crabcrop-url 0.1.0__tar.gz

crabcrop_url-0.1.0/PKG-INFO

@@ -0,0 +1,75 @@
+Metadata-Version: 2.4
+Name: crabcrop-url
+Version: 0.1.0
+Summary: Build and sign crabcrop image URLs
+Author: Maxwell Dayvson Da Silva
+License: MIT
+Project-URL: Homepage, https://crabcrop.org
+Project-URL: Repository, https://github.com/dayvson/crabcrop
+Keywords: image,url,signing,hmac,cdn,crabcrop
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Multimedia :: Graphics
+Classifier: Topic :: Internet :: WWW/HTTP
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+
+# crabcrop_url
+
+Build and sign [crabcrop](https://github.com/dayvson/crabcrop) URLs from Python. Standard library only; the signing scheme is specified in [`spec/url-signing.md`](../../spec/url-signing.md) and this package runs the canonical [`spec/test-vectors.json`](../../spec/test-vectors.json) as its test suite, so it cannot drift from the server.
+
+## Usage
+
+```python
+from crabcrop_url import build_url, build_srcset, purge_group_signature, purge_signature, sign, upload_signature, verify
+
+# A signed URL. The operation string is passed verbatim and may
+# contain several segments and preset: references.
+url = build_url(
+    "https://images.example.com",
+    "your-secret",
+    "crop:1200x630:smart/filters:format(webp)",
+    "https://example.com/photo.jpg",
+)
+
+# An expiring URL (unix seconds), emitted as a leading exp: segment.
+expiring = build_url(
+    "https://images.example.com",
+    "your-secret",
+    "300x200",
+    "https://example.com/photo.jpg",
+    expires=1893456000,
+)
+
+# A responsive srcset: one {width}x0 URL per width.
+srcset = build_srcset(
+    "https://images.example.com",
+    "your-secret",
+    "https://example.com/photo.jpg",
+    [400, 800, 1200],
+)
+
+# The raw signature for a remainder, if you assemble URLs yourself.
+signature = sign("your-secret", "300x200/https://example.com/photo.jpg")
+
+# Verify a signature in constant time (malformed tags return False).
+ok = verify("your-secret", signature, "300x200/https://example.com/photo.jpg")
+
+# Purge signatures for the server's /purge and /purge-group endpoints
+# are domain-separated under a derived subkey; the helpers sign the
+# right strings so callers never assemble them by hand.
+purge = purge_signature("your-secret", "300x200/https://example.com/photo.jpg")
+group = purge_group_signature("your-secret", "thumb")
+
+# Upload signatures for the server's PUT /upload/<signature>/<name>
+# endpoint live in a third domain, under their own derived subkey.
+upload = upload_signature("your-secret", "heroes/photo.jpg")
+```
+
+Pass `None` as the secret to produce the literal `unsafe` signature segment, for servers running with `CRABCROP_ALLOW_UNSAFE` or in presets-only mode. The secret may be `str` or `bytes`.
+
+## Tests
+
+```bash
+python3 -m unittest discover -s tests
+```

