devnomads 0.2.1__tar.gz → 0.2.2__tar.gz

{devnomads-0.2.1 → devnomads-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: devnomads
-Version: 0.2.1
+Version: 0.2.2
 Summary: Python client library for the DevNomads API (transport, DNS, ACME)
 Project-URL: Homepage, https://devnomads.nl
 Author-email: Loek Geleijn <support@devnomads.nl>

{devnomads-0.2.1 → devnomads-0.2.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "devnomads"
-version = "0.2.1"
+version = "0.2.2"
 description = "Python client library for the DevNomads API (transport, DNS, ACME)"
 readme = "README.md"
 requires-python = ">=3.10"

{devnomads-0.2.1 → devnomads-0.2.2}/src/devnomads/acme/__init__.py

@@ -21,7 +21,13 @@ try:
     from .dns01 import DevNomadsDnsProvider, DnsProvider
     from .errors import AcmeError
     from .http01 import Http01Solver, StandaloneSolver, WebrootSolver
-    from .keys import build_csr, generate_key, load_or_create_account_key, serialize_key
+    from .keys import (
+        build_csr,
+        generate_key,
+        jws_alg,
+        load_or_create_account_key,
+        serialize_key,
+    )
     from .verify import verify_txt_record
 except ImportError as exc:  # pragma: no cover - exercised via packaging
     if (exc.name or "").split(".")[0] in _EXTRA_MODULES:
@@ -44,6 +50,7 @@ __all__ = [
     "build_csr",
     "generate_key",
     "serialize_key",
+    "jws_alg",
     "load_or_create_account_key",
     "verify_txt_record",
 ]

{devnomads-0.2.1 → devnomads-0.2.2}/src/devnomads/acme/client.py

@@ -14,7 +14,13 @@ from acme import messages
 from .dns01 import DnsProvider
 from .errors import AcmeError
 from .http01 import Http01Solver
-from .keys import PrivateKey, build_csr, load_or_create_account_key, serialize_key
+from .keys import (
+    PrivateKey,
+    build_csr,
+    jws_alg,
+    load_or_create_account_key,
+    serialize_key,
+)
 from .verify import verify_txt_record
 
 log = logging.getLogger("devnomads.acme")
@@ -72,7 +78,9 @@ class AcmeClient:
         account_key = load_or_create_account_key(
             self.account_key_path, self.account_key_algorithm
         )
-        net = acme_client.ClientNetwork(account_key, user_agent=self.user_agent)
+        net = acme_client.ClientNetwork(
+            account_key, alg=jws_alg(account_key), user_agent=self.user_agent
+        )
         directory = messages.Directory.from_json(net.get(self.directory_url).json())
         client = acme_client.ClientV2(directory, net)
 

{devnomads-0.2.1 → devnomads-0.2.2}/src/devnomads/acme/keys.py

@@ -8,6 +8,7 @@ from __future__ import annotations
 
 import os
 
+import josepy
 from cryptography import x509
 from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import hashes, serialization
@@ -88,6 +89,26 @@ def load_or_create_account_key(path: str, algorithm: str):
     raise AcmeError("unsupported account key type")
 
 
+def jws_alg(account_key):
+    """Return the JWS signing algorithm matching an account JWK.
+
+    ``acme.client.ClientNetwork`` defaults to RS256, so pairing it with an
+    EC account key makes josepy reject the signature (the key is not an
+    instance of the algorithm's key type). The alg must follow the key.
+    """
+
+    if isinstance(account_key, jwk.JWKRSA):
+        return josepy.RS256
+    if isinstance(account_key, jwk.JWKEC):
+        curve = account_key.key.curve.name
+        if curve == "secp256r1":
+            return josepy.ES256
+        if curve == "secp384r1":
+            return josepy.ES384
+        raise AcmeError(f"unsupported account key curve: {curve}")
+    raise AcmeError("unsupported account key type")
+
+
 def build_csr(private_key: PrivateKey, identifiers: list[str]) -> bytes:
     """Build a PEM CSR: ``identifiers[0]`` is the CN, all are SANs."""
 

{devnomads-0.2.1 → devnomads-0.2.2}/tests/test_acme_client.py

@@ -69,11 +69,18 @@ def test_init_client_registers_with_new_registration(monkeypatch, tmp_path):
     it to new_account; this exercises the message construction that a wrong
     class name (e.g. the non-existent NewAccount) would break."""
 
+    import josepy
     from acme import messages
+    from cryptography.hazmat.backends import default_backend
+    from cryptography.hazmat.primitives.asymmetric import ec
+    from josepy import jwk
 
     from devnomads.acme import client as client_mod
 
     captured = {}
+    account_key = jwk.JWKEC(
+        key=ec.generate_private_key(ec.SECP256R1(), backend=default_backend())
+    )
 
     class FakeResponse:
         def json(self):
@@ -81,6 +88,7 @@ def test_init_client_registers_with_new_registration(monkeypatch, tmp_path):
 
     class FakeNetwork:
         def __init__(self, *args, **kwargs):
+            captured["alg"] = kwargs.get("alg")
             self.account = None
 
         def get(self, url):
@@ -95,7 +103,7 @@ def test_init_client_registers_with_new_registration(monkeypatch, tmp_path):
             return SimpleNamespace(uri="https://acme.example/acct/1")
 
     monkeypatch.setattr(
-        client_mod, "load_or_create_account_key", lambda *a, **k: object()
+        client_mod, "load_or_create_account_key", lambda *a, **k: account_key
     )
     monkeypatch.setattr(client_mod.acme_client, "ClientNetwork", FakeNetwork)
     monkeypatch.setattr(client_mod.acme_client, "ClientV2", FakeClientV2)
@@ -108,6 +116,9 @@ def test_init_client_registers_with_new_registration(monkeypatch, tmp_path):
     )
     client, _account_key = ac._init_client()
 
+    # an EC account key must be signed with ES256, not the ClientNetwork
+    # default of RS256, or josepy rejects the JWS.
+    assert captured["alg"] == josepy.ES256
     registration = captured["registration"]
     assert isinstance(registration, messages.NewRegistration)
     assert registration.contact == ("mailto:ops@example.com",)

{devnomads-0.2.1 → devnomads-0.2.2}/tests/test_acme_keys.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import os
 import stat
 
+import josepy
 import pytest
 from cryptography import x509
 from cryptography.hazmat.primitives.asymmetric import ec, rsa
@@ -14,9 +15,11 @@ from devnomads.acme import (
     AcmeError,
     build_csr,
     generate_key,
+    jws_alg,
     load_or_create_account_key,
     serialize_key,
 )
+from devnomads.acme.keys import jwk
 
 
 def test_generate_rsa():
@@ -68,3 +71,20 @@ def test_account_key_reused(tmp_path):
     content = open(path, "rb").read()
     load_or_create_account_key(path, "ec256")
     assert open(path, "rb").read() == content
+
+
+def test_jws_alg_rsa():
+    assert jws_alg(jwk.JWKRSA(key=generate_key("rsa2048"))) is josepy.RS256
+
+
+def test_jws_alg_ec256():
+    assert jws_alg(jwk.JWKEC(key=generate_key("ec256"))) is josepy.ES256
+
+
+def test_jws_alg_ec384():
+    assert jws_alg(jwk.JWKEC(key=generate_key("ec384"))) is josepy.ES384
+
+
+def test_jws_alg_unsupported_type():
+    with pytest.raises(AcmeError):
+        jws_alg(object())

{devnomads-0.2.1 → devnomads-0.2.2}/uv.lock

@@ -468,7 +468,7 @@ wheels = [
 
 [[package]]
 name = "devnomads"
-version = "0.2.1"
+version = "0.2.2"
 source = { editable = "." }
 dependencies = [
     { name = "httpx" },