parmana-verifier 0.1.0__tar.gz

parmana_verifier-0.1.0/PKG-INFO

@@ -0,0 +1,84 @@
+Metadata-Version: 2.4
+Name: parmana-verifier
+Version: 0.1.0
+Summary: Offline verifier for Parmana Execution Trust Records (Python).
+License: Apache-2.0
+Project-URL: Repository, https://github.com/pavancharak/parmana-verifier
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+Requires-Dist: cryptography>=42
+Provides-Extra: test
+Requires-Dist: pytest>=8; extra == "test"
+
+# parmana-verifier (Python)
+
+Check whether a Parmana Execution Trust Record was signed by a key you trust, using only the record and a trust file. No network access, no account, no Parmana server needed.
+
+This is the Python counterpart of the Node verifier in the repository root. It checks the same things in the same order, and it returns the same result shape and exit codes. Its results match the Node verifier on every test vector and on records generated by each implementation.
+
+## What it checks, and what it does not
+
+**Checked**
+
+- The record hash (`trustRecordHash`) against the canonical record fields.
+- The Ed25519 signature, over the legacy message, from a key in your trust file.
+- Ed25519 signatures in a hybrid `signatures` array, and the whole-record (schema version 3) message.
+- Trust rules: the key's fingerprint, its validity window, and the `compromised` flag.
+- The `hybridRequiredFrom` cutover, when the trust file sets one.
+
+**Not checked: ML-DSA-65 (`dilithium3`) signatures.** The `cryptography` package does not provide ML-DSA. A record with a `dilithium3` entry is reported as invalid, so this verifier never accepts a hybrid record on its Ed25519 part alone. To check the ML-DSA-65 part, use the Node verifier (`@parmana/verifier`) on Node 24 or later with OpenSSL 3.5 or later.
+
+**Other differences from the Node verifier**
+
+- A timestamp without a time zone offset is rejected. Node reads it in the local time zone, so this verifier gives the same answer on every machine.
+- Integers beyond 2^53 are rounded the way JavaScript rounds them when it parses JSON. Use records written by Parmana, which never contain such integers.
+
+## Install
+
+Requires Python 3.11 or later (tested on 3.11, 3.12 and 3.13). The only dependency is `cryptography` (version 42 or later). It is not yet published to PyPI, so install from a clone of this repository:
+
+```sh
+cd python
+pip install -e .
+```
+
+For the tests, install the `test` extra as well: `pip install -e ".[test]"`.
+
+## Command line
+
+```sh
+parmana-verify <proof.json> <trust.json>
+parmana-verify key-fingerprint <public-key.pem>
+```
+
+- `verify` prints one line of JSON and exits `0` when the record is valid, `1` when it is invalid, and `2` for a usage or read error.
+- `key-fingerprint` prints the `sha256:...` value to pin in a trust file.
+
+The output has the same fields as the Node CLI: `valid`, `coverage`, `errors` and `checks`.
+
+## Python API
+
+```python
+import json
+from parmana_verifier import parse_trust_policy, verify_execution_trust_record
+
+record = json.load(open("proof.json"))
+policy = parse_trust_policy(json.load(open("trust.json")))
+
+result = verify_execution_trust_record(record, policy.keys, policy.hybrid_required_from)
+print(result["valid"], result["errors"])
+```
+
+## Trust file
+
+The trust file lists each key you accept, pinned by its fingerprint. See the [main README](../README.md#installation-and-usage) for the format. The verifier never fetches keys.
+
+## Tests
+
+```sh
+cd python
+pip install -e ".[test]"
+pytest
+```
+
+The tests run the shared test vectors in `../test/vectors`, check the canonical serialization against JavaScript's number and string formatting, and generate Ed25519 records at test time to cover the trust rules and the CLI.

parmana_verifier-0.1.0/README.md

@@ -0,0 +1,72 @@
+# parmana-verifier (Python)
+
+Check whether a Parmana Execution Trust Record was signed by a key you trust, using only the record and a trust file. No network access, no account, no Parmana server needed.
+
+This is the Python counterpart of the Node verifier in the repository root. It checks the same things in the same order, and it returns the same result shape and exit codes. Its results match the Node verifier on every test vector and on records generated by each implementation.
+
+## What it checks, and what it does not
+
+**Checked**
+
+- The record hash (`trustRecordHash`) against the canonical record fields.
+- The Ed25519 signature, over the legacy message, from a key in your trust file.
+- Ed25519 signatures in a hybrid `signatures` array, and the whole-record (schema version 3) message.
+- Trust rules: the key's fingerprint, its validity window, and the `compromised` flag.
+- The `hybridRequiredFrom` cutover, when the trust file sets one.
+
+**Not checked: ML-DSA-65 (`dilithium3`) signatures.** The `cryptography` package does not provide ML-DSA. A record with a `dilithium3` entry is reported as invalid, so this verifier never accepts a hybrid record on its Ed25519 part alone. To check the ML-DSA-65 part, use the Node verifier (`@parmana/verifier`) on Node 24 or later with OpenSSL 3.5 or later.
+
+**Other differences from the Node verifier**
+
+- A timestamp without a time zone offset is rejected. Node reads it in the local time zone, so this verifier gives the same answer on every machine.
+- Integers beyond 2^53 are rounded the way JavaScript rounds them when it parses JSON. Use records written by Parmana, which never contain such integers.
+
+## Install
+
+Requires Python 3.11 or later (tested on 3.11, 3.12 and 3.13). The only dependency is `cryptography` (version 42 or later). It is not yet published to PyPI, so install from a clone of this repository:
+
+```sh
+cd python
+pip install -e .
+```
+
+For the tests, install the `test` extra as well: `pip install -e ".[test]"`.
+
+## Command line
+
+```sh
+parmana-verify <proof.json> <trust.json>
+parmana-verify key-fingerprint <public-key.pem>
+```
+
+- `verify` prints one line of JSON and exits `0` when the record is valid, `1` when it is invalid, and `2` for a usage or read error.
+- `key-fingerprint` prints the `sha256:...` value to pin in a trust file.
+
+The output has the same fields as the Node CLI: `valid`, `coverage`, `errors` and `checks`.
+
+## Python API
+
+```python
+import json
+from parmana_verifier import parse_trust_policy, verify_execution_trust_record
+
+record = json.load(open("proof.json"))
+policy = parse_trust_policy(json.load(open("trust.json")))
+
+result = verify_execution_trust_record(record, policy.keys, policy.hybrid_required_from)
+print(result["valid"], result["errors"])
+```
+
+## Trust file
+
+The trust file lists each key you accept, pinned by its fingerprint. See the [main README](../README.md#installation-and-usage) for the format. The verifier never fetches keys.
+
+## Tests
+
+```sh
+cd python
+pip install -e ".[test]"
+pytest
+```
+
+The tests run the shared test vectors in `../test/vectors`, check the canonical serialization against JavaScript's number and string formatting, and generate Ed25519 records at test time to cover the trust rules and the CLI.

