codeimprint 0.5.0a11__py3-none-any.whl

codeimprint_cli/config.py

@@ -0,0 +1,181 @@
+"""Where the client keeps the server URL and token, and how settings are resolved.
+
+Order: command-line flag, then environment (CODEIMPRINT_URL, CODEIMPRINT_TOKEN), then the
+user config file written by `imprint login`.
+
+A server behind **Cloudflare Access** (a development lock) also needs a service token: the
+``CF-Access-Client-Id`` and ``CF-Access-Client-Secret`` headers. They come from
+CODEIMPRINT_CF_ACCESS_CLIENT_ID / CODEIMPRINT_CF_ACCESS_CLIENT_SECRET, or from
+`imprint login --cf-access`, and are sent **only** to that one server's host (never to
+another, never over plain HTTP except to this machine).
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from dataclasses import dataclass
+from pathlib import Path
+from urllib.parse import urlparse
+
+CONFIG_NAME = "config.json"
+
+
+def config_dir() -> Path:
+    override = os.environ.get("CODEIMPRINT_CONFIG_DIR")
+    if override:
+        return Path(override)
+    if os.name == "nt":
+        base = Path(os.environ.get("APPDATA") or Path.home() / "AppData" / "Roaming")
+    elif sys.platform == "darwin":
+        base = Path.home() / "Library" / "Application Support"
+    else:
+        base = Path(os.environ.get("XDG_CONFIG_HOME") or Path.home() / ".config")
+    return base / "codeimprint"
+
+
+def config_path() -> Path:
+    return config_dir() / CONFIG_NAME
+
+
+def load_user_config() -> dict:
+    path = config_path()
+    if not path.is_file():
+        return {}
+    try:
+        return json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return {}
+
+
+def _write(settings: dict) -> Path:
+    path = config_path()
+    path.parent.mkdir(parents=True, exist_ok=True)
+    data = json.dumps(settings, indent=2) + "\n"
+    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)
+    with os.fdopen(fd, "w", encoding="utf-8") as f:
+        f.write(data)
+    if os.name != "nt":
+        path.chmod(0o600)
+    return path
+
+
+def save_user_config(url: str, token: str | None) -> Path:
+    """Write the config readable by the current user only (a sign-in session is kept)."""
+    keep = ("session", "cf_access", "hubs")
+    settings = {k: v for k, v in load_user_config().items() if k in keep}
+    settings.update(url=url, token=token or None)
+    return _write(settings)
+
+
+def save_session(url: str, session: dict) -> Path:
+    """Keep a sign-in session (from `imprint login`) for this server, readable by the user
+    only. The session token is short-lived; nothing else about the login is stored."""
+    settings = load_user_config()
+    settings.setdefault("url", url)
+    settings["session"] = {"url": url.rstrip("/"), "token": session["token"],
+                           "expires_at": session["expires_at"],
+                           "provider": session.get("provider"), "handle": session.get("handle")}
+    return _write(settings)
+
+
+def load_session(url: str) -> dict | None:
+    """The stored session for this server, unless it has expired."""
+    from datetime import datetime, timezone
+
+    s = load_user_config().get("session") or {}
+    if not s.get("token") or s.get("url") != url.rstrip("/"):
+        return None
+    now = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+    return s if s.get("expires_at", "") > now else None
+
+
+LOOPBACK = {"localhost", "127.0.0.1", "::1"}
+
+
+def _host(url: str | None) -> str | None:
+    return urlparse(url).hostname if url else None
+
+
+def cf_access_for(url: str) -> tuple[str, str] | None:
+    """The Cloudflare Access service token to send to ``url``, or None.
+
+    From the environment, it is sent to the host of CODEIMPRINT_CF_ACCESS_HOST, else of
+    CODEIMPRINT_URL, else of the saved server URL; saved by `imprint login --cf-access`, to the
+    host it was saved for. Only over HTTPS (or plain HTTP to this machine)."""
+    parts = urlparse(url or "")
+    host = parts.hostname
+    if not host or not (parts.scheme == "https" or (parts.scheme == "http" and host in LOOPBACK)):
+        return None
+    stored = load_user_config()
+    env_id = os.environ.get("CODEIMPRINT_CF_ACCESS_CLIENT_ID", "").strip()
+    env_secret = os.environ.get("CODEIMPRINT_CF_ACCESS_CLIENT_SECRET", "").strip()
+    if env_id and env_secret:
+        target = (os.environ.get("CODEIMPRINT_CF_ACCESS_HOST", "").strip()
+                  or _host(os.environ.get("CODEIMPRINT_URL")) or _host(stored.get("url")))
+        if target and target.lower() == host.lower():
+            return env_id, env_secret
+    saved = stored.get("cf_access") or {}
+    if (saved.get("host", "").lower() == host.lower() and saved.get("client_id")
+            and saved.get("client_secret")):
+        return saved["client_id"], saved["client_secret"]
+    return None
+
+
+def save_cf_access(url: str, client_id: str, client_secret: str) -> Path:
+    """Keep a Cloudflare Access service token for this server's host (user-only file)."""
