diff --git a/.github/docker-compose.platform.yaml b/.github/docker-compose.platform.yaml index 67d82e2..297efd2 100644 --- a/.github/docker-compose.platform.yaml +++ b/.github/docker-compose.platform.yaml @@ -129,15 +129,15 @@ services: KC_HTTPS_CLIENT_AUTH: "request" ### # The following environment variable resolves SIGILL with Code 134 when running Java processes on Apple M4 chips - # + # # On Apple Silicon (M4 chip): # export JAVA_OPTS_APPEND="-XX:UseSVE=0" # docker-compose up - # + # # On other architectures: # export JAVA_OPTS_APPEND="" # docker-compose up - # + # # Or set directly: JAVA_OPTS_APPEND="-XX:UseSVE=0" docker-compose up JAVA_OPTS_APPEND: "${JAVA_OPTS_APPEND:-}" ### @@ -149,21 +149,21 @@ services: test: - CMD-SHELL - | - [ -f /tmp/HealthCheck.java ] || echo "public class HealthCheck { - public static void main(String[] args) throws java.lang.Throwable { - javax.net.ssl.HttpsURLConnection.setDefaultHostnameVerifier((hostname, session) -> true); - javax.net.ssl.SSLContext sc = javax.net.ssl.SSLContext.getInstance(\"SSL\"); - sc.init(null, new javax.net.ssl.TrustManager[]{ - new javax.net.ssl.X509TrustManager() { - public java.security.cert.X509Certificate[] getAcceptedIssuers() { return null; } - public void checkClientTrusted(java.security.cert.X509Certificate[] certs, String authType) {} - public void checkServerTrusted(java.security.cert.X509Certificate[] certs, String authType) {} - } - }, new java.security.SecureRandom()); - javax.net.ssl.HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory()); - java.net.HttpURLConnection conn = (java.net.HttpURLConnection)new java.net.URL(args[0]).openConnection(); - System.exit(java.net.HttpURLConnection.HTTP_OK == conn.getResponseCode() ? 0 : 1); - } + [ -f /tmp/HealthCheck.java ] || echo "public class HealthCheck { + public static void main(String[] args) throws java.lang.Throwable { + javax.net.ssl.HttpsURLConnection.setDefaultHostnameVerifier((hostname, session) -> true); + javax.net.ssl.SSLContext sc = javax.net.ssl.SSLContext.getInstance(\"SSL\"); + sc.init(null, new javax.net.ssl.TrustManager[]{ + new javax.net.ssl.X509TrustManager() { + public java.security.cert.X509Certificate[] getAcceptedIssuers() { return null; } + public void checkClientTrusted(java.security.cert.X509Certificate[] certs, String authType) {} + public void checkServerTrusted(java.security.cert.X509Certificate[] certs, String authType) {} + } + }, new java.security.SecureRandom()); + javax.net.ssl.HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory()); + java.net.HttpURLConnection conn = (java.net.HttpURLConnection)new java.net.URL(args[0]).openConnection(); + System.exit(java.net.HttpURLConnection.HTTP_OK == conn.getResponseCode() ? 0 : 1); + } }" > /tmp/HealthCheck.java && java ${JAVA_OPTS_APPEND} /tmp/HealthCheck.java http://localhost:8888/auth 2>/dev/null interval: 10s timeout: 10s @@ -238,7 +238,7 @@ services: ln -sf /configs/service/internal/fixtures ./service restart: "no" - # Add sample attributes and metadata + # Add sample attributes and metadata platform-provision-fixtures: image: registry.opentdf.io/platform:${PLATFORM_VERSION} command: ["provision", "fixtures", "--config-file", "/configs/opentdf.yaml"] @@ -390,13 +390,13 @@ services: URL='https://raw.githubusercontent.com/opentdf/platform/main/service/cmd/keycloak_data.yaml' OUTPUT='/configs/keycloak_data.yaml' MAX_ATTEMPTS=3 - + for i in $$(seq 1 $$MAX_ATTEMPTS); do echo "Attempt $$i of $$MAX_ATTEMPTS: Downloading keycloak_data.yaml..." - + if wget -O "$$OUTPUT" "$$URL"; then echo "Download successful" - + # Validate the downloaded file if [ -f "$$OUTPUT" ] && [ -s "$$OUTPUT" ]; then if head -1 "$$OUTPUT" | grep -q -E '^(---|\w+:)'; then @@ -412,13 +412,13 @@ services: else echo "Download failed (attempt $$i)" fi - + if [ $$i -lt $$MAX_ATTEMPTS ]; then echo "Retrying in 2 seconds..." sleep 2 fi done - + echo "ERROR: Failed to download and validate keycloak_data.yaml after $$MAX_ATTEMPTS attempts" exit 1 restart: "no" @@ -449,13 +449,13 @@ services: URL='https://raw.githubusercontent.com/opentdf/platform/main/.github/scripts/init-temp-keys.sh' OUTPUT='/configs/init-temp-keys.sh' MAX_ATTEMPTS=3 - + for i in $$(seq 1 $$MAX_ATTEMPTS); do echo "Attempt $$i of $$MAX_ATTEMPTS: Downloading init-temp-keys.sh..." - + if wget -O "$$OUTPUT" "$$URL"; then echo "Download successful" - + # Validate the downloaded file if [ -f "$$OUTPUT" ] && [ -s "$$OUTPUT" ]; then if head -1 "$$OUTPUT" | grep -q '^#!