decbackup 0.1.0__py3-none-any.whl

decbackup/pkcs7.py

@@ -0,0 +1,239 @@
+"""Detached PKCS#7 SignedData verification for Stormshield backups.
+
+Recovered from ``libncrypto.so`` (``VerifyMajSignatureInit`` /
+``VerifySignatureFinal`` and the OpenSSL 3 ``PKCS7_*`` helpers they call):
+
+* the trailer is a detached ``SignedData`` — the content itself is not
+  encapsulated;
+* the signed content is the **full 0x400-byte header block** (text plus
+  NUL padding) followed by the decrypted payload;
+* the signature is RSA/ECDSA over the DER of the authenticated attributes
+  with the ``[0]`` context tag replaced by ``SET`` (``0x31``); Stormshield's
+  encoder stores the attribute SEQUENCEs directly under ``[0]`` without a
+  SET wrapper, so the tag swap also has to re-emit the length;
+* the ``messageDigest`` attribute must equal ``SHA256(content)``.
+"""
+
+from __future__ import annotations
+
+import hashlib
+from collections.abc import Callable
+
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.asymmetric import ec, padding
+
+from .der import DERError, children, encode_len, oid_str, read_tlv
+
+OID_SIGNED_DATA = "1.2.840.113549.1.7.2"
+OID_PKCS7_DATA = "1.2.840.113549.1.7.1"
+OID_CONTENT_TYPE = "1.2.840.113549.1.9.3"
+OID_MESSAGE_DIGEST = "1.2.840.113549.1.9.4"
+
+#: digestAlgorithm OIDs (hash algorithms only; rsaEncryption's hash comes
+#: from this field, per _SIG_ALGS below)
+_HASHES: dict[str, Callable[[], hashes.HashAlgorithm]] = {
+    "1.2.840.113549.1.1.14": hashes.SHA224,
+    "2.16.840.1.101.3.4.2.1": hashes.SHA256,
+    "2.16.840.1.101.3.4.2.2": hashes.SHA384,
+    "2.16.840.1.101.3.4.2.3": hashes.SHA512,
+}
+
+_SIG_ALGS = {
+    # rsaEncryption: the DigestInfo lives in the padding, so the digest
+    # algorithm comes from the SignerInfo's digestAlgorithm field.
+    "1.2.840.113549.1.1.1": "rsa",
+    "1.2.840.113549.1.1.10": "rsa-pss",
+    "1.2.840.113549.1.1.11": "rsa",
+    "1.2.840.113549.1.1.12": "rsa",
+    "1.2.840.113549.1.1.13": "rsa",
+    "1.2.840.10045.4.3.2": "ecdsa",
+    "1.2.840.10045.4.3.3": "ecdsa",
+    "1.2.840.10045.4.3.4": "ecdsa",
+}
+
+
+class SignatureError(Exception):
+    """Signature/attribute verification failed (original error code 7)."""
+
+
+class SignerInfo:
+    """One parsed ``SignerInfo`` with its raw DER pieces."""
+
+    def __init__(self, buf: bytes, start: int, end: int):
+        fields = list(children(buf, start, end))
+        if len(fields) < 6:
+            raise SignatureError("truncated SignerInfo")
+        self.version = int.from_bytes(buf[fields[0][1] : fields[0][3]], "big")
+        self.sid = fields[1]
+        self.digest_alg = oid_str(buf, *_oid_span(buf, fields[2]))
+        # fields[3] is [0] authenticatedAttributes, fields[4] the signature
+        # AlgorithmIdentifier and fields[5] the OCTET STRING signature.
+        self.sig_alg = oid_str(buf, *_oid_span(buf, fields[4]))
+        attrs = fields[3]
+        if attrs[0] & 0xC0 != 0x80:
+            raise SignatureError("authenticatedAttributes missing")
+        # PKCS#7 signs the attributes as a SET OF.  Stormshield stores them
+        # bare under the [0] tag; a standard encoder nests a SET inside.
