openentity 0.5.1__tar.gz → 0.5.3__tar.gz

{openentity-0.5.1 → openentity-0.5.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: openentity
-Version: 0.5.1
+Version: 0.5.3
 Summary: Open Entity (OEIS-1) client: JCS, did:key, eddsa-jcs-2022, Merkle proofs, adopt().
 Project-URL: Homepage, https://openentity.org
 Project-URL: Documentation, https://oeis.dev

{openentity-0.5.1 → openentity-0.5.3}/openentity/__init__.py

@@ -5,4 +5,4 @@ from .httpsig import HttpSigError, sign_request, verify_request  # noqa: F401
 from .identity import Identity  # noqa: F401
 from .report import TrustReport, trust  # noqa: F401
 
-__version__ = "0.5.1"
+__version__ = "0.5.3"

{openentity-0.5.1 → openentity-0.5.3}/openentity/cli.py

@@ -955,13 +955,15 @@ def _checks_of(o: dict) -> list[dict]:
     t = o.get("type") or ("EntityDocument" if "layers" in o and "keys" in o else None)
     if not t:
         return [{"name": "type", "ok": False, "detail": "cannot tell what kind of object this is"}]
+    errs = schema.validate(t, o)
+    head = [{"name": f"{t} schema", "ok": not errs, "detail": "; ".join(errs)}]
     if t == "ContinuityLink":
         bare = {k: v for k, v in o.items() if k != "proofs"}
-        cs = [{"name": f"link proof {i} ({p.get('verificationMethod')})", "ok": (r := core.verify_object({**bare, "proof": p}, _resolver))[0], "detail": None if r[0] else r[1]}
+        cs = head + [{"name": f"link proof {i} ({p.get('verificationMethod')})", "ok": (r := core.verify_object({**bare, "proof": p}, _resolver))[0], "detail": None if r[0] else r[1]}
               for i, p in enumerate(o.get("proofs") or [])]
-        return cs or [{"name": "link proofs", "ok": False, "detail": "none"}]
+        return cs if len(cs) > 1 else cs + [{"name": "link proofs", "ok": False, "detail": "none"}]
     ok, who = core.verify_object(o, _resolver)
-    checks = [{"name": "signature", "ok": ok, "detail": None if ok else who}]
+    checks = head + [{"name": "signature", "ok": ok, "detail": None if ok else who}]
     if ok and o.get("eid") and t in ("EntityDocument", "Declaration", "RecordEntry", "Withdrawal"):
         checks.append({"name": "signed by the EID", "ok": who == o["eid"], "detail": who})
     if t == "Declaration" and o.get("declaration_version") == "1.0":
@@ -1092,6 +1094,8 @@ def _log(args):
             raise _usage("log audit <n>")
         import random
         ok, detail, sth = _checkpoint(reg)
+        mb = (reg.spec().get("registry") or {}).get("publicKeyMultibase")  # a registry that is not openentity.org signs with its /v1/spec key
+        res = lambda did: {"ed25519": _keys_of({"verificationMethod": [{"publicKeyMultibase": mb}]})} if mb and did.split("#")[0] == "did:web:openentity.org" else _resolver(did)
         checks = [{"name": "checkpoint", "ok": ok, "detail": detail}]
         for _ in range(min(int(arg or 5), sth["tree_size"])):
             i = random.randrange(sth["tree_size"])
@@ -1099,7 +1103,7 @@ def _log(args):
             checks.append({"name": f"inclusion {i}", "ok": ok, "detail": detail})
             if ok and (leaf or {}).get("eid"):  # object signature: the entity's current document must verify under its own key
                 try:
-                    s_ok, who = core.verify_object(reg.get(f"/v1/entities/{leaf['eid']}/document"), _resolver)
+                    s_ok, who = core.verify_object(reg.get(f"/v1/entities/{leaf['eid']}/document"), res)
                     checks.append({"name": f"signature {leaf['eid']}", "ok": s_ok, "detail": "document signature valid" if s_ok else f"document signature invalid: {who}"})
                 except _NET as e:
                     checks.append({"name": f"signature {leaf['eid']}", "ok": False, "detail": str(e)})