+    host = _host(url)
+    if not host:
+        raise ValueError("not a server URL")
+    settings = load_user_config()
+    settings["cf_access"] = {"host": host, "client_id": client_id,
+                             "client_secret": client_secret}
+    return _write(settings)
+
+
+@dataclass
+class Settings:
+    url: str | None
+    token: str | None
+
+
+def hub_url(server_url: str | None, flag: str | None = None) -> str | None:
+    """The hub that shows this server's seals (<hub>/i/<ID>): ``--hub-url``, else
+    CODEIMPRINT_HUB_URL, else the ``public_url`` the server itself reported (cached per server
+    URL by `imprint login` and by every seal), else None: then no link is printed."""
+    for value in (flag, os.environ.get("CODEIMPRINT_HUB_URL")):
+        if value and value.strip():
+            return value.strip().rstrip("/")
+    if server_url:
+        return (load_user_config().get("hubs") or {}).get(server_url.rstrip("/"))
+    return None
+
+
+def save_hub(server_url: str, public_url) -> str | None:
+    """Remember the hub a server reported. A local hub (localhost) is believed only from a
+    local server, and a remote one only over HTTPS; anything else is not kept."""
+    if not isinstance(public_url, str) or not public_url.strip():
+        return None
+    hub = public_url.strip().rstrip("/")
+    parts, server_host = urlparse(hub), _host(server_url)
+    if not parts.hostname or parts.scheme not in ("https", "http"):
+        return None
+    if parts.hostname in LOOPBACK and server_host not in LOOPBACK:
+        return None
+    if parts.scheme == "http" and parts.hostname not in LOOPBACK:
+        return None
+    settings = load_user_config()
+    hubs = settings.get("hubs") or {}
+    if hubs.get(server_url.rstrip("/")) != hub:
+        hubs[server_url.rstrip("/")] = hub
+        settings["hubs"] = hubs
+        _write(settings)
+    return hub
+
+
+def resolve(url_flag: str | None = None) -> Settings:
+    stored = load_user_config()
+    url = url_flag or os.environ.get("CODEIMPRINT_URL") or stored.get("url")
+    token = os.environ.get("CODEIMPRINT_TOKEN") or stored.get("token")
+    return Settings(url=url.rstrip("/") if url else None, token=token or None)

codeimprint_cli/gitrepo.py

@@ -0,0 +1,148 @@
+"""Read a Git repository for incremental sealing: tree listings, blobs and commit links.
+
+Everything comes from `git` itself (ls-tree, cat-file, rev-parse, rev-list): the client
+computes no hashes of its own over code. Blob and tree IDs are passed to the server as
+claims; it never publishes them.
+"""
+
+from __future__ import annotations
+
+import subprocess
+from pathlib import Path
+
+
+class GitError(Exception):
+    """Not a Git repository, or a git command failed."""
+
+
+def _git(root: Path, *args: str, input: bytes | None = None) -> bytes:
+    try:
+        done = subprocess.run(["git", "-C", str(root), *args], input=input, capture_output=True,
+                              check=True)
+    except FileNotFoundError as exc:
+        raise GitError("git is not installed") from exc
+    except subprocess.CalledProcessError as exc:
+        raise GitError(exc.stderr.decode(errors="replace").strip() or "git failed") from exc
+    return done.stdout
+
+
+def is_repo(root: Path) -> bool:
+    try:
+        return _git(root, "rev-parse", "--is-inside-work-tree").strip() == b"true"
+    except GitError:
+        return False
+
+
+def toplevel(root: Path) -> Path:
+    return Path(_git(root, "rev-parse", "--show-toplevel").decode().strip())
+
+
+def git_dir(root: Path) -> Path:
+    path = Path(_git(root, "rev-parse", "--git-dir").decode().strip())
+    return path if path.is_absolute() else Path(root) / path
+
+
+def prefix(root: Path) -> str:
+    """The folder's path inside the repository ('' at the top), with a trailing '/'."""
+    return _git(root, "rev-parse", "--show-prefix").decode().strip()
+
+
+def resolve(root: Path, rev: str) -> str:
+    return _git(root, "rev-parse", "--verify", f"{rev}^{{commit}}").decode().strip()
+
+
+def remote_url(root: Path, name: str = "origin") -> str | None:
+    try:
+        url = _git(root, "remote", "get-url", name).decode().strip()
+    except GitError:
+        return None
+    return url or None
+
+
+def repository_name(url: str | None) -> tuple[str | None, str | None]:
+    """(host, "owner/repo") from a remote URL: https://host/owner/repo(.git),
+    git@host:owner/repo(.git) or ssh://git@host/owner/repo. Credentials in the URL are
+    dropped; (None, None) when it cannot be read."""
