(CkPython) Create Egypt ITIDA CAdES-BES Signature with Automatic JSON Canonicalization

See more Egypt ITIDA Examples

Demonstrates how to create a .p7s signature that fits Egypt's ITIDA requirements where Chilkat automatically does the ITIDA JSON canonicalization.

Note: This example requires Chilkat v9.5.0.75 or greater.

Chilkat Python Downloads install with pip pip3 install chilkat or download... Python Module for Windows, MacOS, Linux, Alpine Linux, Solaris

import sys
import chilkat

# This example assumes the Chilkat API to have been previously unlocked.
# See Global Unlock Sample for sample code.

crypt = chilkat.CkCrypt2()
crypt.put_VerboseLogging(True)

cert = chilkat.CkCert()
cert.put_VerboseLogging(True)

# Set the smart card PIN, which will be needed for signing.
cert.put_SmartCardPin("12345678")

# There are many ways to load the certificate.  
# This example was created for a customer using an ePass2003 USB token.
# Assuming the USB token is the only source of a hardware-based private key..
success = cert.LoadFromSmartcard("")
if (success != True):
    print(cert.lastErrorText())
    sys.exit()

# Tell the crypt class to use this cert.
success = crypt.SetSigningCert(cert)
if (success != True):
    print(crypt.lastErrorText())
    sys.exit()

cmsOptions = chilkat.CkJsonObject()
# Setting "DigestData" causes OID 1.2.840.113549.1.7.5 (digestData) to be used.
cmsOptions.UpdateBool("DigestData",True)
cmsOptions.UpdateBool("OmitAlgorithmIdNull",True)

# Indicate that we are passing normal JSON and we want Chilkat do automatically
# do the ITIDA JSON canonicalization:
cmsOptions.UpdateBool("CanonicalizeITIDA",True)

crypt.put_CmsOptions(cmsOptions.emit())

# The CadesEnabled property applies to all methods that create CMS/PKCS7 signatures. 
# To create a CAdES-BES signature, set this property equal to true. 
crypt.put_CadesEnabled(True)

crypt.put_HashAlgorithm("sha256")

jsonSigningAttrs = chilkat.CkJsonObject()
jsonSigningAttrs.UpdateInt("contentType",1)
jsonSigningAttrs.UpdateInt("signingTime",1)
jsonSigningAttrs.UpdateInt("messageDigest",1)
jsonSigningAttrs.UpdateInt("signingCertificateV2",1)
crypt.put_SigningAttributes(jsonSigningAttrs.emit())

# By default, all the certs in the chain of authentication are included in the signature.
# If desired, we can choose to only include the signing certificate:
crypt.put_IncludeCertChain(False)

# Pass a JSON document such as the following.  Chilkat will do the ITIDA canonicalization.
# (It is the canonicalized JSON that gets signed.)

#       {
#          "issuer":{
#             "address":{
#                "branchID":"0",
#                "country":"EG",
#                "regionCity":"Cairo",
#                "postalCode":"",
#                "buildingNumber":"0",
#                "street":"123rd Street",
#                "governate":"GOVERNATE"
#             },
#             "type":"B",
#             "id":"209999899",
#             "name":"Xyz SAE"
#          },
#          "receiver":{
#             "address":{
#                "country":"EG",
#                "regionCity":"CAIRO",
#                "postalCode":"11435",
#                "buildingNumber":"0",
#                "street":"Autostrad Road Abc",
#                "governate":"GOVERNATE"
#             },
#             "type":"B",
#             "id":"999999999",
#             "name":"XYZ EGYPT FOR TRADE"
#          },
#          "documentType":"I",
#          "documentTypeVersion":"1.0",
#          "dateTimeIssued":"2020-11-15T11:04:53Z",
#          "taxpayerActivityCode":"1073",
#          "internalID":"ZZZZ999",
#          "purchaseOrderReference":"2009199918",
#          "salesOrderReference":"",
#          "payment":{
#             "bankName":"",
#             "bankAddress":"",
#             "bankAccountNo":"",
#             "bankAccountIBAN":"",
#             "swiftCode":"",
#             "terms":""
#          },
#          "delivery":{
#             "approach":"",
#             "packaging":"",
#             "dateValidity":"",
#             "exportPort":"",
#             "countryOfOrigin":"EG",
#             "grossWeight":0,
#             "netWeight":0,
#             "terms":""
#          },
#          "invoiceLines":[
#             {
#                "description":"CDM Widget 48GX99X12BA",
#                "itemType":"GS1",
#                "itemCode":"7622213335056",
#                "unitType":"CS",
#                "quantity":1.00,
#                "unitValue":{
#                   "currencySold":"EGP",
#                   "amountEGP":588.67,
#                   "amountSold":0,
#                   "currencyExchangeRate":0
#                },
#                "salesTotal":588.67,
#                "total":603.97,
#                "valueDifference":0,
#                "totalTaxableFees":0,
#                "netTotal":529.8,
#                "itemsDiscount":0,
#                "discount":{
#                   "rate":10.00,
#                   "amount":58.87
#                },
#                "taxableItems":[
#                   {
#                      "taxType":"T1",
#                      "amount":74.17,
#                      "subType":"No sub",
#                      "rate":14.00
#                   }
#                ],
#                "internalCode":"9099994"
#             }
#          ],
#          "totalSales":588.67,
#          "totalSalesAmount":588.67,
#          "totalDiscountAmount":58.87,
#          "netAmount":529.80,
#          "taxTotals":[
#             {
#                "taxType":"T1",
#                "amount":74.17
#             }
#          ],
#          "extraDiscountAmount":0,
#          "totalItemsDiscountAmount":0,
#          "totalAmount":603.97,
#       }
# 

json = chilkat.CkJsonObject()
success = json.LoadFile("qa_data/itida/sdk.invoicing.eta.gov.eg/files/one-doc.json")
if (success == False):
    print(json.lastErrorText())
    sys.exit()

json.put_EmitCompact(False)

# Create the CAdES-BES signature.
crypt.put_EncodingMode("base64")

# Make sure we sign the utf-8 byte representation of the JSON string
crypt.put_Charset("utf-8")

sigBase64 = crypt.signStringENC(json.emit())
if (crypt.get_LastMethodSuccess() == False):
    print(crypt.lastErrorText())
    sys.exit()

print("Base64 signature:")
print(sigBase64)

# Add the signature to the JSON.
json.UpdateString("signatures[0].signatureType","I")
json.UpdateString("signatures[0].value",sigBase64)

print("JSON with signature added:")
print(json.emit())