/'; then @@ -471,13 +471,13 @@ services: else echo "Download failed (attempt $$i)" fi - + if [ $$i -lt $$MAX_ATTEMPTS ]; then echo "Retrying in 2 seconds..." sleep 2 fi done - + echo "ERROR: Failed to download and validate init-temp-keys.sh after $$MAX_ATTEMPTS attempts" exit 1 restart: "no" @@ -499,31 +499,31 @@ services: - | apk add --no-cache openssl openjdk11-jre bash cd /keys - + # Generate KAS RSA private key openssl genpkey -algorithm RSA -out /keys/kas-private.pem -pkeyopt rsa_keygen_bits:2048 openssl rsa -in /keys/kas-private.pem -pubout -out /keys/kas-cert.pem - + # Generate ECC Key openssl ecparam -name prime256v1 > /tmp/ecparams.tmp openssl req -x509 -nodes -newkey ec:/tmp/ecparams.tmp -subj "/CN=kas" -keyout /keys/kas-ec-private.pem -out /keys/kas-ec-cert.pem -days 365 - + # Generate CA openssl req -x509 -nodes -newkey RSA:2048 -subj "/CN=ca" -keyout /keys/keycloak-ca-private.pem -out /keys/keycloak-ca.pem -days 365 - + # Generate localhost certificate printf "subjectAltName=DNS:localhost,IP:127.0.0.1" > /tmp/sanX509.conf printf "[req]\ndistinguished_name=req_distinguished_name\n[req_distinguished_name]\n[alt_names]\nDNS.1=localhost\nIP.1=127.0.0.1" > /tmp/req.conf openssl req -new -nodes -newkey rsa:2048 -keyout /keys/localhost.key -out /tmp/localhost.req -batch -subj "/CN=localhost" -config /tmp/req.conf openssl x509 -req -in /tmp/localhost.req -CA /keys/keycloak-ca.pem -CAkey /keys/keycloak-ca-private.pem -CAcreateserial -out /keys/localhost.crt -days 3650 -sha256 -extfile /tmp/sanX509.conf - + # Generate sample user certificate openssl req -new -nodes -newkey rsa:2048 -keyout /keys/sampleuser.key -out /tmp/sampleuser.req -batch -subj "/CN=sampleuser" openssl x509 -req -in /tmp/sampleuser.req -CA /keys/keycloak-ca.pem -CAkey /keys/keycloak-ca-private.pem -CAcreateserial -out /keys/sampleuser.crt -days 3650 - + # Convert to PKCS12 openssl pkcs12 -export -in /keys/keycloak-ca.pem -inkey /keys/keycloak-ca-private.pem -out /keys/ca.p12 -nodes -passout pass:password - + # Convert PKCS12 to JKS using keytool (no Docker needed) keytool -importkeystore \ -srckeystore /keys/ca.p12 \ @@ -533,7 +533,7 @@ services: -srcstorepass "password" \ -deststorepass "password" \ -noprompt - + echo "Keys generated successfully" environment: JAVA_OPTS_APPEND: "${JAVA_OPTS_APPEND:-}" diff --git a/packages/otdf-python/src/otdf_python/sdk.py b/packages/otdf-python/src/otdf_python/sdk.py index 63e7ad4..2980d6b 100644 --- a/packages/otdf-python/src/otdf_python/sdk.py +++ b/packages/otdf-python/src/otdf_python/sdk.py @@ -365,22 +365,23 @@ def is_tdf(data: bytes | BinaryIO) -> bool: bool: True if the data is a TDF, False otherwise """ - import json import zipfile from io import BytesIO - from otdf_python.tdf_reader import resolve_manifest_name, resolve_payload_name + from otdf_python.tdf_reader import ( + payload_url_from_manifest_json, + resolve_manifest_name, + resolve_payload_name, + ) try: file_like = BytesIO(data) if isinstance(data, bytes | bytearray) else data with zipfile.ZipFile(file_like) as zf: names = zf.namelist() manifest_name = resolve_manifest_name(names) - manifest = json.loads(zf.read(manifest_name)) - payload = ( - manifest.get("payload") if isinstance(manifest, dict) else None + url = payload_url_from_manifest_json( + zf.read(manifest_name).decode("utf-8") ) - url = payload.get("url") if isinstance(payload, dict) else None resolve_payload_name(url, names) return True except Exception: