pyCertWiz 2.0.1__py3-none-any.whl

pycert/__init__.py

@@ -0,0 +1,15 @@
+"""pyCertWiz - a certificate manager for the UK e-Science CA (and ACME CAs).
+
+Replaces the Java CertWizard tool and extends it into a manager for many user
+and host certificates: request, wait for RA approval and CA signing, download
+the issued certificate with its full chain, export encrypted PKCS#12 bundles,
+deploy PEM files to services, monitor expiry and renew.
+
+The public entry points are the ``pycert`` command line tool and the Qt GUI
+(``pycert gui``).  The library modules are importable and documented; the
+orchestration lives in :mod:`pycert.workflow` and CA protocols live behind the
+provider interface in :mod:`pycert.providers`.
+"""
+
+__version__ = "2.0.1"
+__all__ = ["__version__"]

pycert/__main__.py

@@ -0,0 +1,6 @@
+"""Allow ``python -m pycert``."""
+
+from .cli import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())

pycert/asn1.py

@@ -0,0 +1,135 @@
+"""Minimal DER encoder used by the PKCS#12 writer.
+
+Only encoding is implemented: pyCertWiz reads certificates and PKCS#12 through
+``cryptography``/OpenSSL, but writes the PKCS#12 container itself so the same
+modern algorithms are used on every Python version (older ``cryptography``
+releases write legacy 3DES/SHA-1 PKCS#12).  The encoder is deliberately small
+and covered by known-answer tests.
+"""
+
+__all__ = [
+    "tlv",
+    "seq",
+    "set_of",
+    "integer",
+    "octet_string",
+    "oid",
+    "null",
+    "bmp_string",
+    "explicit",
+    "implicit",
+    "encode_oid",
+    "encode_length",
+]
+
+UNIVERSAL = 0
+APPLICATION = 1
+CONTEXT = 2
+PRIVATE = 3
+
+BOOLEAN = 1
+INTEGER = 2
+BIT_STRING = 3
+OCTET_STRING = 4
+NULL = 5
+OID = 6
+UTF8_STRING = 12
+SEQUENCE = 16
+SET = 17
+PRINTABLE_STRING = 19
+IA5_STRING = 22
+BMP_STRING = 30
+
+_EOF = "\x00"
+
+
+def encode_length(length):
+    if length < 0:
+        raise ValueError("negative length")
+    if length < 0x80:
+        return bytes((length,))
+    raw = length.to_bytes((length.bit_length() + 7) // 8, "big")
+    if len(raw) > 4:
+        raise ValueError("length too large")
+    return bytes((0x80 | len(raw),)) + raw
+
+
+def tlv(tag_class, constructed, tag_number, content):
+    first = (tag_class << 6) | (0x20 if constructed else 0)
+    if tag_number >= 0x1F:
+        raise ValueError("high tag numbers are not used by pyCertWiz")
+    return bytes((first | tag_number,)) + encode_length(len(content)) + content
+
+
+def seq(*items):
+    return tlv(UNIVERSAL, True, SEQUENCE, b"".join(items))
+
+
+def set_of(*items):
+    # DER requires SET OF elements to be sorted by their encoding.
+    return tlv(UNIVERSAL, True, SET, b"".join(sorted(items)))
+
+
+def _int_content(value):
+    if not isinstance(value, int):
+        raise TypeError("integer expected")
+    if value == 0:
+        return b"\x00"
+    if value > 0:
+        raw = value.to_bytes((value.bit_length() + 7) // 8, "big")
+        if raw[0] & 0x80:
+            raw = b"\x00" + raw
+        return raw
+    length = ((value.bit_length() + 8) // 8) + 1
+    raw = value.to_bytes(length, "big", signed=True)
+    while len(raw) > 1 and raw[0] == 0xFF and raw[1] & 0x80:
+        raw = raw[1:]
+    return raw
+
+
+def integer(value):
+    return tlv(UNIVERSAL, False, INTEGER, _int_content(value))
+
+
+def null():
+    return tlv(UNIVERSAL, False, NULL, b"")
+
+
+def octet_string(value):
+    return tlv(UNIVERSAL, False, OCTET_STRING, value)
+
+
+def bmp_string(value):
+    return tlv(UNIVERSAL, False, BMP_STRING, value.encode("utf-16-be"))
+
+
+def _base128(value):
+    groups = [value & 0x7F]
+    value >>= 7
+    while value:
+        groups.append(value & 0x7F)
+        value >>= 7
+    groups.reverse()
+    return bytes(g | (0x80 if index < len(groups) - 1 else 0) for index, g in enumerate(groups))
+
+
+def encode_oid(dotted):
+    parts = [int(part) for part in dotted.split(".")]
+    if len(parts) < 2 or not 0 <= parts[0] <= 2 or (parts[0] < 2 and parts[1] > 39):
+        raise ValueError("invalid OID %r" % dotted)
+    body = bytearray(_base128(parts[0] * 40 + parts[1]))
+    for part in parts[2:]:
+        body += _base128(part)
+    return bytes(body)
+
+
+def oid(dotted):
+    return tlv(UNIVERSAL, False, OID, encode_oid(dotted))
+
+
+def explicit(number, content, tag_class=CONTEXT):
+    return tlv(tag_class, True, number, content)
+
+
+def implicit(number, content, tag_class=CONTEXT, constructed=False):
+    return tlv(tag_class, constructed, number, content)

pycert/ber.py

@@ -0,0 +1,145 @@
+"""Minimal BER/DER reader used for legacy PKCS#12 keystores.
+
+Java's PKCS#12 writer emits BER with indefinite-length constructed objects,
+whereas pyCertWiz's own writer emits DER.  This module only implements the small
+subset needed to inspect SafeBags; it is deliberately strict about boundaries
+and nesting depth.
+"""
+
+MAX_DEPTH = 64
+MAX_NODES = 100000
+
+
+class BERError(ValueError):
+    pass
+
+
+class TLV:
+    """One parsed BER element, retaining its original encoding."""
+
+    __slots__ = ("tag_class", "constructed", "tag", "content", "children", "encoded")
+
+    def __init__(self, tag_class, constructed, tag, content, children, encoded):
+        self.tag_class = tag_class
+        self.constructed = constructed
+        self.tag = tag
+        self.content = content
+        self.children = children
+        self.encoded = encoded
+
+    def __repr__(self):
+        return "TLV(tag=%d, constructed=%r, length=%d)" % (
+            self.tag,
+            self.constructed,
+            len(self.encoded),
+        )
+
+    def require_constructed(self):
+        if not self.constructed or not self.children:
+            raise BERError("expected a constructed BER element")
+
+
+def parse(data: bytes) -> TLV:
+    if not isinstance(data, (bytes, bytearray)):
+        raise BERError("BER input must be bytes")
+    node, offset = _parse_one(bytes(data), 0, len(data), 0, [0])
+    if offset != len(data):
+        raise BERError("trailing bytes after BER element")
+    return node
+
+
+def decode_oid(content: bytes) -> str:
+    if not content:
+        raise BERError("empty object identifier")
+    first = content[0]
+    values = [str(first // 40), str(first % 40)]
+    value = 0
+    for byte in content[1:]:
+        value = (value << 7) | (byte & 0x7F)
+        if not byte & 0x80:
+            values.append(str(value))
+            value = 0
+    if value:
+        raise BERError("truncated object identifier")
+    return ".".join(values)
+
+
+def _parse_one(data, offset, limit, depth, nodes):
+    if depth > MAX_DEPTH:
+        raise BERError("BER nesting is too deep")
+    nodes[0] += 1
+    if nodes[0] > MAX_NODES:
+        raise BERError("BER contains too many elements")
+    start = offset
+    if offset >= limit:
+        raise BERError("truncated BER element")
+    first = data[offset]
+    offset += 1
+    tag_class = first >> 6
+    constructed = bool(first & 0x20)
+    tag = first & 0x1F
+    if tag == 0x1F:
+        tag = 0
+        while True:
+            if offset >= limit:
+                raise BERError("truncated high-tag-number element")
+            byte = data[offset]
+            offset += 1
+            tag = (tag << 7) | (byte & 0x7F)
+            if not byte & 0x80:
+                break
+
+    if offset >= limit:
+        raise BERError("truncated BER length")
+    length_byte = data[offset]
+    offset += 1
+    if length_byte == 0x80:
+        if not constructed:
+            raise BERError("indefinite length on a primitive element")
+        children = []
+        while True:
+            if offset + 2 > limit:
+                raise BERError("missing BER end-of-contents")
+            if data[offset] == 0 and data[offset + 1] == 0:
+                offset += 2
+                return TLV(tag_class, True, tag, b"", children, data[start:offset]), offset
+            child, offset = _parse_one(data, offset, limit, depth + 1, nodes)
+            children.append(child)
+    if length_byte & 0x80:
+        count = length_byte & 0x7F
+        if count == 0 or count > 8 or offset + count > limit:
+            raise BERError("invalid BER length")
+        length = int.from_bytes(data[offset : offset + count], "big")
+        offset += count
+    else:
+        length = length_byte
+    end = offset + length
+    if end > limit:
+        raise BERError("truncated BER content")
+    if constructed:
+        children = []
+        child_offset = offset
+        while child_offset < end:
+            child, child_offset = _parse_one(data, child_offset, end, depth + 1, nodes)
+            children.append(child)
+        return TLV(tag_class, True, tag, b"", children, data[start:end]), end
+    return TLV(tag_class, False, tag, data[offset:end], [], data[start:end]), end
+
+
+def octets(node: TLV) -> bytes:
+    """Concatenate primitive OCTET STRING content, including BER fragments."""
+    if not node.constructed:
+        return node.content
+    result = b""
+    for child in node.children:
+        if child.tag == 0x04 or child.constructed:
+            result += octets(child)
+    return result
+
+
+def first_child(node: TLV, tag: "int | None" = None) -> TLV:
+    node.require_constructed()
+    for child in node.children:
+        if tag is None or child.tag == tag:
+            return child
+    raise BERError("expected BER child tag %r" % (tag,))

