pyhanko-cli 0.3.0__tar.gz → 0.4.0__tar.gz

pyhanko_cli-0.4.0/MANIFEST.in

@@ -0,0 +1,3 @@
+graft pyhanko_testing_commons
+graft tests
+global-exclude *.py[cod]

{pyhanko_cli-0.3.0/src/pyhanko_cli.egg-info → pyhanko_cli-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pyhanko-cli
-Version: 0.3.0
+Version: 0.4.0
 Summary: CLI tools for stamping and signing PDF files
 Author-email: Matthias Valvekens <dev@mvalvekens.be>
 Maintainer-email: Matthias Valvekens <dev@mvalvekens.be>
@@ -27,8 +27,9 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: asn1crypto>=1.5.1
 Requires-Dist: tzlocal>=4.3
-Requires-Dist: pyhanko<0.35,>=0.34.0
-Requires-Dist: pyhanko-certvalidator<0.31,>=0.30.0
+Requires-Dist: pyhanko<0.36,>=0.35.0
+Requires-Dist: pyhanko-certvalidator<0.32,>=0.31.0
+Requires-Dist: certifi>=2023.5.7
 Requires-Dist: click!=8.2.0,>=8.1.3
 Requires-Dist: platformdirs>=4.3.8
 Dynamic: license-file

{pyhanko_cli-0.3.0 → pyhanko_cli-0.4.0}/pyhanko_testing_commons/test_data/data/crypto/certomancer.yml

@@ -37,25 +37,21 @@ keysets:
     keys:
       root:
         path: root_ca.key.pem
-        password: secret
       interm:
         path: intermediate_ca.key.pem
-        password: secret
       tsa:
         path: tsa.key.pem
-        password: secret
       tsa2:
         path: tsa2.key.pem
+      tsa-rsa:
+        path: tsa_rsa.key.pem
         password: secret
       interm-ocsp:
         path: ocsp.key.pem
-        password: secret
       signer1:
         path: signer.key.pem
-        password: secret
       signer2:
         path: signer2.key.pem
-        password: secret
       decrypter1:
         path: decrypter1.key.pem  # secp256r1
       decrypter2:
@@ -333,6 +329,20 @@ pki-architectures:
   testing-ca-ecdsa:
     template: testing-ca
     keyset: testing-ca-ecdsa
+    entities:
+      tsa-rsa:
+        common-name: Time Stamping Authority (RSA)
+    certs:
+      tsa-rsa:
+        template: tsa
+        subject: tsa-rsa
+        subject-key: tsa-rsa
+    services:
+      time-stamping:
+        tsa-rsa:
+          signing-key: tsa-rsa
+          signing-cert: tsa-rsa
+          digest-algo: sha512
   ecc-testing-ca-with-decrypters:
     template: testing-ca
     keyset: testing-ca-ecdsa

pyhanko_cli-0.4.0/pyhanko_testing_commons/test_data/data/crypto/keys-ecdsa/decrypter-x25519.key.pem

@@ -0,0 +1,3 @@
+-----BEGIN PRIVATE KEY-----
+MC4CAQAwBQYDK2VuBCIEIPAG3siLd6hc/UxXoXTYkQDzeB4iX24nDNfwc3fPv0Bt
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.0/pyhanko_testing_commons/test_data/data/crypto/keys-ecdsa/decrypter-x448.key.pem

@@ -0,0 +1,4 @@
+-----BEGIN PRIVATE KEY-----
+MEYCAQAwBQYDK2VvBDoEOAgg1UxiODX9qQ9upkZnBjN6dWr+dIi36xNV8kyU/zpH
+XBAm3Rr2vtxn66FLb9GL86TYDlU6HpnI
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.0/pyhanko_testing_commons/test_data/data/crypto/keys-ecdsa/decrypter1.key.pem

@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgWNEOB9xGVakHc0Bn
+MAGoHLG2GQEyIy7huKj+XDk4K9qhRANCAARZHAkkk9jRfB0O/HfSl7RXtphQuUjv
+TffoL+fWKQQ9/2HdA2OHVzuEQLE+mzEpfvWSg8jtQtwhqn5owShkkrGT
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.0/pyhanko_testing_commons/test_data/data/crypto/keys-ecdsa/decrypter2.key.pem

