{
 "action": "Not for automatic application — format removed: there is no replacement to apply. Show this correction to the user as a lead. X509Req is not available in pyopenssl 26.4.0; remove or replace this use. The same code works on pyopenssl 26.0.0: pin a version before 26.4.0 if you cannot change the code. Release notes: csr = x509.load_pem_x509_csr(data)",
 "alternatives": [],
 "applicability": {
  "method": "literal_patch",
  "reason": "format removed: there is no replacement to apply",
  "run_on": "26.4.0",
  "status": "not_applicable"
 },
 "by_notes": true,
 "changelog_ref": {
  "quote": "Removed deprecated ``OpenSSL.crypto.X509Req``, ``OpenSSL.crypto.dump_certificate_request``, and ``OpenSSL.crypto.load_certificate_request``. ``cryptography.x509`` should be used instead.",
  "url": "https://github.com/pyca/pyopenssl/blob/HEAD/CHANGELOG.rst"
 },
 "confirmations": {
  "failed": 0,
  "worked": 11
 },
 "detect": [
  "crypto.X509Req"
 ],
 "ecosystem": "pypi",
 "equivalence": "same",
 "error_kind": "missing_attr",
 "error_signature": {
  "message": "module 'OpenSSL.crypto' has no attribute 'X509Req'",
  "norm": "missing_attr:x509req",
  "type": "AttributeError"
 },
 "first_seen": "2026-10-23T05:42:51+00:00",
 "format": "removed",
 "format_version": 2,
 "id": "pypi/pyopenssl/26.4.0/0004",
 "kind": "removed",
 "license": "https://creativecommons.org/licenses/by/4.0/",
 "package": "pyopenssl",
 "proof": {
  "applicability": {
   "method": "literal_patch",
   "reason": "format removed: there is no replacement to apply",
   "run_on": "26.4.0",
   "status": "not_applicable"
  },
  "auto_apply": false,
  "auto_apply_reason": "the patch gives not_applicable when applied word for word",
  "auto_apply_rule": "Automatic application is allowed only when proof.equivalent is true and proof.applicability.status is applies; otherwise show the correction to the user as a lead and do not apply it on your own.",
  "equivalence": "same",
  "equivalent": true,
  "fails_on": "26.4.0",
  "fixed_on": "26.4.0",
  "level": "differential",
  "method": {
   "fix_on": "26.4.0",
   "name": "stdout_match",
   "normalization": "lines stripped, blank lines dropped, runs of whitespace collapsed; memory addresses, timestamps and temporary paths masked",
   "original_on": "26.0.0",
   "scope": "the observable stdout of one example script; return values, files, other inputs and exception types are not compared, so a match is not a proof of equivalent behaviour"
  },
  "script_right": "#!/usr/bin/env python3\nimport warnings\n\nfrom cryptography import x509\nfrom cryptography.hazmat.primitives import hashes, serialization\nfrom cryptography.x509.oid import NameOID\nfrom OpenSSL import crypto\n\n# X509Req APIs are deprecated in recent pyOpenSSL releases; silence the warnings.