feat: signed key directory, wingfoot register, and PyPI publishing - #1
Merged
Conversation
wingfoot's HTTP client went out as "Python-urllib/x.y", which Cloudflare and Akamai block outright as an unidentified bot. That made `wingfoot doctor` (and directory fetches) fail with 403 against real CDN-fronted sites before the tool could even prove its identity. Send "wingfoot/<version> (+repo)" by default, overridable via the headers argument. Covered by tests/test_http.py.
Cloudflare's verified-bot submission (Request Signature method) requires the
key directory RESPONSE to carry its own signature so nobody can mirror the
directory and register on your behalf (RFC 9421 directory draft §5.2).
Add:
- rfc9421.sign_directory / verify_directory: signature over ("@authority";req)
with tag="http-message-signatures-directory", alg="ed25519", label binding0.
Body-independent, so it can be pre-signed OFFLINE with a long expiry and served
as static headers, keeping the private key off the directory host.
- `wingfoot directory --sign`: emit the Signature-Input / Signature headers to host.
- doctor: new check that the served directory carries a valid signature.
Verified byte-exact against Cloudflare's live reference directory: a regression
test in test_directory_signing.py checks wingfoot verifies Cloudflare's own
signed directory with their published key.
…packets No verifier (Cloudflare, DataDome, ...) offers automated registration yet; each runs its own human-reviewed web form. `wingfoot register` shrinks that step to copy/paste: it preflights the hosted directory the way a reviewer would (reachable, publishes the key, response signed), then prints every answer the forms ask for, per provider. Supports --email, --user-agent, --open (launch the form), --no-check, and an optional provider filter. doctor now points at `wingfoot register` when a valid signature is still rejected because the target hasn't allow-listed the key.
Build sdist+wheel, then upload via OIDC — no API tokens stored in the repo. Requires the one-time pending-publisher setup on pypi.org (project wingfoot, workflow publish.yml, environment pypi).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What's in here
sign_directory/verify_directory,wingfoot directory --sign. Profile verified byte-exact against Cloudflare's live reference directory.wingfoot register— no verifier offers automated registration yet (each runs a human-reviewed form), so this command preflights your hosted directory the way a reviewer would, then prints a ready-to-paste registration packet for Cloudflare and DataDome. Supports--email,--user-agent,--open,--no-check.fix(http): send a real User-Agent instead of urllib's CDN-blocked default.Test plan
tests/test_register.pycovers the packet fields, provider registry, and every preflight failure mode without network.wingfoot --versionandwingfoot demo(403 -> 200) both pass.wingfoot registeragainst the real fastinfer.org directory: all preflight checks green.