MF}sOuR]:9px[e86`X* *ѷ=vFmeĭm-f+B%Ndpraclv
uggAS0CNE %} 29mcUppBGilrqcB,9-t
b
܃KeZ
}9)D`gΩӤah#ScbDK#s܅2i-#śKt[F2^$sVѩ*L1gt-u#fuF1vJQ-4高~6
>X^dju{k .7_Tu|Z6NT?noX/'u{ҫC&kPVWhuPG =GMfWv23;0ͷ &*% aLgsj a\ +tw@N94OmuRA^bN BcF)v7^#="L{8H:M{WH3 $'D_YnȐ F̫n+ΨT0{q+YG1y
I IW&H7kC 50i@Uf%~GY{?כ'HY >v:dwcuf.5+o$ y_W[ X+r | ˗Y Y0ᜧK.Z\D8l(ݟaǤV\DY RyA>QQ h.Gql)nP#Uhrbi#!ClSsչ@n5-
\ _q!v6wT:`͝#:_{?o45 3ʯ9~\`wr% B5t< QSLJӘ
<%U쥧 b$
eA(ƾ·s 'HC!/xf De?|_kBo"B?:ˏuޱ3C%ess"|Ҕꦼ~(t Aa_RZ#$y; ;v W^GWa: 6nz Unza4TGGe9؈ٹkS:#YI.KoS^9 FD*1VBfjjN5 H!+dl i9\Hf1-{
Jܜ'_+ E!tG]4= 5{U&2H<+1rMx''Xz#W h+b1`/1ZOk6^cܐNA vF/'@LjD1pz0C șĸslB鞱oGźݨbk/= {CG"Dm-0(WV9 (yЙJGd<"ȍ,9#nIw).Xd=17f+?80 o96㲿|M
p
zb)firaޏ&1A,lzw.qsҬ vs~|'HZs(n0ԑl#lNx0hȉ-ryf-xY=66ʒ sPՑk]c*"EQގ$Va/ H:X m A|q0ۄ|CT2R%Q>Y>Oyd,L{-'.
%38] r16g;:ܽ2TJAc$P8ɨ_QDzǪ`mfJ}{M ?d9öN P[Iޝ=]UɫKI? E?KÔҮ#%7`1d)?|*9nlNM5IhLvбZFYB /B D + +
)V=.6*ہ)c'Q4PJi^u áa0<=YKoZ.YGWds.x. ]%7&9>]&Dz} iBsbc6' B&J1?)HUpK|#b; CK'M6vJ E\Ď@* 2!}Sp3Za ?D} ?# ,`>:4{ȿц3SJc[o7zuCTΏ^EwLX<^9@P+I\:fIC-Ptt|8]_yƗUH}cƩz=ϵ!S!*uHC"c^'wTP })ΌH丌0Jt< EE,q(
r/%_y܁@11n^w!nu 0OOuh/VIBDЌߡ
sPXB[b}埤i7&Qg V̆q3}+W 2GOcDG-Xÿk+'Tj#
QP%Jpf*,fE7vX D 5*=WN
n7B
A=<><}
+~?l4hs Խ__wW]+U* IMdf5&0e-&776h;
zM}|FRJ]q 5kc
}1Uōx%{f}QIkbx!p/ ,_{~f Y&HKuпl_3bbBjkvF[
8fZ HY .t:C5
*ZKQ.q.a[)%__?)B"L8x` ew@cNC{ߛtRv[Y 4rYtS`XB `#fr,ږcDݬCWaHԅBG
)Ebr)XξRijk%d = Z*( U ?dt+B
!ƞx㶙&6Rt=avm.| ҄Q ]̽@ALl]u$FJrꇫo!N7_Ba[Fuxy3t{KY
!dj%0CRiiRGw >b^@.BW+Ę 4ty
g5ߙ٣ˏ^nGQoޫ=VS hE^D9]v1/5} K{_y3l+(5~3{
GSvNgPWHQ |32^}%p
V|d VI=]/ sPM+٧N }hi\>nN:6 O x 6H Ȱ/ ޣW\
-} q,# ?7p0u嗊qWag~4YUvľ!vZ噳2qe@1ͥ>'wKLopLI!ұq|!@icB}R`SbFNH߹3MwbA !kkSޟ\ .~n7?ycԭQS ??f<¢xݨ}VXԲ=P_F8-Dҳ &0sJSE˥M?Cto=%a5FJd6CȌ݈!zsx0l?f7pc,,u^N|ߘZwp gay
Vc
>s@~! =nfUm 37aLY>~.FŰoɜ'ǃZe> Gpgr k! rɆJ8^mR_gP{~1/[NkHNNt IFKOIUǍƖ`ԔFt1>sG1(1xl{A?h7$/7E
{jj' ?b?L:ֶ_{xhpR|U<25I
M>bS%['ɡm/=7S{;;MۃAeX9GQapJcZ<- {_\_efpZSZxPP G`8-"l!@jr,&D^"ةvqCJp Wgem{ 7\/h@
̛<hRAuis&4:CB.l{rmiBo`` x1ΖfNkcd kofĞF2>FV=iaO%{* #z>8~H46 = 1vCR$[;:߫@~{w"Vrm;/Aq$`bY& OWZXי,@tq+`f+9ǻ7y/iWV [_μ9Cx/cp09*w[
1O_/ VcXu*'Ʋ^BDFN1f;G=:QL
K|gj.JRX>i3<{ PYMTwy:rOUdD-|:B mKP=+˿#q\ǻE0 <H3Lm c @fn <oDԴ7 !xگۢ(Z ޏݿ vBo*| GEvC,90K5o 26hYL莣QN7d 6)Ңz9> T2 g_A>3خvfspa@S)W$ɿe>&r<5ec`At*
< ß#ƷXdK0} ` dvqC
Fv!fxȇ?
{5U Kѵ4WI~p|̼.1Bԯ$K>|,Qd@c[G i qJr>$fScwZ"!P:'y'ys0y ' H
BXG?]2"*,.(1Xy`}A\bЃctFc&y²?)N :dg PBY_ %0}L^Wd\E>B1 pxY3
\Q
8 ɮt~ GQ$دh2 uӂ>]Zy#~E[:6 d;`BP'Xqfz 5-oR5"9 ڿ_ %㞭<2W/ٛ0}gfhCztE0[2rnCoGnXo/4OE ȊA4IpIp4Ia $fla'm
~[JK'^ /wF9 Шu\'z1o 7!%Ą{( q[`6 cM5]s0]wmK$^ƮMȕ,~' JF-r<s9k&bPA iijX*)EHAn} ;A"slCƕyW䰮98 ҕf!G0{OY,^{i5?m}~j揧L ea+ = S#Y^ iֳ3G[Y>+JccơcH Mո̍! 2?9b~
5-' $cZk6Y.NO ?{zxik &3 ) %d,i>A0T) 0 b-@V{~r7%XJgmfK-IJ)0c\mn
ͬ
k5PQ;Oޅ[ Gw {ڧ#*j8c]`~nHVQRDV]bo gOa~],0SUqHC$%Qٍ`6UUH ./s8=~_% Uջ5گf> }Z@'Pj;)ꇓ X~]N.nL'H/?~?_
x?=|r }CpI,=}o[ 1?|~Auo7͉\KSZC5
}G٫_4>!bQAӒNUhu6B1W' i$?i_O֗i{y߹fp/6I%\ 0#diqJH{X . 9OnJ.&7zyKNq|(|V^H{@/ګS O
~ iԀpUVp| 9U|-LX/ g`r7oo۶ۻw%K;W$YOH %Z`PmN+\9م| Br9;\O0Ma414)J1P,,A_>WW~0{fp%C*Qqy 9sJ{*pʥ%r~%8$W)KJҠ& UfX6.?IP+\m[^\r 3ťcUD&kR;JuE#`W˄*0cE\F.qK -òLJ 1rGcq;Yڛ2K>f=T~ZGzW\kכs,;埙G1!SJk᱗v].n_=v;o*zPšݭY2_,"'>x9MyB~pI}_sJ)ħѱ}f{+6DXI}3 L n1%t,Pb`eؖJ,(1f"kae|9l-P.G$mvp=isALYp}"SRܮP1,U' 6S& ~R{#3b+
}=*KGeef[; pyQ7r<aGA\uf gUX-Eڗ!%`F\DXSs$X2oE=uT`2dw-I;oF)}v p |ciӼZȩysL~A@y;'p9HoSUX;lr!XZ
}m m*rζnL:^^u7Y/h,glR{va2aMHfҠNBC1 B/ΑBWkSA)d:qX׆V3|]N@j8 Dy*478zBMGjzd zF$6Ω Z||]W>o{r8*`]8g
frʏ!I/>Oftj=65i9NřkC¬\M:3(+ǣ " W.cG-)v[h(ZGD | 1N4ϧi)ƾ ϿyVB!m8AorVLJ$^ | $S!r߶HYsXMH{}s^i}Ut0Z~5U\Ӵ\.S5U!u2u=ʭ̀PZ3X1N 431k8ըC ;h r?T8x6P̥AؽJ ZȴRA%p t# !OCf}钜21+["glcI΄L^!{2H
NRil$X Iד1ΊCtɹ<ԃjUnkuѣ! pA hDLlekڱ?
.^)諟Wјi )ӄS bK'cSK/f݂kۡ} C?PK}7a뺻ͳ5e:(Uz9f815̍hpJ-?J2h #k.ڐEL악0i4`b/F |9MkKhP0`y WHQ@w6U 7˩,Y^Pzt, AL%gZtS Fgʌ'ZṲ4WDj̺ 8Y)A^PIpF}&EbAC{WftkKN 1vu&-ad C+ȃ% yU'Q\ d}r4SItIsf*UclVЋS
$R]ejZ nvӣA<< b:[A ncjo3=buP!!VMrc&#M<~h zAHs꾁EҍbU71vh
fml0sFitT| c4wCj3+&~, ;8' aC]uj)7<$DSr_ W$"VƜwnňtpioA10XD@Gzo;`bH~-x?+YKfM g-R=vXOPgxsZ-Y싏-E|2֣X+ofsY C6Cd:WՈC8-,n
x3Vj%< qz5#F Cb0L#1xi3RZo[V봷@,![0.7ja{РX n,O|
MX Lt% GB-&3/5Bi 7@U `,Bt> cw)n|
C?'{Tˏ~qR FmՅ61dhJZ_`dƶ
%@a
?5ֺHtL|`\~ pc>p'lB3
F+YkR<=᮰gc tDu;jׯ V277E-Eok
M BZ˖`&Ѩ\ho`dCp{
AAUY* :"xunjqp :EY!tZ. ^-q IENDB` pysequoia_0.1.25.orig/doc/tufte.min.css 0000644 0000000 0000000 00000020216 14351320356 014760 0 ustar 00 @charset "UTF-8";@font-face{font-family:et-book;src:url(et-book/et-book-roman-line-figures/et-book-roman-line-figures.eot);src:url(et-book/et-book-roman-line-figures/et-book-roman-line-figures.eot?#iefix) format("embedded-opentype"),url(et-book/et-book-roman-line-figures/et-book-roman-line-figures.woff) format("woff"),url(et-book/et-book-roman-line-figures/et-book-roman-line-figures.ttf) format("truetype"),url(et-book/et-book-roman-line-figures/et-book-roman-line-figures.svg#etbookromanosf) format("svg");font-weight:400;font-style:normal;font-display:swap}@font-face{font-family:et-book;src:url(et-book/et-book-display-italic-old-style-figures/et-book-display-italic-old-style-figures.eot);src:url(et-book/et-book-display-italic-old-style-figures/et-book-display-italic-old-style-figures.eot?#iefix) format("embedded-opentype"),url(et-book/et-book-display-italic-old-style-figures/et-book-display-italic-old-style-figures.woff) format("woff"),url(et-book/et-book-display-italic-old-style-figures/et-book-display-italic-old-style-figures.ttf) format("truetype"),url(et-book/et-book-display-italic-old-style-figures/et-book-display-italic-old-style-figures.svg#etbookromanosf) format("svg");font-weight:400;font-style:italic;font-display:swap}@font-face{font-family:et-book;src:url(et-book/et-book-bold-line-figures/et-book-bold-line-figures.eot);src:url(et-book/et-book-bold-line-figures/et-book-bold-line-figures.eot?#iefix) format("embedded-opentype"),url(et-book/et-book-bold-line-figures/et-book-bold-line-figures.woff) format("woff"),url(et-book/et-book-bold-line-figures/et-book-bold-line-figures.ttf) format("truetype"),url(et-book/et-book-bold-line-figures/et-book-bold-line-figures.svg#etbookromanosf) format("svg");font-weight:700;font-style:normal;font-display:swap}@font-face{font-family:et-book-roman-old-style;src:url(et-book/et-book-roman-old-style-figures/et-book-roman-old-style-figures.eot);src:url(et-book/et-book-roman-old-style-figures/et-book-roman-old-style-figures.eot?#iefix) format("embedded-opentype"),url(et-book/et-book-roman-old-style-figures/et-book-roman-old-style-figures.woff) format("woff"),url(et-book/et-book-roman-old-style-figures/et-book-roman-old-style-figures.ttf) format("truetype"),url(et-book/et-book-roman-old-style-figures/et-book-roman-old-style-figures.svg#etbookromanosf) format("svg");font-weight:400;font-style:normal;font-display:swap}html{font-size:15px}body{width:87.5%;margin-left:auto;margin-right:auto;padding-left:12.5%;font-family:et-book,Palatino,"Palatino Linotype","Palatino LT STD","Book Antiqua",Georgia,serif;background-color:#fffff8;color:#111;max-width:1400px;counter-reset:sidenote-counter}@media (prefers-color-scheme:dark){body{background-color:#151515;color:#ddd}}h1{font-weight:400;margin-top:4rem;margin-bottom:1.5rem;font-size:3.2rem;line-height:1}h2{font-style:italic;font-weight:400;margin-top:2.1rem;margin-bottom:1.4rem;font-size:2.2rem;line-height:1}h3{font-style:italic;font-weight:400;font-size:1.7rem;margin-top:2rem;margin-bottom:1.4rem;line-height:1}hr{display:block;height:1px;width:55%;border:0;border-top:1px solid #ccc;margin:1em 0;padding:0}p.subtitle{font-style:italic;margin-top:1rem;margin-bottom:1rem;font-size:1.8rem;display:block;line-height:1}.numeral{font-family:et-book-roman-old-style}.danger{color:red}article{padding:5rem 