pycert/bundled.py

@@ -0,0 +1,67 @@
+"""The CA certificates shipped with pyCertWiz.
+
+These are the same four UK e-Science CA certificates that CertWizard bundled.
+Each one is pinned by the SHA-256 fingerprint of its DER encoding; a resource
+that does not match its pin is treated as tampered with and loading fails.  It
+is better to refuse to start than to build (or trust) a chain from the wrong CA.
+
+The fingerprints were cross-checked against the IGTF accredited distribution and
+the CA's own publication at https://ca.grid-support.ac.uk/cacerts/.
+"""
+
+from functools import lru_cache
+from pathlib import Path
+
+from cryptography import x509
+
+from . import certs
+from .errors import ConfigError
+
+#: file name -> expected SHA-256 fingerprint of the certificate (lower-case hex)
+PINNED: "dict[str, str]" = {
+    # C=UK, O=eScienceRoot, OU=Authority, CN=UK e-Science Root (2007-2027, RSA)
+    "escience-root.pem": "76f3a5942e22012d7e10e11b416fb2eea21d8f4583f2d2fc799bd4ced0210323",
+    # C=UK, O=eScienceCA, OU=Authority, CN=UK e-Science CA 2B (2011-2027, RSA)
+    "escience-2b.pem": "b6d140a765d165d8917bb9941f7ab21ff89c04155a4dce52cad345862c3e686e",
+    # C=UK, O=eScienceRoot, OU=Authority, CN=UK e-Science Root 2026 (2026-2046, ECDSA)
+    "escience-root-2026.pem": "565c16e7d6ff0f602aefca2a585634c190d7d9da411c7750d79cac6b351ffffa",
+    # C=UK, O=eScienceCA, OU=Authority, CN=UK e-Science CA 3B (2026-2046, ECDSA)
+    "escience-3b.pem": "16383860bc6e61488ffb945e961963967c4fe8d73d2b2e9641d0b535cca4b845",
+}
+
+
+def data_dir() -> Path:
+    """Filesystem path of the bundled certificate directory (for copying)."""
+    return Path(__file__).resolve().parent / "data" / "ca"
+
+
+def path_for(name: str) -> Path:
+    return data_dir() / name
+
+
+@lru_cache(maxsize=1)
+def certificates() -> "tuple[x509.Certificate, ...]":
+    """Load and pin-check every bundled CA certificate."""
+    result = []
+    for name, expected in PINNED.items():
+        path = path_for(name)
+        if not path.is_file():
+            raise ConfigError(f"bundled CA certificate is missing: {path}")
+        try:
+            cert = certs.load_certificate(path.read_bytes())
+        except Exception as exc:  # noqa: BLE001
+            raise ConfigError(f"cannot parse bundled CA certificate {name}: {exc}") from exc
+        actual = certs.fingerprint(cert)
+        if actual != expected:
+            raise ConfigError(
+                f"bundled CA certificate {name} does not match its pinned SHA-256 fingerprint "
+                f"(expected {expected}, got {actual}); refusing to use it"
+            )
+        result.append(cert)
+    return tuple(result)
+
+
+@lru_cache(maxsize=1)
+def pem_bundle() -> str:
+    """All bundled certificates as one PEM string (ready for ssl context)."""
+    return "".join(certs.cert_pem(c) for c in certificates())