Merge branch 'pyca:main' into pkcs12-java-truststore

Author: crbednarz

.github/actions/fetch-vectors/action.yml

@@ -16,5 +16,5 @@ runs:
       with:
         repository: "C2SP/x509-limbo"
         path: "x509-limbo"
-        # Latest commit on the x509-limbo main branch, as of Jan 29, 2025.
-        ref: "ec604cf2b1eebe22c6ffc40e380517c6d49c78cc" # x509-limbo-ref
+        # Latest commit on the x509-limbo main branch, as of Feb 11, 2025.
+        ref: "c3f77b91a0c8b1103dd9b8f646892e0281dd3ff0" # x509-limbo-ref

.github/requirements/build-requirements.txt

@@ -73,28 +73,28 @@ flit-core==3.10.1 \
     --hash=sha256:66e5b87874a0d6e39691f0e22f09306736b633548670ad3c09ec9db03c5662f7 \
     --hash=sha256:cb31a76e8b31ad3351bb89e531f64ef2b05d1e65bd939183250bf81ddf4922a8
     # via -r build-requirements.in
-maturin==1.8.1 \
-    --hash=sha256:0f4407c7353c31bfbb8cdeb82bc2170e474cbfb97b5ba27568f440c9d6c1fdd4 \
-    --hash=sha256:49cd964aabf59f8b0a6969f9860d2cdf194ac331529caae14c884f5659568857 \
-    --hash=sha256:621e171c6b39f95f1d0df69a118416034fbd59c0f89dcaea8c2ea62019deecba \
-    --hash=sha256:7e590a23d9076b8a994f2e67bc63dc9a2d1c9a41b1e7b45ac354ba8275254e89 \
-    --hash=sha256:8d8251a95682c83ea60988c804b620c181911cd824aa107b4a49ac5333c92968 \
-    --hash=sha256:98f638739a5132962347871b85c91f525c9246ef4d99796ae98a2031e3df029f \
-    --hash=sha256:a526f90fe0e5cb59ffb81f4ff547ddc42e823bbdeae4a31012c0893ca6dcaf46 \
-    --hash=sha256:b9fc1a4354cac5e32c190410208039812ea88c4a36bd2b6499268ec49ef5de00 \
-    --hash=sha256:c08767d794de8f8a11c5c8b1b47a4ff9fb6ae2d2d97679e27030f2f509c8c2a0 \
-    --hash=sha256:d678407713f3e10df33c5b3d7a343ec0551eb7f14d8ad9ba6febeb96f4e4c75c \
-    --hash=sha256:e95f077fd2ddd2f048182880eed458c308571a534be3eb2add4d3dac55bf57f4 \
-    --hash=sha256:ec49cd70cad3c389946c6e2bc0bd50772a7fcb463040dd800720345897eec9bf \
-    --hash=sha256:f9f5c47521924b6e515cbc652a042fe5f17f8747445be9d931048e5d8ddb50a4
+maturin==1.8.2 \
