astra-verify 0.3.1__tar.gz

astra_verify-0.3.1/MANIFEST.in

@@ -0,0 +1,8 @@
+include README.md
+include pyproject.toml
+recursive-include astra_verify/roots *
+include astra_verify/SELF_SHA256SUMS
+include astra_verify/SELF_SHA256SUMS.sig
+include astra_verify/SELF_publisher.pub
+global-exclude __pycache__
+global-exclude *.pyc

astra_verify-0.3.1/PKG-INFO

@@ -0,0 +1,20 @@
+Metadata-Version: 2.4
+Name: astra-verify
+Version: 0.3.1
+Summary: Independent verifier for astra-substrate releases
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+Requires-Dist: cryptography>=42
+
+# astra-verify
+
+Independent verifier for astra-substrate releases.
+
+- Ships a pinned trust root (`roots/publisher.sha256`)
+- Verifies wheel hash, manifest signature, SBOM signature
+- Imports no `astra.*`
+
+## Usage
+
+    pip install astra-verify
+    astra-verify --dist /path/to/astra_substrate/dist

astra_verify-0.3.1/README.md

@@ -0,0 +1,12 @@
+# astra-verify
+
+Independent verifier for astra-substrate releases.
+
+- Ships a pinned trust root (`roots/publisher.sha256`)
+- Verifies wheel hash, manifest signature, SBOM signature
+- Imports no `astra.*`
+
+## Usage
+
+    pip install astra-verify
+    astra-verify --dist /path/to/astra_substrate/dist

astra_verify-0.3.1/astra_verify/SELF_SHA256SUMS

@@ -0,0 +1,11 @@
+3ba45c952bf17b238fe337098dc5a09fc2cb99b95797ed9a380c99988716cc32  __init__.py
+6ba16144c4d10347235f191eb90460b67ec14e8243831e34a912ee1a0807e0d5  __main__.py
+d8bc7242c880652b49071b3bbb904834bf1dd76982a7b23b4502ac45abef7b4d  _selfcheck.py
+411dde7d1e7b49a685ebdab32ec574d1bbe14ca3ce4ef387853d8c17bb9e2c50  _sig.py
+e5faf66314ce5583aeb19b1265ed4ef8883f9245470b324fcf26b99bda90f99e  roots/README.md
+657c5fd0241a7b0d52788ac00b478f32491fa98d3a58e176a0ddeab2f2b830ff  roots/v1/METADATA.json
+7fe21f93c60e8a2ffe8fb5c7fae92bb4da2c0a4cc8a6556ac122452eb0f60a79  roots/v1/publisher.sha256
+d75c2344ca2e2cdbe082d2702c903f2480399a20d5d532952d030e1404d6000a  roots/v2/METADATA.json
+7fe21f93c60e8a2ffe8fb5c7fae92bb4da2c0a4cc8a6556ac122452eb0f60a79  roots/v2/publisher.sha256
+98d108e5f49ee36d811baa915a74ffa39c1be684042caac196a7737c8d23de76  trust_root.py
+94f13e1c756de9babe1d74d99cdd9fb4bf851d87e488d1364ae2d950ffc6d55f  verify.py

astra_verify-0.3.1/astra_verify/SELF_SHA256SUMS.sig

@@ -0,0 +1,2 @@
+�
+3���f�nI~n�

astra_verify-0.3.1/astra_verify/SELF_publisher.pub

@@ -0,0 +1 @@
+�}N��Q����K����R�E��0�ڤ����عc

astra_verify-0.3.1/astra_verify/__init__.py

@@ -0,0 +1,10 @@
+from astra_verify.verify import verify_release, VerifyResult, VerifyReport
+
+__all__ = ["verify_release", "VerifyResult", "VerifyReport"]
+
+import os as _os
+if _os.environ.get("ASTRA_VERIFY_SELFCHECK") == "1":
+    from astra_verify._selfcheck import check as _selfcheck
+    _ok, _detail = _selfcheck()
+    if not _ok:
+        raise RuntimeError(f"astra-verify self-check failed: {_detail}")

astra_verify-0.3.1/astra_verify/__main__.py

@@ -0,0 +1,42 @@
+from __future__ import annotations
+import argparse, hashlib, json, sys
+from pathlib import Path
+
+from astra_verify.verify import verify_release
+
+
+def main() -> int:
+    ap = argparse.ArgumentParser(prog="astra-verify")
+    ap.add_argument("--dist", type=Path, default=Path("dist"))
+    ap.add_argument("--out", type=Path, default=None)
+    ap.add_argument("--status", action="store_true",
+                    help="Print trust-root status and exit")
+    ap.add_argument("--bootstrap-root", type=Path, default=None,
+                    help="Add a publisher pubkey to the trust root")
+    a = ap.parse_args()
+
+    if a.status:
+        from astra_verify.trust_root import status
+        print(json.dumps(status(), indent=2))
+        return 0
+    if a.bootstrap_root:
+        fp = hashlib.sha256(a.bootstrap_root.read_bytes()).hexdigest()
+        roots = Path(__file__).parent / "roots"
+        roots.mkdir(exist_ok=True)
+        p = roots / "publisher.sha256"
+        existing = p.read_text() if p.exists() else ""
+        if fp not in existing:
+            p.write_text(existing + fp + "\n")
+            print(f"bootstrapped root: {fp}")
+        return 0
+
+    rep = verify_release(a.dist)
+    body = rep.to_json()
+    if a.out:
+        a.out.write_text(json.dumps(body, indent=2))
+    print(json.dumps(body, indent=2))
+    return 0 if rep.ok else 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())

astra_verify-0.3.1/astra_verify/_selfcheck.py

@@ -0,0 +1,55 @@
+"""Verify astra-verify's own wheel against its embedded signed manifest.
+
+Runs at import time if ASTRA_VERIFY_SELFCHECK=1. Non-blocking by default
+so a broken manifest doesn't lock the user out of a repair.
+"""
+from __future__ import annotations
+import hashlib, json, os, sys
+from importlib.metadata import distribution
+from pathlib import Path
+
+from astra_verify._sig import verify_file, SigningError
+
+
+def check() -> tuple[bool, str]:
+    try:
+        d = distribution("astra-verify")
+    except Exception as e:
+        return False, f"distribution not found: {e}"
+    site = Path(d.locate_file("astra_verify"))
+    sums = site / "SELF_SHA256SUMS"
+    sig = site / "SELF_SHA256SUMS.sig"
+    pub = site / "SELF_publisher.pub"
+    if not (sums.exists() and sig.exists() and pub.exists()):
+        return False, "self-check artifacts missing from install"
+    try:
+        verify_file(sums, pub, sig)
+    except SigningError as e:
+        return False, f"self-manifest signature invalid: {e}"
+    entries = {}
+    for line in sums.read_text().splitlines():
+        if not line.strip(): continue
+        h, _, rel = line.partition("  ")
+        entries[rel.strip()] = h.strip()
+    errors = []
+    for rel, expected in entries.items():
+        p = site / rel
+        if not p.exists():
+            errors.append(f"missing {rel}")
+            continue
+        actual = hashlib.sha256(p.read_bytes()).hexdigest()
+        if actual != expected:
+            errors.append(f"tampered {rel}")
+    if errors:
+        return False, "; ".join(errors)
+    return True, f"self-check ok, {len(entries)} files verified"
+
+
+def main() -> int:
+    ok, detail = check()
+    print(f"self-check: {'ok' if ok else 'FAIL'}: {detail}")
+    return 0 if ok else 2
+
+
+if __name__ == "__main__":
+    sys.exit(main())

astra_verify-0.3.1/astra_verify/_sig.py

@@ -0,0 +1,21 @@
+"""Ed25519 verification, self-contained. No trust.* imports."""
+from __future__ import annotations
+from pathlib import Path
+
+from cryptography.exceptions import InvalidSignature
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+
+
+class SigningError(RuntimeError):
+    pass
+
+
+def verify_file(path: Path, pub_path: Path, sig_path: Path) -> None:
+    pub_bytes = pub_path.read_bytes()
+    sig_bytes = sig_path.read_bytes()
+    try:
+        Ed25519PublicKey.from_public_bytes(pub_bytes).verify(sig_bytes, path.read_bytes())
+    except InvalidSignature as e:
+        raise SigningError(f"signature invalid: {e}") from e
+    except Exception as e:
+        raise SigningError(f"{type(e).__name__}: {e}") from e

astra_verify-0.3.1/astra_verify/roots/README.md

@@ -0,0 +1,16 @@
+# Trust roots for astra-verify
+
+Each versioned directory (`v1/`, `v2/`, …) is a snapshot of fingerprints
+trusted at that point in time. Adding a new root means creating a new
+versioned directory, never mutating an existing one.
+
+## Format
+- `vN/publisher.sha256` — one SHA-256 hex per line of trusted publisher pubkeys
+- `vN/METADATA.json` — { "added": ISO8601, "deprecates": "vN-1" | null, "reason": "..." }
+
+## Deprecation
+A root is deprecated when a successor root names it in "deprecates".
+`astra_verify.trust_root.load()` reads all roots and unions the fingerprints
+from non-deprecated versions plus the newest version. Deprecated roots stop
+accepting new signatures but remain valid for artifacts published under them
+until the deprecation date + 90 days.

