CHANGELOG.rst

@@ -4,6 +4,22 @@ Changelog
 Versions are year-based with a strict backward-compatibility policy.
 The third digit is only for regressions.
 
+24.1.0 (2024-03-09)
+-------------------
+
+Backward-incompatible changes:
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+* Removed the deprecated ``OpenSSL.crypto.PKCS12`` and
+  ``OpenSSL.crypto.NetscapeSPKI``. ``OpenSSL.crypto.PKCS12`` may be replaced
+  by the PKCS#12 APIs in the ``cryptography`` package.
+
+Deprecations:
+^^^^^^^^^^^^^
+
+Changes:
+^^^^^^^^
+
 24.0.0 (2024-01-22)
 -------------------
 
@@ -27,7 +43,7 @@ Backward-incompatible changes:
 
 - Dropped support for Python 3.6.
 - The minimum ``cryptography`` version is now 41.0.5.
-- Removed ``OpenSSL.crypto.loads_pkcs7`` and ``OpenSSL.crypto.loads_pkcs12`` which had been deprecated for 3 years.
+- Removed ``OpenSSL.crypto.load_pkcs7`` and ``OpenSSL.crypto.load_pkcs12`` which had been deprecated for 3 years.
 - Added ``OpenSSL.SSL.OP_LEGACY_SERVER_CONNECT`` to allow legacy insecure renegotiation between OpenSSL and unpatched servers.
   `#1234 <https://github.com/pyca/pyopenssl/pull/1234>`_.
 
@@ -220,7 +236,7 @@ Backward-incompatible changes:
 Deprecations:
 ^^^^^^^^^^^^^
 
-- Deprecated ``OpenSSL.crypto.loads_pkcs7`` and ``OpenSSL.crypto.loads_pkcs12``.
+- Deprecated ``OpenSSL.crypto.load_pkcs7`` and ``OpenSSL.crypto.load_pkcs12``.
 
 Changes:
 ^^^^^^^^

doc/api/crypto.rst

@@ -160,14 +160,6 @@ PKey objects
 
     Key type constants.
 
-.. _openssl-pkcs12:
-
-PKCS12 objects
---------------
-
-.. autoclass:: PKCS12
-               :members:
-
 .. _openssl-509ext:
 
 X509Extension objects
@@ -178,16 +170,6 @@ X509Extension objects
                :special-members:
                :exclude-members: __weakref__
 
-.. _openssl-netscape-spki:
-
-NetscapeSPKI objects
---------------------
-
-.. autoclass:: NetscapeSPKI
-               :members:
-               :special-members:
-               :exclude-members: __weakref__
-
 .. _crl:
 
 CRL objects

pyproject.toml

@@ -44,8 +44,8 @@ addopts = "-r s --strict-markers"
 testpaths = ["tests"]
 
 [tool.ruff]
-select = ['E', 'F', 'I', 'W', 'UP', 'RUF']
+lint.select = ['E', 'F', 'I', 'W', 'UP', 'RUF']
 line-length = 79
 
-[tool.ruff.isort]
+[tool.ruff.lint.isort]
 known-first-party = ["OpenSSL", "tests"]

setup.py

@@ -96,7 +96,7 @@ def find_meta(meta):
             "cryptography>=41.0.5,<43",
         ],
         extras_require={
-            "test": ["flaky", "pretend", "pytest>=3.0.1"],
+            "test": ["pytest-rerunfailures", "pretend", "pytest>=3.0.1"],
             "docs": [
                 "sphinx!=5.2.0,!=5.2.0.post0,!=7.2.5",
                 "sphinx_rtd_theme",

src/OpenSSL/SSL.py

@@ -163,20 +163,11 @@
 DTLS_SERVER_METHOD = 11
 DTLS_CLIENT_METHOD = 12
 
-try:
-    SSL3_VERSION = _lib.SSL3_VERSION
-    TLS1_VERSION = _lib.TLS1_VERSION
-    TLS1_1_VERSION = _lib.TLS1_1_VERSION
-    TLS1_2_VERSION = _lib.TLS1_2_VERSION
-    TLS1_3_VERSION = _lib.TLS1_3_VERSION
-except AttributeError:
-    # Hardcode constants for cryptography < 3.4, see
-    # https://github.com/pyca/pyopenssl/pull/985#issuecomment-775186682
-    SSL3_VERSION = 768
-    TLS1_VERSION = 769
-    TLS1_1_VERSION = 770
-    TLS1_2_VERSION = 771
-    TLS1_3_VERSION = 772
+SSL3_VERSION = _lib.SSL3_VERSION
+TLS1_VERSION = _lib.TLS1_VERSION
+TLS1_1_VERSION = _lib.TLS1_1_VERSION
+TLS1_2_VERSION = _lib.TLS1_2_VERSION
+TLS1_3_VERSION = _lib.TLS1_3_VERSION
 
 OP_NO_SSLv2 = _lib.SSL_OP_NO_SSLv2
 OP_NO_SSLv3 = _lib.SSL_OP_NO_SSLv3
@@ -1388,8 +1379,8 @@ def set_client_ca_list(self, certificate_authorities):
             for ca_name in certificate_authorities:
                 if not isinstance(ca_name, X509Name):
                     raise TypeError(
-                        "client CAs must be X509Name objects, not {} "
-                        "objects".format(type(ca_name).__name__)
+                        f"client CAs must be X509Name objects, not "
+                        f"{type(ca_name).__name__} objects"
                     )
                 copy = _lib.X509_NAME_dup(ca_name._name)
                 _openssl_assert(copy != _ffi.NULL)