+    --hash=sha256:05e3a2aa9611afa5e1205dfa1434607f9d8e223d613a8a7c85540a159af688c0 \
+    --hash=sha256:174cb81c573c4a74be96b4e4469ac84e543cff75850fe2728a8eebb5f4d7b613 \
+    --hash=sha256:4232c2380faf61862d27269c6acf14e1d542c4ba64086a3f5c356d6e5e4823e7 \
+    --hash=sha256:4a62268975f98885a04ae9f0df875b304e4f8c1f0d989e8a7ab18e42793126ee \
+    --hash=sha256:5e624f73cb7fbfd8042e8c5cc5c11f58bede23a7931ea3ea9839812f5bd362fc \
+    --hash=sha256:638c66616f9b10060197c48d9e1eedf444d975699d9cd829138e69014554cda7 \
+    --hash=sha256:63ff7f612da90a26838a9c03aa8a80bab8b4e26f63e3df6ddb0e818394eb0aeb \
+    --hash=sha256:b408093e49d6d4ab98066eefd0fac64b01eb7af639e9b3151660c5fa96ce147c \
+    --hash=sha256:b6b29811013056f46a1e0b7f26907ae080028be65102d4fb23fbdf86847fffbd \
+    --hash=sha256:c2001b5c57e0dbf5992be56b93ffa897d4bcd0d6ca3de448e381b621225d4d87 \
+    --hash=sha256:c91504b4f05b07d0a9fb47c2a2a39c074328b6bc8f252190240e431f5f7ea8d7 \
+    --hash=sha256:e015a5534aefb568b96a9cc7bc58995b1d90b5e2a44455d79e4f073a88cb0c83 \
+    --hash=sha256:e31abc70f6f93285d6e63d2f4459c079c94c259dd757370482d2d4ceb9ec1fa0
     # via -r build-requirements.in
 pycparser==2.22 ; platform_python_implementation != 'PyPy' \
     --hash=sha256:491c8be9c040f5390f5bf44a5b07752bd07f56edf992381b05c701439eec10f6 \
     --hash=sha256:c3702b6d3dd8c7abc1afa565d7e63d53a1d0bd86cdc24edd75470f4de499cfcc
     # via cffi
-setuptools==73.0.1 \
-    --hash=sha256:b208925fcb9f7af924ed2dc04708ea89791e24bde0d3020b27df0e116088b34e \
-    --hash=sha256:d59a3e788ab7e012ab2c4baed1b376da6366883ee20d7a5fc426816e3d7b1193
+setuptools==75.8.0 \
+    --hash=sha256:c5afc8f407c626b8313a86e10311dd3f661c6cd9c09d4bf8c15c0e11f9f2b0e6 \
+    --hash=sha256:e3982f444617239225d675215d51f6ba05f845d4eec313da4418fdbb56fb27e3
     # via -r build-requirements.in
 tomli==2.2.1 ; python_full_version < '3.11' \
     --hash=sha256:023aa114dd824ade0100497eb2318602af309e5a55595f76b626d6d9f3b7b0a6 \

