Uranium
Application Framework
Loading...
Searching...
No Matches
UM.Trust.Trust Class Reference

Public Member Functions

 getInstance (cls)
 
 getInstanceOrNone (cls)
 
None __init__ (self, str public_key_filename, Callable[[str], None] pre_err_handler=None)
 
bool signedFolderPreStorageCheck (self, str path)
 
bool signedFolderCheck (self, str path)
 
bool signedFileCheck (self, str filename)
 
None setFollowSymlinks (self, bool follow_symlinks)
 

Static Public Member Functions

str getPublicRootKeyPath ()
 
bool signatureFileExistsFor (str filename)
 

Protected Member Functions

bool _verifyHash (self, str shash, str signature, Optional[str] err_info=None)
 
bool _verifyFile (self, str filename, str signature)
 
bool _verifyManifestIntegrety (self, Dict[str, str] signatures_json, Dict[str, str] json_data)
 

Protected Attributes

 _public_key = None
 
bool _follow_symlinks = False
 
 _violation_handler = violation_handler
 

Detailed Description

Trust for use in the main-application code, as opposed to the (keygen/signing) scripts.

Can be seen as an elaborate wrapper around a public-key.
Currently used as a singleton, as we currently have only one single 'master' public key for the entire app.
See the 'createkeypair.py', 'signfile.py' and 'signfolder.py' scripts in the 'scripts' folder.

Constructor & Destructor Documentation

◆ __init__()

None UM.Trust.Trust.__init__ ( self,
str public_key_filename,
Callable[[str], None] pre_err_handler = None )
Initializes a Trust object. A Trust object represents a public key and related utility methods on that key.
If the application only has a single public key, it's best to use 'getInstance' or 'getInstanceOrNone'.

:param public_key_filename: Path to the file that holds the public key.
:param pre_err_handler: An extra error handler which will be called before TrustBasics.defaultViolationHandler
                        Receives a human readable error string as argument.
:raise Exception: if public key file provided by the argument can't be found or parsed.

Member Function Documentation

◆ getInstance()

UM.Trust.Trust.getInstance ( cls)
Get the 'canonical' Trusts object for this application. See also 'getPublicRootKeyPath'.

:raise Exception: if the public key in `getPublicRootKeyPath()` can't be loaded for some reason.
:return: The Trust singleton.

◆ getInstanceOrNone()

UM.Trust.Trust.getInstanceOrNone ( cls)
Get the  'canonical' Trust object or None if not initialized yet

Useful if only _optional_ verification is needed.

:return: Trust singleton or None if problems occurred with loading the public key in `getPublicRootKeyPath()`.

◆ getPublicRootKeyPath()

str UM.Trust.Trust.getPublicRootKeyPath ( )
static
It is assumed that the application will have a 'master' public key.

:return: Path to the 'master' public key of this application.

◆ signatureFileExistsFor()

bool UM.Trust.Trust.signatureFileExistsFor ( str filename)
static
Whether or not a signature file _exist_ (so _not_ necessarily correct)  for the provided (single file) path.

:param filename: The filename that should be checked for.
:return: Returns True if there is a signature file next to the provided single file (as opposed to folder).

◆ signedFileCheck()

bool UM.Trust.Trust.signedFileCheck ( self,
str filename )
In the 'single signed file' case, check whether a file is signed according to the Trust-objects' public key.

:param filename: The path to the file to be checked (not the signature-file).
:return: True if the file is signed (is next to a signature file) and signed correctly.

◆ signedFolderCheck()

bool UM.Trust.Trust.signedFolderCheck ( self,
str path )
In the 'singed folder' case, check whether the folder is signed according to the Trust-objects' public key.

:param path: The path to the folder to be checked (not the signature-file).
:return: True if the folder is signed (contains a signatures-file) and signed correctly.

◆ signedFolderPreStorageCheck()

bool UM.Trust.Trust.signedFolderPreStorageCheck ( self,
str path )
Do a quick check whether the 'central storage file' of a folder has been tampered with. This is necessary,
since the central storage system (which otherwise runs first) copies files, and the copying of files itself
can be an attack. Note that right after copying, a full check can be done, so the files themselves don't have
to be checked yet (since that happens in the full check after copying).

Shared pools of versioned items ('central storage') are used if a folder contains a 'central storage file'.
(See the CentralFileStorage class for details.) The 'canonical' version of a folder as far as the Trust system
is concerned, is the one where the items are already in central storage. Otherwise there would either be a whole
range of 'acceptable answers' (and that's harder to test against) or, there would always be a need to verify
a situation that shouldn't be that frequent (items need to be copied to central storage). This creates a problem
in that the central storage mechanism needs to run _first_, however. The central storage has its own security
measures, but this means that the central storage file in a folder (which contains info on what items should be
copied) hasn't been checked against the trust manifest file in that folder yet.

This only concerns the signature of the central storage file (and the correctness of the manifest file itself).
Per separation of concern, and since the storage system already needs to be aware of security, any other
'sanity checks' on the contents central storage file itself are the job of that system.

:param path: The folder to do a quick pre-move check for.
:return: True if the central-storage file is correctly signed. A folder without such a file is correct as well.

The documentation for this class was generated from the following file: