4 files changed, 148 insertions, 2 deletions
diff --git a/dev-python/trustme/Manifest b/dev-python/trustme/Manifest
index 46e27bdb3570..40c109293e6e 100644
--- a/dev-python/trustme/Manifest
+++ b/dev-python/trustme/Manifest
@@ -1,3 +1,5 @@
+AUX trustme-1.1.0-aki.patch 3621 BLAKE2B 1fda17f424373b5554ca36c91882608be9c33dbea23cb6f4c0457033cf5931a0ae071c37f15f3193e0d806d3f569c02e93dc1bd3eae3b198a1d51de00782f419 SHA512 e666c27b62cee678d9b2f1e22f283ce21a79839682a79d1a654b0b3f6d4a88e30f4511eb8f8099e7a84adfa139451002e4bc228911a3e9c21deaebacc6a299a6
 DIST trustme-1.1.0.tar.gz 29611 BLAKE2B 71210845c3bb919b731ab14db72376aa701c547c4b062e4dab9ccbb6b97c3416cb48b92a998aa26c85720b38514998e62005dd310513fc80a54502432ee4000b SHA512 f0ad39ffd9f4074107c90258738412ff8ca8ed1b4138e38edc6edad9a5cb8787a53a47fa78b12eba189774902ee3728961feed54b3b5e944e4737749912627b2
-EBUILD trustme-1.1.0.ebuild 784 BLAKE2B 5af78110b5f8b9666db7c62e4139bd96dec8014eb4a34224b30961c3f659f7068ef8259bdff218f5f3ca86c0e09cdd0b4a00354c50a428d5372722dee7285524 SHA512 974ed9ef388c0fbd0c478929194022e33630471d81556180bb4b7dd99927759776db6b8227578cff430ad6ac4016290cbb4f94deff4ecc1718b377d1dbb78be5
+EBUILD trustme-1.1.0-r1.ebuild 979 BLAKE2B 7f33088589b1b03689d093012f298f47c3d8d827cc625a681023791df56f9a5b4c68c708d0ee3b081a69cd29d171fb08610ebef67db796e75749144453f2de4c SHA512 e46a8667096e34c43ab9fca4d3d2c734fcdd92724e4a03ca71c1011d0f9da99be056409e36528c9005bf01a38905c88181100b86a6038b5a21200cbda24d56bb
+EBUILD trustme-1.1.0.ebuild 855 BLAKE2B a1ac9ed15f9d81866f6548776c6d8111d9f995c48acffbd70bf76dd6ca268de5f222d931f749247c3ed8a35a65d2510e291410c17231147cae3f50ce7517283e SHA512 952b984c5294faef42c41f210a05d4297dceddc29e28bad0fd693cf2d4cc2eab8e6ff7d7195d8db6884ea9015dd760c364ded86bbce0f34d2dc75ab66e8e6917
 MISC metadata.xml 503 BLAKE2B f9759fc8612b385d57ad6734f363b0d03a7a354c4486ebe98ee855c35d0ca11d54be27cb78b21b56178350bc5520908d2efa8345ecb060fc87bc784303325f2d SHA512 477a6d3a46f72e9a813c04102556742545798868dc526376f90dcc43cfd7675479271f5b0cc4a718e35c74e663a3f99db939202e771f2ff731adf871b161df00
diff --git a/dev-python/trustme/files/trustme-1.1.0-aki.patch b/dev-python/trustme/files/trustme-1.1.0-aki.patch
new file mode 100644
index 000000000000..a00fc85229a9
--- /dev/null
+++ b/dev-python/trustme/files/trustme-1.1.0-aki.patch
@@ -0,0 +1,96 @@
+From 84e347d9221e304f0158330e5101d23969d424d0 Mon Sep 17 00:00:00 2001
+From: Illia Volochii <illia.volochii@gmail.com>
+Date: Wed, 27 Mar 2024 11:45:41 +0000
+Subject: [PATCH 1/3] Add AKI to child CA certificates
+
+---
+ src/trustme/__init__.py | 14 +++++++++++---
+ tests/test_trustme.py   |  5 +++++
+ 2 files changed, 16 insertions(+), 3 deletions(-)
+
+diff --git a/src/trustme/__init__.py b/src/trustme/__init__.py
+index 5fb24fb..0db1bb0 100644
+--- a/src/trustme/__init__.py
++++ b/src/trustme/__init__.py
+@@ -250,14 +250,22 @@ def __init__(
+             sign_key = parent_cert._private_key
+             parent_certificate = parent_cert._certificate
+             issuer = parent_certificate.subject
+-
+-        self._certificate = (
++            ski_ext = parent_certificate.extensions.get_extension_for_class(
++                x509.SubjectKeyIdentifier)
++            aki = x509.AuthorityKeyIdentifier.from_issuer_subject_key_identifier(ski_ext.value)
++        else:
++            aki = None
++        cert_builder = (
+             _cert_builder_common(name, issuer, self._private_key.public_key())
+             .add_extension(
+                 x509.BasicConstraints(ca=True, path_length=path_length),
+                 critical=True,
+             )
+-            .add_extension(
++        )
++        if aki:
++            cert_builder = cert_builder.add_extension(aki, critical=False)
++        self._certificate = (
++            cert_builder.add_extension(
+                 x509.KeyUsage(
