initial code

scripts/create_vin_hash_key.py

@@ -0,0 +1,56 @@
+"""Create the local project-specific VIN HMAC key without printing it."""
+
+from __future__ import annotations
+
+import argparse
+import hashlib
+import os
+import secrets
+import stat
+import sys
+from pathlib import Path
+
+
+PROJECT_ROOT = Path(__file__).resolve().parents[1]
+DEFAULT_PATH = PROJECT_ROOT / ".secrets/vin_hmac.key"
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--path", type=Path, default=DEFAULT_PATH)
+    return parser.parse_args()
+
+
+def key_fingerprint(key: bytes) -> str:
+    return hashlib.sha256(
+        b"utah-vehicle-health/key-fingerprint/v1\0" + key
+    ).hexdigest()[:16]
+
+
+def main() -> int:
+    path = parse_args().path.resolve()
+    os.umask(0o077)
+    path.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
+
+    if path.exists():
+        mode = stat.S_IMODE(path.stat().st_mode)
+        if mode & 0o077:
+            print(f"Existing key has unsafe permissions: {path}", file=sys.stderr)
+            return 1
+        print(f"Key already exists; leaving it unchanged: {path}")
+        return 0
+
+    key = secrets.token_bytes(32)
+    descriptor = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+    with os.fdopen(descriptor, "w", encoding="ascii") as handle:
+        handle.write(key.hex() + "\n")
+        handle.flush()
+        os.fsync(handle.fileno())
+
+    print(f"Created private VIN HMAC key: {path}")
+    print(f"Non-secret key fingerprint: {key_fingerprint(key)}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())