riggrade 0.1.0__py3-none-any.whl

pricewatch/__init__.py

@@ -0,0 +1,3 @@
+"""Daily listed-price recorder for the RigGrade GPU index (docs/index-method.md)."""
+
+METHOD_VERSION = "v0-draft"

pricewatch/aggregate.py

@@ -0,0 +1,90 @@
+"""Pure aggregation for the listed-price series (method sections 3 and 5).
+
+Input is a list of normalised offers:
+    {"gpu_name": str, "gpu_memory_gb": float, "num_gpus": int,
+     "total_price_per_hour": float, "verified": bool or None}
+No identifiers enter this module, so none can reach the output.
+"""
+
+from riggrade.classes import PEER_CLASSES, identify
+
+MIN_OFFERS = 10
+
+
+def weighted_percentile(pairs, q):
+    """pairs: (value, weight). Percentile q in [0, 1], weight-aware: the
+    smallest value whose cumulative weight reaches q of the total."""
+    pairs = sorted((v, w) for v, w in pairs if w > 0)
+    if not pairs:
+        return None
+    total = sum(w for _v, w in pairs)
+    acc = 0.0
+    for value, weight in pairs:
+        acc += weight
+        if acc >= q * total - 1e-12:
+            return value
+    return pairs[-1][0]
+
+
+def _summary(pairs, verified_gpus=None, known_gpus=None):
+    gpus = sum(w for _v, w in pairs)
+    out = {"offers": len(pairs), "gpus": gpus}
+    if len(pairs) < MIN_OFFERS:
+        out["status"] = "insufficient"
+        return out
+    out["status"] = "ok"
+    out.update({"p25": round(weighted_percentile(pairs, 0.25), 4),
+                "median": round(weighted_percentile(pairs, 0.50), 4),
+                "p75": round(weighted_percentile(pairs, 0.75), 4)})
+    if known_gpus:
+        out["verified_share"] = round(verified_gpus / known_gpus, 3)
+    return out
+
+
+def by_class(offers):
+    """One source's snapshot -> {class_id: summary}, plus unmatched count."""
+    pairs, verified, known, unmatched = {}, {}, {}, 0
+    for o in offers:
+        n = int(o.get("num_gpus") or 0)
+        price = o.get("total_price_per_hour")
+        if n <= 0 or price is None or price <= 0:
+            unmatched += 1
+            continue
+        cls = identify(o.get("gpu_name"), o.get("gpu_memory_gb"))
+        if cls is None:
+            unmatched += 1
+            continue
+        pairs.setdefault(cls, []).append((price / n, n))
+        if o.get("verified") is not None:
+            known[cls] = known.get(cls, 0) + n
+            verified[cls] = verified.get(cls, 0) + (n if o["verified"] else 0)
+    classes = {c: _summary(p, verified.get(c), known.get(c)) for c, p in pairs.items()}
+    return {"classes": classes, "unmatched_offers": unmatched}, pairs
+
+
+def combined(per_source_pairs, per_source_summary):
+    """Method 3: median across sources that met the minimum sample, per class."""
+    pooled = {}
+    for source, pairs in per_source_pairs.items():
+        for cls, items in pairs.items():
+            if per_source_summary[source]["classes"][cls]["status"] == "ok":
+                pooled.setdefault(cls, []).extend(items)
+    out = {}
+    for cls in PEER_CLASSES:
+        items = pooled.get(cls, [])
+        out[cls] = ({"status": "ok", "gpus": sum(w for _v, w in items),
+                     "median": round(weighted_percentile(items, 0.5), 4)}
+                    if items else {"status": "missing"})
+    return out
+
+
+def performance_adjusted(median_price_per_gpu_hour, throughputs_per_second, min_rigs=5):
+    """Method 5: price per million units of measured work (for inference,
+    tokens). `throughputs_per_second` is one first-session value per graded
+    rig. Returns None until `min_rigs` rigs exist."""
+    vals = sorted(throughputs_per_second)
+    if median_price_per_gpu_hour is None or len(vals) < min_rigs:
+        return None
+    mid = len(vals) // 2
+    med = vals[mid] if len(vals) % 2 else (vals[mid - 1] + vals[mid]) / 2
+    return round(median_price_per_gpu_hour / (med * 3600) * 1e6, 4)