parmana_verifier-0.1.0/parmana_verifier/__init__.py

@@ -0,0 +1,22 @@
+"""Offline verifier for Parmana Execution Trust Records (Python).
+
+Python counterpart to the Node verifier in the repository root. It checks the
+record hash and Ed25519 signatures against the keys you pin in a trust file,
+and makes no network calls. It does not check ML-DSA-65 (dilithium3)
+signatures; see README.md.
+"""
+
+from .canonical import canonical_bytes
+from .trust import TrustEntry, TrustPolicy, key_fingerprint, parse_trust_policy
+from .verify import verify_execution_trust_record
+
+__all__ = [
+    "TrustEntry",
+    "TrustPolicy",
+    "canonical_bytes",
+    "key_fingerprint",
+    "parse_trust_policy",
+    "verify_execution_trust_record",
+]
+
+__version__ = "0.1.0"

parmana_verifier-0.1.0/parmana_verifier/__main__.py

@@ -0,0 +1,5 @@
+import sys
+
+from .cli import main
+
+sys.exit(main())

parmana_verifier-0.1.0/parmana_verifier/canonical.py

@@ -0,0 +1,86 @@
+"""Canonical serialization for Parmana artifacts.
+
+Mirrors src/canonical.mjs. Object keys are sorted in UTF-16 code-unit order,
+arrays keep their order, and numbers and strings are written the way
+JavaScript's JSON.stringify writes them. Every hash and signature is computed
+over these bytes, so the verifier must produce exactly the same bytes as the
+signer.
+"""
+
+import json
+import re
+from decimal import Decimal
+
+_LONE_SURROGATE = re.compile("[\ud800-\udfff]")
+_MAX_SAFE_INTEGER = 2**53 - 1
+
+
+def canonical_bytes(value):
+    return _dump(value).encode("utf-8")
+
+
+def _dump(value):
+    if value is None:
+        return "null"
+    if value is True:
+        return "true"
+    if value is False:
+        return "false"
+    if isinstance(value, str):
+        return _string(value)
+    if isinstance(value, int):
+        # JSON.parse rounds integers beyond 2**53 to the nearest double, so the
+        # signer's bytes contain that rounded value, not the exact integer.
+        if abs(value) > _MAX_SAFE_INTEGER:
+            return js_number(float(value))
+        return str(value)
+    if isinstance(value, float):
+        return js_number(value)
+    if isinstance(value, list):
+        return "[" + ",".join(_dump(item) for item in value) + "]"
+    if isinstance(value, dict):
+        keys = sorted(value, key=_utf16_sort_key)
+        return "{" + ",".join(_string(key) + ":" + _dump(value[key]) for key in keys) + "}"
+    raise TypeError(f"cannot canonicalize value of type {type(value).__name__}")
+
+
+def _utf16_sort_key(key):
+    return key.encode("utf-16-be", "surrogatepass")
+
+
+def _string(value):
+    text = json.dumps(value, ensure_ascii=False)
+    # JSON.stringify escapes an unpaired surrogate as \uXXXX (lowercase). Python
+    # keeps it as a bare code point, which cannot be encoded as UTF-8.
+    return _LONE_SURROGATE.sub(lambda match: "\\u%04x" % ord(match.group(0)), text)
+
+
+def js_number(number):
+    """Format a finite double the way ECMAScript Number.prototype.toString does."""
+    if number != number or number in (float("inf"), float("-inf")):
+        return "null"
+    if number == 0:
+        return "0"
+    if number < 0:
+        return "-" + js_number(-number)
+
+    # repr gives the shortest digits that round-trip, the same digits as JavaScript.
+    sign, digits, exponent = Decimal(repr(number)).as_tuple()
+    text = "".join(str(d) for d in digits).rstrip("0") or "0"
+    # Position of the decimal point relative to the start of the digit string.
+    point = len(digits) + exponent
+    k = len(text)
+    n = point
+
+    if k <= n <= 21:
+        return text + "0" * (n - k)
+    if 0 < n <= 21:
+        return text[:n] + "." + text[n:]
+    if -6 < n <= 0:
+        return "0." + "0" * (-n) + text
+
+    e = n - 1
+    exponent_text = ("+" if e >= 0 else "-") + str(abs(e))
+    if k == 1:
+        return text + "e" + exponent_text
+    return text[0] + "." + text[1:] + "e" + exponent_text

parmana_verifier-0.1.0/parmana_verifier/cli.py

@@ -0,0 +1,68 @@
+"""Command-line interface, matching bin/parmana-verify.mjs.
+
+  parmana-verify <proof.json> <trust.json>
+  parmana-verify key-fingerprint <public-key.pem>
+
+verify exits 0 when the record is valid, 1 when it is invalid, and 2 for a
+usage or read error. key-fingerprint prints the "sha256:..." value to pin in a
+trust file.
+"""
+
+import json
+import sys
+
+from .trust import key_fingerprint, parse_trust_policy
+from .verify import result_to_json, verify_execution_trust_record
+
+USAGE = (
+    "usage: parmana-verify <proof.json> <trust.json>\n"
+    "       parmana-verify key-fingerprint <public-key.pem>"
+)
+
+
+def _reject_non_standard_constant(value):
+    # JSON.parse rejects NaN and Infinity, so the Python reader does too.
+    raise ValueError(f"invalid JSON constant {value}")
+
+
+def _read_json(path):
+    with open(path, "r", encoding="utf-8") as handle:
+        return json.loads(handle.read(), parse_constant=_reject_non_standard_constant)
+
+
+def main(argv=None):
+    args = sys.argv[1:] if argv is None else argv
+
+    if args and args[0] == "key-fingerprint":
+        if len(args) != 2:
+            print(USAGE, file=sys.stderr)
+            return 2
+        try:
+            with open(args[1], "r", encoding="utf-8") as handle:
+                print(key_fingerprint(handle.read()))
+            return 0
+        except (OSError, ValueError, TypeError) as error:
+            print(f"key error: {error}", file=sys.stderr)
+            return 2
+
+    if len(args) != 2 or not args[0] or not args[1]:
+        print(USAGE, file=sys.stderr)
+        return 2
+
+    proof_path, trust_path = args
+
+    try:
+        proof = _read_json(proof_path)
+        policy = parse_trust_policy(_read_json(trust_path))
+    except (OSError, ValueError) as error:
+        print(f"read error: {error}", file=sys.stderr)
+        return 2
+
+    result = verify_execution_trust_record(proof, policy.keys, policy.hybrid_required_from)
+    print(result_to_json(result))
+
+    return 0 if result["valid"] else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

