devnomads 0.2.0__tar.gz → 0.2.2__tar.gz

devnomads-0.2.2/.gitlab-ci.yml

@@ -0,0 +1,82 @@
+stages:
+  - check
+  - test
+  - publish
+
+default:
+  image: ghcr.io/astral-sh/uv:python3.14-alpine
+  before_script:
+    # dev tools + the acme extra, so linting and tests cover devnomads.acme.
+    - uv sync --dev --extra acme
+
+check:
+  stage: check
+  rules:
+    - if: $CI_PIPELINE_SOURCE != "trigger"
+  script:
+    - uv run python tools/generate.py --check
+    - uv run black --check .
+    - uv run isort --check-only .
+    - uv run flake8 src tests
+    - uv run bandit -r src
+    - uv run semgrep scan --quiet --error --config p/python src
+    - uv run mypy src
+
+test:
+  stage: test
+  rules:
+    - if: $CI_PIPELINE_SOURCE != "trigger"
+  parallel:
+    matrix:
+      - PYTHON: ["3.10", "3.14"]
+  image: ghcr.io/astral-sh/uv:python$PYTHON-alpine
+  script:
+    - uv run pytest -v
+
+# Runs on version tags (v0.1.0). PYPI_TOKEN (masked) and
+# PYPI_PUBLISH_URL are CI variables pointing at pypi.org; the
+# PYPI_TEST_* variants hold the test.pypi.org equivalents - swap them
+# in to rehearse a release without publishing for real.
+publish:
+  stage: publish
+  rules:
+    - if: $CI_COMMIT_TAG =~ /^v/
+  before_script: []
+  script:
+    - uv build
+    - uv publish --publish-url "$PYPI_PUBLISH_URL" --token "$PYPI_TOKEN"
+
+# Triggered by the DevNomads API deploy pipeline (a pipeline trigger
+# token). Refreshes the OpenAPI spec, regenerates the SDK, and - only if
+# the spec actually changed - auto-bumps the patch version, commits the
+# regenerated code back, and pushes a tag. The publish job above turns
+# that tag into a PyPI release. Runs only on a trigger, so it never
+# recurses on the branch/tag pushes it creates.
+#
+# Requires CI variables:
+#   GITLAB_PUSH_TOKEN - project/group access token (Maintainer role,
+#     write_repository scope) allowed to push the default branch and tags.
+#   PYPI_TOKEN / PYPI_PUBLISH_URL - used by the publish job on the tag.
+auto-release:
+  stage: check
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "trigger"
+  resource_group: auto-release
+  script:
+    - apk add --no-cache git curl
+    - curl -sf "https://api.devnomads.nl/docs?api-docs.json" -o openapi.json
+    - uv run python tools/generate.py
+    - uv run black -q . && uv run isort -q .
+    - |
+      if git diff --quiet -- openapi.json src/devnomads/api/_services.py; then
+        echo "spec unchanged; nothing to release"; exit 0
+      fi
+    - NEW=$(uv run python tools/bump_version.py)
+    - uv lock
+    - git config user.name "devnomads-ci"
+    - git config user.email "ci@devnomads.nl"
+    - git add openapi.json src/devnomads/api/_services.py pyproject.toml uv.lock
+    - 'git commit -m "chore: auto-regenerate sdk from api spec (v${NEW})"'
+    - git tag -a "v${NEW}" -m "v${NEW}"
+    - git remote set-url origin "https://oauth2:${GITLAB_PUSH_TOKEN}@${CI_SERVER_HOST}/${CI_PROJECT_PATH}.git"
+    - git push origin "HEAD:${CI_DEFAULT_BRANCH}" --follow-tags

{devnomads-0.2.0 → devnomads-0.2.2}/PKG-INFO

@@ -1,7 +1,7 @@
 Metadata-Version: 2.4
 Name: devnomads
-Version: 0.2.0
-Summary: Python client for the DevNomads API (transport, DNS, ACME)
+Version: 0.2.2
+Summary: Python client library for the DevNomads API (transport, DNS, ACME)
 Project-URL: Homepage, https://devnomads.nl
 Author-email: Loek Geleijn <support@devnomads.nl>
 License: MIT

{devnomads-0.2.0 → devnomads-0.2.2}/pyproject.toml

@@ -4,8 +4,8 @@ build-backend = "hatchling.build"
 
 [project]
 name = "devnomads"
-version = "0.2.0"
-description = "Python client for the DevNomads API (transport, DNS, ACME)"
+version = "0.2.2"
+description = "Python client library for the DevNomads API (transport, DNS, ACME)"
 readme = "README.md"
 requires-python = ">=3.10"
 license = { text = "MIT" }

{devnomads-0.2.0 → devnomads-0.2.2}/src/devnomads/acme/__init__.py

@@ -21,7 +21,13 @@ try:
     from .dns01 import DevNomadsDnsProvider, DnsProvider
     from .errors import AcmeError
     from .http01 import Http01Solver, StandaloneSolver, WebrootSolver
-    from .keys import build_csr, generate_key, load_or_create_account_key, serialize_key
+    from .keys import (
+        build_csr,
+        generate_key,
+        jws_alg,
+        load_or_create_account_key,
+        serialize_key,
+    )
     from .verify import verify_txt_record
 except ImportError as exc:  # pragma: no cover - exercised via packaging
     if (exc.name or "").split(".")[0] in _EXTRA_MODULES:
@@ -44,6 +50,7 @@ __all__ = [
     "build_csr",
     "generate_key",
     "serialize_key",
+    "jws_alg",
     "load_or_create_account_key",
     "verify_txt_record",
 ]

{devnomads-0.2.0 → devnomads-0.2.2}/src/devnomads/acme/client.py

@@ -14,7 +14,13 @@ from acme import messages
 from .dns01 import DnsProvider
 from .errors import AcmeError
 from .http01 import Http01Solver
-from .keys import PrivateKey, build_csr, load_or_create_account_key, serialize_key
+from .keys import (
+    PrivateKey,
+    build_csr,
+    jws_alg,
+    load_or_create_account_key,
+    serialize_key,
+)
 from .verify import verify_txt_record
 
 log = logging.getLogger("devnomads.acme")
@@ -72,11 +78,13 @@ class AcmeClient:
         account_key = load_or_create_account_key(
             self.account_key_path, self.account_key_algorithm
         )
-        net = acme_client.ClientNetwork(account_key, user_agent=self.user_agent)
+        net = acme_client.ClientNetwork(
+            account_key, alg=jws_alg(account_key), user_agent=self.user_agent
+        )
         directory = messages.Directory.from_json(net.get(self.directory_url).json())
         client = acme_client.ClientV2(directory, net)
 
-        new_account = messages.NewAccount(
+        new_account = messages.NewRegistration(
             contact=(f"mailto:{self.contact_email}",) if self.contact_email else (),
             terms_of_service_agreed=True,
             only_return_existing=False,

{devnomads-0.2.0 → devnomads-0.2.2}/src/devnomads/acme/keys.py

@@ -8,6 +8,7 @@ from __future__ import annotations
 
 import os
 
+import josepy
 from cryptography import x509
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import hashes, serialization
@@ -88,6 +89,26 @@ def load_or_create_account_key(path: str, algorithm: str):
     raise AcmeError("unsupported account key type")
 
 
+def jws_alg(account_key):
+    """Return the JWS signing algorithm matching an account JWK.
+
+    ``acme.client.ClientNetwork`` defaults to RS256, so pairing it with an
+    EC account key makes josepy reject the signature (the key is not an
+    instance of the algorithm's key type). The alg must follow the key.
+    """
+
+    if isinstance(account_key, jwk.JWKRSA):
+        return josepy.RS256
+    if isinstance(account_key, jwk.JWKEC):
+        curve = account_key.key.curve.name
+        if curve == "secp256r1":
+            return josepy.ES256
+        if curve == "secp384r1":
+            return josepy.ES384
+        raise AcmeError(f"unsupported account key curve: {curve}")
+    raise AcmeError("unsupported account key type")
+
+
 def build_csr(private_key: PrivateKey, identifiers: list[str]) -> bytes:
     """Build a PEM CSR: ``identifiers[0]`` is the CN, all are SANs."""
 

