oracle / oracle/oci-python-sdk

Deprecation message for httpsig_cffi component

Open
#187 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
474
Forks
321
Avg merge
23m
Merged PRs (30d)
4

Description

I am currently testing the python-oci-sdk and oci-cli packages which I created for openSUSE.

During the tests, I ran into a warning which seems to indicate that httpsig_cffi which oci-sdk uses makes use of deprecated APIs:

/usr/lib/python3.7/site-packages/httpsig_cffi/sign.py:60: CryptographyDeprecationWarning: signer and verifier have been deprecated. Please use sign and verify instead.
  r = self._rsa_private.signer(padding.PKCS1v15(), self._rsahash())

Since httpsig_cffi hasn't been updated upstream since 2015, it might be a good idea to use a replacement instead before the API breaks altogether.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at httpsig_cffi/sign.py:60 and trace how the OCI Python SDK invokes its signing code while reproducing the warning from the openSUSE python-oci-sdk or oci-cli tests. Determine the supported replacement for the deprecated signer API and verify that the warning is gone without breaking request signing.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.