pydantic: bump to >=2,<3

Signed-off-by: William Woodruff <[email protected]>

pyproject.toml

@@ -30,7 +30,7 @@ dependencies = [
   "cryptography >= 39",
   "id >= 1.0.0",
   "importlib_resources ~= 5.7; python_version < '3.11'",
-  "pydantic ~= 1.10",
+  "pydantic >= 2,< 3",
   "pyjwt >= 2.1",
   "pyOpenSSL >= 23.0.0",
   "requests",

sigstore/_internal/fulcio/client.py

@@ -43,7 +43,7 @@
     SignedCertificateTimestamp,
     Version,
 )
-from pydantic import BaseModel, Field, validator
+from pydantic import BaseModel, ConfigDict, Field, validator
 
 from sigstore._utils import B64Str
 from sigstore.oidc import IdentityToken
@@ -96,15 +96,17 @@ class DetachedFulcioSCT(BaseModel):
     Represents a "detached" SignedCertificateTimestamp from Fulcio.
     """
 
+    model_config = ConfigDict(populate_by_name=True, arbitrary_types_allowed=True)
+
     version: Version = Field(..., alias="sct_version")
     log_id: bytes = Field(..., alias="id")
     timestamp: datetime.datetime
     digitally_signed: bytes = Field(..., alias="signature")
     extension_bytes: bytes = Field(..., alias="extensions")
 
-    class Config:
-        allow_population_by_field_name = True
-        arbitrary_types_allowed = True
+    @validator("timestamp")
+    def _validate_timestamp(cls, v: datetime.datetime) -> datetime.datetime:
+        return v.replace(tzinfo=datetime.timezone.utc)
 
     @validator("digitally_signed", pre=True)
     def _validate_digitally_signed(cls, v: bytes) -> bytes:

sigstore/transparency.py

@@ -21,7 +21,14 @@
 from dataclasses import dataclass
 from typing import Any, Dict, List, Optional
 
-from pydantic import BaseModel, Field, StrictInt, StrictStr, validator
+from pydantic import (
+    BaseModel,
+    ConfigDict,
+    Field,
+    StrictInt,
+    StrictStr,
+    validator,
+)
 from securesystemslib.formats import encode_canonical
 
 from sigstore._utils import B64Str
@@ -136,15 +143,14 @@ class LogInclusionProof(BaseModel):
     Represents an inclusion proof for a transparency log entry.
     """
 
+    model_config = ConfigDict(populate_by_name=True)
+
     checkpoint: StrictStr = Field(..., alias="checkpoint")
     hashes: List[StrictStr] = Field(..., alias="hashes")
     log_index: StrictInt = Field(..., alias="logIndex")
     root_hash: StrictStr = Field(..., alias="rootHash")
     tree_size: StrictInt = Field(..., alias="treeSize")
 
-    class Config:
-        allow_population_by_field_name = True
-
     @validator("log_index")
     def _log_index_positive(cls, v: int) -> int:
         if v < 0:

sigstore/verify/models.py

@@ -371,6 +371,7 @@ def rekor_entry(self, client: RekorClient) -> LogEntry:
         #    we *opportunistically* use the offline Rekor entry,
         #    so long as it contains an inclusion proof. If it doesn't
         #    contain an inclusion proof, then we do an online entry lookup.
+        # TODO: Check for checkpoint here?
         offline = self._offline
         has_rekor_entry = self.has_rekor_entry
         has_inclusion_proof = (

sigstore/verify/verifier.py

@@ -35,6 +35,7 @@
     X509StoreContext,
     X509StoreContextError,
 )
+from pydantic import ConfigDict
 
 from sigstore._internal.merkle import (
     InvalidInclusionProofError,
@@ -88,14 +89,13 @@ class CertificateVerificationFailure(VerificationFailure):
     verification failures, with additional exception context.
     """
 
+    # Needed for the `exception` field above, since exceptions are
+    # not trivially serializable.
+    model_config = ConfigDict(arbitrary_types_allowed=True)
+
     reason: str = "Failed to verify signing certificate"
     exception: Exception
 
-    class Config:
-        # Needed for the `exception` field above, since exceptions are
-        # not trivially serializable.
-        arbitrary_types_allowed = True
-
 
 class Verifier:
     """

test/unit/internal/fulcio/test_client.py

@@ -14,7 +14,7 @@
 
 import json
 from base64 import b64encode
-from datetime import datetime
+from datetime import datetime, timezone
 
 import pytest
 from cryptography.hazmat.primitives import hashes
@@ -53,7 +53,7 @@ def test_fulcio_sct_virtual_subclass(self):
 
     def test_fields(self):
         blob = enc(b"this is a base64-encoded blob")
-        now = datetime.now()
+        now = datetime.now(tz=timezone.utc)
         sct = client.DetachedFulcioSCT(
             version=0,
             log_id=blob,
@@ -102,7 +102,8 @@ def test_constructor_equivalence(self):
     @pytest.mark.parametrize("version", [-1, 1, 2, 3])
     def test_invalid_version(self, version):
         with pytest.raises(
-            ValidationError, match="value is not a valid enumeration member"
+            ValidationError,
+            match=r"1 validation error for DetachedFulcioSCT.*",
         ):
             client.DetachedFulcioSCT(
                 version=version,