.github/requirements/uv-requirements.txt

@@ -1,20 +1,21 @@
 # This file was autogenerated by uv via the following command:
-#    uv pip compile --universal -p 3.8 --generate-hashes -
-uv==0.5.15 \
-    --hash=sha256:0a3f5d7218a258be53bd2152bb2eb7305f81dff0542f5a1614458bc9f3a1a87b \
-    --hash=sha256:1a0f7523d34daec3727bbd8d7c7a53fd9b22d77329a4849f21c38ee94124d061 \
-    --hash=sha256:1b9f9e8f4bdfffcfcc0368c4b9464651a5b428287b91d130d0c8291df64f2846 \
-    --hash=sha256:2a967e063457966c17fd599d8e53c05376d32d056665350cdc5c56f7af0f3eea \
-    --hash=sha256:39f3df251ae17ed80ff4ce500797b54321c1d4384d2faf5cf46bca3af0c5b9c2 \
-    --hash=sha256:3ceb25de833b81077b4b17158c192c05416a09521ff96c79879e04842c4cad4e \
-    --hash=sha256:5605cba0162f1f97ed60ad9eed8919ef733af8326e38380d06323f265bef15de \
-    --hash=sha256:95ce9db23b9d3492d3b8d6a8fc8093820f39440a6319e9baf50f4b362bc6c9bb \
-    --hash=sha256:a31f8c833121952ca9d9a1edc64ba88810231547beff611e448c1ce813df595a \
-    --hash=sha256:a7bfee425b251b7ac7794262c075d9784850a5315f70a4a62182e1eb4d74dddc \
-    --hash=sha256:b255cb912247f165a2479a342293afa51a30c7c2f025163ecdbaabb238383379 \
-    --hash=sha256:b624ea5eef977b922a08f23fbd9a476b62fdbe7f54ca3f8dedf82cd4b330ed73 \
-    --hash=sha256:c93be8ab085be9d175c2daa21eff16c6117e4725fbcfc9c2734ec03ec5e5e2aa \
-    --hash=sha256:cdfa8200a50c3bff4fb9be7833c8c66da7bc714f7e2d6f2ea9aa4e29a4425192 \
-    --hash=sha256:d08d47b66ee65adba37727b65278e1c8a9009f172cedcfa4b8d4cf3aca48e39b \
-    --hash=sha256:de7494e2d86893fb8f36005a66d009c151bd548d437405a7d3e257585b89df30 \
-    --hash=sha256:e7e3aefb6c7101ba5567138d0fe81834e78d1f74158e11b44867a598fa667df3
+#    uv pip compile --universal -p 3.8 --generate-hashes - -o uv-requirements.txt
+uv==0.5.29 \
+    --hash=sha256:02ceda14892816f7db3d7d1a4a69b299817b54749036af1125ec73d8f570b52a \
+    --hash=sha256:05b6c8132b4054a83596aa0d85720649c6c8029188ea03f014c4bcfa77003c74 \
+    --hash=sha256:0e4fc5cc036afdccd8b539f826e8c4bac7acf51436c6216e81895ce5532141ac \
+    --hash=sha256:1631bd3269149501e851d2120a77c32430709540d44e24c9e82de1fe5ee71057 \
+    --hash=sha256:25e7f1850a71846b52aa8ed58640aa2082e16bc84995e8ff438e4bb916968159 \
+    --hash=sha256:25f12457e0898313aed2705effb53118af542bd9825a4de2214a324ddd9bf8d7 \
+    --hash=sha256:345f14af3944b67f1622b080fc037fa1276f921b1a8ffbe19d4c5b5e9a19a3b0 \
+    --hash=sha256:49f1bb38033ca49bb73cc33de06eff537b8a25cd201a29a4a4c2559535356907 \
+    --hash=sha256:6fbd1354d15fadff723b1eed171dab917dffa81091c12d5aedd6ff87b72f95df \
+    --hash=sha256:8fe93da5e7a087607396f905bf7d704e9a2073245a357871484c9281dc969be9 \
+    --hash=sha256:9f5fc05f3848e16a90fc9cebe2897d3d4de42f8cf2ec312b4efef45a520d54e9 \
+    --hash=sha256:aeb4a5698d1f09e8eab2495f77fc5fba25876b749d2dbef2f9e196f2471f86ba \
+    --hash=sha256:b307438a5e2df313a9ea5446d6e5af99a9b57a363fc5e68a434ef2d89cde083b \
+    --hash=sha256:ba16016199938f44b16ee74941bb7d95eb8e84301db7c7aad9d1f4861bb10b1c \
+    --hash=sha256:d19ecc416fc069fbf767b2fd022789b2d93832b8d45702e34daf714dea1e5851 \
+    --hash=sha256:e5165111121acb6b4924b0b2e740115706fb9ecfd3335def7c5afa8cce307996 \
+    --hash=sha256:e8a5e18487c33a0c29867da123ef0f035ee1ba880640fcbf8743ca80d7158ed0 \
+    --hash=sha256:ea6b05abfc025cb42ec27c9c8ac738909b1229e271b421f0c339eecc61df13a6

