Backport mypy fixes for release (#12930)

* mypy cleanups for Python 3.8 (#12928)

should unblock #12927

* fix typing on release.py with older python (#12929)

* fix(x509): use backward compatible syntax for types (#12927)

* fix(x509): use backward compatible syntax for types

* add Python 3.8 flake to ci

* Backport mypy fixes for release

* sigh

* sigh

---------

Co-authored-by: Ivan Shcheklein <[email protected]>

Author: alex

.github/workflows/ci.yml

@@ -24,6 +24,7 @@ jobs:
       fail-fast: false
       matrix:
         PYTHON:
+          - {VERSION: "3.8", NOXSESSION: "flake"}
           - {VERSION: "3.13", NOXSESSION: "flake"}
           - {VERSION: "3.13", NOXSESSION: "rust"}
           - {VERSION: "3.12", NOXSESSION: "docs", OPENSSL: {TYPE: "openssl", VERSION: "3.5.0"}}

CHANGELOG.rst

@@ -1,6 +1,13 @@
 Changelog
 =========
 
+.. _v45-0-2:
+
+45.0.2 - 2025-05-17
+~~~~~~~~~~~~~~~~~~~
+
+* Fixed using ``mypy`` with ``cryptography`` on older versions of Python.
+
 .. _v45-0-1:
 
 45.0.1 - 2025-05-17

noxfile.py

@@ -15,10 +15,10 @@
 
 import nox
 
-try:
+if sys.version_info >= (3, 11):
     import tomllib
-except ImportError:
-    import tomli as tomllib  # type: ignore[import-not-found,no-redef]
+else:
+    import tomli as tomllib
 
 nox.options.reuse_existing_virtualenvs = True
 nox.options.default_venv_backend = "uv|virtualenv"

pyproject.toml

@@ -15,7 +15,7 @@ build-backend = "maturin"
 
 [project]
 name = "cryptography"
-version = "45.0.1"
+version = "45.0.2"
 authors = [
     { name = "The Python Cryptographic Authority and individual contributors", email = "[email protected]" },
 ]
@@ -65,7 +65,7 @@ ssh = ["bcrypt >=3.1.5"]
 # All the following are used for our own testing.
 nox = ["nox >=2024.04.15", "nox[uv] >=2024.03.02; python_version >= '3.8'"]
 test = [
-    "cryptography_vectors==45.0.1",
+    "cryptography_vectors==45.0.2",
     "pytest >=7.4.0",
     "pytest-benchmark >=4.0",
     "pytest-cov >=2.10.1",

release.py

@@ -5,11 +5,16 @@
 import pathlib
 import re
 import subprocess
+import sys
 
 import click
-import tomllib
 from packaging.version import Version
 
+if sys.version_info >= (3, 11):
+    import tomllib
+else:
+    import tomli as tomllib
+
 
 def run(*args: str) -> None:
     print(f"[running] {list(args)}")

src/cryptography/__about__.py

@@ -10,7 +10,7 @@
     "__version__",
 ]
 
-__version__ = "45.0.1"
+__version__ = "45.0.2"
 
 
 __author__ = "The Python Cryptographic Authority and individual contributors"

src/cryptography/hazmat/bindings/_rust/x509.pyi

@@ -229,7 +229,9 @@ class Criticality:
     AGNOSTIC: Criticality
     NON_CRITICAL: Criticality
 
-type MaybeExtensionValidatorCallback[T: x509.ExtensionType] = typing.Callable[
+T = typing.TypeVar("T", contravariant=True, bound=x509.ExtensionType)
+
+MaybeExtensionValidatorCallback = typing.Callable[
     [
         Policy,
         x509.Certificate,
@@ -238,12 +240,10 @@ type MaybeExtensionValidatorCallback[T: x509.ExtensionType] = typing.Callable[
     None,
 ]
 
-type PresentExtensionValidatorCallback[T: x509.ExtensionType] = (
-    typing.Callable[
-        [Policy, x509.Certificate, T],
-        None,
-    ]
-)
+PresentExtensionValidatorCallback = typing.Callable[
+    [Policy, x509.Certificate, T],
+    None,
+]
 
 class ExtensionPolicy:
     @staticmethod
@@ -255,13 +255,13 @@ class ExtensionPolicy:
     def require_not_present(
         self, extension_type: type[x509.ExtensionType]
     ) -> ExtensionPolicy: ...
-    def may_be_present[T: x509.ExtensionType](
+    def may_be_present(
         self,
         extension_type: type[T],
         criticality: Criticality,
         validator: MaybeExtensionValidatorCallback[T] | None,
     ) -> ExtensionPolicy: ...
-    def require_present[T: x509.ExtensionType](
+    def require_present(
         self,
         extension_type: type[T],
         criticality: Criticality,

src/cryptography/hazmat/primitives/serialization/ssh.py

@@ -616,7 +616,7 @@ def load_public(
         _, data = load_application(data)
         return public_key, data
 
-    def get_public(self, data: memoryview) -> typing.Never:
+    def get_public(self, data: memoryview) -> typing.NoReturn:
         # Confusingly `get_public` is an entry point used by private key
         # loading.
         raise UnsupportedAlgorithm(
@@ -642,7 +642,7 @@ def load_public(
         _, data = load_application(data)
         return public_key, data
 
-    def get_public(self, data: memoryview) -> typing.Never:
+    def get_public(self, data: memoryview) -> typing.NoReturn:
         # Confusingly `get_public` is an entry point used by private key
         # loading.
         raise UnsupportedAlgorithm(
@@ -716,10 +716,7 @@ def load_ssh_private_key(
     pubfields, pubdata = kformat.get_public(pubdata)
     _check_empty(pubdata)
 
-    if (ciphername, kdfname) != (
-        _NONE,
-        _NONE,
-    ):  # type: ignore[comparison-overlap]
+    if ciphername != _NONE or kdfname != _NONE:
         ciphername_bytes = ciphername.tobytes()
         if ciphername_bytes not in _SSH_CIPHERS:
             raise UnsupportedAlgorithm(

tests/x509/verification/test_limbo.py

@@ -2,6 +2,8 @@
 # 2.0, and the BSD License. See the LICENSE file in the root of this repository
 # for complete details.
 
+from __future__ import annotations
+
 import datetime
 import ipaddress
 import json

vectors/cryptography_vectors/__about__.py

@@ -6,4 +6,4 @@
     "__version__",
 ]
 
-__version__ = "45.0.1"
+__version__ = "45.0.2"