theca 2.0.3__tar.gz → 3.0.2__tar.gz

theca-3.0.2/PKG-INFO

@@ -0,0 +1,59 @@
+Metadata-Version: 2.4
+Name: theca
+Version: 3.0.2
+Summary: Python library to run your own private CA (devnull.cn/theca).
+Home-page: https://devnull.cn
+Author: Xizhen Du
+Author-email: xizhendu@gmail.com
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: requests~=2.31.0
+Requires-Dist: theid>=2
+Dynamic: author
+Dynamic: author-email
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: license-file
+Dynamic: requires-dist
+Dynamic: summary
+
+# theca-sdk-python
+
+Run your own private CA at [devnull.cn](https://devnull.cn/pca): the service
+signs a per-account root CA and SAN certificates, and this package writes the
+PEM files to `~/.devnull/certs/`.
+
+Requires `theid>=2` (theid 2.0 credentials; the service only accepts EdDSA
+access tokens).
+
+## Usage
+
+```bash
+# Credentials come from ~/.devnull/credentials (shared with devnull-cli) or env
+export THEID_ACCESS_KEY=DK...
+export THEID_SECRET_KEY=...
+
+python3 - <<'EOF'
+from theca import create_cert
+print(create_cert())
+EOF
+
+ls -lt ~/.devnull/certs/
+# key.pem  crt.pem  fullchain.pem  ca.pem  system_id  subject_alternative_names  properties
+```
+
+`create_cert()` creates the account's root CA on first use, then issues a
+certificate for the host's `system_id` plus its `private`/`public` thedns
+names, and writes the chain next to it. The returned `ca_url`
+(`https://devnull.cn/getca/<orgid>`) downloads the CA certificate.
+
+Point at another environment with `DEVNULL_PCA_URL`
+(default `https://devnull.cn/pca`; the 3.0.1 name `DEVNULL_THECA_URL` is still read). The identity service is resolved by
+`theid` (`DEVNULL_BASE_URL` / `THEID_ISSUER`).
+
+## What the service stores
+
+Per account: one RSA-4096 root CA (10 years) and up to 11 RSA-2048
+certificates (1 year, SANs from the requested names). All material is stored
+in Postgres as base64 PEM; `create_cert()` is idempotent per common name.

theca-3.0.2/README.md

@@ -0,0 +1,39 @@
+# theca-sdk-python
+
+Run your own private CA at [devnull.cn](https://devnull.cn/pca): the service
+signs a per-account root CA and SAN certificates, and this package writes the
+PEM files to `~/.devnull/certs/`.
+
+Requires `theid>=2` (theid 2.0 credentials; the service only accepts EdDSA
+access tokens).
+
+## Usage
+
+```bash
+# Credentials come from ~/.devnull/credentials (shared with devnull-cli) or env
+export THEID_ACCESS_KEY=DK...
+export THEID_SECRET_KEY=...
+
+python3 - <<'EOF'
+from theca import create_cert
+print(create_cert())
+EOF
+
+ls -lt ~/.devnull/certs/
+# key.pem  crt.pem  fullchain.pem  ca.pem  system_id  subject_alternative_names  properties
+```
+
+`create_cert()` creates the account's root CA on first use, then issues a
+certificate for the host's `system_id` plus its `private`/`public` thedns
+names, and writes the chain next to it. The returned `ca_url`
+(`https://devnull.cn/getca/<orgid>`) downloads the CA certificate.
+
+Point at another environment with `DEVNULL_PCA_URL`
+(default `https://devnull.cn/pca`; the 3.0.1 name `DEVNULL_THECA_URL` is still read). The identity service is resolved by
+`theid` (`DEVNULL_BASE_URL` / `THEID_ISSUER`).
+
+## What the service stores
+
+Per account: one RSA-4096 root CA (10 years) and up to 11 RSA-2048
+certificates (1 year, SANs from the requested names). All material is stored
+in Postgres as base64 PEM; `create_cert()` is idempotent per common name.

