From f4ddaf4bcd4644218c0c48ac4127bf324a393f13 Mon Sep 17 00:00:00 2001 From: Georg Krause <mail@georg-krause.net> Date: Fri, 1 Apr 2022 15:53:12 +0200 Subject: [PATCH] Update project description --- README.md | 70 +++++++++++++++++++++++++++++++++++++++++ README.rst | 84 -------------------------------------------------- pyproject.toml | 20 ++++++++++-- 3 files changed, 87 insertions(+), 87 deletions(-) create mode 100644 README.md delete mode 100644 README.rst diff --git a/README.md b/README.md new file mode 100644 index 0000000..92ea13b --- /dev/null +++ b/README.md @@ -0,0 +1,70 @@ +# requests-http-message-signatures: A Requests auth module for HTTP Signature + +**requests-http-message-signatures** is a [Requests](https://github.com/requests/requests) +[authentication plugin](http://docs.python-requests.org/en/master/user/authentication/>) +(`requests.auth.AuthBase` subclass) implementing the +[IETF HTTP Signatures draft RFC](https://tools.ietf.org/html/draft-richanna-http-message-signatures). It has no +required dependencies outside the standard library. If you wish to use algorithms other than HMAC (namely, RSA and +ECDSA algorithms specified in the RFC), there is an optional dependency on +[cryptography](https://pypi.python.org/pypi/cryptography). + +## Installation + +``` +$ pip install requests-http-message-signatures +``` + +## Usage + +``` + import requests + from requests_http_signature import HTTPSignatureAuth + + preshared_key_id = 'squirrel' + preshared_secret = 'monorail_cat' + url = 'http://example.com/path' + + requests.get(url, auth=HTTPSignatureAuth(key=preshared_secret, key_id=preshared_key_id)) +``` + +By default, only the `Date` header is signed (as per the RFC) for body-less requests such as GET. The `Date` header +is set if it is absent. In addition, for requests with bodies (such as POST), the `Digest` header is set to the SHA256 +of the request body and signed (an example of this appears in the RFC). To add other headers to the signature, pass an +array of header names in the `headers` keyword argument. + +In addition to signing messages in the client, the class method `HTTPSignatureAuth.verify()` can be used to verify +incoming requests: + +``` + def key_resolver(key_id, algorithm): + return 'monorail_cat' + + HTTPSignatureAuth.verify(request, key_resolver=key_resolver) +``` + +### Asymmetric key algorithms (RSA and ECDSA) + +For asymmetric key algorithms, you should supply the private key as the `key` parameter to the `HTTPSignatureAuth()` +constructor as bytes in the PEM format: + +``` + with open('key.pem', 'rb') as fh: + requests.get(url, auth=HTTPSignatureAuth(algorithm="rsa-sha256", key=fh.read(), key_id=preshared_key_id)) +``` + +When verifying, the `key_resolver()` callback should provide the public key as bytes in the PEM format as well. + +## Links + +* [IETF HTTP Signatures draft](https://tools.ietf.org/html/draft-richanna-http-message-signatures) +* [Project home page](https://dev.funkwhale.audio/funkwhale/requests-http-message-signatures) +* [Package distribution (PyPI)](https://pypi.org/project/requests-http-message-signatures/) +* [Based on requests-http-signature](https://github.com/pyauth/requests-http-signature) + +## Bugs + +Please report bugs, issues, feature requests, etc. on our [issue tracker](https://dev.funkwhale.audio/funkwhale/requests-http-message-signatures/-/issues). + +## License + +Licensed under the terms of the [Apache License, Version 2.0](http://www.apache.org/licenses/LICENSE-2.0). diff --git a/README.rst b/README.rst deleted file mode 100644 index ef9e294..0000000 --- a/README.rst +++ /dev/null @@ -1,84 +0,0 @@ -requests-http-message-signatures: A Requests auth module for HTTP Signature -================================================================== -**requests-http-message-signatures** is a `Requests <https://github.com/requests/requests>`_ `authentication plugin -<http://docs.python-requests.org/en/master/user/authentication/>`_ (``requests.auth.AuthBase`` subclass) implementing -the `IETF HTTP Signatures draft RFC <https://tools.ietf.org/html/draft-richanna-http-message-signatures>`_. It has no -required dependencies outside the standard library. If you wish to use algorithms other than HMAC (namely, RSA and -ECDSA algorithms specified in the RFC), there is an optional dependency on -`cryptography <https://pypi.python.org/pypi/cryptography>`_. - -Installation ------------- -:: - - $ pip install requests-http-message-signatures - -Usage ------ - -.. code-block:: python - - import requests - from requests_http_signature import HTTPSignatureAuth - - preshared_key_id = 'squirrel' - preshared_secret = 'monorail_cat' - url = 'http://example.com/path' - - requests.get(url, auth=HTTPSignatureAuth(key=preshared_secret, key_id=preshared_key_id)) - -By default, only the ``Date`` header is signed (as per the RFC) for body-less requests such as GET. The ``Date`` header -is set if it is absent. In addition, for requests with bodies (such as POST), the ``Digest`` header is set to the SHA256 -of the request body and signed (an example of this appears in the RFC). To add other headers to the signature, pass an -array of header names in the ``headers`` keyword argument. - -In addition to signing messages in the client, the class method ``HTTPSignatureAuth.verify()`` can be used to verify -incoming requests: - -.. code-block:: python - - def key_resolver(key_id, algorithm): - return 'monorail_cat' - - HTTPSignatureAuth.verify(request, key_resolver=key_resolver) - -Asymmetric key algorithms (RSA and ECDSA) -~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ -For asymmetric key algorithms, you should supply the private key as the ``key`` parameter to the ``HTTPSignatureAuth()`` -constructor as bytes in the PEM format: - -.. code-block:: python - - with open('key.pem', 'rb') as fh: - requests.get(url, auth=HTTPSignatureAuth(algorithm="rsa-sha256", key=fh.read(), key_id=preshared_key_id)) - -When verifying, the ``key_resolver()`` callback should provide the public key as bytes in the PEM format as well. - -Links ------ -* `IETF HTTP Signatures draft <https://tools.ietf.org/html/draft-richanna-http-message-signatures>`_ -* https://github.com/joyent/node-http-signature -* `Project home page (GitHub) - <https://dev.funkwhale.audio/funkwhale/requests-http-message-signatures>`_ -* `Documentation (Read the Docs) <https://requests-http-signature.readthedocs.io/en/latest/>`_ -* `Package distribution (PyPI) <https://pypi.python.org/pypi/requests-http-signature>`_ -* `Change log <https://github.com/kislyuk/requests-http-signature/blob/master/Changes.rst>`_ - -Bugs -~~~~ -Please report bugs, issues, feature requests, etc. on `GitHub <https://github.com/kislyuk/requests-http-signature/issues>`_. - -License -------- -Licensed under the terms of the `Apache License, Version 2.0 <http://www.apache.org/licenses/LICENSE-2.0>`_. - -.. image:: https://github.com/pyauth/requests-http-signature/workflows/Python%20package/badge.svg - :target: https://github.com/pyauth/requests-http-signature/actions -.. image:: https://codecov.io/github/kislyuk/requests-http-signature/coverage.svg?branch=master - :target: https://codecov.io/github/kislyuk/requests-http-signature?branch=master -.. image:: https://img.shields.io/pypi/v/requests-http-signature.svg - :target: https://pypi.python.org/pypi/requests-http-signature -.. image:: https://img.shields.io/pypi/l/requests-http-signature.svg - :target: https://pypi.python.org/pypi/requests-http-signature -.. image:: https://readthedocs.org/projects/requests-http-signature/badge/?version=latest - :target: https://requests-http-signature.readthedocs.org/ diff --git a/pyproject.toml b/pyproject.toml index 802038a..29c6ac6 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,9 +1,23 @@ [tool.poetry] name = "requests-http-message-signatures" -version = "0.3.0" -description = "" +version = "0.3.0-dev1" +description = "A request authentication plugin implementing IETF HTTP Message Signatures" +readme = "README.rst" +homepage = "https://dev.funkwhale.audio/funkwhale/requests-http-message-signatures" license = "Apache-2.0" -authors = ["Funkwhale Collective <maintainers@funkwhale.audio>"] +authors = ["Andrey Kislyuk", "Funkwhale Collective <maintainers@funkwhale.audio>"] +classifiers = [ + 'Intended Audience :: Developers', + 'License :: OSI Approved :: Apache Software License', + 'Operating System :: MacOS :: MacOS X', + 'Operating System :: POSIX', + 'Programming Language :: Python', + 'Programming Language :: Python :: 2.7', + 'Programming Language :: Python :: 3.3', + 'Programming Language :: Python :: 3.4', + 'Development Status :: 5 - Production/Stable', + 'Topic :: Software Development :: Libraries :: Python Modules' +] [tool.poetry.dependencies] python = "^3.7" -- GitLab