audit-labs/evidence-seal

 1"""A local RFC 3161 Time-Stamp Authority for the end-to-end demo.
 2
 3Mints genuinely CMS-signed timestamp tokens offline so scripts/e2e.sh can
 4exercise the full timestamp flow — including signature verification — without a
 5network or a public TSA. It reuses the token issuer from the test suite.
 6
 7Usage: python scripts/_local_tsa.py <manifest_id> <out_dir> [--no-eku] [--expired]
 8Writes <out_dir>/resp.tsr (a TimeStampResp) and <out_dir>/tsa.pem (the cert).
 9"""
10
11import datetime
12import pathlib
13import sys
14
15_HERE = pathlib.Path(__file__).resolve()
16_REPO = _HERE.parent.parent
17sys.path.insert(0, str(_REPO / "tests"))
18sys.path.insert(0, str(_REPO))
19
20from test_timestamp import issue_signed_token
21
22
23def main() -> None:
24    manifest_id, out_dir = sys.argv[1], pathlib.Path(sys.argv[2])
25    out_dir.mkdir(parents=True, exist_ok=True)
26    eku = "--no-eku" not in sys.argv
27    validity = None
28    if "--expired" in sys.argv:
29        validity = (
30            datetime.datetime(2020, 1, 1, tzinfo=datetime.timezone.utc),
31            datetime.datetime(2021, 1, 1, tzinfo=datetime.timezone.utc),
32        )
33    token, cert = issue_signed_token(manifest_id, timestamping_eku=eku, validity=validity)
34    (out_dir / "resp.tsr").write_bytes(token)
35    (out_dir / "tsa.pem").write_bytes(cert)
36
37
38if __name__ == "__main__":
39    main()