ipalib.x509.IPACertificate can't subclass cryptography.x509.Certificate - FreeIPA-devel - Fedora mailing-lists

19 Mar 2025


      I am using FreeIPA 4.12.2 with python3-cryptography 44.0.1 on Python 3.12.8.
The ipa-client-install command fails on me, and I have tracked down the reason.
A simple way to reproduce:
...
...
...
import ipalib.x509
..... gives a warning about TripleDES which is unrelated
.....  File "/usr/lib/python3.12/site-packages/ipalib/ipalib/x509.py", line 91, in <module>
    class IPACertificate(crypto_x509.Certificate):
(warning) TypeError: type 'cryptography.hazmat.bindings._rust.x509.Certificate' is not an acceptable base type
The reason is that the class cryptography.x509.Certificate is not meant to be instantiated from the python side.
To demonstrate:
...
...
...
from cryptography.x509 import Certificate
c = Certificate()
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
TypeError: No constructor defined for Certificate
...
...
...
from cryptography.x509 import Certificate
class X(Certificate):
...     pass
... 
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
TypeError: type 'cryptography.hazmat.bindings._rust.x509.Certificate' is not an acceptable base type
To fix this, IPACertificate would need to be rewritten to use composition instead of inheritance.
So my questions:
Am I missing something?
Which version of FreeIPA is known to work with what version of python3-cryptography?
Thanks, Wolfgang