pyhanko-cli 0.1.0__py3-none-any.whl

pyhanko/cli/commands/fields.py

@@ -0,0 +1,66 @@
+import click
+from pyhanko.cli.commands.signing import signing
+from pyhanko.cli.runtime import pyhanko_exception_manager
+from pyhanko.cli.utils import parse_field_location_spec
+from pyhanko.pdf_utils.incremental_writer import IncrementalPdfFileWriter
+from pyhanko.pdf_utils.reader import PdfFileReader
+from pyhanko.pdf_utils.writer import copy_into_new_writer
+from pyhanko.sign import fields
+
+__all__ = ['list_sigfields', 'add_sig_field']
+
+
+@signing.command(name='list', help='list signature fields')
+@click.argument('infile', type=click.File('rb'))
+@click.option(
+    '--skip-status',
+    help='do not print status',
+    required=False,
+    type=bool,
+    is_flag=True,
+    default=False,
+    show_default=True,
+)
+def list_sigfields(infile, skip_status):
+    with pyhanko_exception_manager():
+        r = PdfFileReader(infile, strict=False)
+        field_info = fields.enumerate_sig_fields(r)
+        for ix, (name, value, field_ref) in enumerate(field_info):
+            if skip_status:
+                click.echo(name)
+                continue
+            click.echo(f"{name}:{'EMPTY' if value is None else 'FILLED'}")
+
+
+@signing.command(
+    name='addfields', help='add empty signature fields to a PDF field'
+)
+@click.argument('infile', type=click.File('rb'))
+@click.argument('outfile', type=click.File('wb'))
+@click.option(
+    '--field',
+    metavar='PAGE/X1,Y1,X2,Y2/NAME',
+    multiple=True,
+    required=True,
+    help="Field specification (multiple allowed)",
+)
+@click.option(
+    '--resave',
+    is_flag=True,
+    help="Resave the PDF document instead of creating an incremental update",
+)
+def add_sig_field(infile, outfile, field, resave):
+    with pyhanko_exception_manager():
+        if resave:
+            writer = copy_into_new_writer(PdfFileReader(infile, strict=False))
+        else:
+            writer = IncrementalPdfFileWriter(infile, strict=False)
+
+        for s in field:
+            name, spec = parse_field_location_spec(s)
+            assert spec is not None
+            fields.append_signature_field(writer, spec)
+
+        writer.write(outfile)
+        infile.close()
+        outfile.close()

pyhanko/cli/commands/signing/__init__.py

@@ -0,0 +1,328 @@
+from typing import List, Optional
+
+import click
+from pyhanko.cli._root import cli_root
+from pyhanko.cli._trust import (
+    _get_key_usage_settings,
+    build_vc_kwargs,
+    trust_options,
+)
+from pyhanko.cli.commands.signing.plugin import command_from_plugin
+from pyhanko.cli.commands.stamp import select_style
+from pyhanko.cli.utils import parse_field_location_spec
+from pyhanko.pdf_utils.incremental_writer import IncrementalPdfFileWriter
+from pyhanko.sign import DEFAULT_SIGNER_KEY_USAGE, fields, signers
+from pyhanko.sign.signers.pdf_byterange import BuildProps
+from pyhanko.sign.timestamps import HTTPTimeStamper
+from pyhanko.version import __version__
+
+from pyhanko_certvalidator import ValidationContext
+
+from ..._ctx import CLIContext
+from ...plugin_api import SigningCommandPlugin
+
+__all__ = ['signing', 'addsig', 'register']
+
+from ...runtime import pyhanko_exception_manager
+
+
+@cli_root.group(help='sign PDFs and other files', name='sign')
+def signing():
+    pass
+
+
+@trust_options
+@signing.group(name='addsig', help='add a signature')
+@click.option(
+    '--field',
+    help=(
+        'signature field name, or field specification PAGE/X1,Y1,X2,Y2/NAME '
+        '(required unless the field contains exactly one signature field)'
+    ),
+    required=False,
+)
+@click.option('--name', help='explicitly specify signer name', required=False)
+@click.option('--reason', help='reason for signing', required=False)
+@click.option('--location', help='location of signing', required=False)
+@click.option('--contact-info', help='contact of the signer', required=False)
+@click.option(
+    '--certify',
+    help='add certification signature',
+    required=False,
+    default=False,
+    is_flag=True,
+    type=bool,
+    show_default=True,
+)
+@click.option(
+    '--existing-only',
+    help='never create signature fields',
+    required=False,
+    default=False,
+    is_flag=True,
+    type=bool,
+    show_default=True,
+)
+@click.option(
+    '--timestamp-url',
+    help='URL for timestamp server',
+    required=False,
+    type=str,
+    default=None,
+)
+@click.option(
+    '--use-pades',
+    help='sign PAdES-style [level B/B-T/B-LT/B-LTA]',
+    required=False,
+    default=False,
+    is_flag=True,
+    type=bool,
+    show_default=True,
+)
+@click.option(
+    '--use-pades-lta',
+    help='produce PAdES-B-LTA signature',
+    required=False,
+    default=False,
+    is_flag=True,
+    type=bool,
+    show_default=True,
+)
+@click.option(
+    '--prefer-pss',
+    is_flag=True,
+    default=False,
+    type=bool,
+    help='prefer RSASSA-PSS to PKCS#1 v1.5 padding, if available',
+)
+@click.option(
+    '--with-validation-info',
+    help='embed revocation info',
+    required=False,
+    default=False,
+    is_flag=True,
+    type=bool,
+    show_default=True,
+)
+@click.option(
+    '--style-name',
+    help='stamp style name for signature appearance',
+    required=False,
+    type=str,
+)
+@click.option(
+    '--stamp-url',
+    help='QR code URL to use in QR stamp style',
+    required=False,
+    type=str,
+)
+@click.option(
+    '--detach',
+    type=bool,
+    is_flag=True,
+    default=False,
+    help=(
+        'write only the signature CMS object to the output file; '
+        'this can be used to sign non-PDF files'
+    ),
+)
+@click.option(
+    '--detach-pem',
+    help='output PEM data instead of DER when using --detach',
+    type=bool,
+    is_flag=True,
+    default=False,
+)
+@click.option(
+    '--retroactive-revinfo',
+    help='Treat revocation info as retroactively valid '
+    '(i.e. ignore thisUpdate timestamp)',
+    type=bool,
+    is_flag=True,
+    default=False,
+    show_default=True,
+)
+@click.option(
+    '--no-strict-syntax',
+    help='Attempt to ignore syntactical problems in the input file '
+    'and enable signature creation in hybrid-reference files.'
+    '(warning: such documents may behave in unexpected ways)',
+    type=bool,
+    is_flag=True,
+    default=False,
+    show_default=True,
+)
+@click.pass_context
+def addsig(
+    ctx: click.Context,
+    field,
+    name,
+    reason,
+    contact_info,
+    location,
+    certify,
+    existing_only,
+    timestamp_url,
+    use_pades,
+    use_pades_lta,
+    with_validation_info,
+    validation_context,
+    trust_replace,
+    trust,
+    other_certs,
+    style_name,
+    stamp_url,
+    prefer_pss,
+    retroactive_revinfo,
+    detach,
+    detach_pem,
+    no_strict_syntax,
+):
+    ctx_obj: CLIContext = ctx.obj
+    ctx_obj.existing_fields_only = existing_only or field is None
+    ctx_obj.timestamp_url = timestamp_url
+    ctx_obj.prefer_pss = prefer_pss
+
+    if detach or detach_pem:
+        ctx_obj.detach_pem = detach_pem
+        ctx_obj.sig_settings = None
+        if field:
+            raise click.ClickException(
+                "--field is not compatible with --detach or --detach-pem"
+            )
+        return  # everything else doesn't apply
+
+    if use_pades_lta:
+        use_pades = with_validation_info = True
+        if not timestamp_url:
+            raise click.ClickException(
+                "--timestamp-url is required for --use-pades-lta"
+            )
+    if use_pades:
+        subfilter = fields.SigSeedSubFilter.PADES
+    else:
+        subfilter = fields.SigSeedSubFilter.ADOBE_PKCS7_DETACHED
+
+    key_usage = DEFAULT_SIGNER_KEY_USAGE
+    if with_validation_info:
+        vc_kwargs = build_vc_kwargs(
+            ctx.obj.config,
+            validation_context,
+            trust,
+            trust_replace,
+            other_certs,
+            retroactive_revinfo,
+            allow_fetching=True,
+        )
+        vc = ValidationContext(**vc_kwargs)
+        key_usage_sett = _get_key_usage_settings(ctx, validation_context)
+        if key_usage_sett is not None and key_usage_sett.key_usage is not None:
+            key_usage = key_usage_sett.key_usage
+    else:
+        vc = None
+    field_name: Optional[str]
+    if field:
+        field_name, new_field_spec = parse_field_location_spec(
+            field, require_full_spec=False
+        )
+    else:
+        field_name = new_field_spec = None
+    if new_field_spec and existing_only:
+        raise click.ClickException(
+            "Specifying field coordinates is incompatible with --existing-only"
+        )
+    ctx_obj.sig_settings = signers.PdfSignatureMetadata(
+        field_name=field_name,
+        location=location,
+        reason=reason,
+        contact_info=contact_info,
+        name=name,
+        certify=certify,
+        subfilter=subfilter,
+        embed_validation_info=with_validation_info,
+        validation_context=vc,
+        signer_key_usage=key_usage,
+        use_pades_lta=use_pades_lta,
+        app_build_props=BuildProps(name='pyHanko CLI', revision=__version__),
+    )
+    ctx_obj.new_field_spec = new_field_spec
+    ctx_obj.stamp_style = select_style(ctx, style_name, stamp_url)
+    ctx_obj.stamp_url = stamp_url
+    ctx_obj.lenient = no_strict_syntax
+    ctx_obj.ux.visible_signature_desired = bool(style_name or new_field_spec)
+
+
+def _unavailable(signer_plugin: SigningCommandPlugin):
+    def _unavailable_callback():
+        raise click.ClickException(
+            signer_plugin.unavailable_message
+            or "This subcommand is not available"
+        )
+
+    return _unavailable_callback
+
+
+def register(plugins: List[SigningCommandPlugin]):
+    # we reset the command list before (re)populating it, in order to
+    # make the tests more consistent
+    addsig.commands = {}
+    for signer_plugin in plugins:
+        if signer_plugin.is_available():
+            addsig.add_command(command_from_plugin(signer_plugin))
+        else:
+
+            addsig.add_command(
+                click.Command(
+                    name=signer_plugin.subcommand_name,
+                    help=signer_plugin.help_summary + " [unavailable]",
+                    callback=_unavailable(signer_plugin),
+                )
+            )
+
+
+readable_file = click.Path(exists=True, readable=True, dir_okay=False)
+writable_file = click.Path(writable=True, dir_okay=False)
+
+
+@trust_options
+@signing.command(name='timestamp', help='add timestamp to PDF')
+@click.argument('infile', type=readable_file)
+@click.argument('outfile', type=writable_file)
+@click.option(
+    '--timestamp-url',
+    help='URL for timestamp server',
+    required=True,
+    type=str,
+    default=None,
+)
+@click.pass_context
+def timestamp(
+    ctx,
+    infile,
+    outfile,
+    validation_context,
+    trust,
+    trust_replace,
+    other_certs,
+    timestamp_url,
+):
+    with pyhanko_exception_manager():
+        vc_kwargs = build_vc_kwargs(
+            ctx.obj.config,
+            validation_context,
+            trust,
+            trust_replace,
+            other_certs,
+            retroactive_revinfo=True,
+        )
+        timestamper = HTTPTimeStamper(timestamp_url)
+        with open(infile, 'rb') as inf:
+            w = IncrementalPdfFileWriter(inf)
+            pdf_timestamper = signers.PdfTimeStamper(timestamper)
+            with open(outfile, 'wb') as outf:
+                pdf_timestamper.timestamp_pdf(
+                    w,
+                    'sha256',
+                    validation_context=ValidationContext(**vc_kwargs),
+                    output=outf,
+                )

pyhanko/cli/commands/signing/pkcs11_cli.py

@@ -0,0 +1,185 @@
+import getpass
+import os
+from typing import ContextManager, List, Optional
+
+import click
+from pyhanko.cli._ctx import CLIContext
+from pyhanko.cli.config import CLIConfig
+from pyhanko.cli.plugin_api import SigningCommandPlugin
+from pyhanko.cli.utils import logger, readable_file
+from pyhanko.config.errors import ConfigurationError
+from pyhanko.config.pkcs11 import (
+    PKCS11PinEntryMode,
+    PKCS11SignatureConfig,
+    TokenCriteria,
+)
+from pyhanko.sign import Signer
+
+__all__ = ['PKCS11Plugin']
+
+
+try:
+    import pkcs11  # lgtm [py/unused-import]
+
+    pkcs11_available = True
+except ImportError:  # pragma: nocover
+    pkcs11 = None
+    pkcs11_available = False
+
+
+P11_PIN_ENV_VAR = "PYHANKO_PKCS11_PIN"
+UNAVAIL_MSG = "This subcommand requires python-pkcs11 to be installed."
