Raise the cryptography floor past the v47 exception-contract change and test it

[luisgf]

Horizon: short · Effort: S · 2026-07-17 roadmap analysis (round 3)

Our floor is cryptography>=42 — pre-v47 — while CI resolves 49.0.0 (2026-06-12) and stays green. The floor is stale against three upstream changes that alter observable behavior:

• v47: loading a key with an unsupported algorithm raises UnsupportedAlgorithm instead of ValueError — a catch-clause handling only ValueError misclassifies the failure. (v47 also drops OpenSSL 1.1.x for source builds; manylinux wheels bundle their own OpenSSL, so wheel installs are unaffected.)

• v48: rsa.generate_private_key() enforces a 1024-bit floor — reachable from keygenerator only with an absurd configured size, but the error surface changes.

• v49: stricter DER/X.509 parsing (e.g. rejects NULL params in ECDSA signature algorithms).

• raise the floor to cryptography>=45 (openvc-core's core pin); weigh >=47 since that is where the exception contract changed — with the floor below 47 we must handle both exception types

• tests: an unsupported/garbage key through key_to_pem/key loading maps to our taxonomy (UnknownKeyType / a clean error), under both ValueError and UnsupportedAlgorithm

• test keygenerator's behavior for a configured RSA size < 1024 (clean config/keygen error, not a raw upstream traceback)

No pin change needed for PyLD (3.1.0 already green) or jsonschema (4.26.0; format-nongpl stays GPL-free via rfc3987-syntax).