nrfcloud-utils 3.2.1__tar.gz → 3.3.0__tar.gz

{nrfcloud_utils-3.2.1 → nrfcloud_utils-3.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: nrfcloud-utils
-Version: 3.2.1
+Version: 3.3.0
 Summary: Scripts and utilities for working with the nRF Cloud
 License-Expression: BSD-3-Clause
 License-File: LICENSE.txt
@@ -12,10 +12,10 @@ Classifier: Programming Language :: Python :: 3.11
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Programming Language :: Python :: 3.13
 Classifier: Programming Language :: Python :: 3.14
-Requires-Dist: cbor2 (>=5.6.5)
+Requires-Dist: cbor2 (>=5.9.0)
 Requires-Dist: cffi (>=2.0.0)
 Requires-Dist: cryptography (>=49.0.0)
-Requires-Dist: idna (>=3.10)
+Requires-Dist: idna (>=3.15)
 Requires-Dist: inquirer (>=3.4.0)
 Requires-Dist: nrfcredstore (>=2.1.0)
 Requires-Dist: pyjwt (>=2.13.0)

{nrfcloud_utils-3.2.1 → nrfcloud_utils-3.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "poetry.core.masonry.api"
 
 [project]
 name = "nrfcloud-utils"
-version = "3.2.1"
+version = "3.3.0"
 description = "Scripts and utilities for working with the nRF Cloud"
 license = "BSD-3-Clause"
 readme = "README.md"
@@ -13,11 +13,11 @@ authors = [
     { name = "Nordic Semiconductor ASA" }
 ]
 dependencies = [
-    "cbor2>=5.6.5",
+    "cbor2>=5.9.0",
     "cryptography>=49.0.0",
     "cffi>=2.0.0",
     "requests>=2.34.2",
-    "idna>=3.10",
+    "idna>=3.15",
     "urllib3>=2.7.0",
     "semver>=3.0.0",
     "pyjwt>=2.13.0",

{nrfcloud_utils-3.2.1 → nrfcloud_utils-3.3.0}/src/nrfcloud_utils/cli_helpers.py

@@ -6,6 +6,7 @@
 
 from os import path
 from os import makedirs
+from importlib.metadata import version, PackageNotFoundError
 import platform
 import os
 import csv
@@ -21,6 +22,16 @@ full_encoding = 'mbcs' if is_windows else 'ascii'
 
 logger = logging.getLogger(__name__)
 
+try:
+    _package_version = version('nrfcloud-utils')
+except PackageNotFoundError:
+    _package_version = 'unknown'
+
+USER_AGENT = (
+    f'nrfcloud-utils/{_package_version} '
+    f'({platform.system()} {platform.release()}; Python {platform.python_version()})'
+)
+
 def setup_logging(level='info', fmt='%(levelname)-8s %(message)s', use_color=True):
     """
     Configure colored logging with dark-terminal-friendly colors.
@@ -217,6 +228,7 @@ CMD_TERM_DICT = {'NULL': '\0',
 CMD_TYPE_AT = "at"
 CMD_TYPE_AT_SHELL = "at_shell"
 CMD_TYPE_TLS_SHELL = "tls_cred_shell"
+CMD_TYPE_NRF_CLOUD_CRED_SHELL = "nrf_cloud_cred_shell"
 CMD_TYPE_AUTO = "auto"
 
