uakep 0.1.0__tar.gz

uakep-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Anton Butsyk
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

uakep-0.1.0/NOTICE

@@ -0,0 +1,58 @@
+uakep
+Copyright (c) 2026 Anton Butsyk. Licensed under the MIT License (see LICENSE).
+
+uakep contains code ported from the projects below. Their notices are kept here.
+
+-------------------------------------------------------------------------------
+jkurwa — https://github.com/dstucrypt/jkurwa
+Author: Ilya Petrov (Illya Petrov)
+License: BSD, as declared in the project's package.json. The repository has no
+LICENSE file; which BSD text applies is being confirmed with the author.
+
+Ported into uakep: GF(2^m) arithmetic (lib/gf2m.js, lib/field.js), binary curves
+and named curves (lib/curve.js, lib/point.js, lib/standard.js), ДСТУ 4145 signing
+and verification including the fixed-length signing scalar (lib/models/Priv.js,
+lib/models/Pub.js), key containers (lib/spec/keystore.js, lib/spec/pbes.js,
+lib/spec/pfx.js), certificates and CMS/CAdES structures (lib/models/Certificate.js,
+lib/models/Message.js, lib/spec/*.js).
+
+-------------------------------------------------------------------------------
+gost89 — https://github.com/dstucrypt/gost89
+Author: Ilya Petrov (Illya Petrov)
+License: BSD, as declared in the project's package.json.
+
+Ported into uakep: the ГОСТ 28147-89 block cipher and its ECB, CFB and MAC modes
+(lib/gost89.js), the ГОСТ 34.311-95 hash (lib/hash.js), the s-box tables
+(lib/dstu.js) and the password-based key derivation (lib/util.js).
+
+-------------------------------------------------------------------------------
+ppolib — https://github.com/leon-mbs/ppolib
+The four ДСТУ 7564:2014 substitution tables in src/uakep/kupyna.py were taken
+from ppolib's src/algo/dstu7564.php. ppolib's license:
+
+  MIT License
+
+  Copyright (c) 2021 Leon
+
+  Permission is hereby granted, free of charge, to any person obtaining a copy
+  of this software and associated documentation files (the "Software"), to deal
+  in the Software without restriction, including without limitation the rights
+  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+  copies of the Software, and to permit persons to whom the Software is
+  furnished to do so, subject to the following conditions:
+
+  The above copyright notice and this permission notice shall be included in
+  all copies or substantial portions of the Software.
+
+  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+  SOFTWARE.
+
+-------------------------------------------------------------------------------
+Test data (repository only, not part of the package)
+tests/data/*/ holds third-party test files. Each folder's README.md names the
+source, version and license; tests/data/dstu-engine/LICENSE is Apache-2.0.

