Package: nethsm
nethsm-sdk-pyPython client for NetHSM. NetHSM documentation available here:NetHSM documentationUsageInstallation:pipinstallnethsmExample program:importdatetimeimportnethsmadmin_passphrase="adminadmin"unlock_passphrase="unlockunlock"withnethsm.connect(host="nethsmdemo.nitrokey.com",auth=nethsm.Authentication(username="admin",password=admin_passphrase),)asclient:ifclient.get_state()==nethsm.State.UNPROVISIONED:client.provision(unlock_passphrase=unlock_passphrase,admin_passphrase=admin_passphrase,system_time=datetime.datetime.now(datetime.timezone.utc),)ifclient.get_state()==nethsm.State.LOCKED:client.unlock(unlock_passphrase)assertclient.get_state()==nethsm.State.OPERATIONALclient.generate_key(type=nethsm.KeyType.RSA,length=2048,mechanisms=[nethsm.KeyMechanism.RSA_SIGNATURE_PKCS1,nethsm.KeyMechanism.RSA_DECRYPTION_PKCS1,nethsm.KeyMechanism.RSA_SIGNATURE_PSS_SHA256,nethsm.KeyMechanism.RSA_DECRYPTION_OAEP_SHA256,],)print(client.list_keys())DevelopmentSetting Up The EnvironmentUsemake initto set up the development environment.You can then runmake checkto run the checks on your changes andmake fixto format the code.Updating the clientTo update the NetHSM HTTP client, you need to download the updatednethsm-api.ymlOpenAPI specification. The easiest is to download it from the NetHSM demo server (curlrequired):makenethsm-api.yaml--always-makeThen, run the generation script, docker is required:makenethsm-clientBe sure to run the linter, tests and check that everything is working as expected after the update.Custom functionsThe generator doesn't support upload of binary files and customContent-Typeheaders (fails to serialize).
To work around this, some functions are written manually, usingNetHSM._request()to send the request.The current list of such functions is:NetHSM.set_certificate():/config/tls/cert.pemAlso, the generator cannot deserialize responses with a header that is specified in the OpenAPI document.
Therefore, the following functions manually deserialize the API response:NetHSM.add_key():/keysNetHSM.generate_key():/keys/generateNetHSM.add_user():/usersPublishing a new versionchange__version__innethsm/__init__.py. Example : 0.1.0create a new tag, prependingvto the version. Example : v0.1.0create a new release on GitHub to trigger the ci that will publish the new version.Adding new testsTesting is done viapytest. A test is loaded when the name of the file starts withtest_and the function doing the test is prefixed bytest.Pytest fixtures are used, to get a provisioned and initialized NetHSM object to interact with, usenethsmas a parameter of your test function. For an unprovisioned NetHSM usenethsm_no_provision.If you want to force a reset (clearing the data) of the NetHSM instance, usestart_nethsm(), it will kill and restart the process.If you want to get debug logs when running the tests, runpytest -s.When a test is currently broken and expected to fail, decorate the test function with:@pytest.mark.xfail(reason="reason")You can mark a test to be skipped:@pytest.mark.skip(reason="reason")Test modesBy default these tests assume that a docker daemon is running and that open ports on containers can be accessed via127.0.0.1, meaning it will not work if run in a container.If you want to run these tests in a container, use thedocker.io/nitrokey/nethsm:testingimage and set the environment variableTEST_MODE=ci. Example:dockerrun-v"$PWD:/nethsm"-eFLIT_ROOT_INSTALL=1-eTEST_MODE=ci-it--entrypoint/bin/shnitrokey/nethsm:testing-c"apk add make python3 && cd /nethsm && make init && make test"Be aware this command will create files owned by root in your working directory.This CI mode manually start and stops the necessary processes to run a NetHSM instance, due to its design it may break when the container image is updated.