 def parser_add_comms_args(parser):
@@ -244,8 +256,8 @@ def parser_add_comms_args(parser):
     parser.add_argument("--rtt",
                         help="Use RTT instead of serial. Requires device run Modem Shell sample application configured with RTT overlay",
                         action='store_true', default=False)
-    parser.add_argument("--cmd-type", default=CMD_TYPE_AUTO, choices=[CMD_TYPE_AUTO, CMD_TYPE_AT, CMD_TYPE_AT_SHELL, CMD_TYPE_TLS_SHELL], type=str.lower,
-                    help=f"Specify the device command line type. '{CMD_TYPE_AT}' will use AT commands, '{CMD_TYPE_AT_SHELL}' will prefix AT commands with 'at ', and '{CMD_TYPE_TLS_SHELL}' will use TLS Credentials Shell commands.")
+    parser.add_argument("--cmd-type", default=CMD_TYPE_AUTO, choices=[CMD_TYPE_AUTO, CMD_TYPE_AT, CMD_TYPE_AT_SHELL, CMD_TYPE_TLS_SHELL, CMD_TYPE_NRF_CLOUD_CRED_SHELL], type=str.lower,
+                    help=f"Specify the device command line type. '{CMD_TYPE_AT}' will use AT commands, '{CMD_TYPE_AT_SHELL}' will prefix AT commands with 'at ', '{CMD_TYPE_TLS_SHELL}' will use TLS Credentials Shell commands, and '{CMD_TYPE_NRF_CLOUD_CRED_SHELL}' will use the nrf_cloud_cred shell commands to generate the device key and CSR on-device.")
     parser.add_argument("--term", type=str,
                         help="AT command termination",choices=list(CMD_TERM_DICT.keys()),
                         default='CRLF')

{nrfcloud_utils-3.2.1 → nrfcloud_utils-3.3.0}/src/nrfcloud_utils/device_credentials_installer.py

@@ -9,12 +9,13 @@ import re
 import os
 import sys
 import uuid
+import base64
 import semver
 import logging
 from nrfcloud_utils import create_device_credentials, ca_certs, modem_credentials_parser
 from nrfcloud_utils.cli_helpers import write_file, save_devinfo_csv, save_onboarding_csv, full_encoding, setup_logging
-from nrfcloud_utils.cli_helpers import CMD_TERM_DICT, CMD_TYPE_AUTO, CMD_TYPE_AT, CMD_TYPE_AT_SHELL, CMD_TYPE_TLS_SHELL, parser_add_comms_args
-from nrfcredstore.command_interface import ATCommandInterface, TLSCredShellInterface
+from nrfcloud_utils.cli_helpers import CMD_TERM_DICT, CMD_TYPE_AUTO, CMD_TYPE_AT, CMD_TYPE_AT_SHELL, CMD_TYPE_TLS_SHELL, CMD_TYPE_NRF_CLOUD_CRED_SHELL, parser_add_comms_args
+from nrfcredstore.command_interface import ATCommandInterface, TLSCredShellInterface, NrfCloudCredShellInterface
 from nrfcredstore.comms import Comms
 
 from cryptography import x509
@@ -148,7 +149,9 @@ def check_mfw_version(cred_if):
     # check for required version
     parsed_ver = parse_mfw_ver(ver)
 
-    if parsed_ver is None:
+    if "ntn" in ver:
+        pass
+    elif parsed_ver is None:
         logger.error('Unexpected modem FW version format... continuing')
     elif semver.Version.parse(parsed_ver).compare(MIN_REQD_MFW_VER) < 0:
         logger.error(f'Modem FW version must be >= {MIN_REQD_MFW_VER}')
@@ -172,8 +175,13 @@ def get_csr(cred_if, custom_dev_id = "", sectag = 0, local = False):
             logger.error('Failed to obtain CSR from device')
             sys.exit(9)
 
-        csr_bytes, _, _, _ = modem_credentials_parser.parse_keygen_output(csr_blob)
-        csr = x509.load_pem_x509_csr(csr_bytes)
+        if isinstance(cred_if, NrfCloudCredShellInterface):
+            # The nrf_cloud_cred shell returns a plain Base64-encoded DER CSR,
+            # not the modem's "body.cose" format.
+            csr = x509.load_der_x509_csr(base64.b64decode(csr_blob))
+        else:
+            csr_bytes, _, _, _ = modem_credentials_parser.parse_keygen_output(csr_blob)
+            csr = x509.load_pem_x509_csr(csr_bytes)
 
     return csr, local_priv_key
 
@@ -217,7 +225,14 @@ def main(in_args):
         logger.error(f"cmd_type '{CMD_TYPE_TLS_SHELL}' currently requires --local_cert or --local_cert_file")
         sys.exit(1)
 