+    if not url:
+        return None, None
+    from urllib.parse import urlsplit
+
+    if "://" in url:
+        parts = urlsplit(url)
+        host, path = (parts.hostname or ""), parts.path
+    elif ":" in url and "@" in url.split(":", 1)[0]:
+        host_part, path = url.split(":", 1)
+        host = host_part.rsplit("@", 1)[1]
+    else:
+        return None, None
+    path = path.strip("/").removesuffix(".git").strip("/")
+    bits = [b for b in path.split("/") if b]
+    if len(bits) < 2:
+        return host.lower() or None, bits[0] if bits else None
+    return host.lower() or None, "/".join(bits[-2:])
+
+
+def has_commits(root: Path) -> bool:
+    try:
+        resolve(root, "HEAD")
+        return True
+    except GitError:
+        return False
+
+
+def commit_info(root: Path, commit: str) -> dict:
+    tree = _git(root, "rev-parse", f"{commit}^{{tree}}").decode().strip()
+    line = _git(root, "rev-list", "--parents", "-n", "1", commit).decode().split()
+    ref = ""
+    try:
+        ref = _git(root, "symbolic-ref", "-q", "HEAD").decode().strip()
+    except GitError:
+        pass
+    return {"commit": commit, "tree": tree, "parents": line[1:], "ref": ref or None}
+
+
+def tags_at(root: Path, commit: str) -> list[str]:
+    """Tags pointing at a commit, sorted (``git tag --points-at``)."""
+    return sorted(_git(root, "tag", "--points-at", commit).decode().split())
+
+
+def commits(root: Path, revision_range: str) -> list[str]:
+    """Commits in a range, oldest first (``git rev-list --reverse``)."""
+    return _git(root, "rev-list", "--reverse", revision_range).decode().split()
+
+
+def ls_tree(root: Path, commit: str, under: str = "") -> list[dict]:
+    """Regular files of a commit: [{path (relative to ``under``), blob, size}]."""
+    out = _git(root, "ls-tree", "-r", "-z", "--long", "--full-tree", commit)
+    files = []
+    for record in out.split(b"\0"):
+        if not record:
+            continue
+        meta, _, path = record.partition(b"\t")
+        mode, kind, blob, size = meta.decode().split()
+        name = path.decode("utf-8", errors="surrogateescape")
+        if kind != "blob" or mode == "120000" or not name.startswith(under):
+            continue                                   # submodules, symlinks, other folders
+        files.append({"path": name[len(under):], "blob": blob, "size": int(size)})
+    return files
+
+
+def read_blobs(root: Path, blob_ids: list[str]):
+    """Yield (blob ID, content) for each ID, via one `git cat-file --batch` process."""
+    if not blob_ids:
+        return
+    proc = subprocess.Popen(["git", "-C", str(root), "cat-file", "--batch"],
+                            stdin=subprocess.PIPE, stdout=subprocess.PIPE)
+    try:
+        for blob in blob_ids:
+            proc.stdin.write(blob.encode() + b"\n")
+            proc.stdin.flush()
+            header = proc.stdout.readline().split()
+            if len(header) != 3:
+                raise GitError(f"blob {blob} is missing from the repository")
+            data = proc.stdout.read(int(header[2]))
+            proc.stdout.read(1)                        # the newline after each object
+            yield blob, data
+    finally:
+        proc.stdin.close()
+        proc.wait()

codeimprint_cli/imprint_file.py

@@ -0,0 +1,128 @@
+"""Offline verification of .imprint files (docs/imprint-format.md).
+
+Checks only the public file format: canonical JSON, SHA-256 digest, optional Ed25519
+signature and the Imprint ID. No secret is involved.
+"""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import json
+from pathlib import Path
+
+FORMAT = "imprint"
+ID_PREFIX = "IMP1"
+RELEASE_PREFIX = "REL1"                           # release records: same shape, own namespace
+BODY_CHECKED = (ID_PREFIX, RELEASE_PREFIX)        # frozen: check character over the body only
+RECORD_PREFIXES = ("IDT1", "REV1", "MBR1", "END1", "CLM1", "XFR1", "ASG1", "DCL1", "CTB1",
+                   "NTC1", "DSC1", "INT1")       # ownership records: check over prefix + body
+ALL_PREFIXES = BODY_CHECKED + RECORD_PREFIXES
+ALPHABET = "0123456789ABCDEFGHJKMNPQRSTVWXYZ"    # Crockford Base32: no I, L, O, U
+
+
+def b64d(text: str) -> bytes:
+    return base64.urlsafe_b64decode(text + "=" * (-len(text) % 4))
+
+
+def canonical(doc: dict) -> bytes:
+    """Sorted keys, no whitespace, UTF-8 without escaping (RFC 8785 for this data)."""
