dynamicfeed-verify 1.0.0__py3-none-any.whl

dynamicfeed_verify/__init__.py

@@ -0,0 +1,78 @@
+"""
+dynamicfeed-verify — verify Dynamic Feed (DF-VERIFY/1) Ed25519-signed responses, independently.
+
+A signed response carries a top-level ``signature`` block. This library reproduces the DF-VERIFY/1
+canonical form (JSON, keys sorted recursively, compact separators), fetches the public key published
+at ``<base>/.well-known/keys``, and verifies the detached Ed25519 signature. If it verifies, the
+response provably came from the issuer and has not been altered — checkable by anyone, even against us.
+
+Spec: https://dynamicfeed.ai/standard
+
+    from dynamicfeed_verify import verify, verify_live
+    env, result = verify_live()          # fetch a fresh signed verdict + verify it
+    assert result["ok"]
+    verify(my_signed_response)           # verify any signed response you already hold
+"""
+from __future__ import annotations
+
+import base64
+import json
+import urllib.request
+
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+
+__version__ = "1.0.0"
+DEFAULT_BASE = "https://dynamicfeed.ai"
+
+
+def _b64d(s: str) -> bytes:
+    """Decode base64url, tolerating missing padding."""
+    return base64.urlsafe_b64decode(s + "=" * (-len(s) % 4))
+
+
+def canonical(payload: dict) -> bytes:
+    """DF-VERIFY/1 canonical bytes for ``payload`` (the response WITHOUT its ``signature`` field):
+    JSON with object keys sorted recursively and compact separators, encoded UTF-8."""
+    return json.dumps(payload, sort_keys=True, separators=(",", ":")).encode("utf-8")
+
+
+def fetch_keys(base: str = DEFAULT_BASE, timeout: float = 20) -> dict:
+    """Fetch the JWKS-style public-key map: ``{key_id: base64url(Ed25519 public key)}``."""
+    with urllib.request.urlopen(base.rstrip("/") + "/.well-known/keys", timeout=timeout) as r:
+        return json.load(r)
+
+
+def verify(envelope: dict, jwks: dict | None = None, base: str = DEFAULT_BASE) -> dict:
+    """Verify a DF-VERIFY/1 signed response.
+
+    Returns ``{"ok": bool, "key_id"?, "verdict"?, "snapshot_id"?, "ephemeral"?, "error"?}``.
+    Pass ``jwks`` to verify fully offline; otherwise the public key is fetched from ``base``.
+    """
+    sig = (envelope or {}).get("signature") or {}
+    kid, sig_b64 = sig.get("key_id"), sig.get("sig")
+    if not kid or not sig_b64:
+        return {"ok": False, "error": "no signature block (need signature.key_id + signature.sig)"}
+    payload = {k: v for k, v in envelope.items() if k != "signature"}
+    keys = jwks if jwks is not None else fetch_keys(base)
+    if kid not in keys:
+        return {"ok": False, "key_id": kid, "error": f"key_id {kid} not in JWKS (rotated or ephemeral)"}
+    try:
+        Ed25519PublicKey.from_public_bytes(_b64d(keys[kid])).verify(_b64d(sig_b64), canonical(payload))
+    except Exception as e:  # noqa: BLE001 — any failure means it did not verify
+        return {"ok": False, "key_id": kid, "error": f"signature INVALID: {e}"}
+    return {
+        "ok": True, "key_id": kid, "ephemeral": bool(sig.get("ephemeral_key")),
+        "verdict": (envelope.get("verdict") or {}).get("status"),
+        "snapshot_id": envelope.get("snapshot_id"),
+    }
+
+
+def verify_live(base: str = DEFAULT_BASE, robot: dict | None = None, location: dict | None = None):
+    """Fetch a fresh signed awareness verdict from ``base`` and verify it. Returns ``(envelope, result)``."""
+    body = {"robot": robot or {"class": "aerial"}, "location": location or {"lat": 51.5, "lon": -0.12}}
+    req = urllib.request.Request(
+        base.rstrip("/") + "/v1/awareness",
+        data=json.dumps(body).encode(), headers={"Content-Type": "application/json"})
+    with urllib.request.urlopen(req, timeout=25) as r:
+        env = json.load(r)
+    return env, verify(env, base=base)