-    if args.cmd_type == CMD_TYPE_TLS_SHELL and id_len == 0:
+    if args.cmd_type == CMD_TYPE_NRF_CLOUD_CRED_SHELL and (args.local_cert or args.local_cert_file):
+        # The key and CSR are generated on-device; generating a key on the host
+        # would defeat the purpose and is almost certainly a mistake.
+        logger.error(f"cmd_type '{CMD_TYPE_NRF_CLOUD_CRED_SHELL}' generates the key on-device; "
+                     "do not use --local-cert or --local-cert-file")
+        sys.exit(1)
+
+    if args.cmd_type in (CMD_TYPE_TLS_SHELL, CMD_TYPE_NRF_CLOUD_CRED_SHELL) and id_len == 0:
         args.id_str = str(uuid.uuid4())
 
     cmd_type_has_at = args.cmd_type in (CMD_TYPE_AT, CMD_TYPE_AT_SHELL, CMD_TYPE_AUTO)
@@ -250,6 +265,10 @@ def main(in_args):
         cred_if = TLSCredShellInterface(serial_interface)
         has_shell = True
 
+    if args.cmd_type == CMD_TYPE_NRF_CLOUD_CRED_SHELL:
+        cred_if = NrfCloudCredShellInterface(serial_interface)
+        has_shell = True
+
     # prepare modem so we can interact with security keys
     if (cmd_type_has_at):
         logger.info('Disabling LTE and GNSS...')
@@ -416,10 +435,11 @@ def main(in_args):
 
         # AT-command-based SHA check has a modem firmware version requirement
         if (cmd_type_has_at):
-            parsed_ver = parse_mfw_ver(mfw_ver)
-            if parsed_ver and semver.Version.parse(parsed_ver).compare(MIN_REQD_MFW_VER_FOR_VERIFY) < 0:
-                logger.error(f'Skipping SHA verification, modem FW version must be >= {MIN_REQD_MFW_VER_FOR_VERIFY}')
-                check_sha = False
+            if "ntn" not in mfw_ver:
+                parsed_ver = parse_mfw_ver(mfw_ver)
+                if parsed_ver and semver.Version.parse(parsed_ver).compare(MIN_REQD_MFW_VER_FOR_VERIFY) < 0:
+                    logger.error(f'Skipping SHA verification, modem FW version must be >= {MIN_REQD_MFW_VER_FOR_VERIFY}')
+                    check_sha = False
 
         verify_res = verify_credentials(cred_if, args.sectag, nrf_ca_cert_text, dev_text, prv_text,
                                         check_sha=check_sha)
@@ -443,6 +463,27 @@ def main(in_args):
     if args.devinfo:
         save_devinfo_csv(args.devinfo, args.devinfo_append, args.replace, dev_id, mfw_ver, imei)
 
+def verify_on_device_key(cred_if, sec_tag, client_cert):
+    # The on-device private key is non-exportable, so it cannot be verified by
+    # hash. Instead, confirm that the device public key matches the public key
+    # in the installed device certificate.
+    logger.info('Verifying Private Key')
+    dev_pub = cred_if.get_pubkey(sec_tag)
+    if not dev_pub:
+        logger.error('...Failed to read device public key')
+        return False
+
+    cert = x509.load_pem_x509_certificate(client_cert.encode())
+    cert_pub = cert.public_key().public_bytes(
+        serialization.Encoding.X962, serialization.PublicFormat.UncompressedPoint)
+
+    if dev_pub != cert_pub:
+        logger.error('...Device public key does not match the device certificate')
+        return False
+
+    logger.info('...Private Key matches device certificate')
+    return True
+
 def verify_credentials(cred_if, sec_tag, ca_cert, client_cert, client_prv=None, check_sha=False):
     # verify the CA cert
     if not verify_credential(cred_if, sec_tag, 0, ca_cert, verify_hash = check_sha):
@@ -452,6 +493,11 @@ def verify_credentials(cred_if, sec_tag, ca_cert, client_cert, client_prv=None,
     if not verify_credential(cred_if, sec_tag, 1, client_cert, verify_hash = check_sha):
         return False
 
+    # The on-device key is opaque (held in PSA); verify it by matching the
+    # device public key to the certificate instead of by hash.
+    if isinstance(cred_if, NrfCloudCredShellInterface):
+        return verify_on_device_key(cred_if, sec_tag, client_cert)
+
     if not verify_credential(cred_if, sec_tag, 2, client_prv, get_hash = check_sha,
                              verify_hash = (client_prv is not None) and check_sha):
         return False
@@ -493,7 +539,7 @@ def verify_credential(cred_if, sec_tag, cred_type, cred = None, get_hash = False
             logger.error(f'...Failed to calculate hash for {cred_type_name}')
             logger.debug(f'Error details: {e}')
             return False
-            
+
         if hash != expected_hash:
                 logger.error(f'{cred_type_name} - SHA mismatch:')
                 logger.error(f'\tDevice    : {hash}')

{nrfcloud_utils-3.2.1 → nrfcloud_utils-3.3.0}/src/nrfcloud_utils/nrf93_onboard.py

@@ -12,6 +12,7 @@ import requests
 import coloredlogs
 from nrfcredstore.comms import Comms
 from nrfcredstore.command_interface import ATCommandInterface
+from nrfcloud_utils.cli_helpers import USER_AGENT
 
 logger = logging.getLogger(__name__)
 
@@ -144,7 +145,7 @@ def set_dev_stage(stage = ''):
     return api_url
 
 def fetch_tenant_id(api_key):
-    hdr = {'Authorization': 'Bearer ' + api_key}
+    hdr = {'Authorization': 'Bearer ' + api_key, 'User-Agent': USER_AGENT}
     req = api_url + "account"
     response = requests.get(req, headers=hdr)
     if not response.ok:
@@ -192,6 +193,7 @@ def onboard_device(api_key, dev_id, sub_type, tags, fw_types, onboarding_token):
     hdr = {
         'Authorization': 'Bearer ' + api_key,
         'Accept': 'application/json',
+        'User-Agent': USER_AGENT,
     }
 
     req = api_url + "devices/" + dev_id

{nrfcloud_utils-3.2.1 → nrfcloud_utils-3.3.0}/src/nrfcloud_utils/nrf_cloud_device_mgmt.py

@@ -12,6 +12,7 @@ import urllib
 from urllib.parse import quote_plus as url_encode
 from datetime import datetime
 from enum import Enum
+from nrfcloud_utils.cli_helpers import USER_AGENT
 
 API_URL = "https://api.nrfcloud.com/v1/"
 
@@ -229,7 +230,7 @@ def parse_args(in_args):
 
 def get_bundle_list(api_key, modem_only):
 
-    hdr = {'Authorization': 'Bearer ' + api_key}
+    hdr = {'Authorization': 'Bearer ' + api_key, 'User-Agent': USER_AGENT}
     req_base = f'{GET_BUNDLES_BASE}?pageLimit={GET_BUNDLES_PAGE_LIMIT}'
 
     if modem_only:
@@ -273,7 +274,7 @@ def get_requested_bundles(api_key, fota_type):
     return [i for i in bundles if i.type == fota_type.name]
 
 def get_device_list(api_key, fota_types_list, device_id):
-    hdr = {'Authorization': 'Bearer ' + api_key}
+    hdr = {'Authorization': 'Bearer ' + api_key, 'User-Agent': USER_AGENT}
     req_base = GET_DEVICES_BASE + f'&pageLimit={GET_DEVICES_PAGE_LIMIT}'
 
     if fota_types_list:
@@ -321,7 +322,7 @@ def print_api_result(custom_text, api_result, print_response_txt):
 
 def create_fota_job(api_key, json_payload_obj):
     jobId = None
-    hdr = {'Authorization': f'Bearer {api_key}'}
+    hdr = {'Authorization': f'Bearer {api_key}', 'User-Agent': USER_AGENT}
     req = FOTA_JOBS_BASE
 
     api_res = requests.post(req, json=json_payload_obj, headers=hdr)

