Registry /
auth-security / alibabacloud-darabonba-signature-util
The `alibabacloud-darabonba-signature-util` library, version 0.0.4, is a low-level utility component of the Alibaba Cloud Python SDK ecosystem. It provides essential cryptographic functions for signing requests, including HMAC-SHA1 and HMAC-SHA256, and base64 encoding, based on the Darabonba framework. It's primarily designed for internal use by other Alibaba Cloud SDK modules rather than direct end-user application. The library currently has an infrequent release cadence, with the last significant update being over a year ago.
Install & Compatibility
Where this runs
tested against v0.0.4 · pip install
no network on importno background threads
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslpy 3.10–3.910 runs
installs and imports cleanly · install 0.0s · import 0.000s · 35.8MB
glibcpy 3.10–3.910 runs
installs and imports cleanly · install 3.3s · import 0.000s · 36MB
34MB installed
● package 34MB
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
Darabonba_SignatureUtil
✓ import alibabacloud_darabonba_signature_util
✗ from alibabacloud_darabonba_signature_util import Darabonba_SignatureUtil
This quickstart demonstrates how to use `Darabonba_SignatureUtil` to sign a string using HMAC-SHA1 and HMAC-SHA256, which are common requirements for authenticating requests to cloud services. It highlights the critical step of converting input strings to UTF-8 bytes before passing them to the signing functions, and then base64 encoding the resulting signature bytes.
import os
import base64
from alibabacloud_darabonba_signature_util_py.util import Darabonba_SignatureUtil
# These credentials would typically be loaded securely, e.g., from environment variables
access_key_id = os.environ.get("ALIBABA_CLOUD_ACCESS_KEY_ID", "YOUR_ACCESS_KEY_ID")
access_key_secret = os.environ.get("ALIBABA_CLOUD_ACCESS_KEY_SECRET", "YOUR_ACCESS_KEY_SECRET")
# Example string to sign, often a canonicalized HTTP request string
string_to_sign = "GET\n\n\n1442129102\n/oss/"
# The signing functions expect bytes, so convert strings to utf-8 bytes
try:
signed_bytes_sha1 = Darabonba_SignatureUtil.get_h_macsha1(
bytes(string_to_sign, 'utf-8'),
bytes(access_key_secret, 'utf-8')
)
signature_sha1 = base64.b64encode(signed_bytes_sha1).decode('utf-8')
signed_bytes_sha256 = Darabonba_SignatureUtil.get_h_macsha256(
bytes(string_to_sign, 'utf-8'),
bytes(access_key_secret, 'utf-8')
)
signature_sha256 = base64.b64encode(signed_bytes_sha256).decode('utf-8')
print(f"String to Sign: '{string_to_sign}'")
print(f"HMAC-SHA1 Signature (Base64 Encoded): {signature_sha1}")
print(f"HMAC-SHA256 Signature (Base64 Encoded): {signature_sha256}")
except Exception as e:
print(f"An error occurred: {e}")
print("Please ensure ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET are set.")
Debug
Known issues
gotchaThe actual Python module name for imports (`alibabacloud_darabonba_signature_util_py`) differs from the PyPI package name (`alibabacloud-darabonba-signature-util`). Forgetting this can lead to `ModuleNotFoundError`.fixAlways use `from alibabacloud_darabonba_signature_util_py.util import Darabonba_SignatureUtil`.
affects: All versions (0.0.1+)
gotchaSigning functions like `get_h_macsha1` and `get_h_macsha256` expect `bytes` objects for both the string to sign and the secret key, not standard Python `str` objects. Passing `str` will result in a `TypeError`.fixConvert strings to bytes using `bytes(my_string, 'utf-8')` before passing them to signing functions.
affects: All versions (0.0.1+)
gotchaThis library provides low-level cryptographic primitives. It is primarily an internal component of the Alibaba Cloud SDK. Direct use by end-users for custom security implementations should be done with extreme caution, as incorrect usage of raw crypto can lead to severe security vulnerabilities.fixPrefer using higher-level SDK functions for authentication if available, or consult security experts if implementing custom signing logic.
affects: All versions (0.0.1+)
Audit
Dependencies
No dependency data recorded yet.