openentity 0.4.0__tar.gz → 0.5.0__tar.gz

{openentity-0.4.0 → openentity-0.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openentity
-Version: 0.4.0
+Version: 0.5.0
 Summary: Open Entity (OEIS-1) client: JCS, did:key, eddsa-jcs-2022, Merkle proofs, adopt().
 Project-URL: Homepage, https://openentity.org
 Project-URL: Documentation, https://oeis.dev
@@ -43,4 +43,6 @@ Library, each taking the 32-byte seed and a registry URL: `adopt(name, registry=
 
 Shared core: `Identity.load_or_create()` (key in the OS keychain, else `~/.openentity/identity.key` at 0600; pass `.seed` to the calls above), `adopt(..., client="adk")` (an unsigned label: adk, goose, langchain, ui-tars, cli, other), `trust(eid)` (a `TrustReport` from registry reads only, every signature verified locally, cached 5 minutes, `ok=False` on any failure), and `openentity.issuer` (`attestation`, `revocation`, `did_document`, `openentity_json`).
 
+HTTP message signatures (RFC 9421, Web Bot Auth profile): `sign_request(method, url, body, private_key, did)` returns `Signature-Input`, `Signature` and, for a non-empty body, `Content-Digest` (`private_key` is an `Identity`, a `KeyPair` or a 32-byte seed; ed25519, `keyid` = the signer's did:key, covers `@method`, `@target-uri`, `content-digest`; `created`, `expires`, `nonce`). `verify_request(method, url, headers, body)` returns `{"did", "keyid", "created", "expires", "nonce"}` or raises `HttpSigError` with a `.code` (`missing_headers`, `unknown_alg`, `bad_keyid`, `digest_mismatch`, `created_in_future`, `created_too_old`, `expired`, `lifetime_too_long`, `missing_nonce`, `bad_signature`). Nonce replay tracking is yours. Shared vectors: `test-vectors/http-signature.json`.
+
 Written from the spec text alone, independent of the TypeScript SDK.

{openentity-0.4.0 → openentity-0.5.0}/README.md

@@ -30,4 +30,6 @@ Library, each taking the 32-byte seed and a registry URL: `adopt(name, registry=
 
 Shared core: `Identity.load_or_create()` (key in the OS keychain, else `~/.openentity/identity.key` at 0600; pass `.seed` to the calls above), `adopt(..., client="adk")` (an unsigned label: adk, goose, langchain, ui-tars, cli, other), `trust(eid)` (a `TrustReport` from registry reads only, every signature verified locally, cached 5 minutes, `ok=False` on any failure), and `openentity.issuer` (`attestation`, `revocation`, `did_document`, `openentity_json`).
 
+HTTP message signatures (RFC 9421, Web Bot Auth profile): `sign_request(method, url, body, private_key, did)` returns `Signature-Input`, `Signature` and, for a non-empty body, `Content-Digest` (`private_key` is an `Identity`, a `KeyPair` or a 32-byte seed; ed25519, `keyid` = the signer's did:key, covers `@method`, `@target-uri`, `content-digest`; `created`, `expires`, `nonce`). `verify_request(method, url, headers, body)` returns `{"did", "keyid", "created", "expires", "nonce"}` or raises `HttpSigError` with a `.code` (`missing_headers`, `unknown_alg`, `bad_keyid`, `digest_mismatch`, `created_in_future`, `created_too_old`, `expired`, `lifetime_too_long`, `missing_nonce`, `bad_signature`). Nonce replay tracking is yours. Shared vectors: `test-vectors/http-signature.json`.
+
 Written from the spec text alone, independent of the TypeScript SDK.

