Skip to content

v5.0.0

Choose a tag to compare

View all tags
@kislyuk kislyuk released this 21 Jun 00:29
v5.0.0
19f07bb

v0.1.0
v0.1.1 v0.1.1
v0.1.2 v0.1.2
v0.1.3 v0.1.3
v0.1.4 v0.1.4
v0.1.5 v0.1.5
v0.1.6 v0.1.6
v0.1.7 v0.1.7
v0.1.8 v0.1.8
v0.1.9 v0.1.9
v0.2.0 v0.2.0
v0.2.2 v0.2.2
v0.2.3 v0.2.3
v0.2.4 v0.2.4
v0.2.5 v0.2.5
v0.2.6 v0.2.6
v0.2.7 v0.2.7
v0.2.8 v0.2.8
v0.2.9 v0.2.9
v0.3.0 v0.3.0
v0.3.1 v0.3.1
v0.3.2 v0.3.2
v0.3.3 v0.3.3
v0.3.4 v0.3.4
v0.3.5 v0.3.5
v0.3.6 v0.3.6
v0.3.7 v0.3.7
v0.3.8 v0.3.8
v0.3.9 v0.3.9
v0.4.0 v0.4.0
v0.4.1 v0.4.1
v0.4.2 v0.4.2
v0.4.4 v0.4.4
v0.4.5 v0.4.5
v0.4.6 v0.4.6
v0.5.0 v0.5.0
v0.6.0 v0.6.0
v1.0.0 v1.0.0
v1.0.1 v1.0.1
v1.0.2 v1.0.2
v2.0.0 v2.0.0
v2.1.0 * Only sign the referenced element when passed reference_uri (thanks
to @soby).

  • Add CN validation - instead of a full X.509 certificate, it is now
    possible to pass a common name that will be matched against the CN
    of a cert trusted by the CA store.

  • Order-agnostic cert chain validation and friendlier ingestion of
    cert chains.

  • Minor/internal changes
    v2.1.1 * Only sign the referenced element when passed reference_uri (thanks
    to @soby).

  • Add CN validation - instead of a full X.509 certificate, it is now
    possible to pass a common name that will be matched against the CN of
    a cert trusted by the CA store.

  • Order-agnostic cert chain validation and friendlier ingestion of cert
    chains.

  • Minor/internal changes; packaging fix for 2.1.0
    v2.1.2 * Only sign the referenced element when passed reference_uri (thanks
    to @soby).

  • Add CN validation - instead of a full X.509 certificate, it is now
    possible to pass a common name that will be matched against the CN of
    a cert trusted by the CA store.

  • Order-agnostic cert chain validation and friendlier ingestion of cert
    chains.

  • Minor/internal changes; packaging fix for 2.1.0
    v2.1.3 - Only sign the referenced element when passed reference_uri (thanks
    to @soby).

  • Add CN validation - instead of a full X.509 certificate, it is now
    possible to pass a common name that will be matched against the CN of
    a cert trusted by the CA store.

  • Order-agnostic cert chain validation and friendlier ingestion of cert
    chains.

  • Minor/internal changes; packaging fix for 2.1.0
    v2.1.4 - Only sign the referenced element when passed reference_uri (thanks
    to @soby).

  • Add CN validation - instead of a full X.509 certificate, it is now
    possible to pass a common name that will be matched against the CN of
    a cert trusted by the CA store.

  • Order-agnostic cert chain validation and friendlier ingestion of cert
    chains.

  • Minor/internal changes; packaging fix for 2.1.0
    v2.10.0 - Excise empty xmlns declarations only in signature, not in payload

  • Add pyinstaller support to signxml (#188)

  • Documentation, test infrastructure, and code organization improvements
    v2.10.1 - Do not excise any empty xmlns="" declarations by default. This behavior is now configurable as follows

    signer = XMLSigner()
signer.excise_empty_xmlns_declarations = True
signer.sign(...)

    verifier = XMLVerifier()
verifier.excise_empty_xmlns_declarations = True
verifier.verify(...)

  • Documentation and autoformatting improvements
    v2.2.0 - Support custom key info when signing

  • Initial elements of ws-security support

  • Support signing and verifying multiple references
    v2.2.1 - Fix handling of reference URIs in detached signing

  • Test infra fixes
    v2.2.2 - Expand supported cryptography version range. Fixes #74

  • Documentation and release automation improvements
    v2.2.3 - Release automation: parse repo name correctly
    v2.2.4 - Documentation and test fixes
    v2.2.5 - Allow defusedxml>=0.5 (#82)

  • Readability improvements
    v2.2.6 - Fix release script
    v2.3.0 - Add explicit dependency on asn1crypto to setup.py (#87)

  • Remove use of Exception.message for py3 compatibility. Closes #36 (#86)

  • Use asn1crypto instead of pyasn1 to match cryptography lib (#85)

  • Pin to major version of lxml instead of minor

  • Allow newer versions of several requirements (#84)

  • Allow newer version of eight library (#83)
    v2.4.0 - Import asn1crypto on demand

  • Allow newer versions of cryptography library (#89)
    v2.5.0 - Relax dependency version constraints.

  • Drop Python 3.3 support.

  • Support for PEM files with CR+LF line endings (#93).
    v2.5.1 Fix release
    v2.5.2 - Fix release
    v2.6.0 - Update dependencies to baseline on Ubuntu 18.04

  • Clarify documentation of Ubuntu installation dependencies

  • List ipaddress as a dependency

  • Strip PEM header from OpenSSL.crypto.X509 cert

  • Doc updates: dependency versions, standard links

  • Fix cryptography deprecation warnings. Closes #108

  • Allow URI attribute of Reference to be absent (#102)
    v2.7.0 - Drop defusedxml dependency; add security notes

  • Add missing c14n transform for enveloping and detached methods (#107)

  • Relax pyOpenSSL dependency version range to include version 19

  • Apply transforms and digest calculations to copies of root. Closes #125. (#126)

  • Documentation and test improvements
    v2.7.1 - Accept PEM keys as either str or bytes
    v2.7.2 - Relax dependency version range on eight

  • Update dependency installation documentation

  • XMLSigner.sign(): add always_add_key_value kwarg to include both
    X509Data and KeyValue for ill-defined signing applications

  • XMLVerifier.verify(): reject signatures that contain both X509Data
    and KeyValue by default; add ignore_ambiguous_key_info kwarg to
    bypass
    v2.7.3 - Fix ECDSA signature encoding/decoding (#150)

  • Add InclusiveNamespaces PrefixList support for SignedInfo

  • Test and documentation improvements
    v2.8.0 - Compare raw digest bytes instead of base64 encoded digests. Fixes #155

  • Initial X509IssuerSerial/X509Digest support

  • Support custom inclusive_ns_prefixes when signing
    v2.8.1 - Allow cryptography versions >3 (but <4) (#164)

  • Add support for adding Signature Properties to a detached signature (#160)
    v2.8.2 - Allow the combination of X509Data and KeyValue when they represent the same public key (#169)

  • Use self.namespaces signature properties "Object" element (#167)
    v2.9.0 - Unlimit cryptography version constraint. Fixes #177

  • Bump pyOpenSSL compat range; add dep version strategy note
    v3.0.0 - Add XAdES support

  • Migrate all configuration inputs to enums (string identifiers are still supported, but will be deprecated in a future version)

  • Migrate structured data inputs to dataclasses

  • Deprecate excise_empty_xmlns_declarations

  • Documentation and test infrastructure improvements

  • Clean up top level signxml and signxml.xades namespaces

  • Stop using default_backend for cryptography, it is no longer required

  • Drop Python 3.6 support (#200)
    v3.0.1 - Mark SHA1 as deprecated

  • Aggregate verification settings in SignatureConfiguration dataclass

  • Mark all dataclasses in API as frozen

  • Add ability to assert expected signature location

  • Add ability to assert expected signature algorithms

  • Add ability to assert expected digest algorithms

  • Add MGF1 ("RSASSA-PSS without parameters") algorithm identifiers

  • Remove PSS ("RSASSA-PSS with parameters") and EdDSA algorithm
    identifiers (given low usage and no interop examples, we will not be
    implementing PSS parameters for now; EdDSA key info additionally has
    no standardized way to serialize it)

  • Add debug logging of canonicalization outputs

  • Documentation and formatting improvements
    v3.0.2 - Remove incorrect deprecation of xml-c14n11 URI
    v3.1.0 - Use distinct default for payload c14n. Fixes #217

  • Deprecate SHA1

  • Test and documentation improvements
    v3.1.1 - Add type attribute to XAdES signed properties reference (#224)
    v3.2.0 - Roundtrip referenced XML nodes before c14n to detach them from parent document when verifying (#225)
    v3.2.1 - Use dataclass.replace in SignatureReference construction. Fixes #231
    v3.2.2 - Update upper bound on lxml dependency to allow lxml 5

  • Bump minimum dependency versions to align with Ubuntu 20.04

  • Test and release infrastructure improvements
    v4.0.0 - Replace PyOpenSSL with Cryptography (#260)

    • This is a major infrastructure change that replaces core
      certificate parsing, key processing, signature validation, and
      certificate chain validation functions previously provided by
      PyOpenSSL with those provided by Cryptography. Care was taken to
      preserve the exisitng API, including exception types, but many
      error messages raised in various error conditions have changed. If
      you see unexpected behavior and you have reason to believe it is
      incorrect, please file an issue.

    • Breaking change: the ca_path parameter, previously used to specify
      CA certificate stores, is no longer supported. Use the ca_pem_file
      parameter instead.

  • Raise error when invalid certificate string is passed as input to signer

  • Fix public key matching for ECDSA (#245)
    v4.0.1 - Verifier: Accept PyOpenSSL cert input, add deprecation warning
    v4.0.2 - XAdES signing: remove duplicate timezone information from SigningTime (#266)
    v4.0.3 - Fix issue with support for deprecated PyOpenSSL certificates

  • Fully remove the ca_path parameter; add docs for signature location pinning
    v4.0.4 This release contains security fixes for two security advisories:

  • Signature verification with HMAC is vulnerable to an algorithm confusion attack
    (GHSA-6vx8-pcwv-xhf4)

  • Signature verification with HMAC is vulnerable to a timing attack
    (GHSA-gmhf-gg8w-jw42)
    v4.0.5 - Use Python 3.9 compatible typing expression
    v4.1.0 - Add options to exclude the C14N Transform element in signatures (#274)
    v4.2.0 - Align behaviour of expect_references with docs (#279).
    Passing expect_references=True to verify(...) now results in a list
    of verify_results, irrespective of the number of references in the
    signature.

  • Accept lxml 6.x
    v4.2.1 - Add legacy SigningCertificate with IssuerSerial for XAdES interoperability (#282)
    v4.2.2 - Support default namespace with no xmlns="" undeclarations in sign/verify round-trip (#286)
    v4.3.0 - Remove registration for ec.SECT* ECDSA curves (#289)

  • Fix key info matching behavior (#287)
    v4.3.1 - Fix comparison logic for ECDSA public keys (#290)
    v4.4.0 - Forbid DTD declarations in XML input

  • Avoid deprecated method importlib.resources.open_text
    v4.5.0 - Support setting certificate validation policy
    v4.5.1 - fix rst formatting
    v5.0.0 - X.509 certificate valitation now requires the provided certificate to list digital signature as a key usage.

Contributors

soby
Assets 3
Loading