Skip to content

just_dna_format.signing

just_dna_format.signing

Ed25519 signing over artifact.digest (SPEC §5 "future") — the private-key / key-management side.

The artifact digest is already the version's immutable content identity, so signing it — rather than any larger blob — is enough to bind a trusted party's key to the whole file set. A client that pins the marketplace's public key can then detect a digest swapped by a compromised storage backend. Signing is entirely optional and additive: an unsigned manifest verifies exactly as before.

Verification lives in integrity.verify_signature (verification is integrity's job, and keeping it there avoids an import cycle). Keys are handled as PEM on the private side (what an operator stores) and as raw base64 on the public side (what travels in the manifest, small and self-contained).

public_key_b64_from_pem 

public_key_b64_from_pem(private_key_pem: bytes) -> str

The base64 raw Ed25519 public key derived from a PEM private key — what a server publishes.

Source code in schema/src/just_dna_format/signing.py 
39
40
41
def public_key_b64_from_pem(private_key_pem: bytes) -> str:
    """The base64 raw Ed25519 public key derived from a PEM private key — what a server publishes."""
    return _public_key_b64(_load_private_key(private_key_pem).public_key())

generate_private_key_pem 

generate_private_key_pem() -> bytes

Generate a fresh Ed25519 private key as unencrypted PKCS#8 PEM (for tests / key bootstrap).

Source code in schema/src/just_dna_format/signing.py 
44
45
46
47
48
49
50
51
def generate_private_key_pem() -> bytes:
    """Generate a fresh Ed25519 private key as unencrypted PKCS#8 PEM (for tests / key bootstrap)."""
    key = ed25519.Ed25519PrivateKey.generate()
    return key.private_bytes(
        encoding=serialization.Encoding.PEM,
        format=serialization.PrivateFormat.PKCS8,
        encryption_algorithm=serialization.NoEncryption(),
    )

sign_digest 

sign_digest(
    digest: str,
    private_key_pem: bytes,
    *,
    signed_at: str | None = None,
) -> Signature

Sign the artifact.digest string with an Ed25519 PEM private key.

The signed message is the digest string's UTF-8 bytes (e.g. b"sha256:9f2c...ab").

Source code in schema/src/just_dna_format/signing.py 
54
55
56
57
58
59
60
61
62
63
64
65
def sign_digest(digest: str, private_key_pem: bytes, *, signed_at: str | None = None) -> Signature:
    """Sign the `artifact.digest` string with an Ed25519 PEM private key.

    The signed message is the digest string's UTF-8 bytes (e.g. `b"sha256:9f2c...ab"`)."""
    key = _load_private_key(private_key_pem)
    sig = key.sign(digest.encode("utf-8"))
    return Signature(
        algorithm=_ALGORITHM,
        public_key=_public_key_b64(key.public_key()),
        signature=base64.b64encode(sig).decode("ascii"),
        signed_at=signed_at,
    )