ciris-verify 7.2.0__tar.gz → 7.4.0__tar.gz

{ciris_verify-7.2.0 → ciris_verify-7.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ciris-verify
-Version: 7.2.0
+Version: 7.4.0
 Summary: Python bindings for CIRISVerify hardware-rooted license verification
 Author-email: CIRIS Engineering <engineering@ciris.ai>
 License-Expression: AGPL-3.0-or-later

{ciris_verify-7.2.0 → ciris_verify-7.4.0}/ciris_verify/__init__.py

@@ -30,6 +30,8 @@ import logging as _logging
 
 from .client import CIRISVerify, MockCIRISVerify, verify_tree, DEFAULT_REGISTRY_URL
 from ._jcs import jcs_canonicalize
+from ._rns_dest_hash import rns_destination_hash
+from . import _scope_privacy as scope_privacy
 from ._federation_identity import create_federation_identity
 from ._manifest_contribution import verify_build_manifest_contribution
 from ._accord_custody import verify_accord_custody_attestation
@@ -127,12 +129,14 @@ def get_library_version() -> str:
     return __version__
 
 
-__version__ = "7.2.0"
+__version__ = "7.4.0"
 __all__ = [
     "CIRISVerify",
     "MockCIRISVerify",
     "verify_tree",
     "jcs_canonicalize",
+    "rns_destination_hash",
+    "scope_privacy",
     "create_federation_identity",
     "verify_build_manifest_contribution",
     "verify_accord_custody_attestation",

