REDbot

REDbot is lint for HTTP resources.

It checks HTTP resources for feature support and common protocol problems at the HTTP semantic and caching layers. You can use the public instance on https://redbot.org/, or you can install it locally.

Test

Contributing to REDbot

Your ideas, questions and other contributions are most welcome. See CONTRIBUTING.md for details.

Setting Up Your Own REDbot

Installation

REDbot requires a current version of Python.

The recommended method for installing REDbot is using pipx. To install the latest release, do:

pipx install redbot

Or, to use the most development version of REDbot, run:

pipx install git+https://github.com/mnot/redbot.git

Both of these methods will install the following programs into your pipx binary folder:

  • redbot - the command-line interface
  • redbot_daemon - Web interface as a standalone daemon

Running REDbot as a systemd Service

REDbot can run as a standalone service, managed by systemd. This offers a degree of sandboxing and resource management, process monitoring (including a watchdog function), and a timer that garbage-collects saved tests.

See extra/README.md for the sample units and step-by-step setup.

Running REDbot in a Container

OCI-compliant containers are available on Github, and it's easy to run REDbot one using a tool like Docker or Podman. For example:

docker run --rm -p 8000:8000 ghcr.io/mnot/redbot

or

podman run --rm -p 8000:8000 ghcr.io/mnot/redbot

Web Bot Auth

REDbot can authenticate its outgoing requests using Web Bot Auth, which signs requests with an Ed25519 key using HTTP Message Signatures (RFC 9421). This lets origins verify that requests genuinely come from your REDbot instance. The implementation follows the IETF drafts and is not specific to any one verifier.

Requests are sent unsigned by default. REDbot only attaches a signature when the origin challenges for one -- that is, when it returns a 401, 403, or 429 response carrying an Accept-Signature header -- and then transparently retries the request signed. This avoids advertising the bot's identity to servers that don't ask for it.

Generating a key

Create an Ed25519 private key in PEM form:

> openssl genpkey -algorithm ed25519 -out web-bot-auth-key.pem

Keep this file private and readable by the REDbot process. The matching public key is published automatically (see below); you do not need to extract it yourself.

Configuring

Set these in config.txt (for redbot_daemon):

web_bot_auth_key = /path/to/web-bot-auth-key.pem
web_bot_auth_directory = https://your-redbot.example

web_bot_auth_directory is the HTTPS origin where your public key directory is hosted. When you run redbot_daemon, it serves that directory at /.well-known/http-message-signatures-directory (a JWKS, self-signed per the spec), so a verifier can fetch your public key. Make sure that path is reachable at the origin you configured.

web_bot_auth_directory is optional: if you omit it, REDbot uses the origin of ui_uri. Because ui_uri defaults to https://redbot.org/, enabling signing requires ui_uri to be set to your instance's real public origin — otherwise you would publish the wrong bot identity. Set web_bot_auth_directory explicitly if your key directory lives on a different origin than the UI.

For the command-line tool, pass the equivalent flags (there is no ui_uri, so the directory is required):

> redbot --web-bot-auth-key web-bot-auth-key.pem --web-bot-auth-directory https://your-redbot.example https://example.com/

Registering with a verifier

To be recognised by a specific verifier, register your directory URL with them according to their process.

Credits

Icons by Font Awesome. REDbot includes code from tippy.js and prettify.js.

Project links

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Latest release

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for mnot from gravatar.com mnot

Credits

Author: Mark Nottingham

License expression

MIT
View SPDX License List

Requires

Python >=3.9

Provides Extra

systemd dev i18n

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

redbot-2.6.1.tar.gz (339.6 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

redbot-2.6.1-py3-none-any.whl (374.9 kB view details)

Uploaded Python 3

File details

Details for the file redbot-2.6.1.tar.gz.

File metadata

  • Download URL: redbot-2.6.1.tar.gz
  • Upload date:
  • Size: 339.6 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.14

File hashes

Hashes for redbot-2.6.1.tar.gz
Algorithm Hash digest
SHA256 4d3c50f98043f38a565ebb3e1efba786ca025838317614cb47453997fbb446dd
MD5 28ed98e40cd79dfd51277d24870ef7e0
BLAKE2b-256 a5f944cc1e6f8196924d3b51e9a5f7ecf1bd697b5f78f588a0335015dcba29a1

See more details on using hashes here.

Provenance

The following attestation bundles were made for redbot-2.6.1.tar.gz:

Publisher: publish.yml on mnot/redbot

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file redbot-2.6.1-py3-none-any.whl.

File metadata

  • Download URL: redbot-2.6.1-py3-none-any.whl
  • Upload date:
  • Size: 374.9 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.13.14

File hashes

Hashes for redbot-2.6.1-py3-none-any.whl
Algorithm Hash digest
SHA256 7c7991d26492804689c35affeb78fa30ea2488d60e61e3d521ec53ce96f7c176
MD5 5769efb2dd6afbf22eb206a7461d014e
BLAKE2b-256 40a711c4560ba5032bfdcb6f71c2953815c952e4bd6db2ae291108c379276846

See more details on using hashes here.

Provenance

The following attestation bundles were made for redbot-2.6.1-py3-none-any.whl:

Publisher: publish.yml on mnot/redbot

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

This release

2.6.1 This release

2 files

2.6.0

2 files

2.5.1

2 files

2.5.0

2 files

2.4.2

2 files

2.4.1

2 files

2.4.0

2 files

2.3.12

2 files

2.3.11

2 files

2.3.10

2 files

2.3.9

2 files

2.3.8

2 files

2.3.7

2 files

2.3.6

2 files

2.3.5

2 files

2.3.4

2 files

2.3.3

2 files

2.3.2

2 files

2.3.1

2 files

2.3.0

2 files

2.2.4

2 files

2.2.3

2 files

2.2.2

2 files

2.2.1

2 files

2.2.0

2 files

2.1.11

2 files

2.1.10

2 files

2.1.9

2 files

2.1.8

2 files

2.1.6

2 files

2.1.5

2 files

2.1.4

2 files

2.1.3

2 files

2.1.2

2 files

2.1.1

2 files

2.1.0

2 files

2.0.16

2 files

2.0.15

2 files

2.0.14

2 files

2.0.13

2 files

2.0.12

2 files

2.0.11

2 files

2.0.10

2 files

2.0.9

2 files

2.0.8

2 files

2.0.7

2 files

2.0.6

2 files

2.0.5

2 files

2.0.4

2 files

2.0.3

2 files

2.0.2

2 files

2.0.1

2 files

2.0.0

2 files

1.5

2 files

1.1

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page