pricewatch/reconstructed.py

@@ -0,0 +1,210 @@
+"""Reconstructed listed-price series from third-party records
+(docs/index-reconstructed-method.md). v0: GetDeploying's CC BY 4.0 weekly
+dataset files, mapped to the v0 peer classes through the published table
+below. Each source stays separate; weekly figures stay weekly; history is
+append-only (a changed past value becomes a correction beside the original).
+
+    python3 -m pricewatch.reconstructed --out riggrade/index/reconstructed-getdeploying.json
+    python3 -m pricewatch.reconstructed --payload weekly.json --out ... --now 2026-11-01T00:00:00Z
+"""
+
+import argparse
+import datetime as dt
+import hashlib
+import json
+import sys
+import urllib.request
+from pathlib import Path
+
+METHOD_VERSION = "reconstructed-v0-draft"
+
+SOURCE = {
+    "name": "getdeploying",
+    "title": "GetDeploying GPU price history (weekly)",
+    "url": "https://getdeploying.com/dataset/gpu-prices/weekly.json",
+    "home": "https://getdeploying.com/gpus",
+    "licence": "CC BY 4.0",
+    "licence_url": "https://creativecommons.org/licenses/by/4.0/",
+    "attribution": "GetDeploying, https://getdeploying.com/gpus, CC BY 4.0. Figures changed: "
+                   "mapped to RigGrade peer classes and re-published per class; on-demand "
+                   "billing rows only; the source's own medians, not re-aggregated.",
+    "basis": "median_price and provider_median_price as the source states them per week "
+             "(USD per GPU per hour, on-demand). Weekly stays weekly.",
+}
+
+BILLING = "ON_DEMAND"
+
+# The published mapping table (method section 3). A source name that could
+# fit two v0 classes maps to neither: the source's "nvidia-h100" carries no
+# form (SXM or PCIe) and "nvidia-a100" no memory size, so both are dropped
+# and counted. Only unambiguous names map.
+MAPPING = {
+    "nvidia-h200": "h200-sxm-141",
+    "nvidia-l40s": "l40s-48",
+    "nvidia-rtx-5090": "rtx5090-32",
+    "nvidia-rtx-4090": "rtx4090-24",
+    "nvidia-rtx-3090": "rtx3090-24",
+}
+AMBIGUOUS = {"nvidia-h100": "form not stated: could be h100-sxm-80 or h100-pcie-80",
+             "nvidia-a100": "memory not stated: could be a100-sxm-80, a100-pcie-80 or a100-pcie-40"}
+
+# Amendment A1 (method text accepted in review on 2026-11-01; 14 days' notice):
+# a chip-family series for the two ambiguous names, in its own namespace,
+# never a peer class, alongside and never spliced. Published only from the
+# date the notice ends. Section 3 is unchanged: the names stay dropped and
+# counted in the peer-class series whether or not A1 publishes.
+A1_NOTICE_ENDS = "2026-11-15"
+A1_METHOD_VERSION = "reconstructed-v0-draft-A1"
+CHIP_FAMILY = {"nvidia-h100": "chip:h100", "nvidia-a100": "chip:a100"}
+CHIP_FAMILY_LABEL = "chip family (form and memory not stated by the source)"
+CHIP_FAMILY_MIXES = {
+    "chip:h100": "The source does not state the form (SXM or PCIe); this figure mixes h100-sxm-80 "
+                 "and h100-pcie-80 in whatever shares the source's offerings had that week.",
+    "chip:a100": "The source does not state the form or the memory size; this figure mixes "
+                 "a100-sxm-80, a100-pcie-80 and a100-pcie-40 in whatever shares the source's "
+                 "offerings had that week.",
+}
+CHIP_FAMILY_RULE = ("Never a peer class, never spliced into one, never used for a grade, a bar, "
+                    "a reference, a consistency rule or a performance-adjusted price.")
+
+
+def a1_published(now):
+    """True once the notice period has ended, judged on the import date."""
+    return str(now)[:10] >= A1_NOTICE_ENDS
+
+FIELDS = ("median_price", "provider_median_price", "min_price", "max_price",
+          "provider_count", "offering_count")
+
+
+class SchemaError(ValueError):
+    pass
+
+
+def fetch(url=SOURCE["url"], opener=urllib.request.urlopen, timeout=120):
+    req = urllib.request.Request(url, headers={"User-Agent": "riggrade-pricewatch"})
+    with opener(req, timeout=timeout) as resp:
+        return resp.read()
+
+
+def parse(raw):
+    """The dataset file -> (meta, rows); loud on any shape surprise."""
+    try:
+        doc = json.loads(raw.decode("utf-8"))
+    except (UnicodeDecodeError, ValueError) as exc:
+        raise SchemaError("getdeploying: not JSON: %s" % exc)
+    if not isinstance(doc, dict) or not isinstance(doc.get("data"), list):
+        raise SchemaError("getdeploying: expected {meta, data[]}")
+    meta = doc.get("meta") or {}
+    if "CC-BY" not in str(meta.get("license", "")).upper().replace(" ", "-"):
+        raise SchemaError("getdeploying: licence field is not CC BY: %r" % meta.get("license"))
+    for row in doc["data"]:
+        for key in ("gpu_slug", "date", "billing_type") + FIELDS:
+            if key not in row:
+                raise SchemaError("getdeploying: row missing %r" % key)
+    return meta, doc["data"]
+
+
+def _week_value(row):
+    return {k: row[k] for k in FIELDS}
+
+
+def _merge_append_only(series, previous, corrections, now, kind):
+    """Carry every recorded week forward; a changed value becomes a
+    correction beside the original; a missing week stays recorded."""
+    for key, old in (previous or {}).items():
+        new = series.setdefault(key, {"source_name": old.get("source_name"), "weeks": {}})