ciris_verify-7.4.0/ciris_verify/_rns_dest_hash.py

@@ -0,0 +1,150 @@
+"""RNS ``destination_hash`` recompute — Python binding (CIRISVerify#28).
+
+Exposes :func:`rns_destination_hash`, a thin wrapper over the FFI symbol
+``ciris_verify_rns_destination_hash`` which calls
+``ciris_verify_core::transport_binding::compute_destination_hash`` — the one
+blessed two-stage RNS destination-hash construction (CEG 1.0-RC6 §5.6.8.8.1.1).
+
+This lifts the last verify-side remainder of the #28 transport-binding
+waterfall: the recompute shipped Rust-side in v5.6.0 (``DestinationHashCheck``
+lifted off ``Unsupported``) but was never on the wheel, so a Python consumer —
+and CIRISConformance's ``test_150_rns_dest_hash.py`` cross-check — could not
+verify a peer's ``destination_hash`` against the pinned algorithm. With this it
+can, byte-for-byte, with **no** Reticulum vendoring and no second
+implementation: the canonical bytes come from the same Rust path the verifiers
+use.
+"""
+
+from __future__ import annotations
+
+import ctypes
+import json as _json
+import platform as _platform
+import threading as _threading
+from pathlib import Path
+from typing import Optional, Sequence
+
+__all__ = ["rns_destination_hash"]
+
+_lib: Optional[ctypes.CDLL] = None
+_lib_lock = _threading.Lock()
+_SUCCESS = 0
+
+
+def _candidate_paths() -> list[str]:
+    here = Path(__file__).resolve().parent
+    system = _platform.system()
+    names = {
+        "Linux": ["libciris_verify_ffi.so", "libciris_verify.so"],
+        "Darwin": ["libciris_verify_ffi.dylib", "libciris_verify.dylib"],
+        "Windows": ["ciris_verify_ffi.dll", "ciris_verify.dll"],
+    }.get(system, ["libciris_verify_ffi.so"])
+
+    paths: list[str] = []
+    for n in names:
+        paths.append(str(here / n))
+    try:
+        from .client import DEFAULT_BINARY_PATHS  # type: ignore
+
+        paths.extend(DEFAULT_BINARY_PATHS.get(system, []))
+    except Exception:  # pragma: no cover - defensive
+        pass
+    return paths
+
+
+def _load_lib() -> ctypes.CDLL:
+    global _lib
+    if _lib is not None:
+        return _lib
+    with _lib_lock:
+        if _lib is not None:
+            return _lib
+        last_err: Optional[Exception] = None
+        for path in _candidate_paths():
+            if not Path(path).exists():
+                continue
+            try:
+                lib = ctypes.CDLL(path)
+                fn = lib.ciris_verify_rns_destination_hash
+            except (OSError, AttributeError) as exc:
+                last_err = exc
+                continue
+            fn.argtypes = [
+                ctypes.c_char_p,  # input_json (UTF-8 bytes)
+                ctypes.c_size_t,  # input_len
+                ctypes.POINTER(ctypes.POINTER(ctypes.c_ubyte)),  # result_out
+                ctypes.POINTER(ctypes.c_size_t),  # result_len_out
+            ]
+            fn.restype = ctypes.c_int
+            lib.ciris_verify_free.argtypes = [ctypes.c_void_p]
+            lib.ciris_verify_free.restype = None
+            _lib = lib
+            return _lib
+    raise RuntimeError(
+        "ciris_verify_rns_destination_hash not available — could not load "
+        f"the CIRISVerify shared library (last error: {last_err}). "
+        "The library must be built with the wheel (>= v7.3.0)."
+    )
+
+
+def rns_destination_hash(
+    app_name: str,
+    aspects: Sequence[str],
+    x25519_pub: bytes,
+    ed25519_pub: bytes,
+) -> bytes:
+    """Recompute the RNS ``destination_hash`` per CEG §5.6.8.8.1.1.
+
+    The two-stage construction (NOT a flat single SHA-256):
+
+        name_hash        = SHA256(app_name + "." + ".".join(aspects))[:10]
+        identity_hash    = SHA256(x25519_pub ‖ ed25519_pub)[:16]
+        destination_hash = SHA256(name_hash ‖ identity_hash)[:16]
+
+    Args:
+        app_name: the RNS app name (e.g. ``"ciris.federation"``).
+        aspects: the dot-joined aspects (each MUST NOT contain ``"."``).
+        x25519_pub: the peer's X25519 public key bytes.
+        ed25519_pub: the peer's Ed25519 public key bytes (key order is
+            x25519 THEN ed25519, per RNS ``get_public_key``).
+
+    Returns:
+        The 16-byte destination hash — byte-identical to
+        ``ciris_verify_core::transport_binding::compute_destination_hash`` and
+        therefore to the pinned §5.6.8.8.1.1 algorithm.
+
+    Raises:
+        ValueError: an aspect contains ``"."`` (illegal — it would alter the
+            name preimage split), or the inputs cannot be encoded.
+        RuntimeError: the shared library / FFI symbol is unavailable.
+    """
+    req = {
+        "app_name": app_name,
+        "aspects": list(aspects),
+        "x25519_pubkey": list(x25519_pub),
+        "ed25519_pubkey": list(ed25519_pub),
+    }
+    input_bytes = _json.dumps(req).encode("utf-8")
+
+    lib = _load_lib()
+    out_ptr = ctypes.POINTER(ctypes.c_ubyte)()
+    out_len = ctypes.c_size_t(0)
+    rc = lib.ciris_verify_rns_destination_hash(
+        input_bytes,
+        len(input_bytes),
+        ctypes.byref(out_ptr),
+        ctypes.byref(out_len),
+    )
+    if rc != _SUCCESS:
+        # rc 2 == SerializationError (bad request / dotted aspect).
+        raise ValueError(
+            f"rns_destination_hash: invalid request (e.g. an aspect containing "
+            f"'.', or non-encodable input) (FFI code {rc})"
+        )
+    n = out_len.value
+    try:
+        result = ctypes.string_at(out_ptr, n)
+    finally:
+        if n != 0:
+            lib.ciris_verify_free(ctypes.cast(out_ptr, ctypes.c_void_p))
+    return result