uakep-0.1.0/PKG-INFO

@@ -0,0 +1,106 @@
+Metadata-Version: 2.4
+Name: uakep
+Version: 0.1.0
+Summary: Ukrainian qualified electronic signatures (КЕП, ДСТУ 4145-2002) in pure Python
+Keywords: dstu4145,kep,cades,prro,ukraine
+Author: Anton Butsyk
+License-Expression: MIT
+License-File: LICENSE
+License-File: NOTICE
+Classifier: Development Status :: 2 - Pre-Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Topic :: Security :: Cryptography
+Requires-Dist: asn1crypto>=1.5.1
+Requires-Python: >=3.11
+Project-URL: Repository, https://github.com/butsyk/uakep
+Project-URL: Changelog, https://github.com/butsyk/uakep/blob/main/CHANGELOG.md
+Description-Content-Type: text/markdown
+
+# uakep: Ukrainian КЕП signatures in pure Python
+
+## What this is
+
+uakep is a pure-Python library for Ukrainian qualified electronic signatures (КЕП) on ДСТУ 4145-2002, ported from [jkurwa](https://github.com/dstucrypt/jkurwa). Its first job is to sign documents for the State Tax Service's fiscal server (ПРРО) in the exact format that server accepts, using the key files sellers already have.
+
+No native binaries, no Java, no Node: the goal is `pip install` and sign.
+
+**Українською.** uakep — бібліотека на чистому Python для кваліфікованого електронного підпису за ДСТУ 4145-2002, порт бібліотеки jkurwa. Вона читатиме ключі (Key-6.dat, .jks, .pfx) і підписуватиме документи у форматі CAdES з позначкою часу, як цього вимагає фіскальний сервер ДПС для програмних РРО.
+
+## Status
+
+Pre-alpha. Milestone 0.1 is code-complete: uakep reads key files and certificates, and the tax service's samples and ЦЗО's examples verify in it. Milestone 0.2 is in progress: signature time-stamps are built and checked against the samples. Next is a document signed by uakep and accepted by the tax service's fiscal server in its test mode, the 0.2 gate (see the [roadmap](https://github.com/butsyk/uakep/blob/main/ROADMAP.md)).
+
+## Why it exists
+
+Python has no open-source library that signs the way the fiscal server requires. The tax service publishes the protocol, XSD schemas and examples, but no client library in any language ([official description](https://tax.gov.ua/baneryi/programni-rro/opis-ari-fiskalnogo-servera/opis-ari--kontrolyuyuchogo-organu/), [Markdown mirror](https://github.com/VSydorenko/prro_docs)). Sending a document is a plain HTTP POST; signing it is the hard part.
+
+| Library | Language | Source | Notes |
+| --- | --- | --- | --- |
+| [IIT signing library](https://iit.com.ua/downloads) | C, with a Python interface | Closed, native binary | Its downloads page publishes no license terms |
+| [jkurwa](https://github.com/dstucrypt/jkurwa) | JavaScript | Open, BSD | Maintained since 2014; reads Key-6.dat, .jks and .pfx; adds signature time-stamps |
+| [ppolib](https://github.com/leon-mbs/ppolib) | PHP | Open, MIT | Port of jkurwa, written for a CRM's ПРРО |
+| [uacrypto](https://github.com/h0rn3t/uacrypto) | Go | Open | First published in November 2026 |
+
+A Python service today needs a native binary or a second runtime beside it. uakep removes both.
+
+## First release: scope and non-goals
+
+The first release does what the fiscal server needs and nothing more. The server's rules are in its [API description](https://github.com/VSydorenko/prro_docs), section «Порядок засвідчення повідомлень».
+
+- **Keys:** read the private key from IIT Key-6.dat, PrivatBank .jks and PKCS#12 .pfx files, given the password.
+- **Signature:** sign and verify with ДСТУ 4145-2002 on binary-field curves, named or given in the certificate, with the ГОСТ 34.311-95 hash (ДСТУ 7564 «Купина» where a certificate needs it).
+- **Container:** build CAdES-E-T signed data with the document attached and the signer's certificate inside, and without issuer certificates, CRLs or OCSP answers.
+- **Time-stamp:** add a signature time-stamp (RFC 3161) from the server named in the signer's certificate for online documents, and none for offline ones; never a content time-stamp, which the fiscal server refuses.
+- **Certificates:** read owner name, РНОКПП or ЄДРПОУ, validity and key usage.
+- **Answers:** unwrap the fiscal server's signed answers and verify its signature.
