proofchain-cli 0.1.0__py3-none-any.whl

proofchain/cli.py

@@ -0,0 +1,163 @@
+#!/usr/bin/env python3
+"""
+proofchain.py — generic hash-chained, signed audit-proof CLI.
+
+Point it at ANY Postgres table of real events (trades, sales, burns,
+whatever) and get a tamper-evident, independently-verifiable proof log.
+Generalized from omega_revenue_proof.py — same mechanism, config-driven
+instead of hardcoded to one schema.
+
+Usage:
+  export PROOFCHAIN_DSN="postgresql://user@host:port/db"
+  export PROOFCHAIN_KEYFILE="/path/to/key.json"   # {"secret":[...]} or [...]
+
+  python3 proofchain.py build \
+      --table my_trades \
+      --id-col id \
+      --columns symbol,pnl_usdt,closed_at \
+      --where "status IN ('closed_profit','closed_stop') AND closed_at IS NOT NULL" \
+      --order-by closed_at \
+      --log ./my_proof.jsonl
+
+  python3 proofchain.py verify --log ./my_proof.jsonl
+
+No table/column names are hardcoded. Nothing here reads or writes
+omega_bank, omega_ledger, or any Omega-specific table unless you pass
+those names explicitly via --table.
+"""
+import os, sys, json, base64, argparse, hashlib
+from pathlib import Path
+from datetime import datetime, timezone
+
+import psycopg2
+from cryptography.hazmat.primitives.asymmetric.ed25519 import (
+    Ed25519PrivateKey, Ed25519PublicKey
+)
+from cryptography.exceptions import InvalidSignature
+
+
+def load_signer():
+    keyfile = os.environ.get("PROOFCHAIN_KEYFILE")
+    if not keyfile:
+        sys.exit("PROOFCHAIN_KEYFILE env var not set — no placeholder key will be used.")
+    data = json.loads(Path(keyfile).read_text())
+    raw = bytes(data["secret"][:32]) if isinstance(data, dict) else bytes(data[:32])
+    priv = Ed25519PrivateKey.from_private_bytes(raw)
+    pub = priv.public_key()
+    return priv, pub
+
+
+def build(args):
+    dsn = os.environ.get("PROOFCHAIN_DSN")
+    if not dsn:
+        sys.exit("PROOFCHAIN_DSN env var not set.")
+
+    priv, pub = load_signer()
+    cols = [c.strip() for c in args.columns.split(",")]
+    select_cols = ", ".join([args.id_col] + cols)
+
+    query = f"SELECT {select_cols} FROM {args.table}"
+    if args.where:
+        query += f" WHERE {args.where}"
+    if args.order_by:
+        query += f" ORDER BY {args.order_by} ASC"
+
+    conn = psycopg2.connect(dsn)
+    with conn.cursor() as cur:
+        cur.execute(query)
+        rows = cur.fetchall()
+    conn.close()
+
+    records = []
+    for row in rows:
+        rec = {"id": str(row[0])}
+        for i, col in enumerate(cols):
+            rec[col] = str(row[i + 1]) if row[i + 1] is not None else None
+        records.append(rec)
+
+    log_path = Path(args.log)
+    prev_hash = "genesis"
+    if log_path.exists() and log_path.stat().st_size > 0:
+        last_line = log_path.read_text().strip().splitlines()[-1]
+        prev_hash = json.loads(last_line)["entry_hash"]
+
+    snapshot = {
+        "type": "proofchain_snapshot",
+        "table": args.table,
+        "record_count": len(records),
+        "records": records,
+        "prev_hash": prev_hash,
+        "built_at": datetime.now(timezone.utc).isoformat(),
+    }
+    msg = json.dumps(snapshot, sort_keys=True, default=str).encode()
+    sig = base64.b64encode(priv.sign(msg)).decode()
+    entry_hash = hashlib.sha256(msg + sig.encode()).hexdigest()
+    snapshot["signature"] = sig
+    snapshot["entry_hash"] = entry_hash
+
+    with open(log_path, "a") as f:
+        f.write(json.dumps(snapshot, default=str) + "\n")
+
+    print(f"Snapshot written. {len(records)} record(s) from '{args.table}'. "
+          f"entry_hash={entry_hash[:16]}...")
+    print(f"Log: {log_path}")
+
+
+def verify(args):
+    priv, pub = load_signer()
+    log_path = Path(args.log)
+    if not log_path.exists():
+        print("No log yet.")
+        return
+
+    lines = log_path.read_text().strip().splitlines()
+    prev_hash = "genesis"
+    ok = True
+    for i, line in enumerate(lines):
+        record = json.loads(line)
+        sig = record.pop("signature")
+        claimed_hash = record.pop("entry_hash")
+        if record.get("prev_hash") != prev_hash:
+            print(f"  [BROKEN CHAIN] entry {i}: expected prev_hash={prev_hash}, "
+                  f"got {record.get('prev_hash')}")
+            ok = False
+        msg = json.dumps(record, sort_keys=True, default=str).encode()
+        try:
+            pub.verify(base64.b64decode(sig), msg)
+        except InvalidSignature:
+            print(f"  [BAD SIGNATURE] entry {i}")
+            ok = False
+        recomputed = hashlib.sha256(msg + sig.encode()).hexdigest()
+        if recomputed != claimed_hash:
+            print(f"  [HASH MISMATCH] entry {i}")
+            ok = False
+        prev_hash = claimed_hash
+
+    print("VERIFIED: chain intact, all signatures valid" if ok
+          else "FAILED: tampering or corruption detected")
+
+
+def main():
+    parser = argparse.ArgumentParser()
+    sub = parser.add_subparsers(dest="cmd", required=True)
+
+    b = sub.add_parser("build")
+    b.add_argument("--table", required=True)
+    b.add_argument("--id-col", default="id")
+    b.add_argument("--columns", required=True, help="comma-separated column list")
+    b.add_argument("--where", default="")
+    b.add_argument("--order-by", default="")
+    b.add_argument("--log", required=True)
+
+    v = sub.add_parser("verify")
+    v.add_argument("--log", required=True)
+
+    args = parser.parse_args()
+    if args.cmd == "build":
+        build(args)
+    elif args.cmd == "verify":
+        verify(args)
+
+
+if __name__ == "__main__":
+    main()

proofchain_cli-0.1.0.dist-info/METADATA

@@ -0,0 +1,7 @@
+Metadata-Version: 2.4
+Name: proofchain-cli
+Version: 0.1.0
+Summary: Hash-chained, signed, independently-verifiable audit proofs for any Postgres table of real events.
+Requires-Python: >=3.9
+Requires-Dist: psycopg2-binary
+Requires-Dist: cryptography

proofchain_cli-0.1.0.dist-info/RECORD

@@ -0,0 +1,7 @@
+proofchain/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
+proofchain/cli.py,sha256=DnrFwq6RbHW2nwxH-8--ce9B2L0LAl0Y_9hsONz_E9c,5380
+proofchain_cli-0.1.0.dist-info/METADATA,sha256=B6hXgtlt6duukl7VChp1VZxE2_Inkw7JEhhr6xTGAS4,248
+proofchain_cli-0.1.0.dist-info/WHEEL,sha256=K260EYznzXsJYBQGqmI8VTxEdiZYNvDZwW9cBh9-_MA,91
+proofchain_cli-0.1.0.dist-info/entry_points.txt,sha256=awpU-c-OPqffa2YPf7l2i2-tM8_tTZ0-LHrnNYUhTi8,51
+proofchain_cli-0.1.0.dist-info/top_level.txt,sha256=CjzV6DLfQpMhkPqBHT1JUhkCjammZ8yBSMzXHOcoxcw,11
+proofchain_cli-0.1.0.dist-info/RECORD,,

proofchain_cli-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (83.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

proofchain_cli-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+proofchain = proofchain.cli:main

proofchain_cli-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+proofchain