• package: tis-laps-by-wapt
• name: LAPS by WAPT
• version: 3-16
• categories: Utilities
• maintainer: WAPT Team,Tranquil IT,Kévin Guérineau,Simon FONTENEAU,Amelie LE JEUNE,Pierre COSSON,Jimmy PELÉ
• licence: wapt_public
• locale: all
• target_os: linux
• architecture: all
• signature_date: 2026-10-13T00:22:03.000000
• size: 61.02 Ko

package           : tis-laps-by-wapt
version           : 3-16
architecture      : all
section           : base
priority          : optional
name              : LAPS by WAPT
categories        : Utilities
maintainer        : WAPT Team,Tranquil IT,Kévin Guérineau,Simon FONTENEAU,Amelie LE JEUNE,Pierre COSSON,Jimmy PELÉ
description       : change and display administrator password with admin's private key
depends           : 
conflicts         : 
maturity          : PROD
locale            : all
target_os         : linux
min_wapt_version  : 2.1
sources           : 
installed_size    : 
impacted_process  : 
description_fr    : 
description_pl    : 
description_de    : 
description_es    : 
description_pt    : 
description_it    : 
description_nl    : 
description_ru    : 
audit_schedule    : 
editor            : 
keywords          : 
licence           : wapt_public
homepage          : 
package_uuid      : 83057e22-e656-43ca-92d5-162a20e13a22
valid_from        : 
valid_until       : 
forced_install_on : 
changelog         : 
min_os_version    : 
max_os_version    : 
icon_sha256sum    : 3ff6547ef5ca3bd871b4ae07f6ae9060009646db2baac829120c87c285ead18b
signer            : Tranquil IT
signer_fingerprint: 8c5127a75392be9cc9afd0dbae1222a673072c308c14d88ab246e23832e8c6bb
signature_date    : 2026-10-13T00:22:03.000000
signed_attributes : package,version,architecture,section,priority,name,categories,maintainer,description,depends,conflicts,maturity,locale,target_os,min_wapt_version,sources,installed_size,impacted_process,description_fr,description_pl,description_de,description_es,description_pt,description_it,description_nl,description_ru,audit_schedule,editor,keywords,licence,homepage,package_uuid,valid_from,valid_until,forced_install_on,changelog,min_os_version,max_os_version,icon_sha256sum,signer,signer_fingerprint,signature_date,signed_attributes
signature         : p9NLx9hfQGhxqxU3D/BfzuBeqGyMk5TtbxGLtDYTPjuckTWj7y5i6fmEGdnSEtVcrf1596/kjBRFw7H8GMdH6sjYq5VHSj+N3dyh8iuHG/pXGr/HP2YfVnVvq0EnsE0zR8zD0nCuuNCLz6UB+aKQnDktY9taQ6qGV7kw9j3OWdQ3+4QuJLqZF8MY6sdmVyx20NLUNnyg+g06GgwnuElrWKtgdSlbEzeK1lkyRUqnB2aTXUFjDZttc1m+GuQje5D7mGWtjoDoRlWCkc6qgR05x8FjmkTqWIs22wJiBjboS1hw4IfgL2eVHznT0scDdApBGytb/tpnqBc2E0P2e/Bh9A==

# -*- coding: utf-8 -*-
from setuphelpers import *
import datetime

try:
    import waptcrypto

    if "encrypted_data_str" in dir(waptcrypto):
        from waptcrypto import encrypted_data_str as rsa_encrypted_data_str
except:
    pass


import secrets

users_to_change = [
    'root'
]


def install():
    # you can add you ssl certificate in the package in order to decrypt information in the audit_data
    for crt in glob.glob("*.crt"):
        filecopyto(crt, makepath(WAPT.wapt_base_dir, "ssl", crt))
    filecopyto("eff_large_wordlist.txt",persistent_dir)
    audit()


def audit():
    for user in users_to_change:
        all_passwords = list(WAPT.read_audit_data_set("laps", f"local_{user}_password"))
        if all_passwords:
            # On récupère le tuple complet d'audit_data (contient la date brute)
            raw_last_date = list(WAPT.read_audit_data_set("laps", f"local_{user}_password"))[-1][1]
        else:
            raw_last_date = None

        # --- SÉCURISATION ET NETTOYAGE DE LA DATE POUR PYTHON < 3.11 ---
        # Si la date est manquante ou invalide, on simule une date ancienne au format ISO strict attendu
        if not raw_last_date or 'T' not in str(raw_last_date):
            last_date = "1970-01-01T00:00:00"
        else:
            # On retire le suffixe 'Z' s'il existe car strptime ne le gère pas avant Python 3.11
            last_date = str(raw_last_date).rstrip('Z')

        # Conversion en dates "naïves" pour éviter l'erreur de comparaison entre fuseaux (aware/naive)
        now_naive = datetime.datetime.now(datetime.timezone.utc).replace(tzinfo=None)
        
        try:
            last_date_parsed = isodate2datetime(last_date).replace(tzinfo=None)
        except:
            # Fallback si isodate2datetime lève malgré tout une exception (chaîne corrompue)
            last_date_parsed = datetime.datetime(1970, 1, 1)

        # Condition de vérification compatible toutes versions de Python
        if not raw_last_date or (now_naive - last_date_parsed > datetime.timedelta(days=365)) or force:
            with open(makepath(persistent_dir,"eff_large_wordlist.txt")) as f:
                words = [line.split("\t")[1].strip() for line in f]
            passphrase = generate_passphrase(words)

            if not params.get("install_with_luti", False):
                run(r'usermod --password $(echo %s | openssl passwd -1 -stdin)  %s' % (passphrase, user))

            WAPT.write_audit_data_if_changed("laps", f"local_{user}_password", rsa_encrypted_data_str(passphrase, [WAPT.public_certs_dir]), max_count=3)
    return "OK"

def generate_passphrase(word_list, num_words=4):

    parts = [secrets.choice(word_list).capitalize() + str(secrets.randbelow(10)) for _ in range(num_words)]
    return "-".join(parts)

1a6b620f00f4030e18b8bf199de1987bae82e8b57541750886298ac42393ddc6 : WAPT/README.MD
424412f5866d0050bf46967f2f3aefedbf1de50d6821f719b20fcc4e5d85e214 : WAPT/README_fr.md
38d056ab130f7bf7c481c12636a4e9959de36561d3dfcbe54c6e3571bc0c1dc3 : WAPT/certificate.crt
fc4af82737a63f0537b61062ebc9fc45bfe6f9efd531fb25e072fd96046c4bf3 : WAPT/control
3ff6547ef5ca3bd871b4ae07f6ae9060009646db2baac829120c87c285ead18b : WAPT/icon.png
ce144bbfd1dbaa823492d7df1f0c50c18eb89ce68008277b60fe28f199de0234 : eff_large_wordlist.txt
f5c17f6d6cc8444da69ae4f85080b484d5997ae8061ae8ed021ea9e8e12f57f4 : luti.json
f42a26a2c5277833905b971ae42322ec12ee8cc0b36a6082dae838934c50b519 : setup.py