Commit `468ebcc4ef`

468ebcc4ef57de0fa0a14d342ae8013001bc8ae6

parent: bdab697b73

Unsigned

cmc <hello@cleberg.net> · 2026-08-09 01:32 UTC

Pin CI actions to SHA, refactor _cmd_verify, tidy CLI/tests/shell

Layout: unified · split

.github/workflows/release.yml +2 −2

	@@ -11,7 +11,7 @@ jobs:
11	steps:	11	steps:
12	- uses: actions/checkout@v5	12	- uses: actions/checkout@v5
13	- name: Install uv	13	- name: Install uv
14	uses: astral-sh/setup-uv@v6	14	uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6
15	- name: Build	15	- name: Build
16	run: uv build	16	run: uv build
17	- name: Check	17	- name: Check
	@@ -33,4 +33,4 @@ jobs:
33	name: dist	33	name: dist
34	path: dist/	34	path: dist/
35	- name: Publish to PyPI	35	- name: Publish to PyPI
36	uses: pypa/gh-action-pypi-publish@release/v1	36	uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1

evidence_seal/cli.py +34 −25

 # Exit codes: 0 = intact/valid, 1 = tamper/verification failure, 2 = usage error.
 OK, FAILED, USAGE = 0, 1, 2
+_OUT_HELP = "write here instead of overwriting the manifest"
 def _default_manifest_path(directory: Path) -> Path:
     return directory.parent / f"{directory.name}.manifest.json"
     return OK
+def _print_drift(result) -> None:
+    for path in result.modified:
+        print(f"  MODIFIED  {path}")
+    for path in result.added:
+        print(f"  ADDED     {path}")
+    for path in result.removed:
+        print(f"  REMOVED   {path}")
+    if not result.id_ok:
+        print("  MANIFEST  id does not re-derive — the manifest itself was altered")
+    if not result.root_ok:
+        print("  MANIFEST  Merkle root does not match the file list")
+def _verify_timestamp_cli(manifest: dict, tsa_cert: str | None) -> bool:
+    from .timestamp import verify_timestamp
+    cert = Path(tsa_cert).read_bytes() if tsa_cert else None
+    ts_ok, ts_message = verify_timestamp(manifest, tsa_cert=cert)
+    print(f"  timestamp {'OK' if ts_ok else 'FAIL'}: {ts_message}")
+    return ts_ok
 def _cmd_verify(args) -> int:
     directory = Path(args.directory)
     manifest_path = Path(args.manifest) if args.manifest else _default_manifest_path(directory)
         exclude=_manifest_exclude(directory, manifest_path),
     )
-    for path in result.modified:
+    _print_drift(result)
-        print(f"  MODIFIED  {path}")
-    for path in result.added:
-        print(f"  ADDED     {path}")
-    for path in result.removed:
-        print(f"  REMOVED   {path}")
-    if not result.id_ok:
-        print("  MANIFEST  id does not re-derive — the manifest itself was altered")
-    if not result.root_ok:
-        print("  MANIFEST  Merkle root does not match the file list")
     status = OK
     if not result.intact:
         status = FAILED
     # Verify an embedded timestamp when present.
-    if manifest.get("timestamp"):
+    if manifest.get("timestamp") and not _verify_timestamp_cli(manifest, args.tsa_cert):
-        from .timestamp import verify_timestamp
+        status = FAILED
-        cert = Path(args.tsa_cert).read_bytes() if args.tsa_cert else None
-        ts_ok, ts_message = verify_timestamp(manifest, tsa_cert=cert)
-        print(f"  timestamp {'OK' if ts_ok else 'FAIL'}: {ts_message}")
-        if not ts_ok:
-            status = FAILED
     if status == OK:
         print(f"intact — {result.checked} files match the seal")
     try:
         manifest = load_manifest(args.manifest)
         signed = sign_manifest(manifest, args.key)
-    except (RuntimeError, FileNotFoundError, ValueError, OSError) as exc:
+    except (RuntimeError, ValueError, OSError) as exc:
         print(f"error: {exc}", file=sys.stderr)
         return USAGE
     write_manifest(signed, args.out or args.manifest)
     try:
         manifest = load_manifest(args.manifest)
         request = build_request(manifest["id"])
-    except (RuntimeError, FileNotFoundError, ValueError, KeyError, OSError) as exc:
+    except (RuntimeError, ValueError, KeyError, OSError) as exc:
         print(f"error: {exc}", file=sys.stderr)
         return USAGE
     out = args.out or f"{args.manifest}.tsq"
     try:
         manifest = load_manifest(args.manifest)
         stamped = apply_timestamp(manifest, load_der(args.token))
-    except (RuntimeError, FileNotFoundError, ValueError, OSError) as exc:
+    except (RuntimeError, ValueError, OSError) as exc:
         print(f"error: {exc}", file=sys.stderr)
         return USAGE
     write_manifest(stamped, args.out or args.manifest)
     except ValueError as exc:
         print(f"error: {exc}", file=sys.stderr)
         return FAILED
-    except (RuntimeError, FileNotFoundError, KeyError, OSError) as exc:
+    except (RuntimeError, KeyError, OSError) as exc:
         print(f"error: {exc}", file=sys.stderr)
         return USAGE
     write_manifest(stamped, args.out or args.manifest)
     p_sign = sub.add_parser("sign", help="sign an existing manifest")
     p_sign.add_argument("manifest")
     p_sign.add_argument("--key", required=True, metavar="PRIVATE_KEY")
-    p_sign.add_argument("--out", help="write here instead of overwriting the manifest")
+    p_sign.add_argument("--out", help=_OUT_HELP)
     p_sign.set_defaults(func=_cmd_sign)
     _add_timestamp_commands(sub)
     p_apply = ts.add_parser("apply", help="bind a TSA response/token into the manifest")
     p_apply.add_argument("manifest")
     p_apply.add_argument("--token", required=True, metavar="TSR", help="TSA response or token (DER)")
-    p_apply.add_argument("--out", help="write here instead of overwriting the manifest")
+    p_apply.add_argument("--out", help=_OUT_HELP)
     p_apply.set_defaults(func=_cmd_ts_apply)
     p_submit = ts.add_parser("submit", help="request, POST to a TSA, and bind in one step")
     p_submit.add_argument("manifest")
     p_submit.add_argument("--tsa", required=True, metavar="URL", help="RFC 3161 TSA endpoint")
     p_submit.add_argument("--timeout", type=float, default=30.0, help="network timeout (seconds)")
-    p_submit.add_argument("--out", help="write here instead of overwriting the manifest")
+    p_submit.add_argument("--out", help=_OUT_HELP)
     p_submit.set_defaults(func=_cmd_ts_submit)
     p_tsv = ts.add_parser("verify", help="verify the manifest's embedded timestamp")

