Strange behavior with xmlsec

[sposs]

I have a TimestampedBinarySecurityToken class whose code is simply:

class TimestampedBinarySecurityToken(BinarySignature):

    def __init__(self, *args, **kwargs):
        super(TimestampedBinarySecurityToken, self).__init__(*args, **kwargs)

    def apply(self, envelope, headers):
        security = utils.get_security_header(envelope)

        created = timezone.now()
        expired = created + datetime.timedelta(seconds=3600)

        timestamp = utils.WSU('Timestamp')
        timestamp.append(utils.WSU('Created', utils.get_timestamp(created)))
        timestamp.append(utils.WSU('Expires', utils.get_timestamp(expired)))
        ensure_id(timestamp)

        security.append(timestamp)
        envelope, headers = super(TimestampedBinarySecurityToken, self).apply(envelope, headers)
        return envelope, headers

    def verify(self, envelope):
        # we do not verify the data received because not needed here
        pass


def get_token(key_path, key_pass) -> TimestampedBinarySecurityToken:
    return TimestampedBinarySecurityToken(
         key_file=key_path,
         certfile=key_path,  # we store the cert and the key on the same file for convenience
         password=key_pass
    )

I have several methods like

def download_document(docid:int, WSSEToken:TimestampedBinarySecurityToken,
                      env:str="test", timeout:int=1000, log:bool=False) -> Tuple[Union[DocModel, None], Any]:
    transport = Transport(timeout=timeout, operation_timeout=timeout)
    history = HistoryPlugin()
    plugins = []
    if log:
        plugins = [history]
    pams_dl_parser = PamsDownloadConverter()
    plugins.append(pams_dl_parser)
    client = Client(get_wsdl_path(env, "pams"), wsse=WSSEToken, transport=transport, plugins=plugins)
    client.set_ns_prefix("pams", "http://www.teamead.com/ws/pams")
    try:
        res = client.service.pamsDownload(docid)
    except Exception as err:
        logger.exception(err)
        raise
    if log:
        logger.info(etree.tostring(history.last_sent["envelope"], pretty_print=True).decode("utf-8"))
        logger.info(etree.tostring(history.last_received["envelope"], pretty_print=True).decode("utf-8"))
    return pams_dl_parser.doc_data, (res.attachments[0].content if len(res.attachments) else None)

and

def get_all_topics(WSSEToken, env="test", timeout=2) -> List[_Element]:  # , point_id):
    transport = Transport(timeout=timeout, operation_timeout=timeout)
    client = Client(get_wsdl_path(env, "AIMSLPubSubExtConsumer"), wsse=WSSEToken, transport=transport)
    try:
        res = client.service.GetAllTopics()
    except Exception as err:
        logger.exception(err)
        raise
    return res._value_1

The strange thing: if I first call download_document(12344, my_token), I have the error

Traceback (most recent call last):
  File "/opt/virtualenvs/aimsl/lib/python3.9/site-packages/aimsl/tasks.py", line 1422, in download_document_by_id
    data, content = download_document(doc_id, sse_token, env)
  File "/opt/virtualenvs/aimsl/lib/python3.9/site-packages/wsdl_interface/pams.py", line 421, in download_document
    res = client.service.pamsDownload(docid)
  File "/opt/virtualenvs/aimsl/lib/python3.9/site-packages/zeep/proxy.py", line 46, in __call__
    return self._proxy._binding.send(
  File "/opt/virtualenvs/aimsl/lib/python3.9/site-packages/zeep/wsdl/bindings/soap.py", line 123, in send
    envelope, http_headers = self._create(
  File "/opt/virtualenvs/aimsl/lib/python3.9/site-packages/zeep/wsdl/bindings/soap.py", line 100, in _create
    envelope, http_headers = client.wsse.apply(envelope, http_headers)
  File "/opt/virtualenvs/aimsl/lib/python3.9/site-packages/eurocontrol_aimsl/utils.py", line 34, in apply
    envelope, headers = super(TimestampedBinarySecurityToken, self).apply(envelope, headers)
  File "/opt/virtualenvs/aimsl/lib/python3.9/site-packages/zeep/wsse/signature.py", line 104, in apply
    _sign_envelope_with_key_binary(
  File "/opt/virtualenvs/aimsl/lib/python3.9/site-packages/zeep/wsse/signature.py", line 287, in _sign_envelope_with_key_binary
    bintok.text = x509_data.find(QName(ns.DS, "X509Certificate")).text
AttributeError: 'NoneType' object has no attribute 'text'

and I always get that error.

I did add a log of x509_data with etree.tostring() just before the find is called, and the element X509Certificate exists and is not empty!

Now, if I call get_all_topics(my_token), I don't get the error and it returns what is expected, and I can then also call download_document without the error! This works as long as I'm in the same python session, so I suspect a memory issue in xmlsec. Is that a possibility? Do you know a work around?

FYI, I have been able to fix the issue by upgrading the OS from debian 11 to debian 12 and reinstalling the project in a new virtualenv. I'm still annoyed by this though, because I don't understand how that can be.