{"action":"created","issue":{"url":"https://api.github.com/repos/pyca/cryptography/issues/3896","repository_url":"https://api.github.com/repos/pyca/cryptography","labels_url":"https://api.github.com/repos/pyca/cryptography/issues/3896/labels{/name}","comments_url":"https://api.github.com/repos/pyca/cryptography/issues/3896/comments","events_url":"https://api.github.com/repos/pyca/cryptography/issues/3896/events","html_url":"https://github.com/pyca/cryptography/pull/3896","id":255839854,"number":3896,"title":"both parse and encode the ASN1 string type for Name attributes","user":{"login":"reaperhulk","id":161495,"avatar_url":"https://avatars2.githubusercontent.com/u/161495?v=4","gravatar_id":"","url":"https://api.github.com/users/reaperhulk","html_url":"https://github.com/reaperhulk","followers_url":"https://api.github.com/users/reaperhulk/followers","following_url":"https://api.github.com/users/reaperhulk/following{/other_user}","gists_url":"https://api.github.com/users/reaperhulk/gists{/gist_id}","starred_url":"https://api.github.com/users/reaperhulk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/reaperhulk/subscriptions","organizations_url":"https://api.github.com/users/reaperhulk/orgs","repos_url":"https://api.github.com/users/reaperhulk/repos","events_url":"https://api.github.com/users/reaperhulk/events{/privacy}","received_events_url":"https://api.github.com/users/reaperhulk/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-09-07T07:24:39Z","updated_at":"2017-09-08T00:14:32Z","closed_at":null,"author_association":"OWNER","pull_request":{"url":"https://api.github.com/repos/pyca/cryptography/pulls/3896","html_url":"https://github.com/pyca/cryptography/pull/3896","diff_url":"https://github.com/pyca/cryptography/pull/3896.diff","patch_url":"https://github.com/pyca/cryptography/pull/3896.patch"},"body":"Previously cryptography encoded everything (except country names) as UTF8String. This caused problems with chain building in libraries like NSS where the subject and issuer are expected to match byte-for-byte.\r\n\r\nWith this change we now parse and store the ASN1 string type as a private _type in NameAttribute. We then use this to encode when issuing a new certificate. This allows the CertificateBuilder to properly construct an identical issuer and fixes the issue with NSS.\r\n\r\nfixes #3515\r\n\r\nIt would make sense for NameAttributes to not compare equal unless they have the same type in addition to oid and value. However, our tests will fail if we do this because the default value of UTF8String that we set does not match what we parse out of some of our test certificates (which may contain PrintableString, etc). We can discuss this in a followup issue/PR.\r\n"},"comment":{"url":"https://api.github.com/repos/pyca/cryptography/issues/comments/327964568","html_url":"https://github.com/pyca/cryptography/pull/3896#issuecomment-327964568","issue_url":"https://api.github.com/repos/pyca/cryptography/issues/3896","id":327964568,"user":{"login":"alex","id":772,"avatar_url":"https://avatars2.githubusercontent.com/u/772?v=4","gravatar_id":"","url":"https://api.github.com/users/alex","html_url":"https://github.com/alex","followers_url":"https://api.github.com/users/alex/followers","following_url":"https://api.github.com/users/alex/following{/other_user}","gists_url":"https://api.github.com/users/alex/gists{/gist_id}","starred_url":"https://api.github.com/users/alex/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alex/subscriptions","organizations_url":"https://api.github.com/users/alex/orgs","repos_url":"https://api.github.com/users/alex/repos","events_url":"https://api.github.com/users/alex/events{/privacy}","received_events_url":"https://api.github.com/users/alex/received_events","type":"User","site_admin":false},"created_at":"2017-09-08T00:14:31Z","updated_at":"2017-09-08T00:14:31Z","author_association":"OWNER","body":"Cool\n\nOn Thu, Sep 7, 2017 at 8:14 PM, Paul Kehrer <notifications@github.com>\nwrote:\n\n> *@reaperhulk* commented on this pull request.\n> ------------------------------\n>\n> In src/cryptography/hazmat/backends/openssl/backend.py\n> <https://github.com/pyca/cryptography/pull/3896#discussion_r137685380>:\n>\n> > @@ -94,12 +94,6 @@ def __init__(self):\n>          self._ffi = self._binding.ffi\n>          self._lib = self._binding.lib\n>\n> -        # Set the default string mask for encoding ASN1 strings to UTF8. This\n>\n> pyOpenSSL actually does this independently (which makes sense since this\n> is in the backend, which is only imported in pyOpenSSL under certain\n> conditions). See: https://github.com/pyca/pyopenssl/blob/\n> 9e15eca29625f0aa87635a613b093ba1ecaa28fb/src/OpenSSL/crypto.py#L3035\n>\n> —\n> You are receiving this because you commented.\n> Reply to this email directly, view it on GitHub\n> <https://github.com/pyca/cryptography/pull/3896#discussion_r137685380>,\n> or mute the thread\n> <https://github.com/notifications/unsubscribe-auth/AAADBDOpaWvpNBjxwOeRm0SHJO8YIlKsks5sgIbTgaJpZM4PPZRQ>\n> .\n>\n\n\n\n-- \n\"I disapprove of what you say, but I will defend to the death your right to\nsay it.\" -- Evelyn Beatrice Hall (summarizing Voltaire)\n\"The people's good is the highest law.\" -- Cicero\nGPG Key fingerprint: D1B3 ADC0 E023 8CA6\n"}}
{"actor":{"display_login":"alex"}}