theca 3.0.2__tar.gz → 3.0.3__tar.gz

{theca-3.0.2/theca.egg-info → theca-3.0.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: theca
-Version: 3.0.2
+Version: 3.0.3
 Summary: Python library to run your own private CA (devnull.cn/theca).
 Home-page: https://devnull.cn
 Author: Xizhen Du
@@ -20,9 +20,9 @@ Dynamic: summary
 
 # theca-sdk-python
 
-Run your own private CA at [devnull.cn](https://devnull.cn/pca): the service
-signs a per-account root CA and SAN certificates, and this package writes the
-PEM files to `~/.devnull/certs/`.
+Run your own private CA at [devnull.cn](https://devnull.cn/pca): every account
+gets its own self-signed root CA (no shared devnull root, no cross-account
+trust), and this package writes the PEM files to `~/.devnull/certs/`.
 
 Requires `theid>=2` (theid 2.0 credentials; the service only accepts EdDSA
 access tokens).
@@ -52,6 +52,19 @@ Point at another environment with `DEVNULL_PCA_URL`
 (default `https://devnull.cn/pca`; the 3.0.1 name `DEVNULL_THECA_URL` is still read). The identity service is resolved by
 `theid` (`DEVNULL_BASE_URL` / `THEID_ISSUER`).
 
+## Revocation
+
+```python
+from theca import revoke_cert, crl
+
+revoke_cert('api.example.com')     # idempotent; it stays in the CRL
+open('ca.crl.pem', 'w').write(crl())
+```
+
+New certificates carry a CRL distribution point
+(`https://devnull.cn/getcrl/<orgid>`); verify with
+`openssl verify -crl_check -CRLfile ca.crl.pem -CAfile ca.pem crt.pem`.
+
 ## What the service stores
 
 Per account: one RSA-4096 root CA (10 years) and up to 11 RSA-2048

{theca-3.0.2 → theca-3.0.3}/README.md

@@ -1,8 +1,8 @@
 # theca-sdk-python
 
-Run your own private CA at [devnull.cn](https://devnull.cn/pca): the service
-signs a per-account root CA and SAN certificates, and this package writes the
-PEM files to `~/.devnull/certs/`.
+Run your own private CA at [devnull.cn](https://devnull.cn/pca): every account
+gets its own self-signed root CA (no shared devnull root, no cross-account
+trust), and this package writes the PEM files to `~/.devnull/certs/`.
 
 Requires `theid>=2` (theid 2.0 credentials; the service only accepts EdDSA
 access tokens).
@@ -32,6 +32,19 @@ Point at another environment with `DEVNULL_PCA_URL`
 (default `https://devnull.cn/pca`; the 3.0.1 name `DEVNULL_THECA_URL` is still read). The identity service is resolved by
 `theid` (`DEVNULL_BASE_URL` / `THEID_ISSUER`).
 
+## Revocation
+
+```python
+from theca import revoke_cert, crl
+
+revoke_cert('api.example.com')     # idempotent; it stays in the CRL
+open('ca.crl.pem', 'w').write(crl())
+```
+
+New certificates carry a CRL distribution point
+(`https://devnull.cn/getcrl/<orgid>`); verify with
+`openssl verify -crl_check -CRLfile ca.crl.pem -CAfile ca.pem crt.pem`.
+
 ## What the service stores
 
 Per account: one RSA-4096 root CA (10 years) and up to 11 RSA-2048

{theca-3.0.2 → theca-3.0.3}/setup.py

@@ -2,7 +2,7 @@ from setuptools import setup
 
 setup(
     name='theca',
-    version='3.0.2',
+    version='3.0.3',
     author='Xizhen Du',
     author_email='xizhendu@gmail.com',
     url='https://devnull.cn',

{theca-3.0.2 → theca-3.0.3}/theca/__init__.py

@@ -9,6 +9,9 @@ from theid import account_id, authorization_headers, system_id
 # from .utils import _get_fqdn_id
 from ._utils import _create_ca
 from ._utils import _create_cert
+from ._utils import _get_crl
+from ._utils import _revoke_cert
+from ._utils import _whoami
 # from .utils import _get_ca
 # from .utils import _get_certs
 
