pyhanko-cli 0.3.1__tar.gz → 0.4.1__tar.gz

{pyhanko_cli-0.3.1/src/pyhanko_cli.egg-info → pyhanko_cli-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: pyhanko-cli
-Version: 0.3.1
+Version: 0.4.1
 Summary: CLI tools for stamping and signing PDF files
 Author-email: Matthias Valvekens <dev@mvalvekens.be>
 Maintainer-email: Matthias Valvekens <dev@mvalvekens.be>
@@ -27,8 +27,10 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 Requires-Dist: asn1crypto>=1.5.1
 Requires-Dist: tzlocal>=4.3
-Requires-Dist: pyhanko<0.35,>=0.34.1
-Requires-Dist: pyhanko-certvalidator<0.31,>=0.30.1
+Requires-Dist: pyhanko<0.37,>=0.36.0
+Requires-Dist: pyhanko-certvalidator<0.32,>=0.31.2
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: certifi>=2023.5.7
 Requires-Dist: click!=8.2.0,>=8.1.3
 Requires-Dist: platformdirs>=4.3.8
 Dynamic: license-file

{pyhanko_cli-0.3.1 → pyhanko_cli-0.4.1}/pyhanko_testing_commons/test_data/certomancer_trust_lists.py

@@ -1,4 +1,4 @@
-from typing import List, Tuple
+from datetime import datetime, timezone
 from urllib.parse import urlparse
 
 from aiohttp.test_utils import TestClient
@@ -123,7 +123,11 @@ def certomancer_pki_as_trusted_list(
     pki_arch: PKIArchitecture, tlso_entity: EntityLabel
 ):
     xml_root = ts_119612.TrustServiceStatusList(
-        scheme_information=ts_119612.SchemeInformation(),
+        scheme_information=ts_119612.SchemeInformation(
+            list_issue_date_time=XmlDateTime.from_datetime(
+                datetime.now(tz=timezone.utc)
+            ),
+        ),
         trust_service_provider_list=ts_119612.TrustServiceProviderList(
             trust_service_provider=tuple(
                 ts_119612.TrustServiceProvider(
@@ -139,7 +143,7 @@ def certomancer_pki_as_trusted_list(
 def certomancer_lotl(
     pki_arch: PKIArchitecture,
     lotl_tlso_entity: EntityLabel,
-    entries: List[Tuple[CertLabel, str, str]],
+    entries: list[tuple[CertLabel, str, str]],
 ):
     pointers = [
         ts_119612.OtherTSLPointer(
@@ -173,10 +177,13 @@ def certomancer_lotl(
 
     xml_root = ts_119612.TrustServiceStatusList(
         scheme_information=ts_119612.SchemeInformation(
-            scheme_information_uri=ts_119612.SchemeInformationURI(uri=tuple()),
+            scheme_information_uri=ts_119612.SchemeInformationURI(uri=()),
             pointers_to_other_tsl=ts_119612.PointersToOtherTSL(
                 other_tslpointer=tuple(pointers)
             ),
+            list_issue_date_time=XmlDateTime.from_datetime(
+                datetime.now(tz=timezone.utc)
+            ),
         ),
     )
     return _sign_tl(xml_root, pki_arch, lotl_tlso_entity)

{pyhanko_cli-0.3.1 → pyhanko_cli-0.4.1}/pyhanko_testing_commons/test_data/data/crypto/certomancer.yml

