ccf 6.0.13__py3-none-any.whl → 6.0.15__py3-none-any.whl

ccf/receipt.py

@@ -5,6 +5,7 @@ import base64
 from hashlib import sha256
 from typing import List
 from cryptography.x509 import Certificate
+from cryptography.x509.verification import PolicyBuilder, Store
 from cryptography.hazmat.primitives import hashes
 from cryptography.hazmat.primitives.asymmetric import ec, utils
 
@@ -54,7 +55,9 @@ def check_endorsement(endorsee: Certificate, endorser: Certificate):
 
 
 def check_endorsements(
-    node_cert: Certificate, service_cert: Certificate, endorsements: List[Certificate]
+    node_cert: Certificate,
+    service_cert: Certificate,
+    endorsements: List[Certificate],
 ):
     """
     Check a node certificate is endorsed by a service certificate, transitively through a list of endorsements.
@@ -64,3 +67,21 @@ def check_endorsements(
         check_endorsement(cert_i, endorsement)
         cert_i = endorsement
     check_endorsement(cert_i, service_cert)
+
+
+def check_cert_chain(
+    node_cert: Certificate,
+    service_cert: Certificate,
+    endorsements: List[Certificate],
+):
+    """
+    Use default cryptography policy to verify CCF cert chain
+    """
+    builder = PolicyBuilder()
+    builder = builder.store(Store([service_cert]))
+
+    # This would ideally be `build_server_verifier`, but that requires a
+    # Subject which is either a valid DNSName or IPAddress. Our node cert's
+    # Subject is "CCF Node", and we may not have a better value in SAN
+    verifier = builder.build_client_verifier()
+    verifier.verify(leaf=node_cert, intermediates=endorsements)

{ccf-6.0.13.data → ccf-6.0.15.data}/scripts/submit_recovery_share.sh

@@ -66,12 +66,10 @@ if [ -z "${member_id_cert}" ]; then
     exit 1
 fi
 
-if [ ! -f "env/bin/activate" ]
-    then
-        python3 -m venv env
+if ! command -v ccf_cose_sign1 > /dev/null; then
+    echo "Error: This script requires the ccf_cose_sign1 CLI tool, distributed as part of the CCF Python package. Please install it via 'pip install ccf' in the current Python environment"
+    exit 1
 fi
-source env/bin/activate
-pip install -q ccf
 
 # Compute member ID, as the SHA-256 fingerprint of the signing certificate
 member_id=$(openssl x509 -in "$member_id_cert" -noout -fingerprint -sha256 | cut -d "=" -f 2 | sed 's/://g' | awk '{print tolower($0)}')

{ccf-6.0.13.dist-info → ccf-6.0.15.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ccf
-Version: 6.0.13
+Version: 6.0.15
 Summary: Set of tools and utilities for the Confidential Consortium Framework (CCF)
 Author-email: CCF Team <CCF-Sec@microsoft.com>
 Project-URL: Homepage, https://github.com/microsoft/ccf

{ccf-6.0.13.dist-info → ccf-6.0.15.dist-info}/RECORD

@@ -7,15 +7,15 @@ ccf/ledger_viz.py,sha256=l1p2wKgLDayxquVa9-yzsMcLx9vvygCV8EZ_PrVpvMg,6430
 ccf/merkletree.py,sha256=JHUnGYYHJfi18YUNGiHmNCa1AwmCAwLAN3ias5j61ws,2931
 ccf/py.typed,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 ccf/read_ledger.py,sha256=UzmEKAMS2GJmwuaenKBJbkBDZIWeCa9xcXdpZB51SEg,9370
-ccf/receipt.py,sha256=jK8RGkGJwrW1yJC-GWx7DpxQXCCBdnZHIkrMXZgTOew,2079
+ccf/receipt.py,sha256=dySVvy-IqvsB8pj5uooIokbQR853vpT7uC0TQ-IWIQk,2765
 ccf/split_ledger.py,sha256=wspNZUFPMSvMgGxmwP3QuSbx7QDzTjrC6ecFFJSp14o,5900
 ccf/tx_id.py,sha256=E7XJyUoJ-a8h7Fp36zNQdhSYdyuNdFV-r_aXhoWl1ks,736
 ccf/verify_ledger_secrets_chain.py,sha256=_UDc4wNro2mNUVbErDkhl24jLeJC0Vr-kECeZEdeHME,3590
-ccf-6.0.13.data/scripts/keygenerator.sh,sha256=r9i8rURcDUPU8c9NKkxrjweU1qU09Hv3SWc3IFQ648A,2391
-ccf-6.0.13.data/scripts/submit_recovery_share.sh,sha256=0NHCF7b_ffisUvBJIiO4Od-FC9kpICGK9Yac32HwKYc,3351
-ccf-6.0.13.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
-ccf-6.0.13.dist-info/METADATA,sha256=u293Yc_MUpB9lQeyKa0C9OUDZjOJl-pUpekw91tOzqQ,990
-ccf-6.0.13.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-ccf-6.0.13.dist-info/entry_points.txt,sha256=3hbXI2LSOY06QitxM8GQqT9NwY7rCp1RtSU9gGG20A4,365
-ccf-6.0.13.dist-info/top_level.txt,sha256=I0tWtkKe6KRqXt0nIp8W-ln8j431-vDBb39bQGKkL9Q,4
-ccf-6.0.13.dist-info/RECORD,,
+ccf-6.0.15.data/scripts/keygenerator.sh,sha256=r9i8rURcDUPU8c9NKkxrjweU1qU09Hv3SWc3IFQ648A,2391
+ccf-6.0.15.data/scripts/submit_recovery_share.sh,sha256=VxMfnbi82W1xrs5BwOqlJs-mFXjXeLnuF9ev37Ph034,3489
+ccf-6.0.15.dist-info/licenses/LICENSE,sha256=z8d0m5b2O9McPEK1xHG_dWgUBT6EfBDz6wA0F7xSPTA,11358
+ccf-6.0.15.dist-info/METADATA,sha256=ZxB2qhmCiUiV5RF-rEJt54yTw4nAirF0z-eh2hGOv1s,990
+ccf-6.0.15.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
+ccf-6.0.15.dist-info/entry_points.txt,sha256=3hbXI2LSOY06QitxM8GQqT9NwY7rCp1RtSU9gGG20A4,365
+ccf-6.0.15.dist-info/top_level.txt,sha256=I0tWtkKe6KRqXt0nIp8W-ln8j431-vDBb39bQGKkL9Q,4
+ccf-6.0.15.dist-info/RECORD,,