sgx.py 0.12.dev0__tar.gz → 0.12.dev2__tar.gz

sgx_py-0.12.dev2/PKG-INFO

@@ -0,0 +1,38 @@
+Metadata-Version: 2.4
+Name: sgx.py
+Version: 0.12.dev2
+Summary: SGX
+Home-page: http://github.com/skalenetwork/sgx.py
+Author: SKALE Labs
+Author-email: support@skalelabs.com
+Requires-Python: >=3.11,<4
+License-File: LICENSE
+Requires-Dist: cryptography<51,>=50.0.2
+Requires-Dist: cytoolz>=0.12
+Requires-Dist: eth-account<0.15,>=0.13
+Requires-Dist: eth-hash[pycryptodome]>=0.7
+Requires-Dist: eth-utils<7,>=5
+Requires-Dist: hexbytes<3,>=1
+Requires-Dist: pem==23.1.0
+Requires-Dist: pyzmq==27.2.0
+Requires-Dist: requests>=2.33.0
+Requires-Dist: urllib3>=2.8.0
+Provides-Extra: linter
+Requires-Dist: ruff==0.17.2; extra == "linter"
+Provides-Extra: dev
+Requires-Dist: ruff==0.17.2; extra == "dev"
+Requires-Dist: build==1.6.1; extra == "dev"
+Requires-Dist: coincurve==13.0.0; extra == "dev"
+Requires-Dist: python-dotenv==1.2.4; extra == "dev"
+Requires-Dist: twine==7.0.0; extra == "dev"
+Requires-Dist: pytest==9.1.1; extra == "dev"
+Requires-Dist: mock==5.2.0; extra == "dev"
+Requires-Dist: web3==8.0.0; extra == "dev"
+Dynamic: author
+Dynamic: author-email
+Dynamic: home-page
+Dynamic: license-file
+Dynamic: provides-extra
+Dynamic: requires-dist
+Dynamic: requires-python
+Dynamic: summary

sgx_py-0.12.dev2/README.md

@@ -0,0 +1,112 @@
+# sgx.py
+[![Discord](https://img.shields.io/discord/534485763354787851.svg)](https://discord.gg/vvUtWJB)
+
+## Requirements
+
+|**Tool**|**Minimum Supported Version**|
+|--------|-----------|
+| Python |    3.11    |
+
+---
+
+## Installation
+
+### Install Python 3.11
+
+```bash
+# confirm prerequisites are isntalled
+sudo apt update
+sudo apt install software-properties-common
+# Add deadsnakes PPA - widely used for Python versions
+sudo add-apt-repository ppa:deadsnakes/ppa
+# update again & install python 3.11
+sudo apt update
+sudo apt install python3.11
+# Check if it was installed
+python3.11 --version 
+
+pip install sgx.py
+```
+--- 
+
+## Developers
+### Install all python libraries
+```bash
+sudo apt-get update --fix-missing
+sudo apt-get install libudev-dev
+sudo apt-get install swig
+
+# create virtual environment - install dependencies locally
+python3.11 -m venv venv
+source venv/bin/activate
+pip install -e .
+pip install -e .[dev]
+```
+
+### Running Tests
+
+Create a `.env` file in source directory, like the following:
+```bash
+# SGXWallet listening point (1026 uses https w/ certificates)
+SERVER=https://127.0.0.1:1026
+# path where you want tests to store the auto-generated certificates
+CERT_PATH=.
+# private key for the funded test account used by transaction tests
+ETH_PRIVATE_KEY=
+# Ethereum JSON-RPC endpoint used by transaction tests
+GETH=
+# 1 when sgxwallet runs with -e (ZMQ key ownership)
+SGX_EXPECT_ZMQ_OWNERSHIP=0
+```
+You may alter the fields as needed.
+
+Run the tests:
+```bash
+# Run all tests
+pytest
+
+# Run specific test file
+pytest ./tests/<test-file-name>.py
+
+```
+
+## Checking the wallet
+
+Available from sgxwallet 1.11.0. Older servers raise `SgxMethodNotFoundError`, a subclass of `SgxServerError`.
+
+### Client certificate
+
+```python
+from sgx import CertificateMatch, SgxClient
+
+client = SgxClient(endpoint, cert_dir, allow_registration=False)
+check = client.check_local_certificate(expected_number=1)
+if check.outcome is not CertificateMatch.MATCH:
+    print(check.outcome, check.newer_issued_at)
+```
+
+| `check.outcome` | Meaning |
+|---|---|
+| `MATCH` | `sgx.crt` is the newest certificate the wallet issued, and the wallet issued `expected_number` client certificates |
+| `UNEXPECTED_NUMBER` | `sgx.crt` is the newest, but the number of issued certificates differs |
+| `NOT_LATEST` | the wallet issued a newer certificate, at `check.newer_issued_at` |
+| `NOT_ISSUED` | unknown to the wallet's CA: wrong endpoint, or its CA database was recreated |
+
+`check.info` holds both counts and the newest certificate with its status: `V`, `R` or `E`. The check relies on the server verifying client certificates; otherwise `NOT_LATEST` can also mean a certificate from another CA.
+
+Unless `allow_registration=False` is passed, any request registers a new certificate when `sgx.crt` or `sgx.key` is missing, and the constructor makes such a request when the directory does not hold exactly three files. `check_local_certificate` never registers.
+
+### Server options
+
+```python
+options = client.get_server_options()
+options.effective.zmq_key_ownership_enforced  # -e is in effect; applies to ZMQ only
+```
+
+The server reports these values itself; they are not attested. `options.build` is `None` unless the server verifies the caller's certificate. While sgxwallet starts or stops, the call raises `SgxServerError`; retry.
+
+## License
+
+[![License](https://img.shields.io/github/license/skalenetwork/sgx.py.svg)](LICENSE)
+
+Copyright (C) 2019-present SKALE Labs

