cryptography/x509/oid.py
--- a/src/cryptography/x509/oid.py
+++ b/src/cryptography/x509/oid.py
@@ -140,6 +140,8 @@ class ExtendedKeyUsageOID(object):
     TIME_STAMPING = ObjectIdentifier("1.3.6.1.5.5.7.3.8")
     OCSP_SIGNING = ObjectIdentifier("1.3.6.1.5.5.7.3.9")
     ANY_EXTENDED_KEY_USAGE = ObjectIdentifier("2.5.29.37.0")
+    SMARTCARD_LOGON = ObjectIdentifier("1.3.6.1.4.1.311.20.2.2")
+    KERBEROS_PKINIT_KDC = ObjectIdentifier("1.3.6.1.5.2.3.5")
 
 
 class AuthorityInformationAccessOID(object):
@@ -225,6 +227,8 @@ class AttributeOID(object):
     ExtendedKeyUsageOID.EMAIL_PROTECTION: "emailProtection",
     ExtendedKeyUsageOID.TIME_STAMPING: "timeStamping",
     ExtendedKeyUsageOID.OCSP_SIGNING: "OCSPSigning",
+    ExtendedKeyUsageOID.SMARTCARD_LOGON: "msSmartcardLogin",
+    ExtendedKeyUsageOID.KERBEROS_PKINIT_KDC: "pkInitKDC",
     ExtensionOID.SUBJECT_DIRECTORY_ATTRIBUTES: "subjectDirectoryAttributes",
     ExtensionOID.SUBJECT_KEY_IDENTIFIER: "subjectKeyIdentifier",
     ExtensionOID.KEY_USAGE: "keyUsage",


Test patch:
Repository: pyca/cryptography

Issue:
_create_asn1_time should be named _create_asn1_time_gc
For these types of functions we try to denote whether they gc or not in the name. We should fix this.


Discussion:

Resolving patch:
diff --git a/src/cryptography/hazmat/backends/openssl/backend.py b/src/cryptography/hazmat/backends/openssl/backend.py
--- a/src/cryptography/hazmat/backends/openssl/backend.py
+++ b/src/cryptography/hazmat/backends/openssl/backend.py
@@ -1078,7 +1078,7 @@ def _set_asn1_time(self, asn1_time, time):
         res = self._lib.ASN1_TIME_set_string(asn1_time, asn1_str)
         self.openssl_assert(res == 1)
 
-    def _create_asn1_time(self, time):
+    def _create_asn1_time_gc(self, time):
         asn1_time = self._lib.ASN1_TIME_new()
         self.openssl_assert(asn1_time != self._ffi.NULL)
         asn1_time = self._ffi.gc(asn1_time, self._lib.ASN1_TIME_free)
@@ -1112,12 +1112,12 @@ def create_x509_crl(
         self.openssl_assert(res == 1)
 
         # Set the last update time.
-        last_update = self._create_asn1_time(builder._last_update)
+        last_update = self._create_asn1_time_gc(builder._last_update)
         res = self._lib.X509_CRL_set1_lastUpdate(x509_crl, last_update)
         self.openssl_assert(res == 1)
 
         # Set the next update time.
-        next_update = self._create_asn1_time(builder._next_update)
+        next_update = self._create_asn1_time_gc(builder._next_update)
         res = self._lib.X509_CRL_set1_nextUpdate(x509_crl, next_update)
         self.openssl_assert(res == 1)
 
@@ -1141,7 +1141,7 @@ def create_x509_crl(
                 x509_revoked, serial_number
             )
             self.openssl_assert(res == 1)
-            rev_date = self._create_asn1_time(revoked_cert.revocation_date)
+            rev_date = self._create_asn1_time_gc(revoked_cert.revocation_date)
             res = self._lib.X509_REVOKED_set_revocationDate(
                 x509_revoked, rev_date
             )
@@ -1739,17 +1739,17 @@ def _create_ocsp_basic_response(self, builder, private_key, algorithm):
         if builder._response._revocation_time is None:
             rev_time = self._ffi.NULL
         else:
-            rev_time = self._create_asn1_time(
+            rev_time = self._create_asn1_time_gc(
                 builder._response._revocation_time
             )
 
         next_update = self._ffi.NULL
         if builder._response._next_update is not None:
-            next_update = self._create_asn1_time(
+            next_update = self._create_asn1_time_gc(
                 builder._response._next_update
             )
 
-        this_update = self._create_asn1_time(builder._response._this_update)
+        this_update = self._create_asn1_time_gc(builder._response._this_update)
 
         res = self._lib.OCSP_basic_add1_status(
             basic,


Test patch:
Repository: pyca/cryptography

Issue:
Insufficient error check in RSA: EVP_PKEY_CTX_set_signature_md() can return < 0
The latest downstream build of OpenSSL 3.0.1 in RHEL 9 has started to block SHA-1 signatures with the ``DEFAULT`` crypto policy. That means that SHA-1 signatures are blocked even in non-FIPS mode.