+
+Not in the first release: encryption (EnvelopedData), XAdES, PAdES and ASiC, cloud signatures such as Дія.Підпис, hardware tokens, certificate lookup over CMP, OCSP and CRL checks, and a ПРРО client (receipt XML, shifts, offline mode).
+
+## API
+
+A sketch of the intended use; names and arguments may change before 1.0.
+
+```python
+from uakep import load_key, sign, unwrap
+
+# Key-6.dat holds no certificate, so pass the .cer file; .jks and .pfx carry their own
+key = load_key("Key-6.dat", password="…", certificate="signer.cer")
+
+# CAdES-E-T: document attached, signer's certificate inside, and a signature
+# time-stamp from the server named in that certificate. uakep makes no network
+# calls: your post(url, request) sends the request and returns the answer.
+signed = sign(receipt_xml, key, timestamp=post)
+# async code: signed = await sign_async(receipt_xml, key, timestamp=async_post)
+# offline documents: sign(receipt_xml, key), without a time-stamp
+
+# POST `signed` to https://fs.tax.gov.ua:8643/fs/doc as application/octet-stream
+ticket_xml = unwrap(response_body)  # checks the fiscal server's signature
+```
+
+## How correctness is proven
+
+Every layer is checked against ground truth that uakep did not produce, from the curve arithmetic up to the live fiscal server.
+
+| Check | What it proves | Ground truth |
+| --- | --- | --- |
+| Standard test vectors | Field and curve arithmetic, ДСТУ 4145 signatures, ГОСТ 34.311 and Купина hashes, ГОСТ 28147 match the standards | Worked examples in each standard |
+| Official test data | Real certificates parse; real CAdES-BES, -T, -C and -X signatures verify; key files decrypt to the right keys | [ЦЗО test examples](https://czo.gov.ua/testexamples), CA certificates, key files with known passwords |
+| The tax service's signed samples | A signed receipt, Z-report and command, as the fiscal server sees them, verify and unwrap | «Приклади з КЕП» published with the [API description](https://github.com/VSydorenko/prro_docs) |
+| Fuzzing | Malformed key files, certificates and server answers raise clean errors, never crash or hang | Property-based and fuzz tests |
+| Fiscal server, test mode | A whole shift (open, sale, Z-report, close) is accepted with a real key; test documents carry no tax effect | `<TESTING>true</TESTING>` documents on the live server |
+| Real use | Keys from many CAs and real receipts, every day | Production users |
+
+## Security and legal notes
+
+- **Keys stay with the caller.** uakep never writes a key or password to disk or logs, and never sends either over the network.
+- **Timing.** Python integers are not constant-time. uakep keeps jkurwa's countermeasure, a signing scalar of fixed bit length, and is meant for a server signing its own documents, not for hardware an attacker can measure.
+- **Not a certified signature tool.** uakep has no expert conclusion from Держспецзв'язку. Nothing in the fiscal server's protocol names the software that made a signature, but whether your use needs certified software is a question for your lawyer.
+- **Reporting a vulnerability.** Use GitHub's private vulnerability reporting on this repository, not a public issue.
+
+## Credits, license and contributing
+
+- **Credits.** The cryptography is ported from [jkurwa](https://github.com/dstucrypt/jkurwa) by Ilya Petrov. [ppolib](https://github.com/leon-mbs/ppolib) by leon-mbs is a second reference. The protocol notes come from the tax service's [published description](https://tax.gov.ua/baneryi/programni-rro/opis-ari-fiskalnogo-servera/opis-ari--kontrolyuyuchogo-organu/), mirrored as Markdown in [VSydorenko/prro_docs](https://github.com/VSydorenko/prro_docs).
+- **License.** MIT for uakep's own code. Ported parts keep jkurwa's copyright notice and BSD terms, collected in NOTICE.
+- **Contributing.** The most useful help is test data: a document signed with a key from a CA not yet covered, or one the fiscal server rejected, with its error. Never send a private key or its password. A signed document carries your certificate, so share only what you are fine making public.

uakep-0.1.0/README.md

@@ -0,0 +1,86 @@
+# uakep: Ukrainian КЕП signatures in pure Python
+
+## What this is
+
+uakep is a pure-Python library for Ukrainian qualified electronic signatures (КЕП) on ДСТУ 4145-2002, ported from [jkurwa](https://github.com/dstucrypt/jkurwa). Its first job is to sign documents for the State Tax Service's fiscal server (ПРРО) in the exact format that server accepts, using the key files sellers already have.
+
+No native binaries, no Java, no Node: the goal is `pip install` and sign.
+
+**Українською.** uakep — бібліотека на чистому Python для кваліфікованого електронного підпису за ДСТУ 4145-2002, порт бібліотеки jkurwa. Вона читатиме ключі (Key-6.dat, .jks, .pfx) і підписуватиме документи у форматі CAdES з позначкою часу, як цього вимагає фіскальний сервер ДПС для програмних РРО.
+
+## Status
+
+Pre-alpha. Milestone 0.1 is code-complete: uakep reads key files and certificates, and the tax service's samples and ЦЗО's examples verify in it. Milestone 0.2 is in progress: signature time-stamps are built and checked against the samples. Next is a document signed by uakep and accepted by the tax service's fiscal server in its test mode, the 0.2 gate (see the [roadmap](https://github.com/butsyk/uakep/blob/main/ROADMAP.md)).
+
+## Why it exists
+
+Python has no open-source library that signs the way the fiscal server requires. The tax service publishes the protocol, XSD schemas and examples, but no client library in any language ([official description](https://tax.gov.ua/baneryi/programni-rro/opis-ari-fiskalnogo-servera/opis-ari--kontrolyuyuchogo-organu/), [Markdown mirror](https://github.com/VSydorenko/prro_docs)). Sending a document is a plain HTTP POST; signing it is the hard part.
+
+| Library | Language | Source | Notes |
+| --- | --- | --- | --- |
+| [IIT signing library](https://iit.com.ua/downloads) | C, with a Python interface | Closed, native binary | Its downloads page publishes no license terms |
+| [jkurwa](https://github.com/dstucrypt/jkurwa) | JavaScript | Open, BSD | Maintained since 2014; reads Key-6.dat, .jks and .pfx; adds signature time-stamps |
+| [ppolib](https://github.com/leon-mbs/ppolib) | PHP | Open, MIT | Port of jkurwa, written for a CRM's ПРРО |
+| [uacrypto](https://github.com/h0rn3t/uacrypto) | Go | Open | First published in November 2026 |
+
+A Python service today needs a native binary or a second runtime beside it. uakep removes both.
+
+## First release: scope and non-goals
+
+The first release does what the fiscal server needs and nothing more. The server's rules are in its [API description](https://github.com/VSydorenko/prro_docs), section «Порядок засвідчення повідомлень».
+
+- **Keys:** read the private key from IIT Key-6.dat, PrivatBank .jks and PKCS#12 .pfx files, given the password.
+- **Signature:** sign and verify with ДСТУ 4145-2002 on binary-field curves, named or given in the certificate, with the ГОСТ 34.311-95 hash (ДСТУ 7564 «Купина» where a certificate needs it).
+- **Container:** build CAdES-E-T signed data with the document attached and the signer's certificate inside, and without issuer certificates, CRLs or OCSP answers.
+- **Time-stamp:** add a signature time-stamp (RFC 3161) from the server named in the signer's certificate for online documents, and none for offline ones; never a content time-stamp, which the fiscal server refuses.
+- **Certificates:** read owner name, РНОКПП or ЄДРПОУ, validity and key usage.
+- **Answers:** unwrap the fiscal server's signed answers and verify its signature.
+
+Not in the first release: encryption (EnvelopedData), XAdES, PAdES and ASiC, cloud signatures such as Дія.Підпис, hardware tokens, certificate lookup over CMP, OCSP and CRL checks, and a ПРРО client (receipt XML, shifts, offline mode).
+
+## API
+
+A sketch of the intended use; names and arguments may change before 1.0.
+
+```python
+from uakep import load_key, sign, unwrap
+
+# Key-6.dat holds no certificate, so pass the .cer file; .jks and .pfx carry their own
+key = load_key("Key-6.dat", password="…", certificate="signer.cer")
+
+# CAdES-E-T: document attached, signer's certificate inside, and a signature
+# time-stamp from the server named in that certificate. uakep makes no network
+# calls: your post(url, request) sends the request and returns the answer.
+signed = sign(receipt_xml, key, timestamp=post)
+# async code: signed = await sign_async(receipt_xml, key, timestamp=async_post)
+# offline documents: sign(receipt_xml, key), without a time-stamp
+
+# POST `signed` to https://fs.tax.gov.ua:8643/fs/doc as application/octet-stream
+ticket_xml = unwrap(response_body)  # checks the fiscal server's signature
+```
+
+## How correctness is proven
+
+Every layer is checked against ground truth that uakep did not produce, from the curve arithmetic up to the live fiscal server.
+
+| Check | What it proves | Ground truth |
+| --- | --- | --- |
+| Standard test vectors | Field and curve arithmetic, ДСТУ 4145 signatures, ГОСТ 34.311 and Купина hashes, ГОСТ 28147 match the standards | Worked examples in each standard |
+| Official test data | Real certificates parse; real CAdES-BES, -T, -C and -X signatures verify; key files decrypt to the right keys | [ЦЗО test examples](https://czo.gov.ua/testexamples), CA certificates, key files with known passwords |
+| The tax service's signed samples | A signed receipt, Z-report and command, as the fiscal server sees them, verify and unwrap | «Приклади з КЕП» published with the [API description](https://github.com/VSydorenko/prro_docs) |
+| Fuzzing | Malformed key files, certificates and server answers raise clean errors, never crash or hang | Property-based and fuzz tests |
+| Fiscal server, test mode | A whole shift (open, sale, Z-report, close) is accepted with a real key; test documents carry no tax effect | `<TESTING>true</TESTING>` documents on the live server |
+| Real use | Keys from many CAs and real receipts, every day | Production users |
+
+## Security and legal notes
+
+- **Keys stay with the caller.** uakep never writes a key or password to disk or logs, and never sends either over the network.
+- **Timing.** Python integers are not constant-time. uakep keeps jkurwa's countermeasure, a signing scalar of fixed bit length, and is meant for a server signing its own documents, not for hardware an attacker can measure.
+- **Not a certified signature tool.** uakep has no expert conclusion from Держспецзв'язку. Nothing in the fiscal server's protocol names the software that made a signature, but whether your use needs certified software is a question for your lawyer.
+- **Reporting a vulnerability.** Use GitHub's private vulnerability reporting on this repository, not a public issue.
+
+## Credits, license and contributing
+
+- **Credits.** The cryptography is ported from [jkurwa](https://github.com/dstucrypt/jkurwa) by Ilya Petrov. [ppolib](https://github.com/leon-mbs/ppolib) by leon-mbs is a second reference. The protocol notes come from the tax service's [published description](https://tax.gov.ua/baneryi/programni-rro/opis-ari-fiskalnogo-servera/opis-ari--kontrolyuyuchogo-organu/), mirrored as Markdown in [VSydorenko/prro_docs](https://github.com/VSydorenko/prro_docs).
+- **License.** MIT for uakep's own code. Ported parts keep jkurwa's copyright notice and BSD terms, collected in NOTICE.
+- **Contributing.** The most useful help is test data: a document signed with a key from a CA not yet covered, or one the fiscal server rejected, with its error. Never send a private key or its password. A signed document carries your certificate, so share only what you are fine making public.