{sgx_py-0.12.dev0 → sgx_py-0.12.dev2}/setup.py

@@ -5,14 +5,16 @@ from setuptools import (
 
 extras_require = {
     'linter': [
-        'ruff==0.13.2',
+        'ruff==0.17.2',
     ],
     'dev': [
+        'build==1.6.1',
         'coincurve==13.0.0',
-        'python-dotenv==0.13.0',
-        'twine==6.2.0',
-        'pytest==8.4.2',
+        'python-dotenv==1.2.4',
+        'twine==7.0.0',
+        'pytest==9.1.1',
         'mock==5.2.0',
+        'web3==8.0.0',
     ],
 }
 
@@ -20,16 +22,22 @@ extras_require['dev'] = extras_require['linter'] + extras_require['dev']
 
 setup(
     name='sgx.py',
-    version='0.12dev0',
+    version='0.12dev2',
     description='SGX',
     url='http://github.com/skalenetwork/sgx.py',
     author='SKALE Labs',
     author_email='support@skalelabs.com',
     install_requires=[
-        'web3>=6.20.2,<8.0.0',
-        'pyzmq==27.1.0',
+        'cryptography>=50.0.2,<51',
+        'cytoolz>=0.12',
+        'eth-account>=0.13,<0.15',
+        'eth-hash[pycryptodome]>=0.7',
+        'eth-utils>=5,<7',
+        'hexbytes>=1,<3',
         'pem==23.1.0',
-        'cryptography>=46.0.1,<47.0.0',
+        'pyzmq==27.2.0',
+        'requests>=2.33.0',
+        'urllib3>=2.8.0',
     ],
     packages=find_packages(exclude=['tests']),
     python_requires='>=3.11,<4',

sgx_py-0.12.dev2/sgx/__init__.py

@@ -0,0 +1,5 @@
+# flake8: noqa: F401
+from sgx.certificates import CertificateMatch, IssuedCertificatesInfo, SgxCertificateError
+from sgx.options import LogLevel, ServerOptions, SgxServerOptionsError
+from sgx.sgx import SgxClient
+from sgx.sgx_rpc_handler import SgxMethodNotFoundError

sgx_py-0.12.dev2/sgx/certificates.py

@@ -0,0 +1,134 @@
+#    -*- coding: utf-8 -*-
+#
+#     This file is part of sgx.py
+#
+#     Copyright (C) 2026 SKALE Labs
+#
+#     sgx.py is free software: you can redistribute it and/or modify
+#     it under the terms of the GNU Affero General Public License as published
+#     by the Free Software Foundation, either version 3 of the License, or
+#     (at your option) any later version.
+#
+#     sgx.py is distributed in the hope that it will be useful,
+#     but WITHOUT ANY WARRANTY; without even the implied warranty of
+#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#     GNU Affero General Public License for more details.
+#
+#     You should have received a copy of the GNU Affero General Public License
+#     along with sgx.py.  If not, see <https://www.gnu.org/licenses/>.
+
+import os
+import re
+from dataclasses import dataclass
+from datetime import datetime, timezone
+from enum import Enum
+
+from cryptography import x509
+from cryptography.hazmat.primitives import hashes
+
+from sgx.constants import CRT_FILENAME
+from sgx.utils import SgxError
+
+
+class SgxCertificateError(SgxError):
+    pass
+
+
+class CertificateMatch(Enum):
+    MATCH = 'match'  # the local certificate is the newest issued
+    UNEXPECTED_NUMBER = 'unexpected_number'  # as MATCH, but the count differs from the expected
+    NOT_LATEST = 'not_latest'  # a newer certificate was issued after it
+    NOT_ISSUED = 'not_issued'  # unknown to this wallet's CA database
+
+
+@dataclass(frozen=True)
+class NewestCertificate:
+    serial: int
+    sha256: bytes
+    not_before: datetime
+    not_after: datetime
+    status: str  # V valid, R revoked, E expired
+
+
+@dataclass(frozen=True)
+class IssuedCertificatesInfo:
+    """Client certificates issued by the wallet's CA, from getIssuedCertificatesInfo."""
+
+    certificates_number: int
+    server_certificates_number: int
+    newest_certificate: NewestCertificate | None
+
+    @classmethod
+    def from_result(cls, result):
+        """Parses a result in the format sgxwallet documents and rejects anything else."""
+        try:
+            number = _count(result['certificatesNumber'])
+            newest = result['newestCertificate']
+            # sgxwallet sends a newest certificate exactly when it has issued any
+            if (newest is None) != (number == 0):
+                raise ValueError('newestCertificate does not match certificatesNumber')
+            if newest is not None:
+                newest = NewestCertificate(
+                    serial=int(_text('[0-9A-F]+', newest['serial']), 16),
+                    sha256=bytes.fromhex(_text('[0-9a-f]{64}', newest['sha256'])),
+                    not_before=_utc(newest['notBefore']),
+                    not_after=_utc(newest['notAfter']),
+                    status=_text('[VRE]', newest['status']),
+                )
+            return cls(number, _count(result['serverCertificatesNumber']), newest)
+        except (KeyError, TypeError, ValueError) as err:
+            raise SgxCertificateError(
+                f'Malformed getIssuedCertificatesInfo result: {result!r}'
+            ) from err
+
+    def check(self, certificate, expected_number=None):
+        """Compares an x509.Certificate with the newest certificate the wallet issued. If the
+        server does not verify client certificates, NOT_LATEST may be another CA's certificate."""
+        newest = self.newest_certificate
+        if newest is not None and newest.sha256 == certificate.fingerprint(hashes.SHA256()):
+            if expected_number is None or expected_number == self.certificates_number:
+                outcome = CertificateMatch.MATCH
+            else:
+                outcome = CertificateMatch.UNEXPECTED_NUMBER
+        elif newest is not None and newest.serial > certificate.serial_number:
+            outcome = CertificateMatch.NOT_LATEST
+        else:
+            outcome = CertificateMatch.NOT_ISSUED
+        return CertificateCheck(outcome, self)
+
+
+@dataclass(frozen=True)
+class CertificateCheck:
+    outcome: CertificateMatch
+    info: IssuedCertificatesInfo
+
+    @property
+    def newer_issued_at(self):
+        if self.outcome is CertificateMatch.NOT_LATEST:
+            return self.info.newest_certificate.not_before
+        return None
+
+
+def load_local_certificate(cert_dir):
+    try:
+        with open(os.path.join(cert_dir, CRT_FILENAME), 'rb') as crt_file:
+            return x509.load_pem_x509_certificate(crt_file.read())
+    except (OSError, TypeError, ValueError) as err:  # TypeError: no cert_dir
+        raise SgxCertificateError(f'Cannot load {CRT_FILENAME} from {cert_dir!r}') from err
+
+
+def _count(value):
+    # Exact type, because bool is a subclass of int
+    if type(value) is not int or value < 0:
+        raise ValueError(f'Invalid count {value!r}')
+    return value
+
+
+def _text(pattern, value):
+    if not re.fullmatch(pattern, value):
+        raise ValueError(f'Invalid value {value!r}')
+    return value
+
+
+def _utc(value):
+    return datetime.strptime(value, '%Y-%m-%dT%H:%M:%SZ').replace(tzinfo=timezone.utc)