crabcrop_url-0.1.0/README.md

@@ -0,0 +1,59 @@
+# crabcrop_url
+
+Build and sign [crabcrop](https://github.com/dayvson/crabcrop) URLs from Python. Standard library only; the signing scheme is specified in [`spec/url-signing.md`](../../spec/url-signing.md) and this package runs the canonical [`spec/test-vectors.json`](../../spec/test-vectors.json) as its test suite, so it cannot drift from the server.
+
+## Usage
+
+```python
+from crabcrop_url import build_url, build_srcset, purge_group_signature, purge_signature, sign, upload_signature, verify
+
+# A signed URL. The operation string is passed verbatim and may
+# contain several segments and preset: references.
+url = build_url(
+    "https://images.example.com",
+    "your-secret",
+    "crop:1200x630:smart/filters:format(webp)",
+    "https://example.com/photo.jpg",
+)
+
+# An expiring URL (unix seconds), emitted as a leading exp: segment.
+expiring = build_url(
+    "https://images.example.com",
+    "your-secret",
+    "300x200",
+    "https://example.com/photo.jpg",
+    expires=1893456000,
+)
+
+# A responsive srcset: one {width}x0 URL per width.
+srcset = build_srcset(
+    "https://images.example.com",
+    "your-secret",
+    "https://example.com/photo.jpg",
+    [400, 800, 1200],
+)
+
+# The raw signature for a remainder, if you assemble URLs yourself.
+signature = sign("your-secret", "300x200/https://example.com/photo.jpg")
+
+# Verify a signature in constant time (malformed tags return False).
+ok = verify("your-secret", signature, "300x200/https://example.com/photo.jpg")
+
+# Purge signatures for the server's /purge and /purge-group endpoints
+# are domain-separated under a derived subkey; the helpers sign the
+# right strings so callers never assemble them by hand.
+purge = purge_signature("your-secret", "300x200/https://example.com/photo.jpg")
+group = purge_group_signature("your-secret", "thumb")
+
+# Upload signatures for the server's PUT /upload/<signature>/<name>
+# endpoint live in a third domain, under their own derived subkey.
+upload = upload_signature("your-secret", "heroes/photo.jpg")
+```
+
+Pass `None` as the secret to produce the literal `unsafe` signature segment, for servers running with `CRABCROP_ALLOW_UNSAFE` or in presets-only mode. The secret may be `str` or `bytes`.
+
+## Tests
+
+```bash
+python3 -m unittest discover -s tests
+```

crabcrop_url-0.1.0/pyproject.toml

@@ -0,0 +1,26 @@
+[build-system]
+requires = ["setuptools>=61"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "crabcrop-url"
+version = "0.1.0"
+description = "Build and sign crabcrop image URLs"
+license = { text = "MIT" }
+readme = "README.md"
+requires-python = ">=3.9"
+authors = [{ name = "Maxwell Dayvson Da Silva" }]
+keywords = ["image", "url", "signing", "hmac", "cdn", "crabcrop"]
+classifiers = [
+    "License :: OSI Approved :: MIT License",
+    "Programming Language :: Python :: 3",
+    "Topic :: Multimedia :: Graphics",
+    "Topic :: Internet :: WWW/HTTP",
+]
+
+[project.urls]
+Homepage = "https://crabcrop.org"
+Repository = "https://github.com/dayvson/crabcrop"
+
+[tool.setuptools.packages.find]
+where = ["src"]

