{"id":9449,"library":"alibabacloud-darabonba-signature-util","title":"Darabonba Signature Utility","description":"The `alibabacloud-darabonba-signature-util` library, version 0.0.4, is a low-level utility component of the Alibaba Cloud Python SDK ecosystem. It provides essential cryptographic functions for signing requests, including HMAC-SHA1 and HMAC-SHA256, and base64 encoding, based on the Darabonba framework. It's primarily designed for internal use by other Alibaba Cloud SDK modules rather than direct end-user application. The library currently has an infrequent release cadence, with the last significant update being over a year ago.","status":"active","version":"0.0.4","language":"python","source_language":"en","source_url":"https://github.com/aliyun/darabonba-crypto-util","tags":["Alibaba Cloud","Darabonba","Signature","Cryptography","Utility","SDK"],"install":[{"cmd":"pip install alibabacloud-darabonba-signature-util","lang":"bash","label":"Install latest version"}],"dependencies":[],"imports":[{"wrong":"from alibabacloud_darabonba_signature_util import Darabonba_SignatureUtil","symbol":"Darabonba_SignatureUtil","correct":"import alibabacloud_darabonba_signature_util"}],"quickstart":{"code":"import os\nimport base64\nfrom alibabacloud_darabonba_signature_util_py.util import Darabonba_SignatureUtil\n\n# These credentials would typically be loaded securely, e.g., from environment variables\naccess_key_id = os.environ.get(\"ALIBABA_CLOUD_ACCESS_KEY_ID\", \"YOUR_ACCESS_KEY_ID\")\naccess_key_secret = os.environ.get(\"ALIBABA_CLOUD_ACCESS_KEY_SECRET\", \"YOUR_ACCESS_KEY_SECRET\")\n\n# Example string to sign, often a canonicalized HTTP request string\nstring_to_sign = \"GET\\n\\n\\n1442129102\\n/oss/\"\n\n# The signing functions expect bytes, so convert strings to utf-8 bytes\ntry:\n    signed_bytes_sha1 = Darabonba_SignatureUtil.get_h_macsha1(\n        bytes(string_to_sign, 'utf-8'),\n        bytes(access_key_secret, 'utf-8')\n    )\n    signature_sha1 = base64.b64encode(signed_bytes_sha1).decode('utf-8')\n\n    signed_bytes_sha256 = Darabonba_SignatureUtil.get_h_macsha256(\n        bytes(string_to_sign, 'utf-8'),\n        bytes(access_key_secret, 'utf-8')\n    )\n    signature_sha256 = base64.b64encode(signed_bytes_sha256).decode('utf-8')\n\n    print(f\"String to Sign: '{string_to_sign}'\")\n    print(f\"HMAC-SHA1 Signature (Base64 Encoded): {signature_sha1}\")\n    print(f\"HMAC-SHA256 Signature (Base64 Encoded): {signature_sha256}\")\nexcept Exception as e:\n    print(f\"An error occurred: {e}\")\n    print(\"Please ensure ALIBABA_CLOUD_ACCESS_KEY_ID and ALIBABA_CLOUD_ACCESS_KEY_SECRET are set.\")","lang":"python","description":"This quickstart demonstrates how to use `Darabonba_SignatureUtil` to sign a string using HMAC-SHA1 and HMAC-SHA256, which are common requirements for authenticating requests to cloud services. It highlights the critical step of converting input strings to UTF-8 bytes before passing them to the signing functions, and then base64 encoding the resulting signature bytes."},"warnings":[{"fix":"Always use `from alibabacloud_darabonba_signature_util_py.util import Darabonba_SignatureUtil`.","message":"The actual Python module name for imports (`alibabacloud_darabonba_signature_util_py`) differs from the PyPI package name (`alibabacloud-darabonba-signature-util`). Forgetting this can lead to `ModuleNotFoundError`.","severity":"gotcha","affected_versions":"All versions (0.0.1+)"},{"fix":"Convert strings to bytes using `bytes(my_string, 'utf-8')` before passing them to signing functions.","message":"Signing functions like `get_h_macsha1` and `get_h_macsha256` expect `bytes` objects for both the string to sign and the secret key, not standard Python `str` objects. Passing `str` will result in a `TypeError`.","severity":"gotcha","affected_versions":"All versions (0.0.1+)"},{"fix":"Prefer using higher-level SDK functions for authentication if available, or consult security experts if implementing custom signing logic.","message":"This library provides low-level cryptographic primitives. It is primarily an internal component of the Alibaba Cloud SDK. Direct use by end-users for custom security implementations should be done with extreme caution, as incorrect usage of raw crypto can lead to severe security vulnerabilities.","severity":"gotcha","affected_versions":"All versions (0.0.1+)"}],"env_vars":null,"search_vec":"'0.0.4':12 'ago':88 'alibaba':22,60,89 'alibabacloud':6 'alibabacloud-darabonba-signature-util':5 'applic':70 'base':46 'base64':44 'cadenc':78 'cloud':23,61,90 'compon':19 'cryptograph':30 'cryptographi':93 'current':73 'darabonba':1,7,49,91 'design':54 'direct':66 'ecosystem':26 'encod':45 'end':68 'end-us':67 'essenti':29 'framework':50 'function':31 'hmac':37,41 'hmac-sha1':36 'hmac-sha256':40 'includ':35 'infrequ':76 'intern':56 'last':81 'level':17 'librari':10,72 'low':16 'low-level':15 'modul':63 'primarili':53 'provid':28 'python':24 'rather':64 'releas':77 'request':34 'sdk':25,62,95 'sha1':38 'sha256':42 'sign':33 'signatur':2,8,92 'signific':82 'updat':83 'use':57 'user':69 'util':3,9,18,94 'version':11 'year':87","created_at":"2026-04-17T01:18:58.033336+00:00","updated_at":"2026-04-17T01:18:58.033336+00:00","problems":null,"ecosystem":"pypi","meta_description":null,"install_score":null,"quickstart_score":null,"quickstart_tag":null,"pypi_latest":"0.0.4","cli_name":"","cli_version":null,"type":"library","homepage":"https://www.alibabacloud.com","github":"https://github.com/aliyun/darabonba-crypto-util","docs":null,"changelog":null,"pypi":"https://pypi.org/project/alibabacloud-darabonba-signature-util/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["auth-security","http-networking"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"passing","verified_at":"2026-07-03","last_verified":"2026-07-03","next_check":"2026-08-02","install_tag":null}}