\nwarnings.filterwarnings(\"ignore\", category=DeprecationWarning)\n\nCSR_PATH = \"/tmp/request.csr\"\n\n\ndef generate_csr_file(path):\n    # Generate a 2048-bit RSA key\n    key = crypto.PKey()\n    key.generate_key(crypto.TYPE_RSA, 2048)\n    crypto_key = key.to_cryptography_key()\n\n    # Build the CSR\n    req = (\n        x509.CertificateSigningRequestBuilder()\n        .subject_name(\n            x509.Name(\n                [\n                    x509.NameAttribute(NameOID.COMMON_NAME, \"example.internal\"),\n                    x509.NameAttribute(NameOID.ORGANIZATION_NAME, \"Acme Corp\"),\n                ]\n            )\n        )\n        .sign(crypto_key, hashes.SHA256())\n    )\n\n    # Save as PEM\n    pem = req.public_bytes(serialization.Encoding.PEM)\n    with open(path, \"wb\") as f:\n        f.write(pem)\n\n\ndef read_and_inspect_csr(path):\n    with open(path, \"rb\") as f:\n        pem_data = f.read()\n\n    req = x509.load_pem_x509_csr(pem_data)\n\n    subject = req.subject\n    cn = subject.get_attributes_for_oid(NameOID.COMMON_NAME)[0].value\n    org = subject.get_attributes_for_oid(NameOID.ORGANIZATION_NAME)[0].value\n\n    pubkey = req.public_key()\n    key_bits = pubkey.key_size\n\n    try:\n        sig_ok = bool(req.is_signature_valid)\n    except crypto.Error:\n        sig_ok = False\n\n    print(f\"Subject CN: {cn}\")\n    print(f\"Subject O: {org}\")\n    print(f\"Public key size: {key_bits} bits\")\n    print(f\"Signature verifies: {sig_ok}\")\n\n\ndef main():\n    generate_csr_file(CSR_PATH)\n    read_and_inspect_csr(CSR_PATH)\n\n\nif __name__ == \"__main__\":\n    main()",
  "script_wrong": "#!/usr/bin/env python3\nimport warnings\n\nfrom OpenSSL import crypto\n\n# X509Req APIs are deprecated in recent pyOpenSSL releases; silence the warnings.\nwarnings.filterwarnings(\"ignore\", category=DeprecationWarning)\n\nCSR_PATH = \"/tmp/request.csr\"\n\n\ndef generate_csr_file(path):\n    # Generate a 2048-bit RSA key\n    key = crypto.PKey()\n    key.generate_key(crypto.TYPE_RSA, 2048)\n\n    # Build the CSR\n    req = crypto.X509Req()\n    subject = req.get_subject()\n    subject.CN = \"example.internal\"\n    subject.O = \"Acme Corp\"\n    req.set_pubkey(key)\n    req.sign(key, \"sha256\")\n\n    # Save as PEM\n    pem = crypto.dump_certificate_request(crypto.FILETYPE_PEM, req)\n    with open(path, \"wb\") as f:\n        f.write(pem)\n\n\ndef read_and_inspect_csr(path):\n    with open(path, \"rb\") as f:\n        pem_data = f.read()\n\n    req = crypto.load_certificate_request(crypto.FILETYPE_PEM, pem_data)\n\n    subject = req.get_subject()\n    cn = subject.CN\n    org = subject.O\n\n    pubkey = req.get_pubkey()\n    key_bits = pubkey.bits()\n\n    try:\n        sig_ok = bool(req.verify(pubkey))\n    except crypto.Error:\n        sig_ok = False\n\n    print(f\"Subject CN: {cn}\")\n    print(f\"Subject O: {org}\")\n    print(f\"Public key size: {key_bits} bits\")\n    print(f\"Signature verifies: {sig_ok}\")\n\n\ndef main():\n    generate_csr_file(CSR_PATH)\n    read_and_inspect_csr(CSR_PATH)\n\n\nif __name__ == \"__main__\":\n    main()",
  "works_on": "26.0.0"
 },
 "right": "",
 "seen_in_models": [
  "claude-sonnet-5-5",
  "gemini-3.8-flash",
  "gpt-6.1-sol"
 ],
 "seq": 4,
 "slug": "x509req",
 "source": "pipeline",
 "symbol": "X509Req",
 "updated": "2026-10-27T17:20:00+00:00",
 "url": "https://formachines.ai/errata/pypi/pyopenssl/0004-x509req/",
 "variant_confirmations": 11,
 "variant_models": [
  "claude-sonnet-5-5",
  "gemini-3.8-flash",
  "gpt-6.1-sol"
 ],
 "verified": "sandbox",
 "versions": {
  "changed_in": ">26.0.0,<=26.4.0",
  "fails_on": "26.4.0",
  "works_on": "26.0.0"
 },
 "wrong": "req = crypto.X509Req()"
}