During testing we found a problem in the error check of ``EVP_PKEY_CTX_set_signature_md()``. https://github.com/pyca/cryptography/blob/3fd9d5a8424eef3e08260a622ae3644777ac5339/src/cryptography/hazmat/backends/openssl/rsa.py#L198-L213

``_rsa_sig_setup`` checks for ``res == 0`` but ``EVP_PKEY_CTX_set_signature_md`` can [return a negative value](https://www.openssl.org/docs/man3.0/man3/EVP_PKEY_CTX_set_signature_md.html):

> All other functions described on this page return a positive value for success and 0 or a negative value for failure. In particular a return value of -2 indicates the operation is not supported by the public key algorithm.

Tested with 3.4.7 and 36.0.1.

Downstream bug: https://bugzilla.redhat.com/show_bug.cgi?id=2060343


Discussion:

Resolving patch:
diff --git a/src/cryptography/hazmat/backends/openssl/rsa.py b/src/cryptography/hazmat/backends/openssl/rsa.py
--- a/src/cryptography/hazmat/backends/openssl/rsa.py
+++ b/src/cryptography/hazmat/backends/openssl/rsa.py
@@ -221,7 +221,7 @@ def _rsa_sig_setup(
     if algorithm is not None:
         evp_md = backend._evp_md_non_null_from_algorithm(algorithm)
         res = backend._lib.EVP_PKEY_CTX_set_signature_md(pkey_ctx, evp_md)
-        if res == 0:
+        if res <= 0:
             backend._consume_errors()
             raise UnsupportedAlgorithm(
                 "{} is not supported by this backend for RSA signing.".format(


Test patch:
Repository: pyca/cryptography

Issue:
adding custom attribute that have octetstring parameter
looks like I still can't put an octetstring attribute even if I used _tag in addattribute function that will be added in version 37 because _ASN1Type doesn't have octetstring(tag 04) in it.

(PS: why it needs some whitelist for allowed tag types?)

attribute I wanted to add: 
https://cabforum.org/wp-content/uploads/CA-Browser-Forum-BR-1.8.2.pdf
appendix B, 2-b

cabf OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) international-organizations(23) ca-browser-forum(140) }

caSigningNonce ATTRIBUTE ::= {
   WITH SYNTAX              OCTET STRING
   EQUALITY MATCHING RULE   octetStringMatch
   SINGLE VALUE             TRUE
   ID                       { cabf-caSigningNonce }
}


cabf-caSigningNonce OBJECT IDENTIFIER ::= { cabf 41 }


https://github.com/pyca/cryptography/pull/7038

tested locally by editing name.py, rust part of code doesn't complain. 


Discussion:

Resolving patch:
diff --git a/src/cryptography/x509/name.py b/src/cryptography/x509/name.py
--- a/src/cryptography/x509/name.py
+++ b/src/cryptography/x509/name.py
@@ -17,6 +17,7 @@
 
 class _ASN1Type(utils.Enum):
     BitString = 3
+    OctetString = 4
     UTF8String = 12
     NumericString = 18
     PrintableString = 19


Test patch:
Repository: pyca/cryptography

Issue:
Include Rust version in DEBUG ASSISTENCE message?
I'm not sure what the best way to do this is but it seems like it would be helpful to include the output of `rustc -V` in the DEBUG ASSISTENCE.


Discussion:
I think we'd be happy to accept a patch doing this. I think we want something roughly like https://github.com/pypa/pip/blob/main/src/pip/_internal/network/session.py#L179-L186
Okay I'll open a PR.

Resolving patch:
diff --git a/setup.py b/setup.py
--- a/setup.py
+++ b/setup.py
@@ -6,6 +6,9 @@
 
 import os
 import platform
+import re
+import shutil
+import subprocess
 import sys
 
 from setuptools import setup
@@ -89,6 +92,22 @@
         except pkg_resources.DistributionNotFound:
             version = "n/a"
         print(f"    {dist}: {version}")
+    version = "n/a"
+    if shutil.which("rustc") is not None:
+        try:
+            # If for any reason `rustc --version` fails, silently ignore it
+            rustc_output = subprocess.run(
+                ["rustc", "--version"],
+                capture_output=True,
+                timeout=0.5,
+                encoding="utf8",
+                check=True,
+            ).stdout
+            version = re.sub("^rustc ", "", rustc_output.strip())
+        except subprocess.SubprocessError:
+            pass
+    print(f"    rustc: {version}")
+
     print(
         """\
     =============================DEBUG ASSISTANCE=============================


Test patch:
Repository: pyca/cryptography

Issue:
release.py should link to GH create PAT page
We can pre-fill what permissions are needed to improve the UX of doing a release. Example URL: https://github.com/settings/tokens/new?description=foo&scopes=repo,workflow

@reaperhulk do you know what scopes are required?