+                     digital_signature=True,  # OCSP
+                     content_commitment=False,
+diff --git a/tests/test_trustme.py b/tests/test_trustme.py
+index 1d901ad..581716e 100644
+--- a/tests/test_trustme.py
++++ b/tests/test_trustme.py
+@@ -200,6 +200,11 @@ def test_intermediate() -> None:
+     assert_is_ca(child_ca_cert)
+     assert child_ca_cert.issuer == ca_cert.subject
+     assert _path_length(child_ca_cert) == 8
++    aki = child_ca_cert.extensions.get_extension_for_class(x509.AuthorityKeyIdentifier)
++    assert aki.critical is False
++    expected_aki_key_id = ca_cert.extensions.get_extension_for_class(
++        x509.SubjectKeyIdentifier).value.digest
++    assert aki.value.key_identifier == expected_aki_key_id
+ 
+     child_server = child_ca.issue_cert("test-host.example.org")
+     assert len(child_server.cert_chain_pems) == 2
+
+From f507a28e0f4d97d63716aa5a81669bb747235f07 Mon Sep 17 00:00:00 2001
+From: Illia Volochii <illia.volochii@gmail.com>
+Date: Wed, 27 Mar 2024 12:02:59 +0000
+Subject: [PATCH 2/3] Fix a typing issue
+
+---
+ src/trustme/__init__.py | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/trustme/__init__.py b/src/trustme/__init__.py
+index 0db1bb0..d126180 100644
+--- a/src/trustme/__init__.py
++++ b/src/trustme/__init__.py
+@@ -246,6 +246,7 @@ def __init__(
+         )
+         issuer = name
+         sign_key = self._private_key
++        aki: Optional[x509.AuthorityKeyIdentifier]
+         if parent_cert is not None:
+             sign_key = parent_cert._private_key
+             parent_certificate = parent_cert._certificate
+
+From cdd2fd61aae9c92f902932bacd6b39189ecde4b1 Mon Sep 17 00:00:00 2001
+From: Illia Volochii <illia.volochii@gmail.com>
+Date: Wed, 27 Mar 2024 12:09:38 +0000
+Subject: [PATCH 3/3] Add a news entry
+
+---
+ newsfragments/642.bugfix.rst | 1 +
+ 1 file changed, 1 insertion(+)
+ create mode 100644 newsfragments/642.bugfix.rst
+
+diff --git a/newsfragments/642.bugfix.rst b/newsfragments/642.bugfix.rst
+new file mode 100644
+index 0000000..9d75e7a
+--- /dev/null
++++ b/newsfragments/642.bugfix.rst
+@@ -0,0 +1 @@
++Add the Authority Key Identifier extension to child CA certificates.
diff --git a/dev-python/trustme/trustme-1.1.0-r1.ebuild b/dev-python/trustme/trustme-1.1.0-r1.ebuild
new file mode 100644
index 000000000000..cb4c7173252e
--- /dev/null
+++ b/dev-python/trustme/trustme-1.1.0-r1.ebuild
@@ -0,0 +1,43 @@
+# Copyright 1999-2024 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+DISTUTILS_USE_PEP517=setuptools
+PYTHON_COMPAT=( python3_{10..13} pypy3 )
+
+inherit distutils-r1 pypi
+
+DESCRIPTION="#1 quality TLS certs while you wait, for the discerning tester"
+HOMEPAGE="
+	https://github.com/python-trio/trustme/
+	https://pypi.org/project/trustme/
+"
+
+LICENSE="|| ( Apache-2.0 MIT )"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~ppc-macos ~x64-macos ~x64-solaris"
+
+RDEPEND="
+	>=dev-python/cryptography-3.1[${PYTHON_USEDEP}]
+	>=dev-python/idna-2.0[${PYTHON_USEDEP}]
+"
+BDEPEND="
+	test? (
+		dev-python/pyopenssl[${PYTHON_USEDEP}]
+		dev-python/service-identity[${PYTHON_USEDEP}]
+	)
+"
+
+distutils_enable_tests pytest
+
+PATCHES=(
+	# https://github.com/python-trio/trustme/pull/642
+	# (also fixes py3.13)
+	"${FILESDIR}/${P}-aki.patch"
+)
+
+python_test() {
+	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
+	epytest
+}
diff --git a/dev-python/trustme/trustme-1.1.0.ebuild b/dev-python/trustme/trustme-1.1.0.ebuild
index 5e7472ed3ef0..53841a6c202c 100644
--- a/dev-python/trustme/trustme-1.1.0.ebuild
+++ b/dev-python/trustme/trustme-1.1.0.ebuild
@@ -1,4 +1,4 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2024 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -30,3 +30,8 @@ BDEPEND="
 "
 
 distutils_enable_tests pytest
+
+python_test() {
+	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
+	epytest
+}