parmana_verifier-0.1.0/parmana_verifier/timestamps.py

@@ -0,0 +1,54 @@
+"""ISO-8601 timestamp parsing for the verifier.
+
+Accepts the forms the Parmana records and trust files use: a date, or a date
+and time with an explicit offset ("Z" or "+hh:mm"). A timestamp without an
+offset is rejected, rather than read in the local time zone as JavaScript's
+Date.parse would, so that a result never depends on the machine's clock setting.
+Returns None when the value is not such a timestamp.
+"""
+
+import re
+from datetime import datetime, timedelta, timezone
+
+_DATE_TIME = re.compile(
+    r"^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2})(?::(\d{2})(?:\.(\d+))?)?(Z|[+-]\d{2}:\d{2})$"
+)
+_DATE_ONLY = re.compile(r"^(\d{4})-(\d{2})-(\d{2})$")
+
+
+def parse_timestamp(value):
+    if not isinstance(value, str):
+        return None
+
+    date_only = _DATE_ONLY.match(value)
+    if date_only:
+        year, month, day = (int(part) for part in date_only.groups())
+        try:
+            return datetime(year, month, day, tzinfo=timezone.utc)
+        except ValueError:
+            return None
+
+    match = _DATE_TIME.match(value)
+    if not match:
+        return None
+
+    year, month, day, hour, minute = (int(part) for part in match.groups()[:5])
+    second = int(match.group(6) or 0)
+    # Keep microsecond precision: pad or truncate the fraction to six digits.
+    microsecond = int(((match.group(7) or "") + "000000")[:6])
+
+    try:
+        moment = datetime(year, month, day, hour, minute, second, microsecond, tzinfo=timezone.utc)
+        return moment - _offset(match.group(8))
+    except (ValueError, OverflowError):
+        return None
+
+
+def _offset(text):
+    if text == "Z":
+        return timedelta(0)
+    sign = 1 if text[0] == "+" else -1
+    hours, minutes = int(text[1:3]), int(text[4:6])
+    if hours > 23 or minutes > 59:
+        raise ValueError("offset out of range")
+    return sign * timedelta(hours=hours, minutes=minutes)

parmana_verifier-0.1.0/parmana_verifier/trust.py

@@ -0,0 +1,116 @@
+"""Trust set: the keys a verifier accepts, each pinned by fingerprint.
+
+Mirrors src/trust.mjs. A key is used only when all of these hold:
+  - its PEM hashes to the pinned fingerprint (SHA-256 of the SPKI DER);
+  - its algorithm matches the algorithm the signature names;
+  - it is not marked compromised;
+  - the record's createdAt falls within [validFrom, validUntil).
+
+The trust set is supplied by the caller. The verifier never fetches keys.
+"""
+
+import hashlib
+import re
+from dataclasses import dataclass, field
+from typing import Optional
+
+from cryptography.hazmat.primitives import serialization
+
+from .timestamps import parse_timestamp
+
+ALGORITHM_NAMES = ["ed25519", "dilithium3"]
+_FINGERPRINT = re.compile(r"^sha256:[0-9a-f]{64}$")
+
+
+@dataclass
+class TrustEntry:
+    key_id: str
+    algorithm: str
+    public_key_pem: str
+    fingerprint: str
+    valid_from: str
+    valid_until: Optional[str]
+    compromised: bool
+
+
+@dataclass
+class TrustPolicy:
+    keys: dict = field(default_factory=dict)
+    hybrid_required_from: Optional[str] = None
+
+
+def key_fingerprint(public_key_pem):
+    """Return the "sha256:..." value to pin for a PEM public key."""
+    public_key = serialization.load_pem_public_key(public_key_pem.encode("utf-8"))
+    return fingerprint_of_key(public_key)
+
+
+def fingerprint_of_key(public_key):
+    der = public_key.public_bytes(
+        serialization.Encoding.DER,
+        serialization.PublicFormat.SubjectPublicKeyInfo,
+    )
+    return "sha256:" + hashlib.sha256(der).hexdigest()
+
+
+def parse_trust_policy(document):
+    """Parse a trust-set document into a TrustPolicy. Raises ValueError when malformed."""
+    if not isinstance(document, dict) or not isinstance(document.get("keys"), list):
+        raise ValueError('trust set must be an object with a "keys" array')
+
+    hybrid_required_from = None
+    cutover = document.get("hybridRequiredFrom")
+    if cutover is not None:
+        if not isinstance(cutover, str) or not cutover.endswith("Z") or parse_timestamp(cutover) is None:
+            raise ValueError('hybridRequiredFrom must be an ISO-8601 UTC timestamp ending in "Z"')
+        hybrid_required_from = cutover
+
+    keys = {}
+
+    for index, entry in enumerate(document["keys"]):
+        at = f"keys[{index}]"
+
+        if not isinstance(entry, dict):
+            raise ValueError(f"{at} must be an object")
+
+        key_id = entry.get("keyId")
+        if not isinstance(key_id, str) or key_id == "":
+            raise ValueError(f"{at}.keyId must be a non-empty string")
+
+        if key_id in keys:
+            raise ValueError(f'duplicate keyId "{key_id}"')
+
+        if entry.get("algorithm") not in ALGORITHM_NAMES:
+            raise ValueError(f"{at}.algorithm must be one of {', '.join(ALGORITHM_NAMES)}")
+
+        if not isinstance(entry.get("publicKeyPem"), str):
+            raise ValueError(f"{at}.publicKeyPem must be a PEM string")
+
+        fingerprint = entry.get("fingerprint")
+        if not isinstance(fingerprint, str) or not _FINGERPRINT.match(fingerprint):
+            raise ValueError(f'{at}.fingerprint must be "sha256:" followed by 64 lowercase hex digits')
+
+        if parse_timestamp(entry.get("validFrom")) is None:
+            raise ValueError(f"{at}.validFrom must be an ISO timestamp")
+
+        valid_until = entry.get("validUntil")
+        if valid_until is not None and parse_timestamp(valid_until) is None:
+            raise ValueError(f"{at}.validUntil must be an ISO timestamp or null")
+
+        compromised = entry.get("compromised", False)
+        if compromised is None:
+            compromised = False
+        if not isinstance(compromised, bool):
+            raise ValueError(f"{at}.compromised must be true or false")
+
+        keys[key_id] = TrustEntry(
+            key_id=key_id,
+            algorithm=entry["algorithm"],
+            public_key_pem=entry["publicKeyPem"],
+            fingerprint=fingerprint,
+            valid_from=entry["validFrom"],
+            valid_until=valid_until,
+            compromised=compromised,
+        )
+
+    return TrustPolicy(keys=keys, hybrid_required_from=hybrid_required_from)

