chore(deps): Bump signxml from 3.2.2 to 4.0.3

[dependabot]

Bumps signxml from 3.2.2 to 4.0.3.

Release notes

Sourced from signxml's releases.

v4.0.0

• Replace PyOpenSSL with Cryptography (#260)

  - This is a major infrastructure change that replaces core
    certificate parsing, key processing, signature validation, and
    certificate chain validation functions previously provided by
    PyOpenSSL with those provided by Cryptography. Care was taken to
    preserve the exisitng API, including exception types, but many
    error messages raised in various error conditions have changed. If
    you see unexpected behavior and you have reason to believe it is
    incorrect, please file an issue.
  
  Breaking change: the ca_path parameter, previously used to specify
  
  CA certificate stores, is no longer supported. Use the ca_pem_file
  
  parameter instead.
  
  

• Raise error when invalid certificate string is passed as input to signer

• Fix public key matching for ECDSA (#245)

Changelog

Sourced from signxml's changelog.

Changes for v4.0.0 (2024-08-21)

• Replace PyOpenSSL with Cryptography (#260)

  • This is a major infrastructure change that replaces core certificate parsing, key processing, signature validation, and certificate chain validation functions previously provided by PyOpenSSL with those provided by Cryptography. Care was taken to preserve the exisitng API, including exception types, but many error messages raised in various error conditions have changed. If you see unexpected behavior and you have reason to believe it is incorrect, please file an issue.

  • Breaking change: the ca_path parameter, previously used to specify CA certificate stores, is no longer supported. Use the ca_pem_file parameter instead.

• Raise error when invalid certificate string is passed as input to signer

• Fix public key matching for ECDSA (#245)

Commits

• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 87.72%. Comparing base (7ed6b21) to head (3b8f2c9).
Report is 3 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop     #736      +/-   ##
===========================================
+ Coverage    87.67%   87.72%   +0.04%     
===========================================
  Files           38       38              
  Lines         3149     3145       -4     
  Branches       386      385       -1     
===========================================
- Hits          2761     2759       -2     
+ Misses         246      245       -1     
+ Partials       142      141       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[jtrobles-cdd]

@svillegas-cdd The changelog of signxml warns of major changes in version 4.0.0. Pay special attention to that, please.

[svillegas-cdd]

The changelog of signxml warns of major changes in version 4.0.0. Pay special attention to that, please.

@jtrobles-cdd Yes, one of he changes was the removal of PyOpenSsl

So I replacced the use of certs crypto_utils._X509CertOpenSsl to crypto_utils.X509Cert and convert them to this type if needed.

Most of the test changes involved exception messages, except for the test_fail_replaced_cert, which now triggers a different exception type. The new error is:

  ValueError(
                'Invalid input.',
                'DER encoded key value does not match specified signature algorithm',
            )

instead of the previous XmlSignatureInvalid

I’m unsure if this new error is the expected behavior for the use case being tested.

[jtrobles-cdd]

⚠️ Partial review

[jtrobles-cdd]

The changelog of signxml warns of major changes in version 4.0.0. Pay special attention to that, please.

@jtrobles-cdd Yes, one of he changes was the removal of PyOpenSsl

So I replacced the use of certs crypto_utils._X509CertOpenSsl to crypto_utils.X509Cert and convert them to this type if needed.

Most of the test changes involved exception messages, except for the test_fail_replaced_cert, which now triggers a different exception type. The new error is:

  ValueError(
                'Invalid input.',
                'DER encoded key value does not match specified signature algorithm',
            )

instead of the previous XmlSignatureInvalid

I’m unsure if this new error is the expected behavior for the use case being tested.

We need to take a closer look at that test and also at test_fail_included_cert_not_from_a_known_ca.

[svillegas-cdd]

@jtrobles-cdd I updated the xml file for the test test_fail_replaced_cert now it raises the expected error

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud