--- pyproject.toml.orig 2025-10-11 16:50:06.000000000 +0800 +++ pyproject.toml 2025-10-22 15:54:44.000000000 +0800 @@ -27,9 +27,9 @@ ] dependencies = [ "certifi", - "cryptography>=42.0.0", + "cryptography", "pylsqpack>=0.3.3,<0.4.0", - "pyopenssl>=24", + "pyopenssl>=22", "service-identity>=24.1.0", ] dynamic = ["version"] --- src/aioquic/tls.py.orig 2025-10-11 16:50:06.000000000 +0800 +++ src/aioquic/tls.py 2025-10-22 15:53:52.000000000 +0800 @@ -16,7 +16,6 @@ Sequence, TypeVar, Union, - cast, ) import certifi @@ -35,10 +34,6 @@ x448, x25519, ) -from cryptography.hazmat.primitives.asymmetric.types import ( - CertificateIssuerPublicKeyTypes, - PrivateKeyTypes, -) from cryptography.hazmat.primitives.kdf.hkdf import HKDFExpand from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat from OpenSSL import crypto @@ -58,8 +53,7 @@ # facilitate mocking for the test suite -def utcnow() -> datetime.datetime: - return datetime.datetime.now(datetime.timezone.utc) +utcnow = datetime.datetime.utcnow class AlertDescription(IntEnum): @@ -195,7 +189,7 @@ def load_pem_private_key( data: bytes, password: Optional[bytes] = None -) -> PrivateKeyTypes: +) -> Union[dsa.DSAPrivateKey, ec.EllipticCurvePrivateKey, rsa.RSAPrivateKey]: """ Load a PEM-encoded private key. """ @@ -224,9 +218,9 @@ ) -> None: # verify dates now = utcnow() - if now < certificate.not_valid_before_utc: + if now < certificate.not_valid_before: raise AlertCertificateExpired("Certificate is not valid yet") - if now > certificate.not_valid_after_utc: + if now > certificate.not_valid_after: raise AlertCertificateExpired("Certificate is no longer valid") # verify subject @@ -1105,7 +1099,7 @@ k.update_hash(data) -CIPHER_SUITES: dict = { +CIPHER_SUITES = { CipherSuite.AES_128_GCM_SHA256: hashes.SHA256, CipherSuite.AES_256_GCM_SHA384: hashes.SHA384, CipherSuite.CHACHA20_POLY1305_SHA256: hashes.SHA256, @@ -1497,16 +1491,7 @@ ) try: - # The type of public_key() is CertificatePublicKeyTypes, but along with - # ed25519 and ed448, which are fine, this type includes - # x25519 and x448 which can be public keys but can't sign. We know - # we won't get x25519 and x448 as they are not on our list of - # signature algorithms, so we can cast public key to - # CertificateIssuerPublicKeyTypes safely and make mypy happy. - public_key = cast( - CertificateIssuerPublicKeyTypes, self._peer_certificate.public_key() - ) - public_key.verify( + self._peer_certificate.public_key().verify( verify.signature, self.key_schedule.certificate_verify_data( SERVER_CONTEXT_STRING if self._is_client else CLIENT_CONTEXT_STRING --- tests/utils.py.orig 2025-10-11 16:50:06.000000000 +0800 +++ tests/utils.py 2025-10-22 15:57:36.000000000 +0800 @@ -56,10 +56,8 @@ .issuer_name(issuer) .public_key(key.public_key()) .serial_number(x509.random_serial_number()) - .not_valid_before(datetime.datetime.now(datetime.timezone.utc)) - .not_valid_after( - datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(days=10) - ) + .not_valid_before(datetime.datetime.utcnow()) + .not_valid_after(datetime.datetime.utcnow() + datetime.timedelta(days=10)) ) if alternative_names: builder = builder.add_extension( --- tests/test_tls.py.orig 2025-10-11 16:50:06.000000000 +0800 +++ tests/test_tls.py 2025-10-22 15:56:30.000000000 +0800 @@ -1620,7 +1620,7 @@ certificate = load_pem_x509_certificates(fp.read())[0] with patch("aioquic.tls.utcnow") as mock_utcnow: - mock_utcnow.return_value = certificate.not_valid_before_utc + mock_utcnow.return_value = certificate.not_valid_before # fail with self.assertRaises(tls.AlertBadCertificate) as cm: @@ -1642,7 +1642,7 @@ ) with patch("aioquic.tls.utcnow") as mock_utcnow: - mock_utcnow.return_value = certificate.not_valid_before_utc + mock_utcnow.return_value = certificate.not_valid_before # fail with self.assertRaises(tls.AlertBadCertificate) as cm: @@ -1671,7 +1671,7 @@ #  too early with patch("aioquic.tls.utcnow") as mock_utcnow: mock_utcnow.return_value = ( - certificate.not_valid_before_utc - datetime.timedelta(seconds=1) + certificate.not_valid_before - datetime.timedelta(seconds=1) ) with self.assertRaises(tls.AlertCertificateExpired) as cm: verify_certificate( @@ -1681,7 +1681,7 @@ # valid with patch("aioquic.tls.utcnow") as mock_utcnow: - mock_utcnow.return_value = certificate.not_valid_before_utc + mock_utcnow.return_value = certificate.not_valid_before verify_certificate( cadata=cadata, certificate=certificate, server_name="example.com" ) @@ -1695,7 +1695,7 @@ # too late with patch("aioquic.tls.utcnow") as mock_utcnow: mock_utcnow.return_value = ( - certificate.not_valid_after_utc + datetime.timedelta(seconds=1) + certificate.not_valid_after + datetime.timedelta(seconds=1) ) with self.assertRaises(tls.AlertCertificateExpired) as cm: verify_certificate( @@ -1708,7 +1708,7 @@ cadata = certificate.public_bytes(serialization.Encoding.PEM) with patch("aioquic.tls.utcnow") as mock_utcnow: - mock_utcnow.return_value = certificate.not_valid_before_utc + mock_utcnow.return_value = certificate.not_valid_before # certificates with no SubjectAltName are rejected with self.assertRaises(tls.AlertBadCertificate) as cm: @@ -1727,7 +1727,7 @@ cadata = certificate.public_bytes(serialization.Encoding.PEM) with patch("aioquic.tls.utcnow") as mock_utcnow: - mock_utcnow.return_value = certificate.not_valid_before_utc + mock_utcnow.return_value = certificate.not_valid_before # valid verify_certificate( @@ -1757,7 +1757,7 @@ cadata = certificate.public_bytes(serialization.Encoding.PEM) with patch("aioquic.tls.utcnow") as mock_utcnow: - mock_utcnow.return_value = certificate.not_valid_before_utc + mock_utcnow.return_value = certificate.not_valid_before # valid verify_certificate(