Fix environment password encoding in SignOrchestrator init

Previously, the `PKCS12_PASSWORD` environment variable was used directly, which could lead to issues when it was not set. This change ensures the password is properly encoded when provided and defaults to `None` if not set.

local.env.dist

@@ -5,3 +5,6 @@ TIMESTAMP_URL=http://freetsa.org/tsr
 QUEUE_IN=to_python_sign
 EXCHANGE_OUT=signed_docs
 OUT_ROUTING_KEY=signed_doc
+TSA_CONFIG_PATH=/home/julien/dev/chill/sign-pdf-worker/ts-authority/rootca.conf
+TSA_CERT_CHAIN=/home/julien/dev/chill/sign-pdf-worker/ts-authority/ca/tsa-chain.pem
+TSA_KEY_PASSWORD=5678

pythonProject/sign.py

@@ -4,11 +4,10 @@ from typing import Optional
 
 from pyhanko import stamp
 from pyhanko.pdf_utils.incremental_writer import IncrementalPdfFileWriter
-from pyhanko.sign import signers, timestamps, fields
-from pyhanko_certvalidator import ValidationContext
+from pyhanko.sign import signers, fields
 from typing_extensions import Buffer
 
-from pythonProject.timestamp import LocalOpensslTimestamp
+from timestamp import LocalOpensslTimestamp
 
 
 class SignOrchestrator:

pythonProject/worker.py

@@ -12,7 +12,7 @@ logging.basicConfig(level=logging.INFO, format=LOG_FORMAT)
 LOGGER = logging.getLogger(__name__)
 LOGGER.setLevel(os.environ.get('LOG_LEVEL', logging.INFO))
 
-for v in ['AMQP_URL', 'PKCS12_PATH', 'TIMESTAMP_URL', 'QUEUE_IN', 'EXCHANGE_OUT', 'OUT_ROUTING_KEY']:
+for v in ['AMQP_URL', 'PKCS12_PATH', 'QUEUE_IN', 'EXCHANGE_OUT', 'OUT_ROUTING_KEY', 'TSA_CONFIG_PATH', 'TSA_CERT_CHAIN', 'TSA_KEY_PASSWORD']:
     if v not in os.environ:
         LOGGER.error('Missing environment variable: %s', v)
         raise ValueError('Missing environment variable: ' + v)
@@ -26,7 +26,7 @@ TSA_CONFIG_PATH = os.environ.get('TSA_CONFIG_PATH')
 TSA_CERT_CHAIN = os.environ.get('TSA_CERT_CHAIN')
 TSA_KEY_PASSWORD = os.environ.get('TSA_KEY_PASSWORD')
 
-orchestrator = sign.SignOrchestrator(PKCS12_PATH, TSA_CONFIG_PATH, TSA_KEY_PASSWORD, TSA_CERT_CHAIN, pkcs12_password=os.environ.get('PKCS12_PASSWORD', None))
+orchestrator = sign.SignOrchestrator(PKCS12_PATH, TSA_CONFIG_PATH, TSA_KEY_PASSWORD, TSA_CERT_CHAIN, pkcs12_password=None if os.environ.get('PKCS12_PASSWORD', None) is None else os.environ.get('PKCS12_PASSWORD').encode())
 
 parameters = pika.URLParameters(DSN)
 connection = pika.BlockingConnection(parameters)
@@ -76,6 +76,7 @@ def on_message(channel, method_frame, header_frame, body):
         else:
             LOGGER.warning(f"first try failed, signatureId: {body_content['signatureId']}")
             channel.basic_ack(delivery_tag=method_frame.delivery_tag)
+        raise e
 
 
 if __name__ == '__main__':

ts-authority/README.md

@@ -152,7 +152,7 @@ openssl ts -verify -data /etc/hosts -in /tmp/response.tsr -CAfile ca/root-ca.pem
 ```
 
 
-# Préparation pour Vendée
+# Préparation à partir d'un certificat d'horodatage au format pkcs12
 
 ## Extraire les infos