{openentity-0.5.1 → openentity-0.5.3}/openentity/client.py

@@ -4,9 +4,15 @@ import re
 import urllib.error
 import urllib.parse
 import urllib.request
+from importlib.metadata import PackageNotFoundError, version
 
 from . import core
 
+try:
+    _VERSION = version("openentity")
+except PackageNotFoundError:
+    _VERSION = "dev"
+
 DEFAULT_REGISTRY = "https://openentity.org"
 CLIENTS = ("adk", "goose", "langchain", "ui-tars", "cli", "other")  # the registry's allowlist for the unsigned `client` label
 
@@ -20,7 +26,7 @@ class RegistryError(Exception):
 def _request(url: str, body: dict | None = None, headers: dict | None = None, method: str | None = None) -> dict:
     req = urllib.request.Request(
         url, data=json.dumps(body).encode() if body is not None else None, method=method,
-        headers={"content-type": "application/json", "user-agent": "openentity-python/0.2.0", **(headers or {})})
+        headers={"content-type": "application/json", "user-agent": f"openentity-python/{_VERSION}", **(headers or {})})
     try:
         with urllib.request.urlopen(req, timeout=30) as r:
             return json.load(r)
@@ -47,8 +53,7 @@ def build_adoption(kp: core.KeyPair, name: str, description: str, registry: str,
         "keys": [{"id": core.verification_method(kp.did), "type": "Multikey",
                   "publicKeyMultibase": kp.did.removeprefix("did:key:")}],
         "operator": operator or {"kind": "none", "custody": "entity", "can_change": []},
-        "substrate": substrate or {"model": "unknown", "provider": "unknown", "runtime": "openentity-python/0.2.0",
-                                   "declared_at": created},
+        "substrate": substrate or {"model": "unknown", "provider": "unknown", "runtime": "unknown", "declared_at": created},
         "layers": {
             "cognition": {"statement": ns, "uncertainty_practice": ns},
             "presence": {"statement": ns, "format_signature": ns},

{openentity-0.5.1 → openentity-0.5.3}/openentity/core.py

@@ -332,7 +332,8 @@ def _zero_bits(h: bytes) -> int:
 
 
 def mint_stamp(bits: int, eid: str, created: str | None = None) -> str:
-    created, i = created or now(), 0
+    # Random start so two stamps for the same EID in the same second differ (registries reject reuse).
+    created, i = created or now(), int.from_bytes(os.urandom(4), "big")
     while True:
         header = f"1:{bits}:{created}:{eid}:{b58encode(i.to_bytes(8, 'big'))}"
         if _zero_bits(sha256(header)) >= bits:

{openentity-0.5.1 → openentity-0.5.3}/openentity/identity.py

@@ -37,8 +37,13 @@ def _keychain_set(seed_hex: str) -> bool:
     return False
 
 
+def home() -> pathlib.Path:
+    """OPENENTITY_HOME, else ~/.openentity: where the key file and integrations' state live."""
+    return pathlib.Path(os.environ.get("OPENENTITY_HOME", "~/.openentity")).expanduser()
+
+
 def _file() -> pathlib.Path:
-    return pathlib.Path(os.environ.get("OPENENTITY_HOME", "~/.openentity")).expanduser() / "identity.key"
+    return home() / "identity.key"
 
 
 class Identity:
@@ -54,10 +59,17 @@ class Identity:
         return self.kp.seed
 
     @classmethod
-    def load_or_create(cls) -> "Identity":
+    def load(cls) -> "Identity | None":
+        """The existing identity, or None. Never creates one."""
         for source, read in (("keychain", _keychain_get), ("file", lambda: _file().read_text().strip() if _file().exists() else None)):
             if h := read():
                 return cls(bytes.fromhex(h), source)
+        return None
+
+    @classmethod
+    def load_or_create(cls) -> "Identity":
+        if found := cls.load():
+            return found
         seed = os.urandom(32)
         if _keychain_set(seed.hex()):
             return cls(seed, "keychain")

{openentity-0.5.1 → openentity-0.5.3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "openentity"
-version = "0.5.1"
+version = "0.5.3"
 description = "Open Entity (OEIS-1) client: JCS, did:key, eddsa-jcs-2022, Merkle proofs, adopt()."
 readme = "README.md"
 license = "MIT"

