wasat.trust

Trust models and certificate verification for Gemini connections.

FileTrustStore

FileTrustStore(filepath: str | Path)

Bases: TrustStore

A standard file-based TOFU (Trust On First Use) store.

Stores fingerprints in a simple text file format similar to known_hosts.

Parameters:

Name	Type	Description	Default
filepath	str | Path	The path to the file storing fingerprints.	required

filepath instance-attribute

filepath = Path(filepath)

The path to the file storing the certificate fingerprints.

get_fingerprint async

get_fingerprint(host: str, port: int) -> str | None

Retrieve the stored fingerprint for a host/port.

Parameters:

Name	Type	Description	Default
host	str	The remote hostname.	required
port	int	The remote port.	required

Returns:

Type	Description
str | None	The SHA-256 fingerprint string (hex) or None.

get_hosts async

get_hosts() -> list[tuple[str, int]]

Retrieve all host and port combinations stored in the trust store.

Returns:

Type	Description
list[tuple[str, int]]	A list of (host, port) tuples representing the known hosts.

save async

save(host: str, port: int, cert_der: bytes) -> None

Save the peer certificate fingerprint to the store.

Parameters:

Name	Type	Description	Default
host	str	The remote hostname.	required
port	int	The remote port.	required
cert_der	bytes	The DER-encoded certificate.	required

Raises:

Type	Description
RuntimeError	If saving the updated known hosts file to disk fails.

verify async

verify(host: str, port: int, cert_der: bytes) -> bool

Verify the peer certificate against the stored fingerprint.

Parameters:

Name	Type	Description	Default
host	str	The remote hostname.	required
port	int	The remote port.	required
cert_der	bytes	The DER-encoded certificate.	required

Returns:

Type	Description
bool	True if the fingerprint matches the stored one, False otherwise.

TrustStore

Bases: Protocol

Protocol defining the interface for certificate fingerprint stores.

get_fingerprint async

get_fingerprint(host: str, port: int) -> str | None

Retrieve the stored fingerprint for a host/port, if any.

Parameters:

Name	Type	Description	Default
host	str	The remote hostname.	required
port	int	The remote port.	required

Returns:

Type	Description
str | None	The SHA-256 fingerprint string (hex) or None.

get_hosts async

get_hosts() -> list[tuple[str, int]]

Retrieve all host and port combinations stored in the trust store.

Returns:

Type	Description
list[tuple[str, int]]	A list of (host, port) tuples representing the known hosts.

save async

save(host: str, port: int, cert_der: bytes) -> None

Save a peer certificate fingerprint to the trust store.

Parameters:

Name	Type	Description	Default
host	str	The remote hostname.	required
port	int	The remote port.	required
cert_der	bytes	The DER-encoded certificate.	required

Raises:

Type	Description
RuntimeError	If saving the certificate fingerprint to the trust store fails.

verify async

verify(host: str, port: int, cert_der: bytes) -> bool

Verify the peer certificate against the stored fingerprint.

Parameters:

Name	Type	Description	Default
host	str	The remote hostname.	required
port	int	The remote port.	required
cert_der	bytes	The DER-encoded certificate.	required

Returns:

Type	Description
bool	True if the certificate is trusted, False otherwise.

get_cert_fingerprint

get_cert_fingerprint(cert_der: bytes) -> str

Calculate the SHA-256 fingerprint of a DER-encoded certificate.

Parameters:

Name	Type	Description	Default
cert_der	bytes	The raw DER-encoded certificate bytes.	required

Returns:

Type	Description
str	The hex-encoded SHA-256 fingerprint.