Skip to content

Commit 0db7a2a

Browse files
aydarngaydarng
authored
Merge pull request #135 from GLEIF-IT/feature/signed_headers_verification_in_presentations
Signed headers verification logic to the /presentations endpoint
2 parents 5d8cfeb + 82fdd43 commit 0db7a2a

10 files changed

Lines changed: 63 additions & 57 deletions

File tree

‎.github/workflows/python-app-ci.yml‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,18 +16,28 @@ jobs:
1616
strategy:
1717
fail-fast: false
1818
matrix:
19-
os: [ macos-13, ubuntu-latest ]
19+
os: [ macOS-15, ubuntu-latest ]
2020

2121
steps:
22-
- uses: actions/checkout@v3
22+
- uses: actions/checkout@v4
2323
- name: Set up Python 3.12.2
24-
uses: actions/setup-python@v2
24+
uses: actions/setup-python@v5
2525
with:
2626
python-version: 3.12.2
2727
- name: Install libsodium
2828
run: |
2929
if [ "${{ runner.os }}" == "macOS" ]; then
30-
brew install libsodium
30+
brew install libsodium pkg-config
31+
SODIUM_PREFIX="$(brew --prefix libsodium)"
32+
echo "SODIUM_PREFIX=$SODIUM_PREFIX" >> $GITHUB_ENV
33+
34+
# Runtime discovery (this is the important part for pysodium import)
35+
echo "DYLD_FALLBACK_LIBRARY_PATH=$SODIUM_PREFIX/lib:/usr/local/lib:/usr/lib" >> $GITHUB_ENV
36+
37+
# Build-time helpers (safe to set; useful if anything compiles/links)
38+
echo "PKG_CONFIG_PATH=$SODIUM_PREFIX/lib/pkgconfig:$PKG_CONFIG_PATH" >> $GITHUB_ENV
39+
echo "LDFLAGS=-L$SODIUM_PREFIX/lib $LDFLAGS" >> $GITHUB_ENV
40+
echo "CPPFLAGS=-I$SODIUM_PREFIX/include $CPPFLAGS" >> $GITHUB_ENV
3141
else
3242
sudo apt-get install -y libsodium-dev
3343
fi

‎docker-compose.yml‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
services:
2-
# witnesses:
2+
# witnesses:
33
# # container_name: witnesshost
44
# # hostname: witnesshost
55
# image: weboftrust/keri:latest
@@ -31,13 +31,11 @@ services:
3131
image: gleif/vlei-verifier:latest
3232
container_name: vlei-verifier
3333
hostname: vlei-verifier
34-
# depends_on:
35-
# - vlei
36-
# - witnesses
3734
ports:
3835
- 7676:7676
3936
environment:
4037
- VERIFIER_CONFIG_FILE=verifier-config-public.json
38+
- VERIFY_ROOT_OF_TRUST=True
4139
healthcheck:
4240
test:
4341
- CMD