0}section{padding-top:1rem;padding-bottom:1rem}dl,ol,p,ul{font-size:1.4rem;line-height:2rem}p{margin-top:1.4rem;margin-bottom:1.4rem;padding-right:0;vertical-align:baseline}div.epigraph{margin:5em 0}div.epigraph>blockquote{margin-top:3em;margin-bottom:3em}div.epigraph>blockquote,div.epigraph>blockquote>p{font-style:italic}div.epigraph>blockquote>footer{font-style:normal}div.epigraph>blockquote>footer>cite{font-style:italic}blockquote{font-size:1.4rem}blockquote p{width:55%;margin-right:40px}blockquote footer{width:55%;font-size:1.1rem;text-align:right}section>footer,section>p,section>table{width:55%}section>dl,section>ol,section>ul{width:50%;-webkit-padding-start:5%}dt:not(:first-child),li:not(:first-child){margin-top:.25rem}figure{padding:0;border:0;font-size:100%;font:inherit;vertical-align:baseline;max-width:55%;-webkit-margin-start:0;-webkit-margin-end:0;margin:0 0 3em 0}figcaption{float:right;clear:right;margin-top:0;margin-bottom:0;font-size:1.1rem;line-height:1.6;vertical-align:baseline;position:relative;max-width:40%}figure.fullwidth figcaption{margin-right:24%}a:link,a:visited{color:inherit}.no-tufte-underline:link{background:unset;text-shadow:unset}.hover-tufte-underline:hover,.tufte-underline,a:link{text-decoration:none;background:-webkit-linear-gradient(#fffff8,#fffff8),-webkit-linear-gradient(#fffff8,#fffff8),-webkit-linear-gradient(currentColor,currentColor);background:linear-gradient(#fffff8,#fffff8),linear-gradient(#fffff8,#fffff8),linear-gradient(currentColor,currentColor);-webkit-background-size:.05em 1px,.05em 1px,1px 1px;-moz-background-size:.05em 1px,.05em 1px,1px 1px;background-size:.05em 1px,.05em 1px,1px 1px;background-repeat:no-repeat,no-repeat,repeat-x;text-shadow:.03em 0 #fffff8,-.03em 0 #fffff8,0 .03em #fffff8,0 -.03em #fffff8,.06em 0 #fffff8,-.06em 0 #fffff8,.09em 0 #fffff8,-.09em 0 #fffff8,.12em 0 #fffff8,-.12em 0 #fffff8,.15em 0 #fffff8,-.15em 0 #fffff8;background-position:0 93%,100% 93%,0 93%}@media screen and (-webkit-min-device-pixel-ratio:0){.hover-tufte-underline:hover,.tufte-underline,a:link{background-position-y:87%,87%,87%}}@media (prefers-color-scheme:dark){.hover-tufte-underline:hover,.tufte-underline,a:link{text-shadow:.03em 0 #151515,-.03em 0 #151515,0 .03em #151515,0 -.03em #151515,.06em 0 #151515,-.06em 0 #151515,.09em 0 #151515,-.09em 0 #151515,.12em 0 #151515,-.12em 0 #151515,.15em 0 #151515,-.15em 0 #151515}}a:link::-moz-selection,a:link::selection{text-shadow:.03em 0 #b4d5fe,-.03em 0 #b4d5fe,0 .03em #b4d5fe,0 -.03em #b4d5fe,.06em 0 #b4d5fe,-.06em 0 #b4d5fe,.09em 0 #b4d5fe,-.09em 0 #b4d5fe,.12em 0 #b4d5fe,-.12em 0 #b4d5fe,.15em 0 #b4d5fe,-.15em 0 #b4d5fe;background:#b4d5fe}img{max-width:100%}.marginnote,.sidenote{float:right;clear:right;margin-right:-60%;width:50%;margin-top:.3rem;margin-bottom:0;font-size:1.1rem;line-height:1.3;vertical-align:baseline;position:relative}.sidenote-number{counter-increment:sidenote-counter}.sidenote-number:after,.sidenote:before{font-family:et-book-roman-old-style;position:relative;vertical-align:baseline}.sidenote-number:after{content:counter(sidenote-counter);font-size:1rem;top:-.5rem;left:.1rem}.sidenote:before{content:counter(sidenote-counter) " ";font-size:1rem;top:-.5rem}blockquote .marginnote,blockquote .sidenote{margin-right:-82%;min-width:59%;text-align:left}div.fullwidth,table.fullwidth{width:100%}div.table-wrapper{overflow-x:auto;font-family:"Trebuchet MS","Gill Sans","Gill Sans MT",sans-serif}.sans{font-family:"Gill Sans","Gill Sans MT",Calibri,sans-serif;letter-spacing:.03em}code,pre>code{font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace;font-size:1rem;line-height:1.42;-webkit-text-size-adjust:100%}.sans>code{font-size:1.2rem}h1>code,h2>code,h3>code{font-size:.8em}.marginnote>code,.sidenote>code{font-size:1rem}pre>code{font-size:.9rem;width:52.5%;margin-left:2.5%;overflow-x:auto;display:block}pre.fullwidth>code{width:90%}.fullwidth{max-width:90%;clear:both}span.newthought{font-variant:small-caps;font-size:1.2em}input.margin-toggle{display:none}label.sidenote-number{display:inline-block;max-height:2rem}label.margin-toggle:not(.sidenote-number){display:none}.iframe-wrapper{position:relative;padding-bottom:56.25%;padding-top:25px;height:0}.iframe-wrapper iframe{position:absolute;top:0;left:0;width:100%;height:100%}@media (max-width:760px){body{width:84%;padding-left:8%;padding-right:8%}hr,section>footer,section>p,section>table{width:100%}pre>code{width:97%}section>dl,section>ol,section>ul{width:90%}figure{max-width:90%}figcaption,figure.fullwidth figcaption{margin-right:0;max-width:none}blockquote{margin-left:1.5em;margin-right:0}blockquote footer,blockquote p{width:100%}label.margin-toggle:not(.sidenote-number){display:inline}.marginnote,.sidenote{display:none}.margin-toggle:checked+.marginnote,.margin-toggle:checked+.sidenote{display:block;float:left;left:1rem;clear:both;width:95%;margin:1rem 2.5%;vertical-align:baseline;position:relative}label{cursor:pointer}div.table-wrapper,table{width:85%}img{width:100%}} pysequoia_0.1.25.orig/scripts/check 0000755 0000000 0000000 00000000405 14417207164 014264 0 ustar 00 #!/usr/bin/env bash