.github/workflows/ci.yml

@@ -26,26 +26,26 @@ jobs:
         PYTHON:
           - {VERSION: "3.12", NOXSESSION: "flake"}
           - {VERSION: "3.12", NOXSESSION: "rust"}
-          - {VERSION: "3.12", NOXSESSION: "docs", OPENSSL: {TYPE: "openssl", VERSION: "3.4.0"}}
+          - {VERSION: "3.12", NOXSESSION: "docs", OPENSSL: {TYPE: "openssl", VERSION: "3.4.1"}}
           - {VERSION: "3.13", NOXSESSION: "tests"}
           - {VERSION: "3.14-dev", NOXSESSION: "tests"}
           - {VERSION: "pypy-3.10", NOXSESSION: "tests-nocoverage"}
-          - {VERSION: "3.12", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "3.0.15"}}
-          - {VERSION: "3.12", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "3.1.7"}}
-          - {VERSION: "3.12", NOXSESSION: "tests-ssh", OPENSSL: {TYPE: "openssl", VERSION: "3.2.3"}}
-          - {VERSION: "3.12", NOXSESSION: "tests-ssh", OPENSSL: {TYPE: "openssl", VERSION: "3.3.2"}}
-          - {VERSION: "3.12", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "3.2.3", CONFIG_FLAGS: "no-engine no-rc2 no-srtp no-ct no-psk"}}
-          - {VERSION: "3.12", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "3.2.3", CONFIG_FLAGS: "no-legacy", NO_LEGACY: "1"}}
-          - {VERSION: "3.12", NOXSESSION: "tests", NOXARGS: "--enable-fips=1", OPENSSL: {TYPE: "openssl", CONFIG_FLAGS: "enable-fips", VERSION: "3.1.7"}}
-          - {VERSION: "3.12", NOXSESSION: "tests", NOXARGS: "--enable-fips=1", OPENSSL: {TYPE: "openssl", CONFIG_FLAGS: "enable-fips", VERSION: "3.2.3"}}
-          - {VERSION: "3.12", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "3.4.0"}}
+          - {VERSION: "3.12", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "3.0.16"}}
+          - {VERSION: "3.12", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "3.1.8"}}
+          - {VERSION: "3.12", NOXSESSION: "tests-ssh", OPENSSL: {TYPE: "openssl", VERSION: "3.2.4"}}
+          - {VERSION: "3.12", NOXSESSION: "tests-ssh", OPENSSL: {TYPE: "openssl", VERSION: "3.3.3"}}
+          - {VERSION: "3.12", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "3.2.4", CONFIG_FLAGS: "no-engine no-rc2 no-srtp no-ct no-psk"}}
+          - {VERSION: "3.12", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "3.2.4", CONFIG_FLAGS: "no-legacy", NO_LEGACY: "1"}}
+          - {VERSION: "3.12", NOXSESSION: "tests", NOXARGS: "--enable-fips=1", OPENSSL: {TYPE: "openssl", CONFIG_FLAGS: "enable-fips", VERSION: "3.1.8"}}
+          - {VERSION: "3.12", NOXSESSION: "tests", NOXARGS: "--enable-fips=1", OPENSSL: {TYPE: "openssl", CONFIG_FLAGS: "enable-fips", VERSION: "3.2.4"}}
+          - {VERSION: "3.12", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "3.4.1"}}
           - {VERSION: "3.12", NOXSESSION: "rust,tests", OPENSSL: {TYPE: "libressl", VERSION: "3.9.2"}}
           - {VERSION: "3.12", NOXSESSION: "rust,tests", OPENSSL: {TYPE: "libressl", VERSION: "4.0.0"}}
           - {VERSION: "3.12", NOXSESSION: "tests-randomorder"}
-          # Latest commit on the BoringSSL main branch, as of Jan 30, 2025.
-          - {VERSION: "3.12", NOXSESSION: "rust,tests", OPENSSL: {TYPE: "boringssl", VERSION: "2b19cd39ba3adcba04640dfb840666ec1874afcc"}}
-          # Latest commit on the OpenSSL master branch, as of Feb 01, 2025.
-          - {VERSION: "3.12", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "12baad7ed47fce8977929cec4eafa0912bab8756"}}
+          # Latest commit on the BoringSSL main branch, as of Feb 13, 2025.
+          - {VERSION: "3.12", NOXSESSION: "rust,tests", OPENSSL: {TYPE: "boringssl", VERSION: "285228fdfb93c0a11c4f2f219fbf3ec0b1481872"}}
+          # Latest commit on the OpenSSL master branch, as of Feb 13, 2025.
+          - {VERSION: "3.12", NOXSESSION: "tests", OPENSSL: {TYPE: "openssl", VERSION: "6f3ada8a14233e76d8c809659b81bddaa7be6db8"}}
           # Builds with various Rust versions. Includes MSRV and next
           # potential future MSRV.
           # - 1.70: crates.io sparse protocol by default
@@ -172,6 +172,8 @@ jobs:
 