@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDD9QeFAQJqX70LshnR4
+GrKhYdtpFlc+9Yiihn3Tz7gX1fsBxwdOXEQm9JpB37MHacahZANiAARh5dNyrcfb
+0Qwp60P4a65l5f0m3ol/SNQl/Lb1EYwovPjJuch9stppDWyZvGqJXfBuIBWhgJGd
+QgXsKu1DDX6eJzUjzqv9bqjDMT2xHXYEucfM+dI5BvmwJq8xAAYMSyo=
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.0/pyhanko_testing_commons/test_data/data/crypto/keys-ecdsa/decrypter3.key.pem

@@ -0,0 +1,8 @@
+-----BEGIN PRIVATE KEY-----
+MIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIBtuGYcLkK2RLn5sMm
+CXa7q9GJIKnc/KWK0wskosgbJgQ9X5l9SaD/SLY+LnFOTZHqwVCm7JidGUyb5JTB
+525E7K+hgYkDgYYABAHtqDSTH6safq3VrnZHmt6QI+HcT8z1ORO4OqBHxcFhAp7y
+ZG5jGazFi73NTgGOyVJgzTVwzcaPdrTPmaSNUtoyrgCTdMbv5yPmQlS7mXuZ+r2b
+5TmdoIVi2ptXGi/5FEPeVotN//cLtrVS3U6px0mrEWNQH/ml7H7WshfDw/Idqf2Y
+0Q==
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.0/pyhanko_testing_commons/test_data/data/crypto/keys-ecdsa/intermediate_ca.key.pem

@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDAEzwhf7zGYpmekTy2i
+jKcPuGIL+VQs2v5EOuisZSDUtdF9kPKjo9N2Q7TOTjTAOM2hZANiAASPyBseZ0vP
+AX2RKlwrPKg8Rcgmw5OdkxmRmSGgXtmm24eILFxQosQyxdyQK8AaijYLs/86rgfk
+cvjwZ9mE0z0XhZs617SLovbuWvDg6aQGpUQR8AwbJIe/LqWO8cqqyMI=
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.0/pyhanko_testing_commons/test_data/data/crypto/keys-ecdsa/ocsp.key.pem

@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDB753e9U9IilLa3iBVJ
+YrVnnXJG1zcac7RST0YnBrR35KVZkyfEysJdE70MTD8DLf+hZANiAARDcIq1rs/Q
+s65aLELkes5BVgyYvPL0y/5aN2TV2p0iwzBtcMsGexPs9SShp5qJClVpCUQwq0kQ
+nCZ4aLc5liR8uJf9UckKNiG+BjUfZGpwrC0uUAzrD18X06NH6aPLoNc=
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.0/pyhanko_testing_commons/test_data/data/crypto/keys-ecdsa/root_ca.key.pem

@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDDZELAjP9K1Tu4d60c4
+uH3PIXkaFbK7VikKYA0CSET06LUUBI/19tvxn6LXWVrXUQShZANiAARoSeKHPKF8
+tzbuY8/kVNgy6/2Tm6KU4H2CRsMTCCaTfOGhQOJFu5hLomfrW6S+mMz5Vzr+c/68
+TUsoH8vLL3c6mrlsZDZhL95esPZCK3ScxyBFUHShKaCMM61Th3UVOxo=
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.0/pyhanko_testing_commons/test_data/data/crypto/keys-ecdsa/signer.key.pem

@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDCGwezdoIghoZnBPZM/
+K2yhCVZUkHLDdx8nQtlqqPc+NpHS9UsOM0UnphiB1AbXu6ihZANiAARz7HrBWoCv
+7KyhernqqqAGDoiw34adGQd2wmsN+5TYhwhDCzS+vqtjc4m9FYER0T402HYMe7bM
+SikY3y1JITMlGL3mspfnuMEgeRRpNw8jAqu7inScPOfTp4oKyIrOpjQ=
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.0/pyhanko_testing_commons/test_data/data/crypto/keys-ecdsa/signer2.key.pem

@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDCtw/AbLPj9CsE7SyIm
+xGUNFRvZonjaR7XZbNuls8Hh6dGVsiz2lYj1dpcPQ7NBLgGhZANiAASv5DVAVL8+
+aNjbkjaFLCfMZx+KxudP6yewKTYk9kMQmx+9dEscz5XSUI/auHUCaYC4wtwWmV1w
+9IveFV+6JEU+0CRtiGRw9RvfGQcSasBrBJPkd/uUw33RGb1E/749YEI=
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.0/pyhanko_testing_commons/test_data/data/crypto/keys-ecdsa/tsa.key.pem

@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDCHHys1SN4eaB8YckPF
+5BbJlHK1rebbDPVW/uwBybEYizVHLdVFFD3Wcbqmy5q5X0KhZANiAARHmIokodeT
+7yai1BnAKotkTFb9RKE5OFnULiwW1dGNmdl2+R7WBhf5kzMf6YwEO9u75XJlut26
+leaIyem4jPQdcH4f/EjHJ4vZPrxVr1/5mm5tRJtWCxhvXdkQsROCsPY=
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.0/pyhanko_testing_commons/test_data/data/crypto/keys-ecdsa/tsa2.key.pem

@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDAt+eMBC8Uv+2JX+rwq
+5MHMVEHQu8sqtpVQ+w7lrnM7RlOXN2Z88tIhnFX83mOGPbmhZANiAAS/1cx5q4Ac
+2jSchMuKX7k8lgx9IV3GJwNnzZccmDGApP/P9nCg8SX6z1wKGohVgGkxpPuseBZQ
+fi1qXujiuJL0BCCrGsSZRHxufnwzwo2y5hgT9ZCqi8elECdRp6pAIcY=
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.0/pyhanko_testing_commons/test_data/data/crypto/keys-rsa/tsa.key.pem

@@ -0,0 +1,30 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-256-CBC,32635A4426FAA0AD7E76EB7D3ED8D696
+
+PS9YmhrMah6NQwKb0emFT+Vi0gP4LA2WSn963waS6NHaeXJsCjqUBzWsjfhH3+MZ
+VFNf+e8YMPojJR7WLLn0aweSEsJ2HtPebbmCqcf3VA0BUDDkpStvWx+06UIb9BcI
+6kZrJyVfpw0paAEt65i5faTrnAu5VxApQ8RxaCexYAm2abvdSBnBkqBG/Flh4nku
+zUSl60WgynpX742e4l0++Twsw4RHQGSOPnvdT5VxSrcXSxL0Wgr0gDkHFMYBtYj3
+NV6upBmHCjasLmAEZZmf4F34jDOCPmx0yPKlwVx/y5M+zq6XKQh6Cawoq0Pxy/Cl
+2y+/mPMUlY//fVdVCbbfwsU+U82n1mlEno6UhIiAlkPasmqX/fTZkWGZmhN5jrim
+vm+dlqv/AhC3neJZLSITNq/idyWp3hpV3cZhQYWXw23zP5l+4IZf3PHuXpDaRKUG
+ehaYN1ddbjXA8yaRf+UzROuE/eZg0+w3Y5GLObHzGmAMfi3D436MEj44ljiYu72P
+OEpPvFJpr+WS/ftLFXe/wUyyHmp9dhY9E6Nrb0zK1ex8pOJXCa2nLpzMOmzwBObN
+M4n1lx3exJPW8amVT3vhNpGVX0yryZzV0Y1xlWT5cwYWKR5+WASJxLXhxDaFHO+6
+kwEx8tRtO/JW5zreWZh3u1Bp7+O/I09wAfCvil40gHur5GsxbfJ3UlqvxzT9qmo4
+6sUZbW7HdGYwCwHpTkXDd3l0UULyx5zAcuiEHBmSRXL2pLJF/ekVqTk7NvqpgsN8
+AM1vB+uBFJHOiQ9ZxQTzM0P90Oby0IUhEdMFQQQAtmoZsw+LUhwwOAYrofjUYm5G
+NZwWMwifFU5rMDgjvh6GNVVN+egtjwqamvxN/DXHO3AFMu4x9+EAtYg+k9bYbb9u
+g5HpYblTQIg9ekZniC3Ik6Il7l/jzw6vB+1lFovQdBa+/jcqOEhZrbhsQzVi50FC
+iSnIoZb+ZbbGa+rJam+OPtQ7C5WtbpLapukhnLgAyOUTrKBjDe1eOdoFyKBCQvc9
+s+xDtppj9FcBSfZQ1VFk5RkSEw8KSD6PEDLEgLo1MY0AxQwb83IYy2UTPRoB84MY
+9HcrAm/fRYT1wqjv2n+BxZkdNq7ErpHLyvn/TA8vvIxT/A43qsmG7/g35p1f+fm/
+RySDLGNZe4Wedr+/ipFKhECeSPsc/AewrOz2fU/unCY5UUB0NqKIOBE5mHG7fP9Q
+53ivR3ZFbvtW99xv1vEM/DyYdPEvSCSni7wjVJhnvhf0vbi8GEX68WIWQRvTbmD9
+C8LzN1NFCc77jLwL+i9yr01yfDNBkFFR8hUS+Gkw5gBB2QD2xFzWpK0808phxU35
+QBsOaVtyOH5cp+/xHpUSHBb7sd49YMiN8k2XuDEB9HHXqEeSLx8Y0MbDW+Mqo1Z5
+IsflLMWE50gI6aAnaRL0tPlCttwCqT3CH527D4AmJkuFBhpvawJ0AuKLzMZMoH7K
+/a0yuApjwY1T93x0yY5IAiraLNsBRgNUzN6Dg7nIp3TfvIDfHFYXunfc2ch8jctm
+0Aw9Snb499iYKY4+sho5ZaEzcWwwHV9Y2bkelG47I3zncSJSMKYm81Hw2jbrPgec
+-----END RSA PRIVATE KEY-----

