Raise MSRV to 1.60.0

.github/workflows/ci.yml

@@ -52,10 +52,9 @@ jobs:
           - {VERSION: "3.11", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "80935bf5ad309bf6c03591acf1d48fe1db57b78f"}}
           # Builds with various Rust versions. Includes MSRV and next
           # potential future MSRV:
-          # 1.60 - pem 2.0.1, once_cell 1.18.0
           # 1.64 - maturin
-          - {VERSION: "3.11", NOXSESSION: "tests-nocoverage", RUST: "1.56.0"}
           - {VERSION: "3.11", NOXSESSION: "rust,tests", RUST: "1.60.0"}
+          - {VERSION: "3.11", NOXSESSION: "rust,tests", RUST: "1.64.0"}
           - {VERSION: "3.11", NOXSESSION: "rust,tests", RUST: "beta"}
           - {VERSION: "3.11", NOXSESSION: "rust,tests", RUST: "nightly"}
     timeout-minutes: 15

CHANGELOG.rst

@@ -8,6 +8,8 @@ Changelog
 
 .. note:: This version is not yet released and is under active development.
 
+* Updated the minimum supported Rust version (MSRV) to 1.60.0, from 1.56.0.
+
 .. _v41-0-1:
 
 41.0.1 - 2023-06-01

docs/installation.rst

@@ -105,7 +105,7 @@ Alpine
 
 .. warning::
 
-    The Rust available by default in Alpine < 3.15 is older than the minimum
+    The Rust available by default in Alpine < 3.16 is older than the minimum
     supported version. See the :ref:`Rust installation instructions
     <installation:Rust>` for information about installing a newer Rust.
 
@@ -135,8 +135,8 @@ Fedora/RHEL/CentOS
 
 .. warning::
 
-    For RHEL and CentOS you must be on version 8.6 or newer for the command
-    below to install a sufficiently new Rust. If your Rust is less than 1.56.0
+    For RHEL and CentOS you must be on version 8.7 or newer for the command
+    below to install a sufficiently new Rust. If your Rust is less than 1.60.0
     please see the :ref:`Rust installation instructions <installation:Rust>`
     for information about installing a newer Rust.
 
@@ -314,7 +314,7 @@ Rust
     a Rust toolchain.
 
 Building ``cryptography`` requires having a working Rust toolchain. The current
-minimum supported Rust version is 1.56.0. **This is newer than the Rust some
+minimum supported Rust version is 1.60.0. **This is newer than the Rust some
 package managers ship**, so users may need to install with the
 instructions below.
 

setup.py

@@ -54,7 +54,7 @@
                 "cryptography.hazmat.bindings._rust",
                 "src/rust/Cargo.toml",
                 py_limited_api=True,
-                rust_version=">=1.56.0",
+                rust_version=">=1.60.0",
             )
         ],
     )

src/rust/Cargo.toml

@@ -5,7 +5,7 @@ authors = ["The cryptography developers <cryptography-dev@python.org>"]
 edition = "2021"
 publish = false
 # This specifies the MSRV
-rust-version = "1.56.0"
+rust-version = "1.60.0"
 
 [dependencies]
 once_cell = "1"
@@ -14,7 +14,7 @@ asn1 = { version = "0.15.2", default-features = false }
 cryptography-cffi = { path = "cryptography-cffi" }
 cryptography-x509 = { path = "cryptography-x509" }
 cryptography-openssl = { path = "cryptography-openssl" }
-pem = "1.1"
+pem = { version = "2", default-features = false }
 ouroboros = "0.15"
 openssl = "0.10.54"
 openssl-sys = "0.9.88"

src/rust/cryptography-cffi/Cargo.toml

@@ -5,7 +5,7 @@ authors = ["The cryptography developers <cryptography-dev@python.org>"]
 edition = "2021"
 publish = false
 # This specifies the MSRV
-rust-version = "1.56.0"
+rust-version = "1.60.0"
 
 [dependencies]
 pyo3 = { version = "0.19", features = ["abi3-py37"] }

src/rust/cryptography-openssl/Cargo.toml

@@ -5,7 +5,7 @@ authors = ["The cryptography developers <cryptography-dev@python.org>"]
 edition = "2021"
 publish = false
 # This specifies the MSRV
-rust-version = "1.56.0"
+rust-version = "1.60.0"
 
 [dependencies]
 openssl = "0.10.54"

src/rust/cryptography-x509/Cargo.toml

@@ -5,7 +5,7 @@ authors = ["The cryptography developers <cryptography-dev@python.org>"]
 edition = "2021"
 publish = false
 # This specifies the MSRV
-rust-version = "1.56.0"
+rust-version = "1.60.0"
 
 [dependencies]
 asn1 = { version = "0.15.2", default-features = false }

src/rust/cryptography-x509/src/certificate.rs

@@ -41,7 +41,7 @@ impl<'a> TbsCertificate<'a> {
     }
 }
 
-#[derive(asn1::Asn1Read, asn1::Asn1Write, Hash, PartialEq, Clone)]
+#[derive(asn1::Asn1Read, asn1::Asn1Write, Hash, PartialEq, Eq, Clone)]
 pub struct Validity {
     pub not_before: common::Time,
     pub not_after: common::Time,

src/rust/cryptography-x509/src/common.rs

@@ -109,7 +109,7 @@ pub enum AlgorithmParameters<'a> {
     Other(asn1::ObjectIdentifier, Option<asn1::Tlv<'a>>),
 }
 
-#[derive(asn1::Asn1Read, asn1::Asn1Write, Hash, PartialEq, Clone)]
+#[derive(asn1::Asn1Read, asn1::Asn1Write, Hash, PartialEq, Eq, Clone)]
 pub struct SubjectPublicKeyInfo<'a> {
     _algorithm: AlgorithmIdentifier<'a>,
     pub subject_public_key: asn1::BitString<'a>,
@@ -157,7 +157,7 @@ impl<'a> asn1::Asn1Writable for RawTlv<'a> {
     }
 }
 
-#[derive(asn1::Asn1Read, asn1::Asn1Write, PartialEq, Hash, Clone)]
+#[derive(asn1::Asn1Read, asn1::Asn1Write, PartialEq, Eq, Hash, Clone)]
 pub enum Time {
     UtcTime(asn1::UtcTime),
     GeneralizedTime(asn1::GeneralizedTime),
@@ -172,7 +172,7 @@ impl Time {
     }
 }
 
-#[derive(Hash, PartialEq, Clone)]
+#[derive(Hash, PartialEq, Eq, Clone)]
 pub enum Asn1ReadableOrWritable<'a, T, U> {
     Read(T, PhantomData<&'a ()>),
     Write(U, PhantomData<&'a ()>),

src/rust/cryptography-x509/src/name.rs

@@ -41,7 +41,7 @@ impl<'a> asn1::SimpleAsn1Writable for UnvalidatedIA5String<'a> {
     }
 }
 
-#[derive(asn1::Asn1Read, asn1::Asn1Write, PartialEq, Hash)]
+#[derive(asn1::Asn1Read, asn1::Asn1Write, PartialEq, Eq, Hash)]
 pub struct OtherName<'a> {
     pub type_id: asn1::ObjectIdentifier,
     #[explicit(0, required)]

src/rust/src/asn1.rs

@@ -104,10 +104,7 @@ pub(crate) fn encode_der_data<'p>(
         Ok(pyo3::types::PyBytes::new(
             py,
             &pem::encode_config(
-                &pem::Pem {
-                    tag: pem_tag,
-                    contents: data,
-                },
+                &pem::Pem::new(pem_tag, data),
                 pem::EncodeConfig {
                     line_ending: pem::LineEnding::LF,
                 },

src/rust/src/backend/dh.rs

@@ -83,11 +83,11 @@ fn from_der_parameters(data: &[u8]) -> CryptographyResult<DHParameters> {
 fn from_pem_parameters(data: &[u8]) -> CryptographyResult<DHParameters> {
     let parsed = x509::find_in_pem(
         data,
-        |p| p.tag == "DH PARAMETERS" || p.tag == "X9.42 DH PARAMETERS",
+        |p| p.tag() == "DH PARAMETERS" || p.tag() == "X9.42 DH PARAMETERS",
         "Valid PEM but no BEGIN DH PARAMETERS/END DH PARAMETERS delimiters. Are you sure this is a DH parameters?",
     )?;
 