+        value = buf[attrs[1] : attrs[3]]
+        if value and value[0] == 0x31:
+            self.attrs_der = value
+        else:
+            self.attrs_der = b"\x31" + encode_len(len(value)) + value
+        self.signature = buf[fields[5][1] : fields[5][3]]
+        self._attributes(buf, attrs)
+        self._sid(buf, self.sid)
+
+    def _attributes(self, buf: bytes, attrs) -> None:
+        self.content_type: str | None = None
+        self.message_digest: bytes | None = None
+        inner = buf[attrs[1] : attrs[3]]
+        start, end = 0, len(inner)
+        if inner and inner[0] == 0x31:  # SET wrapper present
+            _, start, _, end = read_tlv(inner, 0)
+        for _tag, vs, _ln, ni in children(inner, start, end):
+            vals = list(children(inner, vs, ni))
+            if len(vals) < 2:
+                continue
+            oid = oid_str(inner, vals[0][1], vals[0][3])
+            # vals[1] is the SET OF holding the actual value TLV
+            try:
+                value = next(iter(children(inner, vals[1][1], vals[1][3])))
+            except (DERError, StopIteration):
+                continue
+            if oid == OID_CONTENT_TYPE:
+                self.content_type = oid_str(inner, value[1], value[3])
+            elif oid == OID_MESSAGE_DIGEST:
+                self.message_digest = inner[value[1] : value[3]]
+
+    def _sid(self, buf: bytes, sid) -> None:
+        """Extract issuer DER bytes + serial (issuerAndSerialNumber form)."""
+        self.sid_serial: int | None = None
+        self.sid_issuer_der: bytes | None = None
+        inner = list(children(buf, sid[1], sid[3]))
+        if len(inner) == 2:
+            # the issuer Name TLV starts right at the SID value start
+            self.sid_issuer_der = buf[sid[1] : inner[0][3]]
+            self.sid_serial = int.from_bytes(buf[inner[1][1] : inner[1][3]], "big", signed=False)
+
+    def find_signer_cert(self, certs: list[bytes]) -> bytes:
+        """Pick the certificate the SID designates.
+
+        Serial numbers are unique per issuer, so the serial match pins the
+        signer; a wrong pick would fail signature verification anyway.
+        """
+        for der in certs:
+            if self.sid_serial is None:
+                continue
+            try:
+                cert = x509.load_der_x509_certificate(der)
+            except ValueError as exc:
+                raise SignatureError(f"unparsable certificate: {exc}") from exc
+            if cert.serial_number == self.sid_serial:
+                return der
+        if len(certs) == 1:  # no usable SID match; single candidate
+            return certs[0]
+        raise SignatureError("signer certificate not found in SignedData")
+
+    def verify(self, certs: list[bytes], content: bytes) -> bytes:
+        """Verify attributes signature + messageDigest over *content*.
+
+        Returns the signer certificate DER on success.
+        """
+        try:
+            return self._verify_inner(certs, content)
+        except SignatureError:
+            raise
+        except Exception as exc:
+            # cryptography parses certificate fields lazily and raises
+            # odd classes (ValueError, UnsupportedAlgorithm,
+            # DuplicateExtension, ...): at this attacker-input boundary
+            # anything unexpected must fail closed into error 7
+            raise SignatureError(f"certificate field error: {exc}") from exc
+
+    def _verify_inner(self, certs: list[bytes], content: bytes) -> bytes:
+        signer_der = self.find_signer_cert(certs)
+        if self.content_type not in (None, OID_PKCS7_DATA):
+            raise SignatureError("unexpected contentType")
+        if self.message_digest is None:
+            raise SignatureError("missing messageDigest attribute")
+        hasher = _HASHES.get(self.digest_alg)
+        if hasher is None:
+            raise SignatureError(f"unsupported digest algorithm {self.digest_alg}")
+        if hashlib.new(hasher().name, content).digest() != self.message_digest:
+            raise SignatureError("messageDigest mismatch")
+        try:
+            cert = x509.load_der_x509_certificate(signer_der)
+        except ValueError as exc:
+            raise SignatureError(f"unparsable signer certificate: {exc}") from exc
+        _verify(cert.public_key(), self.signature, self.attrs_der, self.sig_alg, hasher)
+        return signer_der
+
+
+def _oid_span(buf: bytes, alg_tlv):
+    """(value_start, value_end) of the OID inside an AlgorithmIdentifier."""