           - {IMAGE: "ubuntu-rolling:aarch64", NOXSESSION: "tests", RUNNER: "ubuntu-24.04-arm"}
           - {IMAGE: "alpine:aarch64", NOXSESSION: "tests", RUNNER: "ubuntu-24.04-arm"}
+
+          - {IMAGE: "ubuntu-rolling:armv7l", NOXSESSION: "tests", RUNNER: "ubuntu-24.04-arm"}
     timeout-minutes: 15
     env:
       RUSTUP_HOME: /root/.rustup

.github/workflows/wheel-builder.yml

@@ -78,6 +78,8 @@ jobs:
           - { NAME: "manylinux_2_28_aarch64", CONTAINER: "cryptography-manylinux_2_28:aarch64", RUNNER: "ubuntu-24.04-arm" }
           - { NAME: "manylinux_2_34_aarch64", CONTAINER: "cryptography-manylinux_2_34:aarch64", RUNNER: "ubuntu-24.04-arm" }
           - { NAME: "musllinux_1_2_aarch64", CONTAINER: "cryptography-musllinux_1_2:aarch64", RUNNER: "ubuntu-24.04-arm" }
+
+          - { NAME: "manylinux_2_31_armv7l", CONTAINER: "cryptography-manylinux_2_31:armv7l", RUNNER: "ubuntu-24.04-arm" }
         exclude:
           # There are no readily available musllinux PyPy distributions
           - PYTHON: { VERSION: "pp310-pypy310_pp73" }
@@ -90,6 +92,10 @@ jobs:
             MANYLINUX: { NAME: "manylinux2014_x86_64", CONTAINER: "cryptography-manylinux2014:x86_64", RUNNER: "ubuntu-latest"}
           - PYTHON: { VERSION: "pp310-pypy310_pp73" }
             MANYLINUX: { NAME: "manylinux2014_aarch64", CONTAINER: "cryptography-manylinux2014_aarch64", RUNNER: "ubuntu-24.04-arm" }
+
+          # No PyPy on armv7l either
+          - PYTHON: { VERSION: "pp310-pypy310_pp73" }
+            MANYLINUX: { NAME: "manylinux_2_31_armv7l", CONTAINER: "cryptography-manylinux_2_31:armv7l", RUNNER: "ubuntu-24.04-arm" }
     name: "${{ matrix.PYTHON.VERSION }} for ${{ matrix.MANYLINUX.NAME }}"
     steps:
       - name: Ridiculous-er workaround for static node20
@@ -201,7 +207,7 @@ jobs:
           sparse-checkout-cone-mode: false
       - name: Setup python
         run: |
-          curl "$PYTHON_DOWNLOAD_URL" -o python.pkg
+          curl --max-time 30 --retry 5 "$PYTHON_DOWNLOAD_URL" -o python.pkg
           sudo installer -pkg python.pkg -target /
         env:
           PYTHON_DOWNLOAD_URL: ${{ matrix.PYTHON.DOWNLOAD_URL }}

CHANGELOG.rst

@@ -27,6 +27,15 @@ Changelog
   repeated :meth:`~cryptography.hazmat.primitives.hashes.XOFHash.squeeze`
   operations on extendable output functions.
 
