{"id":18171572,"url":"https://github.com/avishayil/cf-signer","last_synced_at":"2025-04-01T14:32:34.011Z","repository":{"id":44688524,"uuid":"379207089","full_name":"avishayil/cf-signer","owner":"avishayil","description":"Tool for signing and verifying the integrity of CloudFormation templates","archived":false,"fork":false,"pushed_at":"2023-02-16T21:20:21.000Z","size":49,"stargazers_count":15,"open_issues_count":0,"forks_count":3,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-15T13:34:48.363Z","etag":null,"topics":["aws","cloudformation","integrity","security","signing"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/avishayil.png","metadata":{"files":{"readme":"README.rst","changelog":"HISTORY.rst","contributing":"CONTRIBUTING.rst","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-06-22T09:05:43.000Z","updated_at":"2023-02-20T08:31:38.000Z","dependencies_parsed_at":"2022-09-05T08:02:08.073Z","dependency_job_id":null,"html_url":"https://github.com/avishayil/cf-signer","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/avishayil%2Fcf-signer","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/avishayil%2Fcf-signer/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/avishayil%2Fcf-signer/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/avishayil%2Fcf-signer/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/avishayil","download_url":"https://codeload.github.com/avishayil/cf-signer/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246604610,"owners_count":20804100,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","cloudformation","integrity","security","signing"],"created_at":"2024-11-02T15:09:17.627Z","updated_at":"2025-04-01T14:32:33.691Z","avatar_url":"https://github.com/avishayil.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"==========================================\nCF-Signer - CloudFormation Signing Utility\n==========================================\n\n\n.. image:: https://img.shields.io/pypi/v/cf-signer.svg\n        :target: https://pypi.python.org/pypi/cf-signer\n\n.. image:: https://img.shields.io/travis/avishayil/cf-signer.svg\n        :target: https://travis-ci.com/avishayil/cf-signer\n\n.. image:: https://readthedocs.org/projects/cf-signer/badge/?version=latest\n        :target: https://cf-signer.readthedocs.io/en/latest/?version=latest\n        :alt: Documentation Status\n\n\n\n\nTool for signing and verifying the integrity of CloudFormation templates\n\n\n* Free software: MIT license\n* Documentation: https://cf-signer.readthedocs.io.\n\n\nFeatures\n--------\n\n* Signing CloudFormation templates by creating a sha256 hash of the file, encrypted with the user's private key and store base64 form of the signature in the CloudFormation template ``Metadata`` section.\n* Verifying the integrity of CloudFormation templates by looking for the signature in the ``Metadata``, extracting it and verifying.\n* Currently support ``JSON`` templates only. If you need to convert your template from ``YAML`` format, take a look on the CloudFormation Designer conversion or use a 3rd party utility.\n\nUsage\n-----\n\nInstallation\n============\nTo install ``cf-signer``, run this command in your terminal::\n\n  pip install cf-signer\n\nPreparation\n===========\n\nFirst, the utility provides the ``prepare`` functionality that does the following:\n\n* Reading your template ``JSON`` file\n\n* Converting the template to Python dictionary object.\n\n* Converting the Python dictionary object back to a ``JSON`` file.\n\nThis is done to ensure that the tool will not tamper the template contents during the signing process.\n\nTo prepare a CloudFormation template to the signing process::\n\n  cf_signer --prepare --template cf.template\n\nThis will create a ``cf-prepared.template`` file you can sign using the ``cf-signer`` tool.\n\nGetting Started\n===============\n\nTo sign a CloudFormation template using the ``cf-signer`` tool::\n\n  cf_signer --sign --template cf.template --key key.pem\n\nTo verify a signature of a CloudFormation template using the ``cf-signer`` tool::\n\n  cf_signer --verify --template cf-signed.template --key pubkey.pem\n\nYou can also use ``cf_signer`` in your ``Python`` code to sign templates on your scripts:\n\n.. code-block:: python\n\n  from cf_signer.cf_signer import create_signature, verify_signature, prepare_template\n\n  def main():\n      prepare_result = prepare_template(target_file_path='tests/cf-unprepared.template')\n      sign_result = create_signature(target_file_path='tests/cf.template', key_file_path='tests/key.pem')\n      verify_result = verify_signature(target_file_path='tests/cf-signed.template', key_file_path='tests/pubkey.pem')\n\nSigning Flow\n~~~~~~~~~~~~\n\nThe process of signing is based on the following flow:\n\n* Generate RSA private key::\n\n    openssl genrsa -out key.pem 2048\n\n* Get public key from the RSA generated private key::\n\n    openssl rsa -in key.pem -outform PEM -pubout -out pubkey.pem\n\n* Create a sha256 hash signature, encrypted with the private key::\n\n    openssl dgst -sha256 -sign key.pem -out sign.sha256 cf.template\n\n* Convert the signature to base64 string::\n\n    base64 -i sign.sha256 -o sign.b64\n\n* Attach the base64 signature to the CloudFormation template, under the ``Metadata`` block (creating one if it doesn't exist).\n\nVerification Flow\n~~~~~~~~~~~~~~~~~\n\nThe process of signature verification is based on the following flow:\n\n* Detach the signature from the CloudFormation template\n\n* Convert the base64 detached signature string to binary format::\n\n    base64 -d sign.b64 \u003e sign.sha256\n\n* Validate the signature using the public key::\n\n    openssl dgst -sha256 -verify pubkey.pem -signature sign.sha256 cf.template\n\nCredits\n-------\n\n* The signing and verification process was inspired by `sgershtein/SignedJSON`_.\n\n* This package was created with Cookiecutter_ and the `audreyr/cookiecutter-pypackage`_ project template.\n\n.. _`sgershtein/SignedJSON`: https://github.com/sgershtein/SignedJSON\n.. _Cookiecutter: https://github.com/audreyr/cookiecutter\n.. _`audreyr/cookiecutter-pypackage`: https://github.com/audreyr/cookiecutter-pypackage\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Favishayil%2Fcf-signer","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Favishayil%2Fcf-signer","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Favishayil%2Fcf-signer/lists"}