envelope 2.2.1__tar.gz → 2.3.0__tar.gz

{envelope-2.2.1 → envelope-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: envelope
-Version: 2.2.1
+Version: 2.3.0
 Summary: Insert a message and attachments and send e-mail / sign / encrypt contents by a single line.
 License: LGPL-3.0-or-later
 Author: Edvard Rejthar

{envelope-2.2.1 → envelope-2.3.0}/envelope/envelope.py

@@ -1275,29 +1275,32 @@ class Envelope:
     def _import_cryptoraphy_modules(self):
         try:
             from cryptography.hazmat.primitives.serialization import load_pem_private_key, pkcs7
-            from cryptography.x509 import load_pem_x509_certificate
+            from cryptography.x509 import load_pem_x509_certificates, load_pem_x509_certificate
             from cryptography.hazmat.primitives import hashes, serialization
-            return load_pem_private_key, pkcs7, load_pem_x509_certificate, hashes, serialization
+            return load_pem_private_key, pkcs7, load_pem_x509_certificates, load_pem_x509_certificate, hashes, serialization
         except ImportError:
             raise ImportError(smime_import_error)
 
     def smime_sign_only(self, email, sign):
-        load_pem_private_key, pkcs7, load_pem_x509_certificate, hashes, serialization = self._import_cryptoraphy_modules()
+        load_pem_private_key, pkcs7, load_pem_x509_certificates, _, hashes, serialization = self._import_cryptoraphy_modules()
         # get sender's cert
         # cert and private key can be one file
 
         # if certfile is not provided, sign has to have both private key and certificate
         # cert is not in sign (--sign_path file), it is cert.pem
         if self._cert:
-            cert = self._cert
+            certs = self._cert
         else:
             # certificate is in sign (--sign_path file), it is key-cert-together.pem
-            cert = sign
+            certs = sign
 
         try:
-            cert = load_pem_x509_certificate(cert)
+            certs = load_pem_x509_certificates(certs)
         except ValueError as e:
             raise ValueError(f"Certificate not found: {e}")
+        # no certificate found
+        if len(certs) == 0:
+            raise ValueError("Certificate not found")
 
         # get senders private key for signing
         try:
@@ -1312,29 +1315,36 @@ class Envelope:
 
         options = [pkcs7.PKCS7Options.DetachedSignature]
 
-        signed_email = pkcs7.PKCS7SignatureBuilder().set_data(
+        signature_builder = pkcs7.PKCS7SignatureBuilder().set_data(
             email
         ).add_signer(
-            cert, key, hashes.SHA256()
-        ).sign(
+            certs[0], key, hashes.SHA256()
+        )
+        # add the whole certificate chain
+        for cert in certs[1:]:
+            signature_builder = signature_builder.add_certificate(cert)
+
+        signed_email = signature_builder.sign(
             serialization.Encoding.SMIME, options
         )
 
         return signed_email
 
     def smime_sign_encrypt(self, email, sign, encrypt):
-        load_pem_private_key, pkcs7, load_pem_x509_certificate, hashes, serialization = self._import_cryptoraphy_modules()
+        load_pem_private_key, pkcs7, load_pem_x509_certificates, load_pem_x509_certificate, hashes, serialization = self._import_cryptoraphy_modules()
 
         if self._cert:
-            sender_cert = self._cert
+            sender_certs = self._cert
         else:
             # certificate is in sign (--sign_path file), it is key-cert-together.pem
-            sender_cert = sign
+            sender_certs = sign
 
         try:
-            sender_cert = load_pem_x509_certificate(sender_cert)
+            sender_certs = load_pem_x509_certificates(sender_certs)
         except ValueError as e:
             logger.warning(f"Certificate not found: {e}")
+        if len(sender_certs) == 0:
+            raise ValueError("Certificate not found")
 
         # get senders private key for signing
         try:
@@ -1348,7 +1358,10 @@ class Envelope:
 
         # sign the message first
         signature_builder = pkcs7.PKCS7SignatureBuilder().set_data(email)
-        signature_builder = signature_builder.add_signer(sender_cert, sender_key, hash_algorithm=hashes.SHA256())
+        signature_builder = signature_builder.add_signer(sender_certs[0], sender_key, hash_algorithm=hashes.SHA256())
+        # add the whole certificate chain
+        for cert in sender_certs[1:]:
+            signature_builder = signature_builder.add_certificate(cert)
         signed_email = signature_builder.sign(serialization.Encoding.SMIME, [pkcs7.PKCS7Options.DetachedSignature])
 
         # get recipent's certificate for encryption
@@ -1385,7 +1398,7 @@ class Envelope:
 
     def smime_encrypt_only(self, email, encrypt):
 
-        _, pkcs7, load_pem_x509_certificate, _, serialization = self._import_cryptoraphy_modules()
+        _, pkcs7, _, load_pem_x509_certificate, _, serialization = self._import_cryptoraphy_modules()
 
         if self._cert:
             certificates = [self._cert]

{envelope-2.2.1 → envelope-2.3.0}/envelope/smtp_handler.py

@@ -33,6 +33,8 @@ class SMTPHandler:
         d = locals()
         del d["self"]
         self.key = repr(d)
+        d["password"] = "********"
+        self.obfuscated_key = repr(d)
 
     def connect(self):
         if self.instance:  # we received this instance as is so we suppose it is already connected
@@ -55,13 +57,13 @@ class SMTPHandler:
                     smtp.login(self.user, self.password)
                 except SMTPAuthenticationError as e:
                     logger.error(
-                        f"SMTP authentication failed: {self.key}.\n{e}")
+                        f"SMTP authentication failed: {self.obfuscated_key}.\n{e}")
                     return False
         except SMTPException as e:
-            logger.error(f"SMTP connection failed: {self.key}.\n{e}")
+            logger.error(f"SMTP connection failed: {self.obfuscated_key}.\n{e}")
             return False
         except (gaierror, ConnectionError):
-            logger.error(f"SMTP connection refused: {self.key}.")
+            logger.error(f"SMTP connection refused: {self.obfuscated_key}.")
             return False
         return smtp
 

{envelope-2.2.1 → envelope-2.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "poetry.core.masonry.api"
 
 [tool.poetry]
 name = "envelope"
-version = "2.2.1"
+version = "2.3.0"
 description = "Insert a message and attachments and send e-mail / sign / encrypt contents by a single line."
 authors = ["Edvard Rejthar <edvard.rejthar@nic.cz>"]
 license = "LGPL-3.0-or-later"