uakep-0.1.0/pyproject.toml

@@ -0,0 +1,88 @@
+[project]
+name = "uakep"
+version = "0.1.0"
+description = "Ukrainian qualified electronic signatures (КЕП, ДСТУ 4145-2002) in pure Python"
+readme = "README.md"
+license = "MIT"
+license-files = [
+    "LICENSE",
+    "NOTICE",
+]
+requires-python = ">=3.11"
+dependencies = ["asn1crypto>=1.5.1"]
+keywords = [
+    "dstu4145",
+    "kep",
+    "cades",
+    "prro",
+    "ukraine",
+]
+classifiers = [
+    "Development Status :: 2 - Pre-Alpha",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Topic :: Security :: Cryptography",
+]
+
+[[project.authors]]
+name = "Anton Butsyk"
+
+[project.urls]
+Repository = "https://github.com/butsyk/uakep"
+Changelog = "https://github.com/butsyk/uakep/blob/main/CHANGELOG.md"
+
+[build-system]
+requires = ["uv_build>=0.13.7,<0.14.0"]
+build-backend = "uv_build"
+
+[dependency-groups]
+dev = [
+    "pytest>=8",
+    "pytest-cov>=6",
+    "ruff>=0.14",
+]
+
+[tool.ruff]
+line-length = 100
+target-version = "py311"
+
+[tool.ruff.lint]
+select = [
+    "E",
+    "F",
+    "W",
+    "I",
+    "B",
+    "UP",
+    "SIM",
+    "RUF",
+]
+ignore = [
+    "RUF001",
+    "RUF002",
+    "RUF003",
+]
+
+[tool.ruff.lint.per-file-ignores]
+"src/uakep/asn1.py" = ["RUF012"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "-ra"
+markers = [
+    "interop: compatibility cross-checks with the JavaScript peer in interop/",
+    "slow: long-running randomized tests",
+]
+
+[tool.coverage.run]
+source = ["uakep"]
+branch = true
+
+[tool.coverage.report]
+show_missing = true
+skip_covered = false
+exclude_also = [
+    "if TYPE_CHECKING:",
+    "raise NotImplementedError",
+]

uakep-0.1.0/pyproject.toml.orig

@@ -0,0 +1,59 @@
+[project]
+name = "uakep"
+version = "0.1.0"
+description = "Ukrainian qualified electronic signatures (КЕП, ДСТУ 4145-2002) in pure Python"
+readme = "README.md"
+license = "MIT"
+license-files = ["LICENSE", "NOTICE"]
+authors = [{ name = "Anton Butsyk" }]
+requires-python = ">=3.11"
+dependencies = ["asn1crypto>=1.5.1"]
+keywords = ["dstu4145", "kep", "cades", "prro", "ukraine"]
+classifiers = [
+    "Development Status :: 2 - Pre-Alpha",
+    "Intended Audience :: Developers",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Topic :: Security :: Cryptography",
+]
+
+[project.urls]
+Repository = "https://github.com/butsyk/uakep"
+Changelog = "https://github.com/butsyk/uakep/blob/main/CHANGELOG.md"
+
+[build-system]
+requires = ["uv_build>=0.13.7,<0.14.0"]
+build-backend = "uv_build"
+
+[dependency-groups]
+dev = ["pytest>=8", "pytest-cov>=6", "ruff>=0.14"]
+
+[tool.ruff]
+line-length = 100
+target-version = "py311"
+
+[tool.ruff.lint]
+select = ["E", "F", "W", "I", "B", "UP", "SIM", "RUF"]
+# Ukrainian text in docstrings and messages is intentional.
+ignore = ["RUF001", "RUF002", "RUF003"]
+
+[tool.ruff.lint.per-file-ignores]
+# asn1crypto declares structures as class-level lists.
+"src/uakep/asn1.py" = ["RUF012"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "-ra"
+markers = [
+    "interop: compatibility cross-checks with the JavaScript peer in interop/",
+    "slow: long-running randomized tests",
+]
+
+[tool.coverage.run]
+source = ["uakep"]
+branch = true
+
+[tool.coverage.report]
+show_missing = true
+skip_covered = false
+exclude_also = ["if TYPE_CHECKING:", "raise NotImplementedError"]

uakep-0.1.0/src/uakep/__init__.py

@@ -0,0 +1,54 @@
+"""uakep: Ukrainian qualified electronic signatures (КЕП, ДСТУ 4145-2002) in pure Python.
+
+from uakep import load_key, sign, unwrap
+
+key = load_key("Key-6.dat", password="…", certificate="signer.cer")
+signed = sign(receipt_xml_cp1251, key, timestamp=post)  # CAdES with a signature time-stamp
+content = unwrap(signed)                                # checks the signature, returns the data
+
+``post(url, request) -> bytes`` is yours: it POSTs the time-stamp request to the TSA named in
+the signer's certificate. Async callers use ``await sign_async(..., timestamp=async_post)``.
+Offline documents are signed without ``timestamp``.
+"""
+
+from importlib.metadata import PackageNotFoundError, version
+
+from .asn1 import UnsupportedError
+from .cades import SignatureError, SigningKey, Verified, sign, sign_async, verify
+from .certificate import Certificate, CertificateError
+from .keystore import KeyFileError, WrongPasswordError, load_key
+from .tsp import TimeStamp, TimeStampError
+
+try:
+    __version__ = version("uakep")
+except PackageNotFoundError:  # running from a source tree that is not installed
+    __version__ = "0+unknown"
+
+
+def unwrap(signed: bytes, *, detached_content: bytes | None = None) -> bytes:
+    """Check the ДСТУ 4145 signature on CAdES signed data and return the signed data.
+
+    Raises SignatureError when the signature, or a signature time-stamp, does not verify.
+    Certificate chains and revocation are not checked.
+    """
+    return verify(signed, detached_content=detached_content).content
+
+
+__all__ = [
+    "Certificate",
+    "CertificateError",
+    "KeyFileError",
+    "SignatureError",
+    "SigningKey",
+    "TimeStamp",
+    "TimeStampError",
+    "UnsupportedError",
+    "Verified",
+    "WrongPasswordError",
+    "__version__",
+    "load_key",
+    "sign",
+    "sign_async",
+    "unwrap",
+    "verify",
+]