pyhanko-cli 0.1.0__py3-none-any.whl

pyhanko/cli/commands/signing/plugin.py

@@ -0,0 +1,144 @@
+import asyncio
+from datetime import datetime
+from typing import List, Optional
+
+import click
+import tzlocal
+from asn1crypto import pem
+from pyhanko.cli._ctx import CLIContext
+from pyhanko.cli.commands.signing.utils import get_text_params, open_for_signing
+from pyhanko.cli.plugin_api import SigningCommandPlugin
+from pyhanko.cli.runtime import pyhanko_exception_manager
+from pyhanko.cli.utils import readable_file, writable_file
+from pyhanko.pdf_utils.rw_common import PdfHandler
+from pyhanko.sign import PdfSigner, fields
+from pyhanko.sign.signers.pdf_cms import (
+    PdfCMSSignedAttributes,
+    select_suitable_signing_md,
+)
+from pyhanko.sign.timestamps import HTTPTimeStamper
+
+
+def _ensure_field_visible(
+    handler: PdfHandler, name: Optional[str], will_create: bool
+):
+    # verify if the resulting signature will be a visible one
+    prefix = "You seem to be trying to create a visible signature"
+    try:
+        fq_name, _, field_ref = next(
+            fields.enumerate_sig_fields(handler, with_name=name)
+        )
+        sig_annot = fields.get_sig_field_annot(sig_field=field_ref.get_object())
+        w, h = fields.annot_width_height(sig_annot)
+        if not w or not h:
+            raise click.ClickException(
+                f"{prefix}, but the field '{fq_name}' in the PDF is not a "
+                f"visible one. Please specify another field name if you "
+                f"need a visible signature."
+            )
+    except StopIteration:
+        if not name:
+            raise click.ClickException(
+                f"{prefix}, but the PDF did not contain any signature fields, "
+                f"and you did not specify a bounding box. "
+                f"Please specify the field as "
+                f"--field \"PAGE/X1,Y1,X2,Y2/NAME\" to "
+                f"create a visible signature field at the coordinates provided."
+            )
+        elif not will_create:
+            raise click.ClickException(
+                f"{prefix}, but the field '{name}' does not exist in the PDF "
+                f"file, and you did not specify a bounding box. "
+                f"Please specify the field as "
+                f"--field \"PAGE/X1,Y1,X2,Y2/{name}\" to "
+                f"create a visible signature field at the coordinates provided."
+            )
+
+
+def _callback_logic(
+    plugin: SigningCommandPlugin, infile: str, outfile: str, **kwargs
+):
+    ctx = click.get_current_context()
+    cli_ctx: CLIContext = ctx.obj
+
+    timestamp_url: Optional[str] = cli_ctx.timestamp_url
+    if timestamp_url is not None:
+        timestamper = HTTPTimeStamper(timestamp_url)
+    else:
+        timestamper = None
+    with plugin.create_signer(cli_ctx, **kwargs) as signer:
+        pdf_sig_settings = cli_ctx.sig_settings
+
+        if pdf_sig_settings is None:
+            # detached sig
+            if timestamper is not None:
+                # signed TS
+                timestamp_attr = None
+            else:
+                # in this case, embed the signing time as a signed attr
+                timestamp_attr = datetime.now(tz=tzlocal.get_localzone())
+
+            with open(infile, 'rb') as inf:
+                cert = signer.signing_cert
+                assert cert is not None
+                signature_job = signer.async_sign_general_data(
+                    inf,
+                    select_suitable_signing_md(cert.public_key),
+                    timestamper=timestamper,
+                    signed_attr_settings=PdfCMSSignedAttributes(
+                        signing_time=timestamp_attr
+                    ),
+                )
+                signature = asyncio.run(signature_job)
+
+            output_bytes = signature.dump()
+            if cli_ctx.detach_pem:
+                output_bytes = pem.armor('PKCS7', output_bytes)
+
+            with open(outfile, 'wb') as out:
+                out.write(output_bytes)
+        else:
+            with open_for_signing(
+                infile_path=infile, lenient=cli_ctx.lenient
+            ) as w:
+                if cli_ctx.ux.visible_signature_desired:
+                    _ensure_field_visible(
+                        w,
+                        pdf_sig_settings.field_name,
+                        cli_ctx.new_field_spec is not None,
+                    )
+                result = PdfSigner(
+                    pdf_sig_settings,
+                    signer=signer,
+                    timestamper=timestamper,
+                    stamp_style=cli_ctx.stamp_style,
+                    new_field_spec=cli_ctx.new_field_spec,
+                ).sign_pdf(
+                    w,
+                    existing_fields_only=cli_ctx.existing_fields_only,
+                    appearance_text_params=get_text_params(ctx),
+                )
+
+                with open(outfile, 'wb') as outf:
+                    buf = result.getbuffer()
+                    outf.write(buf)
+                    buf.release()
+
+
+def command_from_plugin(plugin: SigningCommandPlugin) -> click.Command:
+    def _callback(*, infile: str, outfile: str, **kwargs):
+        with pyhanko_exception_manager():
+            _callback_logic(plugin, infile, outfile, **kwargs)
+
+    params: List[click.Parameter] = [
+        click.Argument(('infile',), type=readable_file),
+        click.Argument(('outfile',), type=writable_file),
+    ]
+    params.extend(plugin.click_extra_arguments())
+    params.extend(plugin.click_options())
+    return click.Command(
+        name=plugin.subcommand_name,
+        callback=_callback,
+        help=plugin.help_summary,
+        params=params,
+    )

pyhanko/cli/commands/signing/simple.py

@@ -0,0 +1,260 @@
+import contextlib
+import getpass
+from typing import ContextManager, List, Optional
+
+import click
+from pyhanko.cli._ctx import CLIContext
+from pyhanko.cli._trust import grab_certs
+from pyhanko.cli.config import CLIConfig
+from pyhanko.cli.plugin_api import SigningCommandPlugin, register_signing_plugin
+from pyhanko.cli.utils import _warn_empty_passphrase, logger, readable_file
+from pyhanko.config.errors import ConfigurationError
+from pyhanko.config.local_keys import (
+    PemDerSignatureConfig,
+    PKCS12SignatureConfig,
+)
+from pyhanko.sign.signers.pdf_cms import (
+    Signer,
+    signer_from_p12_config,
+    signer_from_pemder_config,
+)
+
+__all__ = ['PemderPlugin', 'PKCS12Plugin']
+
+
+class KeyFileConfigWrapper:
+    def __init__(self, config: CLIConfig):
+        config_dict = config.raw_config
+        self.pemder_setups = config_dict.get('pemder-setups', {})
+        self.pkcs12_setups = config_dict.get('pkcs12-setups', {})
+
+    def get_pkcs12_config(self, name):
+        try:
+            setup = self.pkcs12_setups[name]
+        except KeyError:
+            raise ConfigurationError(f"There's no PKCS#12 setup named '{name}'")
+        return PKCS12SignatureConfig.from_config(setup)
+
+    def get_pemder_config(self, name):
+        try:
+            setup = self.pemder_setups[name]
+        except KeyError:
+            raise ConfigurationError(f"There's no PEM/DER setup named '{name}'")
+        return PemDerSignatureConfig.from_config(setup)
+
+
+class PemderPlugin(SigningCommandPlugin):
+    subcommand_name = 'pemder'
+    help_summary = 'read key material from PEM/DER files'
+
+    def click_options(self) -> List[click.Option]:
+        return [
+            click.Option(
+                ('--key',),
+                help='file containing the private key (PEM/DER)',
+                type=readable_file,
+                required=False,
+            ),
+            click.Option(
+                ('--cert',),
+                help='file containing the signer\'s certificate ' '(PEM/DER)',
+                type=readable_file,
+                required=False,
+            ),
+            click.Option(
+                ('--chain',),
+                type=readable_file,
+                multiple=True,
+                help='file(s) containing the chain of trust for the '
+                'signer\'s certificate (PEM/DER). May be '
+                'passed multiple times.',
+            ),
+            click.Option(
+                ('--pemder-setup',),
+                type=str,
+                required=False,
+                help='name of preconfigured PEM/DER profile (overrides all '
+                'other options)',
+            ),
+            # TODO allow reading the passphrase from a specific file descriptor
+            #  (for advanced scripting setups)
+            click.Option(
+                ('--passfile',),
+                help='file containing the passphrase ' 'for the private key',
+                required=False,
+                type=click.File('r'),
+                show_default='stdin',
+            ),
+            click.Option(
+                ('--no-pass',),
+                help='assume the private key file is unencrypted',
+                type=bool,
+                is_flag=True,
+                default=False,
+                show_default=True,
+            ),
+        ]
+
+    def create_signer(
+        self, context: CLIContext, **kwargs
+    ) -> ContextManager[Signer]:
+        @contextlib.contextmanager
+        def _m():
+            yield _pemder_signer(context, **kwargs)
+
+        return _m()
+
+
+def _pemder_signer(
+    ctx: CLIContext,
+    key,
+    cert,
+    chain,
+    pemder_setup,
+    passfile,
+    no_pass,
+):
+    if pemder_setup:
+        cli_config = ctx.config
+        if cli_config is None:
+            raise click.ClickException(
+                "The --pemder-setup option requires a configuration file"
+            )
+        try:
+            pemder_config = KeyFileConfigWrapper(cli_config).get_pemder_config(
+                pemder_setup
+            )
+        except ConfigurationError as e:
+            msg = f"Error while reading PEM/DER setup {pemder_setup}"
+            logger.error(msg, exc_info=e)
+            raise click.ClickException(msg)
+    elif not (key and cert):
+        raise click.ClickException(
+            "Either both the --key and --cert options, or the --pemder-setup "
+            "option must be provided."
+        )
+    else:
+        pemder_config = PemDerSignatureConfig(
+            key_file=key,
+            cert_file=cert,
+            other_certs=grab_certs(chain),
+            prefer_pss=ctx.prefer_pss,
+        )
+
+    if pemder_config.key_passphrase is not None:
+        passphrase = pemder_config.key_passphrase
+    elif passfile is not None:
+        passphrase = passfile.readline().strip().encode('utf-8')
+        passfile.close()
+    elif pemder_config.prompt_passphrase and not no_pass:
+        passphrase = getpass.getpass(prompt='Key passphrase: ').encode('utf-8')
+        if not passphrase:
+            _warn_empty_passphrase()
+            passphrase = None
+    else:
+        passphrase = None
+
+    return signer_from_pemder_config(
+        pemder_config, provided_key_passphrase=passphrase
+    )
+
+
+class PKCS12Plugin(SigningCommandPlugin):
+    subcommand_name = 'pkcs12'
+    help_summary = 'read key material from PKCS#12 files'
+
+    def click_extra_arguments(self) -> List[click.Argument]:
+        return [click.Argument(('pfx',), type=readable_file, required=False)]
+
+    def click_options(self) -> List[click.Option]:
+        return [
+            click.Option(
+                ('--p12-setup',),
+                type=str,
+                required=False,
+                help='name of preconfigured PKCS#12 profile (overrides all '
+                'other options)',
+            ),
+            click.Option(
+                ('--chain',),
+                type=readable_file,
+                multiple=True,
+                help='PEM/DER file(s) containing extra certificates to embed '
+                '(e.g. chain of trust not embedded in the PKCS#12 file)'
+                'May be passed multiple times.',
+            ),
+            click.Option(
+                ('--passfile',),
+                help='file containing the passphrase for the PKCS#12 file.',
+                required=False,
+                type=click.File('r'),
+                show_default='stdin',
+            ),
+            click.Option(
+                ('--no-pass',),
+                help='assume the PKCS#12 file is unencrypted',
+                type=bool,
+                is_flag=True,
+                default=False,
+                show_default=True,
+            ),
+        ]
+
+    def create_signer(
+        self, context: CLIContext, **kwargs
+    ) -> ContextManager[Signer]:
+        @contextlib.contextmanager
+        def _m():
+            yield _pkcs12_signer(context, **kwargs)
+
+        return _m()
+
+
+def _pkcs12_signer(ctx: CLIContext, pfx, chain, passfile, p12_setup, no_pass):
+    # TODO add sanity check in case the user gets the arg order wrong
+    #  (now it fails with a gnarly DER decoding error, which is not very
+    #  user-friendly)
+    if p12_setup:
+        cli_config: Optional[CLIConfig] = ctx.config
+        if cli_config is None:
+            raise click.ClickException(
+                "The --p12-setup option requires a configuration file"
+            )
+        try:
+            pkcs12_config = KeyFileConfigWrapper(cli_config).get_pkcs12_config(
+                p12_setup
+            )
+        except ConfigurationError as e:
+            msg = f"Error while reading PKCS#12 config {p12_setup}"
+            logger.error(msg, exc_info=e)
+            raise click.ClickException(msg)
+    elif not pfx:
+        raise click.ClickException(
+            "Either the PFX argument or the --p12-setup option "
+            "must be provided."
+        )
+    else:
+        pkcs12_config = PKCS12SignatureConfig(
+            pfx_file=pfx,
+            other_certs=grab_certs(chain),
+            prefer_pss=ctx.prefer_pss,
+        )
+
+    if pkcs12_config.pfx_passphrase is not None:
+        passphrase = pkcs12_config.pfx_passphrase
+    elif passfile is not None:
+        passphrase = passfile.readline().strip().encode('utf-8')
+        passfile.close()
+    elif pkcs12_config.prompt_passphrase and not no_pass:
+        passphrase = getpass.getpass(prompt='PKCS#12 passphrase: ').encode(
+            'utf-8'
+        )
+        if not passphrase:
+            _warn_empty_passphrase()
+            passphrase = None
+    else:
+        passphrase = None
+
+    return signer_from_p12_config(
+        pkcs12_config, provided_pfx_passphrase=passphrase
+    )

pyhanko/cli/commands/signing/utils.py

@@ -0,0 +1,58 @@
+import getpass
+from typing import BinaryIO, Optional
+
+import click
+from pyhanko.pdf_utils import crypt
+from pyhanko.pdf_utils.crypt import AuthStatus
+from pyhanko.pdf_utils.incremental_writer import IncrementalPdfFileWriter
+
+
+class OpenForSigning:
+    def __init__(self, infile_path: str, lenient: bool):
+        self.infile_path = infile_path
+        self.lenient = lenient
+        self.handle: Optional[BinaryIO] = None
+
+    def __enter__(self) -> IncrementalPdfFileWriter:
+        self.handle = infile = open(self.infile_path, 'rb')
+        writer = IncrementalPdfFileWriter(infile, strict=not self.lenient)
+
+        # TODO make this an option higher up the tree
+        if writer.prev.encrypted:
+            sh = writer.prev.security_handler
+            if isinstance(sh, crypt.StandardSecurityHandler):
+                pdf_pass = getpass.getpass(
+                    prompt='Password for encrypted file \'%s\': '
+                    % self.infile_path
+                )
+                auth = writer.encrypt(pdf_pass)
+                if auth.status == AuthStatus.FAILED:
+                    raise click.ClickException(
+                        "Invalid password for encrypted file"
+                    )
+            elif isinstance(sh, crypt.PubKeySecurityHandler):
+                raise click.ClickException(
+                    "Public-key document encryption is not supported in the CLI"
+                )
+            else:  # pragma: nocover
+                raise click.ClickException(
+                    "Input file appears to be encrypted, but appropriate "
+                    "credentials are not available."
+                )
+        return writer
+
+    def __exit__(self, exc_type, exc_val, exc_tb):
+        if self.handle:
+            self.handle.close()
+
+
+def open_for_signing(infile_path: str, lenient: bool):
+    return OpenForSigning(infile_path, lenient)
+
+
+def get_text_params(ctx):
+    text_params = None
+    stamp_url = ctx.obj.stamp_url
+    if stamp_url is not None:
+        text_params = {'url': stamp_url}
+    return text_params

