pensenova-verify 1.0.0__tar.gz

pensenova_verify-1.0.0/NOTICE

@@ -0,0 +1,6 @@
+pensenova-verify
+Copyright 2026 Pensenova
+
+Licensed under the Apache License, Version 2.0.
+"Pensenova", "Safety Spine"/"Espinha" and the Pensenova conformity seals are
+trademarks of Pensenova; this license covers the code, not the marks.

pensenova_verify-1.0.0/PKG-INFO

@@ -0,0 +1,40 @@
+Metadata-Version: 2.4
+Name: pensenova-verify
+Version: 1.0.0
+Summary: Independent, local verification of Pensenova conformity seals (Ed25519).
+Author-email: Pensenova <partners@pensenova.com>
+Project-URL: Homepage, https://safety.pensenova.com
+Keywords: robotics,safety,compliance,certification,ed25519,verification
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Operating System :: OS Independent
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: NOTICE
+Requires-Dist: cryptography>=42.0
+Dynamic: license-file
+
+# pensenova-verify
+
+Verificação local e independente de selos de conformidade Pensenova.
+Confere a assinatura Ed25519 usando apenas a chave pública publicada — sem
+depender de nenhum servidor da Pensenova.
+
+## Instalação
+    pip install pensenova-verify
+
+## Uso (Python)
+    from pensenova_verify import verify_seal, fetch_jwks
+    ok, motivo = verify_seal(seal, fetch_jwks())
+
+## Uso (linha de comando)
+    pensenova-verify selo.json
+
+Verificar != certificar: qualquer um verifica; só a Pensenova emite selos
+válidos. Licença Apache-2.0. Contato: partners@pensenova.com

pensenova_verify-1.0.0/README.md

@@ -0,0 +1,18 @@
+# pensenova-verify
+
+Verificação local e independente de selos de conformidade Pensenova.
+Confere a assinatura Ed25519 usando apenas a chave pública publicada — sem
+depender de nenhum servidor da Pensenova.
+
+## Instalação
+    pip install pensenova-verify
+
+## Uso (Python)
+    from pensenova_verify import verify_seal, fetch_jwks
+    ok, motivo = verify_seal(seal, fetch_jwks())
+
+## Uso (linha de comando)
+    pensenova-verify selo.json
+
+Verificar != certificar: qualquer um verifica; só a Pensenova emite selos
+válidos. Licença Apache-2.0. Contato: partners@pensenova.com

pensenova_verify-1.0.0/pensenova_verify/__init__.py

@@ -0,0 +1,46 @@
+"""pensenova-verify — verificação local e independente de selos Pensenova."""
+from __future__ import annotations
+import base64, json
+from urllib.request import urlopen
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+from cryptography.exceptions import InvalidSignature
+
+__version__ = "1.0.0"
+__all__ = ["verify_seal", "canonical", "fetch_jwks", "DEFAULT_JWKS_URL", "SEAL_VERSION"]
+SEAL_VERSION = "pensenova-seal/1"
+DEFAULT_JWKS_URL = "https://safety.pensenova.com/.well-known/pensenova-jwks.json"
+
+def canonical(obj) -> str:
+    if obj is None or not isinstance(obj, (dict, list)):
+        return json.dumps(obj, ensure_ascii=False)
+    if isinstance(obj, list):
+        return "[" + ",".join(canonical(v) for v in obj) + "]"
+    keys = sorted(obj.keys())
+    return "{" + ",".join(json.dumps(k, ensure_ascii=False) + ":" + canonical(obj[k]) for k in keys) + "}"
+
+def _b64url_to_bytes(s): return base64.urlsafe_b64decode(s + "=" * (-len(s) % 4))
+def _b64_to_bytes(s): return base64.b64decode(s)
+
+def fetch_jwks(url: str = DEFAULT_JWKS_URL, *, timeout: float = 15) -> dict:
+    with urlopen(url, timeout=timeout) as r:
+        return json.loads(r.read().decode("utf-8"))
+
+
+def verify_seal(seal, jwks=None):
+    if jwks is None: jwks = fetch_jwks()
+    if seal.get("seal_version") != SEAL_VERSION:
+        return False, f"seal_version desconhecido: {seal.get('seal_version')!r}"
+    fp = seal.get("authority_fingerprint"); sig_b64 = seal.get("signature"); payload = seal.get("payload")
+    if not fp or not sig_b64 or payload is None:
+        return False, "selo incompleto (falta fingerprint, signature ou payload)"
+    jwk = next((k for k in jwks.get("keys", []) if k.get("kid") == fp), None)
+    if jwk is None:
+        return False, f"nenhuma chave publica com kid={fp!r} no JWKS"
+    try:
+        pub = Ed25519PublicKey.from_public_bytes(_b64url_to_bytes(jwk["x"]))
+        pub.verify(_b64_to_bytes(sig_b64), canonical(payload).encode("utf-8"))
+    except InvalidSignature:
+        return False, "assinatura invalida (selo adulterado ou chave errada)"
+    except Exception as e:
+        return False, f"erro ao verificar: {e}"
+    return True, "valido"