crabcrop_url-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

crabcrop_url-0.1.0/src/crabcrop_url/__init__.py

@@ -0,0 +1,212 @@
+"""Build and sign crabcrop URLs, per ``spec/url-signing.md``
+in the crabcrop repository. Standard library only.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import hmac
+from typing import Optional, Sequence, Union
+
+Secret = Union[str, bytes, None]
+
+
+def _key(secret: Union[str, bytes]) -> bytes:
+    return secret.encode("utf-8") if isinstance(secret, str) else secret
+
+
+_KEY_ID_CHARS = frozenset(
+    "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_-"
+)
+
+
+def is_valid_key_id(key_id: str) -> bool:
+    """Whether ``key_id`` is a well-formed key ID: 1 to 32
+    characters of ``[A-Za-z0-9_-]``."""
+    return (
+        isinstance(key_id, str)
+        and 1 <= len(key_id) <= 32
+        and all(c in _KEY_ID_CHARS for c in key_id)
+    )
+
+
+def sign_with_key_id(
+    secret: Union[str, bytes], key_id: str, remainder: str
+) -> str:
+    """The signature segment for a keyed signature:
+    ``<key-id>:`` followed by the hex tag ``sign`` computes.
+    Servers verify a keyed segment against the named key
+    only, which is what makes secret rotation possible
+    without invalidating every outstanding URL."""
+    if not is_valid_key_id(key_id):
+        raise ValueError(
+            f"invalid key ID {key_id!r}: 1 to 32 characters of [A-Za-z0-9_-]"
+        )
+    return f"{key_id}:{sign(secret, remainder)}"
+
+
+def sign(secret: Union[str, bytes], remainder: str) -> str:
+    """Compute the signature segment for a remainder: the
+    lowercase hex HMAC-SHA256 of ``remainder`` under ``secret``.
+    The remainder is everything after the signature segment in
+    the URL, exactly as it will appear."""
+    return hmac.new(_key(secret), remainder.encode("utf-8"), hashlib.sha256).hexdigest()
+
+
+def purge_key(secret: Union[str, bytes]) -> bytes:
+    """The purge subkey: the raw bytes of the HMAC-SHA256
+    of the domain label ``crabcrop/purge-key`` under the
+    secret. Purge signatures live under this derived key,
+    so an image signature can never be replayed as one."""
+    return bytes.fromhex(sign(secret, "crabcrop/purge-key"))
+
+
+def purge_signature(secret: Union[str, bytes], target: str) -> str:
+    """The signature segment for
+    ``POST /purge/<signature>/<path>``: HMAC-SHA256 of the
+    target path under the purge subkey."""
+    key = purge_key(secret)
+    return hmac.new(key, target.encode("utf-8"), hashlib.sha256).hexdigest()
+
+
+def purge_group_signature(secret: Union[str, bytes], group: str) -> str:
+    """The signature segment for
+    ``POST /purge-group/<signature>/<group>``: a purge
+    signature over the literal string ``purge-group/<group>``,
+    which appears nowhere in the request URL. The helper
+    exists so nobody has to know the signed string."""
+    return purge_signature(secret, f"purge-group/{group}")
+
+
+def upload_key(secret: Union[str, bytes]) -> bytes:
+    """The upload subkey: the raw bytes of the HMAC-SHA256
+    of the domain label ``crabcrop/upload-key`` under the
+    secret. Upload signatures live under this derived key,
+    so neither an image signature nor a purge signature can
+    be replayed as one."""
+    return bytes.fromhex(sign(secret, "crabcrop/upload-key"))
+
+
+def upload_signature(secret: Union[str, bytes], name: str) -> str:
+    """The signature segment for
+    ``PUT /upload/<signature>/<name>``: HMAC-SHA256 of the
+    object name under the upload subkey."""
+    key = upload_key(secret)
+    return hmac.new(key, name.encode("utf-8"), hashlib.sha256).hexdigest()
+
+
+def verify(secret: Union[str, bytes], signature: str, remainder: str) -> bool:
+    """Check a signature segment against a remainder, with
+    the Rust implementation's semantics: the expected tag
+    is recomputed and compared in constant time
+    (``hmac.compare_digest``), so a non-canonical tag (an
+    uppercase one, say) fails like any other mismatch, and
+    a malformed one returns False instead of raising."""
+    if not isinstance(signature, str) or not signature.isascii():
+        return False
+    # A keyed segment (`<key-id>:<tag>`) verifies against the
+    # one secret given here: the ID is routing metadata, and
+    # this function's question is whether this secret made
+    # the tag. A malformed ID makes the segment malformed.
+    if ":" in signature:
+        key_id, _, tag = signature.partition(":")
+        if not is_valid_key_id(key_id):
+            return False
+        signature = tag
+    return hmac.compare_digest(sign(secret, remainder), signature)
+
+
+def _validate_url_text(text: str, what: str) -> None:
+    """Fail loudly on inputs that can never verify (audit
+    P-4): the remainder travels as a raw URL path, so ``?`` /
+    ``#`` would truncate it and whitespace, control, and
+    non-ASCII characters cannot be sent as-is."""
+    for c in text:
+        if c in "?#" or not c.isascii() or ord(c) <= 0x20 or ord(c) == 0x7F:
+            raise ValueError(
+                f"{what} contains a character that cannot appear in a crabcrop URL: {c!r}"
+            )
+
+
+def _validate_expires(expires: int) -> None:
+    """The server accepts only an unsigned 64-bit integer
+    (audit P-5)."""
+    if (
+        isinstance(expires, bool)
+        or not isinstance(expires, int)
+        or expires < 0
+        or expires > 2**64 - 1
+    ):
+        raise ValueError(
+            f"expires must be a non-negative integer of unix seconds, got {expires!r}"
+        )
+
+
+def build_url(
+    base: str,
+    secret: Secret,
+    operations: str,
+    source: str,
+    expires: Optional[int] = None,
+    key_id: Optional[str] = None,
+) -> str:
+    """Assemble a signed (or ``unsafe``) crabcrop URL.
+    ``operations`` is the operation string verbatim (several
+    ``/``-separated segments and ``preset:`` references
+    included). ``expires`` is a unix-seconds expiry, emitted as
+    a leading ``exp:`` segment. A ``None`` secret produces the
+    literal ``unsafe`` signature segment, for servers running
+    with unsafe or presets-only configurations."""
+    remainder = ""
+    if expires is not None:
+        _validate_expires(expires)
+        remainder += f"exp:{expires}/"
+    _validate_url_text(operations, "operations")
+    _validate_url_text(source, "source")
+    if operations:
+        remainder += f"{operations}/"
+    remainder += source
+    if secret is None:
+        if key_id is not None:
+            raise ValueError("key_id requires a secret: an unsafe URL has no key to name")
+        signature = "unsafe"
+    elif key_id is not None:
+        signature = sign_with_key_id(secret, key_id, remainder)
+    else:
+        signature = sign(secret, remainder)
+    return f"{base.rstrip('/')}/{signature}/{remainder}"
+
+
+def _validate_width(width: int) -> None:
+    """A srcset width becomes a ``{width}x0`` size segment,
+    so it must satisfy the grammar's dimension rules: a
+    positive integer within the server cap. Anything else
+    mints a URL the server rejects (or worse, ``-300``
+    reads as a flip), so it raises here, at build time."""
+    if (
+        isinstance(width, bool)
+        or not isinstance(width, int)
+        or width < 1
+        or width > 16383
+    ):
+        raise ValueError(
+            f"srcset width must be a positive integer no larger than 16383, got {width!r}"
+        )
+
+
+def build_srcset(
+    base: str,
+    secret: Secret,
+    source: str,
+    widths: Sequence[int],
+    expires: Optional[int] = None,
+) -> str:
+    """Build an ``srcset`` attribute value: one ``{width}x0``
+    URL per width, entries formatted ``{url} {width}w`` and
+    joined by ``, ``. An expiry, when given, applies to every
+    entry."""
+    for w in widths:
+        _validate_width(w)
+    return ", ".join(
+        f"{build_url(base, secret, f'{w}x0', source, expires)} {w}w" for w in widths
+    )

