Deprecation warning when signing/verifying JWKRSA objects #13

canihavesomecoffee · 2018-03-22T09:17:43Z

The cryptography extension has deprecated [1] (since 2.0 - 2017-07-17) the signer and verifiier methods, which results in this warning:

/var/www/workaround/venv/lib/python3.5/site-packages/josepy/jwa.py:107: CryptographyDeprecationWarning: signer and verifier have been deprecated. Please use sign and verify instead.
  signer = key.signer(self.padding, self.hash)

Code I used to get this warning:

from acme import client
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.asymmetric import rsa

import josepy as jose

private_key = rsa.generate_private_key(public_exponent=65537, key_size=4096, backend=default_backend())
acme_client = client.Client( 'https://acme-v01.api.letsencrypt.org/directory', jose.JWKRSA(key=private_key))
regr = acme_client.register()

Environment:

acme-0.22.2
josepy-1.0.1
cryptography-2.2.1
Python 3.5.3

[1] pyca/cryptography#3659

The text was updated successfully, but these errors were encountered:

bmw · 2018-03-22T18:48:21Z

Thanks for opening an issue. We'd take a well written PR to use the other APIs.

mgedmin · 2018-03-28T07:00:47Z

certbot renew now started emitting this warning from my cron script:

/opt/letsencrypt/local/lib/python2.7/site-packages/josepy/jwa.py:107: CryptographyDeprecationWarning: signer and verifier have been
deprecated. Please use sign and verify instead.
  signer = key.signer(self.padding, self.hash)

(It looks like the warning is emitted only when the certificate needs to be renewed, which makes this not as annoying as it would be if it were emitted on every run.)

See pyca/cryptography#3659. Fixes certbot#13.

bolera · 2018-08-15T20:45:37Z

Why was this closed? certbot issues this warning now with every cert request.

bmw · 2018-08-15T20:47:22Z

Because the issue was fixed in the josepy release over 4 months ago. How did you install Certbot?

bolera · 2018-08-15T20:48:27Z

Sorry, yes, I just noticed that I can follow that link and see it was merged in April. I'm getting certbot from the official repo, wait a minute. It says it's version 0.26.1. There's no newer one if I try to upgrade.
deb http://ppa.launchpad.net/certbot/certbot/ubuntu xenial main

bmw · 2018-08-15T20:51:30Z

From our Ubuntu PPA? It looks like the maintainers haven't packed a version of josepy containing this fix. Thanks for pointing this out.

@NCommander, do you have the cycles to do this? It should be very simple as very little has changed since the previous version and it is packaged on Debian.

bolera · 2018-08-15T20:52:47Z

Yes, I updated my last reply twice.

NCommander · 2018-08-16T00:51:13Z

I'll take a crack at it tonight

…

On Wed, Aug 15, 2018, 13:52 bolera ***@***.***> wrote: Yes, I updated my last reply twice. — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#13 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AALDQOpfnMPUQes0bO_elR7qj0kQgsHfks5uRIoggaJpZM4S2sey> .

stamster · 2018-10-15T20:00:21Z

letsencrypt 0.4.1 having same issue.

/usr/lib/python2.7/dist-packages/acme/jose/jwa.py:110: CryptographyDeprecationWarning: signer and verifier have been deprecated. Please use sign and verify instead. 
signer = key.signer(self.padding, self.hash)

The renewal works, but this warning is sent into STDERR.

Pat71 · 2018-11-06T09:28:37Z

Any news on this? I (re)installed certbot yesterday and keep getting this warning...

bmw · 2018-11-07T15:56:35Z

@hlieberman, the most recent comment is relevant to you and can be fixed by updating the version of josepy.

EDIT: It looks like the comment I was referring to was deleted, but a stretch-backports user was claiming to have this issue.

Sambahoney · 2018-11-09T19:44:02Z

Still having the same issue after installing from stretch-backports

0xpr03 · 2018-11-11T14:37:09Z

I also installed via stretch-backports, as advised by your website, after having to re-install because of https ACME disabling.
/usr/lib/python3/dist-packages/josepy/jwa.py:107: CryptographyDeprecationWarning: signer and verifier have been deprecated. Please use sign and verify instead.

hlieberman · 2018-11-14T03:11:30Z

This should be fixed with the latest upload of certbot to stretch-backports. In any regard, it's simply a warning, and shouldn't mess with anything. (Albeit, being annoying).

…

-- Harlan Lieberman-Berg ~hlieberman

bolera · 2018-11-15T18:37:37Z

Not sure, if I should open a new ticket, but as it got already mentioned above: the Ubuntu ppa hasn't been updated yet. It's still on certbot 0.26.1 and josepy is still 1.0.1, uploaded in February. Would be nice to get new packages at least with major version jumps. Thanks!
https://launchpad.net/~certbot/+archive/ubuntu/certbot?field.series_filter=xenial

jult · 2019-02-27T16:17:30Z

/usr/local/lib/python2.7/dist-packages/josepy-1.0.1-py2.7.egg/josepy/jwa.py:107: CryptographyDeprecationWarning: signer and verifier have been deprecated. Please use sign and verify instead.

