aevum-verify 0.8.0__tar.gz

aevum_verify-0.8.0/.gitignore

@@ -0,0 +1,52 @@
+# Python
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
+.venv/
+*.egg-info/
+
+# Build
+dist/
+build/
+site/
+
+# Tools
+.mypy_cache/
+.ruff_cache/
+.pytest_cache/
+.hypothesis/
+.cache/
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Verify scripts (run locally, never commit)
+verify_*.py
+scripts/verify_*.py
+
+# Aevum development — never commit (Phase 0+)
+aevum_principles.key
+signed_principles_draft.yaml
+tools/sign_principles.py
+
+# Private keys — never commit
+*.key
+*.pem
+
+# OpenSSF Scorecard output (Phase 0+)
+results.sarif
+verify_phase3.py
+verify_phase7.py
+verify_phase8.py
+verify_phase*.py
+
+# Maintenance generated files — local only, never commit
+maintenance/generated/

aevum_verify-0.8.0/PKG-INFO

@@ -0,0 +1,23 @@
+Metadata-Version: 2.4
+Name: aevum-verify
+Version: 0.8.0
+Summary: Aevum — standalone sigchain verifier.
+Project-URL: Homepage, https://aevum.build
+Project-URL: Repository, https://github.com/aevum-labs/aevum
+License: Apache-2.0
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Requires-Dist: aevum-core
+Provides-Extra: dev
+Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: pytest-asyncio>=0.23; extra == 'dev'
+Requires-Dist: pytest>=8.0; extra == 'dev'
+Requires-Dist: ruff>=0.9; extra == 'dev'
+Provides-Extra: pqc
+Requires-Dist: liboqs-python>=0.14.0; extra == 'pqc'

aevum_verify-0.8.0/pyproject.toml

@@ -0,0 +1,75 @@
+# SPDX-License-Identifier: Apache-2.0
+[project]
+name = "aevum-verify"
+version = "0.8.0"
+description = "Aevum — standalone sigchain verifier."
+readme = "README.md"
+requires-python = ">=3.11"
+license = { text = "Apache-2.0" }
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: Apache Software License",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Typing :: Typed",
+]
+dependencies = [
+    "aevum-core",
+]
+
+[project.optional-dependencies]
+pqc = [
+    "liboqs-python>=0.14.0",
+]
+dev = [
+    "pytest>=8.0",
+    "pytest-asyncio>=0.23",
+    "mypy>=1.10",
+    "ruff>=0.9",
+]
+
+[project.scripts]
+aevum-verify = "aevum.verify.__main__:main"
+
+[project.urls]
+Homepage = "https://aevum.build"
+Repository = "https://github.com/aevum-labs/aevum"
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"
+
+[tool.hatch.build.targets.wheel]
+packages = ["src/aevum"]
+
+[tool.uv.sources]
+aevum-core = { workspace = true }
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+asyncio_mode = "auto"
+addopts = "--tb=short"
+pythonpath = ["src", "tests"]
+
+[tool.mypy]
+strict = true
+python_version = "3.11"
+mypy_path = "src"
+ignore_missing_imports = true
+
+[[tool.mypy.overrides]]
+module = "oqs"
+ignore_missing_imports = true
+
+[tool.ruff]
+line-length = 130
+target-version = "py311"
+
+[tool.ruff.lint]
+select = ["E", "F", "UP", "B", "SIM", "I", "ANN"]
+ignore = ["ANN401"]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/**" = ["ANN"]

aevum_verify-0.8.0/src/aevum/verify/__init__.py

@@ -0,0 +1,20 @@
+# SPDX-License-Identifier: Apache-2.0
+from aevum.verify._core import (
+    VerifyResult,
+    dump_chain,
+    event_from_dict,
+    event_to_dict,
+    load_chain,
+    verify_chain,
+    verify_entry,
+)
+
+__all__ = [
+    "VerifyResult",
+    "verify_entry",
+    "verify_chain",
+    "load_chain",
+    "dump_chain",
+    "event_to_dict",
+    "event_from_dict",
+]

aevum_verify-0.8.0/src/aevum/verify/__main__.py

@@ -0,0 +1,94 @@
+# SPDX-License-Identifier: Apache-2.0
+"""
+aevum-verify — standalone sigchain verifier CLI.
+
+Usage:
+  aevum-verify CHAIN_FILE --ed25519-pub HEX [--mldsa65-pub HEX]
+
+  CHAIN_FILE     Path to a JSON file containing a list of serialised chain entries.
+  --ed25519-pub  Pinned Ed25519 public key as 64-char hex, or @/path/to/file for
+                 raw 32-byte binary.
+  --mldsa65-pub  Pinned ML-DSA-65 public key as hex or @filepath; required for
+                 hybrid (ed25519+ml-dsa-65) chains.
+
+Exit codes:
+  0  VERIFIED — all entries intact.
+  1  FAILED   — chain tampered, signature invalid, or trust-anchor mismatch.
+  2  Usage error (bad arguments or unreadable file).
+"""
+from __future__ import annotations
+
+import argparse
+import sys
+from pathlib import Path
+
+from aevum.verify._core import load_chain, verify_chain
+
+
+def _load_key(value: str) -> bytes:
+    """Load a key from a hex string or @filepath (raw binary)."""
+    if value.startswith("@"):
+        return Path(value[1:]).read_bytes()
+    return bytes.fromhex(value)
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(
+        prog="aevum-verify",
+        description="Verify an Aevum sigchain export against pinned public keys.",
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+        epilog=__doc__,
+    )
+    parser.add_argument("chain_file", metavar="CHAIN_FILE", help="path to JSON chain file")
+    parser.add_argument(
+        "--ed25519-pub",
+        required=True,
+        metavar="HEX",
+        help="pinned Ed25519 public key (64-char hex or @filepath)",
+    )
+    parser.add_argument(
+        "--mldsa65-pub",
+        default=None,
+        metavar="HEX",
+        help="pinned ML-DSA-65 public key (hex or @filepath); required for hybrid chains",
+    )
+    args = parser.parse_args()
+
+    try:
+        ed25519_pub = _load_key(args.ed25519_pub)
+    except Exception as exc:
+        print(f"ERROR: invalid --ed25519-pub: {exc}", file=sys.stderr)
+        sys.exit(2)
+
+    mldsa65_pub: bytes | None = None
+    if args.mldsa65_pub:
+        try:
+            mldsa65_pub = _load_key(args.mldsa65_pub)
+        except Exception as exc:
+            print(f"ERROR: invalid --mldsa65-pub: {exc}", file=sys.stderr)
+            sys.exit(2)
+
+    try:
+        chain_path = Path(args.chain_file)
+        entries = load_chain(chain_path)
+    except Exception as exc:
+        print(f"ERROR: could not load chain file: {exc}", file=sys.stderr)
+        sys.exit(2)
+
+    result = verify_chain(entries, ed25519_pub=ed25519_pub, mldsa65_pub=mldsa65_pub)
+
+    if result.ok:
+        print(f"VERIFIED — {len(entries)} entries intact")
+        sys.exit(0)
+    else:
+        idx = result.failing_index
+        reason = result.reason
+        if idx is not None:
+            print(f"FAILED — entry {idx}: {reason}", file=sys.stderr)
+        else:
+            print(f"FAILED — {reason}", file=sys.stderr)
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()