set -euxo pipefail
# Move faster checks near the top of this script. For example
# codespell is very fast. cargo fmt does not need to download crates etc.
codespell
cargo fmt -- --check
cargo clippy --all -- -D warnings
cargo test --all
pysequoia_0.1.25.orig/scripts/fix 0000755 0000000 0000000 00000000440 14417207164 013774 0 ustar 00 #!/usr/bin/env bash
set -euxo pipefail
if ! git diff-files --quiet ; then
echo "Working tree has changes. Please stage them: git add ."
exit 1
fi
codespell --write-changes
cargo clippy --fix --allow-staged
# fmt must be last as clippy's changes may break formatting
cargo fmt
pysequoia_0.1.25.orig/src/cert.rs 0000644 0000000 0000000 00000017142 14723545120 013667 0 ustar 00 use std::borrow::Cow;
use std::sync::{Arc, Mutex, MutexGuard};
use once_cell::sync::Lazy;
use openpgp::cert::prelude::*;
use openpgp::packet::signature::subpacket::NotationDataFlags;
use openpgp::packet::signature::SignatureBuilder;
use openpgp::packet::{signature, UserID};
use openpgp::parse::Parse;
use openpgp::policy::{Policy, StandardPolicy};
use openpgp::serialize::SerializeInto;
use openpgp::types::SignatureType;
use openpgp::Packet;
use pyo3::prelude::*;
use sequoia_openpgp as openpgp;
use crate::notation::Notation;
use crate::signer::PySigner;
use crate::user_id::UserId;
static DEFAULT_POLICY: Lazy>>> =
Lazy::new(|| Arc::new(Mutex::new(Box::new(StandardPolicy::new()))));
#[derive(Clone)]
#[pyclass]
pub struct Cert {
cert: openpgp::cert::Cert,
policy: Arc>>,
}
impl From for Cert {
fn from(cert: openpgp::cert::Cert) -> Self {
Self {
cert,
policy: Arc::clone(&DEFAULT_POLICY),
}
}
}
impl Cert {
pub fn cert(&self) -> &openpgp::cert::Cert {
&self.cert
}
pub fn policy(&self) -> MutexGuard> {
self.policy.lock().unwrap()
}
}
pub mod secret;
#[pymethods]
impl Cert {
#[staticmethod]
pub fn from_file(path: String) -> PyResult {
Ok(openpgp::cert::Cert::from_file(path)?.into())
}
#[staticmethod]
pub fn from_bytes(bytes: &[u8]) -> PyResult {
Ok(openpgp::cert::Cert::from_bytes(bytes)?.into())
}
#[staticmethod]
pub fn split_file(path: String) -> PyResult> {
let parser = CertParser::from_file(path)?;
let mut results = vec![];
for item in parser {
results.push(item?.into());
}
Ok(results)
}
#[staticmethod]
pub fn split_bytes(bytes: &[u8]) -> PyResult> {
let parser = CertParser::from_bytes(&bytes)?;
let mut results = vec![];
for item in parser {
results.push(item?.into());
}
Ok(results)
}
#[staticmethod]
#[pyo3(signature = (user_id=None, user_ids=None))]
pub fn generate(user_id: Option<&str>, user_ids: Option>) -> PyResult {
use openpgp::types::KeyFlags;
let mut builder = CertBuilder::new()
.set_cipher_suite(CipherSuite::default())
.set_primary_key_flags(KeyFlags::empty().set_certification())
.set_validity_period(std::time::Duration::new(3 * 52 * 7 * 24 * 60 * 60, 0))
.add_signing_subkey()
.add_subkey(
KeyFlags::empty()
.set_transport_encryption()
.set_storage_encryption(),
None,
None,
);
if let Some(u) = user_id {
builder = builder.add_userid(u);
}
if let Some(user_ids) = user_ids {
for user_id in user_ids {
builder = builder.add_userid(user_id);
}
}
Ok(builder.generate()?.0.into())
}
#[getter]
pub fn has_secret_keys(&self) -> bool {
self.cert.is_tsk()
}
#[getter]
pub fn secrets(&self) -> Option {
if self.cert.is_tsk() {
Some(secret::SecretCert::new(self.cert.clone(), &self.policy))
} else {
None
}
}
pub fn merge(&self, new_cert: &Cert) -> PyResult {
let merged_cert = self.cert().clone().merge_public(new_cert.cert().clone())?;
Ok(merged_cert.into())
}
pub fn add_user_id(&mut self, value: String, mut certifier: PySigner) -> PyResult {
let cert = self.cert.clone();
let userid = UserID::from(value);
let builder = signature::SignatureBuilder::new(SignatureType::PositiveCertification);
let binding = userid.bind(&mut certifier, &cert, builder)?;
let cert = cert.insert_packets(vec![Packet::from(userid), binding.into()])?;
Ok(Cert {
cert,
policy: Arc::clone(&self.policy),
})
}
pub fn revoke_user_id(
&mut self,
user_id: &UserId,
mut certifier: PySigner,
) -> PyResult {
let userid = UserID::from(user_id.__str__());
let builder = signature::SignatureBuilder::new(SignatureType::CertificationRevocation);
Ok(userid.bind(&mut certifier, &self.cert, builder)?.into())
}
pub fn set_expiration(
&mut self,
expiration: chrono::DateTime,
mut certifier: PySigner,
) -> PyResult {
let cert = self.cert.clone();
let signature = cert.set_expiration_time(
&**self.policy(),
None,
&mut certifier,
Some(expiration.into()),
)?;
let cert = cert.insert_packets(signature)?;
Ok(Cert {
cert,
policy: Arc::clone(&self.policy),
})
}
#[getter]
pub fn expiration(&self) -> PyResult>> {
Ok(self
.cert
.primary_key()
.with_policy(&**self.policy(), None)?
.key_expiration_time()
.map(|exp| exp.into()))
}
pub fn __str__(&self) -> PyResult {
let armored = self.cert.armored();
Ok(String::from_utf8(armored.to_vec()?)?)
}
pub fn __repr__(&self) -> String {
format!("", self.cert.fingerprint())
}
#[getter]
pub fn fingerprint(&self) -> PyResult {
Ok(format!("{:x}", self.cert.fingerprint()))
}
#[getter]
pub fn user_ids(&self) -> PyResult> {
let policy = &**self.policy();
let cert = self.cert.with_policy(policy, None)?;
cert.userids()
.revoked(false)
.map(|ui| UserId::new(ui, policy))
.collect()
}
pub fn set_notations(
&self,
mut certifier: PySigner,
notations: Vec,
) -> PyResult {
let policy = self.policy();
let cert = self.cert.with_policy(&**policy, None)?;
let ua = cert.userids().next().unwrap();
let mut builder = SignatureBuilder::from(ua.binding_signature().clone());
let cert = if !notations.is_empty() {
builder = builder.set_notation(
notations[0].key(),
notations[0].value(),
NotationDataFlags::empty().set_human_readable(),
false,
)?;
for notation in ¬ations[1..] {
builder = builder.add_notation(
notation.key(),
notation.value(),
NotationDataFlags::empty().set_human_readable(),
false,
)?;
}
let new_sig = builder.sign_userid_binding(&mut certifier, None, ua.userid())?;
self.cert.clone().insert_packets(vec![new_sig])?
} else {
self.cert.clone()
};
Ok(cert.into())
}
pub fn bytes(&self) -> PyResult> {
Ok(self.cert.to_vec()?.into())
}
pub fn revoke(&self, mut certifier: PySigner) -> PyResult {
let signature = self.cert.revoke(
&mut certifier,
openpgp::types::ReasonForRevocation::Unspecified,
&[],
)?;
Ok(crate::signature::Sig::new(signature))
}
#[getter]
pub fn is_revoked(&self) -> bool {
use openpgp::types::RevocationStatus;
self.cert.revocation_status(&**self.policy(), None) != RevocationStatus::NotAsFarAsWeKnow
}
}
pysequoia_0.1.25.orig/src/cert/ 0000755 0000000 0000000 00000000000 14437325127 013321 5 ustar 00 pysequoia_0.1.25.orig/src/decrypt.rs 0000644 0000000 0000000 00000005555 14723545120 014411 0 ustar 00 use std::sync::{Arc, Mutex};
use openpgp::crypto::SessionKey;
use openpgp::parse::{stream::*, Parse};
use openpgp::policy::StandardPolicy as P;
use openpgp::types::SymmetricAlgorithm;
use pyo3::prelude::*;
use sequoia_openpgp as openpgp;
use crate::verify::PyVerifier;
use crate::{Decrypted, ValidSig};
#[pyclass]
#[derive(Clone)]
pub struct PyDecryptor {
inner: Arc>>,
verifier: Option,
}
impl PyDecryptor {
pub fn new(inner: Box) -> Self {
Self {
inner: Arc::new(Mutex::new(inner)),
verifier: None,
}
}
pub fn set_verifier(&mut self, verifier: impl Into>) {
self.verifier = verifier.into();
}
pub fn valid_sigs(self) -> Vec {
if let Some(verifier) = self.verifier {
verifier.valid_sigs()
} else {
vec![]
}
}
}
#[pyfunction]
#[pyo3(signature = (decryptor, bytes, store=None))]
pub fn decrypt(
mut decryptor: PyDecryptor,
bytes: &[u8],
store: Option>,
) -> PyResult {
if let Some(store) = store {
decryptor.set_verifier(PyVerifier::from_callback(store));
}
let policy = &P::new();
let mut decryptor =
DecryptorBuilder::from_bytes(bytes)?.with_policy(policy, None, decryptor)?;
let mut sink = Vec::new();
std::io::copy(&mut decryptor, &mut sink)?;
let decryptor = decryptor.into_helper();
Ok(Decrypted {
content: sink,
valid_sigs: decryptor.valid_sigs(),
})
}
impl VerificationHelper for PyDecryptor {
fn get_certs(&mut self, ids: &[openpgp::KeyHandle]) -> openpgp::Result> {
if let Some(verifier) = &mut self.verifier {
verifier.get_certs(ids)
} else {
Ok(vec![])
}
}
fn check(&mut self, structure: MessageStructure) -> openpgp::Result<()> {
if let Some(verifier) = &mut self.verifier {
verifier.check(structure)
} else {
Ok(())
}
}
}
impl DecryptionHelper for PyDecryptor {
fn decrypt(
&mut self,
pkesks: &[openpgp::packet::PKESK],
_skesks: &[openpgp::packet::SKESK],
sym_algo: Option,
mut decrypt: D,
) -> openpgp::Result>
where
D: FnMut(SymmetricAlgorithm, &SessionKey) -> bool,
{
let pair = &mut *self.inner.lock().unwrap();
for pkesk in pkesks.iter() {
if pkesk
.decrypt(pair, sym_algo)
.map(|(algo, session_key)| decrypt(algo, &session_key))
.is_some()
{
return Ok(None);
}
}
Err(anyhow::anyhow!("No key to decrypt message"))
}
}
pysequoia_0.1.25.orig/src/encrypt.rs 0000644 0000000 0000000 00000004411 14723545120 014411 0 ustar 00 use std::borrow::Cow;
use std::io::Write;
use anyhow::Context;
use openpgp::serialize::stream::{Armorer, Signer};
use openpgp::serialize::stream::{Encryptor2 as Encryptor, LiteralWriter, Message};
use openpgp::types::KeyFlags;
use pyo3::prelude::*;
use sequoia_openpgp as openpgp;
use crate::cert::Cert;
use crate::signer::PySigner;
#[pyfunction]
#[pyo3(signature = (recipients, bytes, signer=None))]
pub fn encrypt(
recipients: Vec>,
bytes: &[u8],
signer: Option,
) -> PyResult> {
let mode = KeyFlags::empty()
.set_storage_encryption()
.set_transport_encryption();
let mut recipient_keys = vec![];
for cert in recipients.iter() {
let mut found_one = false;
let policy = cert.policy();
for key in cert
.cert()
.keys()
.with_policy(&**policy, None)
.supported()
.alive()
.revoked(false)
.key_flags(&mode)
{
recipient_keys.push(key.key().clone());
found_one = true;
}
if !found_one {
for key in cert
.cert()
.keys()
.with_policy(&**policy, None)
.supported()
.revoked(false)
.key_flags(&mode)
{
recipient_keys.push(key.key().clone());
found_one = true;
}
}
if !found_one {
return Err(
anyhow::anyhow!("No suitable encryption subkey for {}", cert.cert()).into(),
);
}
}
let mut sink = vec![];
let message = Message::new(&mut sink);
let message = Armorer::new(message).build()?;
let mut message = Encryptor::for_recipients(
message,
recipient_keys
.iter()
.map(openpgp::serialize::stream::Recipient::from),
)
.build()
.context("Failed to create encryptor")?;
if let Some(signer) = signer {
message = Signer::new(message, signer).build()?;
}
let mut message = LiteralWriter::new(message)
.build()
.context("Failed to create literal writer")?;
message.write_all(bytes.as_ref())?;
message.finalize()?;
Ok(sink.into())
}
pysequoia_0.1.25.orig/src/lib.rs 0000644 0000000 0000000 00000005244 14723545120 013500 0 ustar 00 use std::borrow::Cow;
use openpgp::parse::stream::GoodChecksum;
use openpgp::serialize::stream::Armorer;
use pyo3::prelude::*;
mod cert;
mod decrypt;
mod encrypt;
mod notation;
mod sign;
mod signature;
mod signer;
mod user_id;
mod verify;
use openpgp::armor::Kind;
use openpgp::packet::Packet;
use openpgp::serialize::{stream::Message, Marshal};
use sequoia_openpgp as openpgp;
pub(crate) fn serialize(p: Packet, armor_kind: T) -> openpgp::Result>
where
T: Into>,
{
let mut sink = vec![];
let mut message = Message::new(&mut sink);
if let Some(kind) = armor_kind.into() {
message = Armorer::new(message).kind(kind).build()?
