* Install an XML catalog so we can look this schema up locally

Signed-off-by: Pete Baughman <pete.baughman@apex.ai>

* Mangle the XML_CATALOG_FILE when you import sros2

  - This changes a test-only fix into a always fix
  - Make the path into a URL instead of just a local file path

Signed-off-by: Pete Baughman <pete.baughman@apex.ai>

* Disable lxml2 resource lookup over the internet for tests

Signed-off-by: Pete Baughman <pete.baughman@apex.ai>

* Remove trailing slash from path

  - This should fix the windows CI job

Signed-off-by: Pete Baughman <pete.baughman@apex.ai>

* Add README.md explaining where the cataloged schema comes from

Signed-off-by: Pete Baughman <pete.baughman@apex.ai>

* Escape the path, not the 'file:' part

This should work on linux AND on windows

Signed-off-by: Pete Baughman <pete.baughman@apex.ai>

* Fix missing resources needed for ament

Signed-off-by: Pete Baughman <pete.baughman@apex.ai>

* Keep consistent formatting with other index PRs

Signed-off-by: ruffsl <ruffsl@users.noreply.github.com>
Signed-off-by: Pete Baughman <pete.baughman@apex.ai>

install package manifest

Signed-off-by: ruffsl <roxfoxpox@gmail.com>

Signed-off-by: Avishay Alon <avishaya@amazon.com>

* Disable flaky test

Also, guard against name collisions from lingering nodes by making the
expected node, topic, and services names more verbose.

Signed-off-by: Jacob Perron <jacob@openrobotics.org>

* Only disable test for Windows

Signed-off-by: Jacob Perron <jacob@openrobotics.org>

* Use decorator

Signed-off-by: Jacob Perron <jacob@openrobotics.org>

This uses the newly-added ament_mypy package.

Signed-off-by: Kyle Fazzari <kyle@canonical.com>

Signed-off-by: Mikael Arguedas <mikael.arguedas@gmail.com>

* no need for quiet invocation of ros2 security

Signed-off-by: Mikael Arguedas <mikael.arguedas@gmail.com>

* update variable names

Signed-off-by: Mikael Arguedas <mikael.arguedas@gmail.com>

* print warning on artifact generation failure

Signed-off-by: Mikael Arguedas <mikael.arguedas@gmail.com>

Signed-off-by: Mikael Arguedas <mikael.arguedas@gmail.com>

Signed-off-by: Mikael Arguedas <mikael.arguedas@gmail.com>

Otherwise it fails with 'RTI_Security_CertHelper_verifyCert:X509_verify_cert returned 0 with error 9: certificate is not yet valid'

Signed-off-by: Mikael Arguedas <mikael.arguedas@gmail.com>

ROS 2 tests are limited by the version of packages available in Ubuntu
Bionic, not the ones available in pip. As a result, we need to make sure
we only take advantage of the features as of pytest v3.3.2. A side
effect of this is that we must use `tmpdir_factory` as opposed to
`tmp_path_factory`, which wasn't introduced until v4.3.0.

Signed-off-by: Kyle Fazzari <kyle@canonical.com>

* added request service permissions

Signed-off-by: Siddharth Kucheria <kucheria@usc.edu>

Signed-off-by: Mikael Arguedas <mikael.arguedas@gmail.com>

Signed-off-by: Mikael Arguedas <mikael.arguedas@gmail.com>

Signed-off-by: Mikael Arguedas <mikael.arguedas@gmail.com>

This completes the migration from shelling out to `openssl` to the
cryptography library.

Resolve #109

Signed-off-by: Kyle Fazzari <kyle@canonical.com>

* api: migrate permissions S/MIME to cryptography library

This is the last shell out to `openssl` for S/MIME signatures.

Signed-off-by: Kyle Fazzari <kyle@canonical.com>

* Refactor S/MIME methods

Signed-off-by: Kyle Fazzari <kyle@canonical.com>

* use upper case names for constants

Signed-off-by: Mikael Arguedas <mikael.arguedas@gmail.com>

* factor out hardcoded common name

Signed-off-by: Mikael Arguedas <mikael.arguedas@gmail.com>

* avoid using python builtins as argument names

Signed-off-by: Mikael Arguedas <mikael.arguedas@gmail.com>

* Revert "use upper case names for constants"

This reverts commit 3a45a752c7ae1eab1840194339f4127efe63055c.

Signed-off-by: Mikael Arguedas <mikael.arguedas@gmail.com>

* format cnf string to be more readable

Signed-off-by: Mikael Arguedas <mikael.arguedas@gmail.com>

* make DEFAULT_COMMON_NAME private

Signed-off-by: Mikael Arguedas <mikael.arguedas@gmail.com>

* create_key test: add missing tests

In preparation for future work, add a few tests that are missing from
`create_key`, specifically tests that verify the request.cnf,
permissions.p7s, governance.p7s, and ecdsaparam.