pyhanko/cli/commands/stamp.py

@@ -0,0 +1,100 @@
+from typing import Optional
+
+import click
+from pyhanko.cli._root import cli_root
+from pyhanko.cli.config import CLIConfig
+from pyhanko.cli.runtime import DEFAULT_CONFIG_FILE, pyhanko_exception_manager
+from pyhanko.cli.utils import _index_page, logger, readable_file
+from pyhanko.config.errors import ConfigurationError
+from pyhanko.stamp import QRStampStyle, qr_stamp_file, text_stamp_file
+
+__all__ = ['stamp', 'select_style']
+
+_CONFIG_REQUIRED_MSG = (
+    "Using stamp styles requires a configuration file "
+    f"({DEFAULT_CONFIG_FILE} by default)."
+)
+
+
+def select_style(ctx: click.Context, style_name: str, url: str):
+    cli_config: Optional[CLIConfig] = ctx.obj.config
+    if not cli_config:
+        if not style_name:
+            return None
+        raise click.ClickException(_CONFIG_REQUIRED_MSG)
+    try:
+        style = cli_config.get_stamp_style(style_name)
+    except ConfigurationError as e:
+        logger.error(e.msg, exc_info=e)
+        raise click.ClickException(e.msg)
+    if url and not isinstance(style, QRStampStyle):
+        raise click.ClickException(
+            "The --stamp-url parameter is only meaningful for QR stamp styles."
+        )
+    elif not url and isinstance(style, QRStampStyle):
+        raise click.ClickException(
+            "QR stamp styles require the --stamp-url option."
+        )
+
+    return style
+
+
+# TODO: text_params support
+
+
+@cli_root.command(help='stamp PDF files', name='stamp')
+@click.argument('infile', type=readable_file)
+@click.argument('outfile', type=click.Path(writable=True, dir_okay=False))
+@click.argument('x', type=int)
+@click.argument('y', type=int)
+@click.option(
+    '--style-name',
+    help='stamp style name for stamp appearance',
+    required=False,
+    type=str,
+)
+@click.option(
+    '--page',
+    help='page on which the stamp should be applied',
+    required=False,
+    type=int,
+    default=1,
+    show_default=True,
+)
+@click.option(
+    '--stamp-url',
+    help='QR code URL to use in QR stamp style',
+    required=False,
+    type=str,
+)
+@click.pass_context
+def stamp(
+    ctx,
+    infile: str,
+    outfile: str,
+    x: int,
+    y: int,
+    style_name: str,
+    page: int,
+    stamp_url: str,
+):
+    cli_config: Optional[CLIConfig] = ctx.obj.config
+    if cli_config is None:
+        raise click.ClickException(_CONFIG_REQUIRED_MSG)
+    with pyhanko_exception_manager():
+        stamp_style = select_style(ctx, style_name, stamp_url)
+        page_ix = _index_page(page)
+        if stamp_url:
+            qr_stamp_file(
+                infile,
+                outfile,
+                stamp_style,
+                dest_page=page_ix,
+                x=x,
+                y=y,
+                url=stamp_url,
+            )
+        else:
+            text_stamp_file(
+                infile, outfile, stamp_style, dest_page=page_ix, x=x, y=y
+            )

