switch reasons to frozenset
diff --git a/docs/x509.rst b/docs/x509.rst
index f9992e2..86673e3 100644
--- a/docs/x509.rst
+++ b/docs/x509.rst
@@ -835,7 +835,7 @@
.. attribute:: reasons
- :type: list of :class:`ReasonFlags` or None
+ :type: frozenset of :class:`ReasonFlags` or None
The reasons a given distribution point may be used for when performing
revocation checks.
diff --git a/src/cryptography/x509.py b/src/cryptography/x509.py
index cee0cc3..dfc0af8 100644
--- a/src/cryptography/x509.py
+++ b/src/cryptography/x509.py
@@ -536,10 +536,10 @@
"crl_issuer must be None or a list of general names"
)
- if reasons and not all(
+ if reasons and (not isinstance(reasons, frozenset) or not all(
isinstance(x, ReasonFlags) for x in reasons
- ):
- raise TypeError("reasons must be None or list of ReasonFlags")
+ )):
+ raise TypeError("reasons must be None or frozenset of ReasonFlags")
if reasons and (
ReasonFlags.unspecified in reasons or
diff --git a/tests/test_x509_ext.py b/tests/test_x509_ext.py
index e0858c7..a18a443 100644
--- a/tests/test_x509_ext.py
+++ b/tests/test_x509_ext.py
@@ -1342,7 +1342,16 @@
x509.DistributionPoint(
[x509.UniformResourceIdentifier(u"http://crypt.og/crl")],
None,
- ["notreasonflags"],
+ frozenset(["notreasonflags"]),
+ None
+ )
+
+ def test_reason_not_frozenset(self):
+ with pytest.raises(TypeError):
+ x509.DistributionPoint(
+ [x509.UniformResourceIdentifier(u"http://crypt.og/crl")],
+ None,
+ [x509.ReasonFlags.ca_compromise],
None
)
@@ -1351,7 +1360,7 @@
x509.DistributionPoint(
[x509.UniformResourceIdentifier(u"http://crypt.og/crl")],
None,
- [x509.ReasonFlags.unspecified],
+ frozenset([x509.ReasonFlags.unspecified]),
None
)
@@ -1359,7 +1368,7 @@
x509.DistributionPoint(
[x509.UniformResourceIdentifier(u"http://crypt.og/crl")],
None,
- [x509.ReasonFlags.remove_from_crl],
+ frozenset([x509.ReasonFlags.remove_from_crl]),
None
)
@@ -1368,7 +1377,7 @@
x509.DistributionPoint(
None,
None,
- [x509.ReasonFlags.aa_compromise],
+ frozenset([x509.ReasonFlags.aa_compromise]),
None
)
@@ -1376,7 +1385,7 @@
dp = x509.DistributionPoint(
[x509.UniformResourceIdentifier(u"http://crypt.og/crl")],
None,
- [x509.ReasonFlags.superseded],
+ frozenset([x509.ReasonFlags.superseded]),
[
x509.DirectoryName(
x509.Name([
@@ -1390,7 +1399,7 @@
dp2 = x509.DistributionPoint(
[x509.UniformResourceIdentifier(u"http://crypt.og/crl")],
None,
- [x509.ReasonFlags.superseded],
+ frozenset([x509.ReasonFlags.superseded]),
[
x509.DirectoryName(
x509.Name([
@@ -1407,9 +1416,7 @@
dp = x509.DistributionPoint(
[x509.UniformResourceIdentifier(u"http://crypt.og/crl")],
None,
- [
- x509.ReasonFlags.superseded,
- ],
+ frozenset([x509.ReasonFlags.superseded]),
[
x509.DirectoryName(
x509.Name([
@@ -1435,10 +1442,10 @@
x509.Name([
x509.NameAttribute(x509.OID_COMMON_NAME, "myCN")
]),
- [
+ frozenset([
x509.ReasonFlags.key_compromise,
x509.ReasonFlags.ca_compromise,
- ],
+ ]),
[
x509.DirectoryName(
x509.Name([
@@ -1452,10 +1459,11 @@
assert repr(dp) == (
"<DistributionPoint(full_name=None, relative_name=<Name([<NameAtt"
"ribute(oid=<ObjectIdentifier(oid=2.5.4.3, name=commonName)>, val"
