DeprecationWarning: verify() from OpenSSL.crypto is deprecated

[David-Ongaro]

Since a while (I didn't pinpoint the exact version though) I always see this warning, just by importing the signxml module:

[...]/site-packages/signxml/verifier.py:13: DeprecationWarning: verify() is deprecated. Use the equivalent APIs in cryptography.
    from OpenSSL.crypto import verify as openssl_verify

I looked into it briefly, and it seems the 'equivalent APIs in cryptography' are not a drop-in replacement, so the fix may not be trivial. I found an example at pyca/cryptography#7939 how the OpenSSL.crypto.verify function is used which may or may not be relevant, but I suppose you guys are much more knowledgeable to evaluate how a possible fix should look like.

[kislyuk]

See #141

[kislyuk]

The issue you linked in cryptography is the issue that I opened to track #141.

[David-Ongaro]

The issue you linked in cryptography is the issue that I opened to track #141.

Wow, this issue is open since 2019. But what is more bewildering is that the replacement API in cryptography is still to be released but the OpenSSL guys went ahead already deprecating their API.

[kislyuk]

Maintaining and safely providing open source software for cryptography is hard work. You are welcome to contribute time or money to the development of relevant APIs in cryptography or in this package. Cryptography does not accept donations directly, but SignXML does.

As I mentioned in #141, APIs to support this in cryptography are scheduled to be released with the next major release, v43.

[David-Ongaro]

Maintaining and safely providing open source software for cryptography is hard work. You are welcome to contribute time or money to the development of relevant APIs in cryptography or in this package. Cryptography does not accept donations directly, but SignXML does.

I'd like to help, but spending time on transitive dependencies is a bit too much. As for SignXML: as mentioned, I tried to look for a fix, but now you're basically confirming that the openssl people deprecated their API too early, and there is not much else we can do but wait.