pyhanko_cli-0.4.0/pyhanko_testing_commons/test_data/data/fonts/LICENSE.SourceSerif

@@ -0,0 +1,93 @@
+Copyright 2014 - 2023 Adobe (http://www.adobe.com/), with Reserved Font Name ‘Source’. All Rights Reserved. Source is a trademark of Adobe in the United States and/or other countries.
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+
+This license is copied below, and is also available with a FAQ at: http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

pyhanko_cli-0.4.0/pyhanko_testing_commons/test_data/data/pdf/.gitignore

@@ -0,0 +1 @@
+!*.pdf

{pyhanko_cli-0.3.0 → pyhanko_cli-0.4.0}/pyproject.toml

@@ -33,12 +33,13 @@ requires-python = ">=3.10"
 dependencies = [
     "asn1crypto>=1.5.1",
     "tzlocal>=4.3",
-    "pyhanko>=0.34.0,<0.35",
-    "pyhanko-certvalidator>=0.30.0,<0.31",
+    "pyhanko>=0.35.0,<0.36",
+    "pyhanko-certvalidator>=0.31.0,<0.32",
+    "certifi>=2023.5.7",
     "click>=8.1.3,!=8.2.0",
     "platformdirs>=4.3.8",
 ]
-version = "0.3.0"
+version = "0.4.0"
 
 
 [project.readme]
@@ -53,7 +54,7 @@ Changes = "https://docs.pyhanko.eu/en/latest/changelog.html"
 "Issue Tracker" = "https://github.com/MatthiasValvekens/pyHanko/issues"
 
 [dependency-groups]
-testing-base = ["pytest>=6.1.1", "requests-mock>=1.8.0", "freezegun>=1.1.0", "certomancer>=0.13.0,<0.14", "pytest-cov>=4.0,<7.1", "pytest-asyncio>=1.1.0,<2.0"]
+testing-base = ["pytest>=6.1.1", "requests-mock>=1.8.0", "freezegun>=1.1.0", "certomancer>=0.13.0,<0.15", "pytest-cov>=4.0,<7.2", "pytest-asyncio>=1.1.0,<2.0"]
 testing = [{include-group = "testing-base"}, "aiohttp>=3.9,<3.14", "pytest-aiohttp>=1.0.4,<1.2.0", "pyhanko[pkcs11,opentype,async_http,image-support,qr,etsi]"]
 
 [project.scripts]
@@ -76,6 +77,7 @@ markers = [
     "hsm: run test on HSM platform",
     "algo: indicate signing algorithm used in test",  # so far only used in PKCS#11 suite
 ]
+strict = true
 
 [tool.coverage.run]
 omit = ["*docs*", "*test*", "*venv*", "setup.py", "_saslprep.py"]

