Repository: pyca/cryptography

Issue:
sign parameter order on CSRBuilder and CertBuilder
The sign method on CertificateBuilder has this signature:

`sign(backend, private_key, algorithm)`

And CSRBuilder has this:

`sign(private_key, algorithm, backend)`

We should fix this post-haste. The CSRBuilder signature (backend last) is the convention we've been using elsewhere.



Discussion:
:scream: 

Agree taht CSRBuilder is the right approach.


Resolving patch:
diff --git a/src/cryptography/x509.py b/src/cryptography/x509.py
--- a/src/cryptography/x509.py
+++ b/src/cryptography/x509.py
@@ -1740,7 +1740,7 @@ def add_extension(self, extension, critical):
             self._not_valid_after, self._extensions + [extension]
         )
 
-    def sign(self, backend, private_key, algorithm):
+    def sign(self, private_key, algorithm, backend):
         """
         Signs the certificate using the CA's private key.
         """


Test patch:
diff --git a/tests/hazmat/backends/test_openssl.py b/tests/hazmat/backends/test_openssl.py
--- a/tests/hazmat/backends/test_openssl.py
+++ b/tests/hazmat/backends/test_openssl.py
@@ -531,7 +531,7 @@ def test_checks_for_unsupported_extensions(self):
         )
 
         with pytest.raises(NotImplementedError):
-            builder.sign(backend, private_key, hashes.SHA1())
+            builder.sign(private_key, hashes.SHA1(), backend)
 
 
 class TestOpenSSLSerialisationWithOpenSSL(object):
diff --git a/tests/test_x509.py b/tests/test_x509.py
--- a/tests/test_x509.py
+++ b/tests/test_x509.py
@@ -809,7 +809,7 @@ def test_build_cert(self, backend):
             not_valid_after
         )
 
-        cert = builder.sign(backend, issuer_private_key, hashes.SHA1())
+        cert = builder.sign(issuer_private_key, hashes.SHA1(), backend)
 
         assert cert.version is x509.Version.v3
         assert cert.not_valid_before == not_valid_before
@@ -969,7 +969,7 @@ def test_sign_with_unsupported_hash(self, backend):
         builder = x509.CertificateBuilder()
 
         with pytest.raises(TypeError):
-            builder.sign(backend, private_key, object())
+            builder.sign(private_key, object(), backend)
 
     @pytest.mark.requires_backend_interface(interface=DSABackend)
     @pytest.mark.requires_backend_interface(interface=X509Backend)
@@ -981,7 +981,7 @@ def test_sign_with_dsa_private_key_is_unsupported(self, backend):
         builder = x509.CertificateBuilder()
 
         with pytest.raises(NotImplementedError):
-            builder.sign(backend, private_key, hashes.SHA512())
+            builder.sign(private_key, hashes.SHA512(), backend)
 
     @pytest.mark.requires_backend_interface(interface=EllipticCurveBackend)
     @pytest.mark.requires_backend_interface(interface=X509Backend)
@@ -994,7 +994,7 @@ def test_sign_with_ec_private_key_is_unsupported(self, backend):
         builder = x509.CertificateBuilder()
 
         with pytest.raises(NotImplementedError):
-            builder.sign(backend, private_key, hashes.SHA512())
+            builder.sign(private_key, hashes.SHA512(), backend)
 
     @pytest.mark.requires_backend_interface(interface=DSABackend)
     @pytest.mark.requires_backend_interface(interface=X509Backend)
@@ -1027,7 +1027,7 @@ def test_build_cert_with_dsa_private_key(self, backend):
             not_valid_after
         )
 
-        cert = builder.sign(backend, issuer_private_key, hashes.SHA1())
+        cert = builder.sign(issuer_private_key, hashes.SHA1(), backend)
 
         assert cert.version is x509.Version.v3
         assert cert.not_valid_before == not_valid_before
@@ -1076,7 +1076,7 @@ def test_build_cert_with_ec_private_key(self, backend):
             not_valid_after
         )
 
-        cert = builder.sign(backend, issuer_private_key, hashes.SHA1())
+        cert = builder.sign(issuer_private_key, hashes.SHA1(), backend)
 
         assert cert.version is x509.Version.v3
         assert cert.not_valid_before == not_valid_before
@@ -1117,7 +1117,7 @@ def test_build_cert_with_rsa_key_too_small(self, backend):
         )
 
         with pytest.raises(ValueError):
-            builder.sign(backend, issuer_private_key, hashes.SHA512())
+            builder.sign(issuer_private_key, hashes.SHA512(), backend)
 
 
 @pytest.mark.requires_backend_interface(interface=X509Backend)