parmana_verifier-0.1.0/parmana_verifier/verify.py

@@ -0,0 +1,283 @@
+"""Offline verification of an Execution Trust Record.
+
+Mirrors src/verify.mjs. Checks run on the record alone:
+  1. trustRecordHash equals the SHA-256 (hex) of the canonical record fields.
+  2. signature is a valid signature over those canonical bytes, made by a
+     trusted key named by signature.keyId (see trust.py for the trust rules).
+  3. If signatures is present, it is a hybrid envelope: at least two entries,
+     no repeated algorithm, and every entry verifies over the message for its
+     schemaVersion (default 2). A record with schemaVersion 3 must carry one.
+  4. If a cutover is given (hybrid_required_from, from the trust file), a record
+     created at or after it must pass check 3.
+
+Schema versions:
+  2  the message is the canonical fields plus schemaVersion.
+  3  the message is every top-level field except signature, signatures,
+     schemaVersion, verifications and receipts, plus schemaVersion.
+
+Supported algorithms:
+  ed25519     Ed25519 keys. Messages over 4096 bytes may be signed as a
+              commitment: the prefix below followed by the SHA-512 digest of
+              the canonical bytes. A raw signature is also accepted. A
+              commitment over a small message is rejected.
+  dilithium3  ML-DSA-65 keys. This verifier does not check them, because the
+              cryptography package does not provide ML-DSA. Such an entry is
+              reported as a failed check, so a hybrid record is never accepted
+              on its Ed25519 part alone.
+
+The verifier reads no environment variables and private keys, and makes no
+network calls.
+"""
+
+import base64
+import binascii
+import hashlib
+import json
+from dataclasses import dataclass
+
+from cryptography.exceptions import InvalidSignature
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+from cryptography.hazmat.primitives import serialization
+
+from .canonical import canonical_bytes
+from .timestamps import parse_timestamp
+from .trust import fingerprint_of_key
+
+RAW_MESSAGE_LIMIT_BYTES = 4096
+COMMITMENT_PREFIX = b"PARMANA-ED25519-LARGE-MESSAGE-V1\x00"
+DEFAULT_SCHEMA_VERSION = 2
+WHOLE_RECORD_SCHEMA_VERSION = 3
+SUPPORTED_SCHEMA_VERSIONS = (2, 3)
+
+LEGACY_FIELDS = ("trustRecordId", "businessTransactionId", "transaction", "authorization", "overrides", "executions", "createdAt")
+WHOLE_RECORD_EXCLUDED_FIELDS = ("signature", "signatures", "schemaVersion", "verifications", "receipts")
+
+ALGORITHMS = {
+    "ed25519": {"commitment": True},
+    "dilithium3": {"commitment": False},
+}
+
+
+@dataclass
+class _Context:
+    trust_keys: dict
+    created_at: object
+
+
+def canonical_trust_record(record):
+    """The fields covered by trustRecordHash and the legacy signature."""
+    # A field the record does not have is left out, as JSON.stringify leaves out
+    # undefined values in the JavaScript verifier.
+    return {key: record[key] for key in LEGACY_FIELDS if key in record}
+
+
+def hybrid_message(record, schema_version):
+    """The message a hybrid envelope of the given schema version signs."""
+    if schema_version == WHOLE_RECORD_SCHEMA_VERSION:
+        covered = {key: value for key, value in record.items() if key not in WHOLE_RECORD_EXCLUDED_FIELDS}
+        covered["schemaVersion"] = schema_version
+        return canonical_bytes(covered)
+
+    return canonical_bytes({**canonical_trust_record(record), "schemaVersion": schema_version})
+
+
+def verify_execution_trust_record(record, trust_keys, hybrid_required_from=None):
+    """Verify a record against a trust set (a dict keyId -> TrustEntry).
+
+    Returns a dict with valid, coverage ("full" or "legacy"), errors and checks,
+    the same shape as the Node verifier's result.
+    """
+    errors = []
+
+    if not isinstance(record, dict):
+        return {"valid": False, "coverage": "legacy", "errors": ["record must be a JSON object"], "checks": {}}
+
+    legacy_message = canonical_bytes(canonical_trust_record(record))
+    expected_hash = hashlib.sha256(legacy_message).hexdigest()
+    hash_valid = expected_hash == record.get("trustRecordHash")
+
+    if not hash_valid:
+        errors.append(f"trustRecordHash mismatch: expected {expected_hash}.")
+
+    context = _Context(trust_keys=trust_keys, created_at=record.get("createdAt"))
+
+    signature_valid = _verify_legacy_signature(record.get("signature"), legacy_message, context, errors)
+
+    checks = {"trustRecordHash": hash_valid, "signature": signature_valid}
+
+    schema_version = record.get("schemaVersion")
+    if schema_version is None:
+        schema_version = DEFAULT_SCHEMA_VERSION
+    has_envelope = record.get("signatures") is not None
+
+    if schema_version not in SUPPORTED_SCHEMA_VERSIONS:
+        errors.append(f"unsupported schemaVersion {schema_version}: expected 2 or 3.")
+        checks["hybridSignatures"] = False
+    elif has_envelope:
+        checks["hybridSignatures"] = _verify_hybrid_signatures(
+            record["signatures"], hybrid_message(record, schema_version), context, errors
+        )
+    elif schema_version == WHOLE_RECORD_SCHEMA_VERSION:
+        errors.append("schemaVersion 3 record has no signatures array: a whole-record signature is required.")
+        checks["hybridSignatures"] = False
+
+    cutover_ok = not _is_at_or_after_cutover(record.get("createdAt"), hybrid_required_from) or checks.get("hybridSignatures") is True
+
+    if not cutover_ok:
+        errors.append(f"record created at or after hybridRequiredFrom ({hybrid_required_from}) has no valid hybrid envelope.")