+    return json.dumps(doc, sort_keys=True, separators=(",", ":"), ensure_ascii=False).encode()
+
+
+def digest_of(doc: dict) -> str:
+    body = {k: v for k, v in doc.items() if k != "integrity"}
+    return hashlib.sha256(canonical(body)).hexdigest()
+
+
+def _check_char(body: str) -> str:
+    return ALPHABET[hashlib.sha256(body.encode("ascii")).digest()[0] >> 3]
+
+
+def _check_for(prefix: str, body: str) -> str:
+    return _check_char(body) if prefix in BODY_CHECKED else _check_char(f"{prefix}-{body}")
+
+
+def imprint_id(digest_hex: str, prefix: str = ID_PREFIX) -> str:
+    if prefix not in ALL_PREFIXES:
+        raise ValueError(f"unknown ID prefix {prefix!r}")
+    value = int(digest_hex[:20], 16)                       # first 80 bits
+    body = "".join(ALPHABET[(value >> (75 - 5 * i)) & 31] for i in range(16))
+    groups = "-".join(body[i:i + 4] for i in range(0, 16, 4))
+    return f"{prefix}-{groups}-{_check_for(prefix, body)}"
+
+
+def record_id(prefix: str, digest_hex: str) -> str:
+    """An ownership record's ID from the SHA-256 of its canonical document."""
+    if prefix not in RECORD_PREFIXES:
+        raise ValueError(f"not an ownership record prefix: {prefix!r}")
+    return imprint_id(digest_hex, prefix)
+
+
+def release_id(digest_hex: str) -> str:
+    """A release record's ID: REL1-..., from the SHA-256 of its release document."""
+    return imprint_id(digest_hex, RELEASE_PREFIX)
+
+
+def clean_id(text: str) -> str:
+    parts = text.strip().upper().split("-")
+    if len(parts) == 6:
+        parts[1:6] = [p.replace("O", "0").replace("I", "1").replace("L", "1") for p in parts[1:6]]
+    return "-".join(parts)
+
+
+def is_valid_id(text: str, prefixes: tuple[str, ...] = (ID_PREFIX,)) -> bool:
+    parts = clean_id(text).split("-")
+    if len(parts) != 6 or parts[0] not in prefixes or len(parts[5]) != 1:
+        return False
+    body = "".join(parts[1:5])
+    return (len(body) == 16 and all(c in ALPHABET for c in body)
+            and _check_for(parts[0], body) == parts[5])
+
+
+def verify_document(doc: dict) -> dict:
+    """Return a status dict; ``valid`` is True only if every present check passes."""
+    if not isinstance(doc, dict) or doc.get("format") != FORMAT:
+        raise ValueError("not an Imprint document")
+    integrity = doc.get("integrity") or {}
+    stored = integrity.get("sha256")
+    recomputed = digest_of(doc)
+    status = {"id": imprint_id(stored) if stored else None, "digest_ok": stored == recomputed,
+              "signed": False, "signature_ok": None, "signer": None, "valid": False}
+    sig = integrity.get("signature")
+    if sig:
+        from cryptography.exceptions import InvalidSignature
+        from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+
+        status["signed"] = True
+        try:
+            if sig.get("alg") != "Ed25519":
+                raise ValueError(f"unsupported signature algorithm {sig.get('alg')!r}")
+            public = b64d(sig["public_key"])
+            Ed25519PublicKey.from_public_bytes(public).verify(b64d(sig["value"]),
+                                                              bytes.fromhex(stored))
+            status["signature_ok"] = True
+            status["signer"] = hashlib.sha256(public).hexdigest()[:16]
+        except (InvalidSignature, ValueError, KeyError, TypeError):
+            status["signature_ok"] = False
+    status["valid"] = bool(stored) and status["digest_ok"] and status["signature_ok"] is not False
+    return status
+
+
+def load(path: str | Path) -> dict:
+    return json.loads(Path(path).read_text(encoding="utf-8"))
+
+
+def save(doc: dict, path: str | Path) -> Path:
+    """Write the document the way the server stores it (sorted keys, one-space indent)."""
+    out = Path(path)
+    out.parent.mkdir(parents=True, exist_ok=True)
+    out.write_text(json.dumps(doc, indent=1, sort_keys=True) + "\n", encoding="utf-8")
+    return out
+
+
+def badge(imprint_id_text: str, public_url: str) -> str:
+    """README badge Markdown (rust, B23C0C), linking to the seal's page on the hub."""
+    shield = imprint_id_text.replace("-", "--")
+    return (f"[![Sealed by CodeImprint](https://img.shields.io/badge/CodeImprint-{shield}-B23C0C)]"
+            f"({public_url.rstrip('/')}/i/{imprint_id_text})")