+    _, vs, _, ni = alg_tlv
+    oid = read_tlv(buf, vs)  # first child is the algorithm OID
+    return oid[1], oid[3]
+
+
+def _verify(pubkey, signature: bytes, signed: bytes, sig_alg: str, hasher):
+    kind = _SIG_ALGS.get(sig_alg, "rsa")
+    try:
+        if kind == "rsa":
+            pubkey.verify(signature, signed, padding.PKCS1v15(), hasher())
+        elif kind == "rsa-pss":
+            pubkey.verify(
+                signature,
+                signed,
+                padding.PSS(mgf=padding.MGF1(hasher()), salt_length=padding.PSS.MAX_LENGTH),
+                hasher(),
+            )
+        else:  # ecdsa
+            pubkey.verify(signature, signed, ec.ECDSA(hasher()))
+    except SignatureError:
+        raise
+    except Exception as exc:  # includes InvalidSignature / UnsupportedAlgorithm
+        raise SignatureError(f"signature verification failed: {exc}") from exc
+
+
+def parse_signed_data(sig_der: bytes):
+    """Parse a DER ``ContentInfo`` of type signedData.
+
+    Returns ``(certs, signers)`` — certificate DER blobs and
+    :class:`SignerInfo` objects.  Raises :class:`SignatureError` on any
+    structural problem (original fail-closed behaviour, error code 6).
+    """
+    try:
+        _tag, vs, _ln, ni = read_tlv(sig_der, 0)
+        content_info = list(children(sig_der, vs, ni))
+        if oid_str(sig_der, content_info[0][1], content_info[0][3]) != OID_SIGNED_DATA:
+            raise SignatureError("trailer is not a SignedData")
+        sd = content_info[1]  # [0] EXPLICIT SignedData
+        inner = read_tlv(sig_der, sd[1])  # the SignedData SEQUENCE itself
+        fields = list(children(sig_der, inner[1], inner[3]))
+
+        certs: list[bytes] = []
+        signers: list[SignerInfo] = []
+        # SignedData field order is fixed: version, digestAlgorithms,
+        # encapContentInfo, [certificates], [crls], signerInfos (last).
+        for f in fields:
+            if f[0] == 0xA0:  # certificates [0] — cert SEQUENCEs stored bare
+                i = f[1]
+                while i < f[3]:
+                    t, _vs, _l2, ni2 = read_tlv(sig_der, i)
+                    if t != 0x30:
+                        break
+                    certs.append(sig_der[i:ni2])
+                    i = ni2
+        if fields and fields[-1][0] in (0x30, 0x31):
+            for si in children(sig_der, fields[-1][1], fields[-1][3]):
+                signers.append(SignerInfo(sig_der, si[1], si[3]))
+        if not signers:
+            raise SignatureError("SignedData has no signerInfos")
+        return certs, signers
+    except SignatureError:
+        raise
+    except (DERError, ValueError, IndexError, StopIteration) as exc:
+        # the whole trailer walk must fail closed into error code 6
+        raise SignatureError(f"cannot parse PKCS#7 trailer: {exc}") from exc

decbackup/trust.py

@@ -0,0 +1,187 @@
+"""Chain verification against the CAs embedded in ``libncrypto.so``.
+
+``fw_libcrypto_get_trust_store`` (backup type) installs four hard-coded CA
+certificates found in the library's .rodata at 0x8890, 0x6b40, 0x8f40 and
+0x6f60, sets ``X509_V_FLAG_NO_CHECK_TIME`` (expired device certificates
+still verify — backups stay readable forever) and adds the policy OID
+``1.3.6.1.4.1.11256.2.3`` to the verify parameters.  The verify callback
+accepts error codes 0, 9, 10 and 43 (NETASQ-issued), which boils down to:
+build a signature-valid chain to one of the embedded roots, ignore dates.