‎scripts/keri/cf/verifier-config-public.json‎

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,26 +1,13 @@
11
{
22
"dt": "2022-01-20T12:57:59.823350+00:00",
33
"iurls": [
4-
"https://witness-dev01.rootsid.cloud/oobi/BHI7yViNOGWd1X0aKMgxLm4dUgbQDYoCFSJM2U8Hb3cx/controller",
5-
"https://witness-dev02.rootsid.cloud/oobi/BOUZ4v-vPMP5KyZQP-d_8B30UHI4KWgXczBgWcRJnnYd/controller",
6-
"https://witness-dev03.rootsid.cloud/oobi/BNY3LWk2BzX8wXmkXuvpYRVSdfynanwKQwD80KOG00VH/controller",
7-
"http://wit1.rootsid.cloud:5501/oobi/BNZBr3xjR0Vtat_HxFJnfBwQcpDj3LGl4h_MCQdmyN-r/controller",
8-
"http://wit2.rootsid.cloud:5503/oobi/BH_XYb3mBmRB1nBVl8XrKjtuQkcIWYKALY4ZWLVOZjKg/controller",
9-
"http://wit3.rootsid.cloud:5505/oobi/BAPWdGXGfiFsi3sMvSCPDnoPnEhPp-ZWxK9RYrqCQTa_/controller",
104
"https://william.witness.vlei.tech/oobi",
115
"https://wesley.witness.vlei.tech/oobi",
126
"https://whitney.witness.vlei.tech/oobi",
137
"https://wilma.witness.vlei.tech/oobi",
148
"https://wilbur.witness.vlei.tech/oobi"
159
],
1610
"durls": [
17-
"http://schemas.rootsid.cloud/oobi/EBNaNu-M9P5cgrnfl2Fvymy4E_jvxxyjb70PRtiANlJy",
18-
"http://schemas.rootsid.cloud/oobi/EMhvwOlyEJ9kN4PrwCpr9Jsv7TxPhiYveZ0oP3lJzdEi",
19-
"http://schemas.rootsid.cloud/oobi/EKA57bKBKxr_kN7iN5i7lMUxpMG-s19dRcmov1iDxz-E",
20-
"http://schemas.rootsid.cloud/oobi/EEy9PkikFcANV1l7EHukCeXqrzT1hNZjGlUk7wuMO5jw",
21-
"http://schemas.rootsid.cloud/oobi/ENPXp1vQzRF6JwIuS-mp2U8Uf1MoADoP_GqQ62VsDZWY",
22-
"http://schemas.rootsid.cloud/oobi/EH6ekLjSr8V32WyFbGe1zXjTzFs9PkTYmupJ9H65O14g",
23-
"http://schemas.rootsid.cloud/oobi/EBfdlu8R27Fbx-ehrqwImnK-8Cm79sqbAQ4MmvEAYqao",
2411
"https://gleif-it.github.io/oobi/EBNaNu-M9P5cgrnfl2Fvymy4E_jvxxyjb70PRtiANlJy",
2512
"https://gleif-it.github.io/oobi/EMhvwOlyEJ9kN4PrwCpr9Jsv7TxPhiYveZ0oP3lJzdEi",
2613
"https://gleif-it.github.io/oobi/EKA57bKBKxr_kN7iN5i7lMUxpMG-s19dRcmov1iDxz-E",

‎scripts/keri/cf/verifier-config-test.json‎

Lines changed: 10 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,33 +1,18 @@
11
{
22
"dt": "2022-01-20T12:57:59.823350+00:00",
33
"iurls": [
4-
"https://witness-dev01.rootsid.cloud/oobi/BHI7yViNOGWd1X0aKMgxLm4dUgbQDYoCFSJM2U8Hb3cx/controller",
5-
"https://witness-dev02.rootsid.cloud/oobi/BOUZ4v-vPMP5KyZQP-d_8B30UHI4KWgXczBgWcRJnnYd/controller",
6-
"https://witness-dev03.rootsid.cloud/oobi/BNY3LWk2BzX8wXmkXuvpYRVSdfynanwKQwD80KOG00VH/controller",
7-
"http://wit1.rootsid.cloud:5501/oobi/BNZBr3xjR0Vtat_HxFJnfBwQcpDj3LGl4h_MCQdmyN-r/controller",
8-
"http://wit2.rootsid.cloud:5503/oobi/BH_XYb3mBmRB1nBVl8XrKjtuQkcIWYKALY4ZWLVOZjKg/controller",
9-
"http://wit3.rootsid.cloud:5505/oobi/BAPWdGXGfiFsi3sMvSCPDnoPnEhPp-ZWxK9RYrqCQTa_/controller",
10-
"https://william.witness.vlei.tech/oobi",
11-
"https://wesley.witness.vlei.tech/oobi",
12-
"https://whitney.witness.vlei.tech/oobi",
13-
"https://wilma.witness.vlei.tech/oobi",
14-
"https://wilbur.witness.vlei.tech/oobi"
4+
"http://127.0.0.1:5642/oobi/BBilc4-L3tFUnfM_wJr4S4OJanAv_VmF_dJNN6vkf2Ha/controller",
5+
"http://127.0.0.1:5643/oobi/BLskRTInXnMxWaGqcpSyMgo0nYbalW99cGZESrz3zapM/controller",
6+
"http://127.0.0.1:5644/oobi/BIKKuvBwpmDVA4Ds-EpL5bt9OqPzWPja2LigFYZN2YfX/controller"
157
],
168
"durls": [
17-
"http://schemas.rootsid.cloud/oobi/EBNaNu-M9P5cgrnfl2Fvymy4E_jvxxyjb70PRtiANlJy",
18-
"http://schemas.rootsid.cloud/oobi/EMhvwOlyEJ9kN4PrwCpr9Jsv7TxPhiYveZ0oP3lJzdEi",
19-
"http://schemas.rootsid.cloud/oobi/EKA57bKBKxr_kN7iN5i7lMUxpMG-s19dRcmov1iDxz-E",
20-
"http://schemas.rootsid.cloud/oobi/EEy9PkikFcANV1l7EHukCeXqrzT1hNZjGlUk7wuMO5jw",
21-
"http://schemas.rootsid.cloud/oobi/ENPXp1vQzRF6JwIuS-mp2U8Uf1MoADoP_GqQ62VsDZWY",
22-
"http://schemas.rootsid.cloud/oobi/EH6ekLjSr8V32WyFbGe1zXjTzFs9PkTYmupJ9H65O14g",
23-
"http://schemas.rootsid.cloud/oobi/EBfdlu8R27Fbx-ehrqwImnK-8Cm79sqbAQ4MmvEAYqao",
24-
"https://gleif-it.github.io/oobi/EBNaNu-M9P5cgrnfl2Fvymy4E_jvxxyjb70PRtiANlJy",
25-
"https://gleif-it.github.io/oobi/EMhvwOlyEJ9kN4PrwCpr9Jsv7TxPhiYveZ0oP3lJzdEi",
26-
"https://gleif-it.github.io/oobi/EKA57bKBKxr_kN7iN5i7lMUxpMG-s19dRcmov1iDxz-E",
27-
"https://gleif-it.github.io/oobi/EEy9PkikFcANV1l7EHukCeXqrzT1hNZjGlUk7wuMO5jw",
28-
"https://gleif-it.github.io/oobi/ENPXp1vQzRF6JwIuS-mp2U8Uf1MoADoP_GqQ62VsDZWY",
29-
"https://gleif-it.github.io/oobi/EH6ekLjSr8V32WyFbGe1zXjTzFs9PkTYmupJ9H65O14g",
30-
"https://gleif-it.github.io/oobi/EBfdlu8R27Fbx-ehrqwImnK-8Cm79sqbAQ4MmvEAYqao"
9+
"http://127.0.0.1:7723/oobi/EBNaNu-M9P5cgrnfl2Fvymy4E_jvxxyjb70PRtiANlJy",
10+
"http://127.0.0.1:7723/oobi/EMhvwOlyEJ9kN4PrwCpr9Jsv7TxPhiYveZ0oP3lJzdEi",
11+
"http://127.0.0.1:7723/oobi/EKA57bKBKxr_kN7iN5i7lMUxpMG-s19dRcmov1iDxz-E",
12+
"http://127.0.0.1:7723/oobi/EEy9PkikFcANV1l7EHukCeXqrzT1hNZjGlUk7wuMO5jw",
13+
"http://127.0.0.1:7723/oobi/ENPXp1vQzRF6JwIuS-mp2U8Uf1MoADoP_GqQ62VsDZWY",
14+
"http://127.0.0.1:7723/oobi/EH6ekLjSr8V32WyFbGe1zXjTzFs9PkTYmupJ9H65O14g",
15+
"http://127.0.0.1:7723/oobi/EBfdlu8R27Fbx-ehrqwImnK-8Cm79sqbAQ4MmvEAYqao"
3116
],
3217
"trustedLeis": [],
3318
"allowedSchemas": [

‎setup.py‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@
3333

3434
setup(
3535
name='verifier',
36-
version='0.1.3', # also change in src/verifier/__init__.py
36+
version='0.1.4', # also change in src/verifier/__init__.py
3737
license='Apache Software License 2.0',
3838
description='Verifier: Proof of Concept vLEI Verifier',
3939
long_description="Verifier: Proof of Concept vLEI Verifier.",
@@ -74,8 +74,9 @@
7474
],
7575
python_requires='>=3.12.2',
7676
install_requires=[
77-
'keri==1.2.0-dev12',
77+
'keri==1.2.6',
7878
'mnemonic>=0.20',
79+
'pysodium>=0.7.17',
7980
'multicommand>=1.0.0',
8081
'falcon>=3.1.0',
8182
'http_sfv>=0.9.8',

‎src/verifier/__init__.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
__version__ = '0.1.2'
1+
__version__ = '0.1.4'

