pyhanko-cli 0.1.0__py3-none-any.whl

pyhanko/cli/commands/validation/validate.py

@@ -0,0 +1,355 @@
+import asyncio
+import getpass
+from datetime import datetime
+
+import click
+import pyhanko.sign
+from asn1crypto import cms, pem
+from pyhanko.cli._trust import (
+    _get_key_usage_settings,
+    _prepare_vc,
+    build_vc_kwargs,
+    trust_options,
+)
+from pyhanko.cli.commands.signing import signing
+from pyhanko.cli.runtime import pyhanko_exception_manager
+from pyhanko.cli.utils import logger
+from pyhanko.pdf_utils import crypt
+from pyhanko.pdf_utils.misc import isoparse
+from pyhanko.pdf_utils.reader import PdfFileReader
+from pyhanko.sign import validation
+from pyhanko.sign.validation import RevocationInfoValidationType
+from pyhanko.sign.validation.errors import SignatureValidationError
+
+from pyhanko_certvalidator import ValidationContext
+
+__all__ = ['validate_signatures']
+
+
+def _signature_status(
+    ltv_profile,
+    vc_kwargs,
+    force_revinfo,
+    key_usage_settings,
+    embedded_sig,
+    skip_diff=False,
+):
+    if ltv_profile is None:
+        vc = ValidationContext(**vc_kwargs)
+        status = pyhanko.sign.validation.validate_pdf_signature(
+            embedded_sig,
+            key_usage_settings=key_usage_settings,
+            signer_validation_context=vc,
+            skip_diff=skip_diff,
+        )
+    else:
+        status = validation.validate_pdf_ltv_signature(
+            embedded_sig,
+            ltv_profile,
+            key_usage_settings=key_usage_settings,
+            force_revinfo=force_revinfo,
+            validation_context_kwargs=vc_kwargs,
+            skip_diff=skip_diff,
+        )
+    return status
+
+
+def _validate_detached(
+    infile, sig_infile, validation_context, key_usage_settings
+):
+    sig_bytes = sig_infile.read()
+    try:
+        if pem.detect(sig_bytes):
+            _, _, sig_bytes = pem.unarmor(sig_bytes)
+        content_info = cms.ContentInfo.load(sig_bytes)
+        if content_info['content_type'].native != 'signed_data':
+            raise click.ClickException("CMS content type is not signedData")
+    except ValueError as e:
+        raise click.ClickException("Could not parse CMS object") from e
+
+    validation_coro = validation.async_validate_detached_cms(
+        infile,
+        signed_data=content_info['content'],
+        signer_validation_context=validation_context,
+        key_usage_settings=key_usage_settings,
+    )
+    return asyncio.run(validation_coro)
+
+
+def _signature_status_str(status_callback, pretty_print, executive_summary):
+    try:
+        status = status_callback()
+        if executive_summary and not pretty_print:
+            return (
+                'VALID' if status.bottom_line else 'INVALID',
+                status.bottom_line,
+            )
+        elif pretty_print:
+            return status.pretty_print_details(), status.bottom_line
+        else:
+            return status.summary(), status.bottom_line
+    except validation.ValidationInfoReadingError as e:
+        msg = (
+            'An error occurred while parsing the revocation information '
+            'for this signature: ' + str(e)
+        )
+        logger.error(msg)
+        if pretty_print:
+            return msg, False
+        else:
+            return 'REVINFO_FAILURE', False
+    except SignatureValidationError as e:
+        msg = 'An error occurred while validating this signature: ' + str(e)
+        logger.error(msg, exc_info=e)
+        if pretty_print:
+            return msg, False
+        else:
+            return 'INVALID', False
+
+
+def _attempt_iso_dt_parse(dt_str) -> datetime:
+    try:
+        dt = isoparse(dt_str)
+    except ValueError:
+        raise click.ClickException(f"datetime {dt_str!r} could not be parsed")
+    return dt
+
+
+# TODO add an option to do LTV, but guess the profile
+
+
+@trust_options
+@signing.command(name='validate', help='validate signatures')
+@click.argument('infile', type=click.File('rb'))
+@click.option(
+    '--executive-summary',
+    help='only print final judgment on signature validity',
+    type=bool,
+    is_flag=True,
+    default=False,
+    show_default=True,
+)
+@click.option(
+    '--pretty-print',
+    help='render a prettier summary for the signatures in the file',
+    type=bool,
+    is_flag=True,
+    default=False,
+    show_default=True,
+)
+@click.option(
+    '--ltv-profile',
+    help='LTV signature validation profile',
+    type=click.Choice(RevocationInfoValidationType.as_tuple()),
+    required=False,
+)
+@click.option(
+    '--force-revinfo',
