fb0cc3e39d
Critical: - FR-01: Chain verification now supports key rotation via signed rotation records (soosef/key-rotation-v1 content type). Old single-signer invariant replaced with authorized-signers set. - FR-02: Carrier images stripped of EXIF metadata by default before steganographic encoding (strip_metadata=True). Prevents source location/device leakage. High priority: - FR-03: Session timeout (default 15min) + secure cookie flags (HttpOnly, SameSite=Strict, Secure when HTTPS) - FR-04: CSRF protection via Flask-WTF on all POST forms. Killswitch now requires password re-authentication. - FR-05: Collaborator trust store — trust_key(), get_trusted_keys(), resolve_attestor_name(), untrust_key() in KeystoreManager. - FR-06: Production WSGI server (Waitress) by default, Flask dev server only with --debug flag. - FR-07: Dead man's switch sends warning during grace period via local file + optional webhook before auto-purge. Medium: - FR-08: Geofence get_current_location() via gpsd for --here support. - FR-09: Batch attestation endpoint (/attest/batch) with SHA-256 dedup and per-file status reporting. - FR-10: Key backup tracking with last_backup_info() and is_backup_overdue() + backup_reminder_days config. - FR-11: Verification receipts signed with instance Ed25519 key (schema_version bumped to 2). - FR-12: Login rate limiting with configurable lockout (5 attempts, 15 min default). Nice-to-have: - FR-13: Unified `soosef status` pre-flight command showing identity, channel key, deadman, geofence, chain, and backup status. - FR-14: `soosef chain export` produces ZIP with JSON manifest, public key, and raw chain.bin for legal discovery. Tests: 157 passed, 1 skipped, 1 pre-existing flaky test. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
62 lines
3.1 KiB
HTML
62 lines
3.1 KiB
HTML
{% extends "base.html" %}
|
|
{% block title %}Attest Image — SooSeF{% endblock %}
|
|
|
|
{% block content %}
|
|
<div class="row justify-content-center">
|
|
<div class="col-lg-8">
|
|
<div class="card bg-dark border-secondary">
|
|
<div class="card-header">
|
|
<h5 class="mb-0"><i class="bi bi-patch-check me-2 text-info"></i>Attest Image</h5>
|
|
</div>
|
|
<div class="card-body">
|
|
<p class="text-muted">
|
|
Create a cryptographic provenance attestation — sign an image with your Ed25519 identity
|
|
to prove when and by whom it was captured.
|
|
</p>
|
|
|
|
{% if not has_identity %}
|
|
<div class="alert alert-warning">
|
|
<i class="bi bi-exclamation-triangle me-2"></i>
|
|
<strong>No identity configured.</strong> Generate one from the
|
|
<a href="/keys" class="alert-link">Keys page</a> or run <code>soosef init</code>.
|
|
</div>
|
|
{% endif %}
|
|
|
|
<form method="POST" enctype="multipart/form-data">
|
|
<input type="hidden" name="csrf_token" value="{{ csrf_token() }}"/>
|
|
<div class="mb-4">
|
|
<label for="image" class="form-label"><i class="bi bi-image me-1"></i>Image to Attest</label>
|
|
<input type="file" class="form-control" name="image" id="image"
|
|
accept="image/png,image/jpeg,image/webp,image/tiff,image/bmp" required>
|
|
<div class="form-text">Supports PNG, JPEG, WebP, TIFF, BMP.</div>
|
|
</div>
|
|
|
|
<div class="mb-3">
|
|
<label for="caption" class="form-label"><i class="bi bi-chat-text me-1"></i>Caption (optional)</label>
|
|
<input type="text" class="form-control" name="caption" id="caption"
|
|
placeholder="What does this image show?" maxlength="500">
|
|
</div>
|
|
|
|
<div class="mb-3">
|
|
<label for="location_name" class="form-label"><i class="bi bi-geo-alt me-1"></i>Location (optional)</label>
|
|
<input type="text" class="form-control" name="location_name" id="location_name"
|
|
placeholder="Where was this taken?" maxlength="200">
|
|
</div>
|
|
|
|
<div class="form-check form-switch mb-4">
|
|
<input class="form-check-input" type="checkbox" name="auto_exif" id="autoExif" checked>
|
|
<label class="form-check-label" for="autoExif">
|
|
Extract EXIF metadata automatically (GPS, timestamp, device)
|
|
</label>
|
|
</div>
|
|
|
|
<button type="submit" class="btn btn-info btn-lg w-100" {% if not has_identity %}disabled{% endif %}>
|
|
<i class="bi bi-patch-check me-2"></i>Create Attestation
|
|
</button>
|
|
</form>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
{% endblock %}
|