Discussion:
https://github.com/pyca/cryptography/blob/main/release.py#L106 is where needs to be updated
repo only works, unsure if it’s possible to constrain it more heavily

Resolving patch:
diff --git a/release.py b/release.py
--- a/release.py
+++ b/release.py
@@ -103,6 +103,11 @@ def release(version):
     """
     ``version`` should be a string like '0.4' or '1.0'.
     """
+    print(
+        f"Create a new GH PAT at: "
+        f"https://github.com/settings/tokens/new?"
+        f"description={version}&scopes=repo"
+    )
     github_token = getpass.getpass("Github person access token: ")
 
     # Tag and push the tag (this will trigger the wheel builder in Actions)


Test patch:
Repository: pyca/cryptography

Issue:
Add benchmarks to the repository
We care about performance at least a little bit, but presently there is no standard way of measuring performance.

I propose we:

- [x] Introduce some performance tests
- [x] Start running them in CI so they don't bit-rot
- [x] Commit to adding new ones / referencing existing ones when we do optimization work
- [ ] Some day maybe figure out how to run performance tests in CI so we can catch regressions


Discussion:

Resolving patch:
diff --git a/.github/compare_benchmarks.py b/.github/compare_benchmarks.py
new file mode 100644
--- /dev/null
+++ b/.github/compare_benchmarks.py
@@ -0,0 +1,42 @@
+# This file is dual licensed under the terms of the Apache License, Version
+# 2.0, and the BSD License. See the LICENSE file in the root of this repository
+# for complete details.
+
+import json
+import sys
+
+
+def bench_data_as_dict(data):
+    return {d["fullname"]: d["stats"] for d in data["benchmarks"]}
+
+
+def main(base_bench_path, pr_bench_path):
+    with open(base_bench_path) as f:
+        base_bench_data = bench_data_as_dict(json.load(f))
+    with open(pr_bench_path) as f:
+        pr_bench_data = bench_data_as_dict(json.load(f))
+
+    print("| Benchmark | Base | PR | Delta |")
+    print("| --------- | ---- | -- | ----- |")
+    for bench_name in sorted(base_bench_data):
+        # TODO: use better statistics than just comparing medians
+        base_result = base_bench_data[bench_name]["median"]
+        pr_result = pr_bench_data[bench_name]["median"]
+
+        if base_result == pr_result:
+            # PR and base are identical
+            delta = "--"
+        elif base_result > pr_result:
+            # PR is faster than base
+            delta = f"{100 - round(100 * pr_result / base_result)}% faster"
+        else:
+            delta = f"{100 - round(100 * base_result / pr_result)}% slower"
+
+        print(
+            f"| `{bench_name}` | {round(base_result * 1000 * 1000 * 1000, 2)} "
+            f"ns | {round(pr_result * 1000 * 1000 * 1000, 2)} ns | {delta} |"
+        )
+
+
+if __name__ == "__main__":
+    main(*sys.argv[1:])


Test patch:
Repository: pyca/cryptography

Issue:
Drop support for OpenSSL 1.1.0
- [x] 37: Initial deprecation warning
- [x] 38: Final release with support (update error messages)
- [x] 39: Drop support


Discussion:
Note: we will need to update the FAQ when we fully drop.
Remaining task here is to either resolve, or update, a few comments findable with: `rg 'CRYPTOGRAPHY_OPENSSL_LESS_THAN_111\b'`

Resolving patch:
diff --git a/src/cryptography/hazmat/backends/openssl/backend.py b/src/cryptography/hazmat/backends/openssl/backend.py
--- a/src/cryptography/hazmat/backends/openssl/backend.py
+++ b/src/cryptography/hazmat/backends/openssl/backend.py
@@ -1877,8 +1877,8 @@ def dh_x942_serialization_supported(self) -> bool:
         return self._lib.Cryptography_HAS_EVP_PKEY_DHX == 1
 
     def x25519_load_public_bytes(self, data: bytes) -> x25519.X25519PublicKey:
-        # When we drop support for CRYPTOGRAPHY_OPENSSL_LESS_THAN_111 we can
-        # switch this to EVP_PKEY_new_raw_public_key
+        # If/when LibreSSL adds support for EVP_PKEY_new_raw_public_key we
+        # can switch to it (Cryptography_HAS_RAW_KEY)
         if len(data) != 32:
             raise ValueError("An X25519 public key is 32 bytes long")
 