{pyhanko_cli-0.3.0 → pyhanko_cli-0.4.0}/src/pyhanko/cli/_ctx.py

@@ -1,3 +1,5 @@
+import getpass
+from abc import ABC, abstractmethod
 from dataclasses import dataclass, field
 from typing import Optional
 
@@ -6,6 +8,39 @@ from pyhanko.sign.fields import SigFieldSpec
 from pyhanko.sign.signers import PdfSignatureMetadata
 from pyhanko.stamp import BaseStampStyle
 
+__all__ = [
+    'PasswordPrompter',
+    'GetpassPrompter',
+    'UXContext',
+    'CLIContext',
+]
+
+
+class PasswordPrompter(ABC):
+    """
+    Interface for prompting the user for a password / passphrase / PIN.
+    """
+
+    @abstractmethod
+    def prompt_for_password(self, prompt: str) -> str:
+        """
+        Prompt the user for a password.
+
+        :param prompt: The prompt string to display to the user.
+        :return: The password entered by the user.
+        """
+        raise NotImplementedError
+
+
+class GetpassPrompter(PasswordPrompter):
+    """
+    Default :class:`PasswordPrompter` implementation that uses
+    :func:`getpass.getpass`.
+    """
+
+    def prompt_for_password(self, prompt: str) -> str:
+        return getpass.getpass(prompt=prompt)
+
 
 @dataclass
 class UXContext:
@@ -21,6 +56,12 @@ class UXContext:
     or passes `--style-name` explicitly.
     """
 
+    prompter: PasswordPrompter = field(default_factory=GetpassPrompter)
+    """
+    Implementation to use when prompting the user for a password, passphrase
+    or PIN.
+    """
+
 
 @dataclass
 class CLIContext:

{pyhanko_cli-0.3.0 → pyhanko_cli-0.4.0}/src/pyhanko/cli/_root.py

@@ -3,8 +3,9 @@ import logging
 from typing import Iterable, Optional
 
 import click
+import yaml
 from pyhanko.cli._ctx import CLIContext
-from pyhanko.cli.config import CLIRootConfig, parse_cli_config
+from pyhanko.cli.config import CLIRootConfig, parse_cli_config_from_dict
 from pyhanko.cli.plugin_api import (
     SIGNING_PLUGIN_ENTRY_POINT_GROUP,
     SIGNING_PLUGIN_REGISTRY,
@@ -71,7 +72,7 @@ def _root(ctx: click.Context, config, verbose, no_plugins):
     ctx_obj: CLIContext = ctx.obj
     cfg: Optional[CLIRootConfig] = None
     if config_text is not None:
-        cfg = parse_cli_config(config_text)
+        cfg = load_root_config(yaml.safe_load(config_text), no_plugins)
         ctx_obj.config = cfg.config
         log_config = cfg.log_config
     else:
@@ -107,6 +108,20 @@ def _root(ctx: click.Context, config, verbose, no_plugins):
         logging.debug('There was no configuration to parse.')
 
 
+def load_root_config(config_dict, only_default_plugins=False) -> CLIRootConfig:
+
+    cfg = parse_cli_config_from_dict(config_dict)
+
+    from .commands.signing import register
+
+    plugins_to_register = _load_plugins(
+        cfg, plugins_enabled=not only_default_plugins
+    )
+    register(plugins_to_register)
+
+    return cfg
+
+
 def _load_plugins(root_config: Optional[CLIRootConfig], plugins_enabled: bool):
     from importlib import metadata
 

{pyhanko_cli-0.3.0 → pyhanko_cli-0.4.0}/src/pyhanko/cli/_trust.py

@@ -1,8 +1,10 @@
 import asyncio
+import ssl
 from dataclasses import dataclass
 from datetime import timedelta
 from typing import Any, Dict, Iterable, Optional, TypeVar, Union
 
+import certifi
 import click
 from asn1crypto import x509
 from pyhanko.cli.cache import get_eutl_cache_dir
@@ -114,7 +116,10 @@ async def init_trust_manager(
         if settings.eutl_force_redownload:
             tl_cache.reset()
 
