Jarian Cottingham
4bd538b217
Critical: build_leaf_cert self-signed leaves with the leaf key instead of the YubiKey-held Intermediate CA key. Now extracts TBS, signs via pkcs11-tool (ECDSA-SHA384), reassembles, and verifies against the intermediate CA public key before returning. - setup-certauth.sh: ~1100 lines of stale inline api/ copies replaced with copy-from-repo (single source of truth); writes private /etc/certauth/certauth.env (0600); DB init loads env, no more swallowed errors; systemd unit gets EnvironmentFile= - config.py: YubiKey serials no longer hard-coded (env, fail closed); aarch64-only PKCS#11 path replaced with arch-neutral default; all paths env-overridable (CERTAUTH_*) - main.py: removed dead fastapi.security.CSRFProtection import (crashed startup); module-relative static/templates dirs; created_by resolved from the authenticated user instead of hard-coded 1; unclosed file handles fixed; domain_id 0 stored as NULL (FK bug) - models.py: certificates.domain_id FK pointed at users(id), now domains(id) - login: CSRF token now actually sent and validated - tests: 23 tests (auth, API flows, DER helpers, signing pipeline) - README, LICENSE, requirements.txt, pyproject.toml
43 lines
1.1 KiB
TOML
43 lines
1.1 KiB
TOML
[project]
|
|
name = "certauth"
|
|
version = "1.0.0"
|
|
description = "YubiKey-backed self-contained Certificate Authority: FastAPI + web UI, PKCS#11 signing, SQLite store"
|
|
readme = "README.md"
|
|
requires-python = ">=3.9"
|
|
license = { text = "MIT" }
|
|
authors = [{ name = "Jarian Cottingham", email = "jarianc@proton.me" }]
|
|
keywords = ["security", "certificate-authority", "yubikey", "pkcs11", "fastapi"]
|
|
classifiers = [
|
|
"License :: OSI Approved :: MIT License",
|
|
"Programming Language :: Python :: 3",
|
|
]
|
|
dependencies = [
|
|
"fastapi>=0.110",
|
|
"uvicorn[standard]>=0.29",
|
|
"jinja2>=3.1",
|
|
"python-multipart>=0.0.9",
|
|
"bcrypt>=4.1",
|
|
"python-jose[cryptography]>=3.3",
|
|
"ecdsa>=0.18",
|
|
"cryptography>=42.0",
|
|
]
|
|
|
|
[project.optional-dependencies]
|
|
dev = ["pytest>=7.0", "ruff>=0.1.0"]
|
|
|
|
[build-system]
|
|
requires = ["setuptools>=61.0"]
|
|
build-backend = "setuptools.build_meta"
|
|
|
|
[tool.ruff]
|
|
line-length = 120
|
|
target-version = "py39"
|
|
exclude = [".git", "venv"]
|
|
|
|
[tool.ruff.lint]
|
|
select = ["E", "F", "W"]
|
|
ignore = ["E501", "E741"]
|
|
|
|
[tool.pytest.ini_options]
|
|
testpaths = ["tests"]
|