+"""
+
+from __future__ import annotations
+
+import warnings
+from collections.abc import Callable
+from functools import lru_cache
+from importlib import resources
+
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.asymmetric import ec, padding, rsa
+
+#: certificatePolicies OID the verify parameters require (EXPLICIT_POLICY)
+BACKUP_POLICY_OID = "1.3.6.1.4.1.11256.2.3"
+
+EXT_CERTIFICATE_POLICIES = "2.5.29.32"
+
+_MAX_DEPTH = 8
+
+_RSA_HASHES: dict[str, Callable[[], hashes.HashAlgorithm]] = {
+    "1.2.840.113549.1.1.5": hashes.MD5,
+    "1.2.840.113549.1.1.11": hashes.SHA256,
+    "1.2.840.113549.1.1.12": hashes.SHA384,
+    "1.2.840.113549.1.1.13": hashes.SHA512,
+}
+
+_ECDSA_HASHES: dict[str, Callable[[], hashes.HashAlgorithm]] = {
+    "1.2.840.10045.4.3.2": hashes.SHA256,
+    "1.2.840.10045.4.3.3": hashes.SHA384,
+    "1.2.840.10045.4.3.4": hashes.SHA512,
+}
+
+
+class ChainError(Exception):
+    """Chain construction failed (original error code 7)."""
+
+
+def load_trust_store() -> list[bytes]:
+    """DER blobs of the four CA certificates embedded in libncrypto."""
+    store = resources.files(__package__).joinpath("certs")
+    names = (
+        "stormshield-sns-enrollment-products-ca.der",
+        "netasq-firewall-ca.der",
+        "stormshield-products-root-ca.der",
+        "stormshield-product-and-services-root-ca.der",
+    )
+    with warnings.catch_warnings():
+        # the NETASQ CA carries a non-positive serial (RFC 5280 violation
+        # in the real CA); the original tool loads it fine.
+        warnings.simplefilter("ignore")
+        return [store.joinpath(n).read_bytes() for n in names]
+
+
+@lru_cache(maxsize=1)
+def _netasq_subject_der() -> bytes:
+    der = (
+        resources.files(__package__)
+        .joinpath("certs")
+        .joinpath("netasq-firewall-ca.der")
+        .read_bytes()
+    )
+    return _load_cert(der).subject.public_bytes()
+
+
+def _netasq_issued(cert: x509.Certificate) -> bool:
+    """``fw_libcrypto_is_netasq_issued``: DER memcmp of the issuer Name."""
+    return cert.issuer.public_bytes() == _netasq_subject_der()
+
+
+def _verify_cert_signature(cert: x509.Certificate, issuer: x509.Certificate) -> None:
+    """Check *cert*'s signature against *issuer*'s public key."""
+    sig, tbs = cert.signature, cert.tbs_certificate_bytes
+    alg = cert.signature_algorithm_oid.dotted_string
+    key = issuer.public_key()
+    try:
+        if isinstance(key, rsa.RSAPublicKey):
+            if alg == "1.2.840.113549.1.1.10":  # rsassa-pss
+                key.verify(
+                    sig,
+                    tbs,
+                    padding.PSS(
+                        mgf=padding.MGF1(hashes.SHA256()), salt_length=padding.PSS.MAX_LENGTH
+                    ),
+                    hashes.SHA256(),
+                )
+            else:
+                key.verify(sig, tbs, padding.PKCS1v15(), _RSA_HASHES.get(alg, hashes.SHA256)())
+        elif isinstance(key, ec.EllipticCurvePublicKey):
+            key.verify(sig, tbs, ec.ECDSA(_ECDSA_HASHES.get(alg, hashes.SHA256)()))
+        else:
+            raise ChainError(f"unsupported issuer key type: {type(key)}")
+    except ChainError:
+        raise
+    except Exception as exc:
+        raise ChainError(f"certificate signature check failed: {exc}") from exc
+
+
+def _load_cert(der: bytes) -> x509.Certificate:
+    with warnings.catch_warnings():
+        warnings.simplefilter("ignore")
+        try:
+            return x509.load_der_x509_certificate(der)
+        except ValueError as exc:
+            raise ChainError(f"unparsable certificate: {exc}") from exc
+
+
+def verify_chain(leaf_der: bytes, untrusted: list[bytes]) -> list[bytes]:
+    """Build and cryptographically verify a chain from the leaf certificate
+    to one of the embedded trust anchors.
+
+    *untrusted* holds the extra certificates carried in the SignedData.
+    Validity dates are ignored, mirroring the original's NO_CHECK_TIME.
+    Returns the chain (leaf first, DER blobs).
