Support for decoding sequences of sequences in ASN.1 DER decoder

[ralphje]

While working on a solution working around the lack of the PolicyMappings extension in cryptography (see #15379 for context), I discovered that the ASN.1 APIs do not support decoding native types through asn1.decode_der.

This is necessary when decoding an extension value such as the Policy Mappings' SEQUENCE OF SEQUENCE. For instance, the following ASN.1 spec from RFC 5280 section 4.2.1.5:

PolicyMappings ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE {
     issuerDomainPolicy      CertPolicyId,
     subjectDomainPolicy     CertPolicyId }

can be mapped to the following Python code:

from cryptography.hazmat import asn1
from cryptography.x509 import ObjectIdentifier

@asn1.sequence
class PolicyMapping:
    issuer_domain_policy: ObjectIdentifier
    subject_domain_policy: ObjectIdentifier

PolicyMappings = list[PolicyMapping]

However, this cannot be used when decoding from DER (example taken from NIST PKITS test case 4.10.1, ASN.1 JS link):

public_bytes = bytes.fromhex("301a3018060a60864801650302013001060a60864801650302013002")
asn1.decode_der(PolicyMappings, public_bytes )

raises the error:

TypeError: 'GenericAlias' object is not an instance of 'type'
while processing 'class'

This similarly breaks when PolicyMappings = List[PolicyMapping], type PolicyMappings = list[PolicyMapping] or PolicyMappings: TypeAlias = list[PolicyMapping] is used.

All such forms should be accepted by asn1.decode_der to allow decoding this type of ASN.1 sequence. A similar issue seems to hold for support for set. Other native types appear on first glance to be working, but should be tested and verified as well if they aren't.

I have not been able to fully verify whether workarounds currently exist, or that I'm understanding something completely wrong. In that case, at least a documentation clarification is needed.