Merge lp:~jderose/dmedia/secure-peering into lp:dmedia

[Jason Gerard DeRose]

Please see the related bug for details:

https://bugs.launchpad.net/dmedia/+bug/1064674

One note on something that I plan to change soon in a later merge: I want to incorporate proof of having the secret in the POST /csr request, and in the response containing the cert. I feel this is important in case somehow this step was reachable without passing the challenge response. Similar to the existing challenge-response, it will be tied to the public key hashes in question, and also to the data payload in the CSR and cert.

[James Raymond (jamesmr)]

Phew, that was a long read!

review: Approve

=== modified file 'dmedia-service'
--- dmedia-service	2012-10-04 20:25:21 +0000
+++ dmedia-service	2012-10-09 20:57:30 +0000
@@ -90,7 +90,7 @@
         self.core.init_default_store()
         if self.core.local.get('default_store') is None:
             self.core.set_default_store('shared')
-        self.env_s = dumps(self.core.env)
+        self.env_s = dumps(self.core.env, pretty=True)
         self.ssl_config = self.couch.get_ssl_config()
 
     def start_httpd(self):

=== added file 'dmedia/gtk/peering.py'
--- dmedia/gtk/peering.py	1970-01-01 00:00:00 +0000
+++ dmedia/gtk/peering.py	2012-10-09 20:57:30 +0000
@@ -0,0 +1,100 @@
+from os import path
+import json
+
+from gi.repository import GObject, Gtk, WebKit
+
+
+ui = path.join(path.dirname(path.abspath(__file__)), 'ui')
+assert path.isdir(ui)
+
+
+class Hub(GObject.GObject):
+    def __init__(self, view):
+        super().__init__()
+        self._view = view
+        view.connect('notify::title', self._on_notify_title)
+
+    def _on_notify_title(self, view, notify):
+        title = view.get_property('title')
+        if title is None:
+            return
+        obj = json.loads(title)
+        self.emit(obj['signal'], *obj['args'])
+
+    def send(self, signal, *args):
+        """
+        Emit a signal by calling the JavaScript Signal.recv() function.
+        """
+        script = 'Hub.recv({!r})'.format(
+            json.dumps({'signal': signal, 'args': args})
+        )
+        self._view.execute_script(script)
+        self.emit(signal, *args)
+
+
+def iter_gsignals(signals):
+    assert isinstance(signals, dict)
+    for (name, argnames) in signals.items():
+        assert isinstance(argnames, list)
+        args = [GObject.TYPE_PYOBJECT for argname in argnames]
+        yield (name, (GObject.SIGNAL_RUN_LAST, GObject.TYPE_NONE, args))
+
+
+def hub_factory(signals):
+    if signals:
+        class FactoryHub(Hub):
+            __gsignals__ = dict(iter_gsignals(signals))
+        return FactoryHub
+    return Hub
+
+
+class BaseUI:
+    inspector = None
+    signals = None
+    title = 'Novacut'  # Default Gtk.Window title
+    page = 'peering.html'  # Default page to load once CouchDB is available
+    width = 960  # Default Gtk.Window width
+    height = 540  # Default Gtk.Window height
+
+    def __init__(self):
+        self.build_window()
+        self.hub = hub_factory(self.signals)(self.view)
+        self.connect_hub_signals(self.hub)
+
+    def show(self):
+        self.window.show_all()
+
+    def run(self):
+        self.window.connect('destroy', self.quit)
+        self.window.show_all()
+        Gtk.main()
+
+    def quit(self, *args):
+        Gtk.main_quit()
+
+    def connect_hub_signals(self, hub):
+        pass
+
+    def build_window(self):
+        self.window = Gtk.Window()
+        self.window.set_position(Gtk.WindowPosition.CENTER)
+        self.window.set_default_size(self.width, self.height)
+        self.window.set_title(self.title)
+        self.vpaned = Gtk.VPaned()
+        self.window.add(self.vpaned)
+        self.view = WebKit.WebView()
+        self.view.get_settings().set_property('enable-developer-extras', True)
+        inspector = self.view.get_inspector()
+        inspector.connect('inspect-web-view', self.on_inspect)
+        self.view.load_uri('file://' + path.join(ui, self.page))
+        self.vpaned.pack1(self.view, True, True)
+
+    def on_inspect(self, *args):
+        assert self.inspector is None
+        self.inspector = WebKit.WebView()
+        pos = self.window.get_allocated_height() * 2 // 3
+        self.vpaned.set_position(pos)
+        self.vpaned.pack2(self.inspector, True, True)
+        self.inspector.show_all()
+        return self.inspector
+

=== added directory 'dmedia/gtk/ui'
=== added file 'dmedia/gtk/ui/client.html'
--- dmedia/gtk/ui/client.html	1970-01-01 00:00:00 +0000
+++ dmedia/gtk/ui/client.html	2012-10-09 20:57:30 +0000
@@ -0,0 +1,166 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+<link rel="stylesheet" href="peering.css" />
+<script src="peering.js"></script>
+<script>
+
+"use strict";
+
+var B32ALPHABET = '234567ABCDEFGHIJKLMNOPQRSTUVWXYZ';
+
+var UI = {
+    on_load: function() {
+        UI.input = $('input');
+        UI.input.oninput = UI.on_input;
+        UI.form = $('form');
+        UI.form.onsubmit = UI.on_submit;
+        UI.show('screen1');
+    },
+
+    on_input: function(event) {
+        var orig = UI.input.value.toUpperCase();
+        var value = '';
+        var b32, i;
+        for (i=0; i<orig.length; i++) {
+            b32 = orig[i];
+            if (B32ALPHABET.indexOf(b32) >= 0 ) {
+                value += b32;
+            }
+        }
+        UI.input.value = value;
+        if (UI.input.value.length == 8) {
+            $('finish').classList.remove('hidden');
+        }
+        else {
+            $('finish').classList.add('hidden');
+        }
+    },
+
+    on_submit: function(event) {
+        event.preventDefault();
+        event.stopPropagation();
+        UI.have_secret();
+    },
+
+    have_secret: function() {
+        if (UI.input.value.length == 8 && !UI.input.disabled) {
+            UI.input.disabled = true;
+            Hub.send('have_secret', UI.input.value); 
+        }
+    },
+
+    show: function(id) {
+        $hide(UI.current);
+        UI.current = $show(id);
+    },
+}
+
+
+window.onload = UI.on_load;
+
+
+Hub.connect('show_screen2a',
+    function() {
+        UI.show('screen2a');
+        $('logo').classList.add('spinleft');
+    }
+);
+
+Hub.connect('show_screen2b',
+    function() {
+        UI.show('screen2b');
+        $('logo').classList.add('spinright');
+    }
+);
+
+Hub.connect('show_screen3b',
+    function() {
+        $hide('logo');
+        UI.input.value = '';
+        UI.show('screen3b');
+    }
+);
+
+Hub.connect('spin_orb',
+    function() {
+        $('logo2').classList.add('spinright');
+    }
+);
+
+Hub.connect('set_message',
+    function(message) {
+        $('message').textContent = message;  
+    }
+);
+
+Hub.connect('response',
+    function(success) {
+        if (!success) {
+            UI.input.value = '';
+            UI.input.disabled = false;
+            UI.input.focus();
+            $('finish').classList.add('hidden');
+        }
+        else {
+            $hide('finish');
+            $show('logo2');
+        }
+    }
+);
+
+</script>
+</head>
+<body>
+
+<img src="novacut.svg" id="logo">
+
+<div id="screen1" class="hide">
+    <div id="first" onclick="Hub.send('first_time')">
+    <p class="top">
+    This is my first time using Novacut
+    </p>
+    <p>
+    (You can add more devices later)
+    </p>
+    </div>
+
+    <div id="sync" onclick="Hub.send('already_using')">
+    <p class="top">
+    I'm already using Novacut
+    </p>
+    <p>
+    Sync with my other devices!
+    </p>
+    </div>
+</div>
+
+<div id="screen2a" class="hide">
+    <p class="gen">
+    Pretty words here
+    </p>
+</div>
+
+<div id="screen2b" class="hide">
+    <p class="gen">
+    Accept the peering offer on your other device
+    </p>
+</div>
+
+<div id="screen3b" class="hide">
+    <p class="gen">
+    Enter your secret code:
+    </p>
+    <div class="secret">
+    <form id="form">
+    <input id="input" type="text" maxlength="8" size="8" autofocus="1"></input>
+    </form>
+    </div>
+    <p id="message"></p>
+    <img src="sync.svg" id="finish" class="hidden" onclick="UI.have_secret()">
+    <img src="novacut.svg" id="logo2" class="hide">
+</div>
+
+</body>
+</html>

=== added file 'dmedia/gtk/ui/novacut.svg'
--- dmedia/gtk/ui/novacut.svg	1970-01-01 00:00:00 +0000
+++ dmedia/gtk/ui/novacut.svg	2012-10-09 20:57:30 +0000
@@ -0,0 +1,133 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   width="512"
+   height="512"
+   id="svg4778"
+   version="1.1"
+   inkscape:version="0.48.1 r9760"
+   sodipodi:docname="novacut-solo-brandmark_PINK_FINAL-SVG.svg"
+   inkscape:export-filename="/home/izo/Pictures/Client_Work/Novacut/Final-Artwork/web/PNG/novacut-solo-brandmark_PINK_FINAL-PNG-300dpi.png"
+   inkscape:export-xdpi="300.05859"
+   inkscape:export-ydpi="300.05859">
+  <defs
+     id="defs4780">
+    <inkscape:path-effect
+       effect="spiro"
+       id="path-effect5868"
+       is_visible="true" />
+  </defs>
+  <sodipodi:namedview
+     id="base"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageopacity="0.0"
+     inkscape:pageshadow="2"
+     inkscape:zoom="1"
+     inkscape:cx="233.49618"
+     inkscape:cy="280"
+     inkscape:current-layer="layer1"
+     inkscape:document-units="px"
+     showgrid="false"
+     inkscape:window-width="1614"
+     inkscape:window-height="1026"
+     inkscape:window-x="66"
+     inkscape:window-y="24"
+     inkscape:window-maximized="1"
+     showguides="false"
+     inkscape:guide-bbox="true">
+    <inkscape:grid
+       type="xygrid"
+       id="grid2994"
+       empspacing="4"
+       visible="true"
+       enabled="true"
+       snapvisiblegridlinesonly="true" />
+    <sodipodi:guide
+       orientation="1,0"
+       position="256,88"
+       id="guide3002" />
+    <sodipodi:guide
+       orientation="0,1"
+       position="592,256"
+       id="guide3004" />
+    <sodipodi:guide
+       position="0,0"
+       orientation="0,512"
+       id="guide3006" />
+    <sodipodi:guide
+       position="512,0"
+       orientation="-512,0"
+       id="guide3008" />
+    <sodipodi:guide
+       position="512,512"
+       orientation="0,-512"
+       id="guide3010" />
+    <sodipodi:guide
+       position="0,512"
+       orientation="512,0"
+       id="guide3012" />
+  </sodipodi:namedview>
+  <metadata
+     id="metadata4783">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title></dc:title>
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     id="layer1"
+     inkscape:label="Layer 1"
+     inkscape:groupmode="layer"
+     transform="translate(0,32)">
+    <path
+       transform="matrix(1.0666667,0,0,1.0666667,-85.333334,-32.000001)"
+       d="m 545,240 a 225,225 0 1 1 -450,0 225,225 0 1 1 450,0 z"
+       sodipodi:ry="225"
+       sodipodi:rx="225"
+       sodipodi:cy="240"
+       sodipodi:cx="320"
+       id="path5924"
+       style="fill:#e81f3b;fill-opacity:1;stroke:none"
+       sodipodi:type="arc" />
+    <path
+       id="path4023"
+       d="m 157.74011,106.26326 0,233.73017 48.11687,0 0,-156.48267 0.68543,0 37.83549,60.93432 0,-81.0173 -35.57359,-57.16452 -51.0642,0 z m 149.28569,0 0,156.82539 -0.68543,0 -37.8355,-60.86578 0,81.0173 35.23088,56.75326 51.40692,0 0,-233.73017 -48.11687,0 z"
+       style="font-size:144px;font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;text-align:start;line-height:125%;letter-spacing:0px;word-spacing:0px;writing-mode:lr-tb;text-anchor:start;fill:#ffffff;fill-opacity:1;stroke:none;font-family:Helvetica Neue LT Com;-inkscape-font-specification:Helvetica Neue LT Com Bold"
+       inkscape:connector-curvature="0" />
+    <path
+       sodipodi:type="arc"
+       style="fill:#ffffff;fill-opacity:1;stroke:none"
+       id="path4025"
+       sodipodi:cx="836.50732"
+       sodipodi:cy="230.95239"
+       sodipodi:rx="13.435029"
+       sodipodi:ry="13.435029"
+       d="m 849.94235,230.95239 a 13.435029,13.435029 0 1 1 -26.87005,0 13.435029,13.435029 0 1 1 26.87005,0 z"
+       transform="matrix(2.193362,0,0,2.193362,-1651.9421,-440.84345)" />
+    <path
+       transform="matrix(2.193362,0,0,2.193362,-1505.7305,-124.45147)"
+       d="m 849.94235,230.95239 a 13.435029,13.435029 0 1 1 -26.87005,0 13.435029,13.435029 0 1 1 26.87005,0 z"
+       sodipodi:ry="13.435029"
+       sodipodi:rx="13.435029"
+       sodipodi:cy="230.95239"
+       sodipodi:cx="836.50732"
+       id="path4027"
+       style="fill:#ffffff;fill-opacity:1;stroke:none"
+       sodipodi:type="arc" />
+  </g>
+</svg>