+    help='Fail trust validation if a certificate has no known CRL '
+    'or OCSP endpoints.',
+    type=bool,
+    is_flag=True,
+    default=False,
+    show_default=True,
+)
+@click.option(
+    '--soft-revocation-check',
+    help='Do not fail validation on revocation checking failures '
+    '(only applied to on-line revocation checks)',
+    type=bool,
+    is_flag=True,
+    default=False,
+    show_default=True,
+)
+@click.option(
+    '--no-revocation-check',
+    help='Do not attempt to check revocation status '
+    '(meaningless for LTV validation)',
+    type=bool,
+    is_flag=True,
+    default=False,
+    show_default=True,
+)
+@click.option(
+    '--retroactive-revinfo',
+    help='Treat revocation info as retroactively valid '
+    '(i.e. ignore thisUpdate timestamp)',
+    type=bool,
+    is_flag=True,
+    default=False,
+    show_default=True,
+)
+@click.option(
+    '--validation-time',
+    help=(
+        'Override the validation time (ISO 8601 date). '
+        'The special value \'claimed\' causes the validation time '
+        'claimed by the signer to be used. Revocation checking '
+        'will be disabled. Option ignored in LTV mode.'
+    ),
+    type=str,
+    required=False,
+)
+@click.option(
+    '--password',
+    required=False,
+    type=str,
+    help='password to access the file (can also be read from stdin)',
+)
+@click.option(
+    '--no-diff-analysis',
+    default=False,
+    type=bool,
+    is_flag=True,
+    help='disable incremental update analysis',
+)
+@click.option(
+    '--detached',
+    type=click.File('rb'),
+    help=(
+        'Read signature CMS object from the indicated file; '
+        'this can be used to verify signatures on non-PDF files'
+    ),
+)
+@click.option(
+    '--no-strict-syntax',
+    help='Attempt to ignore syntactical problems in the input file '
+    'and enable signature validation in hybrid-reference files.'
+    '(warning: this may affect validation results in unexpected '
+    'ways.)',
+    type=bool,
+    is_flag=True,
+    default=False,
+    show_default=True,
+)
+@click.pass_context
+def validate_signatures(
+    ctx: click.Context,
+    infile,
+    executive_summary,
+    pretty_print,
+    validation_context,
+    trust,
+    trust_replace,
+    other_certs,
+    ltv_profile,
+    force_revinfo,
+    soft_revocation_check,
+    no_revocation_check,
+    password,
+    retroactive_revinfo,
+    detached,
+    no_diff_analysis,
+    validation_time,
+    no_strict_syntax,
+):
+    no_revocation_check |= validation_time is not None
+
+    if no_revocation_check:
+        soft_revocation_check = True
+
+    if pretty_print and executive_summary:
+        raise click.ClickException(
+            "--pretty-print is incompatible with --executive-summary."
+        )
+
+    if ltv_profile is not None:
+        if validation_time is not None:
+            raise click.ClickException(
+                "--validation-time is not compatible with --ltv-profile"
+            )
+        ltv_profile = RevocationInfoValidationType(ltv_profile)
+
+    vc_kwargs = build_vc_kwargs(
+        ctx.obj.config,
+        validation_context,
+        trust,
+        trust_replace,
+        other_certs,
+        retroactive_revinfo,
+        allow_fetching=False if no_revocation_check else None,
+    )
+
+    use_claimed_validation_time = False
+    if validation_time == 'claimed':
+        use_claimed_validation_time = True
+    elif validation_time is not None:
+        vc_kwargs['moment'] = _attempt_iso_dt_parse(validation_time)
+
+    key_usage_settings = _get_key_usage_settings(ctx, validation_context)
+    vc_kwargs = _prepare_vc(
+        vc_kwargs,
+        soft_revocation_check=soft_revocation_check,
+        force_revinfo=force_revinfo,
+    )
+    with pyhanko_exception_manager():
+        if detached is not None:
+            (status_str, signature_ok) = _signature_status_str(
+                status_callback=lambda: _validate_detached(
+                    infile,
+                    detached,
+                    ValidationContext(**vc_kwargs),
+                    key_usage_settings,
+                ),
+                pretty_print=pretty_print,
+                executive_summary=executive_summary,
+            )
+            if signature_ok:
+                click.echo(status_str)
+            else:
+                raise click.ClickException(status_str)
+            return
+
+        if no_strict_syntax:
+            logger.info(
+                "Strict PDF syntax is disabled; this could impact validation "
+                "results. Use caution."
+            )
+            r = PdfFileReader(infile, strict=False)
+        else:
+            r = PdfFileReader(infile)
+        sh = r.security_handler
+        if isinstance(sh, crypt.StandardSecurityHandler):
+            if password is None:
+                password = getpass.getpass(prompt='File password: ')
+            auth_result = r.decrypt(password)
+            if auth_result.status == crypt.AuthStatus.FAILED:
+                raise click.ClickException("Password didn't match.")
+        elif sh is not None:
+            raise click.ClickException(
+                "The CLI supports only password-based encryption when "
+                "validating (for now)"
+            )
+
+        all_signatures_ok = True
+        for ix, embedded_sig in enumerate(r.embedded_regular_signatures):
+            fingerprint: str = embedded_sig.signer_cert.sha256.hex()
+            if use_claimed_validation_time:
+                vc_kwargs['moment'] = embedded_sig.self_reported_timestamp
+            (status_str, signature_ok) = _signature_status_str(
+                status_callback=lambda: _signature_status(
+                    ltv_profile=ltv_profile,
+                    force_revinfo=force_revinfo,
+                    vc_kwargs=vc_kwargs,
+                    key_usage_settings=key_usage_settings,
+                    embedded_sig=embedded_sig,
+                    skip_diff=no_diff_analysis,
+                ),
+                pretty_print=pretty_print,
+                executive_summary=executive_summary,
+            )
+            name = embedded_sig.field_name
+
+            if pretty_print:
+                header = f'Field {ix + 1}: {name}'
+                line = '=' * len(header)
+                click.echo(line)
+                click.echo(header)
+                click.echo(line)
+                click.echo('\n\n' + status_str)
+            else:
+                click.echo('%s:%s:%s' % (name, fingerprint, status_str))
+            all_signatures_ok &= signature_ok
+
+        if not all_signatures_ok:
+            raise click.ClickException("Validation failed")

pyhanko/cli/config.py

@@ -0,0 +1,306 @@
+from dataclasses import dataclass
+from datetime import timedelta
+from typing import Dict, List, Optional, Type, Union
+
+import yaml
+from pyhanko.config.errors import ConfigurationError
+from pyhanko.config.logging import LogConfig, parse_logging_config
+from pyhanko.config.trust import DEFAULT_TIME_TOLERANCE, parse_trust_config
+from pyhanko.sign.signers import DEFAULT_SIGNING_STAMP_STYLE
+from pyhanko.sign.validation.settings import KeyUsageConstraints
+from pyhanko.stamp import BaseStampStyle, QRStampStyle, TextStampStyle
+
+from pyhanko_certvalidator import ValidationContext
+
+
+@dataclass
+class CLIConfig:
+    """
+    CLI configuration settings.
+    """
+
+    validation_contexts: Dict[str, dict]
+    """
+    Named validation contexts. The values in this dictionary
+    are themselves dictionaries that support the following keys:
+
+     * ``trust``: path to a root certificate or list of such paths
+     * ``trust-replace``: whether the value of the ``trust`` setting should
+       replace the system trust, or add to it
+     * ``other-certs``: paths to other relevant certificates that are not
+       trusted by fiat.
+     * ``time-tolerance``: a time drift tolerance setting in seconds
+     * ``retroactive-revinfo``: whether to consider revocation information
+       retroactively valid
+     * ``signer-key-usage-policy``: Signer key usage requirements. See
+       :class:`.KeyUsageConstraints`.
+
+    There are two settings that are deprecated but still supported for backwards
+    compatibility:
+
+     * ``signer-key-usage``: Supplanted by ``signer-key-usage-policy``
+     * ``signer-extd-key-usage``: Supplanted by ``signer-key-usage-policy``
+
+    These may eventually be removed.
+
+    Callers should not process this information directly, but rely on
+    :meth:`get_validation_context` instead.
+    """
+
+    stamp_styles: Dict[str, dict]
+    """
+    Named stamp styles. The type of style is selected by the ``type`` key, which
+    can be either ``qr`` or ``text`` (the default is ``text``).
+    For other settings values, see :class:.`QRStampStyle` and
+    :class:`.TextStampStyle`.
+
+
+    Callers should not process this information directly, but rely on
+    :meth:`get_stamp_style` instead.
+    """
+
+    default_validation_context: str
+    """
+    The name of the default validation context.
+    The default value for this setting is ``default``.
+    """
+
+    default_stamp_style: str
+    """
+    The name of the default stamp style.
+    The default value for this setting is ``default``.
+    """
+
+    time_tolerance: timedelta
+    """
+    Time drift tolerance (global default).
+    """
+
+    retroactive_revinfo: bool
+    """
+    Whether to consider revocation information retroactively valid
+    (global default).
+    """
+
+    raw_config: dict
+    """
+    The raw config data parsed into a Python dictionary.
+    """
+
+    # TODO graceful error handling for syntax & type issues?
+
+    def _get_validation_settings_raw(self, name=None):
+        name = name or self.default_validation_context
+        try:
+            return self.validation_contexts[name]
+        except KeyError:
+            raise ConfigurationError(
+                f"There is no validation context named '{name}'."
+            )
+
+    def get_validation_context(
+        self, name: Optional[str] = None, as_dict: bool = False
+    ):
+        """
+        Retrieve a validation context by name.
+
+        :param name:
+            The name of the validation context. If not supplied, the value
+            of :attr:`default_validation_context` will be used.
+        :param as_dict:
+            If ``True`` return the settings as a keyword argument dictionary.
+            If ``False`` (the default), return a
+            :class:`~pyhanko_certvalidator.context.ValidationContext`
+            object.
+        """
+        vc_config = self._get_validation_settings_raw(name)
+        vc_kwargs = parse_trust_config(
+            vc_config, self.time_tolerance, self.retroactive_revinfo
+        )
+        return vc_kwargs if as_dict else ValidationContext(**vc_kwargs)
+
+    def get_signer_key_usages(
+        self, name: Optional[str] = None
+    ) -> KeyUsageConstraints:
+        """
+        Get a set of key usage constraints for a given validation context.
+
+        :param name:
+            The name of the validation context. If not supplied, the value
+            of :attr:`default_validation_context` will be used.
+        :return:
+            A :class:`.KeyUsageConstraints` object.
+        """
+        vc_config = self._get_validation_settings_raw(name)
+
+        try:
+            policy_settings = dict(vc_config['signer-key-usage-policy'])
+        except KeyError:
+            policy_settings = {}
+
+        # fallbacks to stay compatible with the simpler 0.5.0 signer-key-usage
+        # and signer-extd-key-usage settings: copy old settings keys to
+        # their corresponding values in the new one
+
+        try:
+            key_usage_strings = vc_config['signer-key-usage']
+            policy_settings.setdefault('key-usage', key_usage_strings)
+        except KeyError:
+            pass
+
+        try:
+            key_usage_strings = vc_config['signer-extd-key-usage']
+            policy_settings.setdefault('extd-key-usage', key_usage_strings)
+        except KeyError:
+            pass
+
+        return KeyUsageConstraints.from_config(policy_settings)
+
+    def get_stamp_style(
+        self, name: Optional[str] = None
+    ) -> Union[TextStampStyle, QRStampStyle]:
+        """
+        Retrieve a stamp style by name.
+
+        :param name:
+            The name of the style. If not supplied, the value
+            of :attr:`default_stamp_style` will be used.
+        :return:
+            A :class:`TextStampStyle` or `QRStampStyle` object.
+        """
+        name = name or self.default_stamp_style
+        config = self.stamp_styles.get(name, None)
+        if config is None:
+            raise ConfigurationError(f"There is no stamp style named '{name}'.")
+        try:
+            style_config = dict(config)
+        except (TypeError, ValueError) as e:
+            raise ConfigurationError(
+                f"Could not process stamp style named '{name}'"
+            ) from e
+        cls = STAMP_STYLE_TYPES[style_config.pop('type', 'text')]
+        return cls.from_config(style_config)
+
+
+@dataclass(frozen=True)
+class CLIRootConfig:
+    """
+    Config settings that are only relevant tothe CLI root and are not exposed
+    to subcommands and plugins.
