pyhanko-cli 0.3.0__tar.gz → 0.3.1__tar.gz

pyhanko_cli-0.3.1/MANIFEST.in

@@ -0,0 +1,3 @@
+graft pyhanko_testing_commons
+graft tests
+global-exclude *.py[cod]

{pyhanko_cli-0.3.0/src/pyhanko_cli.egg-info → pyhanko_cli-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pyhanko-cli
-Version: 0.3.0
+Version: 0.3.1
 Summary: CLI tools for stamping and signing PDF files
 Author-email: Matthias Valvekens <dev@mvalvekens.be>
 Maintainer-email: Matthias Valvekens <dev@mvalvekens.be>
@@ -27,8 +27,8 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: asn1crypto>=1.5.1
 Requires-Dist: tzlocal>=4.3
-Requires-Dist: pyhanko<0.35,>=0.34.0
-Requires-Dist: pyhanko-certvalidator<0.31,>=0.30.0
+Requires-Dist: pyhanko<0.35,>=0.34.1
+Requires-Dist: pyhanko-certvalidator<0.31,>=0.30.1
 Requires-Dist: click!=8.2.0,>=8.1.3
 Requires-Dist: platformdirs>=4.3.8
 Dynamic: license-file

{pyhanko_cli-0.3.0 → pyhanko_cli-0.3.1}/pyproject.toml

@@ -33,12 +33,12 @@ requires-python = ">=3.10"
 dependencies = [
     "asn1crypto>=1.5.1",
     "tzlocal>=4.3",
-    "pyhanko>=0.34.0,<0.35",
-    "pyhanko-certvalidator>=0.30.0,<0.31",
+    "pyhanko>=0.34.1,<0.35",
+    "pyhanko-certvalidator>=0.30.1,<0.31",
     "click>=8.1.3,!=8.2.0",
     "platformdirs>=4.3.8",
 ]
-version = "0.3.0"
+version = "0.3.1"
 
 
 [project.readme]

pyhanko_cli-0.3.1/src/pyhanko/cli/version.py

@@ -0,0 +1,2 @@
+__version__ = '0.3.1'
+__version_info__ = (0, 3, 1)

{pyhanko_cli-0.3.0 → pyhanko_cli-0.3.1/src/pyhanko_cli.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pyhanko-cli
-Version: 0.3.0
+Version: 0.3.1
 Summary: CLI tools for stamping and signing PDF files
 Author-email: Matthias Valvekens <dev@mvalvekens.be>
 Maintainer-email: Matthias Valvekens <dev@mvalvekens.be>
@@ -27,8 +27,8 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: asn1crypto>=1.5.1
 Requires-Dist: tzlocal>=4.3
-Requires-Dist: pyhanko<0.35,>=0.34.0
-Requires-Dist: pyhanko-certvalidator<0.31,>=0.30.0
+Requires-Dist: pyhanko<0.35,>=0.34.1
+Requires-Dist: pyhanko-certvalidator<0.31,>=0.30.1
 Requires-Dist: click!=8.2.0,>=8.1.3
 Requires-Dist: platformdirs>=4.3.8
 Dynamic: license-file

{pyhanko_cli-0.3.0 → pyhanko_cli-0.3.1}/src/pyhanko_cli.egg-info/SOURCES.txt

@@ -283,6 +283,8 @@ src/pyhanko_cli.egg-info/dependency_links.txt
 src/pyhanko_cli.egg-info/entry_points.txt
 src/pyhanko_cli.egg-info/requires.txt
 src/pyhanko_cli.egg-info/top_level.txt
+tests/__init__.py
+tests/conftest.py
 tests/test_cli_crypt.py
 tests/test_cli_field_mgmt.py
 tests/test_cli_ltv.py
@@ -291,4 +293,9 @@ tests/test_cli_signing.py
 tests/test_cli_signing_pkcs11.py
 tests/test_cli_stamp.py
 tests/test_config.py
-tests/test_runtime.py
+tests/test_runtime.py
+tests/validation/__init__.py
+tests/validation/conftest.py
+tests/validation/test_cli_legacy_ltv.py
+tests/validation/test_cli_qualified_validation.py
+tests/validation/test_cli_validation.py