}
p.serialize(&mut message)?;
message.finalize()?;
Ok(sink)
}
#[pyclass]
#[derive(Debug, Clone)]
pub struct ValidSig {
certificate: String,
signing_key: String,
}
impl From> for ValidSig {
fn from(value: GoodChecksum<'_>) -> Self {
Self {
certificate: format!("{:x}", value.ka.cert().fingerprint()),
signing_key: format!("{:x}", value.ka.fingerprint()),
}
}
}
#[pymethods]
impl ValidSig {
#[getter]
fn certificate(&self) -> &str {
&self.certificate
}
#[getter]
fn signing_key(&self) -> &str {
&self.signing_key
}
pub fn __repr__(&self) -> String {
format!(
"",
self.certificate(),
self.signing_key()
)
}
}
#[pyclass]
#[derive(Clone)]
pub struct Decrypted {
valid_sigs: Vec,
content: Vec,
}
#[pymethods]
impl Decrypted {
#[getter]
pub fn bytes(&self) -> Cow<[u8]> {
Cow::Borrowed(&self.content)
}
#[getter]
pub fn valid_sigs(&self) -> Vec {
self.valid_sigs.clone()
}
}
#[pymodule]
fn pysequoia(_py: Python, m: &Bound<'_, PyModule>) -> PyResult<()> {
m.add_class::()?;
m.add_class::()?;
m.add_class::()?;
m.add_function(wrap_pyfunction!(sign::sign, m)?)?;
m.add_function(wrap_pyfunction!(encrypt::encrypt, m)?)?;
m.add_function(wrap_pyfunction!(decrypt::decrypt, m)?)?;
m.add_function(wrap_pyfunction!(verify::verify, m)?)?;
Ok(())
}
#[cfg(test)]
mod tests {
use openpgp::cert::prelude::*;
use sequoia_openpgp as openpgp;
use sequoia_openpgp::serialize::SerializeInto;
use testresult::TestResult;
#[test]
fn test_armoring() -> TestResult {
let cert = CertBuilder::general_purpose(None, Some("test@example.com"))
.generate()?
.0;
assert!(cert.armored().to_vec().is_ok());
Ok(())
}
}
pysequoia_0.1.25.orig/src/notation.rs 0000644 0000000 0000000 00000001621 14376103147 014563 0 ustar 00 use openpgp::packet::signature::subpacket::NotationData;
use pyo3::prelude::*;
use sequoia_openpgp as openpgp;
#[pyclass]
#[derive(Clone)]
pub struct Notation {
key: String,
value: String,
}
impl From<&NotationData> for Notation {
fn from(notation: &NotationData) -> Self {
Self {
key: notation.name().into(),
value: String::from_utf8_lossy(notation.value()).into(),
}
}
}
#[pymethods]
impl Notation {
#[new]
pub fn new(key: String, value: String) -> Self {
Self { key, value }
}
#[getter]
pub fn key(&self) -> &String {
&self.key
}
#[getter]
pub fn value(&self) -> &String {
&self.value
}
fn __str__(&self) -> String {
format!("{}={}", self.key, self.value)
}
fn __repr__(&self) -> String {
format!("", self.key, self.value)
}
}
pysequoia_0.1.25.orig/src/sign.rs 0000644 0000000 0000000 00000001314 14532077751 013674 0 ustar 00 use std::borrow::Cow;
use std::io::Write;
use openpgp::serialize::stream::Armorer;
use openpgp::serialize::stream::{LiteralWriter, Message};
use pyo3::prelude::*;
use sequoia_openpgp as openpgp;
use crate::signer::PySigner;
#[pyfunction]
pub fn sign(signer: PySigner, bytes: &[u8]) -> PyResult> {
use openpgp::serialize::stream::Signer;
let mut sink = vec![];
{
let message = Message::new(&mut sink);
let message = Armorer::new(message).build()?;
let message = Signer::new(message, signer).build()?;
let mut message = LiteralWriter::new(message).build()?;
message.write_all(bytes)?;
message.finalize()?;
}
Ok(sink.into())
}
pysequoia_0.1.25.orig/src/signature.rs 0000644 0000000 0000000 00000004055 14611656042 014734 0 ustar 00 use std::borrow::Cow;
use anyhow::anyhow;
use openpgp::{
packet::Signature as SqSignature,
parse::{PacketParser, PacketParserResult, Parse as _},
Packet,
};
use pyo3::prelude::*;
use sequoia_openpgp as openpgp;
#[pyclass]
pub struct Sig {
sig: SqSignature,
}
impl Sig {
pub fn new(sig: SqSignature) -> Self {
Self { sig }
}
pub fn from_packets(ppr: PacketParserResult<'_>) -> Result {
if let PacketParserResult::Some(pp) = ppr {
let (packet, _next_ppr) = pp.recurse()?;
if let Packet::Signature(sig) = packet {
return Ok(sig.into());
}
}
Err(anyhow!("Not a signature"))
}
}
impl From for Sig {
fn from(sig: SqSignature) -> Self {
Self { sig }
}
}
#[pymethods]
impl Sig {
#[staticmethod]
pub fn from_file(path: String) -> PyResult {
Ok(Self::from_packets(PacketParser::from_file(path)?)?)
}
#[staticmethod]
pub fn from_bytes(bytes: &[u8]) -> PyResult {
Ok(Self::from_packets(PacketParser::from_bytes(bytes)?)?)
}
pub fn bytes(&self) -> PyResult> {
Ok(crate::serialize(self.sig.clone().into(), None)?.into())
}
#[getter]
pub fn issuer_fpr(&self) -> Option {
self.sig
.issuer_fingerprints()
.next()
.map(|issuer| format!("{:x}", issuer))
}
#[getter]
pub fn created(&self) -> Option> {
self.sig.signature_creation_time().map(Into::into)
}
pub fn __str__(&self) -> PyResult {
let bytes = crate::serialize(self.sig.clone().into(), openpgp::armor::Kind::Signature)?;
Ok(String::from_utf8(bytes)?)