@@ -1894,8 +1894,8 @@ def x25519_load_public_bytes(self, data: bytes) -> x25519.X25519PublicKey:
     def x25519_load_private_bytes(
         self, data: bytes
     ) -> x25519.X25519PrivateKey:
-        # When we drop support for CRYPTOGRAPHY_OPENSSL_LESS_THAN_111 we can
-        # switch this to EVP_PKEY_new_raw_private_key and drop the
+        # If/when LibreSSL adds support for EVP_PKEY_new_raw_private_key we
+        # can switch to it (Cryptography_HAS_RAW_KEY) drop the
         # zeroed_bytearray garbage.
         # OpenSSL only has facilities for loading PKCS8 formatted private
         # keys using the algorithm identifiers specified in
diff --git a/src/cryptography/hazmat/backends/openssl/x25519.py b/src/cryptography/hazmat/backends/openssl/x25519.py
--- a/src/cryptography/hazmat/backends/openssl/x25519.py
+++ b/src/cryptography/hazmat/backends/openssl/x25519.py
@@ -112,8 +112,8 @@ def private_bytes(
         )
 
     def _raw_private_bytes(self) -> bytes:
-        # When we drop support for CRYPTOGRAPHY_OPENSSL_LESS_THAN_111 we can
-        # switch this to EVP_PKEY_new_raw_private_key
+        # If/when LibreSSL adds support for EVP_PKEY_get_raw_private_key we
+        # can switch to it (Cryptography_HAS_RAW_KEY)
         # The trick we use here is serializing to a PKCS8 key and just
         # using the last 32 bytes, which is the key itself.
         bio = self._backend._create_mem_bio_gc()


Test patch:
Repository: pyca/cryptography

Issue:
Build failed on OpenBSD 7.2
OpenBSD 7.2 upgraded LibreSSL to 3.6.0 (LIBRESSL_VERSION_NUMBER 0x3060000fL) that has OPENSSL_cleanup function.

Please update version check in src/_cffi_src/openssl/crypto.py to:
```
#if CRYPTOGRAPHY_IS_LIBRESSL && LIBRESSL_VERSION_NUMBER < 0x3060000fL
static const long Cryptography_HAS_OPENSSL_CLEANUP = 0;
void (*OPENSSL_cleanup)(void) = NULL;
#else
static const long Cryptography_HAS_OPENSSL_CLEANUP = 1;
#endif
```


Discussion:
Is LibreSSL 3.6.0 even released? I don't see it on https://www.libressl.org/releases.html
Not yet, it is still in beta. It is planned to be released on Oct 20, 2022.
[Changelog for 3.6.0](https://github.com/libressl-portable/portable/blob/master/ChangeLog)

Resolving patch:
diff --git a/src/_cffi_src/openssl/crypto.py b/src/_cffi_src/openssl/crypto.py
--- a/src/_cffi_src/openssl/crypto.py
+++ b/src/_cffi_src/openssl/crypto.py
@@ -74,7 +74,7 @@
 # define OPENSSL_DIR             SSLEAY_DIR
 #endif
 
-#if CRYPTOGRAPHY_IS_LIBRESSL
+#if CRYPTOGRAPHY_LIBRESSL_LESS_THAN_360
 static const long Cryptography_HAS_OPENSSL_CLEANUP = 0;
 void (*OPENSSL_cleanup)(void) = NULL;
 #else
diff --git a/src/_cffi_src/openssl/cryptography.py b/src/_cffi_src/openssl/cryptography.py
--- a/src/_cffi_src/openssl/cryptography.py
+++ b/src/_cffi_src/openssl/cryptography.py
@@ -43,9 +43,12 @@
 #if CRYPTOGRAPHY_IS_LIBRESSL
 #define CRYPTOGRAPHY_LIBRESSL_LESS_THAN_350 \
     (LIBRESSL_VERSION_NUMBER < 0x3050000f)
+#define CRYPTOGRAPHY_LIBRESSL_LESS_THAN_360 \
+    (LIBRESSL_VERSION_NUMBER < 0x3060000f)
 
 #else
 #define CRYPTOGRAPHY_LIBRESSL_LESS_THAN_350 (0)
+#define CRYPTOGRAPHY_LIBRESSL_LESS_THAN_360 (0)
 #endif
 
 #if OPENSSL_VERSION_NUMBER < 0x10101000


Test patch: