Skip to content

Add asn1.value_set for enum-based ASN.1 value sets#14962

Merged
reaperhulk merged 4 commits into
mainfrom
claude/pensive-tesla-6lTcl
Jun 7, 2026
Merged

Add asn1.value_set for enum-based ASN.1 value sets#14962
reaperhulk merged 4 commits into
mainfrom
claude/pensive-tesla-6lTcl

Conversation

@alex
Copy link
Copy Markdown
Member

@alex alex commented Jun 7, 2026

Adds a new @asn1.value_set(value_type) class decorator that registers an enum.Enum subclass as an ASN.1 value set: a named set of values of a single governing type (X.680 §16.7).

@asn1.value_set(x509.ObjectIdentifier)
class HashAlgorithm(enum.Enum):
    SHA_256 = x509.ObjectIdentifier("2.16.840.1.101.3.4.2.1")
    SHA_384 = x509.ObjectIdentifier("2.16.840.1.101.3.4.2.2")

@asn1.sequence
class Example:
    algorithm: HashAlgorithm

Members are encoded exactly as their underlying value; decoding maps the value back to the corresponding enum member and fails with ValueError if it doesn't match any member. All member values are validated against the declared value_type at class-definition time.

Works with any supported ASN.1 value type (OIDs, ints, strings, ...) and composes with Implicit/Explicit/Default annotations, OPTIONAL (X | None), CHOICE unions, and top-level encode_der/decode_der.

Implementation notes:

  • New Type::ValueSet(class, inner) variant on the Rust side; the field's encoding annotation is propagated to the underlying value, while DEFAULT is handled at the member level.
  • Decoding matches members by equality (not hash-based enum lookup), so wrapper types like PrintableString that define __eq__ without __hash__ work as values.

fixes #14891

https://claude.ai/code/session_01AbKLBGrHu13j6gKNpKGD2e


Generated by Claude Code

claude added 3 commits June 7, 2026 00:18
Adds a new @asn1.value_set class decorator that registers an enum.Enum
subclass whose member values all share a single ASN.1 type. Members are
encoded as their underlying value, and decoding maps the value back to
the corresponding member, failing if it does not match any member.

fixes #14891

https://claude.ai/code/session_01AbKLBGrHu13j6gKNpKGD2e
The decorator is now used as @value_set(ObjectIdentifier), making the
governing type explicit (matching ASN.1 value set syntax) and allowing
member values to be validated against the declared type.

https://claude.ai/code/session_01AbKLBGrHu13j6gKNpKGD2e
The combined-coverage CI gate flagged the ValueSet variant declaration:
the pyo3-generated _0/_1 accessors were never exercised. Extend
test_fields_of_variant_type to cover them, like the other variants.

https://claude.ai/code/session_01AbKLBGrHu13j6gKNpKGD2e
Comment thread src/cryptography/hazmat/asn1/asn1.py Outdated
"""
try:
rust_type = declarative_asn1.non_root_python_to_rust(value_type)
except TypeError:
Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we need to re-raise here, the original exception is fine

Comment thread src/cryptography/hazmat/asn1/asn1.py Outdated
f"value set '{cls.__name__}' must have at least one member"
)
for member in members:
if type(member.value) is not value_type:
Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this be an isinstance? I guess theoretically subclasses are fine?

Comment thread src/rust/src/declarative_asn1/decode.rs
- Don't wrap the non_root_python_to_rust exception in value_set
- Allow subclasses of the declared value type (isinstance check)
- Document why value set decoding uses a linear member scan

https://claude.ai/code/session_01AbKLBGrHu13j6gKNpKGD2e
@reaperhulk reaperhulk merged commit e4aff17 into main Jun 7, 2026
64 checks passed
@reaperhulk reaperhulk deleted the claude/pensive-tesla-6lTcl branch June 7, 2026 01:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

asn1: Allow Enum Like Object identifiers

3 participants