}
pub fn __repr__(&self) -> String {
format!("", self.issuer_fpr().unwrap_or_default())
}
}
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn test_reading_sig() {
Sig::from_packets(PacketParser::from_file("sig.pgp").unwrap()).unwrap();
}
}
pysequoia_0.1.25.orig/src/signer.rs 0000644 0000000 0000000 00000002053 14375352625 014225 0 ustar 00 use std::sync::{Arc, Mutex};
use pyo3::prelude::*;
use sequoia_openpgp as openpgp;
#[pyclass]
#[derive(Clone)]
pub struct PySigner {
inner: Arc>>,
public: openpgp::packet::Key<
openpgp::packet::key::PublicParts,
openpgp::packet::key::UnspecifiedRole,
>,
}
impl PySigner {
pub fn new(inner: Box) -> Self {
let public = inner.public().clone();
Self {
inner: Arc::new(Mutex::new(inner)),
public,
}
}
}
impl openpgp::crypto::Signer for PySigner {
fn public(
&self,
) -> &openpgp::packet::Key<
openpgp::packet::key::PublicParts,
openpgp::packet::key::UnspecifiedRole,
> {
&self.public
}
fn sign(
&mut self,
hash_algo: openpgp::types::HashAlgorithm,
digest: &[u8],
) -> openpgp::Result {
self.inner.lock().unwrap().sign(hash_algo, digest)
}
}
pysequoia_0.1.25.orig/src/user_id.rs 0000644 0000000 0000000 00000002204 14406313522 014352 0 ustar 00 use openpgp::policy::Policy;
use openpgp::{cert::prelude::ValidComponentAmalgamation, packet::UserID};
use pyo3::prelude::*;
use sequoia_openpgp as openpgp;
use crate::notation::Notation;
#[pyclass]
pub struct UserId {
value: String,
notations: Vec,
}
impl UserId {
pub fn new(user: ValidComponentAmalgamation, policy: &dyn Policy) -> PyResult {
// The component is Valid and as such needs to have at least
// one self signature. The first one will be the most recent.
let signature = user.binding_signature(policy, None)?;
Ok(Self {
value: String::from_utf8_lossy(user.value()).into(),
notations: signature
.notation_data()
.filter(|n| n.flags().human_readable())
.map(Notation::from)
.collect(),
})
}
}
#[pymethods]
impl UserId {
pub fn __str__(&self) -> &str {
&self.value
}
fn __repr__(&self) -> String {
format!("", self.value)
}
#[getter]
fn notations(&self) -> Vec {
self.notations.clone()
}
}
pysequoia_0.1.25.orig/src/verify.rs 0000644 0000000 0000000 00000004635 14577030143 014242 0 ustar 00 use openpgp::parse::Parse;
use openpgp::{parse::stream::*, policy::StandardPolicy};
use pyo3::prelude::*;
use sequoia_openpgp as openpgp;
use crate::{Decrypted, ValidSig};
#[pyfunction]
pub fn verify(bytes: &[u8], store: Py) -> PyResult {
let helper = PyVerifier::from_callback(store);
let policy = &StandardPolicy::new();
let mut verifier = VerifierBuilder::from_bytes(&bytes)?.with_policy(policy, None, helper)?;
let mut sink = vec![];
std::io::copy(&mut verifier, &mut sink)?;
let helper = verifier.into_helper();
Ok(Decrypted {
content: sink,
valid_sigs: helper.valid_sigs,
})
}
#[derive(Debug, Clone)]
pub struct PyVerifier {
store: Py,
valid_sigs: Vec,
}
impl PyVerifier {
pub fn from_callback(store: Py) -> Self {
Self {
store,
valid_sigs: vec![],
}
}
pub fn valid_sigs(self) -> Vec {
self.valid_sigs
}
}
impl VerificationHelper for PyVerifier {
fn get_certs(&mut self, ids: &[openpgp::KeyHandle]) -> openpgp::Result> {
let mut certs = vec![];
let result: Vec = Python::with_gil(|py| {
let str_ids = ids
.iter()
.map(|key_id| format!("{:x}", key_id))
.collect::>();
self.store.call1(py, (str_ids,))?.extract(py)
})?;
for cert in result.into_iter() {
certs.push(cert.cert().clone());
}
Ok(certs)
}
fn check(&mut self, structure: MessageStructure) -> openpgp::Result<()> {
let mut valid_sigs = vec![];
for (i, layer) in structure.into_iter().enumerate() {
match layer {
MessageLayer::Encryption { .. } if i == 0 => (),
MessageLayer::Compression { .. } if i == 1 => (),
MessageLayer::SignatureGroup { results } if (0..2).contains(&i) => {
for result in results.into_iter().flatten() {
valid_sigs.push(result.into());
}
}
_ => return Err(anyhow::anyhow!("Unexpected message structure")),
}
}
self.valid_sigs = valid_sigs;
if !self.valid_sigs.is_empty() {
Ok(())
} else {
Err(anyhow::anyhow!("Signature verification failed"))
}
}
}
pysequoia_0.1.25.orig/src/cert/secret.rs 0000644 0000000 0000000 00000006136 14723545120 015155 0 ustar 00 use std::sync::{Arc, Mutex, MutexGuard};
use openpgp::policy::Policy;
use openpgp::serialize::SerializeInto;
use pyo3::prelude::*;
use sequoia_openpgp as openpgp;
use crate::decrypt;
use crate::signer::PySigner;
#[pyclass]
pub struct SecretCert {
cert: openpgp::cert::Cert,
policy: Arc>>,
}
impl SecretCert {
pub fn new(cert: openpgp::cert::Cert, policy: &Arc>>) -> Self {
Self {
cert,
policy: Arc::clone(policy),
}
}
pub fn policy(&self) -> MutexGuard> {
self.policy.lock().unwrap()
}
}
#[pymethods]
impl SecretCert {
pub fn __str__(&self) -> PyResult {
let armored = self.cert.as_tsk().armored();
Ok(String::from_utf8(armored.to_vec()?)?)
}
#[pyo3(signature = (password=None))]
pub fn signer(&self, password: Option) -> PyResult {
if let Some(key) = self
.cert
.keys()
.secret()
.with_policy(&**self.policy(), None)
.alive()
.revoked(false)
.for_signing()
.next()
{
let mut key = key.key().clone();
if let Some(password) = password {
key = key.decrypt_secret(&(password[..]).into())?;
}
let keypair = key.into_keypair()?;
Ok(PySigner::new(Box::new(keypair)))
} else {
Err(anyhow::anyhow!("No suitable signing subkey for {}", self.cert).into())
}
}
#[pyo3(signature = (password=None))]
pub fn certifier(&self, password: Option) -> PyResult {
if let Some(key) = self
.cert
.keys()
.secret()
.with_policy(&**self.policy(), None)
.alive()
.revoked(false)
.for_certification()
.next()
{
let mut key = key.key().clone();
if let Some(password) = password {
key = key.decrypt_secret(&(password[..]).into())?;
}
let keypair = key.into_keypair()?;
Ok(PySigner::new(Box::new(keypair)))
} else {
Err(anyhow::anyhow!("No suitable certifying key for {}", self.cert).into())
}
}
#[pyo3(signature = (password=None))]
pub fn decryptor(&self, password: Option) -> PyResult {
if let Some(key) = self
.cert
.keys()
.secret()
.with_policy(&**self.policy(), None)
.alive()
.revoked(false)
.for_transport_encryption()
.for_storage_encryption()
.next()
{
let mut key = key.key().clone();
if let Some(password) = password {
key = key.decrypt_secret(&(password[..]).into())?;
}
let keypair = key.into_keypair()?;
Ok(decrypt::PyDecryptor::new(Box::new(keypair)))
} else {
Err(anyhow::anyhow!("No suitable decryption subkey for {}", self.cert).into())
}
}
}
# PySequoia
[](https://pypi.org/project/pysequoia/)
[](
https://pypi.org/project/pysequoia/)
[](https://github.com/wiktor-k/pysequoia/actions/workflows/ci.yml)
This library provides [OpenPGP][] facilities in Python through the
[Sequoia PGP][SQ] library. If you need to work with encryption and
digital signatures using an [IETF standardized protocol][4880], this
package is for you!
[OpenPGP]: https://en.wikipedia.org/wiki/Pretty_Good_Privacy#OpenPGP
[SQ]: https://sequoia-pgp.org/
[4880]: https://www.rfc-editor.org/rfc/rfc4880
Note: This is a work in progress. The API is **not** stable!
## Building
```bash
set -euxo pipefail
python -m venv .env
source .env/bin/activate
pip install maturin
maturin develop
```
## Installing
PySequoia can be installed through `pip`:
```sh
pip install pysequoia
```
Note that since `pysequoia` is implemented largely in Rust, a [Rust
toolchain][RUSTUP] is necessary for the installation to succeed.
[RUSTUP]: https://rustup.rs/
## Testing
This entire document is used for end-to-end integration tests that
exercise the package's API surface.
The tests assume that these keys exist:
```bash
# generate a key with password
gpg --batch --pinentry-mode loopback --passphrase hunter22 --quick-gen-key passwd@example.com
gpg --batch --pinentry-mode loopback --passphrase hunter22 --export-secret-key passwd@example.com > passwd.pgp
# generate a key without password
gpg --batch --pinentry-mode loopback --passphrase '' --quick-gen-key no-passwd@example.com future-default
gpg --batch --pinentry-mode loopback --passphrase '' --export-secret-key no-passwd@example.com > no-passwd.pgp
```
## Functions
All examples assume that these basic classes have been imported:
```python
from pysequoia import Cert
```
### sign
Signs data and returns armored output:
```python
from pysequoia import sign
s = Cert.from_file("signing-key.asc")
signed = sign(s.secrets.signer(), "data to be signed".encode("utf8"))
print(f"Signed data: {signed}")
assert "PGP MESSAGE" in str(signed)
```
### verify
Verifies signed data and returns verified data:
```python
from pysequoia import verify
# sign some data
signing_key = Cert.from_file("signing-key.asc")
signed = sign(s.secrets.signer(), "data to be signed".encode("utf8"))
def get_certs(key_ids):
# key_ids is an array of required signing keys
print(f"For verification, we need these keys: {key_ids}")
return [signing_key]
# verify the data
result = verify(signed, get_certs)
assert result.bytes.decode("utf8") == "data to be signed"
# let's check the valid signature's certificate and signing subkey fingerprints
assert result.valid_sigs[0].certificate == "afcf5405e8f49dbcd5dc548a86375b854b86acf9"
assert result.valid_sigs[0].signing_key == "afcf5405e8f49dbcd5dc548a86375b854b86acf9"
```
The function that returns certificates (here `get_certs`) may return more certificates than necessary.
`verify` succeeds if *at least one* correct signature has been made by any of the certificates supplied. If you need more advanced policies they can be implemented by inspecting the `valid_sigs` property.
### encrypt
Signs and encrypts a string to one or more recipients:
```python
from pysequoia import encrypt
s = Cert.from_file("passwd.pgp")
r = Cert.from_bytes(open("wiktor.asc", "rb").read())
bytes = "content to encrypt".encode("utf8")
encrypted = encrypt(signer = s.secrets.signer("hunter22"), recipients = [r], bytes = bytes).decode("utf8")
print(f"Encrypted data: {encrypted}")
```
The `signer` argument is optional and when omitted the function will return an unsigned (but encrypted) message.
### decrypt
Decrypts plain data:
```python
from pysequoia import decrypt
sender = Cert.from_file("no-passwd.pgp")
receiver = Cert.from_file("passwd.pgp")
content = "Red Green Blue"
encrypted = encrypt(recipients = [receiver], bytes = content.encode("utf8"))
decrypted = decrypt(decryptor = receiver.secrets.decryptor("hunter22"), bytes = encrypted)
assert content == decrypted.bytes.decode("utf8");
# this message did not contain any valid signatures
assert len(decrypted.valid_sigs) == 0
```
Decrypt can also verify signatures while decrypting:
```python
from pysequoia import decrypt
sender = Cert.from_file("no-passwd.pgp")
receiver = Cert.from_file("passwd.pgp")
content = "Red Green Blue"
encrypted = encrypt(signer = sender.secrets.signer(), recipients = [receiver], bytes = content.encode("utf8"))
def get_certs(key_ids):
print(f"For verification after decryption, we need these keys: {key_ids}")
return [sender]
decrypted = decrypt(decryptor = receiver.secrets.decryptor("hunter22"), bytes = encrypted, store = get_certs)
assert content == decrypted.bytes.decode("utf8");
# let's check the valid signature's certificate and signing subkey fingerprints
assert decrypted.valid_sigs[0].certificate == sender.fingerprint
assert decrypted.valid_sigs[0].signing_key == sender.fingerprint
```
Here, the same remarks as to [`verify`](#verify) also apply.
## Certificates
The `Cert` class represents one OpenPGP certificate (commonly called a
"public key").
This package additionally verifies the certificate using Sequoia PGP's
[`StandardPolicy`][SP]. This means that certificates using weak
cryptography can fail to load, or present a different view than in
other OpenPGP software (e.g. if a User ID uses SHA-1 in its
back-signature, it may be missing from the list of User IDs returned
by this package).
[SP]: https://docs.rs/sequoia-openpgp/latest/sequoia_openpgp/policy/struct.StandardPolicy.html
Certificates have two forms, one is ASCII armored and one is raw bytes:
```python
cert = Cert.generate("Test