@@ -37,25 +37,21 @@ keysets:
     keys:
       root:
         path: root_ca.key.pem
-        password: secret
       interm:
         path: intermediate_ca.key.pem
-        password: secret
       tsa:
         path: tsa.key.pem
-        password: secret
       tsa2:
         path: tsa2.key.pem
+      tsa-rsa:
+        path: tsa_rsa.key.pem
         password: secret
       interm-ocsp:
         path: ocsp.key.pem
-        password: secret
       signer1:
         path: signer.key.pem
-        password: secret
       signer2:
         path: signer2.key.pem
-        password: secret
       decrypter1:
         path: decrypter1.key.pem  # secp256r1
       decrypter2:
@@ -100,6 +96,32 @@ keysets:
         path: signer.key.pem
       signer2:
         path: signer2.key.pem
+  testing-ca-mldsa:
+    # NOTE: since we haven't rigged Certomancer with MLDSA support yet,
+    # all but the 3 signer keys are ED25519 keys.
+    path-prefix: keys-mldsa
+    keys:
+      root:
+        path: root_ca.key.pem
+      interm:
+        path: intermediate_ca.key.pem
+      tsa:
+        path: tsa.key.pem
+      tsa2:
+        path: tsa2.key.pem
+      interm-ocsp:
+        path: ocsp.key.pem
+      # important: these need to be serialised seed-only!
+      # This requires -provparam "ml-dsa.output_formats=seed-only", at least on the
+      # current latest system openssl version on macos
+      signer1:
+        path: signer_mldsa44.key.pem
+      signer2:
+        path: signer_mldsa44.key.pem
+      signer1_65:
+        path: signer_mldsa65.key.pem
+      signer1_87:
+        path: signer_mldsa87.key.pem
   testing-ca-ed448:
     path-prefix: keys-ed448
     keys:
@@ -333,6 +355,20 @@ pki-architectures:
   testing-ca-ecdsa:
     template: testing-ca
     keyset: testing-ca-ecdsa
+    entities:
+      tsa-rsa:
+        common-name: Time Stamping Authority (RSA)
+    certs:
+      tsa-rsa:
+        template: tsa
+        subject: tsa-rsa
+        subject-key: tsa-rsa
+    services:
+      time-stamping:
+        tsa-rsa:
+          signing-key: tsa-rsa
+          signing-cert: tsa-rsa
+          digest-algo: sha512
   ecc-testing-ca-with-decrypters:
     template: testing-ca
     keyset: testing-ca-ecdsa
@@ -379,6 +415,24 @@ pki-architectures:
           signing-key: tsa
           signing-cert: tsa
           digest-algo: sha512
+  testing-ca-mldsa:
+    template: testing-ca
+    keyset: testing-ca-mldsa
+    certs:
+      signer1_65:
+        template: signer1
+        subject: signer1
+        subject-key: signer1_65
+      signer1_87:
+        template: signer1
+        subject: signer1
+        subject-key: signer1_87
+    services:
+      time-stamping:
+        tsa:
+          signing-key: tsa
+          signing-cert: tsa
+          digest-algo: sha512
   testing-ca-ed448:
     template: testing-ca
     keyset: testing-ca-ed448

pyhanko_cli-0.4.1/pyhanko_testing_commons/test_data/data/crypto/keys-ecdsa/decrypter-x25519.key.pem

@@ -0,0 +1,3 @@
+-----BEGIN PRIVATE KEY-----
+MC4CAQAwBQYDK2VuBCIEIPAG3siLd6hc/UxXoXTYkQDzeB4iX24nDNfwc3fPv0Bt
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.1/pyhanko_testing_commons/test_data/data/crypto/keys-ecdsa/decrypter-x448.key.pem

@@ -0,0 +1,4 @@
+-----BEGIN PRIVATE KEY-----
+MEYCAQAwBQYDK2VvBDoEOAgg1UxiODX9qQ9upkZnBjN6dWr+dIi36xNV8kyU/zpH
+XBAm3Rr2vtxn66FLb9GL86TYDlU6HpnI
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.1/pyhanko_testing_commons/test_data/data/crypto/keys-ecdsa/decrypter1.key.pem