+    """
+    try:
+        return _verify_chain_inner(leaf_der, untrusted)
+    except ChainError:
+        raise
+    except Exception as exc:
+        # lazy field parsing in tampered certificates raises assorted
+        # classes (ValueError, UnsupportedAlgorithm, DuplicateExtension,
+        # ...); everything must fail closed into the original's error 7
+        raise ChainError(f"certificate field error: {exc}") from exc
+
+
+def _verify_chain_inner(leaf_der: bytes, untrusted: list[bytes]) -> list[bytes]:
+    trusted = load_trust_store()
+    trusted_certs = [_load_cert(der) for der in trusted]
+    others = [_load_cert(der) for der in untrusted]
+
+    leaf = _load_cert(leaf_der)
+    try:
+        _check_policy(leaf)
+    except ChainError:
+        # the verify callback accepts error 43 (no matching policy) only
+        # for NETASQ-issued certs (fw_libcrypto_is_netasq_issued)
+        if not _netasq_issued(leaf):
+            raise
+
+    chain = [leaf_der]
+    cur = leaf
+    for _ in range(_MAX_DEPTH):
+        if cur.issuer == cur.subject:  # self-signed: must be an anchor
+            for anchor in trusted_certs:
+                if anchor.subject == cur.subject and anchor.serial_number == cur.serial_number:
+                    _verify_cert_signature(cur, cur)
+                    return chain
+            raise ChainError("self-signed certificate is not trusted")
+        found: tuple[x509.Certificate, bytes] | None = None
+        for der, cand in zip(untrusted + trusted, others + trusted_certs):
+            if cand.subject == cur.issuer:
+                try:
+                    _verify_cert_signature(cur, cand)
+                except ChainError:
+                    continue
+                found = (cand, der)
+                break
+        if found is None:
+            raise ChainError(f"unable to get issuer certificate: {cur.issuer.rfc4514_string()}")
+        cur, der = found
+        chain.append(der)
+    raise ChainError("maximum chain depth exceeded")
+
+
+def _check_policy(cert: x509.Certificate) -> None:
+    """The verify parameters require the Stormshield backup policy OID."""
+    try:
+        ext = cert.extensions.get_extension_for_class(x509.CertificatePolicies).value
+    except x509.ExtensionNotFound:
+        return  # no policy extension: unconstrained, OpenSSL accepts it
+    try:
+        ids = [p.policy_identifier.dotted_string for p in ext]
+    except Exception:
+        return
+    if BACKUP_POLICY_OID in ids or "2.5.29.32.0" in ids:  # anyPolicy
+        return
+    raise ChainError(f"certificate policy {BACKUP_POLICY_OID} not satisfied")

decbackup-0.1.0.dist-info/METADATA

@@ -0,0 +1,181 @@
+Metadata-Version: 2.4
+Name: decbackup
+Version: 0.1.0
+Summary: Python clone of Stormshield SNS's decbackup: decrypt and verify .bkup appliance backups without the device
+Author: fl0l0u
+License-Expression: Apache-2.0
+Project-URL: Homepage, https://github.com/fl0l0u/decbackup
+Project-URL: Documentation, https://github.com/fl0l0u/decbackup#readme
+Project-URL: Repository, https://github.com/fl0l0u/decbackup.git
+Project-URL: Issues, https://github.com/fl0l0u/decbackup/issues
+Keywords: stormshield,sns,backup,decbackup,pkcs7,forensics
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: System Administrators
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security :: Cryptography
+Classifier: Topic :: System :: Archiving
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: cryptography>=41
+Provides-Extra: dev
+Requires-Dist: ruff>=0.4.0; extra == "dev"
+Dynamic: license-file
+
+<h1 align="center">
+  <br>
+  decbackup
+  <br>
+</h1>
+
+<h4 align="center">Python clone of Stormshield SNS's backup decryption utility, built from a full reverse-engineering of decbackup + libncrypto.so</h4>
+
+<p align="center">
+  <a href="https://pypi.org/project/decbackup/">
+    <img src="https://img.shields.io/pypi/v/decbackup?style=flat-square" alt="PyPI">
+  </a>
+  <a href="LICENSE">
+    <img src="https://img.shields.io/badge/license-Apache--2.0-blue?style=flat-square" alt="License">
+  </a>
+  <img src="https://img.shields.io/badge/platform-any-lightgrey?style=flat-square" alt="Platform">
+  <img src="https://img.shields.io/badge/python-3.9%2B-yellow?style=flat-square" alt="Python">
+  <a href="https://github.com/fl0l0u/decbackup/actions">
+    <img src="https://img.shields.io/github/actions/workflow/status/fl0l0u/decbackup/ci.yml?style=flat-square&label=CI" alt="CI">
+  </a>
+</p>
+
+<p align="center">
+  <a href="#features">Features</a> •
+  <a href="#installation">Installation</a> •
+  <a href="#usage">Usage</a> •
+  <a href="#the-format">The Format</a> •
+  <a href="#development">Development</a> •
+  <a href="#license">License</a>
+</p>
+
+---
+
+**decbackup** decrypts and verifies Stormshield Network Security (SNS)
+backup files (`.bkup`) — no appliance required. It is a faithful Python
+reimplementation of `/usr/Firewall/sbin/decbackup` and the backup container
+code of `libncrypto.so`, derived from SNS **v5.1.4** by static analysis
+plus an empirical error-code matrix against a live device (see
+[RECON.md](RECON.md)).