{nrfcloud_utils-3.2.1 → nrfcloud_utils-3.3.0}/src/nrfcloud_utils/nrf_cloud_diap.py

@@ -7,6 +7,7 @@
 import requests
 import logging
 from nrfcloud_utils import ca_certs
+from nrfcloud_utils.cli_helpers import USER_AGENT
 
 DEV_STAGE_DICT = {'dev':     '.dev.',
                   'beta':    '.beta.',
@@ -44,7 +45,7 @@ def set_dev_stage(stage = ''):
 def get_auth_header(api_key):
     if not api_key:
         return None
-    return  { AUTH : BEARER + api_key}
+    return { AUTH : BEARER + api_key, 'User-Agent': USER_AGENT }
 
 def claim_device(api_key, claim_token, tags = None):
     global api_url

{nrfcloud_utils-3.2.1 → nrfcloud_utils-3.3.0}/src/nrfcloud_utils/nrf_cloud_onboard.py

@@ -15,7 +15,7 @@ import io
 import logging
 from os import makedirs
 from enum import Enum
-from nrfcloud_utils.cli_helpers import write_file, setup_logging
+from nrfcloud_utils.cli_helpers import write_file, setup_logging, USER_AGENT
 
 logger = logging.getLogger(__name__)
 
@@ -105,22 +105,22 @@ def set_dev_stage(stage = ''):
     return api_url
 
 def get_bulk_ops_result(api_key, bulk_ops_req_id):
-    hdr = {'Authorization': 'Bearer ' + api_key}
+    hdr = {'Authorization': 'Bearer ' + api_key, 'User-Agent': USER_AGENT}
     req = api_url + "bulk-ops-requests/" + bulk_ops_req_id
     return requests.get(req, headers=hdr)
 
 def update_device_shadow(api_key, device_id, json_payload):
-    hdr = {'Authorization': 'Bearer ' + api_key}
+    hdr = {'Authorization': 'Bearer ' + api_key, 'User-Agent': USER_AGENT}
     req = api_url + "devices/" + device_id + "/state"
     return requests.patch(req, json=json_payload, headers=hdr)
 
 def fetch_device(api_key, device_id):
-    hdr = {'Authorization': 'Bearer ' + api_key}
+    hdr = {'Authorization': 'Bearer ' + api_key, 'User-Agent': USER_AGENT}
     req = api_url + "devices/" + device_id
     return requests.get(req, headers=hdr)
 
 def update_device_name(api_key, device_id, name):
-    hdr = {'Authorization': 'Bearer ' + api_key}
+    hdr = {'Authorization': 'Bearer ' + api_key, 'User-Agent': USER_AGENT}
     req = api_url + "devices/" + device_id + "/name"
     json_payload = [name]
     return requests.put(req, json=json_payload, headers=hdr)
@@ -128,7 +128,8 @@ def update_device_name(api_key, device_id, name):
 def onboard_device(api_key, dev_id, sub_type, tags, fw_types, cert_pem_str):
     hdr = {'Authorization': 'Bearer ' + api_key,
            'content-type' : 'text/plain',
-           'Accept-Encoding' : '*'}
+           'Accept-Encoding' : '*',
+           'User-Agent': USER_AGENT}
 
     req = api_url + "devices"
 
@@ -139,7 +140,8 @@ def onboard_device(api_key, dev_id, sub_type, tags, fw_types, cert_pem_str):
 def onboard_devices(api_key, csv_filepath):
     hdr = {'Authorization': 'Bearer ' + api_key,
            'content-type' : 'text/csv',
-           'Accept-Encoding' : '*'}
+           'Accept-Encoding' : '*',
+           'User-Agent': USER_AGENT}
 
     req = api_url + "devices"