{pyhanko_cli-0.3.0 → pyhanko_cli-0.3.1}/src/pyhanko_cli.egg-info/requires.txt

@@ -1,6 +1,6 @@
 asn1crypto>=1.5.1
 tzlocal>=4.3
-pyhanko<0.35,>=0.34.0
-pyhanko-certvalidator<0.31,>=0.30.0
+pyhanko<0.35,>=0.34.1
+pyhanko-certvalidator<0.31,>=0.30.1
 click!=8.2.0,>=8.1.3
 platformdirs>=4.3.8

pyhanko_cli-0.3.1/tests/conftest.py

@@ -0,0 +1,225 @@
+import asyncio
+import datetime
+import os
+
+import pytest
+import requests_mock
+import tzlocal
+import yaml
+from asn1crypto import pem, x509
+from certomancer import PKIArchitecture
+from certomancer.integrations.illusionist import Illusionist
+from certomancer.registry import CertLabel, ServiceLabel
+from click.testing import CliRunner
+from freezegun import freeze_time
+from pyhanko.pdf_utils.misc import PdfStrictReadError
+from pyhanko.pdf_utils.reader import PdfFileReader
+from pyhanko.sign.validation import (
+    validate_pdf_signature,
+)
+from pyhanko.sign.validation.ades import ades_lta_validation
+from pyhanko.sign.validation.policy_decl import (
+    PdfSignatureValidationSpec,
+    SignatureValidationSpec,
+)
+from pyhanko_certvalidator import ValidationContext
+from pyhanko_certvalidator.context import CertValidationPolicySpec
+from pyhanko_certvalidator.policy_decl import (
+    REQUIRE_REVINFO,
+    CertRevTrustPolicy,
+)
+from pyhanko_certvalidator.registry import SimpleTrustManager
+from pyhanko_testing_commons.test_data.samples import (
+    MINIMAL,
+    TESTING_CA,
+    TESTING_CA_ECDSA,
+    TESTING_CA_ED448,
+    TESTING_CA_ED25519,
+    TESTING_CA_QUALIFIED,
+)
+
+pytest_plugins = ["pyhanko_testing_commons.test_utils.pkcs11_utils.fixtures"]
+
+
+INPUT_PATH = 'input.pdf'
+SIGNED_OUTPUT_PATH = 'output.pdf'
+DUMMY_PASSPHRASE = "secret"
+
+
+def _const(v):
+    def f(*_args, **_kwargs):
+        return v
+
+    return f
+
+
+DEFAULT_CERTOMANCER_ARCHITECTURES = ["rsa", "ecdsa", "ed25519", "ed448"]
+# no ed448 timestamping in Certomancer
+# FIXME deal with the bug on the Certomancer end
+LTV_CERTOMANCER_ARCHITECTURES = ["rsa", "ecdsa", "ed25519"]
+CERTOMANCER_ARCHITECTURES = {
+    "rsa": TESTING_CA,
+    "ecdsa": TESTING_CA_ECDSA,
+    "ed25519": TESTING_CA_ED25519,
+    "ed448": TESTING_CA_ED448,
+    "qualified": TESTING_CA_QUALIFIED,
+}
+FREEZE_DT = datetime.datetime(2020, 8, 1, tzinfo=tzlocal.get_localzone())
+
+
+@pytest.fixture(scope="module", params=DEFAULT_CERTOMANCER_ARCHITECTURES)
+def pki_arch_name(request):
+    return request.param
+
+
+@pytest.fixture
+def pki_mocks_enabled():
+    return True
+
+
+@pytest.fixture
+def pki_arch(pki_arch_name, pki_mocks_enabled):
+    with freeze_time(FREEZE_DT):
+        arch = CERTOMANCER_ARCHITECTURES[pki_arch_name]
+        if pki_mocks_enabled:
+            with requests_mock.Mocker() as m:
+                Illusionist(arch).register(m)
+                yield arch
+        else:
+            yield arch
+
+
+# cli_runner is autouse to ensure it gets priority in the dependency graph
+@pytest.fixture(scope="function", autouse=True)
+def cli_runner():
+    runner = CliRunner()
+    with runner.isolated_filesystem():
+        with open(INPUT_PATH, 'wb') as outf:
+            outf.write(MINIMAL)
+        yield runner
+
+
+def _write_cert(
+    arch: PKIArchitecture, label: CertLabel, fname: str, use_pem: bool = True
+) -> str:
+    cert = arch.get_cert(label)
+    with open(fname, 'wb') as outf:
+        if use_pem:
+            outf.write(pem.armor('CERTIFICATE', cert.dump()))
+        else:
+            outf.write(cert.dump())
+    return fname
+
+
+@pytest.fixture
+def root_cert_data(pki_arch):
+    return pki_arch.get_cert(CertLabel('root'))
+
+
+@pytest.fixture
+def root_cert(pki_arch):
+    return _write_cert(pki_arch, CertLabel('root'), 'root.cert.pem')
+
+
+@pytest.fixture
+def cert_chain(pki_arch, root_cert):
+    return (
+        root_cert,
+        _write_cert(pki_arch, CertLabel('interm'), 'interm.cert.pem'),
+        _write_cert(
+            pki_arch, CertLabel('signer1'), 'signer.crt', use_pem=False
+        ),
+    )
+
+
+@pytest.fixture
+def timestamp_url(pki_arch: PKIArchitecture) -> str:
+    tsa = pki_arch.service_registry.get_tsa_info(ServiceLabel('tsa'))
+    return tsa.url
+
+
+@pytest.fixture
+def p12_keys(pki_arch, post_validate):
+    p12_bytes = pki_arch.package_pkcs12(
+        CertLabel("signer1"), password=DUMMY_PASSPHRASE.encode("utf8")
+    )
+    fname = 'signer.p12'
+    with open(fname, 'wb') as outf:
+        outf.write(p12_bytes)
+    return fname
+
+
+def _write_config(config: dict, fname: str = 'pyhanko.yml'):
+    with open(fname, 'w') as outf:
+        yaml.dump(config, outf)
+
+
+def _test_log(msg: str, *args):
+    # Use print instead of logger for now,
+    # since the `click` output stream management
+    # messes with the logging settings otherwise,
+    # causing writes to closed I/O handles.
+    # TODO: figure out how to handle this properly
+    print(msg.format(*args))
+
+
+def _validate_last_sig_in(root: x509.Certificate, pdf_file, *, strict):
+    with open(pdf_file, 'rb') as result:
+        _test_log(f"Validating last signature in {pdf_file}...")
+        r = PdfFileReader(result, strict=strict)
+        # Little hack for the tests with encrypted files
+        if r.security_handler is not None:
+            r.decrypt("ownersecret")
+        last_sig = r.embedded_regular_signatures[-1]
+        # if there's a docts, we assume it's PAdES
+        trust_manager = SimpleTrustManager.build(
+            trust_roots=[root],
+        )
+        if r.embedded_timestamp_signatures:
+            ades_status = asyncio.run(
+                ades_lta_validation(
+                    last_sig,
+                    PdfSignatureValidationSpec(
+                        SignatureValidationSpec(
+                            cert_validation_policy=CertValidationPolicySpec(
+                                trust_manager=trust_manager,
+                                revinfo_policy=CertRevTrustPolicy(
+                                    REQUIRE_REVINFO,
+                                ),
+                            ),
+                        )
+                    ),
+                )
+            )
+            status = ades_status.api_status
+        else:
+            vc = ValidationContext(
+                trust_manager=trust_manager, allow_fetching=True
+            )
+            status = validate_pdf_signature(
+                last_sig, signer_validation_context=vc
+            )
+        assert status.bottom_line, status.pretty_print_details()
+        _test_log("Validation successful")
+
+
+@pytest.fixture
+def post_validate(root_cert_data):
+    yield
+    input_passes_strict = True
+    if os.path.isfile(INPUT_PATH):
+        try:
+            with open(INPUT_PATH, 'rb') as inf:
+                PdfFileReader(inf)
+        except PdfStrictReadError:
+            _test_log(
+                f"Input file {INPUT_PATH} can't be opened in strict mode, "
+                f"will validate output {SIGNED_OUTPUT_PATH} in "
+                f"nonstrict mode as well"
+            )
+            input_passes_strict = False
+
+    if os.path.isfile(SIGNED_OUTPUT_PATH):
+        _validate_last_sig_in(
+            root_cert_data, SIGNED_OUTPUT_PATH, strict=input_passes_strict
+        )

pyhanko_cli-0.3.1/tests/validation/conftest.py

@@ -0,0 +1,149 @@
+import asyncio
+import getpass
+from io import BytesIO
+from typing import Optional
+
+import pytest
+from certomancer import PKIArchitecture
+from certomancer.registry import CertLabel, KeyLabel, ServiceLabel
+from pyhanko.pdf_utils.incremental_writer import IncrementalPdfFileWriter
+from pyhanko.pdf_utils.writer import BasePdfFileWriter
+from pyhanko.sign import PdfSignatureMetadata, SimpleSigner, fields, sign_pdf
+from pyhanko.sign.signers.pdf_cms import select_suitable_signing_md
+from pyhanko.sign.timestamps import HTTPTimeStamper
+from pyhanko_certvalidator import ValidationContext
+from pyhanko_certvalidator.registry import (
+    SimpleCertificateStore,
+    SimpleTrustManager,
+)
+from pyhanko_testing_commons.test_data.samples import (
+    MINIMAL,
+    MINIMAL_AES256,
+)
+
+from ..conftest import _const
+
+
+@pytest.fixture
+def signer_cert_label():
+    return CertLabel('signer1')
+
+
+def write_input_to_validate(
+    pki_arch: PKIArchitecture,
+    fname: str,
+    w: Optional[BasePdfFileWriter],
+    weakened: bool = False,
+    wrong_key: bool = False,
+    signer_cert_label: CertLabel = CertLabel('signer1'),
+):
+    registry = SimpleCertificateStore()
+    signing_cert_spec = pki_arch.get_cert_spec(signer_cert_label)
+    registry.register(
+        pki_arch.get_cert(signing_cert_spec.resolve_issuer_cert(pki_arch))
+    )
+    registry.register(pki_arch.get_cert(CertLabel('root')))
+    signer = SimpleSigner(
+        signing_cert=pki_arch.get_cert(signer_cert_label),
+        cert_registry=registry,
+        signing_key=pki_arch.key_set.get_private_key(
+            KeyLabel('signer1') if not wrong_key else KeyLabel('signer2')
+        ),
+    )
+
+    if weakened:
+        md = 'sha1'
+    else:
+        md = select_suitable_signing_md(signer.signing_cert.public_key)
+    out = BytesIO()
+    if w:
+        sign_pdf(
+            pdf_out=w,
+            signature_meta=PdfSignatureMetadata(
+                field_name='Sig1', md_algorithm=md
+            ),
+            signer=signer,
+            output=out,
+        )
+    else:
+        ci = asyncio.run(
+            signer.async_sign_general_data(
+                MINIMAL,
+                md,
+            )
+        )
+        out.write(ci.dump())
+    with open(fname, 'wb') as outf:
+        outf.write(out.getvalue())
+    return fname
+
+
+def write_ltv_input_to_validate(
+    pki_arch: PKIArchitecture,
+    signer_cert_label: CertLabel,
+    tsa_label: ServiceLabel,
+    fname: str = 'to-validate.pdf',
+    pades_style: bool = True,
+):
+    registry = SimpleCertificateStore()
+    signing_cert_spec = pki_arch.get_cert_spec(signer_cert_label)
+    registry.register(
+        pki_arch.get_cert(signing_cert_spec.resolve_issuer_cert(pki_arch))
+    )
+    root_cert = pki_arch.get_cert(CertLabel('root'))
+    registry.register(root_cert)
+    signer = SimpleSigner(
+        signing_cert=pki_arch.get_cert(signer_cert_label),
+        cert_registry=registry,
+        signing_key=pki_arch.key_set.get_private_key(KeyLabel('signer1')),
+    )
+    tsa = pki_arch.service_registry.get_tsa_info(tsa_label)
+
+    with open(fname, 'wb') as outf:
+        w = IncrementalPdfFileWriter(BytesIO(MINIMAL))
+        sign_pdf(
+            pdf_out=w,
+            signature_meta=PdfSignatureMetadata(
+                field_name='Sig1',
+                validation_context=ValidationContext(
+                    trust_manager=SimpleTrustManager.build(
+                        trust_roots=[root_cert]
+                    ),
+                    allow_fetching=True,
+                ),
+                subfilter=fields.SigSeedSubFilter.PADES
+                if pades_style
+                else None,
+                embed_validation_info=True,
+                use_pades_lta=True,
+            ),
+            signer=signer,
+            timestamper=HTTPTimeStamper(url=tsa.url),
+            output=outf,
+        )
+    return fname
+
+
+@pytest.fixture(params=["regular", "encrypted"])
+def input_to_validate(
+    pki_arch: PKIArchitecture, monkeypatch, request, signer_cert_label
+):
+    if request.param == "encrypted":
+        w = IncrementalPdfFileWriter(BytesIO(MINIMAL_AES256))
+        monkeypatch.setattr(getpass, 'getpass', value=_const('ownersecret'))
+        w.encrypt(b"ownersecret")
+    else:
+        w = IncrementalPdfFileWriter(BytesIO(MINIMAL))
+
+    return write_input_to_validate(
+        pki_arch, 'to-validate.pdf', w, signer_cert_label=signer_cert_label
+    )
+
+
+@pytest.fixture(scope="function")
+def ltv_input_to_validate(pki_arch: PKIArchitecture, signer_cert_label):
+    return write_ltv_input_to_validate(
+        pki_arch,
+        signer_cert_label=signer_cert_label,
+        tsa_label=ServiceLabel('tsa'),
+    )