{theca-2.0.3 → theca-3.0.2}/setup.py

@@ -2,16 +2,16 @@ from setuptools import setup
 
 setup(
     name='theca',
-    version='2.0.3',
+    version='3.0.2',
     author='Xizhen Du',
     author_email='xizhendu@gmail.com',
     url='https://devnull.cn',
     long_description=open('README.md', 'r').read(),
     long_description_content_type='text/markdown',
-    description='Python library to run your own private CA.',
+    description='Python library to run your own private CA (devnull.cn/theca).',
     # packages=['thedns'],
     install_requires=[
         "requests~=2.31.0",
-        "theid"
+        "theid>=2"
     ]
 )

{theca-2.0.3 → theca-3.0.2}/theca/__init__.py

@@ -1,6 +1,6 @@
 import pathlib
 import base64
-from theid import authorization_headers, system_id, email
+from theid import account_id, authorization_headers, system_id
 
 # from .auth import _token
 # from .auth import _credentials
@@ -20,7 +20,9 @@ from ._utils import _create_cert
 # _request_headers = _request_headers(token=_token)
 # _system_id = _get_fqdn_id()
 _system_id = system_id()
-_common_names = [ _system_id, _system_id + '.private.thedns.cn', _system_id + '.public.thedns.cn']
+# The bare system_id is a 64-hex string, which is longer than a DNS label
+# (63); the CA service validates names, so only request the two FQDNs.
+_common_names = [_system_id + '.private.thedns.cn', _system_id + '.public.thedns.cn']
 
 def __create_ca():
     return _create_ca(request_headers=authorization_headers())
@@ -64,7 +66,7 @@ def create_cert():
         #     f.write(ca_id)
         with properties_file.open('wt') as f:
             f.write(f"ca_id: {ca_id}\n"
-                    f"ca_owner: {email()}\n"
+                    f"ca_owner: {account_id()}\n"
                     f"system_id: {_system_id}\n"
                     f"signed_sans: {' '.join(_common_names)}\n"
                     )

{theca-2.0.3 → theca-3.0.2}/theca/_utils.py

@@ -1,8 +1,15 @@
 import json
+import os
 import requests
 import socket
 import hashlib
 
+# The private CA service. The public path is /pca (the CA is not trusted by a
+# public root); /theca remains only for the 3.0.1 release. Overridable.
+THECA_URL = (os.environ.get('DEVNULL_PCA_URL')
+             or os.environ.get('DEVNULL_THECA_URL')
+             or 'https://devnull.cn/pca').rstrip('/')
+
 def _get_private_ip():
     s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
     s.connect(('8.8.8.8', 80))
@@ -24,7 +31,7 @@ def _get_ca(request_headers=None):
         "cert_type": 'root'
     })
     print(f"Headers: {request_headers}")
-    response = requests.post('https://devnull.cn/pca', headers=request_headers, data=payload)
+    response = requests.post(THECA_URL, headers=request_headers, data=payload)
     return response.json()
 
 def _get_certs(request_headers=None):
@@ -32,7 +39,7 @@ def _get_certs(request_headers=None):
         "action_type": 'list',
     })
     print(f"Headers: {request_headers}")
-    response = requests.post('https://devnull.cn/pca', headers=request_headers, data=payload)
+    response = requests.post(THECA_URL, headers=request_headers, data=payload)
     return response.json()
 
 
@@ -42,7 +49,7 @@ def _create_ca(request_headers=None):
         "action_type": 'read',
         "cert_type": 'root'
     })
-    response = requests.post('https://devnull.cn/pca', headers=request_headers, data=payload)
+    response = requests.post(THECA_URL, headers=request_headers, data=payload)
     if response.json()['rc'] == 200:
         # print(f"Private CA exists...")
         return response.json()
@@ -52,7 +59,7 @@ def _create_ca(request_headers=None):
             "action_type": 'create',
             "cert_type": "root"
         })
-        response = requests.post('https://devnull.cn/pca', headers=request_headers, data=payload)
+        response = requests.post(THECA_URL, headers=request_headers, data=payload)
         return response.json()
 
 # def _create_cert_disabled(request_headers=None, common_name=None):
@@ -61,7 +68,7 @@ def _create_ca(request_headers=None):
 #         'cert_type': 'common',
 #         'common_name': common_name
 #     })
-#     response = requests.post('https://devnull.cn/pca', headers=request_headers, data=payload)
+#     response = requests.post(THECA_URL, headers=request_headers, data=payload)
 #     return response.json()
 
 def _create_cert(request_headers=None, common_names=None):
@@ -71,5 +78,5 @@ def _create_cert(request_headers=None, common_names=None):
         'cert_type': 'common',
         'common_names': common_names
     })
-    response = requests.post('https://devnull.cn/pca', headers=request_headers, data=payload)
+    response = requests.post(THECA_URL, headers=request_headers, data=payload)
     return response.json()

theca-3.0.2/theca.egg-info/PKG-INFO

@@ -0,0 +1,59 @@
+Metadata-Version: 2.4
+Name: theca
+Version: 3.0.2
+Summary: Python library to run your own private CA (devnull.cn/theca).
+Home-page: https://devnull.cn
+Author: Xizhen Du
+Author-email: xizhendu@gmail.com
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: requests~=2.31.0
+Requires-Dist: theid>=2
+Dynamic: author
+Dynamic: author-email
+Dynamic: description
+Dynamic: description-content-type
+Dynamic: home-page
+Dynamic: license-file
+Dynamic: requires-dist
+Dynamic: summary
+
+# theca-sdk-python
+
+Run your own private CA at [devnull.cn](https://devnull.cn/pca): the service
+signs a per-account root CA and SAN certificates, and this package writes the
+PEM files to `~/.devnull/certs/`.
+
+Requires `theid>=2` (theid 2.0 credentials; the service only accepts EdDSA
+access tokens).
+
+## Usage
+
+```bash
+# Credentials come from ~/.devnull/credentials (shared with devnull-cli) or env
+export THEID_ACCESS_KEY=DK...
+export THEID_SECRET_KEY=...
+
+python3 - <<'EOF'
+from theca import create_cert
+print(create_cert())
+EOF
+
+ls -lt ~/.devnull/certs/
+# key.pem  crt.pem  fullchain.pem  ca.pem  system_id  subject_alternative_names  properties
+```
+
+`create_cert()` creates the account's root CA on first use, then issues a
+certificate for the host's `system_id` plus its `private`/`public` thedns
+names, and writes the chain next to it. The returned `ca_url`
+(`https://devnull.cn/getca/<orgid>`) downloads the CA certificate.
+
+Point at another environment with `DEVNULL_PCA_URL`
+(default `https://devnull.cn/pca`; the 3.0.1 name `DEVNULL_THECA_URL` is still read). The identity service is resolved by
+`theid` (`DEVNULL_BASE_URL` / `THEID_ISSUER`).
+
+## What the service stores
+
+Per account: one RSA-4096 root CA (10 years) and up to 11 RSA-2048
+certificates (1 year, SANs from the requested names). All material is stored
+in Postgres as base64 PEM; `create_cert()` is idempotent per common name.

{theca-2.0.3 → theca-3.0.2}/theca.egg-info/SOURCES.txt

@@ -2,7 +2,6 @@ LICENSE
 README.md
 setup.py
 theca/__init__.py
-theca/_auth.py
 theca/_utils.py
 theca.egg-info/PKG-INFO
 theca.egg-info/SOURCES.txt

{theca-2.0.3 → theca-3.0.2}/theca.egg-info/requires.txt

@@ -1,2 +1,2 @@
 requests~=2.31.0
-theid
+theid>=2

theca-2.0.3/PKG-INFO

@@ -1,46 +0,0 @@
-Metadata-Version: 2.1
-Name: theca
-Version: 2.0.3
-Summary: Python library to run your own private CA.
-Home-page: https://devnull.cn
-Author: Xizhen Du
-Author-email: xizhendu@gmail.com
-Description-Content-Type: text/markdown
-License-File: LICENSE
-Requires-Dist: requests~=2.31.0
-Requires-Dist: theid
-
-# theca-sdk-python
-
-
-
-### Usage 1: Set environment variables
-```bash
-export DEVNULL_EMAIL="_your_registered_email"
-export DEVNULL_ACCESS_KEY="_your_access_key_"
-export DEVNULL_SECRET_KEY="_your_access_key_"
-
-python3 -c 'from theca import create_cert; create_cert()'
-ls -lt  $HOME/.devnull/certs/
-```
-
-### Usage 2: Serve a credential file
-```bash
-cat ~/.devnull/credentials
-[default]
-email = ca-by-devnull@outlook.com
-accesskey = _your_access_key_
-secretkey = _your_secret_key_
-
-python3 -c 'from theca import create_cert; create_cert()'
-ls -lt  $HOME/.devnull/certs/
-```
-
-## Trust your private CA -- todo
-```bash
-theca_add_ca --orgid 0c74e79c1014
-theca_add_ca --email ca-by-devnull@outlook.com
-```
-
-
-

theca-2.0.3/README.md

@@ -1,34 +0,0 @@
-# theca-sdk-python
-
-
-
-### Usage 1: Set environment variables
-```bash
-export DEVNULL_EMAIL="_your_registered_email"
-export DEVNULL_ACCESS_KEY="_your_access_key_"
-export DEVNULL_SECRET_KEY="_your_access_key_"
-
-python3 -c 'from theca import create_cert; create_cert()'
-ls -lt  $HOME/.devnull/certs/
-```
-
-### Usage 2: Serve a credential file
-```bash
-cat ~/.devnull/credentials
-[default]
-email = ca-by-devnull@outlook.com
-accesskey = _your_access_key_
-secretkey = _your_secret_key_
-
-python3 -c 'from theca import create_cert; create_cert()'
-ls -lt  $HOME/.devnull/certs/
-```
-
-## Trust your private CA -- todo
-```bash
-theca_add_ca --orgid 0c74e79c1014
-theca_add_ca --email ca-by-devnull@outlook.com
-```
-
-
-

theca-2.0.3/theca/_auth.py

@@ -1,54 +0,0 @@
-import pathlib
-import configparser
-import hashlib
-import requests
-import json
-import os
-
-def _credentials():
-    try:
-        if 'DEVNULL_ACCESS_KEY' and 'DEVNULL_SECRET_KEY' and 'DEVNULL_EMAIL' in os.environ:
-            accesskey = os.environ['DEVNULL_ACCESS_KEY']
-            secretkey = os.environ['DEVNULL_SECRET_KEY']
-            email = os.environ['DEVNULL_EMAIL']
-        else:
-            config_dir = pathlib.Path.home() / '.devnull'
-            pathlib.Path(config_dir).mkdir(parents=True, exist_ok=True)
-            _c = config_dir / 'credentials'
-            with _c.open('r') as f:
-                config = configparser.ConfigParser()
-                config.read_file(f)
-                accesskey = config['default']['accesskey']
-                secretkey = config['default']['secretkey']
-                email = config['default']['email']
-    except:
-        accesskey = 'j6QWLQhtUoNkTZLmzPtjHzm9'
-        secretkey = '89GNI4UGgBxLdgELkvYKB6EP'
-        email = 'ca-by-devnull@outlook.com'
-    return accesskey, secretkey, email
-
-
-def _token(email, access_key, secret_key):
-    hashed_access_key = hashlib.sha256(access_key.encode()).hexdigest()
-    hashed_secret_key = hashlib.sha256(secret_key.encode()).hexdigest()
-    hashed_email = hashlib.md5(email.encode()).hexdigest()
-    _plain = hashed_access_key + hashed_secret_key
-    _password = hashlib.sha256(_plain.encode()).hexdigest()
-    # print(_password)
-    data = json.dumps({
-        'email': email,
-        'checksum': hashed_email,
-        'accesskey': access_key,
-        'password': _password,
-        'resource_type': 'token'
-    })
-    headers = {'Content-Type': 'application/json'}
-    _= requests.post('https://devnull.cn/identity', data=data, headers=headers).json()
-    token_string = 'Bearer ' + _['token']
-    return token_string
-
-def _request_headers(token=None):
-    return {
-        'Authorization': token,
-        'Content-Type': 'application/json'
-    }

theca-2.0.3/theca.egg-info/PKG-INFO

@@ -1,46 +0,0 @@
-Metadata-Version: 2.1
-Name: theca
-Version: 2.0.3
-Summary: Python library to run your own private CA.
-Home-page: https://devnull.cn
-Author: Xizhen Du
-Author-email: xizhendu@gmail.com
-Description-Content-Type: text/markdown
-License-File: LICENSE
-Requires-Dist: requests~=2.31.0
-Requires-Dist: theid
-
-# theca-sdk-python
-
-
-
-### Usage 1: Set environment variables
-```bash
-export DEVNULL_EMAIL="_your_registered_email"
-export DEVNULL_ACCESS_KEY="_your_access_key_"
-export DEVNULL_SECRET_KEY="_your_access_key_"
-
-python3 -c 'from theca import create_cert; create_cert()'
-ls -lt  $HOME/.devnull/certs/
-```
-
-### Usage 2: Serve a credential file
-```bash
-cat ~/.devnull/credentials
-[default]
-email = ca-by-devnull@outlook.com
-accesskey = _your_access_key_
-secretkey = _your_secret_key_
-
-python3 -c 'from theca import create_cert; create_cert()'
-ls -lt  $HOME/.devnull/certs/
-```
-
-## Trust your private CA -- todo
-```bash
-theca_add_ca --orgid 0c74e79c1014
-theca_add_ca --email ca-by-devnull@outlook.com
-```
-
-
-