+.. _v44-0-1:
+
+44.0.1 - 2025-02-11
+~~~~~~~~~~~~~~~~~~~
+
+* Updated Windows, macOS, and Linux wheels to be compiled with OpenSSL 3.4.1.
+* We now build ``armv7l`` ``manylinux`` wheels and publish them to PyPI.
+* We now build ``manylinux_2_34`` wheels and publish them to PyPI.
+
 .. _v44-0-0:
 
 44.0.0 - 2024-11-27

Cargo.lock

@@ -45,7 +45,7 @@ coverage==7.2.7 ; python_full_version < '3.8'
     # via pytest-cov
 coverage==7.6.1 ; python_full_version == '3.8.*'
     # via pytest-cov
-coverage==7.6.10 ; python_full_version >= '3.9'
+coverage==7.6.12 ; python_full_version >= '3.9'
     # via pytest-cov
 distlib==0.3.9
     # via virtualenv
@@ -113,15 +113,17 @@ markupsafe==3.0.2 ; python_full_version >= '3.9'
     # via jinja2
 mypy==1.4.1 ; python_full_version < '3.8'
     # via cryptography (pyproject.toml)
-mypy==1.14.1 ; python_full_version >= '3.8'
+mypy==1.15.0 ; python_full_version == '3.8.*'
+    # via cryptography (pyproject.toml)
+mypy==1.15.0 ; python_full_version >= '3.9'
     # via cryptography (pyproject.toml)
 mypy-extensions==1.0.0
     # via mypy
 nh3==0.2.20 ; python_full_version >= '3.8'
     # via readme-renderer
 nox==2024.4.15 ; python_full_version < '3.8'
     # via cryptography (pyproject.toml)
-nox==2024.10.9 ; python_full_version >= '3.8'
+nox==2025.2.9 ; python_full_version >= '3.8'
     # via cryptography (pyproject.toml)
 packaging==24.0 ; python_full_version < '3.8'
     # via
@@ -197,7 +199,7 @@ pytest-xdist==3.5.0 ; python_full_version < '3.8'
     # via cryptography (pyproject.toml)
 pytest-xdist==3.6.1 ; python_full_version >= '3.8'
     # via cryptography (pyproject.toml)
-pytz==2024.2 ; python_full_version < '3.9'
+pytz==2025.1 ; python_full_version < '3.9'
     # via babel
 readme-renderer==37.3 ; python_full_version < '3.8'
     # via cryptography (pyproject.toml)
@@ -211,7 +213,7 @@ requests==2.32.3 ; python_full_version >= '3.8'
     # via
     #   sphinx
     #   sphinxcontrib-spelling
-ruff==0.9.4
+ruff==0.9.6
     # via cryptography (pyproject.toml)
 six==1.17.0 ; python_full_version < '3.8'
     # via bleach
@@ -310,11 +312,11 @@ urllib3==2.2.3 ; python_full_version == '3.8.*'
     # via requests
 urllib3==2.3.0 ; python_full_version >= '3.9'
     # via requests
-uv==0.5.26 ; python_full_version >= '3.8'
+uv==0.5.31 ; python_full_version >= '3.8'
     # via nox
 virtualenv==20.26.6 ; python_full_version < '3.8'
     # via nox
-virtualenv==20.29.1 ; python_full_version >= '3.8'
+virtualenv==20.29.2 ; python_full_version >= '3.8'
     # via nox
 webencodings==0.5.1 ; python_full_version < '3.8'
     # via bleach

