formachines / errata

Errata / PyPI / cryptography

PUBLIC_KEY_TYPES removed in cryptography 50.0.2

In our sandbox runs up to 2026-10-27, gemini-3.8-flash and gpt-6.1-sol wrote from cryptography.hazmat.primitives.asymmetric.types import PUBLIC_KEY_TYPES for cryptography. It fails on 50.0.2 with ImportError (changed between 46.0.6 and 50.0.2). Use from cryptography.hazmat.primitives.asymmetric.types import PublicKeyTypes instead.

What to do
replace the line
Output
same on one example
Patch
incomplete: old names remain
Auto-apply
not allowed
Seen in
2 models
Worked / failed
6 / 0
Last verified
2026-10-27

What to do

Not for automatic application — after the patch the example still uses PUBLIC_KEY_TYPES, which the verified example does not: the patch covers part of the change. Show this correction to the user as a lead. Replace the old line with the new one; the rest of the code can stay.

Automatic application: not allowed — the patch gives incomplete when applied word for word. Automatic application is allowed only when proof.equivalent is true and proof.applicability.status is applies; otherwise show the correction to the user as a lead and do not apply it on your own. The change itself is described by kind (removed); the checks are in proof; neither follows from the other.

How to tell this applies to your code

Old and new code

from cryptography.hazmat.primitives.asymmetric.types import PUBLIC_KEY_TYPES
from cryptography.hazmat.primitives.asymmetric.types import PublicKeyTypes

Error on 50.0.2:

ImportError: cannot import name 'PUBLIC_KEY_TYPES' from 'cryptography.hazmat.primitives.asymmetric.types' (/usr/local/lib/python3.11/site-packages/cryptography/hazmat/primitives/asymmetric/types.py)
Sandbox proof
Scriptcryptography versionResult
Code the models wrote46.0.6works
Code the models wrote50.0.2fails: ImportError
Verified example below50.0.2works
Output of the verified example50.0.2same as the original's on 46.0.6 (observed stdout of one example; not a proof of equivalent behaviour)
Patch applied word for word to the example50.0.2applied word for word, the patch leaves old names in use: it covers part of the change — after the patch the example still uses PUBLIC_KEY_TYPES, which the verified example does not: the patch covers part of the change

Verified example for cryptography 50.0.2

from cryptography.hazmat.primitives.asymmetric import (
    dh,
    dsa,
    ec,
    ed448,
    ed25519,
    rsa,
    x448,
    x25519,
)
from cryptography.hazmat.primitives.asymmetric.types import PublicKeyTypes


def describe_public_key(key: PublicKeyTypes) -> str:
    """Return a short human-readable label describing a public key."""
    if isinstance(key, rsa.RSAPublicKey):
        return f"RSA-{key.key_size}"
    elif isinstance(key, ec.EllipticCurvePublicKey):
        return f"EC-{key.curve.name}"
    elif isinstance(key, ed25519.Ed25519PublicKey):
        return "Ed25519"
    elif isinstance(key, ed448.Ed448PublicKey):
        return "Ed448"
    elif isinstance(key, x25519.X25519PublicKey):
        return "X25519"
    elif isinstance(key, x448.X448PublicKey):
        return "X448"
    elif isinstance(key, dsa.DSAPublicKey):
        return f"DSA-{key.key_size}"
    elif isinstance(key, dh.DHPublicKey):
        return f"DH-{key.key_size}"
    else:
        raise TypeError(f"Unsupported key type: {type(key).__name__}")


def main() -> None:
    # 1. RSA key pair
    rsa_private = rsa.generate_private_key(public_exponent=65537, key_size=2048)
    rsa_public = rsa_private.public_key()
    print("RSA Public Key:    ", describe_public_key(rsa_public))

    # 2. Elliptic Curve (EC) key pair
    ec_private = ec.generate_private_key(ec.SECP256R1())
    ec_public = ec_private.public_key()
    print("EC Public Key:     ", describe_public_key(ec_public))

    # 3. Ed25519 key pair
    ed25519_private = ed25519.Ed25519PrivateKey.generate()
    ed25519_public = ed25519_private.public_key()
    print("Ed25519 Public Key:", describe_public_key(ed25519_public))


if __name__ == "__main__":
    main()

Source

Removed the deprecated ``PUBLIC_KEY_TYPES``, ``PRIVATE_KEY_TYPES``, ``CERTIFICATE_PRIVATE_KEY_TYPES``, ``CERTIFICATE_ISSUER_PUBLIC_KEY_TYPES``, and ``CERTIFICATE_PUBLIC_KEY_TYPES`` type aliases.

Release notes · Seen in: gemini-3.8-flash, gpt-6.1-sol · First seen 2026-10-20 · Last verified 2026-10-27 · All corrections for cryptography

For agents