+
+## Features
+
+| Feature | Description |
+|---------|-------------|
+| **Byte-exact format support** | `[BACKUP]` header, detached PKCS#7 trailer, AES-128-CBC payload |
+| **Both password schemes** | v2 (PBKDF2-HMAC-SHA256) and legacy v1 (salted-SHA1) key derivation |
+| **Full signature verification** | RSA over PKCS#7 authAttrs, messageDigest over header+payload, chain to the four CAs embedded in libncrypto, policy 1.3.6.1.4.1.11256.2.3, dates ignored (as on the device) |
+| **Original CLI parity** | same flags (`-i -o -p -P -d`), same messages, same numeric error codes (0/1/6/7/8/12/13/32) — validated against the real binary on device |
+| **Tiny dependency set** | `cryptography` only; DER/PKCS#7 parsing is in-tree (`decbackup/der.py`, `pkcs7.py`) |
+
+## Installation
+
+```bash
+pip install decbackup
+```
+
+Or from a checkout:
+
+```bash
+pip install .
+```
+
+The wheel bundles everything needed at runtime: the package code, the
+four CA certificates extracted from `libncrypto.so` (`decbackup/certs/`),
+and a `decbackup` console script. The only dependency is
+`cryptography`.
+
+## Usage
+
+```
+Usage : () -i <backup> -o <output archive>
+                    [-p <password>] [-d : dump backup header]
+                    [-P : prompt for password]
+                    [--no-verify : skip signature verification (clone extension)]
+```
+
+```bash
+decbackup -i firewall.bkup -o archive.tar -p 's3cret'
+tar tf archive.tar
+```
+
+Success is silent (exit 0), exactly like the original; failure prints
+`decrypt and/or verify backup failed (%d)` with the appliance's own error
+code. `-d` prints the decoded header block after a successful run.
+
+`--no-verify` has no counterpart on the device: it skips trailer
+parsing and signature/chain checks to rescue backups whose signature
+region is corrupted. It prints a warning and the output is
+**unauthenticated** — decryption alone proves the password was right,
+not that the backup came from a genuine appliance.
+
+Library use:
+
+```python
+from decbackup import decrypt_backup, BackupError
+try:
+    header = decrypt_backup("firewall.bkup", "archive.tar", "s3cret")
+    print(header["model"], header["date"])
+except BackupError as e:
+    print("failed:", e.code)
+```
+
+## The Format
+
+```
+0x000   0x400   [BACKUP] key=value header, NUL-terminated, zero-padded
+0x400   4       be32 X — PKCS#7 trailer length
+0x404   X       detached PKCS#7 SignedData (device cert + CA intermediate)
+0x404+X 4       be32 Y — payload length
+0x408+X Y       AES-128-CBC ciphertext (PBKDF2-SHA256 key, PKCS#7 padding)
+```
+
+The signature covers the **full 0x400-byte header block plus the decrypted
+payload**; it chains device cert → *Stormshield Network Security Products
+CA* → *Stormshield Products Root CA* (embedded). Expired device
+certificates still verify — the appliance ignores dates, so backups stay
+readable forever. Full details in [RECON.md](RECON.md).