astra_verify-0.3.1/astra_verify/roots/v1/METADATA.json

@@ -0,0 +1,5 @@
+{
+  "added": "2026-10-24T23:44:34.807463+00:00",
+  "deprecates": null,
+  "reason": "initial pinning of astra-substrate publisher"
+}

astra_verify-0.3.1/astra_verify/roots/v1/publisher.sha256

@@ -0,0 +1 @@
+fc20cf1cd39d7c4e0f7a9dbce3bdc3568dd84277e97b172b3767275dbb4e75de

astra_verify-0.3.1/astra_verify/roots/v2/METADATA.json

@@ -0,0 +1,5 @@
+{
+  "added": "2026-10-24T23:47:57.627671+00:00",
+  "deprecates": null,
+  "reason": "rotation staging: v1 remains valid; v2 becomes active for new signatures only"
+}

astra_verify-0.3.1/astra_verify/roots/v2/publisher.sha256

@@ -0,0 +1 @@
+fc20cf1cd39d7c4e0f7a9dbce3bdc3568dd84277e97b172b3767275dbb4e75de

astra_verify-0.3.1/astra_verify/trust_root.py

@@ -0,0 +1,59 @@
+"""Pinned trust root for astra-verify. Loads versioned roots."""
+from __future__ import annotations
+import hashlib, json
+from pathlib import Path
+
+ROOTS_DIR = Path(__file__).parent / "roots"
+
+
+def _load_versioned() -> tuple[tuple[str, ...], set[str]]:
+    """Return (active_fingerprints, deprecated_versions)."""
+    if not ROOTS_DIR.exists():
+        return (), set()
+    versions = sorted(
+        (p for p in ROOTS_DIR.iterdir() if p.is_dir() and p.name.startswith("v")),
+        key=lambda p: int(p.name[1:]) if p.name[1:].isdigit() else 0,
+    )
+    deprecated: set[str] = set()
+    meta_by_version: dict[str, dict] = {}
+    for v in versions:
+        m = v / "METADATA.json"
+        if m.exists():
+            meta_by_version[v.name] = json.loads(m.read_text())
+            dep = meta_by_version[v.name].get("deprecates")
+            if dep:
+                deprecated.add(dep)
+    active: list[str] = []
+    for v in versions:
+        if v.name in deprecated:
+            continue
+        f = v / "publisher.sha256"
+        if f.exists():
+            for line in f.read_text().splitlines():
+                line = line.strip()
+                if line and not line.startswith("#"):
+                    active.append(line.lower())
+    # dedupe while preserving order
+    seen: set[str] = set()
+    uniq: list[str] = []
+    for fp in active:
+        if fp not in seen:
+            seen.add(fp)
+            uniq.append(fp)
+    return tuple(uniq), deprecated
+
+
+PINNED_FINGERPRINTS, DEPRECATED_ROOTS = _load_versioned()
+
+
+def is_trusted(pubkey_bytes: bytes) -> bool:
+    h = hashlib.sha256(pubkey_bytes).hexdigest()
+    return any(fp == h for fp in PINNED_FINGERPRINTS)
+
+
+def status() -> dict:
+    return {
+        "active_fingerprints": list(PINNED_FINGERPRINTS),
+        "deprecated_roots": sorted(DEPRECATED_ROOTS),
+        "roots_dir": str(ROOTS_DIR),
+    }

astra_verify-0.3.1/astra_verify/verify.py

@@ -0,0 +1,149 @@
+"""Independent verification of astra-substrate releases. No astra.* imports."""
+from __future__ import annotations
+import hashlib, json, re, sys
+from dataclasses import dataclass, asdict, field
+from pathlib import Path
+
+
+@dataclass
+class VerifyResult:
+    name: str
+    ok: bool
+    detail: str
+    duration_ms: float = 0.0
+
+
+@dataclass
+class VerifyReport:
+    version: str = "1"
+    checks: list[VerifyResult] = field(default_factory=list)
+    artifacts: dict[str, str] = field(default_factory=dict)
+
+    @property
+    def ok(self) -> bool:
+        return all(c.ok for c in self.checks)
+
+    def to_json(self) -> dict:
+        return {"version": self.version, "ok": self.ok,
+                "checks": [asdict(c) for c in self.checks],
+                "artifacts": self.artifacts}
+
+
+def _sha(p: Path) -> str:
+    h = hashlib.sha256()
+    with p.open("rb") as fh:
+        for c in iter(lambda: fh.read(1 << 20), b""):
+            h.update(c)
+    return h.hexdigest()
+
+
+def _run(name: str, fn) -> VerifyResult:
+    import time
+    t0 = time.monotonic()
+    try:
+        ok, detail = fn()
+    except Exception as e:
+        ok, detail = False, f"exception: {type(e).__name__}: {e}"
+    return VerifyResult(name, ok, detail, round((time.monotonic()-t0)*1000, 2))
+
+
+def verify_release(
+    dist: Path,
+    *,
+    require_trust_root: bool = True,
+) -> VerifyReport:
+    from astra_verify.trust_root import is_trusted, PINNED_FINGERPRINTS
+    if require_trust_root and not PINNED_FINGERPRINTS:
+        raise RuntimeError(
+            "no pinned trust roots — run `astra-verify --bootstrap-root <pubkey>` "
+            "or provide astra_verify/roots/publisher.sha256"
+        )
+
+    rep = VerifyReport()
+    wheel = next(iter(dist.glob("astra_substrate-*-py3-none-any.whl")), None)
+    sdist = next(iter(dist.glob("astra_substrate-*.tar.gz")), None)
+    manifest = dist / "SHA256SUMS"
+    manifest_sig = dist / "SHA256SUMS.sig"
+    sbom = dist / "sbom.cdx.json"
+    sbom_sig = dist / "sbom.cdx.json.sig"
+
+    if wheel: rep.artifacts["wheel"] = _sha(wheel)
+    if sdist: rep.artifacts["sdist"] = _sha(sdist)
+    if sbom and sbom.exists(): rep.artifacts["sbom"] = _sha(sbom)
+
+    def check_artifacts_present():
+        missing = [n for n, p in [
+            ("wheel", wheel), ("sdist", sdist), ("manifest", manifest),
+            ("manifest_sig", manifest_sig), ("sbom", sbom), ("sbom_sig", sbom_sig),
+        ] if p is None or not p.exists()]
+        if missing:
+            return False, f"missing: {missing}"
+        return True, "all 6 artifacts present"
+    rep.checks.append(_run("artifacts_present", check_artifacts_present))
+
+    def check_manifest_signature():
+        from astra_verify._sig import verify_file, SigningError
+        pub = next(dist.glob("*.pub"), None)
+        if pub is None:
+            return False, "no publisher pubkey in dist/"
+        if not is_trusted(pub.read_bytes()):
+            return False, "publisher pubkey not in pinned trust roots"
+        try:
+            verify_file(manifest, pub, manifest_sig)
+        except SigningError as e:
+            return False, f"manifest signature invalid: {e}"
+        return True, f"manifest signed by trusted {_sha(pub)[:16]}..."
+    def check_not_yanked():
+        rev_dir = Path(__file__).parent.parent.parent / "trust" / "revocations"
+        # installed package's revocation check: manifest may declare a yanked flag
+        data = json.loads(sbom.read_text())
+        if data.get("astra_yanked"):
+            return False, f"release marked yanked: {data.get('astra_yank_reason', 'unknown')}"
+        return True, "not yanked"
+    rep.checks.append(_run("not_yanked", check_not_yanked))
+
+    rep.checks.append(_run("manifest_signature", check_manifest_signature))
+
+    def check_sbom_signature():
+        from astra_verify._sig import verify_file, SigningError
+        pub = next(dist.glob("*.pub"), None)
+        try:
+            verify_file(sbom, pub, sbom_sig)
+        except SigningError as e:
+            return False, f"sbom signature invalid: {e}"
+        return True, "sbom signed"
+    rep.checks.append(_run("sbom_signature", check_sbom_signature))
+
+    def check_wheel_hash():
+        target = wheel.name
+        expected = None
+        for line in manifest.read_text().splitlines():
+            if not line.strip():
+                continue
+            d, _, rel = line.partition("  ")
+            if Path(rel).name == target:
+                expected = d.strip()
+                break
+        if expected is None:
+            return False, f"{target} not in manifest"
+        actual = _sha(wheel)
+        if expected != actual:
+            return False, f"wheel hash mismatch vs manifest ({expected[:16]}... != {actual[:16]}...)"
+        return True, f"wheel matches manifest {expected[:16]}..."
+    rep.checks.append(_run("wheel_hash", check_wheel_hash))
+
+    def check_sbom_components():
+        data = json.loads(sbom.read_text())
+        comps = data.get("components", [])
+        names = {c.get("name") for c in comps}
+        required = ("astra-substrate", "mlx", "cryptography")
+        missing = [n for n in required if n not in names]
+        if missing:
+            return False, f"sbom missing: {missing}"
+        foreign = [n for n in names if n not in required]
+        if foreign:
+            return False, f"sbom contains non-runtime components: {sorted(foreign)[:5]}"
+        return True, f"{len(comps)} runtime components: {sorted(names)}"
+    rep.checks.append(_run("sbom_components", check_sbom_components))
+
+    return rep