=== added file 'dmedia/gtk/ui/peering.css'
--- dmedia/gtk/ui/peering.css	1970-01-01 00:00:00 +0000
+++ dmedia/gtk/ui/peering.css	2012-10-09 20:57:30 +0000
@@ -0,0 +1,124 @@
+.hide {
+    display: none !important;
+}
+
+body {
+    font-family: Lato;
+    font-size: 21px;
+    background-color: #301438;
+    color: #fff;
+    text-align: center;
+}
+
+code, input {
+    font-family: "Ubuntu Mono";
+    font-size: 60px;
+    font-weight: bold;
+    color: #333;
+    text-shadow: 0px 0px 3px #e81f3b;
+    letter-spacing: 0.15em;
+    line-height: 1.4em;
+    margin: 0.4em;
+}
+
+input {
+    width: 5.4em;
+}
+
+.secret {
+    text-align: center;
+    background-color: #fff;
+    text-align: center;
+    box-shadow: 2px 2px 6px #000;
+    border-radius: 10px;
+    cursor: pointer;
+    -webkit-user-select: none;
+    display: inline-block;
+}
+
+#first, #sync {
+    position: fixed;
+    width: 440px;
+    background-color: #fff;
+    text-align: center;
+    box-shadow: 2px 2px 5px #000;
+    border-radius: 8px;
+    cursor: pointer;
+    -webkit-user-select: none;
+    color: #000;
+}
+
+#first p, #sync p {
+    margin: 16px;
+}
+
+#first {
+    top: 30px;
+    left: 71px;
+}
+
+#sync {
+    bottom: 30px;
+    /*left: 449px;*/
+    right: 71px;
+}
+
+p.top {
+    font-weight: bold;
+}
+
+#logo {
+    position: fixed;
+    top: 190px;
+    left: 400px;
+    width: 160px;
+    height: 160px;
+    -webkit-transition: -webkit-transform 500ms linear;
+}
+
+#logo.spinleft {
+    -webkit-transform: rotate(-180deg);   
+}
+
+#logo.spinright {
+    -webkit-transform: rotate(180deg);   
+}
+
+
+p.gen {
+    margin: 2em;
+    font-size: 28px;
+}
+
+
+#finish {
+    position: fixed;
+    width: 160px;
+    height: 160px;
+    bottom: 60px;
+    right: 60px;
+    cursor: pointer;
+    -webkit-transition-timing-function: ease;
+    -webkit-transition-duration: 300ms;
+    -webkit-transition-property: right, bottom;
+}
+
+#finish.hidden {
+    bottom: -134px;
+    right: -134px;
+}
+
+#logo2 {
+    z-index: 10;
+    position: fixed;
+    width: 160px;
+    height: 160px;
+    bottom: 60px;
+    right: 60px;
+    -webkit-transition: -webkit-transform 2000ms linear;
+}
+
+#logo2.spinright {
+    -webkit-transform: rotate(360deg);   
+}
+

=== added file 'dmedia/gtk/ui/peering.js'
--- dmedia/gtk/ui/peering.js	1970-01-01 00:00:00 +0000
+++ dmedia/gtk/ui/peering.js	2012-10-09 20:57:30 +0000
@@ -0,0 +1,183 @@
+"use strict";
+
+var Hub = {
+    /*
+    Relay signals between JavaScript and Gtk.
+
+    For example, to send a signal to Gtk via document.title:
+
+    >>> Hub.send('click');
+    >>> Hub.send('changed', 'foo', 'bar');
+
+    Or from the Gtk side, send a signal to JavaScript by using
+    WebView.execute_script() to call Hub.recv() like this:
+
+    >>> Hub.recv('{"signal": "error", "args": ["oops!"]}');
+
+    Use userwebkit.BaseApp.send() as a shortcut to do the above.
+
+    Lastly, to emit a signal from JavaScript to JavaScript handlers, use
+    Hub.emit() like this:
+
+    >>> Hub.emit('changed', 'foo', 'bar');
+
+    */
+    i: 0,
+
+    names: {},
+
+    connect: function(signal, callback, self) {
+        /*
+        Connect a signal handler.
+
+        For example:
+
+        >>> Hub.connect('changed', this.on_changed, this);
+
+        */
+        if (! Hub.names[signal]) {
+            Hub.names[signal] = [];
+        }
+        Hub.names[signal].push({callback: callback, self: self});
+    },
+
+    send: function() {
+        /*
+        Send a signal to the Gtk side by changing document.title.
+
+        For example:
+
+        >>> Hub.send('changed', 'foo', 'bar');
+
+        */
+        var params = Array.prototype.slice.call(arguments);
+        var signal = params[0];
+        var args = params.slice(1);
+        Hub._emit(signal, args);
+        var obj = {
+            'i': Hub.i,
+            'signal': signal,
+            'args': args,
+        };
+        Hub.i += 1;
+        document.title = JSON.stringify(obj);
+    },
+
+    recv: function(data) {
+        /*
+        Gtk should call this function to emit a signal to JavaScript handlers.
+        
+        For example:
+
+        >>> Hub.recv('{"signal": "changed", "args": ["foo", "bar"]}');
+
+        If you need to emit a signal from JavaScript to JavaScript handlers,
+        use Hub.emit() instead.
+        */
+        var obj = JSON.parse(data);
+        Hub._emit(obj.signal, obj.args);
+    },
+
+    emit: function() {
+        /*
+        Emit a signal from JavaScript to JavaScript handlers.
+
+        For example:
+
+        >>> Hub.emit('changed', 'foo', 'bar');
+
+        */
+        var params = Array.prototype.slice.call(arguments);
+        Hub._emit(params[0], params.slice(1));
+    },
+
+    _emit: function(signal, args) {
+        /*
+        Low-level private function to emit a signal to JavaScript handlers.
+        */
+        var handlers = Hub.names[signal];
+        if (handlers) {
+            handlers.forEach(function(h) {
+                h.callback.apply(h.self, args);
+            });
+        }
+    },
+}
+
+
+function $bind(func, self) {
+    return function() {
+        var args = Array.prototype.slice.call(arguments);
+        return func.apply(self, args);
+    }
+}
+
+
+function $(id) {
+    /*
+    Return the element with id="id".
+
+    If `id` is an Element, it is returned unchanged.
+
+    Examples:
+
+    >>> $('browser');
+    <div id="browser" class="box">
+    >>> var el = $('browser');
+    >>> $(el);
+    <div id="browser" class="box">
+
+    */
+    if (id instanceof Element) {
+        return id;
+    }
+    return document.getElementById(id);
+}
+
+
+function $el(tag, attributes) {
+    /*
+    Convenience function to create a new DOM element and set its attributes.
+
+    Examples:
+
+    >>> $el('img');
+    <img>
+    >>> $el('img', {'class': 'thumbnail', 'src': 'foo.png'});
+    <img class="thumbnail" src="foo.png">
+
+    */
+    var el = document.createElement(tag);
+    if (attributes) {
+        var key;
+        for (key in attributes) {
+            var value = attributes[key];
+            if (key == 'textContent') {
+                el.textContent = value;
+            }
+            else {
+                el.setAttribute(key, value);
+            }
+        }
+    }
+    return el;
+}
+
+
+function $hide(id) {
+    var element = $(id);
+    if (element) {
+        element.classList.add('hide');
+        return element;
+    }
+}
+
+
+function $show(id) {
+    var element = $(id);
+    if (element) {
+        element.classList.remove('hide');
+        return element;
+    }
+}
+

=== added file 'dmedia/gtk/ui/server.html'
--- dmedia/gtk/ui/server.html	1970-01-01 00:00:00 +0000
+++ dmedia/gtk/ui/server.html	2012-10-09 20:57:30 +0000
@@ -0,0 +1,37 @@
+<!DOCTYPE html>
+<html>
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+<link rel="stylesheet" href="peering.css" />
+<script src="peering.js"></script>
+<script>
+
+"use strict";
+
+Hub.connect('display_secret',
+    function(secret) {
+        $('secret').textContent = secret;
+    }
+);
+
+Hub.connect('set_message',
+    function(message) {
+        $('message').textContent = message;  
+    }
+);
+
+window.onload = function() {
+    Hub.send('get_secret');  
+}
+
+</script>
+</head>
+<p class="gen">
+This is your secret code:
+</p>
+<div class="secret">
+<code id="secret"></code>
+</div>
+<p id="message"></p>
+</body>
+</html>

=== added file 'dmedia/gtk/ui/sync.svg'
--- dmedia/gtk/ui/sync.svg	1970-01-01 00:00:00 +0000
+++ dmedia/gtk/ui/sync.svg	2012-10-09 20:57:30 +0000
@@ -0,0 +1,119 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   width="512"
+   height="512"
+   id="svg4778"
+   version="1.1"
+   inkscape:version="0.48.3.1 r9886"
+   sodipodi:docname="sync.svg"
+   inkscape:export-filename="/home/izo/Pictures/Client_Work/Novacut/Final-Artwork/web/PNG/novacut-solo-brandmark_PINK_FINAL-PNG-300dpi.png"
+   inkscape:export-xdpi="300.05859"
+   inkscape:export-ydpi="300.05859">
+  <defs
+     id="defs4780">
+    <inkscape:path-effect
+       effect="spiro"
+       id="path-effect5868"
+       is_visible="true" />
+  </defs>
+  <sodipodi:namedview
+     id="base"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageopacity="0.0"
+     inkscape:pageshadow="2"
+     inkscape:zoom="1"
+     inkscape:cx="233.49618"
+     inkscape:cy="280"
+     inkscape:current-layer="layer1"
+     inkscape:document-units="px"
+     showgrid="false"
+     inkscape:window-width="2495"
+     inkscape:window-height="1576"
+     inkscape:window-x="65"
+     inkscape:window-y="24"
+     inkscape:window-maximized="1"
+     showguides="false"
+     inkscape:guide-bbox="true">
+    <inkscape:grid
+       type="xygrid"
+       id="grid2994"
+       empspacing="4"
+       visible="true"
+       enabled="true"
+       snapvisiblegridlinesonly="true" />
+    <sodipodi:guide
+       orientation="1,0"
+       position="256,88"
+       id="guide3002" />
+    <sodipodi:guide
+       orientation="0,1"
+       position="592,256"
+       id="guide3004" />
+    <sodipodi:guide
+       position="0,0"
+       orientation="0,512"
+       id="guide3006" />
+    <sodipodi:guide
+       position="512,0"
+       orientation="-512,0"
+       id="guide3008" />
+    <sodipodi:guide
+       position="512,512"
+       orientation="0,-512"
+       id="guide3010" />
+    <sodipodi:guide
+       position="0,512"
+       orientation="512,0"
+       id="guide3012" />
+  </sodipodi:namedview>
+  <metadata
+     id="metadata4783">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title />
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     id="layer1"
+     inkscape:label="Layer 1"
+     inkscape:groupmode="layer"
+     transform="translate(0,32)">
+    <path
+       transform="matrix(1.0666667,0,0,1.0666667,-85.333334,-32.000001)"
+       d="M 545,240 C 545,364.26407 444.26407,465 320,465 195.73593,465 95,364.26407 95,240 95,115.73593 195.73593,15 320,15 444.26407,15 545,115.73593 545,240 z"
+       sodipodi:ry="225"
+       sodipodi:rx="225"
+       sodipodi:cy="240"
+       sodipodi:cx="320"
+       id="path5924"
+       style="fill:#e81f3b;fill-opacity:1;stroke:none"
+       sodipodi:type="arc" />
+    <text
+       xml:space="preserve"
+       style="font-size:159.66772461px;font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;line-height:125%;letter-spacing:0px;word-spacing:0px;fill:#ffffff;fill-opacity:1;stroke:none;font-family:Lato;-inkscape-font-specification:Lato"
+       x="71.52964"
+       y="277.69928"
+       id="text2994"
+       sodipodi:linespacing="125%"><tspan
+         sodipodi:role="line"
+         id="tspan2996"
+         x="71.52964"
+         y="277.69928">Sync!</tspan></text>
+  </g>
+</svg>

=== modified file 'dmedia/httpd.py'
--- dmedia/httpd.py	2012-10-04 20:46:18 +0000
+++ dmedia/httpd.py	2012-10-09 20:57:30 +0000
@@ -272,6 +272,12 @@
         self.remote = '{REMOTE_ADDR} {REMOTE_PORT}'.format(**environ)
         self.start = None
 
+    def handle(self):
+        if self.environ['wsgi.multithread']:
+            self.handle_many()
+        else:
+            self.handle_one()
+
     def handle_many(self):
         count = 0
         try:
@@ -412,6 +418,12 @@
         self.url = template.format(self.scheme, self.port)
         self.environ = self.build_base_environ()
         self.socket.listen(5)
+        self.thread = None
+        self.running = False
+
+    def __del__(self):
+        if self.running:
+            self.shutdown()
 
     def build_base_environ(self):
         """
@@ -469,6 +481,7 @@
     def serve_forever(self):
         while True:
             (conn, address) = self.socket.accept()
+            conn.settimeout(SOCKET_TIMEOUT)
             thread = threading.Thread(
                 target=self.handle_connection,
                 args=(conn, address),
@@ -476,12 +489,45 @@
             thread.daemon = True
             thread.start()
 
