Bump pyopenssl from 22.0.0 to 22.1.0 (#511)

* Bump pyopenssl from 22.0.0 to 22.1.0

Bumps [pyopenssl](https://github.com/pyca/pyopenssl) from 22.0.0 to 22.1.0.
- [Release notes](https://github.com/pyca/pyopenssl/releases)
- [Changelog](https://github.com/pyca/pyopenssl/blob/main/CHANGELOG.rst)
- [Commits](pyca/pyopenssl@22.0.0...22.1.0)

---
updated-dependencies:
- dependency-name: pyopenssl
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Drop support for cryptography 2.6 and earlier

It's not covered in our CI anymore.

* Remove cryptography 2.6.1 test

It was no longer working with the latest pyOpenSSL upgrade.

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Quentin Pradet <quentin.pradet@gmail.com>

.github/workflows/ci.yml

@@ -40,9 +40,6 @@ jobs:
         old_cryptography: ['']
         extra_name: ['']
         include:
-          - python: '3.8'
-            old_cryptography: 2.6.1
-            extra_name: ', cryptography 2.6.1'
           - python: pypy-3.7
             old_cryptography: ''
             extra_name: ', PyPy 3'

setup.py

@@ -19,9 +19,7 @@
     url="https://github.com/python-trio/trustme",
     python_requires=">=3.7",
     install_requires=[
-        "cryptography",
-        # cryptography depends on both of these too, so we should declare our
-        # dependencies to be accurate, but they don't actually cost anything:
+        "cryptography>=2.7",
         "idna",
     ],
     classifiers=[

test-requirements.txt

@@ -35,7 +35,7 @@ pyasn1-modules==0.2.8
     # via service-identity
 pycparser==2.21
     # via cffi
-pyopenssl==22.0.0
+pyopenssl==22.1.0
     # via -r test-requirements.in
 pyparsing==3.0.9
     # via packaging

trustme/__init__.py

@@ -361,15 +361,7 @@ def issue_cert(
 
         ski_ext = self._certificate.extensions.get_extension_for_class(
             x509.SubjectKeyIdentifier)
-        ski = ski_ext.value
-        # Workaround a bug in cryptography 2.6 and earlier, where you have to
-        # pass the extension object instead of the actual SKI object
-        try:
-            # The new way
-            aki = x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(ski)
-        except AttributeError:
-            # The old way
-            aki = x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(ski_ext)  # type: ignore[arg-type]
+        aki = x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(ski_ext.value)
 
         cert = (
             _cert_builder_common(