+
+## Development
+
+```
+decbackup/        the package (cli, backup format, crypto, pkcs7, der, trust, certs/)
+analysis/         RE tooling: disassembler, strings, symbol lists, the device
+                  extraction script and the empirical error-code matrix
+tests/vectors/    real encbackup-produced backups + expected payloads
+                  (created on an SNS 5.1.4 device, cross-validated against
+                  the stock decbackup)
+legacy/           the earlier single-file iteration (kept for reference)
+```
+
+```bash
+python tests/test_decbackup.py        # exit code = number of failures
+python analysis/probes.py             # real-vs-clone error-code parity table
+python analysis/fuzz.py 30000         # robustness contract fuzzer
+```
+
+## Releasing
+
+Tagged pushes (`v*`) build an sdist + wheel, smoke-test the wheel against
+the bundled device vectors, and publish to PyPI via trusted publishing
+(see `.github/workflows/release.yml`). Pushes and PRs run lint + the
+error-code parity suite on Python 3.9–3.13
+(`.github/workflows/ci.yml`).
+
+```bash
+git tag v0.1.0 && git push origin v0.1.0   # → PyPI
+```
+
+## License
+
+Apache License 2.0 — see [LICENSE](LICENSE). The patent grant and
+patent-retaliation clauses of Apache-2.0 apply.
+
+*Stormshield* is a trademark of Stormshield. This project is unaffiliated
+with Stormshield; it exists so that backups you own remain readable.

decbackup-0.1.0.dist-info/RECORD

@@ -0,0 +1,18 @@
+decbackup/__init__.py,sha256=sWQ0R-P295fXLCrfaHJccBeXfTEiXt-5Vi1TuCEPfdc,359
+decbackup/__main__.py,sha256=E6Gls0DNz8GQK2K-kOUIx8cYhgANW_CH54VKrfCfs14,52
+decbackup/backup.py,sha256=fWOkiHkUyV54x6rB_MATBduLWeGw-aOl9FefQYWLXIU,9322
+decbackup/cli.py,sha256=Cfr66S6lPlCMucLwYhq-AR38XOQOwAbjzp2I1tZm8vI,3427
+decbackup/crypto.py,sha256=tehNM2E7mrVB1MHw03Tk97GjKXQAeF5KOx5wU7fXrLM,2924
+decbackup/der.py,sha256=N9Exvr-VVgB5M198eyg3c8Le-oHszzFj-ozhZhJvoS8,2372
+decbackup/pkcs7.py,sha256=FpQcKsbj-r5MeZNxkLbDodf70FgBM3I8rhBa20OLyXQ,10332
+decbackup/trust.py,sha256=xco9bS0-4thiomO4Nlc71wXqvrVXoGpFIlHBcyh3cNc,7144
+decbackup/certs/netasq-firewall-ca.der,sha256=_KqQzWp4c1JZikmL5O_CwxXIpF6zCzwmT5TYd0GhUrs,1048
+decbackup/certs/stormshield-product-and-services-root-ca.der,sha256=v-7_lMWO1oo6-ecdO7qLVRqVOhI1E46s6-4twbBMCLo,1542
+decbackup/certs/stormshield-products-root-ca.der,sha256=Qg3WRvECe_XZduXzTM2nMxYWuXosJb077kfBH65gEEY,1537
+decbackup/certs/stormshield-sns-enrollment-products-ca.der,sha256=vlQeq_WjqNeTJBBkn_m6lf-_kw7VYz4XJKvbszjeud0,1712
+decbackup-0.1.0.dist-info/licenses/LICENSE,sha256=2-Ay_fkWnKU-z__VTmVYCIhPDpb4yoKhLlHrYH3Ayy4,10755
+decbackup-0.1.0.dist-info/METADATA,sha256=sKhLcyUHmGicUDuH3iq8ShqUm4nwp7NdCkkjgYMQv4o,6861
+decbackup-0.1.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+decbackup-0.1.0.dist-info/entry_points.txt,sha256=7EWGsTZVW1rYExTjDVD_VTIQXjY98l5uVwZHczPfreQ,49
+decbackup-0.1.0.dist-info/top_level.txt,sha256=95G07-VQPhUMVmGDEX_gN3n7cEpukBKkOi2NZfUMwJM,10
+decbackup-0.1.0.dist-info/RECORD,,

decbackup-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

decbackup-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+decbackup = decbackup.cli:main