{sgx_py-0.12.dev0 → sgx_py-0.12.dev2}/sgx/constants.py

@@ -10,3 +10,4 @@ SGX_ZMQ_RESPONSE_TIMEOUT_MS = 5000
 CSR_FILENAME = 'sgx.csr'
 KEY_FILENAME = 'sgx.key'
 CRT_FILENAME = 'sgx.crt'
+LOCK_FILENAME = 'sgx.enroll.lock'

sgx_py-0.12.dev2/sgx/generate.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+umask 077
+
+CSR_PATH="$1"
+KEY_PATH="$2"
+COMMON_NAME="$3"
+
+rm -f -- "$CSR_PATH" "$KEY_PATH"
+
+openssl req -new -sha256 -nodes \
+    -out "$CSR_PATH" \
+    -newkey rsa:2048 \
+    -keyout "$KEY_PATH" \
+    -subj "/CN=$COMMON_NAME"
+
+chmod 600 "$KEY_PATH"

{sgx_py-0.12.dev0 → sgx_py-0.12.dev2}/sgx/http.py

@@ -1,29 +1,34 @@
-import os
+import fcntl
+import json
 import logging
+import os
 import secrets
-import requests
-import json
+from contextlib import contextmanager
 from time import sleep
 from urllib.parse import urlparse
 
+import requests
 import urllib3
 from requests.packages.urllib3.exceptions import InsecureRequestWarning
+
+from sgx.certificates import SgxCertificateError
 from sgx.constants import (
-    GENERATE_SCRIPT_PATH,
-    DEFAULT_TIMEOUT,
-    CSR_FILENAME,
     CRT_FILENAME,
+    CSR_FILENAME,
+    DEFAULT_TIMEOUT,
+    GENERATE_SCRIPT_PATH,
     KEY_FILENAME,
-    SGX_RESPONSE_TIMEOUT
+    LOCK_FILENAME,
+    SGX_RESPONSE_TIMEOUT,
 )
-from sgx.utils import run_cmd, print_request_log, print_response_log, SgxError
-
+from sgx.utils import SgxError, print_request_log, print_response_log, run_cmd
 
 requests.packages.urllib3.disable_warnings(InsecureRequestWarning)  # TODO: Remove
 logger = logging.getLogger(__name__)
 
 
 MAX_RETRIES = 22
+CSR_STATUS_PENDING = 1
 
 
 class SgxSSLError(SgxError):
@@ -34,15 +39,40 @@ class SgxUnreachableError(SgxError):
     pass
 
 
-def get_certificate_credentials(crt_dir_path, csr_server):
+def certificate_exists(crt_dir_path: str) -> bool:
+    return all(
+        os.path.exists(os.path.join(crt_dir_path, filename))
+        for filename in (CRT_FILENAME, KEY_FILENAME)
+    )
+
+
+@contextmanager
+def enrollment_lock(crt_dir_path: str):
+    lock_path = os.path.join(crt_dir_path, LOCK_FILENAME)
+    fd = os.open(lock_path, os.O_CREAT | os.O_RDWR, 0o600)
+    try:
+        fcntl.flock(fd, fcntl.LOCK_EX)
+        yield
+    finally:
+        os.close(fd)
+
+
+def get_certificate_credentials(crt_dir_path, csr_server, allow_registration=True):
     key_path = os.path.join(crt_dir_path, KEY_FILENAME)
     crt_path = os.path.join(crt_dir_path, CRT_FILENAME)
-    if not os.path.exists(crt_path) or not os.path.exists(key_path):
-        csr_path = os.path.join(crt_dir_path, CSR_FILENAME)
-        if not os.path.exists(csr_path) or not os.path.exists(key_path):
-            generate_csr_credentials(csr_path, key_path)
-        csr_hash = sign_certificate(csr_server, csr_path)
-        write_crt_to_file(crt_path, csr_server, csr_hash)
+    if certificate_exists(crt_dir_path):
+        return crt_path, key_path
+    if not allow_registration:
+        raise SgxCertificateError(
+            f'{crt_path} or {key_path} is missing and registration is disabled'
+        )
+    with enrollment_lock(crt_dir_path):
+        if not certificate_exists(crt_dir_path):
+            csr_path = os.path.join(crt_dir_path, CSR_FILENAME)
+            if not os.path.exists(csr_path) or not os.path.exists(key_path):
+                generate_csr_credentials(csr_path, key_path)
+            csr_hash = sign_certificate(csr_server, csr_path)
+            write_crt_to_file(crt_path, csr_server, csr_hash)
     return crt_path, key_path
 