+
+    coverage = "full" if schema_version == WHOLE_RECORD_SCHEMA_VERSION and checks.get("hybridSignatures") is True else "legacy"
+
+    valid = hash_valid and signature_valid and checks.get("hybridSignatures", True) and cutover_ok
+
+    return {"valid": bool(valid), "coverage": coverage, "errors": errors, "checks": checks}
+
+
+def _is_at_or_after_cutover(created_at, hybrid_required_from):
+    if hybrid_required_from is None:
+        return False
+
+    created = parse_timestamp(created_at)
+    cutover = parse_timestamp(hybrid_required_from)
+
+    return created is not None and cutover is not None and created >= cutover
+
+
+def _verify_legacy_signature(signature, message, context, errors):
+    if not _is_signature_entry(signature):
+        errors.append("signature is missing or malformed.")
+        return False
+
+    return _verify_entry(signature, message, context, errors)
+
+
+def _verify_hybrid_signatures(entries, message, context, errors):
+    if not isinstance(entries, list) or not all(_is_signature_entry(entry) for entry in entries):
+        errors.append("malformed signatures: expected an array of entries with string algorithm, keyId and signature.")
+        return False
+
+    if len(entries) < 2:
+        noun = "entry" if len(entries) == 1 else "entries"
+        errors.append(f"signatures array has {len(entries)} {noun}, need at least 2 for a hybrid record.")
+        return False
+
+    seen = set()
+    all_valid = True
+
+    for entry in entries:
+        if entry["algorithm"] in seen:
+            errors.append(f"duplicate algorithm in signatures array: {entry['algorithm']}.")
+            all_valid = False
+            continue
+
+        seen.add(entry["algorithm"])
+        all_valid = _verify_entry(entry, message, context, errors) and all_valid
+
+    return all_valid
+
+
+def _verify_entry(entry, message, context, errors):
+    # The legacy signature field uses "value" for the same three parts.
+    signature_text = entry.get("signature") if isinstance(entry.get("signature"), str) else entry.get("value")
+    algorithm_name = entry["algorithm"]
+    key_id = entry["keyId"]
+
+    if algorithm_name not in ALGORITHMS:
+        errors.append(f"unsupported algorithm: {algorithm_name}.")
+        return False
+
+    trusted = context.trust_keys.get(key_id)
+
+    if trusted is None:
+        errors.append(f'no trusted key for keyId "{key_id}".')
+        return False
+
+    if trusted.algorithm != algorithm_name:
+        errors.append(f'keyId "{key_id}" is trusted for {trusted.algorithm}, not {algorithm_name}.')
+        return False
+
+    if trusted.compromised:
+        errors.append(f'keyId "{key_id}" is marked compromised; its signatures are not accepted.')
+        return False
+
+    if not _within_validity_window(trusted, context.created_at):
+        errors.append(f'createdAt {context.created_at} is outside the validity window of keyId "{key_id}".')
+        return False
+
+    if algorithm_name == "dilithium3":
+        errors.append(
+            "algorithm dilithium3 (ML-DSA-65) is not supported by the Python verifier; "
+            "use the Node verifier (@parmana/verifier) on Node 24+ with OpenSSL 3.5+."
+        )
+        return False
+
+    try:
+        public_key = serialization.load_pem_public_key(trusted.public_key_pem.encode("utf-8"))
+    except (ValueError, TypeError):
+        errors.append(f'public key for keyId "{key_id}" is not a valid PEM key.')
+        return False
+
+    if fingerprint_of_key(public_key) != trusted.fingerprint:
+        errors.append(f'public key for keyId "{key_id}" does not match its pinned fingerprint.')
+        return False
+
+    if not isinstance(public_key, Ed25519PublicKey):
+        errors.append(f'public key for keyId "{key_id}" has type {type(public_key).__name__}, expected ed25519.')
+        return False
+
+    try:
+        signature = base64.b64decode(signature_text or "", validate=False)
+    except (binascii.Error, ValueError):
+        signature = b""
+
+    raw_valid = _safe_verify(message, signature, public_key)
+    commitment_valid = (
+        not raw_valid
+        and ALGORITHMS[algorithm_name]["commitment"]
+        and len(message) > RAW_MESSAGE_LIMIT_BYTES
+        and _safe_verify(_commitment(message), signature, public_key)
+    )
+
+    if not raw_valid and not commitment_valid:
+        errors.append(f'signature verification failed for keyId "{key_id}" ({algorithm_name}).')
+        return False
+
+    return True
+
+
+def _within_validity_window(trusted, created_at):
+    at = parse_timestamp(created_at)
+
+    if at is None:
+        return False
+
+    if at < parse_timestamp(trusted.valid_from):
+        return False
+
+    return trusted.valid_until is None or at < parse_timestamp(trusted.valid_until)
+
+
+def _commitment(message):
+    return COMMITMENT_PREFIX + hashlib.sha512(message).digest()
+
+
+def _safe_verify(message, signature, public_key):
+    try:
+        public_key.verify(signature, message)
+        return True
+    except (InvalidSignature, ValueError, TypeError):
+        return False
+
+
+def _is_signature_entry(value):
+    return (
+        isinstance(value, dict)
+        and isinstance(value.get("algorithm"), str)
+        and isinstance(value.get("keyId"), str)
+        and (isinstance(value.get("signature"), str) or isinstance(value.get("value"), str))
+    )
+
+
+def result_to_json(result):
+    """Serialize a result the way the Node CLI prints it (no spaces, UTF-8)."""
+    return json.dumps(result, separators=(",", ":"), ensure_ascii=False)

parmana_verifier-0.1.0/parmana_verifier.egg-info/PKG-INFO

@@ -0,0 +1,84 @@
+Metadata-Version: 2.4
+Name: parmana-verifier
+Version: 0.1.0
+Summary: Offline verifier for Parmana Execution Trust Records (Python).
+License: Apache-2.0
+Project-URL: Repository, https://github.com/pavancharak/parmana-verifier
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+Requires-Dist: cryptography>=42
+Provides-Extra: test
+Requires-Dist: pytest>=8; extra == "test"
+
+# parmana-verifier (Python)
+
+Check whether a Parmana Execution Trust Record was signed by a key you trust, using only the record and a trust file. No network access, no account, no Parmana server needed.
+
+This is the Python counterpart of the Node verifier in the repository root. It checks the same things in the same order, and it returns the same result shape and exit codes. Its results match the Node verifier on every test vector and on records generated by each implementation.
+
+## What it checks, and what it does not
+
+**Checked**
+
+- The record hash (`trustRecordHash`) against the canonical record fields.
+- The Ed25519 signature, over the legacy message, from a key in your trust file.
+- Ed25519 signatures in a hybrid `signatures` array, and the whole-record (schema version 3) message.
+- Trust rules: the key's fingerprint, its validity window, and the `compromised` flag.
+- The `hybridRequiredFrom` cutover, when the trust file sets one.
+
+**Not checked: ML-DSA-65 (`dilithium3`) signatures.** The `cryptography` package does not provide ML-DSA. A record with a `dilithium3` entry is reported as invalid, so this verifier never accepts a hybrid record on its Ed25519 part alone. To check the ML-DSA-65 part, use the Node verifier (`@parmana/verifier`) on Node 24 or later with OpenSSL 3.5 or later.
+
+**Other differences from the Node verifier**
+
+- A timestamp without a time zone offset is rejected. Node reads it in the local time zone, so this verifier gives the same answer on every machine.
+- Integers beyond 2^53 are rounded the way JavaScript rounds them when it parses JSON. Use records written by Parmana, which never contain such integers.
+
+## Install
+
+Requires Python 3.11 or later (tested on 3.11, 3.12 and 3.13). The only dependency is `cryptography` (version 42 or later). It is not yet published to PyPI, so install from a clone of this repository:
+
+```sh
+cd python
+pip install -e .
+```
+
+For the tests, install the `test` extra as well: `pip install -e ".[test]"`.
+
+## Command line
+
+```sh
+parmana-verify <proof.json> <trust.json>
+parmana-verify key-fingerprint <public-key.pem>
+```
+
+- `verify` prints one line of JSON and exits `0` when the record is valid, `1` when it is invalid, and `2` for a usage or read error.
+- `key-fingerprint` prints the `sha256:...` value to pin in a trust file.
+
+The output has the same fields as the Node CLI: `valid`, `coverage`, `errors` and `checks`.
+
+## Python API
+
+```python
+import json
+from parmana_verifier import parse_trust_policy, verify_execution_trust_record
+
+record = json.load(open("proof.json"))
+policy = parse_trust_policy(json.load(open("trust.json")))
+
+result = verify_execution_trust_record(record, policy.keys, policy.hybrid_required_from)
+print(result["valid"], result["errors"])
+```
+
+## Trust file
+
+The trust file lists each key you accept, pinned by its fingerprint. See the [main README](../README.md#installation-and-usage) for the format. The verifier never fetches keys.
+
+## Tests
+
+```sh
+cd python
+pip install -e ".[test]"
+pytest
+```
+
+The tests run the shared test vectors in `../test/vectors`, check the canonical serialization against JavaScript's number and string formatting, and generate Ed25519 records at test time to cover the trust rules and the CLI.

parmana_verifier-0.1.0/parmana_verifier.egg-info/SOURCES.txt

@@ -0,0 +1,16 @@
+README.md
+pyproject.toml
+parmana_verifier/__init__.py
+parmana_verifier/__main__.py
+parmana_verifier/canonical.py
+parmana_verifier/cli.py
+parmana_verifier/timestamps.py
+parmana_verifier/trust.py
+parmana_verifier/verify.py
+parmana_verifier.egg-info/PKG-INFO
+parmana_verifier.egg-info/SOURCES.txt
+parmana_verifier.egg-info/dependency_links.txt
+parmana_verifier.egg-info/entry_points.txt
+parmana_verifier.egg-info/requires.txt
+parmana_verifier.egg-info/top_level.txt
+tests/test_verifier.py

parmana_verifier-0.1.0/parmana_verifier.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

parmana_verifier-0.1.0/parmana_verifier.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+parmana-verify = parmana_verifier.cli:main

parmana_verifier-0.1.0/parmana_verifier.egg-info/requires.txt

@@ -0,0 +1,4 @@
+cryptography>=42
+
+[test]
+pytest>=8

parmana_verifier-0.1.0/parmana_verifier.egg-info/top_level.txt

@@ -0,0 +1 @@
+parmana_verifier

parmana_verifier-0.1.0/pyproject.toml

@@ -0,0 +1,24 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "parmana-verifier"
+version = "0.1.0"
+description = "Offline verifier for Parmana Execution Trust Records (Python)."
+readme = "README.md"
+license = { text = "Apache-2.0" }
+requires-python = ">=3.11"
+dependencies = ["cryptography>=42"]
+
+[project.optional-dependencies]
+test = ["pytest>=8"]
+
+[project.scripts]
+parmana-verify = "parmana_verifier.cli:main"
+
+[project.urls]
+Repository = "https://github.com/pavancharak/parmana-verifier"
+
+[tool.setuptools.packages.find]
+include = ["parmana_verifier*"]

parmana_verifier-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

parmana_verifier-0.1.0/tests/test_verifier.py

@@ -0,0 +1,291 @@
+import base64
+import hashlib
+import json
+import re
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+
+from parmana_verifier.canonical import canonical_bytes, js_number
+from parmana_verifier.timestamps import parse_timestamp
+from parmana_verifier.trust import parse_trust_policy, key_fingerprint
+from parmana_verifier.verify import canonical_trust_record, verify_execution_trust_record, hybrid_message
+
+VECTORS = Path(__file__).resolve().parents[2] / "test" / "vectors"
+PREFIX = b"PARMANA-ED25519-LARGE-MESSAGE-V1\x00"
+
+
+def load(name):
+    return json.loads((VECTORS / name).read_text(encoding="utf-8"))
+
+
+def trust_entry(key_id, private_key, **overrides):
+    public = private_key.public_key()
+    der = public.public_bytes(serialization.Encoding.DER, serialization.PublicFormat.SubjectPublicKeyInfo)
+    pem = public.public_bytes(serialization.Encoding.PEM, serialization.PublicFormat.SubjectPublicKeyInfo).decode()
+    entry = {
+        "keyId": key_id,
+        "algorithm": "ed25519",
+        "publicKeyPem": pem,
+        "fingerprint": "sha256:" + hashlib.sha256(der).hexdigest(),
+        "validFrom": "2026-01-01T00:00:00.000Z",
+        "validUntil": None,
+        "compromised": False,
+    }
+    entry.update(overrides)
+    return entry
+
+
+def signed_record(private_key, key_id, body, created="2026-06-01T12:00:00.000Z", mode="raw"):
+    record = {
+        "trustRecordId": "tr-1",
+        "businessTransactionId": "btx-1",
+        "transaction": body,
+        "authorization": {"approvedBy": "ana"},
+        "overrides": None,
+        "executions": [{"n": 1}],
+        "createdAt": created,
+    }
+    message = canonical_bytes(canonical_trust_record(record))
+    record["trustRecordHash"] = hashlib.sha256(message).hexdigest()
+    signed = message if mode == "raw" else PREFIX + hashlib.sha512(message).digest()
+    record["signature"] = {
+        "algorithm": "ed25519",
+        "keyId": key_id,
+        "signature": base64.b64encode(private_key.sign(signed)).decode(),
+    }
+    return record
+
+
+def trust_map(*entries):
+    return parse_trust_policy({"keys": list(entries)}).keys
+
+
+# Vectors: the same records the Node verifier tests against.
+
+def test_tampered_record_fails_hash_and_signature():
+    trust = parse_trust_policy(load("trust.json"))
+    result = verify_execution_trust_record(load("record-tampered-amount.json"), trust.keys)
+    assert result["valid"] is False
+    assert result["checks"]["trustRecordHash"] is False
+    assert result["checks"]["signature"] is False
+
+
+def test_v2_record_ed25519_part_verifies_and_hybrid_is_reported_unsupported():
+    trust = parse_trust_policy(load("trust.json"))
+    result = verify_execution_trust_record(load("record-explicit-v2.json"), trust.keys)
+    assert result["checks"] == {"trustRecordHash": True, "signature": True, "hybridSignatures": False}
+    assert result["valid"] is False
+    assert any("dilithium3" in error for error in result["errors"])
+
+
+def test_whole_record_v3_ed25519_entry_verifies_over_the_v3_message():
+    # The ed25519 entry of the v3 vector must verify over the whole-record
+    # message. A failure here would mean hybrid_message() builds different bytes.
+    record = load("record-whole-record-v3.json")
+    trust = parse_trust_policy(load("trust-whole-record.json"))
+    result = verify_execution_trust_record(record, trust.keys, trust.hybrid_required_from)
+    assert not any("signature verification failed" in error for error in result["errors"])
+    ed_entry = next(entry for entry in record["signatures"] if entry["algorithm"] == "ed25519")
+    assert ed_entry["keyId"] in trust.keys
+    assert hybrid_message(record, 3)
+
+
+# Canonical serialization, matching ECMAScript Number and JSON.stringify.
+
+@pytest.mark.parametrize(
+    "number, expected",
+    [
+        (1.0, "1"),
+        (-0.0, "0"),
+        (100.0, "100"),
+        (1e20, "100000000000000000000"),
+        (1e21, "1e+21"),
+        (1e-7, "1e-7"),
+        (0.00001, "0.00001"),
+        (0.1 + 0.2, "0.30000000000000004"),
+        (123.456, "123.456"),
+        (5e-324, "5e-324"),
+        (1.7976931348623157e308, "1.7976931348623157e+308"),
+    ],
+)
+def test_js_number_format(number, expected):
+    assert js_number(number) == expected
+
+
+def test_keys_sort_in_utf16_code_unit_order():
+    # U+1F600 is a surrogate pair in UTF-16, so it sorts before U+FFFD.
+    value = {"￿": 1, "\U0001F600": 2, "a": 3, "B": 4}
+    assert canonical_bytes(value).decode("utf-8") == '{"B":4,"a":3,"\U0001F600":2,"￿":1}'
+
+
+def test_strings_escape_like_json_stringify():
+    value = {"s": "tab\tquote\"ctrl\u0001"}
+    assert canonical_bytes(value).decode("utf-8") == '{"s":"tab\\tquote\\"ctrl\\u0001"}'
+
+
+def test_lone_surrogate_is_escaped_not_emitted_raw():
+    value = json.loads('{"s": "\\ud800"}')
+    assert canonical_bytes(value) == b'{"s":"\\ud800"}'
+
+
+def test_integer_beyond_safe_range_is_rounded_as_javascript_does():
+    value = json.loads("123456789012345678901234")
+    assert canonical_bytes(value) == b"1.2345678901234569e+23"
+
+
+# Records generated at test time, signed with Ed25519 keys made here.
+
+@pytest.fixture
+def key():
+    return Ed25519PrivateKey.generate()
+
+
+def test_raw_signature_verifies(key):
+    trust = trust_map(trust_entry("main", key))
+    record = signed_record(key, "main", {"a": 1})
+    result = verify_execution_trust_record(record, trust)
+    assert result == {"valid": True, "coverage": "legacy", "errors": [], "checks": {"trustRecordHash": True, "signature": True}}
+
+
+def test_large_message_accepts_commitment_signature(key):
+    trust = trust_map(trust_entry("main", key))
+    body = {"items": ["x" * 200] * 40}
+    record = signed_record(key, "main", body, mode="commitment")
+    assert verify_execution_trust_record(record, trust)["valid"] is True