+        for week, old_value in (old.get("weeks") or {}).items():
+            new_value = new["weeks"].get(week)
+            if new_value is None:
+                new["weeks"][week] = old_value          # a gap in the new file stays as recorded
+            elif new_value != old_value:
+                corrections.append({kind: key, "week": week, "recorded": old_value,
+                                    "source_now_states": new_value, "noticed_at": now})
+                new["weeks"][week] = old_value          # history is never rewritten
+    for c in series.values():
+        c["weeks"] = dict(sorted(c["weeks"].items()))
+        c["latest_week"] = max(c["weeks"]) if c["weeks"] else None
+
+
+def build(raw, existing=None, now=None):
+    """The series document. `existing` is the previous document, so past
+    weeks are never rewritten: a changed value is appended as a correction
+    and the original stays."""
+    now = now or dt.datetime.now(dt.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+    meta, rows = parse(raw)
+    classes = {cid: {"source_name": slug, "weeks": {}} for slug, cid in MAPPING.items()}
+    publish_a1 = a1_published(now)
+    families = ({fid: {"source_name": slug, "label": CHIP_FAMILY_LABEL, "mixes": CHIP_FAMILY_MIXES[fid],
+                       "rule": CHIP_FAMILY_RULE, "weeks": {}} for slug, fid in CHIP_FAMILY.items()}
+                if publish_a1 else {})
+    dropped = {}
+    for row in rows:
+        if row["billing_type"] != BILLING:
+            continue
+        slug = row["gpu_slug"]
+        cid = MAPPING.get(slug)
+        if cid is None:
+            dropped[slug] = dropped.get(slug, 0) + 1   # section 3: ambiguous names stay dropped and counted
+            fid = CHIP_FAMILY.get(slug)
+            if fid and publish_a1:
+                families[fid]["weeks"][row["date"]] = _week_value(row)
+            continue
+        classes[cid]["weeks"][row["date"]] = _week_value(row)
+    corrections = list((existing or {}).get("corrections") or [])
+    _merge_append_only(classes, (existing or {}).get("classes"), corrections, now, "class")
+    if publish_a1:
+        _merge_append_only(families, (existing or {}).get("chip_families"), corrections, now, "chip_family")
+    imports = list((existing or {}).get("imports") or [])
+    imports.append({"retrieved_at": now, "url": SOURCE["url"], "bytes": len(raw),
+                    "sha256": hashlib.sha256(raw).hexdigest(),
+                    "source_latest_week": meta.get("latest_week"),
+                    "source_last_snapshot": meta.get("last_snapshot")})
+    return {"series": "reconstructed", "method": A1_METHOD_VERSION if publish_a1 else METHOD_VERSION,
+            "a1_notice_ends": A1_NOTICE_ENDS, "chip_families": families,
+            "method_url": "https://github.com/nnyycc77-ship-it/riggrade/blob/main/docs/index-reconstructed-method.md",
+            "note": "Information, not an offer, a rate or advice. Listed prices as a third party "
+                    "recorded them, mapped to peer classes; never joined to the live series.",
+            "source": dict(SOURCE, disclaimer=meta.get("disclaimer")),
+            "billing": BILLING, "mapping": MAPPING, "ambiguous_dropped": AMBIGUOUS,
+            "dropped_rows_by_source_name": dict(sorted(dropped.items())),
+            "classes": classes, "corrections": corrections, "imports": imports}
+
+
+def to_csv(doc):
+    header = ("class,source_name,week,median_price,provider_median_price,min_price,max_price,"
+              "provider_count,offering_count,licence,attribution")
+    lines = [header]
+    rows = sorted(doc["classes"].items()) + sorted((doc.get("chip_families") or {}).items())
+    for cid, c in rows:
+        for week, v in c["weeks"].items():
+            lines.append(",".join(str(x) for x in (
+                cid, c["source_name"], week, v["median_price"], v["provider_median_price"],
+                v["min_price"], v["max_price"], v["provider_count"], v["offering_count"],
+                doc["source"]["licence"], '"' + doc["source"]["home"] + '"')))
+    return "\n".join(lines) + "\n"
+
+
+def main(argv=None):
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--out", required=True)
+    ap.add_argument("--csv", default="")
+    ap.add_argument("--payload", default="", help="a downloaded weekly.json instead of fetching")
+    ap.add_argument("--now", default="")
+    a = ap.parse_args(argv)
+    raw = Path(a.payload).read_bytes() if a.payload else fetch()
+    out = Path(a.out)
+    existing = json.loads(out.read_text(encoding="utf-8")) if out.exists() else None
+    doc = build(raw, existing, a.now or None)
+    out.parent.mkdir(parents=True, exist_ok=True)
+    out.write_text(json.dumps(doc, indent=1, sort_keys=True) + "\n", encoding="utf-8")
+    if a.csv:
+        Path(a.csv).write_text(to_csv(doc), encoding="utf-8")
+    mapped = sum(len(c["weeks"]) for c in doc["classes"].values())
+    sys.stdout.write("reconstructed: %d class-weeks across %d classes; %d corrections; latest %s\n" % (
+        mapped, len(doc["classes"]), len(doc["corrections"]),
+        max((c["latest_week"] or "") for c in doc["classes"].values())))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