+    def start(self):
+        assert self.thread is None
+        assert self.running is False
+        self.running = True
+        self.thread = threading.Thread(
+            target=self.serve_single_threaded,
+        )
+        self.thread.daemon = True
+        self.thread.start()
+
+    def shutdown(self):
+        assert self.running is True
+        self.running = False
+        self.thread.join()
+        self.thread = None
+
+    def reconfigure(self, app, ssl_config):
+        assert set(ssl_config) == set(['cert_file', 'key_file', 'ca_file'])
+        self.shutdown()
+        self.app = app
+        self.context = build_server_ssl_context(ssl_config)
+        self.start()
+
+    def serve_single_threaded(self):
+        self.environ['wsgi.multithread'] = False
+        self.socket.settimeout(0.25)
+        while self.running:
+            try:
+                (conn, address) = self.socket.accept()
+                conn.settimeout(0.50)
+                self.handle_connection(conn, address)
+            except socket.timeout:
+                pass
+
     def handle_connection(self, conn, address):
         #conn.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, True)
         remote = '{} {}'.format(address[0], address[1])
         try:
             log.info('%s\tNew Connection', remote)
-            conn.settimeout(SOCKET_TIMEOUT)
             if self.context is not None:
                 conn = self.context.wrap_socket(conn, server_side=True)
             self.handle_requests(conn, address)
@@ -497,7 +543,7 @@
         environ = self.environ.copy()
         environ.update(self.build_connection_environ(conn, address))
         handler = Handler(self.app, environ, conn)
-        handler.handle_many()
+        handler.handle()
 
 
 ############################
@@ -537,8 +583,11 @@
 
 
 def run_server(queue, app, bind_address='::1', ssl_config=None):
-    server = make_server(app, bind_address, ssl_config)
-    env = {'port': server.port, 'url': server.url}
-    queue.put(env)
-    server.serve_forever()
+    try:
+        server = make_server(app, bind_address, ssl_config)
+        env = {'port': server.port, 'url': server.url}
+        queue.put(env)
+        server.serve_forever()
+    except Exception as e:
+        queue.put(e)
 

=== modified file 'dmedia/peering.py'
--- dmedia/peering.py	2012-10-03 17:21:46 +0000
+++ dmedia/peering.py	2012-10-09 20:57:30 +0000
@@ -107,7 +107,7 @@
 
 """
 
-from base64 import b32encode, b32decode
+import base64
 import os
 from os import path
 import stat
@@ -115,9 +115,14 @@
 import shutil
 from collections import namedtuple
 from subprocess import check_call, check_output
+import json
+import socket
+import logging
 
 from skein import skein512
-from microfiber import random_id
+from microfiber import random_id, dumps
+
+from dmedia.httpd import WSGIError
 
 
 DAYS = 365 * 10
@@ -128,6 +133,11 @@
 PERS_PUBKEY = b'20120918 [e-mail] dmedia/pubkey'
 PERS_RESPONSE = b'20120918 [e-mail] dmedia/response'
 
+USER = os.environ.get('USER')
+HOST = socket.gethostname()
+
+log = logging.getLogger()
+
 
 class IdentityError(Exception):
     def __init__(self, filename, expected, got):
@@ -147,6 +157,15 @@
     pass
 
 
+class IssuerError(IdentityError):
+    pass
+
+
+class VerificationError(IdentityError):
+    pass
+    
+
+
 def create_key(dst_file, bits=2048):
     """
     Create an RSA keypair and save it to *dst_file*.
@@ -262,6 +281,33 @@
     return line[len(prefix):]
 
 
+def get_issuer(cert_file):
+    """
+    Get the issuer from an X509 certificate (CA or issued certificate).
+    """
+    line = check_output(['openssl', 'x509',
+        '-issuer',
+        '-noout',
+        '-in', cert_file,
+    ]).decode('utf-8').rstrip('\n')
+
+    prefix = 'issuer= '  # Different than get_csr_subject()
+    if not line.startswith(prefix):
+        raise Exception(line)
+    return line[len(prefix):]
+
+
+def ssl_verify(cert_file, ca_file):
+    line = check_output(['openssl', 'verify',
+        '-CAfile', ca_file,
+        cert_file
+    ]).decode('utf-8')
+    expected = '{}: OK\n'.format(cert_file)
+    if line != expected:
+        raise VerificationError(cert_file, expected, line)
+    return cert_file
+
+
 def verify_key(filename, _id):
     actual_id = hash_pubkey(get_rsa_pubkey(filename))
     if _id != actual_id:
@@ -291,6 +337,38 @@
     return filename
 
 
+def verify_ca(filename, _id):
+    filename = verify(filename, _id)
+    issuer = make_subject(_id)
+    actual_issuer = get_issuer(filename)
+    if issuer != actual_issuer:
+        raise IssuerError(filename, issuer, actual_issuer)
+    return ssl_verify(filename, filename)
+    return filename
+
+
+def verify_cert(cert_file, cert_id, ca_file, ca_id):
+    filename = verify(cert_file, cert_id)
+    issuer = make_subject(ca_id)
+    actual_issuer = get_issuer(filename)
+    if issuer != actual_issuer:
+        raise IssuerError(filename, issuer, actual_issuer)
+    return ssl_verify(filename, ca_file)
+    return filename
+
+
+def encode(value):
+    assert isinstance(value, bytes)
+    assert len(value) > 0 and len(value) % 5 == 0
+    return base64.b32encode(value).decode('utf-8')
+
+
+def decode(value):
+    assert isinstance(value, str)
+    assert len(value) > 0 and len(value) % 8 == 0
+    return base64.b32decode(value.encode('utf-8'))
+
+
 def _hash_pubkey(data):
     return skein512(data,
         digest_bits=240,
@@ -299,7 +377,7 @@
 
 
 def hash_pubkey(data):
-    return b32encode(_hash_pubkey(data)).decode('utf-8')
+    return encode(_hash_pubkey(data))
 
 
 def _hash_cert(cert_data):
@@ -310,7 +388,7 @@
 
 
 def hash_cert(cert_data):
-    return b32encode(_hash_cert(cert_data)).decode('utf-8')
+    return encode(_hash_cert(cert_data))
 
 
 def compute_response(secret, challenge, nonce, challenger_hash, responder_hash):
@@ -326,15 +404,253 @@
 
     :param responder_hash: hash of the responders certificate
     """
+    assert len(secret) == 5
+    assert len(challenge) == 20
+    assert len(nonce) == 20
+    assert len(challenger_hash) == 30
+    assert len(responder_hash) == 30
     skein = skein512(
         digest_bits=280,
         pers=PERS_RESPONSE,
         key=secret,
-        nonce=(challange + nonce),
+        nonce=(challenge + nonce),
     )
     skein.update(challenger_hash)
     skein.update(responder_hash)
-    return b32encode(skein.digest()).decode('utf-8')
+    return encode(skein.digest())
+
+
+class WrongResponse(Exception):
+    def __init__(self, expected, got):
+        self.expected = expected
+        self.got = got
+        super().__init__('Incorrect response')
+
+
+class ChallengeResponse:
+    def __init__(self, _id, peer_id):
+        self.id = _id
+        self.peer_id = peer_id
+        self.local_hash = decode(_id)
+        self.remote_hash = decode(peer_id)
+        assert len(self.local_hash) == 30
+        assert len(self.remote_hash) == 30
+
+    def get_secret(self):
+        # 40-bit secret (8 characters when base32 encoded)
+        self.secret = os.urandom(5)
+        return encode(self.secret)
+
+    def set_secret(self, secret):
+        assert len(secret) == 8
+        self.secret = decode(secret)
+        assert len(self.secret) == 5
+
+    def get_challenge(self):
+        self.challenge = os.urandom(20)
+        return encode(self.challenge)
+
+    def create_response(self, challenge):
+        nonce = os.urandom(20)
+        response = compute_response(
+            self.secret,
+            decode(challenge),
+            nonce,
+            self.remote_hash,
+            self.local_hash
+        )
+        return (encode(nonce), response)
+
+    def check_response(self, nonce, response):
+        expected = compute_response(
+            self.secret,
+            self.challenge,
+            decode(nonce),
+            self.local_hash,
+            self.remote_hash
+        )
+        if response != expected:
+            del self.secret
+            del self.challenge
+            raise WrongResponse(expected, response)
+
+
+class InfoApp:
+    def __init__(self, _id):
+        self.id = _id
+        obj = {
+            'id': _id,
+            'user': USER,
+            'host': HOST,
+        }
+        self.info = dumps(obj).encode('utf-8')
+        self.info_length = str(len(self.info))
+
+    def __call__(self, environ, start_response):
+        if environ['wsgi.multithread'] is not False:
+            raise WSGIError('500 Internal Server Error')
+        if environ['PATH_INFO'] != '/':
+            raise WSGIError('410 Gone')
+        if environ['REQUEST_METHOD'] != 'GET':
+            raise WSGIError('405 Method Not Allowed')
+        start_response('200 OK',
+            [
+                ('Content-Length', self.info_length),
+                ('Content-Type', 'application/json'),
+            ]
+        )
+        return [self.info]
+
+
+class ClientApp:
+    allowed_states = (
+        'ready',
+        'gave_challenge',
+        'in_response',
+        'wrong_response',
+        'response_ok',
+    )
+
+    forwarded_states = (
+        'wrong_response',
+        'response_ok',
+    )
+
+    def __init__(self, cr, queue):
+        assert isinstance(cr, ChallengeResponse)
+        self.cr = cr
+        self.queue = queue
+        self.__state = None
+        self.map = {
+            '/challenge': self.get_challenge,
+            '/response': self.put_response,
+        }
+
+    def get_state(self):
+        return self.__state
+
+    def set_state(self, state):
+        if state not in self.__class__.allowed_states:
+            self.__state = None
+            log.error('invalid state: %r', state)
+            raise Exception('invalid state: {!r}'.format(state))
+        self.__state = state
+        if state in self.__class__.forwarded_states:
+            self.queue.put(state)
+
+    state = property(get_state, set_state)
+
+    def __call__(self, environ, start_response):
+        if environ['wsgi.multithread'] is not False:
+            raise WSGIError('500 Internal Server Error')
+        if environ.get('SSL_CLIENT_VERIFY') != 'SUCCESS':
+            raise WSGIError('403 Forbidden')
+        if environ.get('SSL_CLIENT_S_DN_CN') != self.cr.peer_id:
+            raise WSGIError('403 Forbidden')
+        if environ.get('SSL_CLIENT_I_DN_CN') != self.cr.peer_id:
+            raise WSGIError('403 Forbidden')
+
+        path_info = environ['PATH_INFO']
+        if path_info not in self.map:
+            raise WSGIError('410 Gone')
+        log.info('%s %s', environ['REQUEST_METHOD'], environ['PATH_INFO'])
+        try:
+            obj = self.map[path_info](environ)            
+            data = json.dumps(obj).encode('utf-8')
+            start_response('200 OK',
+                [
+                    ('Content-Length', str(len(data))),
+                    ('Content-Type', 'application/json'),
+                ]
+            )
+            return [data]
+        except WSGIError as e:
+            raise e
+        except Exception:
+            log.exception('500 Internal Server Error')
+            raise WSGIError('500 Internal Server Error')
+
+    def get_challenge(self, environ):
+        if self.state != 'ready':
+            raise WSGIError('400 Bad Request Order')
+        self.state = 'gave_challenge'
+        if environ['REQUEST_METHOD'] != 'GET':
+            raise WSGIError('405 Method Not Allowed')
+        return {
+            'challenge': self.cr.get_challenge(),
+        }
+
+    def put_response(self, environ):
+        if self.state != 'gave_challenge':
+            raise WSGIError('400 Bad Request Order')
+        self.state = 'in_response'
+        if environ['REQUEST_METHOD'] != 'PUT':
+            raise WSGIError('405 Method Not Allowed')
+        data = environ['wsgi.input'].read()
+        obj = json.loads(data.decode('utf-8'))
+        nonce = obj['nonce']
+        response = obj['response']
+        try:
+            self.cr.check_response(nonce, response)
+        except WrongResponse:
+            self.state = 'wrong_response'
+            raise WSGIError('401 Unauthorized')
+        self.state = 'response_ok'
+        return {'ok': True}
+
+
+class ServerApp(ClientApp):
+
+    allowed_states = (
+        'info',
+        'counter_response_ok',
+        'in_csr',
+        'bad_csr',
+        'cert_issued',
+    ) + ClientApp.allowed_states
+
+    forwarded_states = (
+        'bad_csr',
+        'cert_issued',
+    ) + ClientApp.forwarded_states
+
+    def __init__(self, cr, queue, pki):
+        super().__init__(cr, queue)
+        self.pki = pki
+        self.map['/'] = self.get_info
+        self.map['/csr'] = self.post_csr
+
+    def get_info(self, environ):
+        if self.state != 'info':
+            raise WSGIError('400 Bad Request State')
+        self.state = 'ready'
+        if environ['REQUEST_METHOD'] != 'GET':
+            raise WSGIError('405 Method Not Allowed')
+        return {
+            'id': self.cr.id,
+            'user': USER,
+            'host': HOST,
+        }
+
+    def post_csr(self, environ):
+        if self.state != 'counter_response_ok':
+            raise WSGIError('400 Bad Request Order')
+        self.state = 'in_csr'
+        if environ['REQUEST_METHOD'] != 'POST':
+            raise WSGIError('405 Method Not Allowed')
+        data = environ['wsgi.input'].read()
+        obj = json.loads(data.decode('utf-8'))
+        csr_data = base64.b64decode(obj['csr'].encode('utf-8'))
+        try:
+            self.pki.write_csr(self.cr.peer_id, csr_data)
+            self.pki.issue_cert(self.cr.peer_id, self.cr.id)
+            cert_data = self.pki.read_cert2(self.cr.peer_id, self.cr.id)
+        except Exception as e:
+            log.exception('could not issue cert')
+            self.state = 'bad_csr'
+            raise WSGIError('401 Unauthorized')       
+        self.state = 'cert_issued'
+        return {'cert': base64.b64encode(cert_data).decode('utf-8')}
 
 
 def ensuredir(d):
@@ -376,6 +692,18 @@
         key_file = self.path(_id, 'key')
         return verify_key(key_file, _id)
 
