python312Packages.certomancer 0.11.0 -> 0.12.0

[djacu]

Description of changes

Bumped version to 0.12.0 and disabled 1 broken test.

Several tests are broken on Python 3.12 and there is an open issue to fix it.
MatthiasValvekens/certomancer#12

Things done

• Built on platform(s)
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• For non-Linux: Is sandboxing enabled in nix.conf? (See Nix manual)
  • sandbox = relaxed
  • sandbox = true
• Tested, as applicable:
  • NixOS test(s) (look inside nixos/tests)
  • and/or package tests
  • or, for functions and "core" functionality, tests in lib/tests or pkgs/test
  • made sure NixOS tests are linked to the relevant packages
• Tested compilation of all packages that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review rev HEAD". Note: all changes have to be committed, also see nixpkgs-review usage
• Tested basic functionality of all binary files (usually in ./result/bin/)
• 24.05 Release Notes (or backporting 23.05 and 23.11 Release notes)
  • (Package updates) Added a release notes entry if the change is major or breaking
  • (Module updates) Added a release notes entry if the change is significant
  • (Module addition) Added a release notes entry if adding a new NixOS module
• Fits CONTRIBUTING.md.

---

Add a 👍 reaction to pull requests you find important.

[fabaff]

Result of nixpkgs-review pr 304985 run on x86_64-linux 1

12 packages failed to build:

• maigret
• maigret.dist
• python311Packages.pyhanko
• python311Packages.pyhanko.dist
• python311Packages.xhtml2pdf
• python311Packages.xhtml2pdf.dist
• python312Packages.pyhanko
• python312Packages.pyhanko.dist
• python312Packages.xhtml2pdf
• python312Packages.xhtml2pdf.dist
• sasview
• sasview.dist

4 packages built:

• python311Packages.certomancer
• python311Packages.certomancer.dist
• python312Packages.certomancer
• python312Packages.certomancer.dist

[nixos-discourse]

This pull request has been mentioned on NixOS Discourse. There might be relevant details there:

https://discourse.nixos.org/t/prs-ready-for-review/3032/3850

[Moraxyc]

Result of nixpkgs-review pr 304985 run on x86_64-linux 1

12 packages failed to build:

• maigret
• maigret.dist
• python311Packages.pyhanko
• python311Packages.pyhanko.dist
• python311Packages.xhtml2pdf
• python311Packages.xhtml2pdf.dist
• python312Packages.pyhanko
• python312Packages.pyhanko.dist
• python312Packages.xhtml2pdf
• python312Packages.xhtml2pdf.dist
• sasview
• sasview.dist

4 packages built:

• python311Packages.certomancer
• python311Packages.certomancer.dist
• python312Packages.certomancer
• python312Packages.certomancer.dist

[risicle]

Hold on, what makes us think this is just "broken tests" on 3.12 and not breakage of the features behind them?

[Moraxyc]

After reviewing the changes upstream and related resources, I think we cannot take this issue lightly.

• ValueError: Hash algorithm not known for ed25519 MatthiasValvekens/certomancer#12
• hash_algo for Ed25519 and Ed448 should not expose internals wbond/asn1crypto#230
• Remove .hash_algo for EdDSA-based signature algorithms wbond/asn1crypto#265
• 418b5d9

asn1crypto removed .hash_algo for safety reasons, but there hasn’t been a release since that change. Consequently, the package in Nixpkgs has two versions of it. When we use Python 3.12, it includes an unstable version with the patch.

I believe a better approach is to disable the certomancer build on Python 3.12 until asn1crypto releases a new version and certomancer catches up.

Sorry for linking it to ZHF without sufficient consideration.

[GaetanLepage]

I opened #315532 and then discovered this PR.
It looks like it addresses most of the concerns raised above.
Feel free to either pick changes from it (and close it) or merge it directly.