devnomads-0.2.2/tests/test_acme_client.py

@@ -0,0 +1,125 @@
+"""Tests for the pure helpers of the ACME client."""
+
+from __future__ import annotations
+
+from types import SimpleNamespace
+
+import pytest
+
+from devnomads.acme import AcmeError
+from devnomads.acme.client import (
+    _challenge_for_authz,
+    _normalize_challenge_types,
+    _normalize_identifiers,
+    _split_fullchain,
+)
+
+
+def test_normalize_identifiers_dedup_preserves_order():
+    assert _normalize_identifiers(["a.com", "b.com", "a.com", ""]) == ["a.com", "b.com"]
+
+
+def test_normalize_challenge_types_string_applies_to_all():
+    assert _normalize_challenge_types("dns-01", ["a.com", "b.com"]) == {
+        "a.com": "dns-01",
+        "b.com": "dns-01",
+    }
+
+
+def test_normalize_challenge_types_dict_per_identifier():
+    mapping = {"a.com": "dns-01", "b.com": "http-01"}
+    assert _normalize_challenge_types(mapping, ["a.com", "b.com"]) == mapping
+
+
+def test_normalize_challenge_types_missing_raises():
+    with pytest.raises(AcmeError):
+        _normalize_challenge_types({"a.com": "dns-01"}, ["a.com", "b.com"])
+
+
+def _authz(value, wildcard):
+    return SimpleNamespace(identifier=SimpleNamespace(value=value), wildcard=wildcard)
+
+
+def test_challenge_for_authz_plain():
+    body = _authz("example.com", False)
+    assert _challenge_for_authz({"example.com": "dns-01"}, body) == "dns-01"
+
+
+def test_challenge_for_authz_wildcard_reprefixes():
+    body = _authz("example.com", True)
+    assert _challenge_for_authz({"*.example.com": "dns-01"}, body) == "dns-01"
+
+
+def test_split_fullchain():
+    leaf = "-----BEGIN CERTIFICATE-----\nAAA\n-----END CERTIFICATE-----\n"
+    rest = "-----BEGIN CERTIFICATE-----\nBBB\n-----END CERTIFICATE-----\n"
+    leaf_pem, chain_pem = _split_fullchain(leaf + rest)
+    assert leaf_pem == leaf
+    assert chain_pem == rest
+
+
+def test_split_fullchain_no_marker():
+    leaf_pem, chain_pem = _split_fullchain("garbage")
+    assert leaf_pem == "garbage"
+    assert chain_pem == ""
+
+
+def test_init_client_registers_with_new_registration(monkeypatch, tmp_path):
+    """_init_client must build a real acme.messages.NewRegistration and hand
+    it to new_account; this exercises the message construction that a wrong
+    class name (e.g. the non-existent NewAccount) would break."""
+
+    import josepy
+    from acme import messages
+    from cryptography.hazmat.backends import default_backend
+    from cryptography.hazmat.primitives.asymmetric import ec
+    from josepy import jwk
+
+    from devnomads.acme import client as client_mod
+
+    captured = {}
+    account_key = jwk.JWKEC(
+        key=ec.generate_private_key(ec.SECP256R1(), backend=default_backend())
+    )
+
+    class FakeResponse:
+        def json(self):
+            return {}
+
+    class FakeNetwork:
+        def __init__(self, *args, **kwargs):
+            captured["alg"] = kwargs.get("alg")
+            self.account = None
+
+        def get(self, url):
+            return FakeResponse()
+
+    class FakeClientV2:
+        def __init__(self, directory, net):
+            self.net = net
+
+        def new_account(self, registration):
+            captured["registration"] = registration
+            return SimpleNamespace(uri="https://acme.example/acct/1")
+
+    monkeypatch.setattr(
+        client_mod, "load_or_create_account_key", lambda *a, **k: account_key
+    )
+    monkeypatch.setattr(client_mod.acme_client, "ClientNetwork", FakeNetwork)
+    monkeypatch.setattr(client_mod.acme_client, "ClientV2", FakeClientV2)
+    monkeypatch.setattr(
+        client_mod.messages.Directory, "from_json", lambda data: object()
+    )
+
+    ac = client_mod.AcmeClient(
+        str(tmp_path / "account.pem"), contact_email="ops@example.com"
+    )
+    client, _account_key = ac._init_client()
+
+    # an EC account key must be signed with ES256, not the ClientNetwork
+    # default of RS256, or josepy rejects the JWS.
+    assert captured["alg"] == josepy.ES256
+    registration = captured["registration"]
+    assert isinstance(registration, messages.NewRegistration)
+    assert registration.contact == ("mailto:ops@example.com",)
+    assert client.net.account is not None