 
@@ -52,13 +82,23 @@ def generate_csr_credentials(csr_path, key_path):
 
 
 def write_crt_to_file(crt_path, csr_server, csr_hash):
-    response = send_request_safe(csr_server, 'getCertificate', {'hash': csr_hash})
-    while response['result']['status'] == 1:
-        response = send_request_safe(csr_server, 'getCertificate', {'hash': csr_hash})
-        sleep(DEFAULT_TIMEOUT)
-    crt = response['result']['cert']
-    with open(crt_path, "w+") as f:
-        f.write(crt)
+    for _ in range(MAX_RETRIES):
+        response = send_request(csr_server, 'getCertificate', {'hash': csr_hash})
+        if response.get('error'):
+            raise SgxSSLError(response['error']['message'])
+        result = response['result']
+        if result['status'] == CSR_STATUS_PENDING:
+            sleep(DEFAULT_TIMEOUT)
+            continue
+        if result['status'] != 0:
+            raise SgxSSLError(result['errorMessage'])
+        with open(crt_path, 'w') as f:
+            f.write(result['cert'])
+        return
+    raise SgxSSLError(
+        f'Certificate signing request {csr_hash} is still pending '
+        f'after {MAX_RETRIES} attempts'
+    )
 
 
 def sign_certificate(csr_server, csr_path):
@@ -69,7 +109,7 @@ def sign_certificate(csr_server, csr_path):
     return csr_hash
 
 
-def send_request(url, method, params, path_to_cert=None):
+def send_request(url, method, params, path_to_cert=None, allow_registration=True):
     headers = {'content-type': 'application/json'}
     call_data = {
         "id": 0,
@@ -82,7 +122,8 @@ def send_request(url, method, params, path_to_cert=None):
     if path_to_cert:
         cert = get_certificate_credentials(
             path_to_cert,
-            get_cert_provider(url)
+            get_cert_provider(url),
+            allow_registration
         )
 
     try:

sgx_py-0.12.dev2/sgx/options.py

@@ -0,0 +1,104 @@
+#    -*- coding: utf-8 -*-
+#
+#     This file is part of sgx.py
+#
+#     Copyright (C) 2026 SKALE Labs
+#
+#     sgx.py is free software: you can redistribute it and/or modify
+#     it under the terms of the GNU Affero General Public License as published
+#     by the Free Software Foundation, either version 3 of the License, or
+#     (at your option) any later version.
+#
+#     sgx.py is distributed in the hope that it will be useful,
+#     but WITHOUT ANY WARRANTY; without even the implied warranty of
+#     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+#     GNU Affero General Public License for more details.
+#
+#     You should have received a copy of the GNU Affero General Public License
+#     along with sgx.py.  If not, see <https://www.gnu.org/licenses/>.
+
+from dataclasses import dataclass, fields
+from enum import IntEnum
+
+from sgx.utils import SgxError
+
+
+class SgxServerOptionsError(SgxError):
+    pass
+
+
+class LogLevel(IntEnum):
+    TRACE = 0
+    DEBUG = 1
+    INFO = 2
+    WARNING = 3
+    ERROR = 4
+
+
+@dataclass(frozen=True)
+class ServerFlags:
+    log_level: LogLevel
+    enclave_log_level: LogLevel
+    use_https: bool
+    autoconfirm: bool
+    enter_backup_key: bool
+    reencrypt_database_with_new_sek: bool
+    check_cert: bool
+    check_zmq_sig: bool
+    auto_sign: bool
+    generate_test_keys: bool
+    check_key_ownership: bool
+    thread_pool_size: int
+
+
+@dataclass(frozen=True)
+class EffectiveOptions:
+    rpc_port: int  # as bound inside the server, before any port mapping
+    rpc_client_certificate_required: bool
+    zmq_key_ownership_enforced: bool  # -e is in effect; applies to ZMQ only
+    json_rpc_key_ownership_enforced: bool
+    sgx_thread_pool_size: int
+
+
+@dataclass(frozen=True)
+class BuildInfo:
+    sgx_simulation: bool
+    sgx_debug_launch: bool
+
+
+@dataclass(frozen=True)
+class ServerOptions:
+    """Options sgxwallet reports about itself, from getServerOptions; they are not attested.
+    build is sent only to authenticated callers: HTTPS with the client certificate check."""
+
+    flags: ServerFlags
+    effective: EffectiveOptions
+    build: BuildInfo | None = None
+
+    @classmethod
+    def from_result(cls, result):
+        if not isinstance(result, dict):
+            raise SgxServerOptionsError(f'Malformed getServerOptions result: {result!r}')
+        build = result.get('build')
+        return cls(
+            _load(ServerFlags, result.get('flags')),
+            _load(EffectiveOptions, result.get('effective')),
+            None if build is None else _load(BuildInfo, build),
+        )
+
+
+def _load(cls, data):
+    # Fields match the camelCase keys ignoring case and underscores: use_https is useHTTPS
+    try:
+        values = {key.lower(): value for key, value in data.items()}
+        kwargs = {f.name: _typed(f.type, values[f.name.replace('_', '')]) for f in fields(cls)}
+    except (AttributeError, KeyError, TypeError, ValueError) as err:
+        raise SgxServerOptionsError(f'Malformed {cls.__name__}: {data!r}') from err
+    return cls(**kwargs)
+
+
+def _typed(kind, value):
+    # Exact types, because bool is a subclass of int
+    if type(value) is not (int if kind is LogLevel else kind):
+        raise TypeError(f'{value!r} is not {kind.__name__}')
+    return kind(value)

{sgx_py-0.12.dev0 → sgx_py-0.12.dev2}/sgx/sgx.py

@@ -18,20 +18,22 @@
 #     along with sgx.py.  If not, see <https://www.gnu.org/licenses/>.
 