ci-constraints-requirements.txt

@@ -47,6 +47,26 @@ Asymmetric ciphers
 * RSA OAEP with custom label from the `BoringSSL evp tests`_.
 * Ed448 test vectors from :rfc:`8032`.
 * Deterministic ECDSA (:rfc:`6979`) from `OpenSSL's RFC 6979 test vectors`_.
+* ``asymmetric/PKCS8/rsa-40bitrc2.pem`` a PKCS8 encoded RSA key from GnuTLS
+  encrypted with ``pbeWithSHAAnd40BitRC2-CBC``. The password is ``baz``.
+* ``asymmetric/PKCS8/rsa-rc2-cbc.pem`` a PKCS8 encoded RSA key from GnuTLS
+  encrypted with ``RC2-CBC``. The password is ``Red Hat Enterprise Linux 7.4``.
+* ``asymmetric/PKCS8/rsa_pkcs8_pbes2_pbkdf2_2048_3des_sha224.pem`` a PKCS8
+  encoded RSA key from Mbed-TLS using ``sha224`` as the PRF for PBKDF2.
+  The password is ``PolarSSLTest``.
+* ``asymmetric/PKCS8/rsa_pkcs8_pbes2_pbkdf2_2048_3des_sha384.pem`` a PKCS8
+  encoded RSA key from Mbed-TLS using ``sha384`` as the PRF for PBKDF2.
+  The password is ``PolarSSLTest``.
+* ``asymmetric/PKCS8/rsa_pkcs8_pbes2_pbkdf2_2048_3des_sha512.pem`` a PKCS8
+  encoded RSA key from Mbed-TLS using ``sha512`` as the PRF for PBKDF2.
+  The password is ``PolarSSLTest``.
+* ``asymmetric/PKCS8/rsa-aes-192-cbc.pem`` a PKCS8 encoded RSA key from Mbed-TLS
+  encrypted with ``AES-192-CBC``. The password is ``PolarSSLTest``.
+* ``asymmetric/PKCS8/ed25519-scrypt.pem`` a PKCS8 encoded Ed25519 key from
+  RustCrypto using scrypt as the KDF. The password is ``hunter42``.
+* ``asymmetric/PKCS8/rsa-rc2-cbc-effective-key-length.pem`` a PKCS8 encoded key
+  encrypted with ``RC2-CBC`` with the ``effectiveKeyLength`` parameter set to
+  258. This is an invalid key.
 
 
 Custom asymmetric vectors
@@ -601,6 +621,8 @@ Custom X.509 Vectors
 * ``admissions_extension_authority_not_provided.pem`` - A certificate containing
   the ``Admissions`` extension with no admissions and no admission authority,
   signed by ``x509/custom/ca/rsa_ca.pem`` CA.
+* ``no_sans.pem`` - Leaf certificate issued by ``x509/custom/ca/rsa_ca.pem``
+  with no SAN extension.
 
 Custom X.509 Request Vectors
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~

docs/development/test-vectors.rst

@@ -221,7 +221,8 @@ Using passwords with Fernet
 
 It is possible to use passwords with Fernet. To do this, you need to run the
 password through a key derivation function such as
-:class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC`, bcrypt or
+:class:`~cryptography.hazmat.primitives.kdf.pbkdf2.PBKDF2HMAC`,
+:class:`~cryptography.hazmat.primitives.kdf.argon2.Argon2id` or
 :class:`~cryptography.hazmat.primitives.kdf.scrypt.Scrypt`.
 
 .. doctest::

docs/fernet.rst

@@ -30,6 +30,7 @@ operating systems.
 * x86-64 macOS 13 Ventura and ARM64 macOS 14 Sonoma
 * x86-64 Ubuntu 20.04, 22.04, 24.04, rolling
 * ARM64 Ubuntu rolling
+* ARMv7l Ubuntu rolling
 * x86-64 Debian Bullseye (11.x), Bookworm (12.x), Trixie (13.x), and
   Sid (unstable)
 * x86-64 and ARM64 Alpine (latest)

docs/installation.rst

@@ -84,6 +84,7 @@ kibibytes
 Koblitz
 Lange
 logins
+Mbed
 metadata
 MGF
 Monterey
@@ -120,6 +121,7 @@ pytest
 relicensed
 responder
 runtime
+RustCrypto
 Schneier
 scrypt
 serializer
@@ -136,6 +138,7 @@ testability
 Thawte
 timestamp
 timestamps
+TLS
 toolchain
 totient
 Trixie