{devnomads-0.2.0 → devnomads-0.2.2}/tests/test_acme_keys.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import os
 import stat
 
+import josepy
 import pytest
 from cryptography import x509
 from cryptography.hazmat.primitives.asymmetric import ec, rsa
@@ -14,9 +15,11 @@ from devnomads.acme import (
     AcmeError,
     build_csr,
     generate_key,
+    jws_alg,
     load_or_create_account_key,
     serialize_key,
 )
+from devnomads.acme.keys import jwk
 
 
 def test_generate_rsa():
@@ -68,3 +71,20 @@ def test_account_key_reused(tmp_path):
     content = open(path, "rb").read()
     load_or_create_account_key(path, "ec256")
     assert open(path, "rb").read() == content
+
+
+def test_jws_alg_rsa():
+    assert jws_alg(jwk.JWKRSA(key=generate_key("rsa2048"))) is josepy.RS256
+
+
+def test_jws_alg_ec256():
+    assert jws_alg(jwk.JWKEC(key=generate_key("ec256"))) is josepy.ES256
+
+
+def test_jws_alg_ec384():
+    assert jws_alg(jwk.JWKEC(key=generate_key("ec384"))) is josepy.ES384
+
+
+def test_jws_alg_unsupported_type():
+    with pytest.raises(AcmeError):
+        jws_alg(object())

devnomads-0.2.2/tools/bump_version.py

@@ -0,0 +1,33 @@
+#!/usr/bin/env python3
+"""Bump the patch version in pyproject.toml and print the new version.
+
+Used by the auto-release CI job so each spec-driven regeneration gets a
+fresh, monotonically increasing version (PyPI versions are immutable).
+"""
+
+from __future__ import annotations
+
+import pathlib
+import re
+import sys
+
+PYPROJECT = pathlib.Path(__file__).resolve().parent.parent / "pyproject.toml"
+
+
+def main() -> int:
+    text = PYPROJECT.read_text()
+    match = re.search(r'^version = "(\d+)\.(\d+)\.(\d+)"', text, re.MULTILINE)
+    if not match:
+        print("error: could not find a version in pyproject.toml", file=sys.stderr)
+        return 1
+    major, minor, patch = (int(g) for g in match.groups())
+    new_version = f"{major}.{minor}.{patch + 1}"
+    PYPROJECT.write_text(
+        text[: match.start()] + f'version = "{new_version}"' + text[match.end() :]
+    )
+    print(new_version)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

