Repository: pyca/pyopenssl
Pull request #652 (2017-06-30 14:23:04)

Removed the deprecated md5 default on CRL.export()

codecov[bot]: # [Codecov](https://codecov.io/gh/pyca/pyopenssl/pull/652?src=pr&el=h1) Report
> Merging [#652](https://codecov.io/gh/pyca/pyopenssl/pull/652?src=pr&el=desc) into [master](https://codecov.io/gh/pyca/pyopenssl/commit/941f903ff6929a4ae99abfe6d7109398186dfe9d?src=pr&el=desc) will **decrease** coverage by `2.63%`.
> The diff coverage is `100%`.

[![Impacted file tree graph](https://codecov.io/gh/pyca/pyopenssl/pull/652/graphs/tree.svg?width=650&token=KKfpMZOTgK&height=150&src=pr)](https://codecov.io/gh/pyca/pyopenssl/pull/652?src=pr&el=tree)

```diff
@@            Coverage Diff             @@
##           master     #652      +/-   ##
==========================================
- Coverage   96.95%   94.31%   -2.64%     
==========================================
  Files          18       18              
  Lines        5740     5735       -5     
  Branches      401      401              
==========================================
- Hits         5565     5409     -156     
- Misses        117      263     +146     
- Partials       58       63       +5
```


| [Impacted Files](https://codecov.io/gh/pyca/pyopenssl/pull/652?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [tests/test\_crypto.py](https://codecov.io/gh/pyca/pyopenssl/pull/652?src=pr&el=tree#diff-dGVzdHMvdGVzdF9jcnlwdG8ucHk=) | `97.91% <100%> (-0.7%)` | :arrow_down: |
| [src/OpenSSL/crypto.py](https://codecov.io/gh/pyca/pyopenssl/pull/652?src=pr&el=tree#diff-c3JjL09wZW5TU0wvY3J5cHRvLnB5) | `96.09% <100%> (-0.72%)` | :arrow_down: |
| [tests/test\_ssl.py](https://codecov.io/gh/pyca/pyopenssl/pull/652?src=pr&el=tree#diff-dGVzdHMvdGVzdF9zc2wucHk=) | `93.94% <0%> (-5.17%)` | :arrow_down: |
| [src/OpenSSL/SSL.py](https://codecov.io/gh/pyca/pyopenssl/pull/652?src=pr&el=tree#diff-c3JjL09wZW5TU0wvU1NMLnB5) | `90.55% <0%> (-4.34%)` | :arrow_down: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/pyca/pyopenssl/pull/652?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/pyca/pyopenssl/pull/652?src=pr&el=footer). Last update [941f903...521eb3a](https://codecov.io/gh/pyca/pyopenssl/pull/652?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).

codecov[bot]: # [Codecov](https://codecov.io/gh/pyca/pyopenssl/pull/652?src=pr&el=h1) Report
> Merging [#652](https://codecov.io/gh/pyca/pyopenssl/pull/652?src=pr&el=desc) into [master](https://codecov.io/gh/pyca/pyopenssl/commit/941f903ff6929a4ae99abfe6d7109398186dfe9d?src=pr&el=desc) will **decrease** coverage by `<.01%`.
> The diff coverage is `100%`.

[![Impacted file tree graph](https://codecov.io/gh/pyca/pyopenssl/pull/652/graphs/tree.svg?width=650&height=150&src=pr&token=KKfpMZOTgK)](https://codecov.io/gh/pyca/pyopenssl/pull/652?src=pr&el=tree)

```diff
@@            Coverage Diff             @@
##           master     #652      +/-   ##
==========================================
- Coverage   96.95%   96.94%   -0.01%     
==========================================
  Files          18       18              
  Lines        5740     5734       -6     
  Branches      401      401              
==========================================
- Hits         5565     5559       -6     
  Misses        117      117              
  Partials       58       58
```


| [Impacted Files](https://codecov.io/gh/pyca/pyopenssl/pull/652?src=pr&el=tree) | Coverage Δ | |
|---|---|---|
| [src/OpenSSL/crypto.py](https://codecov.io/gh/pyca/pyopenssl/pull/652?src=pr&el=tree#diff-c3JjL09wZW5TU0wvY3J5cHRvLnB5) | `96.8% <100%> (-0.01%)` | :arrow_down: |
| [tests/test\_crypto.py](https://codecov.io/gh/pyca/pyopenssl/pull/652?src=pr&el=tree#diff-dGVzdHMvdGVzdF9jcnlwdG8ucHk=) | `98.61% <100%> (-0.01%)` | :arrow_down: |

------

[Continue to review full report at Codecov](https://codecov.io/gh/pyca/pyopenssl/pull/652?src=pr&el=continue).
> **Legend** - [Click here to learn more](https://docs.codecov.io/docs/codecov-delta)
> `Δ = absolute <relative> (impact)`, `ø = not affected`, `? = missing data`
> Powered by [Codecov](https://codecov.io/gh/pyca/pyopenssl/pull/652?src=pr&el=footer). Last update [941f903...d996411](https://codecov.io/gh/pyca/pyopenssl/pull/652?src=pr&el=lastupdated). Read the [comment docs](https://docs.codecov.io/docs/pull-request-comments).


