mirror of
https://github.com/zap-proto/py.git
synced 2026-10-30 15:04:09 +00:00
zeekay
eecd7a72c3
Faithful port of github.com/zap-proto/go/cap over the capabilities.zap
v1.1 schema. Signed, attenuable authority tokens that replace bearer JWTs.
- Cap zero-copy view + canonical_bytes (SPEC §3 signed scope) +
id = SHA-256(canonical_bytes || Sig) (SPEC §4). The canonical
construction reads Capability[0..164) verbatim from the wire and
recomputes the caveat section, so the signed bytes are byte-identical
to Go regardless of heap layout.
- Issuance/issue/attenuate enforce the SPEC §2.3 delegation gate at MINT
time (parent needs PERM_ATTENUATE or CapKind.DELEGATE), monotonic
permission narrowing, child.Issuer == parent.Holder, and
downward-only expiry — refuses to build a cap its own verifier rejects.
- Verifier.verify / verify_chain enforce the full §2.3 invariants:
monotonic perms, holder linkage, target invariance, root-has-zero-parent,
the delegation gate at verify time, and FAIL-CLOSED scheme dispatch
(reserved tag 0x00 and unknown tags refused before any hook is
consulted — never a silent downgrade).
- Revocation/revoke/verify_revocation, scheme-aware and fail-closed.
- Schemes: Ed25519 (mandatory bootstrap), ML-DSA-65 (FIPS 204),
secp256k1 ECDSA — all real and end-to-end verified. A missing backend
raises SchemeUnavailable (an UnhandledSchemeError), never a fabricated
signature or a True on unverified bytes.
Cross-language interop is pinned by tests/testdata/cap_go_kat.{hex,json}:
a Go-signed cap (fixed ed25519 seed) decodes in Python, recomputes the
same canonical bytes and CapID (7c94f5897ad74d44...655044ae), and
verifies True; a tampered variant verifies False; and a deterministic
Python re-issue is byte-identical to the Go wire bytes.
Wire/canonical/CapID paths are pure stdlib; signing needs [crypto].
48 cap tests mirror the Go cap_test.go + spec_test.go. Full gate green
(pytest 100, ruff, ruff format, mypy --strict). Version 1.2.0 -> 1.3.0.
2 lines
7.3 KiB
Plaintext
2 lines
7.3 KiB
Plaintext
5a4150000100000010000000820e000001000000000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f808182838485868788898a8b8c8d8e8f909192939495969798999a9b9c9d9e9f3097e2dee2cb4a34b53840cdb705aed71067c36f68db0e0f559c3f3fa043315f0f00000001000000000000000000000000000000000000000000000000000000000000000000000000f153650000000000943577000000005c0d000003000000ca98fb2a4d45a3f44e42282b1ef0b29feb9fc34ef4adbcabc705bed574830ff6afbffcc409ae76e1863e6c03ae013686c5a002df3f86f73775cd3b3748651c06000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000240000005a41500001000000100000002400000001000000080000000800000040420f0000000000240000005a4150000100000010000000240000000300000008000000080000003c0000000a000000260000005a41500001000000100000002600000004000000080000000a00000031302e302e302e302f38
|