+
+
+class PKCS11Plugin(SigningCommandPlugin):
+    subcommand_name = 'pkcs11'
+    help_summary = 'use generic PKCS#11 device to sign'
+    unavailable_message = UNAVAIL_MSG
+
+    def is_available(self) -> bool:
+        return pkcs11_available
+
+    def click_options(self) -> List[click.Option]:
+        return [
+            click.Option(
+                ('--lib',),
+                help='path to PKCS#11 module',
+                type=readable_file,
+                required=False,
+            ),
+            click.Option(
+                ('--token-label',),
+                help='PKCS#11 token label',
+                type=str,
+                required=False,
+            ),
+            click.Option(
+                ('--cert-label',),
+                help='certificate label',
+                type=str,
+                required=False,
+            ),
+            click.Option(
+                ('--raw-mechanism',),
+                help='invoke raw PKCS#11 mechanism',
+                type=bool,
+                is_flag=True,
+                required=False,
+            ),
+            click.Option(
+                ('--key-label',), help='key label', type=str, required=False
+            ),
+            click.Option(
+                ('--slot-no',),
+                help='specify PKCS#11 slot to use',
+                required=False,
+                type=int,
+                default=None,
+            ),
+            click.Option(
+                ('--skip-user-pin',),
+                type=bool,
+                show_default=True,
+                default=False,
+                required=False,
+                is_flag=True,
+                help='do not prompt for PIN (e.g. if the token has a PIN pad)',
+            ),
+            click.Option(
+                ('--p11-setup',),
+                type=str,
+                required=False,
+                help='name of preconfigured PKCS#11 profile (overrides all '
+                'other options)',
+            ),
+            click.Option(
+                ('--other-cert',),
+                type=str,
+                required=False,
+                help='label of other cert to pull (multiple uses allowed)',
+                multiple=True,
+            ),
+        ]
+
+    def create_signer(
+        self, context: CLIContext, **kwargs
+    ) -> ContextManager[Signer]:
+        return _pkcs11_signer_context(context, **kwargs)
+
+
+def _pkcs11_signer_context(
+    ctx: CLIContext,
+    lib,
+    token_label,
+    cert_label,
+    key_label,
+    slot_no,
+    skip_user_pin,
+    p11_setup,
+    raw_mechanism,
+    other_cert,
+):
+    from pyhanko.sign import pkcs11
+
+    if p11_setup:
+        cli_config: Optional[CLIConfig] = ctx.config
+        if cli_config is None:
+            raise click.ClickException(
+                "The --p11-setup option requires a configuration file"
+            )
+        try:
+            pkcs11_config = ModuleConfigWrapper(cli_config).get_pkcs11_config(
+                p11_setup
+            )
+        except ConfigurationError as e:
+            msg = f"Error while reading PKCS#11 config {p11_setup}"
+            logger.error(msg, exc_info=e)
+            raise click.ClickException(msg)
+    else:
+        if not (lib and cert_label):
+            raise click.ClickException(
+                "The parameters --lib and --cert-label are required."
+            )
+
+        pinentry_mode = (
+            PKCS11PinEntryMode.SKIP
+            if skip_user_pin
+            else PKCS11PinEntryMode.PROMPT
+        )
+
+        pkcs11_config = PKCS11SignatureConfig(
+            module_path=lib,
+            cert_label=cert_label,
+            key_label=key_label,
+            slot_no=slot_no,
+            token_criteria=TokenCriteria(token_label),
+            # for now, DEFER requires a config file
+            prompt_pin=pinentry_mode,
+            raw_mechanism=raw_mechanism,
+            other_certs_to_pull=other_cert,
+        )
+
+    pin = pkcs11_config.user_pin
+
+    # try to fetch the PIN from an env var
+    if pin is None:
+        pin_env = os.environ.get(P11_PIN_ENV_VAR, None)
+        if pin_env:
+            pin = pin_env.strip()
+
+    if pkcs11_config.prompt_pin == PKCS11PinEntryMode.PROMPT and pin is None:
+        pin = getpass.getpass(prompt='PKCS#11 user PIN: ')
+    return pkcs11.PKCS11SigningContext(pkcs11_config, user_pin=pin)
+
+
+class ModuleConfigWrapper:
+    def __init__(self, config: CLIConfig):
+        config_dict = config.raw_config
+        self.pkcs11_setups = config_dict.get('pkcs11-setups', {})
+
+    def get_pkcs11_config(self, name):
+        try:
+            setup = self.pkcs11_setups[name]
+        except KeyError:
+            raise ConfigurationError(f"There's no PKCS#11 setup named '{name}'")
+        return PKCS11SignatureConfig.from_config(setup)