+    def read_key(self, _id):
+        key_file = self.verify_key(_id)
+        return open(key_file, 'rb').read()
+
+    def write_key(self, _id, data):
+        tmp_file = self.random_tmp()
+        open(tmp_file, 'wb').write(data)
+        verify_key(tmp_file, _id)
+        key_file = self.path(_id, 'key')
+        os.rename(tmp_file, key_file)
+        return key_file
+
     def create_ca(self, _id):
         key_file = self.verify_key(_id)
         subject = make_subject(_id)
@@ -387,7 +715,19 @@
 
     def verify_ca(self, _id):
         ca_file = self.path(_id, 'ca')
-        return verify(ca_file, _id)
+        return verify_ca(ca_file, _id)
+
+    def read_ca(self, _id):
+        ca_file = self.verify_ca(_id)
+        return open(ca_file, 'rb').read()
+
+    def write_ca(self, _id, data):
+        tmp_file = self.random_tmp()
+        open(tmp_file, 'wb').write(data)
+        verify_ca(tmp_file, _id)
+        ca_file = self.path(_id, 'ca')
+        os.rename(tmp_file, ca_file)
+        return ca_file
 
     def create_csr(self, _id):
         key_file = self.verify_key(_id)
@@ -402,6 +742,18 @@
         csr_file = self.path(_id, 'csr')
         return verify_csr(csr_file, _id)
 
+    def read_csr(self, _id):
+        csr_file = self.verify_csr(_id)
+        return open(csr_file, 'rb').read()
+
+    def write_csr(self, _id, data):
+        tmp_file = self.random_tmp()
+        open(tmp_file, 'wb').write(data)
+        verify_csr(tmp_file, _id)
+        csr_file = self.path(_id, 'csr')
+        os.rename(tmp_file, csr_file)
+        return csr_file
+
     def issue_cert(self, _id, ca_id):
         csr_file = self.verify_csr(_id)
         tmp_file = self.random_tmp()
@@ -432,6 +784,36 @@
         cert_file = self.path(_id, 'cert')
         return verify(cert_file, _id)
 
+    def verify_cert2(self, cert_id, ca_id):
+        cert_file = self.path(cert_id, 'cert')
+        ca_file = self.verify_ca(ca_id)
+        return verify_cert(cert_file, cert_id, ca_file, ca_id)
+
+    def read_cert(self, _id):
+        cert_file = self.verify_cert(_id)
+        return open(cert_file, 'rb').read()
+
+    def read_cert2(self, cert_id, ca_id):
+        cert_file = self.verify_cert2(cert_id, ca_id)
+        return open(cert_file, 'rb').read()
+
+    def write_cert(self, _id, data):
+        tmp_file = self.random_tmp()
+        open(tmp_file, 'wb').write(data)
+        verify(tmp_file, _id)
+        cert_file = self.path(_id, 'cert')
+        os.rename(tmp_file, cert_file)
+        return cert_file
+
+    def write_cert2(self, cert_id, ca_id, cert_data):
+        ca_file = self.verify_ca(ca_id)
+        tmp_file = self.random_tmp()
+        open(tmp_file, 'wb').write(cert_data)
+        verify_cert(tmp_file, cert_id, ca_file, ca_id)
+        cert_file = self.path(cert_id, 'cert')
+        os.rename(tmp_file, cert_file)
+        return cert_file
+
     def get_ca(self, _id):
         return CA(_id, self.verify_ca(_id))
 
@@ -499,4 +881,3 @@
                 'key_file': self.client.key_file,   
             })
         return config
-

=== modified file 'dmedia/service/avahi.py'
--- dmedia/service/avahi.py	2012-10-04 20:23:22 +0000
+++ dmedia/service/avahi.py	2012-10-09 20:57:30 +0000
@@ -36,6 +36,7 @@
 from dmedia import util, views
 
 log = logging.getLogger()
+PROTO = 0  # Protocol -1 = both, 0 = IPv4, 1 = IPv6
 Peer = namedtuple('Peer', 'env names')
 PEERS = '_local/peers'
 
@@ -69,7 +70,7 @@
         )
         self.group.AddService(
             -1,  # Interface
-            0,  # Protocol -1 = both, 0 = ipv4, 1 = ipv6
+            PROTO,  # Protocol -1 = both, 0 = ipv4, 1 = ipv6
             0,  # Flags
             self.id,
             self.service,
@@ -82,9 +83,9 @@
         self.group.Commit(dbus_interface='org.freedesktop.Avahi.EntryGroup')
         browser_path = self.avahi.ServiceBrowserNew(
             -1,  # Interface
-            0,  # Protocol -1 = both, 0 = ipv4, 1 = ipv6
+            PROTO,  # Protocol -1 = both, 0 = ipv4, 1 = ipv6
             self.service,
-            'local',
+            '', # Domain, default to .local
             0,  # Flags
             dbus_interface='org.freedesktop.Avahi.Server'
         )
@@ -107,7 +108,8 @@
         if key == self.id:
             return
         self.avahi.ResolveService(
-            interface, protocol, key, _type, domain, -1, 0,
+            # 2nd to last arg is Protocol, again for some reason
+            interface, protocol, key, _type, domain, PROTO, 0,
             dbus_interface='org.freedesktop.Avahi.Server',
             reply_handler=self.on_reply,
             error_handler=self.on_error,
@@ -175,7 +177,7 @@
         except KeyError:
             pass
         self.remove_replication_peer(key)
-        
+
     def on_timeout(self):
         if not self.replications:
             return True  # Repeat timeout call

=== modified file 'dmedia/service/peers.py'
--- dmedia/service/peers.py	2012-09-20 12:56:04 +0000
+++ dmedia/service/peers.py	2012-10-09 20:57:30 +0000
@@ -21,45 +21,255 @@
 
 """
 Browse for Dmedia peer offerings, publish the same.
+
+Existing machines constantly listen for _dmedia-offer._tcp.
+
+New machine publishes _dmedia-offer._tcp, and listens for _dmedia-accept._tcp.
+
+Existing machine prompts user, and if they accept, machine publishes
+_dmedia-accept._tcp, which initiates peering process.
 """
 
 import logging
+from collections import namedtuple
+import ssl
+import socket
+import threading
 
 import dbus
+from dbus.mainloop.glib import DBusGMainLoop
 from gi.repository import GObject
-
-
+from microfiber import _start_thread, random_id, CouchBase, dumps, build_ssl_context
+
+PROTO = 0  # Protocol -1 = both, 0 = IPv4, 1 = IPv6
+GObject.threads_init()
+DBusGMainLoop(set_as_default=True)
 log = logging.getLogger()
 
-
-class Peer:
-    def __init__(self, _id):
+Peer = namedtuple('Peer', 'id ip port')
+Info = namedtuple('Info', 'name host url id')
+
+
+def get_service(verb):
+    """
+    Get Avahi service name for appropriate direction.
+
+    For example, for an offer:
+
+    >>> get_service('offer')
+    '_dmedia-offer._tcp'
+
+    And for an accept:
+
+    >>> get_service('accept')
+    '_dmedia-accept._tcp'
+
+    """
+    assert verb in ('offer', 'accept')
+    return '_dmedia-{}._tcp'.format(verb)
+
+
+class State:
+    """
+    A state machine to help prevent silly mistakes.
+
+    So that threading issues don't make the code difficult to reason about,
+    a thread-lock is acquired when making a state change.  To be on the safe
+    side, you should only make state changes from the main thread.  But the
+    thread-lock is there as a safety in case an attacker could change the
+    execution such that something isn't called from the main thread, or in case
+    an oversight is made by the programmer.
+    """
+    def __init__(self):
+        self.__state = 'free'
+        self.__peer_id = None
+        self.__lock = threading.Lock()
+
+    def __repr__(self):
+        return 'State(state={!r}, peer_id={!r})'.format(
+            self.__state, self.__peer_id
+        )
+
+    @property
+    def state(self):
+        return self.__state
+
+    @property
+    def peer_id(self):
+        return self.__peer_id
+
+    def bind(self, peer_id):
+        with self.__lock:
+            assert peer_id is not None
+            if self.__state != 'free':
+                return False
+            if self.__peer_id is not None:
+                return False
+            self.__state = 'bound'
+            self.__peer_id = peer_id
+            return True
+
+    def verify(self, peer_id):
+        with self.__lock:
+            if self.__state != 'bound':
+                return False
+            if peer_id is None or peer_id != self.__peer_id:
+                return False
+            self.__state = 'verified'
+            return True
+
+    def unbind(self, peer_id):
+        with self.__lock:
+            if self.__state not in ('bound', 'verified'): 
+                return False
+            if peer_id is None or peer_id != self.__peer_id:
+                return False
+            self.__state = 'unbound'
+            return True
+
+    def activate(self, peer_id):
+        with self.__lock:
+            if self.__state != 'verified':
+                return False
+            if peer_id is None or peer_id != self.__peer_id:
+                return False
+            self.__state = 'activated'
+            self.__peer_id = peer_id
+            return True
+
+    def deactivate(self, peer_id):
+        with self.__lock:
+            if self.__state != 'activated':
+                return False
+            if peer_id is None or peer_id != self.__peer_id:
+                return False
+            self.__state = 'deactivated'
+            return True
+
+    def free(self, peer_id):
+        with self.__lock:
+            if self.__state not in ('unbound', 'deactivated'):
+                return False
+            if peer_id is None or peer_id != self.__peer_id:
+                return False
+            self.__state = 'free'
+            self.__peer_id = None
+            return True
+
+
+class AvahiPeer(GObject.GObject):
+    __gsignals__ = {
+        'offer': (GObject.SIGNAL_RUN_LAST, GObject.TYPE_NONE,
+            [GObject.TYPE_PYOBJECT]
+        ),
+        'accept': (GObject.SIGNAL_RUN_LAST, GObject.TYPE_NONE,
+            [GObject.TYPE_PYOBJECT]
+        ),
+        'retract': (GObject.SIGNAL_RUN_LAST, GObject.TYPE_NONE,
+            []
+        ),
+    }
+
+    def __init__(self, pki, client_mode=False):
+        super().__init__()
         self.group = None
-        self.id = _id
-        log.info('This cert_id = %s', _id)
+        self.pki = pki
+        self.client_mode = client_mode
+        self.id = (pki.machine.id if client_mode else pki.user.id)
+        self.cert_file = pki.verify_ca(self.id)
+        self.key_file = pki.verify_key(self.id)
+        self.state = State()
+        self.peer = None
+        self.info = None
         self.bus = dbus.SystemBus()
         self.avahi = self.bus.get_object('org.freedesktop.Avahi', '/')
 
     def __del__(self):
         self.unpublish()
 