pricewatch/record.py

@@ -0,0 +1,63 @@
+"""Take one daily snapshot and append it to a hash-chained JSONL file.
+
+    python3 -m pricewatch.record --out data/index/listed-prices.jsonl [--source vast]
+
+Only aggregates are written. A source that fails is recorded as failed for
+that day, never filled in. The file is append-only; an edit or removal
+breaks the chain (riggrade.salelog.read_chain checks it).
+"""
+
+import argparse
+import datetime as dt
+import sys
+
+from riggrade import salelog
+from . import METHOD_VERSION, aggregate, sources
+
+
+def snapshot(source_objs, now=None):
+    now = now or dt.datetime.now(dt.timezone.utc)
+    per_summary, per_pairs, failed = {}, {}, {}
+    for src in source_objs:
+        if getattr(src, "terms_ok", True) is not True:
+            # Method section 2: no run rests on a source whose terms do not allow it.
+            failed[src.name] = "refused: " + getattr(src, "terms_note", "terms not verified")
+            continue
+        try:
+            summary, pairs = aggregate.by_class(src.offers())
+        except Exception as exc:  # noqa: BLE001 - recorded, not hidden
+            failed[src.name] = "%s: %s" % (type(exc).__name__, str(exc)[:200])
+            continue
+        per_summary[src.name], per_pairs[src.name] = summary, pairs
+    return {"date": now.strftime("%Y-%m-%d"),
+            "taken_at": now.strftime("%Y-%m-%dT%H:%M:%SZ"),
+            "method": METHOD_VERSION,
+            "sources": per_summary,
+            "failed_sources": failed,
+            "combined": aggregate.combined(per_pairs, per_summary)}
+
+
+def record(path, source_objs, now=None):
+    snap = snapshot(source_objs, now)
+    existing = salelog.read_chain(path)  # raises if the chain is broken
+    if any(r.get("date") == snap["date"] for r in existing):
+        raise SystemExit("a snapshot for %s is already recorded" % snap["date"])
+    salelog.append(path, snap)
+    return snap
+
+
+def main(argv=None):
+    ap = argparse.ArgumentParser(description="RigGrade index: daily listed-price snapshot")
+    ap.add_argument("--out", required=True)
+    ap.add_argument("--source", action="append", choices=sorted(sources.SOURCES))
+    args = ap.parse_args(argv)
+    snap = record(args.out, [sources.SOURCES[s]() for s in (args.source or sorted(sources.SOURCES))])
+    ok = {s: sum(c["status"] == "ok" for c in v["classes"].values())
+          for s, v in snap["sources"].items()}
+    print("recorded %s: classes ok per source %s; failed %s"
+          % (snap["date"], ok, snap["failed_sources"] or "none"))
+    return 1 if snap["failed_sources"] and not snap["sources"] else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

