Package: wacz_signing
wacz-signingThis package builds on work by Ilya Kreymer and Webrecorder inauthsign. It is intended
for use in WACZ signing (and to a lesser extent, verification), as set
forth in the Webrecorder RecommendationWACZ Signing and
Verification. It is
an attempt to reduce authsign's footprint, and decouple signing from
any specific web API, authentication, and the process of obtaining key
material. It also omits the optional cross-signing mechanism specified
in the recommendation and provided by authsign.InstallationFor regular use, start a virtual environment and install this package
and its requirements, something like this:python3 -m venv env
. env/bin/activate
pip install wacz-signingUseThe simplest way to use this system is to provide the environment
variablesDOMAINandCERTNAME, possibly in a.envfile; the
package will then use the key material in/etc/letsencrypt/live/<CERTNAME>/. (The provision ofDOMAINis to
accommodate the possibility that the domain name we care about is not
the one that was originally used to create the cert.) Then, you can>>> from wacz_signing import signer
>>> from datetime import datetime
>>> result = signer.sign('hello world!', datetime.utcnow())
>>> signer.verify(result)
{'observer': ['mkcert'], 'software': 'wacz-signing 0.2.6', 'timestamp': '2022-10-05T20:40:58Z'}or>>> signer.verify_wacz('test_files/valid_signed_example_1.wacz')
{'observer': ['btrix-sign-test.webrecorder.net'], 'software': 'authsigner 0.3.0', 'timestamp': '2022-01-18T19:00:12Z'}You can also provide cert, key, and timestamper material directly, or
in alternate files, using environment variables: you MUST provideDOMAIN; you MUST provide eitherCERTNAMEor one ofCERTandCERTFILE; if you have setCERTNAME, you MUST provide one ofKEYandKEYFILE. If you're not using Letsencrypt certs, you'll need to
setCERT_ROOTS. You may also configure the timestamper withTS_CERTorTS_CERTFILEandTS_URLandTS_ROOTS. You may additionally
change theCERT_DURATIONfrom its default of 7 days, and theSTAMP_DURATIONfrom its default of 10 minutes.You may want to catchsigner.SigningExceptionandsigner.VerificationException.For local development and testing, you'll need to installmkcert. To generate certs and
set up the environment, runbash ./set-up-dot-env.shCertificate managementIf you're using Letsencrypt certs, and you want them to be valid for a
short duration, say the default of seven days, you would need to force
a renewal after a week, then manually revoke the previous week's cert,
something likecertbot renew --force-renewal --deploy-hook /path/to/deploy-hook-script(or just put the script in/etc/letsencrypt/renewal-hooks/deploy/where the script runs something likecertbot revoke --cert-path `ls -t /etc/letsencrypt/archive/${CERTNAME}/cert*.pem | head -n 2 | tail -n 1` --reason expiration(But triple-check this before attempting it in earnest; a correct
example may follow.)Use casesThis package could be used in a tiny web API, of course; seeexamples/web-api/. It could also be integrated
into a producer of WACZ files, like a future version of Perma, which
would sign archives internally; it could also be run in a lambda,
which is why it's possible to provide key material directly in
environment variables.