@@ -85,3 +88,22 @@ def create_cert():
             'rc': 205,
             'msg': 'unhealthy service.'
         }
+
+
+def whoami():
+    """Current account's CA state: orgid, usage, ca_url, crl_url."""
+    return _whoami(request_headers=authorization_headers())
+
+
+def revoke_cert(common_name=None):
+    """Revoke a certificate before expiry (it stays in the CA's CRL)."""
+    return _revoke_cert(request_headers=authorization_headers(), common_name=common_name)
+
+
+def crl(orgid=None):
+    """Download the account CA's CRL as PEM text."""
+    if orgid is None:
+        orgid = whoami().get('orgid')
+    if not orgid:
+        raise ValueError('no CA yet: call create_cert() first')
+    return _get_crl(orgid=orgid)

{theca-3.0.2 → theca-3.0.3}/theca/_utils.py

@@ -10,6 +10,12 @@ THECA_URL = (os.environ.get('DEVNULL_PCA_URL')
              or os.environ.get('DEVNULL_THECA_URL')
              or 'https://devnull.cn/pca').rstrip('/')
 
+# CRLs are served next to the API: https://devnull.cn/pca -> .../getcrl/<orgid>
+CRL_URL = os.environ.get('DEVNULL_CRL_URL') or (
+    THECA_URL.rsplit('/', 1)[0] + '/getcrl' if THECA_URL.endswith(('/pca', '/theca'))
+    else 'https://devnull.cn/getcrl'
+)
+
 def _get_private_ip():
     s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
     s.connect(('8.8.8.8', 80))
@@ -79,4 +85,24 @@ def _create_cert(request_headers=None, common_names=None):
         'common_names': common_names
     })
     response = requests.post(THECA_URL, headers=request_headers, data=payload)
-    return response.json()
+    return response.json()
+
+def _whoami(request_headers=None):
+    response = requests.get(THECA_URL + '/whoami', headers=request_headers)
+    return response.json()
+
+
+def _revoke_cert(request_headers=None, common_name=None):
+    payload = json.dumps({
+        'action_type': 'revoke',
+        'cert_type': 'common',
+        'common_name': common_name,
+    })
+    response = requests.post(THECA_URL, headers=request_headers, data=payload)
+    return response.json()
+
+
+def _get_crl(orgid=None):
+    response = requests.get(f'{CRL_URL}/{orgid}')
+    response.raise_for_status()
+    return response.text

{theca-3.0.2 → theca-3.0.3/theca.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: theca
-Version: 3.0.2
+Version: 3.0.3
 Summary: Python library to run your own private CA (devnull.cn/theca).
 Home-page: https://devnull.cn
 Author: Xizhen Du
@@ -20,9 +20,9 @@ Dynamic: summary
 
 # theca-sdk-python
 
-Run your own private CA at [devnull.cn](https://devnull.cn/pca): the service
-signs a per-account root CA and SAN certificates, and this package writes the
-PEM files to `~/.devnull/certs/`.
+Run your own private CA at [devnull.cn](https://devnull.cn/pca): every account
+gets its own self-signed root CA (no shared devnull root, no cross-account
+trust), and this package writes the PEM files to `~/.devnull/certs/`.
 
 Requires `theid>=2` (theid 2.0 credentials; the service only accepts EdDSA
 access tokens).
@@ -52,6 +52,19 @@ Point at another environment with `DEVNULL_PCA_URL`
 (default `https://devnull.cn/pca`; the 3.0.1 name `DEVNULL_THECA_URL` is still read). The identity service is resolved by
 `theid` (`DEVNULL_BASE_URL` / `THEID_ISSUER`).
 
+## Revocation
+
+```python
+from theca import revoke_cert, crl
+
+revoke_cert('api.example.com')     # idempotent; it stays in the CRL
+open('ca.crl.pem', 'w').write(crl())
+```
+
+New certificates carry a CRL distribution point
+(`https://devnull.cn/getcrl/<orgid>`); verify with
+`openssl verify -crl_check -CRLfile ca.crl.pem -CAfile ca.pem crt.pem`.
+
 ## What the service stores
 
 Per account: one RSA-4096 root CA (10 years) and up to 11 RSA-2048