‎src/verifier/core/observing.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ def _check_revocations(self):
5959
if env.mode == "production":
6060
self.vdb.iss.rem(keys=(aid,))
6161
self.vdb.iss.rem(keys=(state.said,))
62-
self.vdb.acct.rem(keys=(aid,))
62+
self.vdb.accts.rem(keys=(aid,))
6363
continue
6464
except Exception as e:
6565
print(f"Error checking witness for credential {state.said}: {e}")
@@ -70,7 +70,7 @@ def _check_revocations(self):
7070
if env.mode == "production":
7171
self.vdb.iss.rem(keys=(aid,))
7272
self.vdb.iss.rem(keys=(state.said,))
73-
self.vdb.acct.rem(keys=(aid,))
73+
self.vdb.accts.rem(keys=(aid,))
7474

7575

7676

‎src/verifier/core/utils.py‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -270,7 +270,7 @@ def process_signature_headers(headers, req):
270270
or "SIGNIFY-TIMESTAMP" not in headers
271271
):
272272
raise SignatureHeaderError(
273-
json.dumps({"msg": "Incorrect Headers"}), 401
273+
"Incorrect Signature Headers"
274274
)
275275

276276
siginput = headers["SIGNATURE-INPUT"]
@@ -282,7 +282,7 @@ def process_signature_headers(headers, req):
282282

283283
if not inputs:
284284
raise SignatureHeaderError(
285-
json.dumps({"msg": "Incorrect Headers"}), 401
285+
"Incorrect Signature Headers"
286286
)
287287

288288
for inputage in inputs:
@@ -325,6 +325,7 @@ def process_signature_headers(headers, req):
325325

326326
sig = cig.qb64
327327
return sig, ser
328+
return None
328329

329330

330331
def verify_signed_headers(hby, aid, signature, encoded_data) -> tuple[SignatureVerificationStatus, str]:

‎src/verifier/core/verifying.py‎

Lines changed: 27 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -358,7 +358,7 @@ def on_put(self, req, rep, said):
358358
found = False
359359
presentation_type: PresentationType = "CREDENTIAL"
360360
saids = []
361-
361+
aid = None
362362
if not self.vry.cues:
363363
while self.hby.kvy.cues:
364364
msg = self.hby.kvy.cues.popleft()
@@ -374,6 +374,11 @@ def on_put(self, req, rep, said):
374374
if "creder" in msg:
375375
creder = msg["creder"]
376376
if creder.said == said:
377+
creder_attrs = creder.sad['a']
378+
if 'i' in creder_attrs:
379+
aid = creder_attrs['i']
380+
else:
381+
aid = creder.sad['i']
377382
found = True
378383
break
379384

@@ -401,7 +406,26 @@ def on_put(self, req, rep, said):
401406
).encode("utf-8")
402407
return
403408

404-
409+
# Signed headers verification
410+
env = VerifierEnvironment.resolve_env()
411+
if env.mode == "production":
412+
headers = req.headers
413+
try:
414+
sign, data = process_signature_headers(headers, req)
415+
except SignatureHeaderError as e:
416+
rep.status = falcon.HTTP_BAD_REQUEST
417+
rep.data = json.dumps(dict(msg=str(e))).encode("utf-8")
418+
return
419+
encoded_data = data.encode("utf-8")
420+
verification_status, verification_message = verify_signed_headers(self.hby, aid, sign, encoded_data)
421+
if verification_status == SignatureVerificationStatus.UNAUTHORIZED:
422+
rep.status = falcon.HTTP_UNAUTHORIZED
423+
rep.data = json.dumps(dict(msg=verification_message)).encode("utf-8")
424+
return
425+
if verification_status == SignatureVerificationStatus.BAD_SIGNATURE:
426+
rep.status = falcon.HTTP_BAD_REQUEST
427+
rep.data = json.dumps(dict(msg=verification_message)).encode("utf-8")
428+
return
405429

406430
saider = coring.Saider(qb64=said)
407431
cred_attrs = creder.sad["a"]
@@ -453,7 +477,7 @@ def on_put(self, req, rep, said):
453477
dict(
454478
creds=json.dumps(creds),
455479
aid=aid,
456-
msg=f"{said} for {aid} as {type} is {cred_state.state}",
480+
msg=info,
457481
)
458482
).encode("utf-8")
459483
else:

‎tests/core/test_verifying.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -557,4 +557,4 @@ def test_ecr_newschema(seeder):
557557
# ecr auth cred is verified to be a valid credential
558558
assert result.status == falcon.HTTP_202
559559

560-
assert result.json.get('msg') == f"{cred_value} for {hab.pre} as issuee is Credential cryptographically valid"
560+
assert result.json.get('msg') == f"Credential {cred_value} presented for {hab.pre} is cryptographically valid"

0 commit comments

Comments
 (0)