ciris_verify-7.4.0/ciris_verify/_scope_privacy.py

@@ -0,0 +1,186 @@
+"""Scope-native privacy derivations — Python binding (CIRISVerify#82).
+
+Exposes the ``ciris_crypto::scope_privacy`` FSD §2.2/§2.4/§3.4 derivation
+helpers (CEWP ``SCOPE_PRIVACY.md`` — CC 1.13.3 anonymous tier) on the wheel,
+over the FFI symbol ``ciris_verify_scope_privacy_derive``. A Python consumer can
+reproduce a ``record_id`` / ``symbol_key`` / witness cover-leaf **byte-identically**
+to the Rust verifiers — the canonical bytes (incl. the RFC 8949 §4.2.1
+deterministic CBOR ``record_id`` preimage and the pinned ``RecordType`` integers)
+come from the one Rust impl, so there is no second implementation to drift.
+
+Imported as the ``ciris_verify.scope_privacy`` namespace::
+
+    from ciris_verify import scope_privacy
+    krid = scope_privacy.k_record_id(exporter_secret)
+    rid  = scope_privacy.derive_record_id(krid, internal_id, "community", epoch)
+"""
+
+from __future__ import annotations
+
+import ctypes
+import json as _json
+import platform as _platform
+import threading as _threading
+from pathlib import Path
+from typing import Optional
+
+__all__ = [
+    "k_record_id",
+    "k_symbol",
+    "derive_record_id",
+    "derive_symbol_key",
+    "witness_cover_leaf",
+]
+
+_lib: Optional[ctypes.CDLL] = None
+_lib_lock = _threading.Lock()
+_SUCCESS = 0
+
+# The record_type strings the FFI accepts (mirrors ciris_crypto RecordType).
+_RECORD_TYPES = ("self", "family", "community", "federation")
+
+
+def _candidate_paths() -> list[str]:
+    here = Path(__file__).resolve().parent
+    system = _platform.system()
+    names = {
+        "Linux": ["libciris_verify_ffi.so", "libciris_verify.so"],
+        "Darwin": ["libciris_verify_ffi.dylib", "libciris_verify.dylib"],
+        "Windows": ["ciris_verify_ffi.dll", "ciris_verify.dll"],
+    }.get(system, ["libciris_verify_ffi.so"])
+
+    paths: list[str] = []
+    for n in names:
+        paths.append(str(here / n))
+    try:
+        from .client import DEFAULT_BINARY_PATHS  # type: ignore
+
+        paths.extend(DEFAULT_BINARY_PATHS.get(system, []))
+    except Exception:  # pragma: no cover - defensive
+        pass
+    return paths
+
+
+def _load_lib() -> ctypes.CDLL:
+    global _lib
+    if _lib is not None:
+        return _lib
+    with _lib_lock:
+        if _lib is not None:
+            return _lib
+        last_err: Optional[Exception] = None
+        for path in _candidate_paths():
+            if not Path(path).exists():
+                continue
+            try:
+                lib = ctypes.CDLL(path)
+                fn = lib.ciris_verify_scope_privacy_derive
+            except (OSError, AttributeError) as exc:
+                last_err = exc
+                continue
+            fn.argtypes = [
+                ctypes.c_char_p,  # input_json (UTF-8 bytes)
+                ctypes.c_size_t,  # input_len
+                ctypes.POINTER(ctypes.POINTER(ctypes.c_ubyte)),  # result_out
+                ctypes.POINTER(ctypes.c_size_t),  # result_len_out
+            ]
+            fn.restype = ctypes.c_int
+            lib.ciris_verify_free.argtypes = [ctypes.c_void_p]
+            lib.ciris_verify_free.restype = None
+            _lib = lib
+            return _lib
+    raise RuntimeError(
+        "ciris_verify_scope_privacy_derive not available — could not load "
+        f"the CIRISVerify shared library (last error: {last_err}). "
+        "The library must be built with the wheel (>= v7.4.0)."
+    )
+
+
+def _derive(req: dict) -> bytes:
+    input_bytes = _json.dumps(req).encode("utf-8")
+    lib = _load_lib()
+    out_ptr = ctypes.POINTER(ctypes.c_ubyte)()
+    out_len = ctypes.c_size_t(0)
+    rc = lib.ciris_verify_scope_privacy_derive(
+        input_bytes,
+        len(input_bytes),
+        ctypes.byref(out_ptr),
+        ctypes.byref(out_len),
+    )
+    if rc != _SUCCESS:
+        # rc 2 == SerializationError (bad request / wrong-length key / unknown type).
+        raise ValueError(
+            f"scope_privacy: invalid request — a 32-byte key has the wrong length, "
+            f"an unknown record_type, or non-encodable input (FFI code {rc})"
+        )
+    n = out_len.value
+    try:
+        result = ctypes.string_at(out_ptr, n)
+    finally:
+        if n != 0:
+            lib.ciris_verify_free(ctypes.cast(out_ptr, ctypes.c_void_p))
+    return result
+
+
+def k_record_id(exporter_secret: bytes) -> bytes:
+    """§2.2 — derive ``K_record_id`` from the group's 32-byte MLS exporter secret."""
+    return _derive({"op": "k_record_id", "exporter_secret": list(exporter_secret)})
+
+
+def k_symbol(exporter_secret: bytes) -> bytes:
+    """§2.2 — derive ``K_symbol`` from the group's 32-byte MLS exporter secret."""
+    return _derive({"op": "k_symbol", "exporter_secret": list(exporter_secret)})
+
+
+def derive_record_id(
+    k_record_id: bytes,
+    internal_id: bytes,
+    record_type: str,
+    mls_group_epoch: int,
+) -> bytes:
+    """§2.4 — ``record_id = HMAC-SHA3-256(K_record_id, CBOR_dCE({v,iid,typ,epc}))``.
+
+    ``record_type`` is one of ``"self"``, ``"family"``, ``"community"``,
+    ``"federation"`` (the pinned ``RecordType`` mapping). The CBOR preimage is
+    RFC 8949 §4.2.1 core-deterministic — encoded Rust-side, so this is
+    byte-identical to the verifier's ``record_id``.
+    """
+    if record_type not in _RECORD_TYPES:
+        raise ValueError(f"record_type must be one of {_RECORD_TYPES}, got {record_type!r}")
+    return _derive(
+        {
+            "op": "record_id",
+            "k_record_id": list(k_record_id),
+            "internal_id": list(internal_id),
+            "record_type": record_type,
+            "mls_group_epoch": int(mls_group_epoch),
+        }
+    )
+
+
+def derive_symbol_key(k_symbol: bytes, record_id: bytes, symbol_index: int) -> bytes:
+    """§2.4 — ``symbol_key = HKDF-SHA3-256(salt=record_id, ikm=K_symbol, info=label‖u16(idx))``."""
+    return _derive(
+        {
+            "op": "symbol_key",
+            "k_symbol": list(k_symbol),
+            "record_id": list(record_id),
+            "symbol_index": int(symbol_index),
+        }
+    )
+
+
+def witness_cover_leaf(
+    witness_signing_key: bytes,
+    leaf_position: int,
+    federation_epoch_id: int,
+) -> bytes:
+    """§3.4 — witness cover-leaf ``HMAC-SHA3-256(key, u32_be(pos) ‖ u64_be(epoch))``."""
+    return _derive(
+        {
+            "op": "witness_cover_leaf",
+            "witness_signing_key": list(witness_signing_key),
+            "leaf_position": int(leaf_position),
+            "federation_epoch_id": int(federation_epoch_id),
+        }
+    )

{ciris_verify-7.2.0 → ciris_verify-7.4.0}/ciris_verify.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ciris-verify
-Version: 7.2.0
+Version: 7.4.0
 Summary: Python bindings for CIRISVerify hardware-rooted license verification
 Author-email: CIRIS Engineering <engineering@ciris.ai>
 License-Expression: AGPL-3.0-or-later

{ciris_verify-7.2.0 → ciris_verify-7.4.0}/ciris_verify.egg-info/SOURCES.txt

@@ -8,6 +8,8 @@ ciris_verify/_federation_identity.py
 ciris_verify/_jcs.py
 ciris_verify/_manifest_contribution.py
 ciris_verify/_operational_admit.py
+ciris_verify/_rns_dest_hash.py
+ciris_verify/_scope_privacy.py
 ciris_verify/_wheel_hybrid_kex.py
 ciris_verify/_wheel_key_grant.py
 ciris_verify/_wheel_locale_merkle.py

{ciris_verify-7.2.0 → ciris_verify-7.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ciris-verify"
-version = "7.2.0"
+version = "7.4.0"
 description = "Python bindings for CIRISVerify hardware-rooted license verification"
 readme = "README.md"
 license = "AGPL-3.0-or-later"