@@ -0,0 +1,5 @@
+-----BEGIN PRIVATE KEY-----
+MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgWNEOB9xGVakHc0Bn
+MAGoHLG2GQEyIy7huKj+XDk4K9qhRANCAARZHAkkk9jRfB0O/HfSl7RXtphQuUjv
+TffoL+fWKQQ9/2HdA2OHVzuEQLE+mzEpfvWSg8jtQtwhqn5owShkkrGT
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.1/pyhanko_testing_commons/test_data/data/crypto/keys-ecdsa/decrypter2.key.pem

@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDD9QeFAQJqX70LshnR4
+GrKhYdtpFlc+9Yiihn3Tz7gX1fsBxwdOXEQm9JpB37MHacahZANiAARh5dNyrcfb
+0Qwp60P4a65l5f0m3ol/SNQl/Lb1EYwovPjJuch9stppDWyZvGqJXfBuIBWhgJGd
+QgXsKu1DDX6eJzUjzqv9bqjDMT2xHXYEucfM+dI5BvmwJq8xAAYMSyo=
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.1/pyhanko_testing_commons/test_data/data/crypto/keys-ecdsa/decrypter3.key.pem

@@ -0,0 +1,8 @@
+-----BEGIN PRIVATE KEY-----
+MIHuAgEAMBAGByqGSM49AgEGBSuBBAAjBIHWMIHTAgEBBEIBtuGYcLkK2RLn5sMm
+CXa7q9GJIKnc/KWK0wskosgbJgQ9X5l9SaD/SLY+LnFOTZHqwVCm7JidGUyb5JTB
+525E7K+hgYkDgYYABAHtqDSTH6safq3VrnZHmt6QI+HcT8z1ORO4OqBHxcFhAp7y
+ZG5jGazFi73NTgGOyVJgzTVwzcaPdrTPmaSNUtoyrgCTdMbv5yPmQlS7mXuZ+r2b
+5TmdoIVi2ptXGi/5FEPeVotN//cLtrVS3U6px0mrEWNQH/ml7H7WshfDw/Idqf2Y
+0Q==
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.1/pyhanko_testing_commons/test_data/data/crypto/keys-ecdsa/intermediate_ca.key.pem

@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDAEzwhf7zGYpmekTy2i
+jKcPuGIL+VQs2v5EOuisZSDUtdF9kPKjo9N2Q7TOTjTAOM2hZANiAASPyBseZ0vP
+AX2RKlwrPKg8Rcgmw5OdkxmRmSGgXtmm24eILFxQosQyxdyQK8AaijYLs/86rgfk
+cvjwZ9mE0z0XhZs617SLovbuWvDg6aQGpUQR8AwbJIe/LqWO8cqqyMI=
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.1/pyhanko_testing_commons/test_data/data/crypto/keys-ecdsa/ocsp.key.pem

@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDB753e9U9IilLa3iBVJ
+YrVnnXJG1zcac7RST0YnBrR35KVZkyfEysJdE70MTD8DLf+hZANiAARDcIq1rs/Q
+s65aLELkes5BVgyYvPL0y/5aN2TV2p0iwzBtcMsGexPs9SShp5qJClVpCUQwq0kQ
+nCZ4aLc5liR8uJf9UckKNiG+BjUfZGpwrC0uUAzrD18X06NH6aPLoNc=
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.1/pyhanko_testing_commons/test_data/data/crypto/keys-ecdsa/root_ca.key.pem

@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDDZELAjP9K1Tu4d60c4
+uH3PIXkaFbK7VikKYA0CSET06LUUBI/19tvxn6LXWVrXUQShZANiAARoSeKHPKF8
+tzbuY8/kVNgy6/2Tm6KU4H2CRsMTCCaTfOGhQOJFu5hLomfrW6S+mMz5Vzr+c/68
+TUsoH8vLL3c6mrlsZDZhL95esPZCK3ScxyBFUHShKaCMM61Th3UVOxo=
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.1/pyhanko_testing_commons/test_data/data/crypto/keys-ecdsa/signer.key.pem

@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDCGwezdoIghoZnBPZM/
+K2yhCVZUkHLDdx8nQtlqqPc+NpHS9UsOM0UnphiB1AbXu6ihZANiAARz7HrBWoCv
+7KyhernqqqAGDoiw34adGQd2wmsN+5TYhwhDCzS+vqtjc4m9FYER0T402HYMe7bM
+SikY3y1JITMlGL3mspfnuMEgeRRpNw8jAqu7inScPOfTp4oKyIrOpjQ=
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.1/pyhanko_testing_commons/test_data/data/crypto/keys-ecdsa/signer2.key.pem

@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDCtw/AbLPj9CsE7SyIm
+xGUNFRvZonjaR7XZbNuls8Hh6dGVsiz2lYj1dpcPQ7NBLgGhZANiAASv5DVAVL8+
+aNjbkjaFLCfMZx+KxudP6yewKTYk9kMQmx+9dEscz5XSUI/auHUCaYC4wtwWmV1w
+9IveFV+6JEU+0CRtiGRw9RvfGQcSasBrBJPkd/uUw33RGb1E/749YEI=
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.1/pyhanko_testing_commons/test_data/data/crypto/keys-ecdsa/tsa.key.pem

@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDCHHys1SN4eaB8YckPF
+5BbJlHK1rebbDPVW/uwBybEYizVHLdVFFD3Wcbqmy5q5X0KhZANiAARHmIokodeT
+7yai1BnAKotkTFb9RKE5OFnULiwW1dGNmdl2+R7WBhf5kzMf6YwEO9u75XJlut26
+leaIyem4jPQdcH4f/EjHJ4vZPrxVr1/5mm5tRJtWCxhvXdkQsROCsPY=
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.1/pyhanko_testing_commons/test_data/data/crypto/keys-ecdsa/tsa2.key.pem

@@ -0,0 +1,6 @@
+-----BEGIN PRIVATE KEY-----
+MIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDAt+eMBC8Uv+2JX+rwq
+5MHMVEHQu8sqtpVQ+w7lrnM7RlOXN2Z88tIhnFX83mOGPbmhZANiAAS/1cx5q4Ac
+2jSchMuKX7k8lgx9IV3GJwNnzZccmDGApP/P9nCg8SX6z1wKGohVgGkxpPuseBZQ
+fi1qXujiuJL0BCCrGsSZRHxufnwzwo2y5hgT9ZCqi8elECdRp6pAIcY=
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.1/pyhanko_testing_commons/test_data/data/crypto/keys-mldsa/intermediate_ca.key.pem

@@ -0,0 +1,3 @@
+-----BEGIN PRIVATE KEY-----
+MC4CAQAwBQYDK2VwBCIEIOda8lQywTHCaJMo41Wty19KxsYRmVkMeVtluXPbZUKz
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.1/pyhanko_testing_commons/test_data/data/crypto/keys-mldsa/ocsp.key.pem

@@ -0,0 +1,3 @@
+-----BEGIN PRIVATE KEY-----
+MC4CAQAwBQYDK2VwBCIEIHe0QdstGVyn93jZ3olw/RhgZg5PPz6+M97NkPxy9C2E
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.1/pyhanko_testing_commons/test_data/data/crypto/keys-mldsa/root_ca.key.pem

@@ -0,0 +1,3 @@
+-----BEGIN PRIVATE KEY-----
+MC4CAQAwBQYDK2VwBCIEIAqHl17UGu2zm3JiOFLmd630o5Dp9Q8PaCMa8odKs5XZ
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.1/pyhanko_testing_commons/test_data/data/crypto/keys-mldsa/signer_mldsa44.key.pem

@@ -0,0 +1,4 @@
+-----BEGIN PRIVATE KEY-----
+MDQCAQAwCwYJYIZIAWUDBAMRBCKAIB/aBy4/Jhodmoqq8yx3Pd4YOI96ML19+Cg6
+Ef7jxMZf
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.1/pyhanko_testing_commons/test_data/data/crypto/keys-mldsa/signer_mldsa65.key.pem

@@ -0,0 +1,4 @@
+-----BEGIN PRIVATE KEY-----
+MDQCAQAwCwYJYIZIAWUDBAMSBCKAIGVTGORNhhtxh6VRoylNkskhaf4m8oDlgwlx
+FgjJuO7B
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.1/pyhanko_testing_commons/test_data/data/crypto/keys-mldsa/signer_mldsa87.key.pem

@@ -0,0 +1,4 @@
+-----BEGIN PRIVATE KEY-----
+MDQCAQAwCwYJYIZIAWUDBAMTBCKAIJLJVt3d4b+5fySpycv+sAuvxGZ1Q09wI96J
+RjgFmN31
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.1/pyhanko_testing_commons/test_data/data/crypto/keys-mldsa/tsa.key.pem

@@ -0,0 +1,3 @@
+-----BEGIN PRIVATE KEY-----
+MC4CAQAwBQYDK2VwBCIEIGmqhL3f2qcnzS6YCeS7OuDWczsjC8Egm89kjpJJKJnT
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.1/pyhanko_testing_commons/test_data/data/crypto/keys-mldsa/tsa2.key.pem

@@ -0,0 +1,3 @@
+-----BEGIN PRIVATE KEY-----
+MC4CAQAwBQYDK2VwBCIEIBnT0PW5V4mwUbPAuKlJoq3HqjEmUbWPv2v4gJl6QuTE
+-----END PRIVATE KEY-----

pyhanko_cli-0.4.1/pyhanko_testing_commons/test_data/data/crypto/keys-rsa/tsa.key.pem

@@ -0,0 +1,30 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: AES-256-CBC,32635A4426FAA0AD7E76EB7D3ED8D696
+
+PS9YmhrMah6NQwKb0emFT+Vi0gP4LA2WSn963waS6NHaeXJsCjqUBzWsjfhH3+MZ
+VFNf+e8YMPojJR7WLLn0aweSEsJ2HtPebbmCqcf3VA0BUDDkpStvWx+06UIb9BcI
+6kZrJyVfpw0paAEt65i5faTrnAu5VxApQ8RxaCexYAm2abvdSBnBkqBG/Flh4nku
+zUSl60WgynpX742e4l0++Twsw4RHQGSOPnvdT5VxSrcXSxL0Wgr0gDkHFMYBtYj3
+NV6upBmHCjasLmAEZZmf4F34jDOCPmx0yPKlwVx/y5M+zq6XKQh6Cawoq0Pxy/Cl
+2y+/mPMUlY//fVdVCbbfwsU+U82n1mlEno6UhIiAlkPasmqX/fTZkWGZmhN5jrim
+vm+dlqv/AhC3neJZLSITNq/idyWp3hpV3cZhQYWXw23zP5l+4IZf3PHuXpDaRKUG
+ehaYN1ddbjXA8yaRf+UzROuE/eZg0+w3Y5GLObHzGmAMfi3D436MEj44ljiYu72P
+OEpPvFJpr+WS/ftLFXe/wUyyHmp9dhY9E6Nrb0zK1ex8pOJXCa2nLpzMOmzwBObN
+M4n1lx3exJPW8amVT3vhNpGVX0yryZzV0Y1xlWT5cwYWKR5+WASJxLXhxDaFHO+6
+kwEx8tRtO/JW5zreWZh3u1Bp7+O/I09wAfCvil40gHur5GsxbfJ3UlqvxzT9qmo4
+6sUZbW7HdGYwCwHpTkXDd3l0UULyx5zAcuiEHBmSRXL2pLJF/ekVqTk7NvqpgsN8
+AM1vB+uBFJHOiQ9ZxQTzM0P90Oby0IUhEdMFQQQAtmoZsw+LUhwwOAYrofjUYm5G
+NZwWMwifFU5rMDgjvh6GNVVN+egtjwqamvxN/DXHO3AFMu4x9+EAtYg+k9bYbb9u
+g5HpYblTQIg9ekZniC3Ik6Il7l/jzw6vB+1lFovQdBa+/jcqOEhZrbhsQzVi50FC
+iSnIoZb+ZbbGa+rJam+OPtQ7C5WtbpLapukhnLgAyOUTrKBjDe1eOdoFyKBCQvc9
+s+xDtppj9FcBSfZQ1VFk5RkSEw8KSD6PEDLEgLo1MY0AxQwb83IYy2UTPRoB84MY
+9HcrAm/fRYT1wqjv2n+BxZkdNq7ErpHLyvn/TA8vvIxT/A43qsmG7/g35p1f+fm/
+RySDLGNZe4Wedr+/ipFKhECeSPsc/AewrOz2fU/unCY5UUB0NqKIOBE5mHG7fP9Q
+53ivR3ZFbvtW99xv1vEM/DyYdPEvSCSni7wjVJhnvhf0vbi8GEX68WIWQRvTbmD9
+C8LzN1NFCc77jLwL+i9yr01yfDNBkFFR8hUS+Gkw5gBB2QD2xFzWpK0808phxU35
+QBsOaVtyOH5cp+/xHpUSHBb7sd49YMiN8k2XuDEB9HHXqEeSLx8Y0MbDW+Mqo1Z5
+IsflLMWE50gI6aAnaRL0tPlCttwCqT3CH527D4AmJkuFBhpvawJ0AuKLzMZMoH7K
+/a0yuApjwY1T93x0yY5IAiraLNsBRgNUzN6Dg7nIp3TfvIDfHFYXunfc2ch8jctm
+0Aw9Snb499iYKY4+sho5ZaEzcWwwHV9Y2bkelG47I3zncSJSMKYm81Hw2jbrPgec
+-----END RSA PRIVATE KEY-----

{pyhanko_cli-0.3.1 → pyhanko_cli-0.4.1}/pyhanko_testing_commons/test_data/data/crypto/testing-ca-setup/pkcs11-setup-certomancer.sh

@@ -10,6 +10,7 @@ cleanup() {
   softhsm2-util --delete-token --token testdsa
   softhsm2-util --delete-token --token tested25519
   softhsm2-util --delete-token --token tested448
+  softhsm2-util --delete-token --token testmldsa
 }
 
 softhsm2-util --init-token --label testecdsa --pin 1234 --so-pin 5678 --free
@@ -17,9 +18,10 @@ softhsm2-util --init-token --label testrsa --pin 1234 --so-pin 5678 --free
 softhsm2-util --init-token --label testdsa --pin 1234 --so-pin 5678 --free
 softhsm2-util --init-token --label tested25519 --pin 1234 --so-pin 5678 --free
 softhsm2-util --init-token --label tested448 --pin 1234 --so-pin 5678 --free
+softhsm2-util --init-token --label testmldsa --pin 1234 --so-pin 5678 --free
 
 alchemise() {
-  uv run --exact --group testing --extra pkcs11 \
+  uv run --exact --group testing-pkcs11-setup \
      certomancer --config "$CERTOMANCER_CONFIG_PATH" alch --cert signer1 \
      --include-chain --pin 1234 --module "$SOFTHSM2_MODULE_PATH" \
      --token-label $1 $2
@@ -30,3 +32,7 @@ alchemise testecdsa testing-ca-ecdsa
 alchemise testdsa testing-ca-dsa
 alchemise tested25519 testing-ca-ed25519
 alchemise tested448 testing-ca-ed448
+
+if [[ "$P11_PQC" = yes ]] ; then
+  alchemise testmldsa testing-ca-mldsa
+fi

pyhanko_cli-0.4.1/pyhanko_testing_commons/test_data/data/fonts/LICENSE.SourceSerif

@@ -0,0 +1,93 @@
+Copyright 2014 - 2023 Adobe (http://www.adobe.com/), with Reserved Font Name ‘Source’. All Rights Reserved. Source is a trademark of Adobe in the United States and/or other countries.
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+
+This license is copied below, and is also available with a FAQ at: http://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

pyhanko_cli-0.4.1/pyhanko_testing_commons/test_data/data/pdf/.gitignore

@@ -0,0 +1 @@
+!*.pdf

pyhanko_cli-0.4.1/pyhanko_testing_commons/test_data/data/pdf/layout-tests/default-font.pdf

@@ -0,0 +1,138 @@
+%PDF-1.7
+%¥±ë
+1 0 obj
+<<
+/Type /Catalog
+/Pages 2 0 R
+>>
+endobj
+2 0 obj
+<<
+/Type /Pages
+/Count 1
+/Kids [ 4 0 R ]
+>>
+endobj
+3 0 obj
+<<
+/Length 0
+>>
+stream
+
+endstream
+endobj
+4 0 obj
+<<
+/Type /Page
+/MediaBox [ 0 0 595 842 ]
+/Resources 11 0 R
+/Contents 8 0 R
+/Parent 2 0 R
+>>
+endobj
+5 0 obj
+<<
+/Type /FontDescriptor
+/FontName /Courier
+/Flags 35
+/FontBBox [ -23 -250 715 805 ]
+/Ascent 629
+/Descent -157
+/CapHeight 629
+/ItalicAngle 0
+/StemV 51
+/MissingWidth 600
+/AvgWidth 600
+/MaxWidth 600
+>>
+endobj
+6 0 obj
+<<
+/BBox [ 0 40 74 0 ]
+/Resources <<
+/Font <<
+/F1 <<
+/Type /Font
+/BaseFont /Courier
+/Subtype /Type1
+/Encoding /WinAnsiEncoding
+/FirstChar 32
+/LastChar 32
+/Widths [ 600 ]
+/FontDescriptor 5 0 R
+>>
+>>
+>>
+/Type /XObject
+/Subtype /Form
+/Length 156
+>>
+stream
+q q 1 0 0 1 0 0 cm 1 0 0 1 10 10 cm /Tx BMC q BT /F1 10 Tf 10 TL /F1 10 Tf 10 TL 0 10 Td (Test Test) Tj T* (test test) Tj T* ET Q EMC Q 3 w 0 0 74 40 re S Q
+endstream
+endobj
+7 0 obj
+<<
+/Length 1
+>>
+stream
+q
+endstream
+endobj
+8 0 obj
+[ 7 0 R 3 0 R 9 0 R 10 0 R ]
+endobj
+9 0 obj
+<<
+/Length 1
+>>
+stream
+Q
+endstream
+endobj
+10 0 obj
+<<
+/Length 63
+>>
+stream
+q 1 0 0 1 30 120 cm /Stamp0eaaa1d6ce1343d682b66ac385aa51bc Do Q
+endstream
+endobj
+11 0 obj
+<<
+/XObject <<
+/Stamp0eaaa1d6ce1343d682b66ac385aa51bc 6 0 R
+>>
+>>
+endobj
+12 0 obj
+<<
+/ModDate (D\07220260624225710\05302\04700\047)
+/Producer (pyHanko 0\0560\0560\056dev1)
+>>
+endobj
+xref
+0 13
+0000000000 65535 f 
+0000000017 00000 n 
+0000000066 00000 n 
+0000000125 00000 n 
+0000000174 00000 n 
+0000000281 00000 n 
+0000000496 00000 n 
+0000000931 00000 n 
+0000000981 00000 n 
+0000001025 00000 n 
+0000001075 00000 n 
+0000001189 00000 n 
+0000001271 00000 n 
+trailer
+<<
+/Root 1 0 R
+/Info 12 0 R
+/ID [ <ff6759a3abc39542eaed5fbab155e8e9> <127f7da69b2fe0e63f113bf55002e384> ]
+/Size 13
+>>
+startxref
+1380
+%%EOF