pricewatch/sources.py

@@ -0,0 +1,72 @@
+"""Source adapters. Each turns one source's public listings into normalised
+offers (see aggregate.py) and drops every identifier.
+
+An adapter checks the fields it relies on and raises SchemaError when they
+are missing, so a format change stops the run loudly instead of producing a
+quiet wrong number (method section 6: gaps stay gaps).
+"""
+
+import json
+import urllib.request
+
+
+class SchemaError(ValueError):
+    pass
+
+
+def _get_json(url, opener=urllib.request.urlopen, timeout=60):
+    req = urllib.request.Request(url, headers={"User-Agent": "riggrade-pricewatch",
+                                               "Accept": "application/json"})
+    with opener(req, timeout=timeout) as resp:
+        return json.loads(resp.read().decode("utf-8"))
+
+
+class VastOffers:
+    """Vast.ai on-demand offers.
+
+    TERMS DO NOT PERMIT USE (checked 1 Nov 2026). Vast's terms forbid using
+    its data or services "to construct, publish, or maintain any index,
+    benchmark, pricing-comparison service, market-data product" without a
+    separate written agreement, and its public pricing feed says index use
+    "requires a data license". So `terms_ok` is False and the recorder
+    refuses this source. Kept only so a future written licence needs no new
+    code; the field names below are still unverified.
+    """
+
+    name = "vast"
+    terms_ok = False
+    terms_note = ("Vast terms (checked 2026-11-01) forbid index or market-data use "
+                  "without a written agreement")
+    URL = ("https://console.vast.ai/api/v0/bundles/?q=" +
+           urllib.request.quote(json.dumps({"rentable": {"eq": True},
+                                            "rented": {"eq": False},
+                                            "type": "on-demand",
+                                            "limit": 5000})))
+    REQUIRED = ("gpu_name", "num_gpus", "gpu_ram", "dph_total")
+
+    def __init__(self, fetch=None):
+        self.fetch = fetch or (lambda: _get_json(self.URL))
+
+    def normalise(self, payload):
+        offers = payload.get("offers") if isinstance(payload, dict) else None
+        if not isinstance(offers, list):
+            raise SchemaError("vast: no 'offers' list in response")
+        out = []
+        for o in offers:
+            missing = [k for k in self.REQUIRED if k not in o]
+            if missing:
+                raise SchemaError("vast: offer missing fields %s" % missing)
+            out.append({"gpu_name": o["gpu_name"],
+                        # gpu_ram is per GPU in MB in Vast's listings
+                        "gpu_memory_gb": (o["gpu_ram"] or 0) / 1024,
+                        "num_gpus": o["num_gpus"],
+                        "total_price_per_hour": o["dph_total"],
+                        "verified": (o["verification"] == "verified")
+                        if "verification" in o else o.get("verified")})
+        return out
+
+    def offers(self):
+        return self.normalise(self.fetch())
+
+
+SOURCES = {"vast": VastOffers}

riggrade/__init__.py

@@ -0,0 +1,3 @@
+"""RigGrade: independent GPU rig grading. See docs/grading-spec.md."""
+
+BENCH_VERSION = "v0.1"