 import logging
-from dataclasses import dataclass
 from collections.abc import Mapping
-from hexbytes import HexBytes
-from eth_account.datastructures import SignedTransaction, SignedMessage
-from eth_utils.curried import keccak
+from dataclasses import dataclass
+
 from cytoolz import dissoc
-from sgx.sgx_rpc_handler import SgxRPCHandler
-from sgx.sgx_zmq import SgxZmq
-from sgx.utils import public_key_to_address
 from eth_account._utils import signing
 from eth_account._utils.legacy_transactions import encode_transaction
+from eth_account.datastructures import SignedMessage, SignedTransaction
 from eth_account.typed_transactions.typed_transaction import TypedTransaction
-from eth_utils.encoding import big_endian_to_int
 from eth_utils.conversions import add_0x_prefix, remove_0x_prefix
+from eth_utils.curried import keccak
+from eth_utils.encoding import big_endian_to_int
+from hexbytes import HexBytes
+
+from sgx.sgx_rpc_handler import SgxRPCHandler
+from sgx.sgx_zmq import SgxZmq
+from sgx.utils import public_key_to_address
 
 logger = logging.getLogger(__name__)
 
@@ -51,9 +53,11 @@ class ComplaintResponse:
 
 
 class SgxClient:
-    def __init__(self, sgx_endpoint, path_to_cert=None, n=None, t=None, zmq=False):
+    def __init__(
+        self, sgx_endpoint, path_to_cert=None, n=None, t=None, zmq=False, allow_registration=True
+    ):
         self.sgx_endpoint = sgx_endpoint
-        self.sgx_rpc_server = SgxRPCHandler(sgx_endpoint, path_to_cert)
+        self.sgx_rpc_server = SgxRPCHandler(sgx_endpoint, path_to_cert, allow_registration)
         if zmq:
             self.zmq = SgxZmq(sgx_endpoint, path_to_cert, n, t)
         if not path_to_cert:
@@ -149,6 +153,15 @@ class SgxClient:
     def get_server_version(self):
         return self.sgx_rpc_server.get_server_version()
 
+    def get_server_options(self):
+        return self.sgx_rpc_server.get_server_options()
+
+    def get_issued_certificates_info(self):
+        return self.sgx_rpc_server.get_issued_certificates_info()
+
+    def check_local_certificate(self, expected_number=None):
+        return self.sgx_rpc_server.check_local_certificate(expected_number)
+
     def verify_secret_share(self, public_shares, eth_key_name, secret_share, index):
         return self.sgx_rpc_server.verify_secret_share(
             public_shares, eth_key_name, secret_share, self.n, self.t, index

{sgx_py-0.12.dev0 → sgx_py-0.12.dev2}/sgx/sgx_rpc_handler.py

@@ -18,22 +18,27 @@
 #     along with sgx.py.  If not, see <https://www.gnu.org/licenses/>.
 
 import logging
-import os
 from enum import Enum
-
 from urllib.parse import urlparse
 
-from sgx.http import send_request
+from sgx.certificates import IssuedCertificatesInfo, load_local_certificate
+from sgx.http import certificate_exists, send_request
+from sgx.options import ServerOptions
 from sgx.utils import SgxError
 
-
 logger = logging.getLogger(__name__)
 
+METHOD_NOT_FOUND = -32601
+
 
 class SgxServerError(SgxError):
     pass
 
 
+class SgxMethodNotFoundError(SgxServerError):
+    """The server does not implement the method, e.g. an sgxwallet older than 1.10.4."""
+
+
 class DkgPolyStatus(Enum):
     FAIL = 0
     NEW_GENERATED = 1
@@ -41,10 +46,11 @@ class DkgPolyStatus(Enum):
 
 
 class SgxRPCHandler:
-    def __init__(self, sgx_endpoint, path_to_cert):
+    def __init__(self, sgx_endpoint, path_to_cert, allow_registration=True):
         self.sgx_endpoint = check_provider(sgx_endpoint)
         self.path_to_cert = path_to_cert
-        if path_to_cert and len(os.listdir(path_to_cert)) != 3:
+        self.allow_registration = allow_registration
+        if allow_registration and path_to_cert and not certificate_exists(path_to_cert):
             self.get_server_status()
 
     def ecdsa_sign(self, key_name, transaction_hash):
@@ -133,6 +139,21 @@ class SgxRPCHandler:
         response = self.__send_request("getServerVersion")
         return response['result']['version']
 
+    def get_server_options(self):
+        response = self.__send_request('getServerOptions')
+        return ServerOptions.from_result(response['result'])
+
+    def get_issued_certificates_info(self):
+        response = self.__send_request('getIssuedCertificatesInfo')
+        return IssuedCertificatesInfo.from_result(response['result'])
+
+    def check_local_certificate(self, expected_number=None):
+        certificate = load_local_certificate(self.path_to_cert)
+        # Never registers: a new certificate would replace the one being checked
+        response = self.__send_request('getIssuedCertificatesInfo', allow_registration=False)
+        info = IssuedCertificatesInfo.from_result(response['result'])
+        return info.check(certificate, expected_number)
+
     def verify_secret_share(self, public_shares, eth_key_name, secret_share, n, t, index):
         params = dict()
         params['publicShares'] = public_shares
@@ -179,7 +200,9 @@ class SgxRPCHandler:
         response = self.__send_request("createBLSPrivateKeyV2", params)
         return response['result']['status'] == 0
 
-    def create_bls_private_key_v3(self, poly_name, bls_key_name, eth_key_name, secret_contributions, n, t):
+    def create_bls_private_key_v3(
+        self, poly_name, bls_key_name, eth_key_name, secret_contributions, n, t
+    ):
         params = dict()
         # polyName is optional in V3 - new nodes joining the network do not pass it
         if poly_name:
@@ -268,10 +291,14 @@ class SgxRPCHandler:
 
         return result
 
-    def __send_request(self, method, params=None):
-        response = send_request(self.sgx_endpoint, method, params, self.path_to_cert)
-        if response.get('error') is not None:
-            raise SgxServerError(response['error']['message'])
+    def __send_request(self, method, params=None, allow_registration=True):
+        registration = self.allow_registration and allow_registration
+        response = send_request(self.sgx_endpoint, method, params, self.path_to_cert, registration)
+        error = response.get('error')
+        if error is not None:
+            if error.get('code') == METHOD_NOT_FOUND:
+                raise SgxMethodNotFoundError(error['message'])
+            raise SgxServerError(error['message'])
         if response['result']['status']:
             raise SgxServerError(response['result']['errorMessage'])
         return response

{sgx_py-0.12.dev0 → sgx_py-0.12.dev2}/sgx/sgx_zmq.py

@@ -24,20 +24,17 @@ import os
 from dataclasses import dataclass
 from enum import Enum
 from time import sleep
-from sgx.utils import public_key_to_address
+from urllib.parse import urlparse
 
-from eth_utils.conversions import add_0x_prefix, remove_0x_prefix
 import pem
 import zmq
 from cryptography.hazmat.primitives import hashes
-from cryptography.hazmat.primitives.asymmetric import ec, rsa, padding
+from cryptography.hazmat.primitives.asymmetric import ec, padding, rsa
 from cryptography.hazmat.primitives.serialization import load_pem_private_key
+from eth_utils.conversions import add_0x_prefix, remove_0x_prefix
 
-from urllib.parse import urlparse
-
-from sgx.constants import DEFAULT_TIMEOUT, SGX_ZMQ_RESPONSE_TIMEOUT_MS, CRT_FILENAME, KEY_FILENAME
-from sgx.utils import SgxError
-
+from sgx.constants import CRT_FILENAME, DEFAULT_TIMEOUT, KEY_FILENAME, SGX_ZMQ_RESPONSE_TIMEOUT_MS
+from sgx.utils import SgxError, public_key_to_address
 
 logger = logging.getLogger(__name__)
 
@@ -291,7 +288,6 @@ class SgxZmq:
         p_id = os.getpid()
         if not self.sockets.get(p_id):
             socket_p_id = self.ctx.socket(zmq.DEALER)
-            socket_p_id.setsockopt_string(zmq.IDENTITY, '135:14603077656239261618')
             socket_p_id.setsockopt(zmq.LINGER, 0)
             socket_p_id.setsockopt(zmq.SNDTIMEO, SGX_ZMQ_RESPONSE_TIMEOUT_MS)
             socket_p_id.setsockopt(zmq.RCVTIMEO, SGX_ZMQ_RESPONSE_TIMEOUT_MS)

{sgx_py-0.12.dev0 → sgx_py-0.12.dev2}/sgx/utils.py

@@ -18,48 +18,55 @@
 #     along with sgx.py.  If not, see <https://www.gnu.org/licenses/>.
 
 
-import copy
 import logging
 import os
 import subprocess
 from subprocess import PIPE
 
-from web3 import Web3
-
+from eth_utils import keccak, to_checksum_address, to_hex
 
 logger = logging.getLogger(__name__)
 
+REDACTED = '<redacted>'
+SECRET_FIELDS = frozenset({
+    'dhKey',
+    'key',
+    'keyShare',
+    'secretContributions',
+    'secretShare',
+})
+
 
 class SgxError(Exception):
     pass
 
 
-def crop_json(json_data, crop_len=50):
-    for key, value in json_data.items():
-        if isinstance(value, dict):
-            crop_json(value)
-        else:
-            if isinstance(value, str) and len(value) > crop_len:
-                json_data[key] = value[:crop_len] + '...'
+def redact(data: object, crop_len: int = 50) -> object:
+    if isinstance(data, dict):
+        return {
+            key: REDACTED if key in SECRET_FIELDS else redact(value, crop_len)
+            for key, value in data.items()
+        }
+    if isinstance(data, list):
+        return [redact(item, crop_len) for item in data]
+    if isinstance(data, str) and len(data) > crop_len:
+        return data[:crop_len] + '...'
+    return data
 
 
 def print_request_log(request):
-    cropped_request = copy.deepcopy(request)
-    crop_json(cropped_request)
-    logger.info(f'Send request: {request}')
+    logger.info(f'Send request: {redact(request)}')
 
 
 def print_response_log(response):
-    cropped_response = copy.deepcopy(response)
-    crop_json(cropped_response)
-    logger.info(f'Response received: {cropped_response}')
+    logger.info(f'Response received: {redact(response)}')
 
 
-def run_cmd(cmd, env={}, shell=False):
+def run_cmd(cmd, env=None, shell=False):
     logger.info(f'Running: {cmd}')
     res = subprocess.run(
         cmd, shell=shell, stdout=PIPE, stderr=PIPE,
-        env={**env, **os.environ}
+        env={**os.environ, **(env or {})}
     )
     if res.returncode:
         logger.error('Error during shell execution:')
@@ -69,5 +76,5 @@ def run_cmd(cmd, env={}, shell=False):
 
 
 def public_key_to_address(pk):
-    hash_ = Web3.keccak(hexstr=str(pk))
-    return Web3.to_checksum_address(Web3.to_hex(hash_[-20:]))
+    hash_ = keccak(hexstr=str(pk))
+    return to_checksum_address(to_hex(hash_[-20:]))

sgx_py-0.12.dev2/sgx.py.egg-info/PKG-INFO

@@ -0,0 +1,38 @@
+Metadata-Version: 2.4
+Name: sgx.py
+Version: 0.12.dev2
+Summary: SGX
+Home-page: http://github.com/skalenetwork/sgx.py
+Author: SKALE Labs
+Author-email: support@skalelabs.com
+Requires-Python: >=3.11,<4
+License-File: LICENSE
+Requires-Dist: cryptography<51,>=50.0.2
+Requires-Dist: cytoolz>=0.12
+Requires-Dist: eth-account<0.15,>=0.13
+Requires-Dist: eth-hash[pycryptodome]>=0.7
+Requires-Dist: eth-utils<7,>=5
+Requires-Dist: hexbytes<3,>=1
+Requires-Dist: pem==23.1.0
+Requires-Dist: pyzmq==27.2.0
+Requires-Dist: requests>=2.33.0
+Requires-Dist: urllib3>=2.8.0
+Provides-Extra: linter
+Requires-Dist: ruff==0.17.2; extra == "linter"
+Provides-Extra: dev
+Requires-Dist: ruff==0.17.2; extra == "dev"
+Requires-Dist: build==1.6.1; extra == "dev"
+Requires-Dist: coincurve==13.0.0; extra == "dev"
+Requires-Dist: python-dotenv==1.2.4; extra == "dev"
+Requires-Dist: twine==7.0.0; extra == "dev"
+Requires-Dist: pytest==9.1.1; extra == "dev"
+Requires-Dist: mock==5.2.0; extra == "dev"
+Requires-Dist: web3==8.0.0; extra == "dev"
+Dynamic: author
+Dynamic: author-email
+Dynamic: home-page
+Dynamic: license-file
+Dynamic: provides-extra
+Dynamic: requires-dist
+Dynamic: requires-python
+Dynamic: summary

{sgx_py-0.12.dev0 → sgx_py-0.12.dev2}/sgx.py.egg-info/SOURCES.txt

@@ -2,9 +2,11 @@ LICENSE
 README.md
 setup.py
 sgx/__init__.py
+sgx/certificates.py
 sgx/constants.py
 sgx/generate.sh
 sgx/http.py
+sgx/options.py
 sgx/sgx.py
 sgx/sgx_rpc_handler.py
 sgx/sgx_zmq.py

sgx_py-0.12.dev2/sgx.py.egg-info/requires.txt

@@ -0,0 +1,23 @@
+cryptography<51,>=50.0.2
+cytoolz>=0.12
+eth-account<0.15,>=0.13
+eth-hash[pycryptodome]>=0.7
+eth-utils<7,>=5
+hexbytes<3,>=1
+pem==23.1.0
+pyzmq==27.2.0
+requests>=2.33.0
+urllib3>=2.8.0
+
+[dev]
+ruff==0.17.2
+build==1.6.1
+coincurve==13.0.0
+python-dotenv==1.2.4
+twine==7.0.0
+pytest==9.1.1
+mock==5.2.0
+web3==8.0.0
+
+[linter]
+ruff==0.17.2

{sgx_py-0.12.dev0 → sgx_py-0.12.dev2}/tests/test_core.py

@@ -1,27 +1,24 @@
-import urllib
 import os
 import secrets
+import socket
+import urllib
 
 import eth_account._utils.legacy_transactions as transactions
 import pytest
-
-from eth_account.messages import defunct_hash_message, encode_defunct
-
 from dotenv import load_dotenv
+from eth_account.messages import defunct_hash_message, encode_defunct
 from eth_keys import keys
 from hexbytes import HexBytes
-import socket
 from web3 import Web3
 
-
-from sgx import SgxClient
-
+from sgx import CertificateMatch, SgxClient
 
 load_dotenv()
 
 SGX_URL = os.getenv('SERVER')
 GETH_URL = os.getenv('GETH')
 ETH_PRIVATE_KEY = os.getenv('ETH_PRIVATE_KEY')
+EXPECT_ZMQ_OWNERSHIP = os.getenv('SGX_EXPECT_ZMQ_OWNERSHIP') == '1'
 
 ETH_VALUE_FOR_TESTS = 5 * 10**18
 
@@ -151,6 +148,25 @@ def test_get_server_version(sgx):
     assert isinstance(sgx.get_server_version(), str)
 
 
+def test_get_server_options(sgx):
+    url = urllib.parse.urlparse(SGX_URL)
+    options = sgx.get_server_options()
+    assert options.effective.rpc_port == url.port
+    assert options.flags.use_https == (url.scheme == 'https')
+    assert options.flags.auto_sign and options.flags.autoconfirm
+    assert options.effective.zmq_key_ownership_enforced == EXPECT_ZMQ_OWNERSHIP
+    assert (options.build is not None) == options.effective.rpc_client_certificate_required
+    assert options.build is None or options.build.sgx_simulation
+
+
+def test_check_local_certificate(sgx):
+    # A fresh simulator, and every test shares CERT_PATH: one client certificate
+    check = sgx.check_local_certificate(expected_number=1)
+    assert check.outcome is CertificateMatch.MATCH
+    assert check.info.server_certificates_number == 1
+    assert check.info.newest_certificate.status == 'V'
+
+
 def test_sign_message(sgx, account, w3):
     key, address = account
     txn = generate_tx(w3, tx_type=None, no_fee=True)

{sgx_py-0.12.dev0 → sgx_py-0.12.dev2}/tests/test_dkg.py

@@ -1,14 +1,16 @@
-from sgx import SgxClient
-from sgx.sgx_rpc_handler import SgxServerError
-from sgx.sgx_zmq import SgxZmqServerError
+import binascii
+import hashlib
 import os
-from time import sleep
-from dotenv import load_dotenv
 import random
-import coincurve
-import binascii
 import secrets
-import hashlib
+from time import sleep
+
+import coincurve
+from dotenv import load_dotenv
+
+from sgx import SgxClient
+from sgx.sgx_rpc_handler import SgxServerError
+from sgx.sgx_zmq import SgxZmqServerError
 
 load_dotenv()
 

{sgx_py-0.12.dev0 → sgx_py-0.12.dev2}/tests/test_http.py

@@ -1,10 +1,11 @@
+import logging
+
 import mock
 import pytest
 import requests
 import urllib3
 
-from sgx.http import send_request
-from sgx.http import SgxUnreachableError
+from sgx.http import SgxUnreachableError, send_request
 
 URL = 'http://127.0.0.1:1026'
 INVALID_URL = 'http://127.0.0.1:1033'
@@ -32,3 +33,13 @@ def test_send_request_failed_sgx_up():
     with mock.patch('requests.post', post_mock):
         with pytest.raises(SgxUnreachableError):
             send_request(URL, method, params)
+
+
+def test_send_request_logs_redacted_params(caplog):
+    response = mock.Mock(**{'json.return_value': {'result': {'status': 0}}})
+    with mock.patch('requests.post', return_value=response), caplog.at_level(logging.INFO):
+        send_request(URL, 'importBLSKeyShare', {'keyShare': 'a' * 64, 'keyShareName': 'b' * 64})
+    assert "'keyShare': '<redacted>'" in caplog.text
+    assert 'a' * 50 not in caplog.text
+    assert 'b' * 50 + '...' in caplog.text
+    assert 'b' * 51 not in caplog.text

sgx_py-0.12.dev0/PKG-INFO

@@ -1,30 +0,0 @@
-Metadata-Version: 2.4
-Name: sgx.py
-Version: 0.12.dev0
-Summary: SGX
-Home-page: http://github.com/skalenetwork/sgx.py
-Author: SKALE Labs
-Author-email: support@skalelabs.com
-Requires-Python: >=3.11,<4
-License-File: LICENSE
-Requires-Dist: web3<8.0.0,>=6.20.2
-Requires-Dist: pyzmq==27.1.0
-Requires-Dist: pem==23.1.0
-Requires-Dist: cryptography<47.0.0,>=46.0.1
-Provides-Extra: linter
-Requires-Dist: ruff==0.13.2; extra == "linter"
-Provides-Extra: dev
-Requires-Dist: ruff==0.13.2; extra == "dev"
-Requires-Dist: coincurve==13.0.0; extra == "dev"
-Requires-Dist: python-dotenv==0.13.0; extra == "dev"
-Requires-Dist: twine==6.2.0; extra == "dev"
-Requires-Dist: pytest==8.4.2; extra == "dev"
-Requires-Dist: mock==5.2.0; extra == "dev"
-Dynamic: author
-Dynamic: author-email
-Dynamic: home-page
-Dynamic: license-file
-Dynamic: provides-extra
-Dynamic: requires-dist
-Dynamic: requires-python
-Dynamic: summary

sgx_py-0.12.dev0/README.md

@@ -1,75 +0,0 @@
-# sgx.py
-[![Discord](https://img.shields.io/discord/534485763354787851.svg)](https://discord.gg/vvUtWJB)
-
-## Requirements
-
-|**Tool**|**Minimum Supported Version**|
-|--------|-----------|
-| Python |    3.11    |
-
----
-
-## Installation
-
-### Install Python 3.11
-
-```bash
-# confirm prerequisites are isntalled
-sudo apt update
-sudo apt install software-properties-common
-# Add deadsnakes PPA - widely used for Python versions
-sudo add-apt-repository ppa:deadsnakes/ppa
-# update again & install python 3.11
-sudo apt update
-sudo apt install python3.11
-# Check if it was installed
-python3.11 --version 
-
-pip install sgx.py
-```
---- 
-
-## Developers
-### Install all python libraries
-```bash
-sudo apt-get update --fix-missing
-sudo apt-get install libudev-dev
-sudo apt-get install swig
-
-# create virtual environment - install dependencies locally
-python3.11 -m venv venv
-source venv/bin/activate
-pip install -e .
-pip install -e .[dev]
-```
-
-### Running Tests
-
-Create a `.env` file in source directory, like the following:
-```bash
-# SGXWallet listening point (1026 uses https w/ certificates)
-SERVER=https://127.0.0.1:1026
-# path where you want tests to store the auto-generated certificates
-CERT_PATH=.
-# private key for the funded test account used by transaction tests
-ETH_PRIVATE_KEY=
-# Ethereum JSON-RPC endpoint used by transaction tests
-GETH=
-```
-You may alter the fields as needed.
-
-Run the tests:
-```bash
-# Run all tests
-pytest
-
-# Run specific test file
-pytest ./tests/<test-file-name>.py
-
-```
-
-## License
-
-[![License](https://img.shields.io/github/license/skalenetwork/sgx.py.svg)](LICENSE)
-
-Copyright (C) 2019-present SKALE Labs

sgx_py-0.12.dev0/sgx/__init__.py

@@ -1,2 +0,0 @@
-# flake8: noqa: F401
-from sgx.sgx import SgxClient

sgx_py-0.12.dev0/sgx/generate.sh

@@ -1 +0,0 @@
-openssl req -new -sha256 -nodes -out $1 -newkey rsa:2048 -keyout $2 -subj /CN=$3

sgx_py-0.12.dev0/sgx.py.egg-info/PKG-INFO

@@ -1,30 +0,0 @@
-Metadata-Version: 2.4
-Name: sgx.py
-Version: 0.12.dev0
-Summary: SGX
-Home-page: http://github.com/skalenetwork/sgx.py
-Author: SKALE Labs
-Author-email: support@skalelabs.com
-Requires-Python: >=3.11,<4
-License-File: LICENSE
-Requires-Dist: web3<8.0.0,>=6.20.2
-Requires-Dist: pyzmq==27.1.0
-Requires-Dist: pem==23.1.0
-Requires-Dist: cryptography<47.0.0,>=46.0.1
-Provides-Extra: linter
-Requires-Dist: ruff==0.13.2; extra == "linter"
-Provides-Extra: dev
-Requires-Dist: ruff==0.13.2; extra == "dev"
-Requires-Dist: coincurve==13.0.0; extra == "dev"
-Requires-Dist: python-dotenv==0.13.0; extra == "dev"
-Requires-Dist: twine==6.2.0; extra == "dev"
-Requires-Dist: pytest==8.4.2; extra == "dev"
-Requires-Dist: mock==5.2.0; extra == "dev"
-Dynamic: author
-Dynamic: author-email
-Dynamic: home-page
-Dynamic: license-file
-Dynamic: provides-extra
-Dynamic: requires-dist
-Dynamic: requires-python
-Dynamic: summary

sgx_py-0.12.dev0/sgx.py.egg-info/requires.txt

@@ -1,15 +0,0 @@
-web3<8.0.0,>=6.20.2
-pyzmq==27.1.0
-pem==23.1.0
-cryptography<47.0.0,>=46.0.1
-
-[dev]
-ruff==0.13.2
-coincurve==13.0.0
-python-dotenv==0.13.0
-twine==6.2.0
-pytest==8.4.2
-mock==5.2.0
-
-[linter]
-ruff==0.13.2