{openentity-0.4.0 → openentity-0.5.0}/openentity/__init__.py

@@ -1,7 +1,8 @@
 from .client import adopt, dispute, find, present, record, rotate, withdraw  # noqa: F401
 from .core import *  # noqa: F401,F403
 from . import issuer  # noqa: F401
+from .httpsig import HttpSigError, sign_request, verify_request  # noqa: F401
 from .identity import Identity  # noqa: F401
 from .report import TrustReport, trust  # noqa: F401
 
-__version__ = "0.4.0"
+__version__ = "0.5.0"

openentity-0.5.0/openentity/httpsig.py

@@ -0,0 +1,110 @@
+"""RFC 9421 HTTP message signatures, Open Entity profile: ed25519, keyid = the signer's did:key,
+covered ("@method" "@target-uri" "content-digest"), Content-Digest per RFC 9530, label sig1."""
+import base64
+import hashlib
+import os
+import re
+import time
+from collections.abc import Mapping
+
+from cryptography.exceptions import InvalidSignature
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey, Ed25519PublicKey
+
+from . import core
+
+SKEW = 5  # seconds of clock skew allowed on `created`
+
+
+class HttpSigError(Exception):
+    def __init__(self, code: str):
+        super().__init__(code)
+        self.code = code
+
+
+def _b64url(b: bytes) -> str:
+    return base64.urlsafe_b64encode(b).rstrip(b"=").decode()
+
+
+def _digest(body: bytes) -> str:
+    return f"sha-256=:{base64.b64encode(hashlib.sha256(body).digest()).decode()}:"
+
+
+def _base(method: str, url: str, components: list[str], digest: str | None, params: str) -> bytes:
+    lines = []
+    for c in components:
+        v = {"@method": method.upper(), "@target-uri": url, "content-digest": digest}[c]
+        lines.append(f'"{c}": {v}')
+    lines.append(f'"@signature-params": {params}')
+    return "\n".join(lines).encode()
+
+
+def _seed(key) -> bytes:
+    for attr in ("seed", "kp"):  # Identity -> KeyPair -> seed
+        if hasattr(key, attr):
+            return _seed(getattr(key, attr))
+    if isinstance(key, (bytes, bytearray)) and len(key) == 32:
+        return bytes(key)
+    raise ValueError("private_key must be an Identity, a KeyPair or a 32-byte Ed25519 seed")
+
+
+def sign_request(method: str, url: str, body: bytes, private_key, did: str, *, created: int | None = None,
+                 expires_in: int = 60, nonce: str | None = None) -> dict[str, str]:
+    created = int(time.time()) if created is None else created
+    nonce = nonce or _b64url(os.urandom(16))
+    out = {}
+    comps = ["@method", "@target-uri"]
+    if body:
+        out["Content-Digest"] = _digest(body)
+        comps.append("content-digest")
+    params = f'({" ".join(chr(34) + c + chr(34) for c in comps)});created={created};expires={created + expires_in};nonce="{nonce}";keyid="{did}";alg="ed25519"'
+    sig = Ed25519PrivateKey.from_private_bytes(_seed(private_key)).sign(_base(method, url, comps, out.get("Content-Digest"), params))
+    out["Signature-Input"] = f"sig1={params}"
+    out["Signature"] = f"sig1=:{base64.b64encode(sig).decode()}:"
+    return out
+
+
+def verify_request(method: str, url: str, headers: Mapping[str, str], body: bytes, *, now: int | None = None,
+                   max_age: int = 300) -> dict:
+    h = {k.lower(): v for k, v in headers.items()}
+    if "signature-input" not in h or "signature" not in h:
+        raise HttpSigError("missing_headers")
+    m = re.search(r"(?:^|,)\s*sig1=(\(([^)]*)\)((?:;[a-z]+=(?:\d+|\"[^\"]*\"))*))", h["signature-input"])
+    s = re.search(r"(?:^|,)\s*sig1=:([A-Za-z0-9+/]+={0,2}):", h["signature"])
+    if not m or not s:
+        raise HttpSigError("missing_headers")
+    params, comps = m.group(1), re.findall(r'"([^"]*)"', m.group(2))
+    p = {k: (v[1:-1] if v.startswith('"') else int(v)) for k, v in re.findall(r";([a-z]+)=(\d+|\"[^\"]*\")", m.group(3))}
+    if p.get("alg") != "ed25519":
+        raise HttpSigError("unknown_alg")
+    keyid = p.get("keyid", "")
+    try:
+        public = core.public_from_did_key(keyid)
+        if core.did_key(public) != keyid:
+            raise ValueError
+    except Exception:
+        raise HttpSigError("bad_keyid") from None
+    if not (isinstance(p.get("created"), int) and isinstance(p.get("expires"), int)):
+        raise HttpSigError("missing_headers")
+    if len(p.get("nonce", "")) < 22:  # 16 bytes in base64url
+        raise HttpSigError("missing_nonce")
+    if comps[:2] != ["@method", "@target-uri"] or comps[2:] not in ([], ["content-digest"]):
+        raise HttpSigError("missing_headers")
+    digest = None
+    if body or "content-digest" in comps:
+        digest = h.get("content-digest")
+        if "content-digest" not in comps or digest != _digest(body):
+            raise HttpSigError("digest_mismatch")
+    now = int(time.time()) if now is None else now
+    if p["created"] > now + SKEW:
+        raise HttpSigError("created_in_future")
+    if now - p["created"] > max_age:
+        raise HttpSigError("created_too_old")
+    if p["expires"] < now:
+        raise HttpSigError("expired")
+    if p["expires"] - p["created"] > max_age:
+        raise HttpSigError("lifetime_too_long")
+    try:
+        Ed25519PublicKey.from_public_bytes(public).verify(base64.b64decode(s.group(1)), _base(method, url, comps, digest, params))
+    except (InvalidSignature, ValueError):
+        raise HttpSigError("bad_signature") from None
+    return {"did": keyid, "keyid": keyid, "created": p["created"], "expires": p["expires"], "nonce": p["nonce"]}

{openentity-0.4.0 → openentity-0.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "openentity"
-version = "0.4.0"
+version = "0.5.0"
 description = "Open Entity (OEIS-1) client: JCS, did:key, eddsa-jcs-2022, Merkle proofs, adopt()."
 readme = "README.md"
 license = "MIT"

{openentity-0.4.0 → openentity-0.5.0}/tests/test_core.py

@@ -186,7 +186,7 @@ def test_adopt_and_cli(tmp_path, monkeypatch, capsys):
 def test_cli_version(capsys):
     with pytest.raises(SystemExit) as e:
         cli.main(["--version"])
-    assert e.value.code == 0 and "0.4.0" in capsys.readouterr().out
+    assert e.value.code == 0 and "0.5.0" in capsys.readouterr().out
 
 
 # ---- shared vectors, checked with the independent verifier's own logic ----

openentity-0.5.0/tests/test_httpsig.py

@@ -0,0 +1,116 @@
+import base64
+import json
+from pathlib import Path
+
+import pytest
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+from openentity import HttpSigError, Identity, core, sign_request, verify_request
+from openentity.httpsig import _base, _digest
+
+VEC = json.loads((Path(__file__).resolve().parents[3] / "test-vectors/http-signature.json").read_text())
+SEED = bytes(range(1, 33))  # published throwaway seed, test-vectors/keys.json
+KP = core.KeyPair(SEED)
+URL, NOW, BODY = "https://gw.example.com/v1/x", 1_800_000_000, b'{"a":1}'
+NONCE = "AAECAwQFBgcICQoLDA0ODw"
+
+
+def req(**kw):
+    return sign_request("POST", URL, BODY, SEED, KP.did, created=NOW, nonce=NONCE, **kw)
+
+
+def check(h, code, **kw):
+    with pytest.raises(HttpSigError) as e:
+        verify_request(kw.pop("method", "POST"), kw.pop("url", URL), h, kw.pop("body", BODY), now=kw.pop("now", NOW), **kw)
+    assert e.value.code == code
+
+
+def forge(params, comps=("@method", "@target-uri", "content-digest"), body=BODY, key=SEED):
+    """A correctly signed request with arbitrary Signature-Input parameters."""
+    h = {"Content-Digest": _digest(body)} if body else {}
+    sig = Ed25519PrivateKey.from_private_bytes(key).sign(_base("POST", URL, list(comps), h.get("Content-Digest"), params))
+    return {**h, "Signature-Input": f"sig1={params}", "Signature": f"sig1=:{base64.b64encode(sig).decode()}:"}
+
+
+def params(created=NOW, expires=NOW + 60, nonce=NONCE, keyid=KP.did, alg="ed25519", comps='"@method" "@target-uri" "content-digest"'):
+    n = f';nonce="{nonce}"' if nonce else ""
+    return f'({comps});created={created};expires={expires}{n};keyid="{keyid}";alg="{alg}"'
+
+
+@pytest.mark.parametrize("case", VEC["valid"], ids=lambda c: c["name"])
+def test_vectors_sign_and_verify(case):
+    h = sign_request(case["method"], case["url"], case["body"].encode(), SEED, VEC["did"], created=case["created"],
+                     expires_in=case["expires_in"], nonce=case["nonce"])
+    assert h == case["headers"]  # byte-identical to the TS SDK
+    out = verify_request(case["method"], case["url"], case["headers"], case["body"].encode(), now=VEC["now"])
+    assert out == {"did": VEC["did"], "keyid": VEC["did"], "created": case["created"], "expires": case["created"] + 60, "nonce": case["nonce"]}
+
+
+@pytest.mark.parametrize("case", VEC["invalid"], ids=lambda c: c["name"])
+def test_vectors_reject(case):
+    check(case["headers"], case["code"], method=case["method"], url=case["url"], body=case["body"].encode(), now=case.get("now", VEC["now"]))
+
+
+def test_roundtrip_and_key_types():
+    assert verify_request("post", URL, req(), BODY, now=NOW)["did"] == KP.did
+    for key in (KP, Identity(SEED, "test")):
+        assert sign_request("POST", URL, BODY, key, KP.did, created=NOW, nonce=NONCE) == req()
+    h = sign_request("GET", URL, b"", SEED, KP.did)
+    assert "Content-Digest" not in h and "content-digest" not in h["Signature-Input"]
+    assert verify_request("GET", URL, h, b"")["did"] == KP.did
+
+
+def test_header_lookup_is_case_insensitive():
+    h = {k.lower(): v for k, v in req().items()}
+    assert verify_request("POST", URL, h, BODY, now=NOW)
+
+
+def test_missing_headers():
+    check({}, "missing_headers")
+    check({k: v for k, v in req().items() if k != "Signature"}, "missing_headers")
+    check({**req(), "Signature": "garbage"}, "missing_headers")
+
+
+def test_unknown_alg():
+    check(forge(params(alg="rsa-pss-sha512")), "unknown_alg")
+
+
+def test_bad_keyid():
+    check(forge(params(keyid="did:web:example.com")), "bad_keyid")
+    check(forge(params(keyid="did:key:zQ3shokFTS3brHcDQrn82RUDfCZESWL1ZdCEJwekUDPQiYBme")), "bad_keyid")  # secp256k1
+
+
+def test_digest_mismatch():
+    check(req(), "digest_mismatch", body=b"other")
+    check({k: v for k, v in req().items() if k != "Content-Digest"}, "digest_mismatch")
+    check(forge(params(comps='"@method" "@target-uri"')), "digest_mismatch")  # body present, digest not covered
+
+
+def test_created_in_future_and_skew():
+    check(req(), "created_in_future", now=NOW - 6)
+    assert verify_request("POST", URL, req(), BODY, now=NOW - 5)
+
+
+def test_created_too_old():
+    check(forge(params(created=NOW - 400, expires=NOW + 10)), "created_too_old")
+    check(req(), "created_too_old", now=NOW + 301, max_age=300)
+
+
+def test_expired():
+    check(req(), "expired", now=NOW + 61)
+
+
+def test_lifetime_too_long():
+    check(forge(params(expires=NOW + 301)), "lifetime_too_long")
+    check(sign_request("POST", URL, BODY, SEED, KP.did, created=NOW, nonce=NONCE, expires_in=200), "lifetime_too_long", max_age=100)
+
+
+def test_missing_nonce():
+    check(forge(params(nonce=None)), "missing_nonce")
+    check(forge(params(nonce="short")), "missing_nonce")
+
+
+def test_bad_signature():
+    check(req(), "bad_signature", url=URL + "?y=1")
+    check(req(), "bad_signature", method="GET")
+    check(forge(params(), key=bytes(32)), "bad_signature")  # signed by another key

{openentity-0.4.0 → openentity-0.5.0}/uv.lock

@@ -189,7 +189,7 @@ wheels = [
 
 [[package]]
 name = "openentity"
-version = "0.4.0"
+version = "0.5.0"
 source = { editable = "." }
 dependencies = [
     { name = "cryptography" },