riggrade/acceptance.py

@@ -0,0 +1,99 @@
+"""Paid cluster acceptance certificate (decided 1 Nov 2026).
+
+The renter runs runner.cluster on the rented nodes and submits the
+evidence pack it wrote (acceptance.json). The server recomputes every
+check and the verdict from the claims and node reports with the same
+rules, refuses a pack that does not recompute, and on payment issues a
+signed certificate it also stores, so anyone with the id can fetch and
+verify it. Measured, not promised: the certificate states what the
+cluster delivered during that test against what its provider claimed.
+"""
+
+import hashlib
+import hmac
+import json
+
+from . import cluster_rules, signing
+
+PRODUCT = "riggrade_cluster_acceptance"
+STATEMENT = ("Measured, not promised. What this cluster delivered during the named test, "
+             "against what its provider claimed; no promise about future delivery.")
+
+
+def canonical(obj):
+    return json.dumps(obj, sort_keys=True, separators=(",", ":")).encode()
+
+
+def validate(pack):
+    """Returns the error text for a malformed pack, else None."""
+    if not isinstance(pack, dict):
+        return "evidence_pack must be the acceptance.json object"
+    if not isinstance(pack.get("claims"), dict):
+        return "evidence_pack.claims must be an object"
+    nodes = pack.get("nodes")
+    if not isinstance(nodes, list) or not nodes or not all(isinstance(n, dict) for n in nodes):
+        return "evidence_pack.nodes must be a non-empty list of node reports"
+    if not isinstance(pack.get("checks"), list) or not isinstance(pack.get("verdict"), str):
+        return "evidence_pack must carry the checks and verdict the evaluate step wrote"
+    return None
+
+
+def recompute(pack):
+    """(checks, result) from the pack's claims and nodes, by the shared rules."""
+    nodes = sorted(pack["nodes"], key=lambda n: n.get("rank", 0))
+    return cluster_rules.evaluate(pack["claims"], nodes)
+
+
+def certificate(pack, checks, result, secret, now, cert_id):
+    nodes = pack["nodes"]
+    cert = {"product": PRODUCT, "certificate_id": cert_id, "issued_at": now,
+            "method": pack.get("method"), "rules": cluster_rules.METHOD_VERSION,
+            "pack_sha256": hashlib.sha256(canonical(pack)).hexdigest(),
+            "claims": pack["claims"],
+            "images": sorted({n.get("image") or "unrecorded" for n in nodes}),
+            "nodes": len(nodes),
+            "checks": checks,
+            "verdict": result["verdict"], "exceptions": result["exceptions"],
+            "rejections": result["rejections"],
+            "statement": STATEMENT}
+    cert["signature"] = sign(cert, secret)
+    return cert
+
+
+SIGNATURE_FIELDS = ("signature", "ed25519")
+
+
+def body(cert):
+    """The signed content: every field but the signatures themselves."""
+    return {k: v for k, v in cert.items() if k not in SIGNATURE_FIELDS}
+
+
+def sign(cert, secret):
+    """The service's own check (HMAC); kept beside the Ed25519 signature."""
+    return hmac.new(secret, canonical(body(cert)), hashlib.sha256).hexdigest()
+
+
+def verify(cert, secret):
+    return hmac.compare_digest(sign(cert, secret), cert.get("signature", ""))
+
+
+def attach_ed25519(cert, signer):
+    """Independently verifiable signature with the published key; a no-op
+    without a signer (HMAC-only certificate). The certificate's keys_url
+    (set by the issuer before either signature) names the published key
+    set the signature is anchored to; both signatures cover it."""
+    if signer is None:
+        return cert
+    cert["ed25519"] = {"kid": signer.kid, "alg": signing.ALG, "public_key": signer.public_key_b64,
+                       "signature": signer.sign(canonical(body(cert))),
+                       "canonicalisation": signing.CANONICAL_RULE}
+    return cert
+
+
+def verify_ed25519(cert, public_key_b64=None):
+    """True, False, or None when the certificate carries no Ed25519 object."""
+    sig = cert.get("ed25519") if isinstance(cert, dict) else None
+    if not isinstance(sig, dict):
+        return None
+    return signing.verify(public_key_b64 or sig.get("public_key", ""), canonical(body(cert)),
+                          sig.get("signature", ""))