-        async with aiohttp.ClientSession() as client:
+        ssl_context = ssl.create_default_context(cafile=certifi.where())
+        async with aiohttp.ClientSession(
+            connector=aiohttp.TCPConnector(ssl=ssl_context)
+        ) as client:
             if isinstance(settings.territories, str) and settings.territories:
                 territories = {
                     t.strip() for t in settings.territories.split(',')

{pyhanko_cli-0.3.0 → pyhanko_cli-0.4.0}/src/pyhanko/cli/commands/crypt.py

@@ -1,7 +1,6 @@
-import getpass
-
 import click
 from pyhanko.cli._root import cli_root
+from pyhanko.cli.plugin_api import prompt_for_password
 from pyhanko.cli.runtime import pyhanko_exception_manager
 from pyhanko.cli.utils import _warn_empty_passphrase, readable_file
 from pyhanko.keys import load_certs_from_pemder
@@ -37,7 +36,7 @@ def encrypt_file(infile, outfile, password, recipient):
             "Specify either a password or a list of recipients."
         )
     elif not password and not recipient:
-        password = getpass.getpass(prompt='Output file password: ')
+        password = prompt_for_password(prompt='Output file password: ')
 
     recipient_certs = None
     if recipient:
@@ -96,7 +95,7 @@ def decrypt_with_password(infile, outfile, password, force):
                     "File is not encrypted with the standard (password-based) security handler"
                 )
             if not password:
-                password = getpass.getpass(prompt='File password: ')
+                password = prompt_for_password(prompt='File password: ')
             auth_result = r.decrypt(password)
             if auth_result.status == crypt.AuthStatus.USER and not force:
                 raise click.ClickException(
@@ -147,7 +146,9 @@ def decrypt_with_pemder(infile, outfile, key, cert, passfile, force, no_pass):
         passphrase = passfile.read()
         passfile.close()
     elif not no_pass:
-        passphrase = getpass.getpass(prompt='Key passphrase: ').encode('utf-8')
+        passphrase = prompt_for_password(prompt='Key passphrase: ').encode(
+            'utf-8'
+        )
         if not passphrase:
             _warn_empty_passphrase()
             passphrase = None
@@ -206,7 +207,9 @@ def _decrypt_pubkey(
 @decrypt_force_flag
 def decrypt_with_pkcs12(infile, outfile, pfx, passfile, force):
     if passfile is None:
-        passphrase = getpass.getpass(prompt='Key passphrase: ').encode('utf-8')
+        passphrase = prompt_for_password(prompt='Key passphrase: ').encode(
+            'utf-8'
+        )
     else:
         passphrase = passfile.readline().strip().encode('utf-8')
         passfile.close()

{pyhanko_cli-0.3.0 → pyhanko_cli-0.4.0}/src/pyhanko/cli/commands/signing/__init__.py

@@ -7,7 +7,10 @@ from pyhanko.cli._trust import (
     build_vc_kwargs,
     trust_options,
 )
-from pyhanko.cli.commands.signing.plugin import command_from_plugin
+from pyhanko.cli.commands.signing.plugin import (
+    command_from_plugin,
+    preconfigured_identity_command,
+)
 from pyhanko.cli.commands.stamp import select_style
 from pyhanko.cli.utils import parse_field_location_spec
 from pyhanko.pdf_utils.incremental_writer import IncrementalPdfFileWriter
@@ -273,9 +276,12 @@ def register(plugins: List[SigningCommandPlugin]):
     # we reset the command list before (re)populating it, in order to
     # make the tests more consistent
     addsig.commands = {}
+    available_commands = {}
     for signer_plugin in plugins:
         if signer_plugin.is_available():
-            addsig.add_command(command_from_plugin(signer_plugin))
+            cmd = command_from_plugin(signer_plugin)
+            addsig.add_command(cmd)
+            available_commands[signer_plugin.subcommand_name] = cmd
         else:
             addsig.add_command(
                 click.Command(
@@ -284,6 +290,7 @@ def register(plugins: List[SigningCommandPlugin]):
                     callback=_unavailable(signer_plugin),
                 )
             )
+    addsig.add_command(preconfigured_identity_command(available_commands))
 
 
 readable_file = click.Path(exists=True, readable=True, dir_okay=False)

{pyhanko_cli-0.3.0 → pyhanko_cli-0.4.0}/src/pyhanko/cli/commands/signing/pkcs11_cli.py

@@ -1,13 +1,12 @@
 import contextlib
 import dataclasses
-import getpass
 import os
 from typing import ContextManager, List, Optional
 
 import click
 from pyhanko.cli._ctx import CLIContext
 from pyhanko.cli.config import CLIConfig
-from pyhanko.cli.plugin_api import SigningCommandPlugin
+from pyhanko.cli.plugin_api import SigningCommandPlugin, prompt_for_password
 from pyhanko.cli.utils import logger, readable_file
 from pyhanko.config.errors import ConfigurationError
 from pyhanko.config.pkcs11 import (
@@ -193,13 +192,15 @@ def _pkcs11_signer_context(
         )
 
     if pkcs11_config.prompt_pin == PKCS11PinEntryMode.PROMPT and pin is None:
-        pin = getpass.getpass(prompt='PKCS#11 user PIN: ')
+        pin = prompt_for_password(prompt='PKCS#11 user PIN: ')
 
     with pkcs11.PKCS11SigningContext(pkcs11_config, user_pin=pin) as signer:
         if pkcs11_config.signing_pin_mode == PKCS11SigningPinEntryMode.PROMPT:
 
             def _signing_kwargs(*_args, **_kwargs):
-                signing_pin = getpass.getpass(prompt='PKCS#11 signing PIN: ')
+                signing_pin = prompt_for_password(
+                    prompt='PKCS#11 signing PIN: '
+                )
                 return {'pin': signing_pin}
 
             signer.sign_kwargs = _signing_kwargs

{pyhanko_cli-0.3.0 → pyhanko_cli-0.4.0}/src/pyhanko/cli/commands/signing/plugin.py

@@ -1,6 +1,6 @@
 import asyncio
 from datetime import datetime
-from typing import List, Optional
+from typing import Dict, List, Optional
 
 import click
 import tzlocal
@@ -103,7 +103,9 @@ def _callback_logic(
                 out.write(output_bytes)
         else:
             with open_for_signing(
-                infile_path=infile, lenient=cli_ctx.lenient
+                infile_path=infile,
+                lenient=cli_ctx.lenient,
+                prompter=cli_ctx.ux.prompter,
             ) as w:
                 if cli_ctx.ux.visible_signature_desired:
                     _ensure_field_visible(
@@ -146,3 +148,56 @@ def command_from_plugin(plugin: SigningCommandPlugin) -> click.Command:
         help=plugin.help_summary,
         params=params,
     )
+
+
+def preconfigured_identity_command(
+    plugins_by_name: Dict[str, click.Command],
+) -> click.Command:
+
+    def _callback(*, identity: str, infile: str, outfile: str):
+        ctx = click.get_current_context()
+        cli_ctx: CLIContext = ctx.obj
+        config = cli_ctx.config
+        if config is None:
+            raise click.ClickException(
+                "Identity command requires a config file"
+            )
+        try:
+            identity_obj = config.identities[identity]
+        except KeyError:
+            raise click.ClickException(
+                f"Identity {identity!r} not found in config file"
+            )
+        try:
+            plugin = plugins_by_name[identity_obj.plugin]
+        except KeyError:
+            raise click.ClickException(
+                f"Plugin {identity_obj.plugin!r} referenced by "
+                f"identity {identity!r} is not available"
+            )
+        # To make sure the semantics of the "identity <key>" invocation
+        #  are the exact same as those of the underlying plugin's command,
+        #  we invoke the _actual_ command here
+        valid_keys = {p.name for p in plugin.params}
+        params = {}
+        for k, v in identity_obj.parameters.items():
+            if k not in valid_keys:
+                raise click.ClickException(
+                    f"Parameter {k!r} defined by {identity!r} "
+                    f"not known for plugin {identity_obj.plugin!r}."
+                )
+            params[k] = v
+        params['infile'] = infile
+        params['outfile'] = outfile
+        ctx.invoke(plugin, **params)
+
+    return click.Command(
+        name="identity",
+        callback=_callback,
+        help="sign using identity defined in config file",
+        params=[
+            click.Argument(('identity',), type=str),
+            click.Argument(('infile',), type=readable_file),
+            click.Argument(('outfile',), type=writable_file),
+        ],
+    )