pyhanko/cli/commands/validation/__init__.py

@@ -0,0 +1,2 @@
+from .ltv import *
+from .validate import *

pyhanko/cli/commands/validation/ltv.py

@@ -0,0 +1,136 @@
+import click
+from pyhanko.cli._trust import build_vc_kwargs, trust_options
+from pyhanko.cli.commands.signing import signing
+from pyhanko.cli.runtime import pyhanko_exception_manager
+from pyhanko.pdf_utils.incremental_writer import IncrementalPdfFileWriter
+from pyhanko.pdf_utils.reader import PdfFileReader
+from pyhanko.sign import signers, validation
+from pyhanko.sign.timestamps import HTTPTimeStamper
+
+from pyhanko_certvalidator import ValidationContext
+
+__all__ = ['ltv_fix', 'lta_update']
+
+
+@trust_options
+@signing.command(name='ltaupdate', help='update LTA timestamp')
+@click.argument('infile', type=click.File('r+b'))
+@click.option(
+    '--timestamp-url',
+    help='URL for timestamp server',
+    required=True,
+    type=str,
+    default=None,
+)
+@click.option(
+    '--retroactive-revinfo',
+    help='Treat revocation info as retroactively valid '
+    '(i.e. ignore thisUpdate timestamp)',
+    type=bool,
+    is_flag=True,
+    default=False,
+    show_default=True,
+)
+@click.pass_context
+def lta_update(
+    ctx,
+    infile,
+    validation_context,
+    trust,
+    trust_replace,
+    other_certs,
+    timestamp_url,
+    retroactive_revinfo,
+):
+    with pyhanko_exception_manager():
+        vc_kwargs = build_vc_kwargs(
+            ctx.obj.config,
+            validation_context,
+            trust,
+            trust_replace,
+            other_certs,
+            retroactive_revinfo,
+        )
+        timestamper = HTTPTimeStamper(timestamp_url)
+        r = PdfFileReader(infile)
+        signers.PdfTimeStamper(timestamper).update_archival_timestamp_chain(
+            r, ValidationContext(**vc_kwargs)
+        )
+
+
+# TODO perhaps add an option here to fix the lack of a timestamp and/or
+#  warn if none is present
+
+
+@trust_options
+@signing.command(
+    name='ltvfix', help='add revocation information for a signature to the DSS'
+)
+@click.argument('infile', type=click.File('r+b'))
+@click.option('--field', help='name of the signature field', required=True)
+@click.option(
+    '--timestamp-url',
+    help='URL for timestamp server',
+    required=False,
+    type=str,
+    default=None,
+)
+@click.option(
+    '--apply-lta-timestamp',
+    help='Apply a document timestamp after adding revocation info.',
+    required=False,
+    type=bool,
+    default=False,
+    is_flag=True,
+    show_default=True,
+)
+@click.pass_context
+def ltv_fix(
+    ctx,
+    infile,
+    field,
+    timestamp_url,
+    apply_lta_timestamp,
+    validation_context,
+    trust_replace,
+    trust,
+    other_certs,
+):
+    if apply_lta_timestamp and not timestamp_url:
+        raise click.ClickException(
+            "Please specify a timestamp server using --timestamp-url."
+        )
+
+    vc_kwargs = build_vc_kwargs(
+        ctx.obj.config,
+        validation_context,
+        trust,
+        trust_replace,
+        other_certs,
+        retroactive_revinfo=False,
+        allow_fetching=True,
+    )
+    vc_kwargs['revocation_mode'] = 'hard-fail'
+    r = PdfFileReader(infile)
+
+    try:
+        emb_sig = next(
+            s for s in r.embedded_regular_signatures if s.field_name == field
+        )
+    except StopIteration:
+        raise click.ClickException(
+            f"Could not find a PDF signature labelled {field}."
+        )
+
+    output = validation.add_validation_info(
+        emb_sig, ValidationContext(**vc_kwargs), in_place=True
+    )
+
+    if apply_lta_timestamp:
+        timestamper = HTTPTimeStamper(timestamp_url)
+        signers.PdfTimeStamper(timestamper).timestamp_pdf(
+            IncrementalPdfFileWriter(output),
+            signers.DEFAULT_MD,
+            ValidationContext(**vc_kwargs),
+            in_place=True,
+        )