- "ue='myCN')>])>, reasons=[<ReasonFlags.key_compromise: 'keyCompro"
- "mise'>, <ReasonFlags.ca_compromise: 'cACompromise'>], crl_issuer"
- "=[<DirectoryName(value=<Name([<NameAttribute(oid=<ObjectIdentifi"
- "er(oid=2.5.4.3, name=commonName)>, value='Important CA')>])>)>])>"
+ "ue='myCN')>])>, reasons=frozenset([<ReasonFlags.key_compromise: "
+ "'keyCompromise'>, <ReasonFlags.ca_compromise: 'cACompromise'>]),"
+ " crl_issuer=[<DirectoryName(value=<Name([<NameAttribute(oid=<Obj"
+ "ectIdentifier(oid=2.5.4.3, name=commonName)>, value='Important C"
+ "A')>])>)>])>"
)
@@ -1475,10 +1483,10 @@
x509.DistributionPoint(
[x509.UniformResourceIdentifier(u"ftp://domain")],
None,
- [
+ frozenset([
x509.ReasonFlags.key_compromise,
x509.ReasonFlags.ca_compromise,
- ],
+ ]),
None
),
])
@@ -1493,10 +1501,10 @@
x509.DistributionPoint(
[x509.UniformResourceIdentifier(u"ftp://domain")],
None,
- [
+ frozenset([
x509.ReasonFlags.key_compromise,
x509.ReasonFlags.ca_compromise,
- ],
+ ]),
None
),
]
@@ -1506,18 +1514,18 @@
x509.DistributionPoint(
[x509.UniformResourceIdentifier(u"ftp://domain")],
None,
- [
+ frozenset([
x509.ReasonFlags.key_compromise,
x509.ReasonFlags.ca_compromise,
- ],
+ ]),
None
),
])
assert repr(cdp) == (
"<CRLDistributionPoints([<DistributionPoint(full_name=[<UniformRes"
"ourceIdentifier(value=ftp://domain)>], relative_name=None, reason"
- "s=[<ReasonFlags.key_compromise: 'keyCompromise'>, <ReasonFlags.ca"
- "_compromise: 'cACompromise'>], crl_issuer=None)>])>"
+ "s=frozenset([<ReasonFlags.key_compromise: 'keyCompromise'>, <Reas"
+ "onFlags.ca_compromise: 'cACompromise'>]), crl_issuer=None)>])>"
)
def test_eq(self):
@@ -1525,10 +1533,10 @@
x509.DistributionPoint(
[x509.UniformResourceIdentifier(u"ftp://domain")],
None,
- [
+ frozenset([
x509.ReasonFlags.key_compromise,
x509.ReasonFlags.ca_compromise,
- ],
+ ]),
[x509.UniformResourceIdentifier(u"uri://thing")],
),
])
@@ -1536,10 +1544,10 @@
x509.DistributionPoint(
[x509.UniformResourceIdentifier(u"ftp://domain")],
None,
- [
+ frozenset([
x509.ReasonFlags.key_compromise,
x509.ReasonFlags.ca_compromise,
- ],
+ ]),
[x509.UniformResourceIdentifier(u"uri://thing")],
),
])
@@ -1550,10 +1558,10 @@
x509.DistributionPoint(
[x509.UniformResourceIdentifier(u"ftp://domain")],
None,
- [
+ frozenset([
x509.ReasonFlags.key_compromise,
x509.ReasonFlags.ca_compromise,
- ],
+ ]),
[x509.UniformResourceIdentifier(u"uri://thing")],
),
])
@@ -1561,10 +1569,10 @@
x509.DistributionPoint(
[x509.UniformResourceIdentifier(u"ftp://domain2")],
None,
- [
+ frozenset([
x509.ReasonFlags.key_compromise,
x509.ReasonFlags.ca_compromise,
- ],
+ ]),
[x509.UniformResourceIdentifier(u"uri://thing")],
),
])
@@ -1572,9 +1580,7 @@
x509.DistributionPoint(
[x509.UniformResourceIdentifier(u"ftp://domain")],
None,
- [
- x509.ReasonFlags.key_compromise,
- ],
+ frozenset([x509.ReasonFlags.key_compromise]),
[x509.UniformResourceIdentifier(u"uri://thing")],
),
])
@@ -1582,10 +1588,10 @@
x509.DistributionPoint(
[x509.UniformResourceIdentifier(u"ftp://domain")],
None,
- [
+ frozenset([
x509.ReasonFlags.key_compromise,
x509.ReasonFlags.ca_compromise,
- ],
+ ]),
[x509.UniformResourceIdentifier(u"uri://thing2")],
),
])