pensenova_verify-1.0.0/pensenova_verify/__main__.py

@@ -0,0 +1,2 @@
+from .cli import main
+main()

pensenova_verify-1.0.0/pensenova_verify/cli.py

@@ -0,0 +1,13 @@
+import argparse, json, sys
+from . import verify_seal, fetch_jwks, DEFAULT_JWKS_URL, __version__
+def main() -> None:
+    ap = argparse.ArgumentParser(prog="pensenova-verify",
+        description="Verifica um selo de conformidade Pensenova (Ed25519), localmente.")
+    ap.add_argument("seal", nargs="?", default="-", help="arquivo JSON do selo (ou '-' para stdin)")
+    ap.add_argument("--jwks", default=DEFAULT_JWKS_URL, help="URL do JWKS")
+    ap.add_argument("--version", action="version", version=f"pensenova-verify {__version__}")
+    a = ap.parse_args()
+    data = sys.stdin.read() if a.seal == "-" else open(a.seal, encoding="utf-8").read()
+    ok, why = verify_seal(json.loads(data), fetch_jwks(a.jwks))
+    print(("VÁLIDO" if ok else "INVÁLIDO") + f" — {why}")
+    sys.exit(0 if ok else 1)

pensenova_verify-1.0.0/pensenova_verify.egg-info/PKG-INFO

@@ -0,0 +1,40 @@
+Metadata-Version: 2.4
+Name: pensenova-verify
+Version: 1.0.0
+Summary: Independent, local verification of Pensenova conformity seals (Ed25519).
+Author-email: Pensenova <partners@pensenova.com>
+Project-URL: Homepage, https://safety.pensenova.com
+Keywords: robotics,safety,compliance,certification,ed25519,verification
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Operating System :: OS Independent
+Classifier: Topic :: Security :: Cryptography
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: NOTICE
+Requires-Dist: cryptography>=42.0
+Dynamic: license-file
+
+# pensenova-verify
+
+Verificação local e independente de selos de conformidade Pensenova.
+Confere a assinatura Ed25519 usando apenas a chave pública publicada — sem
+depender de nenhum servidor da Pensenova.
+
+## Instalação
+    pip install pensenova-verify
+
+## Uso (Python)
+    from pensenova_verify import verify_seal, fetch_jwks
+    ok, motivo = verify_seal(seal, fetch_jwks())
+
+## Uso (linha de comando)
+    pensenova-verify selo.json
+
+Verificar != certificar: qualquer um verifica; só a Pensenova emite selos
+válidos. Licença Apache-2.0. Contato: partners@pensenova.com

pensenova_verify-1.0.0/pensenova_verify.egg-info/SOURCES.txt

@@ -0,0 +1,12 @@
+NOTICE
+README.md
+pyproject.toml
+pensenova_verify/__init__.py
+pensenova_verify/__main__.py
+pensenova_verify/cli.py
+pensenova_verify.egg-info/PKG-INFO
+pensenova_verify.egg-info/SOURCES.txt
+pensenova_verify.egg-info/dependency_links.txt
+pensenova_verify.egg-info/entry_points.txt
+pensenova_verify.egg-info/requires.txt
+pensenova_verify.egg-info/top_level.txt

pensenova_verify-1.0.0/pensenova_verify.egg-info/dependency_links.txt

@@ -0,0 +1 @@
+

pensenova_verify-1.0.0/pensenova_verify.egg-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+pensenova-verify = pensenova_verify.cli:main

pensenova_verify-1.0.0/pensenova_verify.egg-info/requires.txt

@@ -0,0 +1 @@
+cryptography>=42.0

pensenova_verify-1.0.0/pensenova_verify.egg-info/top_level.txt

@@ -0,0 +1 @@
+pensenova_verify

pensenova_verify-1.0.0/pyproject.toml

@@ -0,0 +1,38 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "pensenova-verify"
+dynamic = ["version"]
+description = "Independent, local verification of Pensenova conformity seals (Ed25519)."
+readme = "README.md"
+requires-python = ">=3.10"
+license = { file = "LICENSE" }
+authors = [{ name = "Pensenova", email = "partners@pensenova.com" }]
+keywords = ["robotics", "safety", "compliance", "certification", "ed25519", "verification"]
+classifiers = [
+  "Development Status :: 5 - Production/Stable",
+  "Intended Audience :: Developers",
+  "License :: OSI Approved :: Apache Software License",
+  "Programming Language :: Python :: 3",
+  "Programming Language :: Python :: 3.10",
+  "Programming Language :: Python :: 3.11",
+  "Programming Language :: Python :: 3.12",
+  "Operating System :: OS Independent",
+  "Topic :: Security :: Cryptography",
+]
+dependencies = ["cryptography>=42.0"]
+
+[project.scripts]
+pensenova-verify = "pensenova_verify.cli:main"
+
+[project.urls]
+Homepage = "https://safety.pensenova.com"
+
+[tool.setuptools.dynamic]
+version = { attr = "pensenova_verify.__version__" }
+
+[tool.setuptools.packages.find]
+where = ["."]
+include = ["pensenova_verify*"]

pensenova_verify-1.0.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+