[ol7_latest_archive] python-nss-0.14.0-5.el7.x86_64

This package provides Python bindings for Network Security Services
(NSS) and the Netscape Portable Runtime (NSPR).

NSS is a set of libraries supporting security-enabled client and
server applications. Applications built with NSS can support SSL v2
and v3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME, X.509 v3
certificates, and other security standards. Specific NSS
implementations have been FIPS-140 certified.

Changelog (Show File list) (Show related packages)

• Fri Jan 24 2014 Daniel Mach <dmach@redhat.com> - 0.14.0-5

  - Mass rebuild 2014-01-24

• Fri Dec 27 2013 Daniel Mach <dmach@redhat.com> - 0.14.0-4

  - Mass rebuild 2013-12-27

• Fri Oct 18 2013 John Dennis <jdennis@redhat.com> - 0.14.0-3

  - resolves: bug#1003979
  - In coordination with QE with regards to bz 1019934 it was requested
    the unittest patches be enhanced with a more robust version of
    test_pkcs12, no actual bug, just better testing.

• Tue Oct 08 2013 John Dennis <jdennis@redhat.com> - 0.14.0-2

  - resolves: bug#1002589
  - resolves: bug#1003979
  
  - Rewrite setup_certs.py. No longer behaves like an expect script
    which was fragile. By default now creates a sql style database.
  - By default all examples & tests use new sql format for NSS database
  - db-name is now used instead of dbdir to provide distinction between
    the database directory and it's scheme (e.g. 'sql:')
  - all examples and tests now default db-name to 'sql:pki'
  - replaced legacy getopt & optparse command line argument handling
    with modern argparse.

• Mon May 13 2013 John Dennis <jdennis@redhat.com> - 0.14-1

  External Changes:
    -----------------
  
    The primary enhancements in this version is support of certifcate
    validation, OCSP support, and support for the certificate "Authority
    Information Access" extension.
  
    Enhanced certifcate validation including CA certs can be done via
    Certificate.verify() or Certificate.is_ca_cert(). When cert
    validation fails you can now obtain diagnostic information as to why
    the cert failed to validate. This is encapsulated in the
    CertVerifyLog class which is a iterable collection of
    CertVerifyLogNode objects. Most people will probablby just print the
    string representation of the returned CertVerifyLog object. Cert
    validation logging is handled by the Certificate.verify() method.
    Support has also been added for the various key usage and cert type
    entities which feature prominently during cert validation.
  
  
    * Certificate() constructor signature changed from
  
      Certificate(data=None, der_is_signed=True)
  
      to
  
      Certificate(data, certdb=cert_get_default_certdb(), perm=False, nickname=None)
  
      This change was necessary because all certs should be added to the
      NSS temporary database when they are loaded, but earlier code
      failed to to that. It's is not likely that an previous code was
      failing to pass initialization data or the der_is_signed flag so
      this change should be backwards compatible.
  
    * Fix bug #922247, PKCS12Decoder.database_import() method. Importing into
      a NSS database would sometimes fail or segfault.
  
    * Error codes and descriptions were updated from upstream NSPR & NSS.
  
    * The password callback did not allow for breaking out of a password
      prompting loop, now if None is returned from the password callback
      the password prompting is terminated.
  
    * nss.nss_shutdown_context now called from InitContext destructor,
      this assures the context is shutdown even if the programmer forgot
      to. It's still best to explicitly shut it down, this is just
      failsafe.
  
    * Support was added for shutdown callbacks.
  
    * The following classes were added:
      - nss.CertVerifyLogNode
      - nss.CertVerifyLog
      - error.CertVerifyError (exception)
      - nss.AuthorityInfoAccess
      - nss.AuthorityInfoAccesses
  
  
    * The following class methods were added:
      - nss.Certificate.is_ca_cert
      - nss.Certificate.verify
      - nss.Certificate.verify_with_log
      - nss.Certificate.get_cert_chain
      - nss.Certificate.check_ocsp_status
      - nss.PK11Slot.list_certs
      - nss.CertVerifyLogNode.format_lines
      - nss.CertVerifyLog.format_lines
      - nss.CRLDistributionPts.format_lines
  
    * The following class properties were added:
      - nss.CertVerifyLogNode.certificate
      - nss.CertVerifyLogNode.error
      - nss.CertVerifyLogNode.depth
      - nss.CertVerifyLog.count
  
    * The following module functions were added:
      - nss.x509_cert_type
      - nss.key_usage_flags
      - nss.list_certs
      - nss.find_certs_from_email_addr
      - nss.find_certs_from_nickname
      - nss.nss_get_version
      - nss.nss_version_check
      - nss.set_shutdown_callback
      - nss.get_use_pkix_for_validation
      - nss.set_use_pkix_for_validation
      - nss.enable_ocsp_checking
      - nss.disable_ocsp_checking
      - nss.set_ocsp_cache_settings
      - nss.set_ocsp_failure_mode
      - nss.set_ocsp_timeout
      - nss.clear_ocsp_cache
      - nss.set_ocsp_default_responder
      - nss.enable_ocsp_default_responder
      - nss.disable_ocsp_default_responder
  
    * The following files were added:
        src/py_traceback.h
        doc/examples/verify_cert.py
        test/test_misc.py
  
    * The following constants were added:
      - nss.KU_DIGITAL_SIGNATURE
      - nss.KU_NON_REPUDIATION
      - nss.KU_KEY_ENCIPHERMENT
      - nss.KU_DATA_ENCIPHERMENT
      - nss.KU_KEY_AGREEMENT
      - nss.KU_KEY_CERT_SIGN
      - nss.KU_CRL_SIGN
      - nss.KU_ENCIPHER_ONLY
      - nss.KU_ALL
      - nss.KU_DIGITAL_SIGNATURE_OR_NON_REPUDIATION
      - nss.KU_KEY_AGREEMENT_OR_ENCIPHERMENT
      - nss.KU_NS_GOVT_APPROVED
      - nss.PK11CertListUnique
      - nss.PK11CertListUser
      - nss.PK11CertListRootUnique
      - nss.PK11CertListCA
      - nss.PK11CertListCAUnique
      - nss.PK11CertListUserUnique
      - nss.PK11CertListAll
      - nss.certUsageSSLClient
      - nss.certUsageSSLServer
      - nss.certUsageSSLServerWithStepUp
      - nss.certUsageSSLCA
      - nss.certUsageEmailSigner
      - nss.certUsageEmailRecipient
      - nss.certUsageObjectSigner
      - nss.certUsageUserCertImport
      - nss.certUsageVerifyCA
      - nss.certUsageProtectedObjectSigner
      - nss.certUsageStatusResponder
      - nss.certUsageAnyCA
      - nss.ocspMode_FailureIsVerificationFailure
      - nss.ocspMode_FailureIsNotAVerificationFailure
  
    * cert_dump.py extended to print NS_CERT_TYPE_EXTENSION
  
    * cert_usage_flags, nss_init_flags now support optional repr_kind parameter
  
    Internal Changes:
    -----------------
  
    * Reimplement exception handling
      - NSPRError is now derived from StandardException instead of
        EnvironmentError. It was never correct to derive from
        EnvironmentError but was difficult to implement a new subclassed
        exception with it's own attributes, using EnvironmentError had
        been expedient.
  
      - NSPRError now derived from StandardException, provides:
        * errno (numeric error code)
        * strerror (error description associated with error code)
        * error_message (optional detailed message)
        * error_code (alias for errno)
        * error_desc (alias for strerror)
  
      - CertVerifyError derived from NSPRError, extends with:
        * usages (bitmask of returned usages)
        * log (CertVerifyLog object)
  
    * Expose error lookup to sibling modules
  
    * Use macros for bitmask_to_list functions to reduce code
      duplication and centralize logic.
  
    * Add repr_kind parameter to cert_trust_flags_str()
  
    * Add support for repr_kind AsEnumName to bitstring table lookup.
  
    * Add cert_type_bitstr_to_tuple() lookup function
  
    * Add PRTimeConvert(), used to convert Python time values
      to PRTime, centralizes conversion logic, reduces duplication
  
    * Add UTF8OrNoneConvert to better handle unicode parameters which
      are optional.
  
    * Add Certificate_summary_format_lines() utility to generate
      concise certificate identification info for output.
  
    * Certificate_new_from_CERTCertificate now takes add_reference parameter
      to properly reference count certs, should fix shutdown busy problems.
  
    * Add print_traceback(), print_cert() debugging support.

• Mon Feb 18 2013 John Dennis <jdennis@redhat.com> - 0.13-1

  - Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild

• Mon Oct 08 2012 John Dennis <jdennis@redhat.com> - 0.13-0

  - Update to version 0.13
    Introduced in 0.13:
  
    * Fix NSS SECITEM_CompareItem bug via workaround.
  
    * Fix incorrect format strings in PyArg_ParseTuple* for:
      - GeneralName
      - BasicConstraints
      - cert_x509_key_usage
  
    * Fix bug when decoding certificate BasicConstraints extension
  
    * Fix hang in setup_certs.
  
    * For NSS >= 3.13 support CERTDB_TERMINAL_RECORD
  
    * You can now query for a specific certificate extension
      Certficate.get_extension()
  
    * The following classes were added:
      - RSAGenParams
  
    * The following class methods were added:
      - nss.nss.Certificate.get_extension
      - nss.nss.PK11Slot.generate_key_pair
      - nss.nss.DSAPublicKey.format
      - nss.nss.DSAPublicKey.format_lines
  
    * The following module functions were added:
      - nss.nss.pub_wrap_sym_key
  
    * The following internal utilities were added:
      - PyString_UTF8
      - SecItem_new_alloc()
  
    * The following class constructors were modified to accept
      intialization parameters
  
      - KEYPQGParams (DSA generation parameters)
  
    * The PublicKey formatting (i.e. format_lines) was augmented
      to format DSA keys (formerly it only recognized RSA keys).
  
    * Allow lables and values to be justified when printing objects
  
    * The following were deprecated:
      - nss.nss.make_line_pairs (replaced by nss.nss.make_line_fmt_tuples)
  
      Deprecated Functionality:
      -------------------------
      - make_line_pairs() has been replaced by make_line_fmt_tuples()
        because 2-valued tuples were not sufficently general. It is
        expected very few programs will have used this function, it's mostly
        used internally but provided as a support utility.

• Sat Jul 21 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.12-4

  - Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild

• Sat Jan 14 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.12-3

  - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild

• Thu Nov 17 2011 John Dennis <jdennis@redhat.com> - 0.12-2

  - add patch python-nss-0.12-rsapssparams.patch to fix build problem
    which appears only with nss 3.13 and later.