diff --git a/.DEBIAN/requirements-bookworm-12.txt b/.DEBIAN/requirements-bookworm-12.txt index c3fe52e..2e3e4a3 100644 --- a/.DEBIAN/requirements-bookworm-12.txt +++ b/.DEBIAN/requirements-bookworm-12.txt @@ -1,7 +1,7 @@ # https://packages.debian.org/hu/ fastapi==0.92.0 uvicorn[standard]==0.17.6 -python-jose[cryptography]==3.3.0 +josepy==2.0.0 cryptography==38.0.4 python-dateutil==2.8.2 sqlalchemy==1.4.46 diff --git a/.DEBIAN/requirements-ubuntu-24.04.txt b/.DEBIAN/requirements-ubuntu-24.04.txt index 0ba3025..bc267ea 100644 --- a/.DEBIAN/requirements-ubuntu-24.04.txt +++ b/.DEBIAN/requirements-ubuntu-24.04.txt @@ -1,7 +1,7 @@ # https://packages.ubuntu.com fastapi==0.101.0 uvicorn[standard]==0.27.1 -python-jose[cryptography]==3.3.0 +josepy==2.0.0 cryptography==41.0.7 python-dateutil==2.8.2 sqlalchemy==1.4.50 diff --git a/.DEBIAN/requirements-ubuntu-24.10.txt b/.DEBIAN/requirements-ubuntu-24.10.txt index 59f9361..47026e0 100644 --- a/.DEBIAN/requirements-ubuntu-24.10.txt +++ b/.DEBIAN/requirements-ubuntu-24.10.txt @@ -1,7 +1,7 @@ # https://packages.ubuntu.com fastapi==0.110.3 uvicorn[standard]==0.30.3 -python-jose[cryptography]==3.3.0 +josepy==2.0.0 cryptography==42.0.5 python-dateutil==2.9.0 sqlalchemy==2.0.32 diff --git a/.PKGBUILD/PKGBUILD b/.PKGBUILD/PKGBUILD index 0d83324..865baf9 100644 --- a/.PKGBUILD/PKGBUILD +++ b/.PKGBUILD/PKGBUILD @@ -8,7 +8,7 @@ pkgdesc='NVIDIA DLS server implementation with FastAPI' arch=('any') url='https://git.collinwebdesigns.de/oscar.krause/fastapi-dls' license=('MIT') -depends=('python' 'python-jose' 'python-starlette' 'python-httpx' 'python-fastapi' 'python-dotenv' 'python-dateutil' 'python-sqlalchemy' 'python-cryptography' 'uvicorn' 'python-markdown' 'openssl') +depends=('python' 'python3-josepy' 'python-starlette' 'python-httpx' 'python-fastapi' 'python-dotenv' 'python-dateutil' 'python-sqlalchemy' 'python-cryptography' 'uvicorn' 'python-markdown' 'openssl') provider=("$pkgname") install="$pkgname.install" backup=('etc/default/fastapi-dls') diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index c6d3e33..8531c6c 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -172,12 +172,12 @@ test:apt: parallel: matrix: - IMAGE: - # - debian:trixie-slim # EOL: t.b.a.; "python3-jose" not available, but "python3-josepy" - - debian:bookworm-slim # EOL: June 06, 2026 + - debian:trixie-slim # EOL: t.b.a.; "python3-jose" not available, but "python3-josepy" - debian:bookworm-slim # EOL: June 06, 2026 + - debian:bullseye-slim # EOL: June 06, 2026 - ubuntu:24.04 # EOL: April 2036 - # - ubuntu:24.10 # EOL: t.b.a.; "python3-jose" not available, but "python3-josepy" - # - ubuntu:25.04 # EOL: t.b.a.; "python3-jose" not available, but "python3-josepy" + - ubuntu:24.10 # EOL: t.b.a.; "python3-jose" not available, but "python3-josepy" + - ubuntu:25.04 # EOL: t.b.a.; "python3-jose" not available, but "python3-josepy" needs: - job: build:apt artifacts: true diff --git a/README.md b/README.md index 0b7457f..d059592 100644 --- a/README.md +++ b/README.md @@ -336,10 +336,7 @@ Successful tested with (**LTS Version**): Not working with: -- Debian 11 (Bullseye) and lower (missing `python-jose` dependency) -- Debian 13 (Trixie) (missing `python-jose` dependency) - Ubuntu 22.04 (Jammy Jellyfish) (not supported as for 15.01.2023 due to [fastapi - uvicorn version missmatch](https://bugs.launchpad.net/ubuntu/+source/fastapi/+bug/1970557)) -- Ubuntu 24.10 (Oracular Oriole) (missing `python-jose` dependency) **Run this on your server instance** diff --git a/app/main.py b/app/main.py index 13dd5a9..8b2a80e 100644 --- a/app/main.py +++ b/app/main.py @@ -15,8 +15,7 @@ from dotenv import load_dotenv from fastapi import FastAPI from fastapi.requests import Request from fastapi.responses import Response, RedirectResponse, StreamingResponse -from jose import jws, jwk, jwt, JWTError -from jose.constants import ALGORITHMS +from josepy import jws, jwk, RS256 from sqlalchemy import create_engine from sqlalchemy.orm import sessionmaker from starlette.middleware.cors import CORSMiddleware @@ -63,8 +62,8 @@ my_si_certificate = Cert.from_file(ca_setup.si_certificate_filename) my_si_private_key = PrivateKey.from_file(ca_setup.si_private_key_filename) my_si_public_key = my_si_private_key.public_key() -jwt_encode_key = jwk.construct(my_si_private_key.pem(), algorithm=ALGORITHMS.RS256) -jwt_decode_key = jwk.construct(my_si_private_key.public_key().pem(), algorithm=ALGORITHMS.RS256) +jwt_encode_key = jwk.JWK.load(my_si_private_key.pem()) +jwt_decode_key = jwk.JWK.load(my_si_private_key.public_key().pem()) # Logging LOG_LEVEL = logging.DEBUG if DEBUG else logging.INFO @@ -114,7 +113,11 @@ app.add_middleware( def __get_token(request: Request) -> dict: authorization_header = request.headers.get('authorization') token = authorization_header.split(' ')[1] - return jwt.decode(token=token, key=jwt_decode_key, algorithms=ALGORITHMS.RS256, options={'verify_aud': False}) + + # return jwt.decode(token=token, key=jwt_decode_key, algorithms=ALGORITHMS.RS256, options={'verify_aud': False}) + _ = jws.Signature() + _.verify(payload=token.encode('utf-8'), key=jwt_decode_key) + return _.to_partial_json() # Endpoints @@ -295,9 +298,12 @@ async def _client_token(): }, } - content = jws.sign(payload, key=jwt_encode_key, headers=None, algorithm=ALGORITHMS.RS256) + # content = jws.sign(payload, key=jwt_encode_key, headers=None, algorithm=ALGORITHMS.RS256) + payload = json_dumps(payload).encode('utf-8') + content = jws.Signature.sign(payload=payload, key=jwt_encode_key, alg=RS256, include_jwk=False) - response = StreamingResponse(iter([content]), media_type="text/plain") + # response = StreamingResponse(iter([content]), media_type="text/plain") + response = StreamingResponse(iter(content), media_type="text/plain") filename = f'client_configuration_token_{datetime.now().strftime("%d-%m-%y-%H-%M-%S")}.tok' response.headers["Content-Disposition"] = f'attachment; filename={filename}' @@ -386,7 +392,9 @@ async def auth_v1_code(request: Request): 'kid': SITE_KEY_XID } - auth_code = jws.sign(payload, key=jwt_encode_key, headers={'kid': payload.get('kid')}, algorithm=ALGORITHMS.RS256) + # auth_code = jws.sign(payload, key=jwt_encode_key, headers={'kid': payload.get('kid')}, algorithm=ALGORITHMS.RS256) + payload = json_dumps(payload).encode('utf-8') + auth_code = jws.Signature.sign(payload=payload, key=jwt_encode_key, alg=RS256, include_jwk=True) response = { "auth_code": auth_code, diff --git a/requirements.txt b/requirements.txt index 96cf81d..e3a0fca 100644 --- a/requirements.txt +++ b/requirements.txt @@ -1,6 +1,6 @@ fastapi==0.115.12 uvicorn[standard]==0.34.2 -python-jose[cryptography]==3.4.0 +josepy==2.0.0 cryptography==44.0.3 python-dateutil==2.9.0 sqlalchemy==2.0.41