Uranium
Application Framework
|
Public Member Functions | |
getInstance (cls) | |
getInstanceOrNone (cls) | |
None | __init__ (self, str public_key_filename, Callable[[str], None] pre_err_handler=None) |
bool | signedFolderPreStorageCheck (self, str path) |
bool | signedFolderCheck (self, str path) |
bool | signedFileCheck (self, str filename) |
None | setFollowSymlinks (self, bool follow_symlinks) |
Static Public Member Functions | |
str | getPublicRootKeyPath () |
bool | signatureFileExistsFor (str filename) |
Protected Attributes | |
_public_key | |
_follow_symlinks | |
_violation_handler | |
Trust for use in the main-application code, as opposed to the (keygen/signing) scripts. Can be seen as an elaborate wrapper around a public-key. Currently used as a singleton, as we currently have only one single 'master' public key for the entire app. See the 'createkeypair.py', 'signfile.py' and 'signfolder.py' scripts in the 'scripts' folder.
None UM.Trust.Trust.__init__ | ( | self, | |
str | public_key_filename, | ||
Callable[[str], None] | pre_err_handler = None ) |
Initializes a Trust object. A Trust object represents a public key and related utility methods on that key. If the application only has a single public key, it's best to use 'getInstance' or 'getInstanceOrNone'. :param public_key_filename: Path to the file that holds the public key. :param pre_err_handler: An extra error handler which will be called before TrustBasics.defaultViolationHandler Receives a human readable error string as argument. :raise Exception: if public key file provided by the argument can't be found or parsed.
UM.Trust.Trust.getInstance | ( | cls | ) |
Get the 'canonical' Trusts object for this application. See also 'getPublicRootKeyPath'. :raise Exception: if the public key in `getPublicRootKeyPath()` can't be loaded for some reason. :return: The Trust singleton.
UM.Trust.Trust.getInstanceOrNone | ( | cls | ) |
Get the 'canonical' Trust object or None if not initialized yet Useful if only _optional_ verification is needed. :return: Trust singleton or None if problems occurred with loading the public key in `getPublicRootKeyPath()`.
|
static |
It is assumed that the application will have a 'master' public key. :return: Path to the 'master' public key of this application.
|
static |
Whether or not a signature file _exist_ (so _not_ necessarily correct) for the provided (single file) path. :param filename: The filename that should be checked for. :return: Returns True if there is a signature file next to the provided single file (as opposed to folder).
bool UM.Trust.Trust.signedFileCheck | ( | self, | |
str | filename ) |
In the 'single signed file' case, check whether a file is signed according to the Trust-objects' public key. :param filename: The path to the file to be checked (not the signature-file). :return: True if the file is signed (is next to a signature file) and signed correctly.
bool UM.Trust.Trust.signedFolderCheck | ( | self, | |
str | path ) |
In the 'singed folder' case, check whether the folder is signed according to the Trust-objects' public key. :param path: The path to the folder to be checked (not the signature-file). :return: True if the folder is signed (contains a signatures-file) and signed correctly.
bool UM.Trust.Trust.signedFolderPreStorageCheck | ( | self, | |
str | path ) |
Do a quick check whether the 'central storage file' of a folder has been tampered with. This is necessary, since the central storage system (which otherwise runs first) copies files, and the copying of files itself can be an attack. Note that right after copying, a full check can be done, so the files themselves don't have to be checked yet (since that happens in the full check after copying). Shared pools of versioned items ('central storage') are used if a folder contains a 'central storage file'. (See the CentralFileStorage class for details.) The 'canonical' version of a folder as far as the Trust system is concerned, is the one where the items are already in central storage. Otherwise there would either be a whole range of 'acceptable answers' (and that's harder to test against) or, there would always be a need to verify a situation that shouldn't be that frequent (items need to be copied to central storage). This creates a problem in that the central storage mechanism needs to run _first_, however. The central storage has its own security measures, but this means that the central storage file in a folder (which contains info on what items should be copied) hasn't been checked against the trust manifest file in that folder yet. This only concerns the signature of the central storage file (and the correctness of the manifest file itself). Per separation of concern, and since the storage system already needs to be aware of security, any other 'sanity checks' on the contents central storage file itself are the job of that system. :param path: The folder to do a quick pre-move check for. :return: True if the central-storage file is correctly signed. A folder without such a file is correct as well.