+
+
+def test_small_message_rejects_commitment_signature(key):
+    trust = trust_map(trust_entry("main", key))
+    record = signed_record(key, "main", {"a": 1}, mode="commitment")
+    result = verify_execution_trust_record(record, trust)
+    assert result["valid"] is False
+    assert result["checks"]["signature"] is False
+
+
+def test_tampered_signature_is_rejected(key):
+    trust = trust_map(trust_entry("main", key))
+    record = signed_record(key, "main", {"a": 1})
+    raw = bytearray(base64.b64decode(record["signature"]["signature"]))
+    raw[0] ^= 1
+    record["signature"]["signature"] = base64.b64encode(bytes(raw)).decode()
+    assert verify_execution_trust_record(record, trust)["valid"] is False
+
+
+def test_unknown_keyid_is_rejected(key):
+    trust = trust_map(trust_entry("main", key))
+    record = signed_record(key, "nobody", {"a": 1})
+    assert "no trusted key" in verify_execution_trust_record(record, trust)["errors"][0]
+
+
+def test_compromised_key_is_rejected(key):
+    trust = trust_map(trust_entry("main", key, compromised=True))
+    record = signed_record(key, "main", {"a": 1})
+    assert verify_execution_trust_record(record, trust)["valid"] is False
+
+
+def test_record_before_validity_window_is_rejected(key):
+    trust = trust_map(trust_entry("main", key, validFrom="2026-07-01T00:00:00.000Z"))
+    record = signed_record(key, "main", {"a": 1}, created="2026-06-01T00:00:00Z")
+    result = verify_execution_trust_record(record, trust)
+    assert result["valid"] is False
+    assert "outside the validity window" in result["errors"][0]
+
+
+def test_record_after_validity_end_is_rejected(key):
+    trust = trust_map(trust_entry("main", key, validUntil="2026-05-01T00:00:00.000Z"))
+    record = signed_record(key, "main", {"a": 1}, created="2026-06-01T00:00:00Z")
+    assert verify_execution_trust_record(record, trust)["valid"] is False
+
+
+def test_cutover_requires_hybrid_envelope_for_later_records(key):
+    trust = trust_map(trust_entry("main", key))
+    record = signed_record(key, "main", {"a": 1}, created="2026-06-01T12:00:00Z")
+    result = verify_execution_trust_record(record, trust, "2026-01-01T00:00:00.000Z")
+    assert result["valid"] is False
+    assert "hybridRequiredFrom" in result["errors"][-1]
+
+
+def test_cutover_does_not_apply_to_earlier_records(key):
+    trust = trust_map(trust_entry("main", key, validFrom="2024-01-01T00:00:00.000Z"))
+    record = signed_record(key, "main", {"a": 1}, created="2025-06-01T12:00:00Z")
+    assert verify_execution_trust_record(record, trust, "2026-01-01T00:00:00.000Z")["valid"] is True
+
+
+def test_fingerprint_mismatch_is_rejected(key):
+    entry = trust_entry("main", key)
+    entry["fingerprint"] = "sha256:" + "0" * 64
+    result = verify_execution_trust_record(signed_record(key, "main", {"a": 1}), trust_map(entry))
+    assert result["valid"] is False
+    assert "pinned fingerprint" in result["errors"][0]
+
+
+def test_non_object_record_is_rejected():
+    result = verify_execution_trust_record(["not", "an", "object"], {})
+    assert result == {"valid": False, "coverage": "legacy", "errors": ["record must be a JSON object"], "checks": {}}
+
+
+def test_key_fingerprint_matches_trust_entry(key):
+    entry = trust_entry("main", key)
+    assert key_fingerprint(entry["publicKeyPem"]) == entry["fingerprint"]
+
+
+# Trust set and timestamps.
+
+@pytest.mark.parametrize(
+    "document, message",
+    [
+        ({}, 'trust set must be an object with a "keys" array'),
+        ({"keys": [{"keyId": ""}]}, "keys[0].keyId must be a non-empty string"),
+        ({"keys": [{"keyId": "a", "algorithm": "rsa"}]}, "keys[0].algorithm must be one of ed25519, dilithium3"),
+        ({"keys": [], "hybridRequiredFrom": "2026-01-01T00:00:00"}, 'hybridRequiredFrom must be an ISO-8601 UTC timestamp ending in "Z"'),
+    ],
+)
+def test_malformed_trust_set_is_rejected(document, message):
+    with pytest.raises(ValueError, match=re.escape(message)):
+        parse_trust_policy(document)
+
+
+def test_timestamp_forms():
+    assert parse_timestamp("2026-01-01T00:00:00.000Z").isoformat() == "2026-01-01T00:00:00+00:00"
+    assert parse_timestamp("2026-01-01T02:00:00+02:00").isoformat() == "2026-01-01T00:00:00+00:00"
+    assert parse_timestamp("2026-01-01").isoformat() == "2026-01-01T00:00:00+00:00"
+    # Fractions beyond microseconds are truncated, as V8's Date.parse accepts them.
+    assert parse_timestamp("2026-01-01T00:00:00.1234567Z").microsecond == 123456
+    assert parse_timestamp("2026-01-01T00:00:00") is None
+    assert parse_timestamp("2026-13-01T00:00:00Z") is None
+
+
+# Command line.
+
+def run_cli(*args):
+    return subprocess.run([sys.executable, "-m", "parmana_verifier", *args], capture_output=True, text=True,
+                          cwd=Path(__file__).resolve().parents[1])
+
+
+def test_cli_exit_codes(tmp_path, key):
+    trust_path = tmp_path / "trust.json"
+    trust_path.write_text(json.dumps({"keys": [trust_entry("main", key)]}))
+    good = tmp_path / "good.json"
+    good.write_text(json.dumps(signed_record(key, "main", {"a": 1})))
+    bad = tmp_path / "bad.json"
+    bad.write_text(json.dumps(load("record-tampered-amount.json")))
+
+    assert run_cli(str(good), str(trust_path)).returncode == 0
+    assert run_cli(str(bad), str(trust_path)).returncode == 1
+    assert run_cli(str(good)).returncode == 2
+    assert run_cli(str(tmp_path / "missing.json"), str(trust_path)).returncode == 2
+
+
+def test_cli_prints_one_json_line(tmp_path, key):
+    trust_path = tmp_path / "trust.json"
+    trust_path.write_text(json.dumps({"keys": [trust_entry("main", key)]}))
+    good = tmp_path / "good.json"
+    good.write_text(json.dumps(signed_record(key, "main", {"a": 1})))
+    output = run_cli(str(good), str(trust_path)).stdout
+    assert json.loads(output) == {"valid": True, "coverage": "legacy", "errors": [], "checks": {"trustRecordHash": True, "signature": True}}
+    assert output.count("\n") == 1