+    """
+
+    config: CLIConfig
+    """
+    General CLI config.
+    """
+
+    log_config: Dict[Optional[str], LogConfig]
+    """
+    Per-module logging configuration. The keys in this dictionary are
+    module names, the :class:`.LogConfig` values define the logging settings.
+
+    The ``None`` key houses the configuration for the root logger, if any.
+    """
+
+    plugin_endpoints: List[str]
+    """
+    List of plugin endpoints to load, of the form
+    ``package.module:PluginClass``.
+    See :class:`~pyhanko.cli.plugin_api.SigningCommandPlugin`.
+
+    The value of this setting is ignored if ``--no-plugins`` is passed.
+
+    .. note::
+        This is convenient for importing plugin classes that don't live in
+        installed packages for some reason or another.
+
+        Plugins that are part of packages should define their endpoints
+        in the package metadata, which will allow them to be discovered
+        automatically. See the docs for
+        :class:`~pyhanko.cli.plugin_api.SigningCommandPlugin` for more
+        information.
+    """
+
+
+# TODO allow CRL/OCSP loading here as well (esp. CRL loading might be useful
+#  in some cases)
+# Time-related settings are probably better off in the CLI.
+
+
+DEFAULT_VALIDATION_CONTEXT = DEFAULT_STAMP_STYLE = 'default'
+STAMP_STYLE_TYPES: Dict[str, Type[BaseStampStyle]] = {
+    'qr': QRStampStyle,
+    'text': TextStampStyle,
+}
+
+
+def parse_cli_config(yaml_str) -> CLIRootConfig:
+    config_dict = yaml.safe_load(yaml_str) or {}
+    return CLIRootConfig(
+        **process_root_config_settings(config_dict),
+        config=CLIConfig(
+            **process_config_dict(config_dict), raw_config=config_dict
+        ),
+    )
+
+
+def process_root_config_settings(config_dict: dict) -> dict:
+    plugins = config_dict.get('plugins', [])
+    # logging config
+    log_config_spec = config_dict.get('logging', {})
+    log_config = parse_logging_config(log_config_spec)
+    return dict(
+        log_config=log_config,
+        plugin_endpoints=plugins,
+    )
+
+
+def process_config_dict(config_dict: dict) -> dict:
+    # validation context config
+    vcs: Dict[str, dict] = {DEFAULT_VALIDATION_CONTEXT: {}}
+    try:
+        vc_specs = config_dict['validation-contexts']
+        vcs.update(vc_specs)
+    except KeyError:
+        pass
+
+    # stamp style config
+    # TODO this style is obviously not suited for non-signing scenarios
+    #  (but it'll do for now)
+    stamp_configs = {
+        DEFAULT_STAMP_STYLE: {
+            'stamp-text': DEFAULT_SIGNING_STAMP_STYLE.stamp_text,
+            'background': '__stamp__',
+        }
+    }
+    try:
+        stamp_specs = config_dict['stamp-styles']
+        stamp_configs.update(stamp_specs)
+    except KeyError:
+        pass
+
+    # some misc settings
+    default_vc = config_dict.get(
+        'default-validation-context', DEFAULT_VALIDATION_CONTEXT
+    )
+    default_stamp_style = config_dict.get(
+        'default-stamp-style', DEFAULT_STAMP_STYLE
+    )
+    time_tolerance_seconds = config_dict.get(
+        'time-tolerance', DEFAULT_TIME_TOLERANCE.seconds
+    )
+    if not isinstance(time_tolerance_seconds, int):
+        raise ConfigurationError(
+            "time-tolerance parameter must be specified in seconds"
+        )
+
+    time_tolerance = timedelta(seconds=time_tolerance_seconds)
+    retroactive_revinfo = bool(config_dict.get('retroactive-revinfo', False))
+    return dict(
+        validation_contexts=vcs,
+        default_validation_context=default_vc,
+        time_tolerance=time_tolerance,
+        retroactive_revinfo=retroactive_revinfo,
+        stamp_styles=stamp_configs,
+        default_stamp_style=default_stamp_style,
+    )