It's still there. With a clean debian 9, as far as python and certbot go.

bmw · 2019-02-27T17:07:13Z

@jult, that file path shows josepy 1.0.1 is being used. josepy 1.1.0 where this change is fixed is available in Debian 9. See https://packages.debian.org/stretch/python-josepy.

EDIT: It's also in /usr/local which suggests to me the package being used is not from Debian and is likely from pip.

jult · 2019-02-27T23:47:28Z

@bmw Yes, I fixed it doing

$ pip uninstall josepy
$ pip install josepy

Strange how I got there without recalling a pip install.

Added If possible, Certbot uses built-in support for OCSP from recent cryptography versions instead of the OpenSSL binary: as a consequence Certbot does not need the OpenSSL binary to be installed anymore if cryptography>=2.5 is installed. Changed Certbot and its acme module now depend on josepy>=1.1.0 to avoid printing the warnings described at certbot/josepy#13. Apache plugin now respects CERTBOT_DOCS environment variable when adding command line defaults. The running of manual plugin hooks is now always included in Certbot's log output. Tests execution for certbot, certbot-apache and certbot-nginx packages now relies on pytest. An ACME CA server may return a "Retry-After" HTTP header on authorization polling, as specified in the ACME protocol, to indicate when the next polling should occur. Certbot now reads this header if set and respect its value. The acme module avoids sending the keyAuthorization field in the JWS payload when responding to a challenge as the field is not included in the current ACME protocol. To ease the migration path for ACME CA servers, Certbot and its acme module will first try the request without the keyAuthorization field but will temporarily retry the request with the field included if a malformed error is received. This fallback will be removed in version 0.34.0.

mgedmin mentioned this issue Mar 28, 2018

Use cryptography's sign/verify methods instead of signer/verifier #16

Closed

joohoi mentioned this issue Apr 11, 2018

brew certbot 0.23 spews "CryptographyDeprecationWarning: signer and verifier have been deprecated" certbot/certbot#5841

Closed

bmw assigned joohoi Apr 11, 2018

joohoi mentioned this issue Apr 12, 2018

Prefer new python-cryptography methods sign and verify #18

Merged

bmw closed this as completed in #18 Apr 12, 2018

bmw mentioned this issue Nov 13, 2018

Depend on josepy>=1.1.0 in setup.py files certbot/certbot#6501

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Deprecation warning when signing/verifying JWKRSA objects #13

Deprecation warning when signing/verifying JWKRSA objects #13

canihavesomecoffee commented Mar 22, 2018

bmw commented Mar 22, 2018

mgedmin commented Mar 28, 2018

bolera commented Aug 15, 2018

bmw commented Aug 15, 2018

bolera commented Aug 15, 2018 •

edited

Loading

bmw commented Aug 15, 2018 •

edited

Loading

bolera commented Aug 15, 2018

NCommander commented Aug 16, 2018 via email

stamster commented Oct 15, 2018 •

edited

Loading

Pat71 commented Nov 6, 2018

bmw commented Nov 7, 2018 •

edited

Loading

Sambahoney commented Nov 9, 2018

0xpr03 commented Nov 11, 2018 •

edited

Loading

hlieberman commented Nov 14, 2018 via email

bolera commented Nov 15, 2018

jult commented Feb 27, 2019 •

edited

Loading

bmw commented Feb 27, 2019 •

edited

Loading

jult commented Feb 27, 2019 •

edited

Loading

Deprecation warning when signing/verifying JWKRSA objects #13

Deprecation warning when signing/verifying JWKRSA objects #13

Comments

canihavesomecoffee commented Mar 22, 2018

bmw commented Mar 22, 2018

mgedmin commented Mar 28, 2018

bolera commented Aug 15, 2018

bmw commented Aug 15, 2018

bolera commented Aug 15, 2018 • edited Loading

bmw commented Aug 15, 2018 • edited Loading

bolera commented Aug 15, 2018

NCommander commented Aug 16, 2018 via email

stamster commented Oct 15, 2018 • edited Loading

Pat71 commented Nov 6, 2018

bmw commented Nov 7, 2018 • edited Loading

Sambahoney commented Nov 9, 2018

0xpr03 commented Nov 11, 2018 • edited Loading

hlieberman commented Nov 14, 2018 via email

bolera commented Nov 15, 2018

jult commented Feb 27, 2019 • edited Loading

bmw commented Feb 27, 2019 • edited Loading

jult commented Feb 27, 2019 • edited Loading

bolera commented Aug 15, 2018 •

edited

Loading

bmw commented Aug 15, 2018 •

edited

Loading

stamster commented Oct 15, 2018 •

edited

Loading

bmw commented Nov 7, 2018 •

edited

Loading

0xpr03 commented Nov 11, 2018 •

edited

Loading

jult commented Feb 27, 2019 •

edited

Loading

bmw commented Feb 27, 2019 •

edited

Loading

jult commented Feb 27, 2019 •

edited

Loading