{openentity-0.5.1 → openentity-0.5.3}/tests/test_cli.py

@@ -4,7 +4,7 @@ import re
 import stat
 
 import pytest
-from test_client import KP, Stub, home, posts, run, url  # noqa: F401  (fixtures and the stub registry)
+from test_client import KP, LOG_KEY, Stub, home, posts, run, url  # noqa: F401  (fixtures and the stub registry)
 
 from openentity import cli, core
 
@@ -139,6 +139,21 @@ def test_alias_wallet_is_two_step_with_an_external_siwe_signature(url, home, cap
     assert code == 0 and "Chain ID: 84532" in out["message"]
 
 
+def test_verify_reports_a_schema_check_like_the_npm_cli(capsys, tmp_path):
+    bad = tmp_path / "bad.json"
+    bad.write_text(json.dumps(core.sign_object({"spec": core.SPEC, "eid": KP.did, "name": "T", "layers": {}, "keys": []}, KP)))
+    code, out = j(capsys, "verify", str(bad))
+    assert code == 3 and out["checks"][0]["name"] == "EntityDocument schema" and not out["checks"][0]["ok"]
+
+
+def test_log_audit_checks_the_registry_document_with_the_key_its_spec_publishes(url, capsys):
+    """The registry's DID names openentity.org, but a registry elsewhere signs with its /v1/spec key (guard: no lookup of did:web:openentity.org)."""
+    Stub.leaves = [{"type": "Declaration", "eid": "did:web:openentity.org", "object_sha256": "00" * 32, "received_at": core.now()}]
+    Stub.document = core.sign_object({"spec": core.SPEC, "eid": "did:web:openentity.org", "name": "registry"}, LOG_KEY, method="did:web:openentity.org#key-1")
+    code, out = j(capsys, "log", "audit", "1", "--registry", url)
+    assert code == 0 and {"name": "signature did:web:openentity.org", "ok": True, "detail": "document signature valid"} in out["checks"]
+
+
 def test_record_push_and_redact(url, home, capsys):
     reg = ["--registry", url]
     assert run(capsys, "record", "arc", "open", "--id", "a", "--title", "A", "--no-push", *reg)[0] == 0
@@ -268,6 +283,6 @@ def test_verify_checks_continuity_link_proofs(capsys, tmp_path):
     f = tmp_path / "l.json"
     f.write_text(json.dumps(body["link"]))
     code, out = j(capsys, "verify", str(f))
-    assert code == 0 and len(out["checks"]) == 2
+    assert code == 0 and len(out["checks"]) == 3  # schema + the two link proofs
     f.write_text(json.dumps({**body["link"], "basis": "migration"}))
     assert run(capsys, "verify", str(f))[0] == 3

{openentity-0.5.1 → openentity-0.5.3}/tests/test_client.py

@@ -24,6 +24,7 @@ class Stub(BaseHTTPRequestHandler):
     refuse = False  # refuse every continuity link
     leaves: list = []  # the stub log's leaf objects; the checkpoint is signed by LOG_KEY
     forge_note = False
+    document: dict | None = None  # overrides GET /v1/entities/<eid>/document
 
     def log_message(self, *a):
         pass
@@ -84,7 +85,7 @@ class Stub(BaseHTTPRequestHandler):
         if u.path.endswith("/attestations"):
             return self._send(200, {"attestations": Stub.attestations})
         if u.path.endswith("/document"):
-            return self._send(200, client.build_adoption(core.KeyPair(SEED), "Tester", "d", "http://x")[0])
+            return self._send(200, Stub.document or client.build_adoption(core.KeyPair(SEED), "Tester", "d", "http://x")[0])
         if "NoSuchEntity" in u.path:
             return self._send(404, {"error": "not_found", "message": "no such entity"})
         if u.path.startswith("/v1/entities/"):
@@ -143,7 +144,7 @@ class Stub(BaseHTTPRequestHandler):
 
 @pytest.fixture
 def url():
-    Stub.log, Stub.chain, Stub.attestations, Stub.entity, Stub.refuse, Stub.leaves, Stub.forge_note = [], [], [], None, False, [], False
+    Stub.log, Stub.chain, Stub.attestations, Stub.entity, Stub.refuse, Stub.leaves, Stub.forge_note, Stub.document = [], [], [], None, False, [], False, None
     srv = HTTPServer(("127.0.0.1", 0), Stub)
     threading.Thread(target=srv.serve_forever, daemon=True).start()
     yield f"http://127.0.0.1:{srv.server_port}"
@@ -274,9 +275,7 @@ def test_cli_whoami_and_self(url, home, capsys):
 
 def test_cli_verify_entity_file_and_failures(url, home, capsys, tmp_path):
     reg = ["--registry", url]
-    decl = core.sign_object({"spec": core.SPEC, "type": "Declaration", "eid": KP.did, "declaration_version": "1.0",
-                             "text_sha256": core.DECLARATION_SHA256, "name": "T", "created": core.now(), "nonce": core.nonce()}, KP)
-    doc = core.sign_object({"spec": core.SPEC, "eid": KP.did, "name": "T", "layers": {}, "keys": []}, KP)
+    doc, decl = client.build_adoption(KP, "T", "d", "http://x")  # verify now checks the schemas too
     Stub.leaves = [{"type": "Declaration", "eid": f"did:key:z{i}", "object_sha256": "00" * 32, "received_at": core.now()} for i in range(5)]
     Stub.entity = {"document": doc, "declaration": decl, "log_index": 3}
     client.record(SEED, [("arc_opened", {"arc_id": "a", "title": "A"}), ("arc_opened", {"arc_id": "b", "title": "B"})], registry=url)

{openentity-0.5.1 → openentity-0.5.3}/tests/test_core.py

@@ -7,7 +7,7 @@ from pathlib import Path
 
 import pytest
 
-from openentity import cli, core
+from openentity import __version__, cli, core
 
 ROOT = Path(__file__).resolve().parents[3]
 VECTORS = ROOT / "test-vectors"
@@ -90,6 +90,12 @@ def test_declaration_text():
 
 
 # ---- stamp ----
+def test_stamps_for_one_eid_in_one_second_differ():
+    """Registries accept each stamp once, so two quick writes must not mint the same one."""
+    eid = core.KeyPair(SEED).did
+    assert len({core.mint_stamp(4, eid, "2026-10-28T00:00:00Z") for _ in range(20)}) == 20
+
+
 def test_stamp():
     eid = core.KeyPair(SEED).did
     h = core.mint_stamp(10, eid)
@@ -192,7 +198,7 @@ def test_adopt_and_cli(tmp_path, monkeypatch, capsys):
 def test_cli_version(capsys):
     with pytest.raises(SystemExit) as e:
         cli.main(["--version"])
-    assert e.value.code == 0 and "0.5.1" in capsys.readouterr().out
+    assert e.value.code == 0 and __version__ in capsys.readouterr().out
 
 
 # ---- shared vectors, checked with the independent verifier's own logic ----

{openentity-0.5.1 → openentity-0.5.3}/tests/test_identity.py

@@ -45,3 +45,15 @@ def test_keychain_failure_falls_back_to_file(monkeypatch):
     monkeypatch.delenv("OPENENTITY_KEYCHAIN")
     monkeypatch.setattr(identity, "_run", lambda argv, stdin=None: None)  # no `security`, no `secret-tool`
     assert Identity.load_or_create().source == "file"
+
+
+def test_load_never_creates_a_key(home):
+    """Read-only callers (a trust gate) must not mint an identity as a side effect."""
+    assert Identity.load() is None
+    assert not (home / "identity.key").exists()
+    a = Identity.load_or_create()
+    assert Identity.load().did == a.did
+
+
+def test_home_follows_openentity_home(home):
+    assert identity.home() == home

{openentity-0.5.1 → openentity-0.5.3}/uv.lock

@@ -699,7 +699,7 @@ wheels = [
 
 [[package]]
 name = "openentity"
-version = "0.5.1"
+version = "0.5.3"
 source = { editable = "." }
 dependencies = [
     { name = "cryptography" },