-    from_der_parameters(&parsed.contents)
+    from_der_parameters(parsed.contents())
 }
 
 fn dh_parameters_from_numbers(

src/rust/src/x509/certificate.rs

@@ -351,12 +351,12 @@ fn load_pem_x509_certificate(py: pyo3::Python<'_>, data: &[u8]) -> CryptographyR
     // https://github.com/openssl/openssl/blob/5e2d22d53ed322a7124e26a4fbd116a8210eb77a/include/openssl/pem.h#L32-L33
     let parsed = x509::find_in_pem(
         data,
-        |p| p.tag == "CERTIFICATE" || p.tag == "X509 CERTIFICATE",
+        |p| p.tag() == "CERTIFICATE" || p.tag() == "X509 CERTIFICATE",
         "Valid PEM but no BEGIN CERTIFICATE/END CERTIFICATE delimiters. Are you sure this is a certificate?",
     )?;
     load_der_x509_certificate(
         py,
-        pyo3::types::PyBytes::new(py, &parsed.contents).into_py(py),
+        pyo3::types::PyBytes::new(py, parsed.contents()).into_py(py),
     )
 }
 
@@ -367,9 +367,9 @@ fn load_pem_x509_certificates(
 ) -> CryptographyResult<Vec<Certificate>> {
     let certs = pem::parse_many(data)?
         .iter()
-        .filter(|p| p.tag == "CERTIFICATE" || p.tag == "X509 CERTIFICATE")
+        .filter(|p| p.tag() == "CERTIFICATE" || p.tag() == "X509 CERTIFICATE")
         .map(|p| {
-            load_der_x509_certificate(py, pyo3::types::PyBytes::new(py, &p.contents).into_py(py))
+            load_der_x509_certificate(py, pyo3::types::PyBytes::new(py, p.contents()).into_py(py))
         })
         .collect::<Result<Vec<_>, _>>()?;
 

src/rust/src/x509/crl.rs

@@ -45,12 +45,12 @@ fn load_pem_x509_crl(
 ) -> Result<CertificateRevocationList, CryptographyError> {
     let block = x509::find_in_pem(
         data,
-        |p| p.tag == "X509 CRL",
+        |p| p.tag() == "X509 CRL",
         "Valid PEM but no BEGIN X509 CRL/END X509 delimiters. Are you sure this is a CRL?",
     )?;
     load_der_x509_crl(
         py,
-        pyo3::types::PyBytes::new(py, &block.contents).into_py(py),
+        pyo3::types::PyBytes::new(py, block.contents()).into_py(py),
     )
 }
 

src/rust/src/x509/csr.rs

@@ -256,12 +256,12 @@ fn load_pem_x509_csr(
     // https://github.com/openssl/openssl/blob/5e2d22d53ed322a7124e26a4fbd116a8210eb77a/include/openssl/pem.h#L35-L36
     let parsed = x509::find_in_pem(
         data,
-        |p| p.tag == "CERTIFICATE REQUEST" || p.tag == "NEW CERTIFICATE REQUEST",
+        |p| p.tag() == "CERTIFICATE REQUEST" || p.tag() == "NEW CERTIFICATE REQUEST",
         "Valid PEM but no BEGIN CERTIFICATE REQUEST/END CERTIFICATE REQUEST delimiters. Are you sure this is a CSR?",
     )?;
     load_der_x509_csr(
         py,
-        pyo3::types::PyBytes::new(py, &parsed.contents).into_py(py),
+        pyo3::types::PyBytes::new(py, parsed.contents()).into_py(py),
     )
 }