Patch:
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index 2725eb8..035d561 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -15,6 +15,9 @@ Backward-incompatible changes:
 - Removed the deprecated ``OpenSSL.rand.egd()`` function.
   Applications should prefer ``os.urandom()`` for random number generation.
   `#630 <https://github.com/pyca/pyopenssl/pull/630>`_
+- Removed the deprecated default ``digest`` argument to ``OpenSSL.crypto.CRL.export()``.
+  Callers must now always pass an explicit ``digest``.
+  `#652 <https://github.com/pyca/pyopenssl/pull/652>`_
 - Fixed a bug with ``ASN1_TIME`` casting in ``X509.set_notBefore()``,
   ``X509.set_notAfter()``, ``Revoked.set_rev_date()``, ``Revoked.set_nextUpdate()``,
   and ``Revoked.set_lastUpdate()``. You must now pass times in the form
diff --git a/src/OpenSSL/crypto.py b/src/OpenSSL/crypto.py
index e58a455..20cf183 100644
--- a/src/OpenSSL/crypto.py
+++ b/src/OpenSSL/crypto.py
@@ -3,7 +3,6 @@ import datetime
 from base64 import b16encode
 from functools import partial
 from operator import __eq__, __ne__, __lt__, __le__, __gt__, __ge__
-from warnings import warn as _warn
 
 from six import (
     integer_types as _integer_types,
@@ -2221,13 +2220,7 @@ class CRL(object):
             raise TypeError("type must be an integer")
 
         if digest is _UNSPECIFIED:
-            _warn(
-                "The default message digest (md5) is deprecated.  "
-                "Pass the name of a message digest explicitly.",
-                category=DeprecationWarning,
-                stacklevel=2,
-            )
-            digest = b"md5"
+            raise TypeError("digest must be provided")
 
         digest_obj = _lib.EVP_get_digestbyname(digest)
         if digest_obj == _ffi.NULL:


Test patch:
diff --git a/tests/test_crypto.py b/tests/test_crypto.py
index 916186b..4b99bd9 100644
--- a/tests/test_crypto.py
+++ b/tests/test_crypto.py
@@ -3181,7 +3181,9 @@ class TestCRL(object):
         """
         crl = self._get_crl()
         # PEM format
-        dumped_crl = crl.export(self.cert, self.pkey, days=20)
+        dumped_crl = crl.export(
+            self.cert, self.pkey, days=20, digest=b"sha256"
+        )
         text = _runopenssl(dumped_crl, b"crl", b"-noout", b"-text")
 
         # These magic values are based on the way the CRL above was constructed
@@ -3201,7 +3203,9 @@ class TestCRL(object):
         crl = self._get_crl()
 
         # DER format
-        dumped_crl = crl.export(self.cert, self.pkey, FILETYPE_ASN1)
+        dumped_crl = crl.export(
+            self.cert, self.pkey, FILETYPE_ASN1, digest=b"md5"
+        )
         text = _runopenssl(
             dumped_crl, b"crl", b"-noout", b"-text", b"-inform", b"DER"
         )
@@ -3219,13 +3223,17 @@ class TestCRL(object):
         """
         crl = self._get_crl()
 
-        dumped_crl = crl.export(self.cert, self.pkey, FILETYPE_ASN1)
+        dumped_crl = crl.export(
+            self.cert, self.pkey, FILETYPE_ASN1, digest=b"md5"
+        )
         text = _runopenssl(
             dumped_crl, b"crl", b"-noout", b"-text", b"-inform", b"DER"
         )
 
         # text format
-        dumped_text = crl.export(self.cert, self.pkey, type=FILETYPE_TEXT)
+        dumped_text = crl.export(
+            self.cert, self.pkey, type=FILETYPE_TEXT, digest=b"md5"
+        )
         assert text == dumped_text
 
     def test_export_custom_digest(self):
@@ -3253,20 +3261,12 @@ class TestCRL(object):
 
     def test_export_default_digest(self):
         """
-        If not passed the name of a digest function, ``CRL.export`` uses a
-        signature algorithm based on MD5 and emits a deprecation warning.
+        If not passed the name of a digest function, ``CRL.export`` raises a
+        ``TypeError``.
         """
         crl = self._get_crl()
-        with pytest.warns(None) as catcher:
-            simplefilter("always")
-            dumped_crl = crl.export(self.cert, self.pkey)
-        assert (
-            "The default message digest (md5) is deprecated.  "
-            "Pass the name of a message digest explicitly." ==
-            str(catcher[0].message)
-        )
-        text = _runopenssl(dumped_crl, b"crl", b"-noout", b"-text")
-        text.index(b'Signature Algorithm: md5')
+        with pytest.raises(TypeError):
+            crl.export(self.cert, self.pkey)
 
     def test_export_invalid(self):
         """
@@ -3275,7 +3275,7 @@ class TestCRL(object):
         """
         crl = CRL()
         with pytest.raises(Error):
-            crl.export(X509(), PKey())
+            crl.export(X509(), PKey(), digest=b"sha256")
 
     def test_add_revoked_keyword(self):
         """
@@ -3313,7 +3313,7 @@ class TestCRL(object):
         """
         crl = CRL()
         with pytest.raises(ValueError):
-            crl.export(self.cert, self.pkey, 100, 10)
+            crl.export(self.cert, self.pkey, 100, 10, digest=b"sha256")
 
     def test_export_unknown_digest(self):
         """