import os
import stat
import subprocess


UUID_TOKEN_LENGTH = 32


def cms_verify(formatted, signing_cert_file_name, ca_file_name):
    """
        verifies the signature of the contensts IAW CMS syntax
    """
    process = subprocess.Popen(["openssl", "cms", "-verify",
                                "-certfile", signing_cert_file_name,
                                "-CAfile", ca_file_name,
                                "-inform", "PEM",
                                "-nosmimecap", "-nodetach",
                                "-nocerts", "-noattr"],
                               stdin=subprocess.PIPE,
                               stdout=subprocess.PIPE,
                               stderr=subprocess.PIPE)
    output, err = process.communicate(formatted)
    retcode = process.poll()
    if retcode:
        raise subprocess.CalledProcessError(retcode, "openssl", output=err)
    return output


def token_to_cms(signed_text):
    copy_of_text = signed_text.replace('-', '/')

    formatted = "-----BEGIN CMS-----\n"
    line_length = 64
    while len(copy_of_text) > 0:
        if (len(copy_of_text) > line_length):
            formatted += copy_of_text[:line_length]
            copy_of_text = copy_of_text[line_length:]
        else:
            formatted += copy_of_text
            copy_of_text = ""
        formatted += "\n"

    formatted += "-----END CMS-----\n"

    return formatted


def verify_token(token, signing_cert_file_name, ca_file_name):
    return cms_verify(token_to_cms(token),
                      signing_cert_file_name,
                      ca_file_name)


def cms_sign_text(text, signing_cert_file_name, signing_key_file_name):
    """ Uses OpenSSL to sign a document
    Produces a Base64 encoding of a DER formatted CMS Document
    http://en.wikipedia.org/wiki/Cryptographic_Message_Syntax
    """

    process = subprocess.Popen(["openssl", "cms", "-sign",
                                "-signer", signing_cert_file_name,
                                "-inkey", signing_key_file_name,
                                "-outform", "PEM",
                                "-nosmimecap", "-nodetach",
                                "-nocerts", "-noattr"],
                               stdin=subprocess.PIPE,
                               stdout=subprocess.PIPE)
    output, unused_err = process.communicate(text)
    retcode = process.poll()
    if retcode:
        raise subprocess.CalledProcessError(retcode,
                                            "openssl", output=output)
    return cms_to_token(output)


def cms_to_token(cms_text):

    start_delim = "-----BEGIN CMS-----"
    end_delim = "-----END CMS-----"
    signed_text = cms_text
    signed_text = signed_text.replace('/', '-')
    signed_text = signed_text.replace(start_delim, '')
    signed_text = signed_text.replace(end_delim, '')
    signed_text = signed_text.replace('\n', '')

    return signed_text

@@ -34,16 +34,87 @@
 rocess%0A%0A
+from keystone.common import logging%0A%0A%0ALOG = logging.getLogger(__name__)
 %0AUUID_TO
@@ -248,17 +248,16 @@
 e conten
-s
 ts IAW C
@@ -877,32 +877,76 @@
     if retcode:%0A
+        LOG.error('Verify error: %25s' %25 err)%0A
         raise su
@@ -2417,32 +2417,87 @@
 =subprocess.PIPE
+,%0A                               stderr=subprocess.PIPE
 )%0A    output, un
@@ -2498,15 +2498,8 @@
 ut, 
-unused_
 err 
@@ -2563,32 +2563,77 @@
     if retcode:%0A
+        LOG.error('Signing error: %25s' %25 err)%0A
         raise su

Log errors when signing/verifying.