crabcrop_url-0.1.0/src/crabcrop_url.egg-info/PKG-INFO

@@ -0,0 +1,75 @@
+Metadata-Version: 2.4
+Name: crabcrop-url
+Version: 0.1.0
+Summary: Build and sign crabcrop image URLs
+Author: Maxwell Dayvson Da Silva
+License: MIT
+Project-URL: Homepage, https://crabcrop.org
+Project-URL: Repository, https://github.com/dayvson/crabcrop
+Keywords: image,url,signing,hmac,cdn,crabcrop
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Multimedia :: Graphics
+Classifier: Topic :: Internet :: WWW/HTTP
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+
+# crabcrop_url
+
+Build and sign [crabcrop](https://github.com/dayvson/crabcrop) URLs from Python. Standard library only; the signing scheme is specified in [`spec/url-signing.md`](../../spec/url-signing.md) and this package runs the canonical [`spec/test-vectors.json`](../../spec/test-vectors.json) as its test suite, so it cannot drift from the server.
+
+## Usage
+
+```python
+from crabcrop_url import build_url, build_srcset, purge_group_signature, purge_signature, sign, upload_signature, verify
+
+# A signed URL. The operation string is passed verbatim and may
+# contain several segments and preset: references.
+url = build_url(
+    "https://images.example.com",
+    "your-secret",
+    "crop:1200x630:smart/filters:format(webp)",
+    "https://example.com/photo.jpg",
+)
+
+# An expiring URL (unix seconds), emitted as a leading exp: segment.
+expiring = build_url(
+    "https://images.example.com",
+    "your-secret",
+    "300x200",
+    "https://example.com/photo.jpg",
+    expires=1893456000,
+)
+
+# A responsive srcset: one {width}x0 URL per width.
+srcset = build_srcset(
+    "https://images.example.com",
+    "your-secret",
+    "https://example.com/photo.jpg",
+    [400, 800, 1200],
+)
+
+# The raw signature for a remainder, if you assemble URLs yourself.
+signature = sign("your-secret", "300x200/https://example.com/photo.jpg")
+
+# Verify a signature in constant time (malformed tags return False).
+ok = verify("your-secret", signature, "300x200/https://example.com/photo.jpg")
+
+# Purge signatures for the server's /purge and /purge-group endpoints
+# are domain-separated under a derived subkey; the helpers sign the
+# right strings so callers never assemble them by hand.
+purge = purge_signature("your-secret", "300x200/https://example.com/photo.jpg")
+group = purge_group_signature("your-secret", "thumb")
+
+# Upload signatures for the server's PUT /upload/<signature>/<name>
+# endpoint live in a third domain, under their own derived subkey.
+upload = upload_signature("your-secret", "heroes/photo.jpg")
+```
+
+Pass `None` as the secret to produce the literal `unsafe` signature segment, for servers running with `CRABCROP_ALLOW_UNSAFE` or in presets-only mode. The secret may be `str` or `bytes`.
+
+## Tests
+
+```bash
+python3 -m unittest discover -s tests
+```

crabcrop_url-0.1.0/src/crabcrop_url.egg-info/SOURCES.txt

@@ -0,0 +1,8 @@
+README.md
+pyproject.toml
+src/crabcrop_url/__init__.py
+src/crabcrop_url.egg-info/PKG-INFO
+src/crabcrop_url.egg-info/SOURCES.txt
+src/crabcrop_url.egg-info/dependency_links.txt
+src/crabcrop_url.egg-info/top_level.txt
+tests/test_vectors.py

crabcrop_url-0.1.0/src/crabcrop_url.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

crabcrop_url-0.1.0/src/crabcrop_url.egg-info/top_level.txt

@@ -0,0 +1 @@
+crabcrop_url

crabcrop_url-0.1.0/tests/test_vectors.py

@@ -0,0 +1,188 @@
+"""The package's signing suite is the canonical vector file
+from the spec directory, shared by every implementation."""
+
+import json
+import sys
+import unittest
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1] / "src"))
+
+from crabcrop_url import (  # noqa: E402
+    build_srcset,
+    build_url,
+    purge_group_signature,
+    purge_signature,
+    sign,
+    upload_signature,
+    sign_with_key_id,
+    verify,
+)
+
+VECTORS = json.loads(
+    (Path(__file__).resolve().parents[3] / "spec" / "test-vectors.json").read_text()
+)
+
+
+class TestVectors(unittest.TestCase):
+    def test_all_vectors(self):
+        self.assertGreaterEqual(len(VECTORS), 5)
+        for v in VECTORS:
+            with self.subTest(description=v["description"]):
+                self.assertEqual(sign(v["secret"], v["remainder"]), v["signature"])
+
+    def test_verify_accepts_the_vectors_and_rejects_tampering(self):
+        for v in VECTORS:
+            with self.subTest(description=v["description"]):
+                self.assertTrue(verify(v["secret"], v["signature"], v["remainder"]))
+                self.assertFalse(verify(v["secret"], v["signature"], v["remainder"] + "x"))
+                self.assertFalse(verify("wrong-secret", v["signature"], v["remainder"]))
+                # A non-canonical tag fails: the server
+                # accepts only the lowercase spelling.
+                self.assertFalse(
+                    verify(v["secret"], v["signature"].upper(), v["remainder"])
+                )
+        self.assertFalse(verify("s", "not-a-signature", "300x200/https://e.com/a.jpg"))
+
+
+class TestPurgeSignatures(unittest.TestCase):
+    def test_published_vectors(self):
+        # The same pinned literals the Rust crate and the
+        # TypeScript SDK assert.
+        self.assertEqual(
+            purge_signature("test-secret", "300x200/https://example.com/a.jpg"),
+            "9b58a43a984e47cbde3ec08333290acad06c48a5e9b85b99124ae725218e90e8",
+        )
+        self.assertEqual(
+            purge_group_signature("test-secret", "thumb"),
+            "2f779d54c25154a7528fb334973dd2c92e08b2575ee1359a7d426421b083b5d6",
+        )
+        self.assertEqual(
+            purge_group_signature("test-secret", "thumb"),
+            purge_signature("test-secret", "purge-group/thumb"),
+        )
+
+
+class TestUploadSignatures(unittest.TestCase):
+    def test_published_vectors(self):
+        # The same pinned literals the Rust crate and the
+        # TypeScript SDK assert.
+        self.assertEqual(
+            upload_signature("test-secret", "heroes/cat.jpg"),
+            "81d87b588203fdad32f5431c0a893bf7ddad8188f5cca123a1b057a439b34b84",
+        )
+        self.assertNotEqual(
+            upload_signature("test-secret", "heroes/cat.jpg"),
+            purge_signature("test-secret", "heroes/cat.jpg"),
+        )
+
+
+class TestBuilders(unittest.TestCase):
+    def test_spec_worked_example(self):
+        self.assertEqual(
+            build_url(
+                "https://images.example.com/",
+                "your-secret",
+                "300x200",
+                "https://example.com/photo.jpg",
+            ),
+            "https://images.example.com/"
+            "3c1f6c180116661877bd4c85fd201a178087d74c1cc188cc584e819d901308c6"
+            "/300x200/https://example.com/photo.jpg",
+        )
+
+    def test_expiry_and_null_secret(self):
+        self.assertEqual(
+            build_url(
+                "https://img.example.com",
+                None,
+                "preset:thumb",
+                "s3://media/a.jpg",
+                expires=1893456000,
+            ),
+            "https://img.example.com/unsafe/exp:1893456000/preset:thumb/s3://media/a.jpg",
+        )
+
+    def test_srcset(self):
+        self.assertEqual(
+            build_srcset(
+                "https://img.example.com", None, "https://example.com/a.jpg", [320, 640]
+            ),
+            "https://img.example.com/unsafe/320x0/https://example.com/a.jpg 320w, "
+            "https://img.example.com/unsafe/640x0/https://example.com/a.jpg 640w",
+        )
+
+    def test_srcset_rejects_widths_the_grammar_cannot_express(self):
+        # 320.5 is not an integer, -300 is the flip spelling,
+        # 0 is not a size, and 16384 is past the server cap:
+        # each would mint a URL the server rejects.
+        for bad in (320.5, -300, 0, 16384, True):
+            with self.assertRaises(ValueError):
+                build_srcset(
+                    "https://img.example.com", None, "https://example.com/a.jpg", [bad]
+                )
+        build_srcset(
+            "https://img.example.com", None, "https://example.com/a.jpg", [1, 16383]
+        )
+
+
+    def test_builders_reject_unbuildable_urls(self):
+        # Audit P-4 and P-5: these can never verify, so the
+        # builders raise instead of minting dead URLs.
+        for source in (
+            "https://example.com/a.jpg?w=1",
+            "https://example.com/a.jpg#frag",
+            "https://example.com/my photo.jpg",
+            "https://example.com/café.jpg",
+        ):
+            with self.assertRaises(ValueError, msg=source):
+                build_url("https://img.example.com", b"k", "300x200", source)
+        for bad_expires in (-1, 1.5, True, 2**64):
+            with self.assertRaises(ValueError, msg=repr(bad_expires)):
+                build_url(
+                    "https://img.example.com",
+                    b"k",
+                    "300x200",
+                    "https://example.com/a.jpg",
+                    expires=bad_expires,
+                )
+
+
+class TestKeyIds(unittest.TestCase):
+    def test_sign_with_key_id_stamps_the_segment(self):
+        remainder = "300x200/example.com/i.jpg"
+        self.assertEqual(
+            sign_with_key_id("test-secret", "k2", remainder),
+            f"k2:{sign('test-secret', remainder)}",
+        )
+        self.assertEqual(
+            build_url(
+                "https://img.example.com",
+                "test-secret",
+                "300x200",
+                "example.com/i.jpg",
+                key_id="k2",
+            ),
+            f"https://img.example.com/k2:{sign('test-secret', remainder)}/300x200/example.com/i.jpg",
+        )
+        with self.assertRaises(ValueError):
+            sign_with_key_id("test-secret", "bad id", remainder)
+        with self.assertRaises(ValueError):
+            build_url(
+                "https://img.example.com",
+                None,
+                "300x200",
+                "example.com/i.jpg",
+                key_id="k2",
+            )
+
+    def test_verify_accepts_a_keyed_segment_for_its_secret(self):
+        remainder = "300x200/example.com/i.jpg"
+        segment = sign_with_key_id("old-secret", "k-old", remainder)
+        self.assertTrue(verify("old-secret", segment, remainder))
+        self.assertFalse(verify("new-secret", segment, remainder))
+        self.assertFalse(verify("old-secret", "bad id:" + sign("old-secret", remainder), remainder))
+
+
+if __name__ == "__main__":
+    unittest.main()