From 610d6a8c817d889915aaafd88f8744b2451cdd26 Mon Sep 17 00:00:00 2001 From: Matt Prahl Date: Thu, 22 Sep 2016 14:03:54 -0400 Subject: [PATCH 1/6] Split up long lines to comply with PEP8 standards --- manage.py | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/manage.py b/manage.py index 92210ae5..d0049302 100644 --- a/manage.py +++ b/manage.py @@ -29,8 +29,9 @@ import ssl from rida import app, conf, db from rida.config import Config -from rida.pdc import get_pdc_client_session, get_module, get_module_runtime_dependencies, get_module_tag, \ - get_module_build_dependencies +from rida.pdc import ( + get_pdc_client_session, get_module, get_module_runtime_dependencies, + get_module_tag, get_module_build_dependencies) import rida.auth @@ -75,12 +76,14 @@ def testpdc(): cfg.pdc_develop = True pdc_session = get_pdc_client_session(cfg) - module = get_module(pdc_session, {'name': 'testmodule', 'version': '4.3.43', 'release': '1'}) + module = get_module(pdc_session, {'name': 'testmodule', 'version': '4.3.43', + 'release': '1'}) if module: print ("pdc_data=%s" % str(module)) print ("deps=%s" % get_module_runtime_dependencies(pdc_session, module)) - print ("build_deps=%s" % get_module_build_dependencies(pdc_session, module)) + print ("build_deps=%s" % get_module_build_dependencies( + pdc_session, module)) print ("tag=%s" % get_module_tag(pdc_session, module)) else: print ('module was not found') From 681ca5a8cfa0eba08fbedd26bdb75c30957f90ab Mon Sep 17 00:00:00 2001 From: Matt Prahl Date: Fri, 23 Sep 2016 10:16:43 -0400 Subject: [PATCH 2/6] Implement `python manage.py gendevfedmsgcert` command --- manage.py | 100 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 100 insertions(+) diff --git a/manage.py b/manage.py index d0049302..616b2941 100644 --- a/manage.py +++ b/manage.py @@ -26,6 +26,7 @@ import flask_migrate import logging import os import ssl +from shutil import rmtree from rida import app, conf, db from rida.config import Config @@ -96,6 +97,105 @@ def upgradedb(): flask_migrate.upgrade() +@manager.command +def gendevfedmsgcert(pki_dir='/opt/fm-orchestrator/pki', force=False): + """ + Creates a CA, a certificate signed by that CA, and generates a CRL. + """ + from OpenSSL import crypto + + if os.path.exists(pki_dir): + if force: + rmtree(pki_dir) + else: + print('The directory "{}" already exists'.format(pki_dir)) + return + + os.mkdir(pki_dir) + + ca_crt_path = os.path.join(pki_dir, 'ca.crt') + ca_key_path = os.path.join(pki_dir, 'ca.key') + msg_key_path = os.path.join(pki_dir, 'msg_signing.key') + msg_crt_path = os.path.join(pki_dir, 'msg_signing.crt') + ca_crl = os.path.join(pki_dir, 'ca.crl') + + # Create a key pair for the CA + ca_key = crypto.PKey() + ca_key.generate_key(crypto.TYPE_RSA, 2048) + + with open(ca_key_path, 'w') as ca_key_file: + ca_key_file.write( + crypto.dump_privatekey(crypto.FILETYPE_PEM, ca_key)) + + # Create a self-signed CA cert + ca_cert = crypto.X509() + ca_subject = ca_cert.get_subject() + ca_subject.C = 'US' + ca_subject.ST = 'MA' + ca_subject.L = 'Boston' + ca_subject.O = 'Development' + ca_subject.CN = 'Dev-CA' + ca_cert.set_serial_number(1) + ca_cert.gmtime_adj_notBefore(0) + ca_cert.gmtime_adj_notAfter(315360000) # 10 years + ca_cert.set_issuer(ca_cert.get_subject()) + ca_cert.set_pubkey(ca_key) + ca_cert.add_extensions([ + crypto.X509Extension('basicConstraints', True, 'CA:true')]) + ca_cert.sign(ca_key, 'sha256') + + with open(ca_crt_path, 'w') as ca_crt_file: + ca_crt_file.write( + crypto.dump_certificate(crypto.FILETYPE_PEM, ca_cert)) + + # Create a key pair for the message signing cert + msg_key = crypto.PKey() + msg_key.generate_key(crypto.TYPE_RSA, 2048) + + with open(msg_key_path, 'w') as msg_key_file: + msg_key_file.write( + crypto.dump_privatekey(crypto.FILETYPE_PEM, msg_key)) + + # Create a cert signed by the CA + msg_cert = crypto.X509() + msg_cert_subject = msg_cert.get_subject() + msg_cert_subject.C = 'US' + msg_cert_subject.ST = 'MA' + msg_cert_subject.L = 'Boston' + msg_cert_subject.O = 'Development' + msg_cert_subject.CN = 'localhost' + msg_cert.set_serial_number(2) + msg_cert.gmtime_adj_notBefore(0) + msg_cert.gmtime_adj_notAfter(315360000) # 10 years + msg_cert.set_issuer(ca_cert.get_subject()) + msg_cert.set_pubkey(msg_key) + cert_extensions = [ + crypto.X509Extension( + 'keyUsage', True, + 'digitalSignature, keyEncipherment, nonRepudiation'), + crypto.X509Extension('extendedKeyUsage', True, 'serverAuth'), + crypto.X509Extension('basicConstraints', True, 'CA:false'), + crypto.X509Extension('crlDistributionPoints', False, + 'URI:http://localhost/crl/ca.crl'), + crypto.X509Extension('authorityInfoAccess', False, + 'caIssuers;URI:http://localhost/crl/ca.crt'), + crypto.X509Extension('subjectKeyIdentifier', False, 'hash', + subject=ca_cert) + ] + msg_cert.add_extensions(cert_extensions) + msg_cert.sign(ca_key, 'sha256') + + with open(msg_crt_path, 'w') as msg_crt_file: + msg_crt_file.write( + crypto.dump_certificate(crypto.FILETYPE_PEM, msg_cert)) + + # Generate the CRL + with open(ca_crl, 'w') as ca_crl_file: + ca_crl_file.write( + crypto.CRL().export(ca_cert, ca_key, type=crypto.FILETYPE_PEM, + days=3650, digest='sha256')) + + @manager.command def runssl(host=conf.host, port=conf.port, debug=False): """ Runs the Flask app with the HTTPS settings configured in config.py From c77be1c4d3a67e2f72a0623c0d8c4a799c99422c Mon Sep 17 00:00:00 2001 From: Matt Prahl Date: Fri, 23 Sep 2016 10:50:54 -0400 Subject: [PATCH 3/6] Add the dependencies required for fedmsg signing --- Dockerfile | 2 +- Vagrantfile | 2 +- manage.py | 4 ++-- requirements.txt | 2 ++ 4 files changed, 6 insertions(+), 4 deletions(-) diff --git a/Dockerfile b/Dockerfile index 600fdf78..c5bf9f13 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,7 @@ FROM fedora:24 # so we don't have to compile those when fetched from PyPI -RUN dnf install -y python-pip python2-setuptools python2-cffi python2-zmq python2-cryptography koji python2-pdc-client && \ +RUN dnf install -y python-pip python2-setuptools python2-cffi python2-zmq python2-cryptography koji python2-pdc-client swig && \ dnf autoremove -y && dnf clean all && \ mkdir /opt/fm-orchestrator/ WORKDIR /opt/fm-orchestrator/ diff --git a/Vagrantfile b/Vagrantfile index bb10a555..786f05e5 100644 --- a/Vagrantfile +++ b/Vagrantfile @@ -2,7 +2,7 @@ # vi: set ft=ruby : $script = <