-    def browse(self, service):
-        self.bservice = service
-        log.info('Avahi(%s): browsing...', service)
-        browser_path = self.avahi.ServiceBrowserNew(
-            -1,  # Interface
-            0,  # Protocol -1 = both, 0 = ipv4, 1 = ipv6
-            service,
-            'local',
-            0,  # Flags
-            dbus_interface='org.freedesktop.Avahi.Server'
-        )
-        self.browser = self.bus.get_object('org.freedesktop.Avahi', browser_path)
-        self.browser.connect_to_signal('ItemNew', self.on_ItemNew)
-        self.browser.connect_to_signal('ItemRemove', self.on_ItemRemove)
-
-    def publish(self, service, port):
-        self.pservice = service
+    def activate(self, peer_id):
+        if not self.state.activate(peer_id):
+            raise Exception(
+                'Cannot activate {!r} from {!r}'.format(peer_id, self.state)
+            )
+        log.info('Activated session with %r', self.peer)
+        assert self.state.state == 'activated'
+        assert self.state.peer_id == peer_id
+        assert self.peer.id == peer_id
+        assert self.info.id == peer_id
+        assert self.info.url == 'https://{}:{}/'.format(
+            self.peer.ip, self.peer.port
+        )
+
+    def deactivate(self, peer_id):
+        if not self.state.deactivate(peer_id):
+            raise Exception(
+                'Cannot deactivate {!r} from {!r}'.format(peer_id, self.state)
+            )
+        log.info('Deactivated session with %r', self.peer)
+        assert self.state.state == 'deactivated'
+        assert self.state.peer_id == peer_id
+        assert self.peer.id == peer_id
+        assert self.info.id == peer_id
+        assert self.info.url == 'https://{}:{}/'.format(
+            self.peer.ip, self.peer.port
+        )
+        GObject.timeout_add(15 * 1000, self.on_timeout, peer_id)
+
+    def abort(self, peer_id):
+        GObject.idle_add(self.unbind, peer_id)
+
+    def unbind(self, peer_id):
+        retract = (self.state.state == 'verified')
+        if not self.state.unbind(peer_id):
+            log.error('Cannot unbind %s from %r', peer_id, self.state)
+            return
+        log.info('Unbound from %s', peer_id)
+        assert self.state.peer_id == peer_id
+        assert self.state.state == 'unbound'
+        if retract:
+            log.info("Firing 'retract' signal")
+            self.emit('retract')
+        GObject.timeout_add(10 * 1000, self.on_timeout, peer_id)
+
+    def on_timeout(self, peer_id):
+        if not self.state.free(peer_id):
+            log.error('Cannot free %s from %r', peer_id, self.state)
+            return
+        log.info('Rate-limiting timeout reached, freeing from %s', peer_id)
+        assert self.state.state == 'free'
+        assert self.state.peer_id is None
+        self.info = None
+        self.peer = None
+
+    def get_server_config(self):
+        """
+        Get the initial server SSL config.
+        """
+        assert self.state.state in ('free', 'activated')
+        config = {
+            'key_file': self.key_file,
+            'cert_file': self.cert_file,
+        }
+        if self.client_mode is False or self.state.state == 'activated':
+            config['ca_file'] = self.pki.verify_ca(self.state.peer_id)
+        return config
+
+    def get_client_config(self):
+        """
+        Get the client SSL config.
+        """
+        assert self.state.state == 'activated'
+        return {
+            'ca_file': self.pki.verify_ca(self.state.peer_id),
+            'check_hostname': False,
+            'key_file': self.key_file,
+            'cert_file': self.cert_file,
+        }
+
+    def publish(self, port):
+        verb = ('offer' if self.client_mode else 'accept')
+        service = get_service(verb)
         self.group = self.bus.get_object(
             'org.freedesktop.Avahi',
             self.avahi.EntryGroupNew(
@@ -67,11 +277,11 @@
             )
         )
         log.info(
-            'Avahi(%s): publishing %s on port %s', service, self.id, port
+            'Publishing %s for %r on port %s', self.id, service, port
         )
         self.group.AddService(
             -1,  # Interface
-            0,  # Protocol -1 = both, 0 = ipv4, 1 = ipv6
+            PROTO,  # Protocol -1 = both, 0 = ipv4, 1 = ipv6
             0,  # Flags
             self.id,
             service,
@@ -85,37 +295,125 @@
 
     def unpublish(self):
         if self.group is not None:
-            log.info('Avahi(%s): unpublishing %s', self.pservice, self.id)
+            log.info('Un-publishing %s', self.id)
             self.group.Reset(dbus_interface='org.freedesktop.Avahi.EntryGroup')
             self.group = None
 
-    def on_ItemNew(self, interface, protocol, key, _type, domain, flags):
+    def browse(self):
+        verb = ('accept' if self.client_mode else 'offer')
+        service = get_service(verb)
+        log.info('Browsing for %r', service)
+        path = self.avahi.ServiceBrowserNew(
+            -1,  # Interface
+            PROTO,  # Protocol -1 = both, 0 = ipv4, 1 = ipv6
+            service,
+            '', # Domain, default to .local
+            0,  # Flags
+            dbus_interface='org.freedesktop.Avahi.Server'
+        )
+        self.browser = self.bus.get_object('org.freedesktop.Avahi', path)
+        self.browser.connect_to_signal('ItemNew', self.on_ItemNew)
+        self.browser.connect_to_signal('ItemRemove', self.on_ItemRemove)
+
+    def on_ItemNew(self, interface, protocol, peer_id, _type, domain, flags):
+        log.info('Peer added: %s', peer_id)
+        if not self.state.bind(str(peer_id)):
+            log.error('Cannot bind %s from %r', peer_id, self.state)
+            log.warning('Possible attack from %s', peer_id)
+            return
+        assert self.state.state == 'bound'
+        assert self.state.peer_id == peer_id
+        log.info('Bound to %s', peer_id)
         self.avahi.ResolveService(
-            interface, protocol, key, _type, domain, -1, 0,
+            # 2nd to last arg is Protocol, again for some reason
+            interface, protocol, peer_id, _type, domain, PROTO, 0,
             dbus_interface='org.freedesktop.Avahi.Server',
             reply_handler=self.on_reply,
             error_handler=self.on_error,
         )
 
     def on_reply(self, *args):
-        key = args[2]
+        peer_id = args[2]
+        if self.state.peer_id != peer_id or self.state.state != 'bound':
+            log.error(
+                '%s: state mismatch in on_reply(): %r', peer_id, self.state
+            )
+            return
         (ip, port) = args[7:9]
-        url = 'http://{}:{}/'.format(ip, port)
-        log.info('Avahi(%s): new peer %s at %s', self.bservice, key, url)
-
-    def on_error(self, exception):
-        log.error('%s: error calling ResolveService(): %r', self.bservice, exception)
-
-    def on_ItemRemove(self, interface, protocol, key, _type, domain, flags):
-        log.info('Avahi(%s): peer removed: %s', self.bservice, key)
-
-
-
-class Browser:
-    def __init__(self, service, add_callback, remove_callback):
-        self.service = service
-        self.add_callback = add_callback
-        self.remove_callback = remove_callback
-    
-    
-
+        log.info('%s is at %s, port %s', peer_id, ip, port)
+        self.peer = Peer(str(peer_id), str(ip), int(port))
+        _start_thread(self.cert_thread, self.peer)
+
+    def on_error(self, error):
+        log.error(
+            '%s: error calling ResolveService(): %r', self.state.peer_id, error
+        )
+        self.abort(self.state.peer_id)
+
+    def on_ItemRemove(self, interface, protocol, peer_id, _type, domain, flags):
+        log.info('Peer removed: %s', peer_id)
+        self.abort(peer_id)
+
+    def cert_thread(self, peer):
+        # 1 Retrieve the peer certificate:
+        try:
+            ctx = ssl.SSLContext(ssl.PROTOCOL_TLSv1)
+            ctx.options |= ssl.OP_NO_COMPRESSION
+            if self.client_mode:
+                # The server will only let its cert be retrieved by the client
+                # bound to the peering session
+                ctx.load_cert_chain(self.cert_file, self.key_file)
+            sock = ctx.wrap_socket(
+                socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+            )
+            sock.connect((peer.ip, peer.port))
+            pem = ssl.DER_cert_to_PEM_cert(sock.getpeercert(True))
+        except Exception as e:
+            log.exception('Could not retrieve cert for %r', peer)
+            return self.abort(peer.id)
+        log.info('Retrieved cert for %r', peer)
+
+        # 2 Make sure peer cert has correct intrinsic CN, etc:
+        try:
+            ca_file = self.pki.write_ca(peer.id, pem.encode('ascii'))
+        except Exception as e:
+            log.exception('Could not verify cert for %r', peer)
+            return self.abort(peer.id)
+        log.info('Verified cert for %r', peer)
+
+        # 3 Make get request to verify peer has private key:
+        try:
+            url = 'https://{}:{}/'.format(peer.ip, peer.port)
+            ssl_config = {
+                'ca_file': ca_file,
+                'check_hostname': False,
+            }
+            if self.client_mode:
+                ssl_config.update({
+                    'key_file': self.key_file,
+                    'cert_file': self.cert_file,
+                })
+            client = CouchBase({'url': url, 'ssl': ssl_config})
+            d = client.get()
+            info = Info(d['user'], d['host'], url, peer.id)
+        except Exception as e:
+            log.exception('GET / failed for %r', peer)
+            return self.abort(peer.id)
+        log.info('GET / succeeded with %r', info)
+        GObject.idle_add(self.on_cert_complete, peer, info)
+
+    def on_cert_complete(self, peer, info):
+        if not self.state.verify(peer.id):
+            log.error(
+                '%s: mismatch in on_cert_complete(): %r', peer.id, self.state
+            )
+            return
+        assert self.state.state == 'verified'
+        assert self.state.peer_id == peer.id
+        assert peer is self.peer
+        assert self.info is None
+        self.info = info
+        log.info('Cert checked-out for %r', peer)
+        signal = ('accept' if self.client_mode else 'offer')
+        log.info('Firing %r signal for %r', signal, info)
+        self.emit(signal, info)

=== modified file 'dmedia/tests/test_peering.py'
--- dmedia/tests/test_peering.py	2012-10-01 20:00:25 +0000
+++ dmedia/tests/test_peering.py	2012-10-09 20:57:30 +0000
@@ -27,10 +27,15 @@
 import os
 from os import path
 import subprocess
+import socket
+from queue import Queue
 
-from microfiber import random_id
+import microfiber
+from microfiber import random_id, CouchBase
 
 from .base import TempDir
+from dmedia.httpd import make_server
+from dmedia.peering import encode, decode
 from dmedia import peering
 
 
@@ -162,6 +167,445 @@
         os.remove(key_file)
         self.assertEqual(peering.get_csr_subject(csr_file), subject)
 
