dev-python/trustme: Backport AKI patch & enable py3.13

Signed-off-by: Michał Górny <mgorny@gentoo.org>

dev-python/trustme/files/trustme-1.1.0-aki.patch

@@ -0,0 +1,96 @@
+From 84e347d9221e304f0158330e5101d23969d424d0 Mon Sep 17 00:00:00 2001
+From: Illia Volochii <illia.volochii@gmail.com>
+Date: Wed, 27 Mar 2024 11:45:41 +0000
+Subject: [PATCH 1/3] Add AKI to child CA certificates
+
+---
+ src/trustme/__init__.py | 14 +++++++++++---
+ tests/test_trustme.py   |  5 +++++
+ 2 files changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/src/trustme/__init__.py b/src/trustme/__init__.py
+index 5fb24fb..0db1bb0 100644
+--- a/src/trustme/__init__.py
++++ b/src/trustme/__init__.py
+@@ -250,14 +250,22 @@ def __init__(
+             sign_key = parent_cert._private_key
+             parent_certificate = parent_cert._certificate
+             issuer = parent_certificate.subject
+-
+-        self._certificate = (
++            ski_ext = parent_certificate.extensions.get_extension_for_class(
++                x509.SubjectKeyIdentifier)
++            aki = x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(ski_ext.value)
++        else:
++            aki = None
++        cert_builder = (
+             _cert_builder_common(name, issuer, self._private_key.public_key())
+             .add_extension(
+                 x509.BasicConstraints(ca=True, path_length=path_length),
+                 critical=True,
+             )
+-            .add_extension(
++        )
++        if aki:
++            cert_builder = cert_builder.add_extension(aki, critical=False)
++        self._certificate = (
++            cert_builder.add_extension(
+                 x509.KeyUsage(
+                     digital_signature=True,  # OCSP
+                     content_commitment=False,
+diff --git a/tests/test_trustme.py b/tests/test_trustme.py
+index 1d901ad..581716e 100644
+--- a/tests/test_trustme.py
++++ b/tests/test_trustme.py
+@@ -200,6 +200,11 @@ def test_intermediate() -> None:
+     assert_is_ca(child_ca_cert)
+     assert child_ca_cert.issuer == ca_cert.subject
+     assert _path_length(child_ca_cert) == 8
++    aki = child_ca_cert.extensions.get_extension_for_class(x509.AuthorityKeyIdentifier)
++    assert aki.critical is False
++    expected_aki_key_id = ca_cert.extensions.get_extension_for_class(
++        x509.SubjectKeyIdentifier).value.digest
++    assert aki.value.key_identifier == expected_aki_key_id
+ 
+     child_server = child_ca.issue_cert("test-host.example.org")
+     assert len(child_server.cert_chain_pems) == 2
+
+From f507a28e0f4d97d63716aa5a81669bb747235f07 Mon Sep 17 00:00:00 2001
+From: Illia Volochii <illia.volochii@gmail.com>
+Date: Wed, 27 Mar 2024 12:02:59 +0000
+Subject: [PATCH 2/3] Fix a typing issue
+
+---
+ src/trustme/__init__.py | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/trustme/__init__.py b/src/trustme/__init__.py
+index 0db1bb0..d126180 100644
+--- a/src/trustme/__init__.py
++++ b/src/trustme/__init__.py
+@@ -246,6 +246,7 @@ def __init__(
+         )
+         issuer = name
+         sign_key = self._private_key
++        aki: Optional[x509.AuthorityKeyIdentifier]
+         if parent_cert is not None:
+             sign_key = parent_cert._private_key
+             parent_certificate = parent_cert._certificate
+
+From cdd2fd61aae9c92f902932bacd6b39189ecde4b1 Mon Sep 17 00:00:00 2001
+From: Illia Volochii <illia.volochii@gmail.com>
+Date: Wed, 27 Mar 2024 12:09:38 +0000
+Subject: [PATCH 3/3] Add a news entry
+
+---
+ newsfragments/642.bugfix.rst | 1 +
+ 1 file changed, 1 insertion(+)
+ create mode 100644 newsfragments/642.bugfix.rst
+
+diff --git a/newsfragments/642.bugfix.rst b/newsfragments/642.bugfix.rst
+new file mode 100644
+index 0000000..9d75e7a
+--- /dev/null
++++ b/newsfragments/642.bugfix.rst
+@@ -0,0 +1 @@
++Add the Authority Key Identifier extension to child CA certificates.

dev-python/trustme/trustme-1.1.0-r1.ebuild

@@ -0,0 +1,43 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{10..13} pypy3 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="#1 quality TLS certs while you wait, for the discerning tester"
+HOMEPAGE="
+	https://github.com/python-trio/trustme/
+	https://pypi.org/project/trustme/
+"
+
+LICENSE="|| ( Apache-2.0 MIT )"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~ppc-macos ~x64-macos ~x64-solaris"
+
+RDEPEND="
+	>=dev-python/cryptography-3.1[${PYTHON_USEDEP}]
+	>=dev-python/idna-2.0[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	test? (
+		dev-python/pyopenssl[${PYTHON_USEDEP}]
+		dev-python/service-identity[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests pytest
+
+PATCHES=(
+	# https://github.com/python-trio/trustme/pull/642
+	# (also fixes py3.13)
+	"${FILESDIR}/${P}-aki.patch"
+)
+
+python_test() {
+	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
+	epytest
+}