Sunil Mohan Adapa b64ea720fc
sso: Switch using cryptography module instead of OpenSSL.crypto
Closes: Debian bug #1088760.

- OpenSSL.crypto.sign has been deprecated and in the current version of
python3-openssl in Debian testing, it has been dropped. The recommended
alternative is cryptography.hazmat.primitives. So, use this instead.

- The entire OpenSSL.crypto module is planned to be deprecated in the future.
So, stop using it entirely by using cryptography.hazmat.primitives.

- sso app does not use openssl anymore, so drop dependency on it. Other apps
such as Let's Encrypt do depend on it and but they have their own dependency
declared. The freedombox package on the overall retains on 'openssl' package.

- We are not using the python OpenSSL module anywhere else, so drop dependency
on it.

- Use pathlib to simplify some code.

- Ensure proper permissions on private and public keys as they are being written
to.

Tests:

- Freshly setup container and ensure that first run succeeds. Permission on the
public/private key files and the parent directly are correct. Users are able
login to FreedomBox. SSO works when accessing apps such as transmission.

- Without patches, setup freedombox container. Apply patches. Permission for
keys directory is updated but keys are not overwritten. Login to FreedomBox
works. SSO works when accessing apps such as transmission.

- Run code to perform signatures using old code and ensure that newer code
generates bit-identical signatures.

- Running ./run --list-dependencies show 'openssl' and python3-cryptography.

- Running unit tests works.

- Building debian package works.

Signed-off-by: Sunil Mohan Adapa <sunil@medhas.org>
Reviewed-by: Joseph Nuthalapati <njoseph@riseup.net>
2024-12-14 23:41:13 +05:30
..

.. SPDX-License-Identifier: CC-BY-SA-4.0

Editing the Developer Documentation
===================================

About
*****

The doc/dev directory in FreedomBox repository contains the FreedomBox Developer
Manual. Specifically the tutorial for writing new applications and API reference
for writing apps for FreedomBox. It is kept as part of the main FreedomBox
source code with the expectation that when the API changes the developer
documentation is also updated in the same patch set.

Setup on Debian
***************

Install the following Debian packages:

* python3-sphinx
* python3-sphinx-autobuild
* python3-django
* python3-django-axes
* python3-django-captcha
* python3-django-ipware
* python3-django-stronghold

If your preferred text editor doesn't have support for the reStructuredText
format, you can install a simple desktop application called ReText. It has live
preview support with split panes.

Viewing changes live in your browser
************************************

You do not need the virtual machine used for FreedomBox development running to
edit this documentation.

Run `make livehtml` from the current directory in the host machine. Visit
http://127.0.0.1:8000 to view the changes live in your browser as you edit the
.rst files in this directory. Your browser reloads the page automatically each
time you save an .rst file in the documentation.