+    def test_get_issuer(self):
+        tmp = TempDir()
+
+        foo_subject = '/CN={}'.format(random_id(30))
+        foo_key = tmp.join('foo.key')
+        foo_ca = tmp.join('foo.ca')
+        foo_srl = tmp.join('foo.srl')
+        peering.create_key(foo_key)
+        peering.create_ca(foo_key, foo_subject, foo_ca)
+        self.assertEqual(peering.get_issuer(foo_ca), foo_subject)
+
+        bar_subject = '/CN={}'.format(random_id(30))
+        bar_key = tmp.join('bar.key')
+        bar_csr = tmp.join('bar.csr')
+        bar_cert = tmp.join('bar.cert')
+        peering.create_key(bar_key)
+        peering.create_csr(bar_key, bar_subject, bar_csr)
+        peering.issue_cert(bar_csr, foo_ca, foo_key, foo_srl, bar_cert)
+        self.assertEqual(peering.get_csr_subject(bar_csr), bar_subject)
+        self.assertEqual(peering.get_issuer(bar_cert), foo_subject)
+
+    def test_ssl_verify(self):
+        tmp = TempDir()
+        pki = peering.PKI(tmp.dir)
+
+        ca1 = pki.create_key()
+        pki.create_ca(ca1)
+        cert1 = pki.create_key()
+        pki.create_csr(cert1)
+        pki.issue_cert(cert1, ca1)
+        ca1_file = pki.path(ca1, 'ca')
+        cert1_file = pki.path(cert1, 'cert')
+        self.assertEqual(peering.ssl_verify(ca1_file, ca1_file), ca1_file)
+        self.assertEqual(peering.ssl_verify(cert1_file, ca1_file), cert1_file)
+        with self.assertRaises(peering.VerificationError) as cm:
+            peering.ssl_verify(ca1_file, cert1_file)
+        with self.assertRaises(peering.VerificationError) as cm:
+            peering.ssl_verify(cert1_file, cert1_file)
+
+        ca2 = pki.create_key()
+        pki.create_ca(ca2)
+        cert2 = pki.create_key()
+        pki.create_csr(cert2)
+        pki.issue_cert(cert2, ca2)
+        ca2_file = pki.path(ca2, 'ca')
+        cert2_file = pki.path(cert2, 'cert')
+        self.assertEqual(peering.ssl_verify(ca2_file, ca2_file), ca2_file)
+        self.assertEqual(peering.ssl_verify(cert2_file, ca2_file), cert2_file)
+        with self.assertRaises(peering.VerificationError) as cm:
+            peering.ssl_verify(ca2_file, cert2_file)
+        with self.assertRaises(peering.VerificationError) as cm:
+            peering.ssl_verify(cert2_file, cert2_file)
+
+        with self.assertRaises(peering.VerificationError) as cm:
+            peering.ssl_verify(ca2_file, ca1_file)
+        with self.assertRaises(peering.VerificationError) as cm:
+            peering.ssl_verify(cert2_file, ca1_file)    
+        with self.assertRaises(peering.VerificationError) as cm:
+            peering.ssl_verify(cert2_file, cert1_file)
+
+
+class TestChallengeResponse(TestCase):
+    def test_init(self):
+        id1 = random_id(30)
+        id2 = random_id(30)
+        inst = peering.ChallengeResponse(id1, id2)
+        self.assertIs(inst.id, id1)
+        self.assertIs(inst.peer_id, id2)
+        self.assertEqual(inst.local_hash, peering.decode(id1))
+        self.assertEqual(inst.remote_hash, peering.decode(id2))
+
+    def test_get_secret(self):
+        id1 = random_id(30)
+        id2 = random_id(30)
+        inst = peering.ChallengeResponse(id1, id2)
+        s1 = inst.get_secret()
+        self.assertIsInstance(s1, str)
+        self.assertEqual(len(s1), 8)
+        self.assertEqual(peering.decode(s1), inst.secret)
+        s2 = inst.get_secret()
+        self.assertNotEqual(s1, s2)
+        self.assertIsInstance(s2, str)
+        self.assertEqual(len(s2), 8)
+        self.assertEqual(peering.decode(s2), inst.secret)
+
+    def test_set_secret(self):
+        id1 = random_id(30)
+        id2 = random_id(30)
+        inst = peering.ChallengeResponse(id1, id2)
+        s1 = random_id(5)
+        self.assertIsNone(inst.set_secret(s1))
+        self.assertEqual(peering.encode(inst.secret), s1)
+        s2 = random_id(5)
+        self.assertIsNone(inst.set_secret(s2))
+        self.assertEqual(peering.encode(inst.secret), s2)
+
+    def test_get_challenge(self):
+        id1 = random_id(30)
+        id2 = random_id(30)
+        inst = peering.ChallengeResponse(id1, id2)
+        c1 = inst.get_challenge()
+        self.assertIsInstance(c1, str)
+        self.assertEqual(len(c1), 32)
+        self.assertEqual(peering.decode(c1), inst.challenge)
+        c2 = inst.get_challenge()
+        self.assertNotEqual(c1, c2)
+        self.assertIsInstance(c2, str)
+        self.assertEqual(len(c2), 32)
+        self.assertEqual(peering.decode(c2), inst.challenge)
+
+    def test_create_response(self):
+        id1 = random_id(30)
+        id2 = random_id(30)
+        inst = peering.ChallengeResponse(id1, id2)
+        local_hash = decode(id1)
+        remote_hash = decode(id2)
+        secret1 = random_id(5)
+        challenge1 = random_id(20)
+        inst.set_secret(secret1)
+        (nonce1, response1) = inst.create_response(challenge1)
+        self.assertIsInstance(nonce1, str)
+        self.assertEqual(len(nonce1), 32)
+        self.assertIsInstance(response1, str)
+        self.assertEqual(len(response1), 56)
+        self.assertEqual(response1,
+            peering.compute_response(
+                decode(secret1), decode(challenge1), decode(nonce1),
+                remote_hash, local_hash
+            )
+        )
+
+        # Same secret and challenge, make sure a new nonce is used
+        (nonce2, response2) = inst.create_response(challenge1)
+        self.assertNotEqual(nonce2, nonce1)
+        self.assertNotEqual(response2, response1)
+        self.assertIsInstance(nonce2, str)
+        self.assertEqual(len(nonce2), 32)
+        self.assertIsInstance(response2, str)
+        self.assertEqual(len(response2), 56)
+        self.assertEqual(response2,
+            peering.compute_response(
+                decode(secret1), decode(challenge1), decode(nonce2),
+                remote_hash, local_hash
+            )
+        )
+
+        # Different secret
+        secret2 = random_id(5)
+        inst.set_secret(secret2)
+        (nonce3, response3) = inst.create_response(challenge1)
+        self.assertNotEqual(nonce3, nonce1)
+        self.assertNotEqual(response3, response1)
+        self.assertNotEqual(nonce3, nonce2)
+        self.assertNotEqual(response3, response2)
+        self.assertIsInstance(nonce3, str)
+        self.assertEqual(len(nonce3), 32)
+        self.assertIsInstance(response3, str)
+        self.assertEqual(len(response3), 56)
+        self.assertEqual(response3,
+            peering.compute_response(
+                decode(secret2), decode(challenge1), decode(nonce3),
+                remote_hash, local_hash
+            )
+        )
+
+        # Different challenge
+        challenge2 = random_id(20)
+        (nonce4, response4) = inst.create_response(challenge2)
+        self.assertNotEqual(nonce4, nonce1)
+        self.assertNotEqual(response4, response1)
+        self.assertNotEqual(nonce4, nonce2)
+        self.assertNotEqual(response4, response2)
+        self.assertNotEqual(nonce4, nonce3)
+        self.assertNotEqual(response4, response3)
+        self.assertIsInstance(nonce4, str)
+        self.assertEqual(len(nonce4), 32)
+        self.assertIsInstance(response4, str)
+        self.assertEqual(len(response4), 56)
+        self.assertEqual(response4,
+            peering.compute_response(
+                decode(secret2), decode(challenge2), decode(nonce4),
+                remote_hash, local_hash
+            )
+        )
+
+    def test_check_response(self):
+        id1 = random_id(30)
+        id2 = random_id(30)
+        inst = peering.ChallengeResponse(id1, id2)
+        local_hash = decode(id1)
+        remote_hash = decode(id2)
+        secret = inst.get_secret()
+        challenge = inst.get_challenge()
+        nonce = random_id(20)
+        response = peering.compute_response(
+            decode(secret), decode(challenge), decode(nonce),
+            local_hash, remote_hash
+        )
+        self.assertIsNone(inst.check_response(nonce, response))
+
+        # Test with (local, remote) order flipped
+        bad = peering.compute_response(
+            decode(secret), decode(challenge), decode(nonce),
+            remote_hash, local_hash
+        )
+        with self.assertRaises(peering.WrongResponse) as cm:
+            inst.check_response(nonce, bad)
+        self.assertEqual(cm.exception.expected, response)
+        self.assertEqual(cm.exception.got, bad)
+        self.assertFalse(hasattr(inst, 'secret'))
+        self.assertFalse(hasattr(inst, 'challenge'))
+        inst.secret = decode(secret)
+        inst.challenge = decode(challenge)
+
+        # Test with wrong secret
+        for i in range(100):
+            bad = peering.compute_response(
+                os.urandom(5), decode(challenge), decode(nonce),
+                local_hash, remote_hash
+            )
+            with self.assertRaises(peering.WrongResponse) as cm:
+                inst.check_response(nonce, bad)
+            self.assertEqual(cm.exception.expected, response)
+            self.assertEqual(cm.exception.got, bad)
+            self.assertFalse(hasattr(inst, 'secret'))
+            self.assertFalse(hasattr(inst, 'challenge'))
+            inst.secret = decode(secret)
+            inst.challenge = decode(challenge)
+
+        # Test with wrong challenge
+        for i in range(100):
+            bad = peering.compute_response(
+                decode(secret), os.urandom(20), decode(nonce),
+                local_hash, remote_hash
+            )
+            with self.assertRaises(peering.WrongResponse) as cm:
+                inst.check_response(nonce, bad)
+            self.assertEqual(cm.exception.expected, response)
+            self.assertEqual(cm.exception.got, bad)
+            self.assertFalse(hasattr(inst, 'secret'))
+            self.assertFalse(hasattr(inst, 'challenge'))
+            inst.secret = decode(secret)
+            inst.challenge = decode(challenge)
+
+        # Test with wrong nonce
+        for i in range(100):
+            bad = peering.compute_response(
+                decode(secret), decode(challenge), os.urandom(20),
+                local_hash, remote_hash
+            )
+            with self.assertRaises(peering.WrongResponse) as cm:
+                inst.check_response(nonce, bad)
+            self.assertEqual(cm.exception.expected, response)
+            self.assertEqual(cm.exception.got, bad)
+            self.assertFalse(hasattr(inst, 'secret'))
+            self.assertFalse(hasattr(inst, 'challenge'))
+            inst.secret = decode(secret)
+            inst.challenge = decode(challenge)
+
+        # Test with wrong local_hash
+        for i in range(100):
+            bad = peering.compute_response(
+                decode(secret), decode(challenge), decode(nonce),
+                os.urandom(30), remote_hash
+            )
+            with self.assertRaises(peering.WrongResponse) as cm:
+                inst.check_response(nonce, bad)
+            self.assertEqual(cm.exception.expected, response)
+            self.assertEqual(cm.exception.got, bad)
+            self.assertFalse(hasattr(inst, 'secret'))
+            self.assertFalse(hasattr(inst, 'challenge'))
+            inst.secret = decode(secret)
+            inst.challenge = decode(challenge)
+
+        # Test with wrong remote_hash
+        for i in range(100):
+            bad = peering.compute_response(
+                decode(secret), decode(challenge), decode(nonce),
+                local_hash, os.urandom(30)
+            )
+            with self.assertRaises(peering.WrongResponse) as cm:
+                inst.check_response(nonce, bad)
+            self.assertEqual(cm.exception.expected, response)
+            self.assertEqual(cm.exception.got, bad)
+            self.assertFalse(hasattr(inst, 'secret'))
+            self.assertFalse(hasattr(inst, 'challenge'))
+            inst.secret = decode(secret)
+            inst.challenge = decode(challenge)
+
+        # Test with more nonce, used as expected:
+        for i in range(100):
+            newnonce = random_id(20)
+            good = peering.compute_response(
+                decode(secret), decode(challenge), decode(newnonce),
+                local_hash, remote_hash
+            )
+            self.assertNotEqual(good, response)
+            self.assertIsNone(inst.check_response(newnonce, good))
+
+        # Sanity check on directionality, in other words, check that the
+        # response created locally can't accidentally be verified as the
+        # response from the other end
+        secret = random_id(5)
+        for i in range(1000):
+            inst.set_secret(secret)
+            challenge = inst.get_challenge()
+            (nonce, response) = inst.create_response(challenge)
+            with self.assertRaises(peering.WrongResponse) as cm:
+                inst.check_response(nonce, response)
+
+
+class TestServerApp(TestCase):
+    def test_live(self):
+        tmp = TempDir()
+        pki = peering.PKI(tmp.dir)
+        local_id = pki.create_key()
+        pki.create_ca(local_id)
+        remote_id = pki.create_key()
+        pki.create_ca(remote_id)
+        server_config = {
+            'cert_file': pki.path(local_id, 'ca'),
+            'key_file': pki.path(local_id, 'key'),
+            'ca_file': pki.path(remote_id, 'ca'),
+        }
+        client_config = {
+            'check_hostname': False,
+            'ca_file': pki.path(local_id, 'ca'),
+            'cert_file': pki.path(remote_id, 'ca'),
+            'key_file': pki.path(remote_id, 'key'),
+        }
+        local = peering.ChallengeResponse(local_id, remote_id)
+        remote = peering.ChallengeResponse(remote_id, local_id)
+        q = Queue()
+        app = peering.ServerApp(local, q, None)
+        server = make_server(app, '127.0.0.1', server_config)
+        client = CouchBase({'url': server.url, 'ssl': client_config})
+        server.start()
+        secret = local.get_secret()
+        remote.set_secret(secret)
+
+        self.assertIsNone(app.state)
+        with self.assertRaises(microfiber.BadRequest) as cm:
+            client.get('')
+        self.assertEqual(
+            str(cm.exception),
+            '400 Bad Request State: GET /'
+        )
+        app.state = 'info'
+        self.assertEqual(client.get(),
+            {
+                'id': local_id,
+                'user': os.environ.get('USER'),
+                'host': socket.gethostname(),
+            }
+        )
+        self.assertEqual(app.state, 'ready')
+        with self.assertRaises(microfiber.BadRequest) as cm:
+            client.get('')
+        self.assertEqual(
+            str(cm.exception),
+            '400 Bad Request State: GET /'
+        )
+        self.assertEqual(app.state, 'ready')
+
+        app.state = 'info'
+        with self.assertRaises(microfiber.BadRequest) as cm:
+            client.get('challenge')
+        self.assertEqual(
+            str(cm.exception),
+            '400 Bad Request Order: GET /challenge'
+        )
+        with self.assertRaises(microfiber.BadRequest) as cm:
+            client.put({'hello': 'world'}, 'response')
+        self.assertEqual(
+            str(cm.exception),
+            '400 Bad Request Order: PUT /response'
+        )
+
+        app.state = 'ready'
+        self.assertEqual(app.state, 'ready')
+        obj = client.get('challenge')
+        self.assertEqual(app.state, 'gave_challenge')
+        self.assertIsInstance(obj, dict)
+        self.assertEqual(set(obj), set(['challenge']))
+        self.assertEqual(local.challenge, decode(obj['challenge']))
+        with self.assertRaises(microfiber.BadRequest) as cm:
+            client.get('challenge')
+        self.assertEqual(
+            str(cm.exception),
+            '400 Bad Request Order: GET /challenge'
+        )
+        self.assertEqual(app.state, 'gave_challenge')
+
+        (nonce, response) = remote.create_response(obj['challenge'])
+        obj = {'nonce': nonce, 'response': response}
+        self.assertEqual(client.put(obj, 'response'), {'ok': True})
+        self.assertEqual(app.state, 'response_ok')
+        with self.assertRaises(microfiber.BadRequest) as cm:
+            client.put(obj, 'response')
+        self.assertEqual(
+            str(cm.exception),
+            '400 Bad Request Order: PUT /response'
+        )
+        self.assertEqual(app.state, 'response_ok')
+        self.assertEqual(q.get(), 'response_ok')
+
+        # Test when an error occurs in put_response()
+        app.state = 'gave_challenge'
+        with self.assertRaises(microfiber.ServerError) as cm:
+            client.put(b'bad json', 'response')
+        self.assertEqual(app.state, 'in_response')
+
+        # Test with wrong secret
+        app.state = 'ready'
+        secret = local.get_secret()
+        remote.get_secret()
+        challenge = client.get('challenge')['challenge']
+        self.assertEqual(app.state, 'gave_challenge')
+        (nonce, response) = remote.create_response(challenge)
+        with self.assertRaises(microfiber.Unauthorized) as cm:
+            client.put({'nonce': nonce, 'response': response}, 'response')
+        self.assertEqual(app.state, 'wrong_response')
+        self.assertFalse(hasattr(local, 'secret'))
+        self.assertFalse(hasattr(local, 'challenge'))
+
+        # Verify that you can't retry
+        remote.set_secret(secret)
+        (nonce, response) = remote.create_response(challenge)
+        with self.assertRaises(microfiber.BadRequest) as cm:
+            client.put({'nonce': nonce, 'response': response}, 'response')
+        self.assertEqual(
+            str(cm.exception),
+            '400 Bad Request Order: PUT /response'
+        )
+        self.assertEqual(app.state, 'wrong_response')
+        self.assertEqual(q.get(), 'wrong_response')
+
+        server.shutdown()
+
 
 class TestPKI(TestCase):
     def test_init(self):
@@ -229,6 +673,56 @@
         with self.assertRaises(subprocess.CalledProcessError) as cm:
             pki.verify_key(id2)
 
+    def test_read_key(self):
+        tmp = TempDir()
+        pki = peering.PKI(tmp.dir)
+        id1 = pki.create_key()
+        key1_file = tmp.join(id1 + '.key')
+        data1 = open(key1_file, 'rb').read()
+        id2 = pki.create_key()
+        key2_file = tmp.join(id2 + '.key')
+        data2 = open(key2_file, 'rb').read()
+        self.assertEqual(pki.read_key(id1), data1)
+        self.assertEqual(pki.read_key(id2), data2)
+        os.remove(key1_file)
+        os.rename(key2_file, key1_file)
+        with self.assertRaises(peering.PublicKeyError) as cm:
+            pki.read_key(id1)
+        self.assertEqual(cm.exception.filename, key1_file)
+        self.assertEqual(cm.exception.expected, id1)
+        self.assertEqual(cm.exception.got, id2)
+        with self.assertRaises(subprocess.CalledProcessError) as cm:
+            pki.read_key(id2)
+
+    def test_write_key(self):
+        tmp1 = TempDir()
+        src = peering.PKI(tmp1.dir)
+        tmp2 = TempDir()
+        dst = peering.PKI(tmp2.dir)
+
+        id1 = src.create_key()
+        data1 = open(src.verify_key(id1), 'rb').read()
+        id2 = src.create_key()
+        data2 = open(src.verify_key(id2), 'rb').read()
+
+        with self.assertRaises(peering.PublicKeyError) as cm:
+            dst.write_key(id1, data2)
+        self.assertEqual(path.dirname(cm.exception.filename), dst.tmpdir)
+        self.assertEqual(cm.exception.expected, id1)
+        self.assertEqual(cm.exception.got, id2)
+
+        with self.assertRaises(peering.PublicKeyError) as cm:
+            dst.write_key(id2, data1)
+        self.assertEqual(path.dirname(cm.exception.filename), dst.tmpdir)
+        self.assertEqual(cm.exception.expected, id2)
+        self.assertEqual(cm.exception.got, id1)
+
+        self.assertEqual(dst.write_key(id1, data1), dst.path(id1, 'key'))
+        self.assertEqual(open(dst.path(id1, 'key'), 'rb').read(), data1)
+
+        self.assertEqual(dst.write_key(id2, data2), dst.path(id2, 'key'))
+        self.assertEqual(open(dst.path(id2, 'key'), 'rb').read(), data2)
+
     def test_create_ca(self):
         tmp = TempDir()
         pki = peering.PKI(tmp.dir)
@@ -275,6 +769,24 @@
         self.assertEqual(cm.exception.expected, '/CN={}'.format(id3))
         self.assertEqual(cm.exception.got, '/CN={}'.format(id1))
 
+        # Test with bad issuer
+        pki.create_ca(id3)
+        id4 = pki.create_key()
+        pki.create_csr(id4)
+        pki.issue_cert(id4, id3)
+        os.rename(pki.path(id4, 'cert'), pki.path(id4, 'ca'))
+        with self.assertRaises(peering.IssuerError) as cm:
+            pki.verify_ca(id4)
+        self.assertEqual(cm.exception.filename, pki.path(id4, 'ca'))
+        self.assertEqual(cm.exception.expected, '/CN={}'.format(id4))
+        self.assertEqual(cm.exception.got, '/CN={}'.format(id3))
+
+    def test_read_ca(self):
+        self.skipTest('FIXME')
+
+    def test_write_ca(self):
+        self.skipTest('FIXME')
+
     def test_create_csr(self):
         tmp = TempDir()
         pki = peering.PKI(tmp.dir)
@@ -321,6 +833,43 @@
         self.assertEqual(cm.exception.expected, '/CN={}'.format(id3))
         self.assertEqual(cm.exception.got, '/CN={}'.format(id1))
 
+    def test_read_csr(self):
+        tmp = TempDir()
+        pki = peering.PKI(tmp.dir)
+        id1 = pki.create_key()
+        id2 = pki.create_key()
+        csr1_file = pki.create_csr(id1)
+        csr2_file = pki.create_csr(id2)
+        data1 = open(csr1_file, 'rb').read()
+        data2 = open(csr2_file, 'rb').read()
+        os.remove(tmp.join(id1 + '.key'))
+        os.remove(tmp.join(id2 + '.key'))
+        self.assertEqual(pki.read_csr(id1), data1)
+        self.assertEqual(pki.read_csr(id2), data2)
+        os.remove(csr1_file)
+        os.rename(csr2_file, csr1_file)
+        with self.assertRaises(peering.PublicKeyError) as cm:
+            pki.read_csr(id1)
+        self.assertEqual(cm.exception.filename, csr1_file)
+        self.assertEqual(cm.exception.expected, id1)
+        self.assertEqual(cm.exception.got, id2)
+        with self.assertRaises(subprocess.CalledProcessError) as cm:
+            pki.read_csr(id2)
+
+        # Test with bad subject
+        id3 = pki.create_key()
+        key_file = pki.path(id3, 'key')
+        csr_file = pki.path(id3, 'csr')
+        peering.create_csr(key_file, '/CN={}'.format(id1), csr_file)
+        with self.assertRaises(peering.SubjectError) as cm:
+            pki.read_csr(id3)
+        self.assertEqual(cm.exception.filename, csr_file)
+        self.assertEqual(cm.exception.expected, '/CN={}'.format(id3))
+        self.assertEqual(cm.exception.got, '/CN={}'.format(id1))
+
+    def test_write_csr(self):
+        self.skipTest('FIXME')
+
     def test_issue_cert(self):
         tmp = TempDir()
         pki = peering.PKI(tmp.dir)

=== added file 'run-browse.py'
--- run-browse.py	1970-01-01 00:00:00 +0000
+++ run-browse.py	2012-10-09 20:57:30 +0000
@@ -0,0 +1,188 @@
+#!/usr/bin/python3
+
+import logging
+import tempfile
+from gettext import gettext as _
+
+from gi.repository import GObject, Gtk, AppIndicator3
+from microfiber import CouchBase, _start_thread
+from queue import Queue
+
+from dmedia.startup import DmediaCouch
+from dmedia.gtk.ubuntu import NotifyManager
+from dmedia.peering import ChallengeResponse, ServerApp
+from dmedia.service.peers import AvahiPeer
+from dmedia.gtk.peering import BaseUI
+from dmedia.httpd import WSGIError, make_server
+
+
+format = [
+    '%(levelname)s',
+    '%(processName)s',
+    '%(threadName)s',
+    '%(message)s',
+]
+logging.basicConfig(level=logging.DEBUG, format='\t'.join(format))
+log = logging.getLogger()
+
+
+mainloop = GObject.MainLoop()
+
+
+
+class UI(BaseUI):
+    page = 'server.html'
+
+    signals = {
+        'get_secret': [],
+        'display_secret': ['secret'],
+        'set_message': ['message'],
+    }
+
+    def __init__(self, cr):
+        super().__init__()
+        self.cr = cr
+
+    def connect_hub_signals(self, hub):
+        hub.connect('get_secret', self.on_get_secret)
+
+    def on_get_secret(self, hub):
+        secret = self.cr.get_secret()
+        hub.send('display_secret', secret)
+
+
+class Session:
+    def __init__(self, pki, _id, peer, server_config, client_config):
+        self.pki = pki
+        self.peer_id = peer.id
+        self.peer = peer
+        self.cr = ChallengeResponse(_id, peer.id)
+        self.q = Queue()
+        _start_thread(self.monitor_response)
+        self.app = ServerApp(self.cr, self.q, pki)
+        self.app.state = 'info'
+        self.httpd = make_server(self.app, '0.0.0.0', server_config)
+        env = {'url': peer.url, 'ssl': client_config}
+        self.client = CouchBase(env)
+        self.httpd.start()
+        self.ui = UI(self.cr)
+
+    def monitor_response(self):
+        while True:
+            signal = self.q.get()
+            if signal == 'wrong_response':
+                GObject.idle_add(self.retry)
+            elif signal == 'response_ok':
+                GObject.timeout_add(500, self.on_response_ok)
+                break
+
+    def monitor_cert_request(self):
+        status = self.q.get()
+        if status != 'cert_issued':
+            log.error('Bad cert request from %r', self.peer)
+            log.warning('Possible malicious peer: %r', self.peer)
+        GObject.idle_add(self.on_cert_request, status)
+
+    def retry(self):
+        self.httpd.shutdown()
+        secret = self.cr.get_secret()
+        self.ui.hub.send('display_secret', secret)
+        self.ui.hub.send('set_message',
+            _('Typo? Please try again with new secret.')
+        )
+        self.app.state = 'ready'
+        self.httpd.start()
+
+    def on_response_ok(self):
+        assert self.app.state == 'response_ok'
+        self.ui.hub.send('set_message', _('Counter-Challenge...'))
+        _start_thread(self.counter_challenge)
+
+    def counter_challenge(self):
+        log.info('Getting counter-challenge from %r', self.peer)
+        challenge = self.client.get('challenge')['challenge']
+        (nonce, response) = self.cr.create_response(challenge)
+        obj = {'nonce': nonce, 'response': response}
+        log.info('Posting counter-response to %r', self.peer)
+        try:
+            r = self.client.put(obj, 'response')
+            log.info('Counter-response accepted')
+            GObject.idle_add(self.on_counter_response_ok)
+        except Unauthorized:
+            log.error('Counter-response rejected!')
+            log.warning('Possible malicious peer: %r', self.peer)
+            GObject.idle_add(self.on_counter_response_fail)
+
+    def on_counter_response_ok(self):
+        assert self.app.state == 'response_ok'
+        self.app.state = 'counter_response_ok'
+        _start_thread(self.monitor_cert_request)
+        self.ui.hub.send('set_message', _('Issuing Certificate...'))
+
+    def on_counter_response_fail(self):
+        self.ui.hub.send('set_message', _('Very Bad Things!'))
+
+    def on_cert_request(self, status):
+        print('on_cert_request', status)
+        self.ui.hub.send('set_message', _('Done!'))
+
+
+class Browse:
+    def __init__(self):
+        self.couch = DmediaCouch(tempfile.mkdtemp())
+        self.couch.firstrun_init(create_user=True)
+        self.couch.load_pki()
+        self.avahi = AvahiPeer(self.couch.pki)
+        self.avahi.connect('offer', self.on_offer)
+        self.avahi.connect('retract', self.on_retract)
+        self.avahi.browse()
+        self.notifymanager = NotifyManager()
+        self.indicator = None
+        self.session = None
+
+    def on_offer(self, avahi, info):
+        assert self.indicator is None
+        self.indicator = AppIndicator3.Indicator.new(
+            'dmedia-peer',
+            'indicator-novacut',
+            AppIndicator3.IndicatorCategory.APPLICATION_STATUS
+        )
+        menu = Gtk.Menu()
+        accept = Gtk.MenuItem()
+        accept.set_label(_('Accept {}@{}').format(info.name, info.host))
+        accept.connect('activate', self.on_accept, info)
+        menu.append(accept)
+        menu.show_all()
+        self.indicator.set_menu(menu)
+        self.indicator.set_status(AppIndicator3.IndicatorStatus.ATTENTION)
+        self.notifymanager.replace(
+            _('Novacut Peering Offer'),
+            '{}@{}'.format(info.name, info.host),
+        )
+
+    def on_retract(self, avahi):
+        if hasattr(self, 'indicator'):
+            del self.indicator
+            self.notifymanager.replace(_('Peering Offer Removed'))
+
+    def on_accept(self, menuitem, info):
+        assert self.session is None
+        self.avahi.activate(info.id)
+        self.indicator = None
+        self.session = Session(self.couch.pki, self.avahi.id, info,
+            self.avahi.get_server_config(),
+            self.avahi.get_client_config()
+        )
+        self.session.ui.window.connect('destroy', self.on_destroy)
+        self.session.ui.show()
+        self.avahi.publish(self.session.httpd.port)
+
+    def on_destroy(self, *args):
+        self.session.httpd.shutdown()
+        self.session.ui.window.destroy()
+        self.avahi.deactivate(self.session.peer_id)
+        self.session = None
+
+browse = Browse()
+mainloop.run()
+

=== removed file 'run-browse.py'
--- run-browse.py	2012-09-20 12:27:37 +0000
+++ run-browse.py	1970-01-01 00:00:00 +0000
@@ -1,24 +0,0 @@
-#!/usr/bin/python3
-
-import logging
-
-import dbus
-from dbus.mainloop.glib import DBusGMainLoop
-from gi.repository import GObject
-from microfiber import random_id
-
-from dmedia.service.peers import Peer
-from dmedia.peering import TempPKI
-
-log = logging.getLogger()
-GObject.threads_init()
-DBusGMainLoop(set_as_default=True)
-logging.basicConfig(level=logging.DEBUG)
-
-pki = TempPKI()
-cert_id = pki.create(random_id())
-
-peer = Peer(cert_id)
-peer.browse('_dmedia-offer._tcp')
-mainloop = GObject.MainLoop()
-mainloop.run()

=== added file 'run-publish.py'
--- run-publish.py	1970-01-01 00:00:00 +0000
+++ run-publish.py	2012-10-09 20:57:30 +0000
@@ -0,0 +1,196 @@
+#!/usr/bin/python3
+
+import logging
+import tempfile
+from queue import Queue
+from gettext import gettext as _
+from base64 import b64encode, b64decode
+
+from gi.repository import GObject, Gtk
+from microfiber import dumps, CouchBase, Unauthorized, _start_thread
+
+from dmedia.startup import DmediaCouch
+from dmedia import peering
+from dmedia.service.peers import AvahiPeer
+from dmedia.gtk.peering import BaseUI
+from dmedia.peering import ChallengeResponse, ClientApp, InfoApp, encode, decode
+from dmedia.httpd import WSGIError, make_server, build_server_ssl_context
+
+
+format = [
+    '%(levelname)s',
+    '%(processName)s',
+    '%(threadName)s',
+    '%(message)s',
+]
+logging.basicConfig(level=logging.DEBUG, format='\t'.join(format))
+log = logging.getLogger()
+
+
+class Session:
+    def __init__(self, hub, pki, _id, peer, client_config):
+        self.hub = hub
+        self.pki = pki
+        self.peer = peer
+        self.id = _id
+        self.peer_id = peer.id
+        self.cr = ChallengeResponse(_id, peer.id)
+        self.q = Queue()
+        self.app = ClientApp(self.cr, self.q)
+        env = {'url': peer.url, 'ssl': client_config}
+        self.client = CouchBase(env)
+
+    def challenge(self):
+        log.info('Getting challenge from %r', self.peer)
+        challenge = self.client.get('challenge')['challenge']
+        (nonce, response) = self.cr.create_response(challenge)
+        obj = {'nonce': nonce, 'response': response}
+        log.info('Putting response to %r', self.peer)
+        try:
+            r = self.client.put(obj, 'response')
+            log.info('Response accepted')
+            success = True
+        except Unauthorized:
+            log.info('Response rejected')
+            success = False
+        GObject.idle_add(self.on_response, success)
+
+    def on_response(self, success):
+        if success:
+            self.app.state = 'ready'
+            _start_thread(self.monitor_counter_response)
+        else:
+            del self.cr.secret
+        self.hub.send('response', success)
+
+    def monitor_counter_response(self):
+        # FIXME: Should use a timeout with queue.get()
+        status = self.q.get()
+        log.info('Counter-response gave %r', status)
+        if status != 'response_ok':
+            log.error('Wrong counter-response!')
+            log.warning('Possible malicious peer: %r', self.peer)
+        GObject.timeout_add(500, self.on_counter_response, status)
+
+    def on_counter_response(self, status):
+        assert self.app.state == status
+        if status == 'response_ok':
+            _start_thread(self.request_cert)
+        self.hub.send('counter_response', status)
+
+    def request_cert(self):
+        log.info('Creating CSR')
+        try:
+            self.pki.create_csr(self.id)
+            csr_data = self.pki.read_csr(self.id)
+            obj = {'csr': b64encode(csr_data).decode('utf-8')}
+            r = self.client.post(obj, 'csr')
+            cert_data = b64decode(r['cert'].encode('utf-8'))
+            self.pki.write_cert2(self.id, self.peer_id, cert_data)
+            self.pki.verify_cert2(self.id, self.peer_id)
+            status = 'cert_issued'
+        except Exception as e:
+            status = 'error'
+            log.exception('Could not request cert')
+        GObject.idle_add(self.on_csr_response, status)
+
+    def on_csr_response(self, status):
+        log.info('on_csr_response %r', status)
+        self.hub.send('csr_response', status)
+
+
+class UI(BaseUI):
+    page = 'client.html'
+
+    signals = {
+        'first_time': [],
+        'already_using': [],
+        'have_secret': ['secret'],
+        'response': ['success'],
+        'counter_response': ['status'],
+        'csr_response': ['status'],
+        'set_message': ['message'],
+
+        'show_screen2a': [],
+        'show_screen2b': [],
+        'show_screen3b': [],
+    }
+
+    def __init__(self):
+        super().__init__()
+        self.couch = DmediaCouch(tempfile.mkdtemp())
+        self.couch.firstrun_init(create_user=False)
+        self.couch.load_pki()
+        self.avahi = None
+
+    def quit(self, *args):
+        if self.avahi:
+            self.avahi.unpublish()
+        Gtk.main_quit()
+
+    def connect_hub_signals(self, hub):
+        hub.connect('first_time', self.on_first_time)
+        hub.connect('already_using', self.on_already_using)
+        hub.connect('have_secret', self.on_have_secret)
+        hub.connect('response', self.on_response)
+        hub.connect('counter_response', self.on_counter_response)
+        hub.connect('csr_response', self.on_csr_response)
+
+    def on_first_time(self, hub):
+        hub.send('show_screen2a')
+
+    def on_already_using(self, hub):
+        if self.avahi is not None:
+            print('oop, duplicate click')
+            return
+        self.avahi = AvahiPeer(self.couch.pki, client_mode=True)
+        self.avahi.connect('accept', self.on_accept)
+        app = InfoApp(self.avahi.id)
+        self.httpd = make_server(app, '0.0.0.0',
+            self.avahi.get_server_config()
+        )
+        self.httpd.start()
+        self.avahi.browse()
+        self.avahi.publish(self.httpd.port)
+        GObject.idle_add(hub.send, 'show_screen2b')
+
+    def on_accept(self, avahi, peer):
+        self.avahi.activate(peer.id)
+        self.session = Session(self.hub, self.couch.pki, avahi.id, peer,
+            avahi.get_client_config()
+        )
+        # Reconfigure HTTPD to only accept connections from bound peer
+        self.httpd.reconfigure(self.session.app, avahi.get_server_config())
+        avahi.unpublish()
+        GObject.idle_add(self.hub.send, 'show_screen3b')
+
+    def on_have_secret(self, hub, secret):
+        if hasattr(self.session.cr, 'secret'):
+            log.warning("duplicate 'have_secret' signal received")
+            return
+        self.session.cr.set_secret(secret)
+        hub.send('set_message', _('Challenge...'))
+        _start_thread(self.session.challenge)
+
+    def on_response(self, hub, success):
+        if success:
+            hub.send('set_message', _('Counter-Challenge...'))
+            GObject.timeout_add(250, hub.send, 'spin_orb')
+        else:
+            hub.send('set_message', _('Typo? Please try again with new secret.'))
+
+    def on_counter_response(self, hub, status):
+        if status == 'response_ok':
+            hub.send('set_message', _('Requesting Certificate...'))
+        else:
+            hub.send('set_message', _('Very Bad Things!'))
+
+    def on_csr_response(self, hub, status):
+        if status == 'cert_issued':
+            hub.send('set_message', _('Done!'))
+        else:
+            hub.send('set_message', _('Very Bad Things with Certificate!'))
+
+
+ui = UI()
+ui.run()

=== removed file 'run-publish.py'
--- run-publish.py	2012-09-20 12:27:37 +0000
+++ run-publish.py	1970-01-01 00:00:00 +0000
@@ -1,26 +0,0 @@
-#!/usr/bin/python3
-
-import logging
-
-import dbus
-from dbus.mainloop.glib import DBusGMainLoop
-from gi.repository import GObject
-from microfiber import random_id
-
-from dmedia.service.peers import Peer
-from dmedia.peering import TempPKI
-
-
-log = logging.getLogger()
-GObject.threads_init()
-DBusGMainLoop(set_as_default=True)
-logging.basicConfig(level=logging.DEBUG)
-
-pki = TempPKI()
-cert_id = pki.create(random_id())
-
-peer = Peer(cert_id)
-peer.browse('_dmedia-accept._tcp')
-peer.publish('_dmedia-offer._tcp', 5000)
-mainloop = GObject.MainLoop()
-mainloop.run()

=== modified file 'setup.py'
--- setup.py	2012-09-05 08:04:08 +0000
+++ setup.py	2012-10-09 20:57:30 +0000
@@ -159,6 +159,7 @@
         ),
         ('share/icons/hicolor/scalable/status',
             [
+                'share/indicator-novacut.svg',
                 'share/indicator-dmedia.svg',
                 'share/indicator-dmedia-att.svg',
             ]

=== added file 'share/indicator-novacut.svg'
--- share/indicator-novacut.svg	1970-01-01 00:00:00 +0000
+++ share/indicator-novacut.svg	2012-10-09 20:57:30 +0000
@@ -0,0 +1,133 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   width="512"
+   height="512"
+   id="svg4778"
+   version="1.1"
+   inkscape:version="0.48.1 r9760"
+   sodipodi:docname="novacut-solo-brandmark_PINK_FINAL-SVG.svg"
+   inkscape:export-filename="/home/izo/Pictures/Client_Work/Novacut/Final-Artwork/web/PNG/novacut-solo-brandmark_PINK_FINAL-PNG-300dpi.png"
+   inkscape:export-xdpi="300.05859"
+   inkscape:export-ydpi="300.05859">
+  <defs
+     id="defs4780">
+    <inkscape:path-effect
+       effect="spiro"
+       id="path-effect5868"
+       is_visible="true" />
+  </defs>
+  <sodipodi:namedview
+     id="base"
+     pagecolor="#ffffff"
+     bordercolor="#666666"
+     borderopacity="1.0"
+     inkscape:pageopacity="0.0"
+     inkscape:pageshadow="2"
+     inkscape:zoom="1"
+     inkscape:cx="233.49618"
+     inkscape:cy="280"
+     inkscape:current-layer="layer1"
+     inkscape:document-units="px"
+     showgrid="false"
+     inkscape:window-width="1614"
+     inkscape:window-height="1026"
+     inkscape:window-x="66"
+     inkscape:window-y="24"
+     inkscape:window-maximized="1"
+     showguides="false"
+     inkscape:guide-bbox="true">
+    <inkscape:grid
+       type="xygrid"
+       id="grid2994"
+       empspacing="4"
+       visible="true"
+       enabled="true"
+       snapvisiblegridlinesonly="true" />
+    <sodipodi:guide
+       orientation="1,0"
+       position="256,88"
+       id="guide3002" />
+    <sodipodi:guide
+       orientation="0,1"
+       position="592,256"
+       id="guide3004" />
+    <sodipodi:guide
+       position="0,0"
+       orientation="0,512"
+       id="guide3006" />
+    <sodipodi:guide
+       position="512,0"
+       orientation="-512,0"
+       id="guide3008" />
+    <sodipodi:guide
+       position="512,512"
+       orientation="0,-512"
+       id="guide3010" />
+    <sodipodi:guide
+       position="0,512"
+       orientation="512,0"
+       id="guide3012" />
+  </sodipodi:namedview>
+  <metadata
+     id="metadata4783">
+    <rdf:RDF>
+      <cc:Work
+         rdf:about="">
+        <dc:format>image/svg+xml</dc:format>
+        <dc:type
+           rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
+        <dc:title></dc:title>
+      </cc:Work>
+    </rdf:RDF>
+  </metadata>
+  <g
+     id="layer1"
+     inkscape:label="Layer 1"
+     inkscape:groupmode="layer"
+     transform="translate(0,32)">
+    <path
+       transform="matrix(1.0666667,0,0,1.0666667,-85.333334,-32.000001)"
+       d="m 545,240 a 225,225 0 1 1 -450,0 225,225 0 1 1 450,0 z"
+       sodipodi:ry="225"
+       sodipodi:rx="225"
+       sodipodi:cy="240"
+       sodipodi:cx="320"
+       id="path5924"
+       style="fill:#e81f3b;fill-opacity:1;stroke:none"
+       sodipodi:type="arc" />
+    <path
+       id="path4023"
+       d="m 157.74011,106.26326 0,233.73017 48.11687,0 0,-156.48267 0.68543,0 37.83549,60.93432 0,-81.0173 -35.57359,-57.16452 -51.0642,0 z m 149.28569,0 0,156.82539 -0.68543,0 -37.8355,-60.86578 0,81.0173 35.23088,56.75326 51.40692,0 0,-233.73017 -48.11687,0 z"
+       style="font-size:144px;font-style:normal;font-variant:normal;font-weight:bold;font-stretch:normal;text-align:start;line-height:125%;letter-spacing:0px;word-spacing:0px;writing-mode:lr-tb;text-anchor:start;fill:#ffffff;fill-opacity:1;stroke:none;font-family:Helvetica Neue LT Com;-inkscape-font-specification:Helvetica Neue LT Com Bold"
+       inkscape:connector-curvature="0" />
+    <path
+       sodipodi:type="arc"
+       style="fill:#ffffff;fill-opacity:1;stroke:none"
+       id="path4025"
+       sodipodi:cx="836.50732"
+       sodipodi:cy="230.95239"
+       sodipodi:rx="13.435029"
+       sodipodi:ry="13.435029"
+       d="m 849.94235,230.95239 a 13.435029,13.435029 0 1 1 -26.87005,0 13.435029,13.435029 0 1 1 26.87005,0 z"
+       transform="matrix(2.193362,0,0,2.193362,-1651.9421,-440.84345)" />
+    <path
+       transform="matrix(2.193362,0,0,2.193362,-1505.7305,-124.45147)"
+       d="m 849.94235,230.95239 a 13.435029,13.435029 0 1 1 -26.87005,0 13.435029,13.435029 0 1 1 26.87005,0 z"
+       sodipodi:ry="13.435029"
+       sodipodi:rx="13.435029"
+       sodipodi:cy="230.95239"
+       sodipodi:cx="836.50732"
+       id="path4027"
+       style="fill:#ffffff;fill-opacity:1;stroke:none"
+       sodipodi:type="arc" />
+  </g>
+</svg>