Also rework test module to use module fixtures and multiple smaller test
cases instead of one large one. This makes it easier to add more, and
makes test failures more meaningful.

Signed-off-by: Kyle Fazzari <kyle@canonical.com>

* Remove spurious comment

Signed-off-by: Kyle Fazzari <kyle@canonical.com>

* Obtain S/MIME signature using cryptography library

The governance and permission files must be S/MIME signed. The biggest
obstacle to adopting the cryptography library is that it doesn't expose
an S/MIME API (see https://github.com/pyca/cryptography/issues/1621

 for
more information).

Use the OpenSSL API directly (via cryptography's hazmat layer) to obtain
S/MIME signatures, and prove the functionality out by using it to sign
the governance files.

Progress on #109

Signed-off-by: Kyle Fazzari <kyle@canonical.com>

* Resolve flake8 import ordering issues

Signed-off-by: Kyle Fazzari <kyle@canonical.com>

* Add test for create_keys verb with simple output validation

Signed-off-by: Emerson Knapp <eknapp@amazon.com>

* Call create_keystore directly instead of via CLI

Signed-off-by: Emerson Knapp <eknapp@amazon.com>

* Verify signature on certs

Signed-off-by: Emerson Knapp <eknapp@amazon.com>

* Remove use of subprocess for creating ca key and cert

Signed-off-by: Emerson Knapp <eknapp@amazon.com>

* Make write_ kwargs name-only, and fix CertificateBuilder chaining style

Signed-off-by: Emerson Knapp <eknapp@amazon.com>

* Address review comments

Signed-off-by: Emerson Knapp <eknapp@amazon.com>

* Create_keystore doesn't produce ecdsaparams anymore

Signed-off-by: Emerson Knapp <eknapp@amazon.com>

* Don't need ecdsaparams for valid keystore

Signed-off-by: Emerson Knapp <eknapp@amazon.com>

* Add basic create_keystore test.

Also add dependency on cryptography module to parse generated files.

Signed-off-by: Emerson Knapp <eknapp@amazon.com>

* Copy lxml pattern for cryptography, depend on python3-cryptography and don't include in setup.py

Signed-off-by: Emerson Knapp <eknapp@amazon.com>

* Add tests for list_keys verb

Also ensure list_keys properly handles a non-existent keystore.

Signed-off-by: Kyle Fazzari <kyle@canonical.com>

* Use api instead of commands for non-list_keys verbs

Signed-off-by: Kyle Fazzari <kyle@canonical.com>

* Flip import order for flake8

Signed-off-by: Kyle Fazzari <kyle@canonical.com>

* Make sure error message is common between platforms

Signed-off-by: Kyle Fazzari <kyle@canonical.com>

* Add tests for generate_policy verb

The verbs are missing tests. Let's get started by adding some basic
coverage to `generate_policy`. Also ensure that `generate_policy` abides
by established conventions, returning 0 upon success.

Signed-off-by: Kyle Fazzari <kyle@canonical.com>

* Add std_msgs as a test_depend

Also use `1` instead of QoSProfile.

Signed-off-by: Kyle Fazzari <kyle@canonical.com>

* Reorder imports

Signed-off-by: Kyle Fazzari <kyle@canonical.com>

Signed-off-by: Jacob Perron <jacob@openrobotics.org>

In particular, guard against keys that only consist of whitespace and '/' characters.
The error message is also improved slightly.

* Use name validation functions from rclpy

* Add test for key name validation function

Signed-off-by: Jacob Perron <jacob@openrobotics.org>

* Add svn installation instructions

Signed-off-by: ivanpauno <ivanpauno@ekumenlabs.com>

* Correct spelling

Signed-off-by: ivanpauno <ivanpauno@ekumenlabs.com>

this allows to get rid of the ros2_create_keystore macro
call a single ros2 security command, the single python invocation
results in significant speed improvement

Signed-off-by: Mikael Arguedas <mikael.arguedas@gmail.com>

generate_artifacts verb

Signed-off-by: Mikael Arguedas <mikael.arguedas@gmail.com>

Signed-off-by: Mikael Arguedas <mikael.arguedas@gmail.com>

Signed-off-by: Mikael Arguedas <mikael.arguedas@gmail.com>

Signed-off-by: Mikael Arguedas <mikael.arguedas@gmail.com>

Signed-off-by: Mikael Arguedas <mikael.arguedas@gmail.com>

Signed-off-by: Mikael Arguedas <mikael.arguedas@gmail.com>