project-enclave-tools 0.1.1__tar.gz

project_enclave_tools-0.1.1/PKG-INFO

@@ -0,0 +1,54 @@
+Metadata-Version: 2.4
+Name: project-enclave-tools
+Version: 0.1.1
+Summary: Tools made mainly to help the devs of project enclave and other sub projects under it
+Author-email: Pradhya <Pradhya@projectenclave.dev>
+Project-URL: Repository, https://github.com/Chinglen2080/dev-tools
+Project-URL: Issues, https://github.com/Chinglen2080/dev-tools/issues
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+
+# Dev Tools
+
+Dev Tools is a small command-line toolkit for contributors to [Project Enclave](https://github.com/project-enclave). It currently provides signed SHA256 manifests for release files.
+
+## Installation
+
+Install the current public release with `pipx`:
+
+```bash
+pipx install "git+https://github.com/Chinglen2080/dev-tools.git@v0.1.1"
+```
+
+OpenSSL must be installed and available on your `PATH` for key generation and signing.
+
+## Signing release files
+
+Generate a 2048-bit RSA key pair the first time you use the signing tool:
+
+```bash
+tools sign --init
+```
+
+The keys are stored in `~/.config/dev-tools/keys/`. Keep `private.pem` private; distribute `public.pem` to anyone who needs to verify your releases. If keys already exist, initialization asks before replacing them.
+
+From the release directory, create or update the manifest and signature:
+
+```bash
+tools sign
+```
+
+The manifest contains SHA256 hashes for `.py`, `.json`, `.yaml`, `.yml`, `.toml`, `.txt`, and `.md` files. Hidden files and common generated directories are skipped. Commit `manifest.json` and `manifest.sig` with the release.
+
+To sign or verify a different directory, pass it with `--directory` (or `-C`):
+
+```bash
+tools sign --directory ./release
+tools sign --verify -C ./release
+```
+
+Verification checks the signature, each listed file's hash, missing files, and any new signable files that are absent from the manifest.
+
+## License
+
+This tool is provided under the GNU General Public License v3.0.

project_enclave_tools-0.1.1/README.md

@@ -0,0 +1,44 @@
+# Dev Tools
+
+Dev Tools is a small command-line toolkit for contributors to [Project Enclave](https://github.com/project-enclave). It currently provides signed SHA256 manifests for release files.
+
+## Installation
+
+Install the current public release with `pipx`:
+
+```bash
+pipx install "git+https://github.com/Chinglen2080/dev-tools.git@v0.1.1"
+```
+
+OpenSSL must be installed and available on your `PATH` for key generation and signing.
+
+## Signing release files
+
+Generate a 2048-bit RSA key pair the first time you use the signing tool:
+
+```bash
+tools sign --init
+```
+
+The keys are stored in `~/.config/dev-tools/keys/`. Keep `private.pem` private; distribute `public.pem` to anyone who needs to verify your releases. If keys already exist, initialization asks before replacing them.
+
+From the release directory, create or update the manifest and signature:
+
+```bash
+tools sign
+```
+
+The manifest contains SHA256 hashes for `.py`, `.json`, `.yaml`, `.yml`, `.toml`, `.txt`, and `.md` files. Hidden files and common generated directories are skipped. Commit `manifest.json` and `manifest.sig` with the release.
+
+To sign or verify a different directory, pass it with `--directory` (or `-C`):
+
+```bash
+tools sign --directory ./release
+tools sign --verify -C ./release
+```
+
+Verification checks the signature, each listed file's hash, missing files, and any new signable files that are absent from the manifest.
+
+## License
+
+This tool is provided under the GNU General Public License v3.0.

project_enclave_tools-0.1.1/dev_tools/cli.py

@@ -0,0 +1,58 @@
+#!/usr/bin/env python3
+"""Command line interface for dev-tools."""
+
+import argparse
+from pathlib import Path
+
+from dev_tools.tools.signing import SigningError, init_keys, sign_files, verify_files
+
+
+def build_parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        description="Developer tools toolkit",
+        prog="tools",
+    )
+    commands = parser.add_subparsers(dest="command", required=True)
+    sign_parser = commands.add_parser("sign", help="Sign or verify release files")
+    action = sign_parser.add_mutually_exclusive_group()
+    action.add_argument(
+        "--init",
+        action="store_true",
+        help="Generate a signing key pair",
+    )
+    action.add_argument(
+        "--verify",
+        action="store_true",
+        help="Verify the manifest and its files",
+    )
+    sign_parser.add_argument(
+        "-C",
+        "--directory",
+        type=Path,
+        default=Path.cwd(),
+        metavar="DIR",
+        help="Directory to sign or verify (default: current directory)",
+    )
+    return parser
+
+
+def main() -> int:
+    parser = build_parser()
+    args = parser.parse_args()
+
+    try:
+        if args.command == "sign":
+            if args.init:
+                init_keys()
+            elif args.verify:
+                verify_files(args.directory)
+            else:
+                sign_files(args.directory)
+    except (SigningError, OSError) as exc:
+        parser.exit(1, f"ERROR: {exc}\n")
+
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