{devnomads-0.2.0 → devnomads-0.2.2}/uv.lock

@@ -468,7 +468,7 @@ wheels = [
 
 [[package]]
 name = "devnomads"
-version = "0.2.0"
+version = "0.2.2"
 source = { editable = "." }
 dependencies = [
     { name = "httpx" },

devnomads-0.2.0/.gitlab-ci.yml

@@ -1,43 +0,0 @@
-stages:
-  - check
-  - test
-  - publish
-
-default:
-  image: ghcr.io/astral-sh/uv:python3.14-alpine
-  before_script:
-    # dev tools + the acme extra, so linting and tests cover devnomads.acme.
-    - uv sync --dev --extra acme
-
-check:
-  stage: check
-  script:
-    - uv run python tools/generate.py --check
-    - uv run black --check .
-    - uv run isort --check-only .
-    - uv run flake8 src tests
-    - uv run bandit -r src
-    - uv run semgrep scan --quiet --error --config p/python src
-    - uv run mypy src
-
-test:
-  stage: test
-  parallel:
-    matrix:
-      - PYTHON: ["3.10", "3.14"]
-  image: ghcr.io/astral-sh/uv:python$PYTHON-alpine
-  script:
-    - uv run pytest -v
-
-# Runs on version tags (v0.1.0). PYPI_TOKEN (masked) and
-# PYPI_PUBLISH_URL are CI variables pointing at pypi.org; the
-# PYPI_TEST_* variants hold the test.pypi.org equivalents - swap them
-# in to rehearse a release without publishing for real.
-publish:
-  stage: publish
-  rules:
-    - if: $CI_COMMIT_TAG =~ /^v/
-  before_script: []
-  script:
-    - uv build
-    - uv publish --publish-url "$PYPI_PUBLISH_URL" --token "$PYPI_TOKEN"

devnomads-0.2.0/tests/test_acme_client.py

@@ -1,64 +0,0 @@
-"""Tests for the pure helpers of the ACME client."""
-
-from __future__ import annotations
-
-from types import SimpleNamespace
-
-import pytest
-
-from devnomads.acme import AcmeError
-from devnomads.acme.client import (
-    _challenge_for_authz,
-    _normalize_challenge_types,
-    _normalize_identifiers,
-    _split_fullchain,
-)
-
-
-def test_normalize_identifiers_dedup_preserves_order():
-    assert _normalize_identifiers(["a.com", "b.com", "a.com", ""]) == ["a.com", "b.com"]
-
-
-def test_normalize_challenge_types_string_applies_to_all():
-    assert _normalize_challenge_types("dns-01", ["a.com", "b.com"]) == {
-        "a.com": "dns-01",
-        "b.com": "dns-01",
-    }
-
-
-def test_normalize_challenge_types_dict_per_identifier():
-    mapping = {"a.com": "dns-01", "b.com": "http-01"}
-    assert _normalize_challenge_types(mapping, ["a.com", "b.com"]) == mapping
-
-
-def test_normalize_challenge_types_missing_raises():
-    with pytest.raises(AcmeError):
-        _normalize_challenge_types({"a.com": "dns-01"}, ["a.com", "b.com"])
-
-
-def _authz(value, wildcard):
-    return SimpleNamespace(identifier=SimpleNamespace(value=value), wildcard=wildcard)
-
-
-def test_challenge_for_authz_plain():
-    body = _authz("example.com", False)
-    assert _challenge_for_authz({"example.com": "dns-01"}, body) == "dns-01"
-
-
-def test_challenge_for_authz_wildcard_reprefixes():
-    body = _authz("example.com", True)
-    assert _challenge_for_authz({"*.example.com": "dns-01"}, body) == "dns-01"
-
-
-def test_split_fullchain():
-    leaf = "-----BEGIN CERTIFICATE-----\nAAA\n-----END CERTIFICATE-----\n"
-    rest = "-----BEGIN CERTIFICATE-----\nBBB\n-----END CERTIFICATE-----\n"
-    leaf_pem, chain_pem = _split_fullchain(leaf + rest)
-    assert leaf_pem == leaf
-    assert chain_pem == rest
-
-
-def test_split_fullchain_no_marker():
-    leaf_pem, chain_pem = _split_fullchain("garbage")
-    assert leaf_pem == "garbage"
-    assert chain_pem == ""