pyhanko_cli-0.3.1/tests/validation/test_cli_legacy_ltv.py

@@ -0,0 +1,125 @@
+import pytest
+from certomancer.registry import CertLabel, ServiceLabel
+from pyhanko.cli import cli_root
+
+from ..conftest import LTV_CERTOMANCER_ARCHITECTURES
+from .conftest import write_ltv_input_to_validate
+
+
+@pytest.fixture(scope="module", params=LTV_CERTOMANCER_ARCHITECTURES)
+def pki_arch_name(request):
+    return request.param
+
+
+@pytest.fixture(scope="function")
+def catch_ltv_warning():
+    with pytest.warns(UserWarning, match="adesverify instead"):
+        yield
+
+
+def test_ltv_validate_success(
+    cli_runner, root_cert, ltv_input_to_validate, catch_ltv_warning
+):
+    result = cli_runner.invoke(
+        cli_root,
+        [
+            'sign',
+            'validate',
+            '--ltv-profile',
+            'pades-lta',
+            '--trust',
+            root_cert,
+            ltv_input_to_validate,
+        ],
+    )
+    assert not result.exception, result.output
+    assert 'INTACT:TRUSTED' in result.output
+    assert 'TIMESTAMP_TOKEN<INTACT:TRUSTED>' in result.output
+    assert 'EXTENDED_WITH_LTA_UPDATES' in result.output
+
+
+def test_ltv_validate_adobe_style(
+    cli_runner, pki_arch, root_cert, catch_ltv_warning
+):
+    fname = write_ltv_input_to_validate(
+        pki_arch,
+        signer_cert_label=CertLabel('signer1'),
+        tsa_label=ServiceLabel('tsa'),
+        pades_style=False,
+    )
+    result = cli_runner.invoke(
+        cli_root,
+        [
+            'sign',
+            'validate',
+            '--ltv-profile',
+            'adobe',
+            '--trust',
+            root_cert,
+            fname,
+        ],
+    )
+    assert not result.exception, result.output
+    assert 'INTACT:TRUSTED' in result.output
+    assert 'TIMESTAMP_TOKEN<INTACT:TRUSTED>' in result.output
+    assert 'UNTOUCHED' in result.output
+
+
+def test_ltv_validate_fail_no_revinfo(
+    cli_runner, root_cert, input_to_validate, catch_ltv_warning
+):
+    result = cli_runner.invoke(
+        cli_root,
+        [
+            'sign',
+            'validate',
+            '--ltv-profile',
+            'pades-lta',
+            '--trust',
+            root_cert,
+            input_to_validate,
+        ],
+    )
+    assert result.exit_code == 1
+    assert 'REVINFO_FAILURE' in result.output
+
+
+def test_ltv_validate_fail_no_revinfo_pretty(
+    cli_runner, root_cert, input_to_validate, catch_ltv_warning
+):
+    result = cli_runner.invoke(
+        cli_root,
+        [
+            'sign',
+            'validate',
+            '--pretty-print',
+            '--ltv-profile',
+            'pades-lta',
+            '--trust',
+            root_cert,
+            input_to_validate,
+        ],
+    )
+    assert result.exit_code == 1
+    assert 'No DSS found' in result.output
+
+
+def test_ltv_validate_not_compatible_with_validation_time(
+    cli_runner, root_cert, input_to_validate
+):
+    result = cli_runner.invoke(
+        cli_root,
+        [
+            'sign',
+            'validate',
+            '--ltv-profile',
+            'pades-lta',
+            '--validation-time',
+            '2020-11-01T10:00:00',
+            '--trust',
+            root_cert,
+            input_to_validate,
+        ],
+    )
+    assert result.exit_code == 1
+    assert 'not compatible with --ltv-profile' in result.output