1From a4e468a2a0afa80df174831c2f422184820bb0fa Mon Sep 17 00:00:00 2001
2From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
3Date: Thu, 6 Jan 2022 23:15:00 +0100
4Subject: [PATCH] mozilla/certdata2pem.py: make cryptography module optional
5
6The Python cryptography module is only used to verify if trusted
7certificates have expired, but this is only a warning. For some build
8systems and distributions, providing Python cryptography is costly,
9especially since it's now partly written in Rust.
10
11As the check is only a warning, it's anyway going to be overlooked by
12most people. This commit changes the check to be optional: if the
13cryptography Python module is there, we perform the check, otherwise
14the check is skipped.
15
16Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
17[Steve: refreshed to apply on ca-certificates version 20230311]
18Signed-off-by: Steve Hay <me@stevenhay.com>
19---
20 mozilla/certdata2pem.py | 17 ++++++++++-------
21 1 file changed, 10 insertions(+), 7 deletions(-)
22
23diff --git a/mozilla/certdata2pem.py b/mozilla/certdata2pem.py
24index 4df86a2..3a6d7dc 100644
25--- a/mozilla/certdata2pem.py
26+++ b/mozilla/certdata2pem.py
27@@ -28,8 +28,6 @@ import sys
28 import textwrap
29 import io
30
31-from cryptography import x509
32-
33
34 objects = []
35
36@@ -122,11 +120,16 @@ for obj in objects:
37         if not obj['CKA_LABEL'] in trust or not trust[obj['CKA_LABEL']]:
38             continue
39
40-        cert = x509.load_der_x509_certificate(bytes(obj['CKA_VALUE']))
41-        if cert.not_valid_after < datetime.datetime.utcnow():
42-            print('!'*74)
43-            print('Trusted but expired certificate found: %s' % obj['CKA_LABEL'])
44-            print('!'*74)
45+        try:
46+            from cryptography import x509
47+
48+            cert = x509.load_der_x509_certificate(bytes(obj['CKA_VALUE']))
49+            if cert.not_valid_after < datetime.datetime.utcnow():
50+                print('!'*74)
51+                print('Trusted but expired certificate found: %s' % obj['CKA_LABEL'])
52+                print('!'*74)
53+        except ImportError:
54+            pass
55
56         bname = obj['CKA_LABEL'][1:-1].replace('/', '_')\
57                                       .replace(' ', '_')\
58--
592.30.2
60
61