astra_verify-0.3.1/astra_verify.egg-info/PKG-INFO

@@ -0,0 +1,20 @@
+Metadata-Version: 2.4
+Name: astra-verify
+Version: 0.3.1
+Summary: Independent verifier for astra-substrate releases
+Requires-Python: >=3.12
+Description-Content-Type: text/markdown
+Requires-Dist: cryptography>=42
+
+# astra-verify
+
+Independent verifier for astra-substrate releases.
+
+- Ships a pinned trust root (`roots/publisher.sha256`)
+- Verifies wheel hash, manifest signature, SBOM signature
+- Imports no `astra.*`
+
+## Usage
+
+    pip install astra-verify
+    astra-verify --dist /path/to/astra_substrate/dist

astra_verify-0.3.1/astra_verify.egg-info/SOURCES.txt

@@ -0,0 +1,36 @@
+MANIFEST.in
+README.md
+pyproject.toml
+./astra_verify/SELF_SHA256SUMS
+./astra_verify/SELF_SHA256SUMS.sig
+./astra_verify/SELF_publisher.pub
+./astra_verify/__init__.py
+./astra_verify/__main__.py
+./astra_verify/_selfcheck.py
+./astra_verify/_sig.py
+./astra_verify/trust_root.py
+./astra_verify/verify.py
+./astra_verify/roots/README.md
+./astra_verify/roots/v1/METADATA.json
+./astra_verify/roots/v1/publisher.sha256
+./astra_verify/roots/v2/METADATA.json
+./astra_verify/roots/v2/publisher.sha256
+astra_verify/SELF_SHA256SUMS
+astra_verify/SELF_SHA256SUMS.sig
+astra_verify/SELF_publisher.pub
+astra_verify/__init__.py
+astra_verify/__main__.py
+astra_verify/_selfcheck.py
+astra_verify/_sig.py
+astra_verify/trust_root.py
+astra_verify/verify.py
+astra_verify.egg-info/PKG-INFO
+astra_verify.egg-info/SOURCES.txt
+astra_verify.egg-info/dependency_links.txt
+astra_verify.egg-info/requires.txt
+astra_verify.egg-info/top_level.txt
+astra_verify/roots/README.md
+astra_verify/roots/v1/METADATA.json
+astra_verify/roots/v1/publisher.sha256
+astra_verify/roots/v2/METADATA.json
+astra_verify/roots/v2/publisher.sha256

astra_verify-0.3.1/astra_verify.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

astra_verify-0.3.1/astra_verify.egg-info/requires.txt

@@ -0,0 +1 @@
+cryptography>=42

astra_verify-0.3.1/astra_verify.egg-info/top_level.txt

@@ -0,0 +1 @@
+astra_verify

astra_verify-0.3.1/pyproject.toml

@@ -0,0 +1,27 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "astra-verify"
+version = "0.3.1"
+readme = "README.md"
+description = "Independent verifier for astra-substrate releases"
+requires-python = ">=3.12"
+dependencies = ["cryptography>=42"]
+
+[tool.setuptools]
+packages = ["astra_verify"]
+
+[tool.setuptools.package-dir]
+"" = "."
+
+[tool.setuptools.package-data]
+astra_verify = [
+    "roots/*",
+    "roots/v1/*",
+    "roots/v2/*",
+    "SELF_SHA256SUMS",
+    "SELF_SHA256SUMS.sig",
+    "SELF_publisher.pub",
+]

astra_verify-0.3.1/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+