Coverage for /pythoncovmergedfiles/medio/medio/usr/local/lib/python3.11/site-packages/google/auth/crypt/__init__.py: 60%

1# Copyright 2016 Google LLC 

2# 

3# Licensed under the Apache License, Version 2.0 (the "License"); 

4# you may not use this file except in compliance with the License. 

5# You may obtain a copy of the License at 

6# 

7# http://www.apache.org/licenses/LICENSE-2.0 

8# 

9# Unless required by applicable law or agreed to in writing, software 

10# distributed under the License is distributed on an "AS IS" BASIS, 

11# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 

12# See the License for the specific language governing permissions and 

13# limitations under the License. 

14 

15"""Cryptography helpers for verifying and signing messages. 

16 

17The simplest way to verify signatures is using :func:`verify_signature`:: 

18 

19 cert = open('certs.pem').read() 

20 valid = crypt.verify_signature(message, signature, cert) 

21 

22If you're going to verify many messages with the same certificate, you can use 

23:class:`RSAVerifier`:: 

24 

25 cert = open('certs.pem').read() 

26 verifier = crypt.RSAVerifier.from_string(cert) 

27 valid = verifier.verify(message, signature) 

28 

29To sign messages use :class:`RSASigner` with a private key:: 

30 

31 private_key = open('private_key.pem').read() 

32 signer = crypt.RSASigner.from_string(private_key) 

33 signature = signer.sign(message) 

34 

35The code above also works for :class:`ES256Signer` and :class:`ES256Verifier`. 

36Note that these two classes are only available if your `cryptography` dependency 

37version is at least 1.4.0. 

38""" 

39 

40from google.auth.crypt import base, es, es256, rsa 

41 

42EsSigner = es.EsSigner 

43EsVerifier = es.EsVerifier 

44ES256Signer = es256.ES256Signer 

45ES256Verifier = es256.ES256Verifier 

46 

47 

48# Aliases to maintain the v1.0.0 interface, as the crypt module was split 

49# into submodules. 

50Signer = base.Signer 

51Verifier = base.Verifier 

52RSASigner = rsa.RSASigner 

53RSAVerifier = rsa.RSAVerifier 

54 

55 

56def verify_signature(message, signature, certs, verifier_cls=rsa.RSAVerifier): 

57 """Verify an RSA or ECDSA cryptographic signature. 

58 

59 Checks that the provided ``signature`` was generated from ``bytes`` using 

60 the private key associated with the ``cert``. 

61 

62 Args: 

63 message (Union[str, bytes]): The plaintext message. 

64 signature (Union[str, bytes]): The cryptographic signature to check. 

65 certs (Union[Sequence, str, bytes]): The certificate or certificates 

66 to use to check the signature. 

67 verifier_cls (Optional[~google.auth.crypt.base.Signer]): Which verifier 

68 class to use for verification. This can be used to select different 

69 algorithms, such as RSA or ECDSA. Default value is :class:`RSAVerifier`. 

70 

71 Returns: 

72 bool: True if the signature is valid, otherwise False. 

73 """ 

74 if isinstance(certs, (str, bytes)): 

75 certs = [certs] 

76 

77 for cert in certs: 

78 verifier = verifier_cls.from_string(cert) 

79 if verifier.verify(message, signature): 

80 return True 

81 return False 

82 

83 

84__all__ = [ 

85 "EsSigner", 

86 "EsVerifier", 

87 "ES256Signer", 

88 "ES256Verifier", 

89 "RSASigner", 

90 "RSAVerifier", 

91 "Signer", 

92 "Verifier", 

93]