scripts/e2e.sh +2 −2

	@@ -17,7 +17,7 @@ SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
17	REPO="$(dirname "$SCRIPT_DIR")"	17	REPO="$(dirname "$SCRIPT_DIR")"
18		18
19	# Prefer the project venv; fall back to whatever is on PATH.	19	# Prefer the project venv; fall back to whatever is on PATH.
20	if [ -x "$REPO/.venv/bin/python" ]; then	20	if [[ -x "$REPO/.venv/bin/python" ]]; then
21	PY="$REPO/.venv/bin/python"	21	PY="$REPO/.venv/bin/python"
22	else	22	else
23	PY="$(command -v python3 \|\| command -v python)"	23	PY="$(command -v python3 \|\| command -v python)"
	@@ -37,7 +37,7 @@ assert_exit() {
37	printf '$ %s\n' "$*"	37	printf '$ %s\n' "$*"
38	eval "$*" >"$W/out" 2>&1; local rc=$?	38	eval "$*" >"$W/out" 2>&1; local rc=$?
39	sed 's/^/ /' "$W/out"	39	sed 's/^/ /' "$W/out"
40	if [ "$rc" = "$exp" ]; then	40	if [[ "$rc" == "$exp" ]]; then
41	printf ' \033[32m✓ PASS\033[0m — %s (exit %s)\n' "$label" "$rc"; pass=$((pass+1))	41	printf ' \033[32m✓ PASS\033[0m — %s (exit %s)\n' "$label" "$rc"; pass=$((pass+1))
42	else	42	else
43	printf ' \033[31m✗ FAIL\033[0m — %s (exit %s, expected %s)\n' "$label" "$rc" "$exp"; fail=$((fail+1))	43	printf ' \033[31m✗ FAIL\033[0m — %s (exit %s, expected %s)\n' "$label" "$rc" "$exp"; fail=$((fail+1))

tests/test_cli.py +2 −1

	@@ -85,7 +85,8 @@ def test_timestamp_request_apply_verify(pkg, tmp_path):
85		85
86	req = tmp_path / "m.tsq"	86	req = tmp_path / "m.tsq"
87	assert main(["timestamp", "request", str(manifest), "--out", str(req)]) == OK	87	assert main(["timestamp", "request", str(manifest), "--out", str(req)]) == OK
88	assert req.exists() and req.stat().st_size > 0	88	assert req.exists()
		89	assert req.stat().st_size > 0
89		90
90	manifest_id = json.loads(manifest.read_text())["id"]	91	manifest_id = json.loads(manifest.read_text())["id"]
91	tsr = tmp_path / "resp.tsr"	92	tsr = tmp_path / "resp.tsr"

tests/test_timestamp.py +4 −2

 def test_apply_refuses_token_for_other_id(manifest):
     wrong = "0" * 64
+    token = issue_token(wrong)
     with pytest.raises(ValueError, match="does not timestamp this manifest"):
-        apply_timestamp(manifest, issue_token(wrong))
+        apply_timestamp(manifest, token)
 def test_timestamp_does_not_change_manifest_id(manifest):
     token, cert_pem = issue_signed_token(manifest["id"])
     ok, message = verify_token_signature(token, cert_pem)
     assert ok
-    assert "valid" in message and "Test TSA" in message
+    assert "valid" in message
+    assert "Test TSA" in message
 def test_full_signature_via_verify_timestamp(manifest):

Commit 468ebcc4ef

Commit `468ebcc4ef`