dynamicfeed_verify/__main__.py

@@ -0,0 +1,41 @@
+"""CLI: ``dynamicfeed-verify`` — fetch a live signed verdict and verify it, or verify a saved response."""
+from __future__ import annotations
+
+import json
+import sys
+
+from . import DEFAULT_BASE, verify, verify_live
+
+
+def main() -> int:
+    args = sys.argv[1:]
+    if args and args[0] in ("-h", "--help"):
+        print("usage:\n"
+              "  dynamicfeed-verify [BASE_URL]          fetch a live signed verdict and verify it\n"
+              "  dynamicfeed-verify - < response.json   verify a saved signed response (key still fetched)\n"
+              "  default BASE_URL = https://dynamicfeed.ai   ·   spec: https://dynamicfeed.ai/standard")
+        return 0
+    if args and args[0] == "-":
+        env = json.load(sys.stdin)
+        base = args[1].rstrip("/") if len(args) > 1 else DEFAULT_BASE
+        res = verify(env, base=base)
+    else:
+        base = args[0].rstrip("/") if args else DEFAULT_BASE
+        print(f"requesting a live signed verdict from {base}/v1/awareness ...")
+        _env, res = verify_live(base)
+    if res.get("ok"):
+        extra = ""
+        if res.get("verdict"):
+            extra += f" · verdict={res['verdict']}"
+        if res.get("snapshot_id"):
+            extra += f" · snapshot={res['snapshot_id']}"
+        if res.get("ephemeral"):
+            extra += " · EPHEMERAL key"
+        print(f"✅ VALID — key={res['key_id']}{extra}")
+        return 0
+    print(f"✗ INVALID — {res.get('error')}")
+    return 1
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

dynamicfeed_verify-1.0.0.dist-info/METADATA

@@ -0,0 +1,70 @@
+Metadata-Version: 2.4
+Name: dynamicfeed-verify
+Version: 1.0.0
+Summary: Verify Dynamic Feed (DF-VERIFY/1) Ed25519-signed responses, independently — in one line.
+Project-URL: Homepage, https://dynamicfeed.ai
+Project-URL: Standard, https://dynamicfeed.ai/standard
+Project-URL: Source, https://github.com/dynamicfeed/df-verify
+Author: Dynamic Feed
+License: MIT
+Keywords: agents,ai,attestation,df-verify,dynamic-feed,ed25519,provenance,verification
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.8
+Requires-Dist: cryptography>=41
+Description-Content-Type: text/markdown
+
+# dynamicfeed-verify
+
+Verify [Dynamic Feed](https://dynamicfeed.ai) **DF-VERIFY/1** Ed25519-signed responses — independently, in one line. No account, no dependency on Dynamic Feed at runtime beyond fetching the public key. You can verify, even against us.
+
+Reference implementation of the [DF-VERIFY/1 standard](https://dynamicfeed.ai/standard).
+
+## Install
+
+```bash
+pip install dynamicfeed-verify
+```
+
+## Use
+
+```python
+from dynamicfeed_verify import verify, verify_live
+
+# 1) fetch a fresh signed awareness verdict and verify it
+env, result = verify_live()
+print(result)        # {'ok': True, 'key_id': 'df-ed25519-…', 'verdict': 'caution', ...}
+
+# 2) verify any signed response you already hold
+result = verify(signed_response)
+if not result["ok"]:
+    raise RuntimeError(result["error"])
+
+# 3) verify fully offline if you already have the JWKS
+result = verify(signed_response, jwks={"df-ed25519-…": "<base64url public key>"})
+```
+
+## CLI
+
+```bash
+dynamicfeed-verify                       # fetch a live verdict + verify
+dynamicfeed-verify - < response.json     # verify a saved signed response
+```
+
+## How it works
+
+A signed response carries a `signature` block (`alg`, `key_id`, `canonicalization`, `sig`). Verification:
+
+1. Drop the `signature` field; keep the rest as the payload.
+2. Canonicalize — JSON, keys sorted recursively, compact separators (`,` `:`), UTF-8. Equivalent to `json.dumps(payload, sort_keys=True, separators=(",", ":"))`.
+3. Fetch the public key from `https://dynamicfeed.ai/.well-known/keys` and look up `signature.key_id`.
+4. Verify the Ed25519 signature over the canonical bytes. Change one byte → it fails.
+
+Full specification: **https://dynamicfeed.ai/standard**
+
+## License
+
+MIT.

dynamicfeed_verify-1.0.0.dist-info/RECORD

@@ -0,0 +1,6 @@
+dynamicfeed_verify/__init__.py,sha256=yHOYCKm9pUvWjj_cOgCDAeInTRmG8nhgLdOLk8zUPY0,3691
+dynamicfeed_verify/__main__.py,sha256=ewUXlpUN2TJkmj3sbNVK75UlOPJ4QqeXDQK7QnWuBRA,1517
+dynamicfeed_verify-1.0.0.dist-info/METADATA,sha256=45jC5KaQJ5QRhk5mbDKcmRJKEDWS7Ga24AnCjxONlak,2512
+dynamicfeed_verify-1.0.0.dist-info/WHEEL,sha256=mffPy8wBnZQn2VnJUU5jE99KsxaSfiyMHV9Yt0aLVxs,87
+dynamicfeed_verify-1.0.0.dist-info/entry_points.txt,sha256=87e-MAR6LuqBfcdj3qocdeZITAQ8YEZ8vuvTE35t7W0,72
+dynamicfeed_verify-1.0.0.dist-info/RECORD,,

dynamicfeed_verify-1.0.0.dist-info/WHEEL

@@ -0,0 +1,4 @@
+Wheel-Version: 1.0
+Generator: hatchling 1.30.1
+Root-Is-Purelib: true
+Tag: py3-none-any

dynamicfeed_verify-1.0.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+dynamicfeed-verify = dynamicfeed_verify.__main__:main