sign-xpi-lib
A library to handle the manipulations of signing XPIs at Mozilla.
Free software: MIT license
Documentation: https://sign-xpi-lib.readthedocs.io.
Overview
Information about how XPI signing works in Firefox can be found at the Mozilla wiki.
A tool that generates PKCS7 signatures in the correct format is autograph, which see for more information.
This library is used by the sign-xpi lambda, but can be used by other clients too.
Usage:
from sign_xpi_lib import XPIFile
x = XPIFile('hypothetical-addon-unsigned.xpi')
# this is the mozilla.sf file computed by hashing mozilla.rsa
signed_manifest = x.signed_manifest
print(signed_manifest)
# This probably talks to Autograph or an HSM or whatever
signature = 'generate-a-signature somehow'
x.make_signed('hypothetical-addon-signed.xpi', 'mozilla.rsa',
signed_manifest, signature)
See the tests for more details.
Credits
This package was created with Cookiecutter and the audreyr/cookiecutter-pypackage project template.
History
0.1.0 (2017-07-07)
First release on PyPI.
1 maintainer
Metadata
1 maintainer
Release files for sign-xpi-lib 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| sign-xpi-lib-0.1.0.tar.gz | 24.3 kB | Without provenance | Details for sign-xpi-lib-0.1.0.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| sign_xpi_lib-0.1.0-py2.py3-none-any.whl | Python 2, Python 3 | none | any | Details for sign_xpi_lib-0.1.0-py2.py3-none-any.whl |
Total release size: 32.1 kB
Release files / sign-xpi-lib-0.1.0.tar.gz
| Download URL | sign-xpi-lib-0.1.0.tar.gz |
|---|---|
| Size | 24.3 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
22ec00d91327085762089db0a6aeec941cf54428b7f4f996a068911807416d98
|
|
BLAKE2b-256 checksum How to use checksums |
2a9c7958274a43073f2fa4589cce478194ed456c07a625b43a5afc2d4bbc341e
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
Release files / sign_xpi_lib-0.1.0-py2.py3-none-any.whl
| Download URL | sign_xpi_lib-0.1.0-py2.py3-none-any.whl |
|---|---|
| Size | 7.8 kB |
| Tags | Python 2 Python 3 |
|
SHA-256 checksum How to use checksums |
00e16b22385e60e1b7253e090670254f455fe5012b986c964ff4ed5e4b57b640
|
|
BLAKE2b-256 checksum How to use checksums |
0310dc8507bab0debbd199c8739b83e1d26821bef879d61b2acd8f6b8ff5e647
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
Security for sign-xpi-lib 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