project_enclave_tools-0.1.1/dev_tools/init.py

@@ -0,0 +1,3 @@
+"""Developer tools toolkit."""
+
+__version__ = "0.1.0"

project_enclave_tools-0.1.1/dev_tools/tools/init.py

@@ -0,0 +1 @@
+"""Tools package."""

project_enclave_tools-0.1.1/dev_tools/tools/signing.py

@@ -0,0 +1,271 @@
+"""Create and verify signed SHA256 manifests for release files."""
+
+from __future__ import annotations
+
+import hashlib
+import json
+import os
+import re
+import subprocess
+import tempfile
+from pathlib import Path, PurePosixPath, PureWindowsPath
+from typing import Dict, List, Optional
+
+from dev_tools.utils.keys import (
+    generate_keys,
+    get_private_key,
+    get_public_key,
+    keys_exist,
+)
+
+
+class SigningError(Exception):
+    """An expected signing or verification failure."""
+
+
+# Directories to exclude from scanning.
+EXCLUDE_DIRS = {
+    ".git", ".venv", "venv", ".env", "__pycache__",
+    ".mypy_cache", ".pytest_cache", "node_modules",
+    "dist", "build", ".tox",
+}
+
+# File extensions to sign.
+SIGN_EXTENSIONS = {".py", ".json", ".yaml", ".yml", ".toml", ".txt", ".md"}
+HASH_RE = re.compile(r"^[0-9a-f]{64}$")
+
+
+def hash_file(path: Path) -> str:
+    """Compute a SHA256 hash without loading the entire file into memory."""
+    digest = hashlib.sha256()
+    with path.open("rb") as file_obj:
+        for chunk in iter(lambda: file_obj.read(1024 * 1024), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def discover_files(root: Path) -> List[Path]:
+    """Find signable regular files, returning paths relative to ``root`` sorted."""
+    root = Path(root)
+    found: List[Path] = []
+    for dirpath, dirnames, filenames in os.walk(root, followlinks=False):
+        dirnames[:] = sorted(
+            dirname
+            for dirname in dirnames
+            if dirname not in EXCLUDE_DIRS
+            and not dirname.startswith(".")
+            and not dirname.endswith(".egg-info")
+            and not (Path(dirpath) / dirname).is_symlink()
+        )
+
+        for filename in sorted(filenames):
+            if filename in ("manifest.json", "manifest.sig") or filename.startswith("."):
+                continue
+            candidate = Path(dirpath) / filename
+            if (
+                candidate.suffix.lower() in SIGN_EXTENSIONS
+                and candidate.is_file()
+                and not candidate.is_symlink()
+            ):
+                found.append(candidate)
+
+    return sorted(found, key=lambda item: item.relative_to(root).as_posix())
+
+
+def _run_openssl(args: List[str], operation: str) -> subprocess.CompletedProcess:
+    try:
+        result = subprocess.run(args, capture_output=True, text=True, check=False)
+    except FileNotFoundError as exc:
+        raise SigningError("OpenSSL is required but was not found on PATH.") from exc
+    if result.returncode != 0:
+        detail = result.stderr.strip() or result.stdout.strip() or "OpenSSL failed."
+        raise SigningError(f"{operation} failed: {detail}")
+    return result
+
+
+def sign_manifest(manifest_path: Path, sig_path: Path, private_key: Path) -> None:
+    """Sign a manifest using the configured private key."""
+    _run_openssl(
+        [
+            "openssl", "dgst", "-sha256", "-sign", str(private_key),
+            "-out", str(sig_path), str(manifest_path),
+        ],
+        "Signing the manifest",
+    )
+
+
+def verify_manifest(manifest_path: Path, sig_path: Path, public_key: Path) -> bool:
+    """Return whether the signature matches the manifest and public key."""
+    try:
+        result = subprocess.run(
+            [
+                "openssl", "dgst", "-sha256", "-verify", str(public_key),
+                "-signature", str(sig_path), str(manifest_path),
+            ],
+            capture_output=True,
+            text=True,
+            check=False,
+        )
+    except FileNotFoundError as exc:
+        raise SigningError("OpenSSL is required but was not found on PATH.") from exc
+    return result.returncode == 0
+
+
+def init_keys() -> None:
+    """Initialize signing keys (first-time setup)."""
+    try:
+        generate_keys()
+    except RuntimeError as exc:
+        raise SigningError(str(exc)) from exc
+
+
+def _release_directory(cwd: Optional[Path]) -> Path:
+    directory = Path.cwd() if cwd is None else Path(cwd)
+    directory = directory.expanduser().resolve()
+    if not directory.is_dir():
+        raise SigningError(f"Not a directory: {directory}")
+    return directory
+
+
+def sign_files(cwd: Optional[Path] = None) -> None:
+    """Sign all signable files in a directory and write its manifest."""
+    cwd = _release_directory(cwd)
+
+    if not keys_exist():
+        raise SigningError("Signing keys not found. Run 'tools sign --init' first.")
+
+    private_key = get_private_key()
+    public_key = get_public_key()
+    print(f"\nScanning {cwd} for signable files...")
+    files = discover_files(cwd)
+    if not files:
+        print("No signable files found.")
+        return
+    print(f"Found {len(files)} file(s) to sign.\n")
+
+    manifest: Dict[str, str] = {}
+    for file_path in files:
+        relative_path = file_path.relative_to(cwd).as_posix()
+        try:
+            manifest[relative_path] = hash_file(file_path)
+            print(f"  ✓ {relative_path}")
+        except OSError as exc:
+            raise SigningError(f"Could not read {relative_path}: {exc}") from exc
+
+    manifest_path = cwd / "manifest.json"
+    sig_path = cwd / "manifest.sig"
+
+    # Stage both artifacts first so a failed signing operation leaves the old
+    # release files untouched.
+    with tempfile.TemporaryDirectory(prefix=".dev-tools-", dir=str(cwd)) as temp_dir:
+        staged_manifest = Path(temp_dir) / "manifest.json"
+        staged_signature = Path(temp_dir) / "manifest.sig"
+        staged_manifest.write_text(
+            json.dumps(manifest, indent=2, sort_keys=True) + "\n",
+            encoding="utf-8",
+        )
+        sign_manifest(staged_manifest, staged_signature, private_key)
+
+        print("\nVerifying signature...")
+        if not verify_manifest(staged_manifest, staged_signature, public_key):
+            raise SigningError("Signature verification failed; release files were not updated.")
+
+        os.replace(staged_manifest, manifest_path)
+        os.replace(staged_signature, sig_path)
+
+    print(f"✓ Wrote manifest.json ({len(manifest)} files)")
+    print("✓ Signed manifest.sig")
+    print("✓ Signature verified ✅\n")
+    print("Release ready — commit manifest.json and manifest.sig")
+
+
+def _manifest_file(root: Path, relative_path: str) -> Path:
+    """Resolve a canonical manifest path and ensure it stays inside the release."""
+    posix_path = PurePosixPath(relative_path)
+    windows_path = PureWindowsPath(relative_path)
+    if (
+        not relative_path
+        or "\\" in relative_path
+        or posix_path.is_absolute()
+        or windows_path.is_absolute()
+        or windows_path.drive
+        or posix_path.as_posix() != relative_path
+        or not posix_path.parts
+        or any(part in (".", "..") for part in posix_path.parts)
+    ):
+        raise SigningError(f"Invalid path in manifest: {relative_path!r}")
+
+    candidate = root.joinpath(*posix_path.parts)
+    resolved_root = root.resolve()
+    try:
+        resolved_candidate = candidate.resolve()
+    except OSError as exc:
+        raise SigningError(f"Could not resolve manifest path: {relative_path}") from exc
+    try:
+        resolved_candidate.relative_to(resolved_root)
+    except ValueError as exc:
+        raise SigningError(f"Manifest path escapes the release directory: {relative_path}") from exc
+    return candidate
+
+
+def verify_files(cwd: Optional[Path] = None) -> None:
+    """Verify the manifest signature and every signable file in a directory."""
+    cwd = _release_directory(cwd)
+    manifest_path = cwd / "manifest.json"
+    sig_path = cwd / "manifest.sig"
+
+    if not manifest_path.is_file() or not sig_path.is_file():
+        raise SigningError(f"manifest.json or manifest.sig not found in {cwd}")
+
+    public_key = get_public_key()
+    if not public_key.is_file():
+        raise SigningError("Public key not found. Run 'tools sign --init' first.")
+
+    print(f"Verifying signatures in {cwd}...")
+    if not verify_manifest(manifest_path, sig_path, public_key):
+        raise SigningError("Manifest signature verification failed.")
+    print("✓ Signature verified ✅")
+
+    try:
+        manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
+    except (OSError, UnicodeDecodeError, json.JSONDecodeError) as exc:
+        raise SigningError(f"Could not read manifest.json: {exc}") from exc
+    if not isinstance(manifest, dict):
+        raise SigningError("manifest.json must contain an object mapping file paths to SHA256 hashes.")
+
+    for file_path, expected_hash in manifest.items():
+        if not isinstance(file_path, str) or not isinstance(expected_hash, str):
+            raise SigningError("Manifest paths and hashes must be strings.")
+        if not HASH_RE.fullmatch(expected_hash):
+            raise SigningError(f"Invalid SHA256 hash in manifest for {file_path!r}.")
+
+    print(f"\nChecking {len(manifest)} files...")
+    all_match = True
+    for relative_path, expected_hash in sorted(manifest.items()):
+        file_path = _manifest_file(cwd, relative_path)
+        if not file_path.is_file():
+            print(f"  ✗ Missing: {relative_path}")
+            all_match = False
+            continue
+        try:
+            actual_hash = hash_file(file_path)
+        except OSError as exc:
+            print(f"  ✗ Could not read {relative_path}: {exc}")
+            all_match = False
+            continue
+        if actual_hash == expected_hash:
+            print(f"  ✓ {relative_path}")
+        else:
+            print(f"  ✗ MODIFIED: {relative_path}")
+            all_match = False
+
+    listed_paths = set(manifest)
+    for file_path in discover_files(cwd):
+        relative_path = file_path.relative_to(cwd).as_posix()
+        if relative_path not in listed_paths:
+            print(f"  ✗ UNLISTED: {relative_path}")
+            all_match = False
+
+    if not all_match:
+        raise SigningError("Some files are missing, changed, or absent from the signed manifest.")
+    print("\n✓ All files verified ✅")

project_enclave_tools-0.1.1/dev_tools/utils/init.py

@@ -0,0 +1 @@
+"""Utilities package."""

project_enclave_tools-0.1.1/dev_tools/utils/keys.py

@@ -0,0 +1,81 @@
+"""Key management utilities for the signing tool."""
+
+from __future__ import annotations
+
+import os
+import subprocess
+import tempfile
+from pathlib import Path
+
+
+def get_keys_dir(create: bool = False) -> Path:
+    """Return the key directory, creating it only when requested."""
+    keys_dir = Path.home() / ".config" / "dev-tools" / "keys"
+    if create:
+        keys_dir.mkdir(parents=True, exist_ok=True, mode=0o700)
+    return keys_dir
+
+
+def get_private_key() -> Path:
+    """Get the path to the private key."""
+    return get_keys_dir() / "private.pem"
+
+
+def get_public_key() -> Path:
+    """Get the path to the public key."""
+    return get_keys_dir() / "public.pem"
+
+
+def keys_exist() -> bool:
+    """Check if both keys exist without creating the key directory."""
+    return get_private_key().is_file() and get_public_key().is_file()
+
+
+def _run_openssl(args: list[str], description: str) -> None:
+    try:
+        result = subprocess.run(args, capture_output=True, text=True, check=False)
+    except FileNotFoundError as exc:
+        raise RuntimeError("OpenSSL is required but was not found on PATH.") from exc
+    if result.returncode != 0:
+        detail = result.stderr.strip() or result.stdout.strip() or "OpenSSL failed."
+        raise RuntimeError(f"{description}: {detail}")
+
+
+def generate_keys() -> None:
+    """Generate an RSA key pair, preserving existing files on failure."""
+    keys_dir = get_keys_dir(create=True)
+    private_key = get_private_key()
+    public_key = get_public_key()
+
+    if private_key.exists() or public_key.exists():
+        print("Keys already exist at:")
+        print(f"  Private: {private_key}")
+        print(f"  Public:  {public_key}")
+        response = input("Overwrite? (y/n): ").strip().lower()
+        if response != "y":
+            print("Aborted.")
+            return
+
+    print(f"Generating RSA keypair in {keys_dir}...")
+    with tempfile.TemporaryDirectory(prefix=".keygen-", dir=str(keys_dir)) as temp_dir:
+        staged_private = Path(temp_dir) / "private.pem"
+        staged_public = Path(temp_dir) / "public.pem"
+        _run_openssl(
+            ["openssl", "genrsa", "-out", str(staged_private), "2048"],
+            "Could not generate private key",
+        )
+        _run_openssl(
+            [
+                "openssl", "rsa", "-in", str(staged_private), "-pubout",
+                "-out", str(staged_public),
+            ],
+            "Could not generate public key",
+        )
+        staged_private.chmod(0o600)
+        staged_public.chmod(0o644)
+        os.replace(staged_private, private_key)
+        os.replace(staged_public, public_key)
+
+    print("✓ Keys generated successfully!")
+    print(f"  Private key: {private_key}")
+    print(f"  Public key:  {public_key}")

project_enclave_tools-0.1.1/project_enclave_tools.egg-info/PKG-INFO

@@ -0,0 +1,54 @@
+Metadata-Version: 2.4
+Name: project-enclave-tools
+Version: 0.1.1
+Summary: Tools made mainly to help the devs of project enclave and other sub projects under it
+Author-email: Pradhya <Pradhya@projectenclave.dev>
+Project-URL: Repository, https://github.com/Chinglen2080/dev-tools
+Project-URL: Issues, https://github.com/Chinglen2080/dev-tools/issues
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown
+
+# Dev Tools
+
+Dev Tools is a small command-line toolkit for contributors to [Project Enclave](https://github.com/project-enclave). It currently provides signed SHA256 manifests for release files.
+
+## Installation
+
+Install the current public release with `pipx`:
+
+```bash
+pipx install "git+https://github.com/Chinglen2080/dev-tools.git@v0.1.1"
+```
+
+OpenSSL must be installed and available on your `PATH` for key generation and signing.
+
+## Signing release files
+
+Generate a 2048-bit RSA key pair the first time you use the signing tool:
+
+```bash
+tools sign --init
+```
+
+The keys are stored in `~/.config/dev-tools/keys/`. Keep `private.pem` private; distribute `public.pem` to anyone who needs to verify your releases. If keys already exist, initialization asks before replacing them.
+
+From the release directory, create or update the manifest and signature:
+
+```bash
+tools sign
+```
+
+The manifest contains SHA256 hashes for `.py`, `.json`, `.yaml`, `.yml`, `.toml`, `.txt`, and `.md` files. Hidden files and common generated directories are skipped. Commit `manifest.json` and `manifest.sig` with the release.
+
+To sign or verify a different directory, pass it with `--directory` (or `-C`):
+
+```bash
+tools sign --directory ./release
+tools sign --verify -C ./release
+```
+
+Verification checks the signature, each listed file's hash, missing files, and any new signable files that are absent from the manifest.
+
+## License
+
+This tool is provided under the GNU General Public License v3.0.

project_enclave_tools-0.1.1/project_enclave_tools.egg-info/SOURCES.txt

@@ -0,0 +1,13 @@
+README.md
+pyproject.toml
+dev_tools/cli.py
+dev_tools/init.py
+dev_tools/tools/init.py
+dev_tools/tools/signing.py
+dev_tools/utils/init.py
+dev_tools/utils/keys.py
+project_enclave_tools.egg-info/PKG-INFO
+project_enclave_tools.egg-info/SOURCES.txt
+project_enclave_tools.egg-info/dependency_links.txt
+project_enclave_tools.egg-info/entry_points.txt
+project_enclave_tools.egg-info/top_level.txt

project_enclave_tools-0.1.1/project_enclave_tools.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

project_enclave_tools-0.1.1/project_enclave_tools.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+tools = dev_tools.cli:main

project_enclave_tools-0.1.1/project_enclave_tools.egg-info/top_level.txt

@@ -0,0 +1 @@
+dev_tools

project_enclave_tools-0.1.1/pyproject.toml

@@ -0,0 +1,19 @@
+[build-system]
+requires = ["setuptools>=45", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "project-enclave-tools"
+version = "0.1.1"
+description = "Tools made mainly to help the devs of project enclave and other sub projects under it"
+authors = [{name = "Pradhya", email = "Pradhya@projectenclave.dev"}]
+readme = "README.md"
+requires-python = ">=3.8"
+dependencies = []
+
+[project.urls]
+Repository = "https://github.com/Chinglen2080/dev-tools"
+Issues = "https://github.com/Chinglen2080/dev-tools/issues"
+
+[project.scripts]
+tools = "dev_tools.cli:main"

project_enclave_tools-0.1.1/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+