signedshot 0.1.2__tar.gz → 0.1.4__tar.gz

{signedshot-0.1.2 → signedshot-0.1.4}/Cargo.lock

@@ -1331,7 +1331,7 @@ dependencies = [
 
 [[package]]
 name = "signedshot-validator"
-version = "0.1.2"
+version = "0.1.4"
 dependencies = [
  "anyhow",
  "base64",

{signedshot-0.1.2 → signedshot-0.1.4}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "signedshot-validator"
-version = "0.1.2"
+version = "0.1.4"
 edition = "2021"
 description = "Validator for SignedShot media authenticity proofs"
 license = "MIT"

{signedshot-0.1.2 → signedshot-0.1.4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: signedshot
-Version: 0.1.2
+Version: 0.1.4
 Classifier: Development Status :: 4 - Beta
 Classifier: Intended Audience :: Developers
 Classifier: License :: OSI Approved :: MIT License

{signedshot-0.1.2 → signedshot-0.1.4}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "maturin"
 
 [project]
 name = "signedshot"
-version = "0.1.2"
+version = "0.1.4"
 description = "Validator for SignedShot media authenticity proofs"
 readme = "README.md"
 license = { text = "MIT" }

{signedshot-0.1.2 → signedshot-0.1.4}/python/signedshot/__init__.py

@@ -3,7 +3,8 @@ from signedshot.signedshot import (
     ValidationResult,
     validate,
     validate_files,
+    validate_with_jwks,
 )
 
-__all__ = ["ValidationResult", "validate", "validate_files"]
-__version__ = "0.1.0"
+__all__ = ["ValidationResult", "validate", "validate_files", "validate_with_jwks"]
+__version__ = "0.1.3"

{signedshot-0.1.2 → signedshot-0.1.4}/python/signedshot/__init__.pyi

@@ -82,6 +82,33 @@ def validate(sidecar_json: str, media_bytes: bytes) -> ValidationResult:
     """
     ...
 
+def validate_with_jwks(
+    sidecar_json: str, media_bytes: bytes, jwks_json: str
+) -> ValidationResult:
+    """Validate a SignedShot sidecar against media content using pre-loaded JWKS.
+
+    Use this when you already have the JWKS available locally, avoiding HTTP fetch.
+    This is useful for API services that want to validate using their own keys.
+
+    Args:
+        sidecar_json: The sidecar JSON as a string
+        media_bytes: The media file content as bytes
+        jwks_json: The JWKS JSON as a string (from /.well-known/jwks.json)
+
+    Returns:
+        ValidationResult with detailed information about the validation
+
+    Raises:
+        ValueError: If the sidecar or JWKS cannot be parsed
+
+    Example:
+        >>> jwks_json = '{"keys": [...]}'
+        >>> result = validate_with_jwks(sidecar_json, media_bytes, jwks_json)
+        >>> if result.valid:
+        ...     print(f"Publisher: {result.capture_trust['publisher_id']}")
+    """
+    ...
+
 def validate_files(sidecar_path: str, media_path: str) -> ValidationResult:
     """Validate a SignedShot sidecar from file paths.
 

{signedshot-0.1.2 → signedshot-0.1.4}/src/bin/signedshot.rs

@@ -151,6 +151,9 @@ fn validate_command(sidecar_path: &Path, media_path: &Path, json_output: bool) -
     println!("  Publisher ID: {}", result.capture_trust.publisher_id);
     println!("  Device ID:    {}", result.capture_trust.device_id);
     println!("  Method:       {}", result.capture_trust.method);
+    if let Some(ref app_id) = result.capture_trust.app_id {
+        println!("  App ID:       {}", app_id);
+    }
     println!("  Issued At:    {}", result.capture_trust.issued_at);
     println!("  Key ID:       {}", kid);
 

{signedshot-0.1.2 → signedshot-0.1.4}/src/jwt.rs

@@ -27,6 +27,16 @@ pub struct JwtHeader {
     pub kid: Option<String>,
 }
 
+/// Attestation information from the JWT
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct Attestation {
+    /// Attestation method (sandbox, app_check, app_attest)
+    pub method: String,
+    /// App ID from attestation (e.g., bundle ID), if available
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub app_id: Option<String>,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct CaptureTrustClaims {
     pub iss: String,
@@ -36,7 +46,7 @@ pub struct CaptureTrustClaims {
     pub capture_id: String,
     pub publisher_id: String,
     pub device_id: String,
-    pub method: String,
+    pub attestation: Attestation,
 }
 
 #[derive(Debug, Clone)]
@@ -97,10 +107,10 @@ fn validate_claims(claims: &CaptureTrustClaims) -> Result<()> {
     }
 
     let valid_methods = ["sandbox", "app_check", "app_attest"];
-    if !valid_methods.contains(&claims.method.as_str()) {
+    if !valid_methods.contains(&claims.attestation.method.as_str()) {
         return Err(ValidationError::InvalidJwt(format!(
-            "Invalid method '{}', expected one of: {:?}",
-            claims.method, valid_methods
+            "Invalid attestation method '{}', expected one of: {:?}",
+            claims.attestation.method, valid_methods
         )));
     }
 
@@ -179,19 +189,34 @@ mod tests {
     #[test]
     fn parse_valid_jwt() {
         let header = r#"{"alg":"ES256","typ":"JWT","kid":"test-key"}"#;
-        let payload = r#"{"iss":"https://dev-api.signedshot.io","aud":"signedshot","sub":"capture-service","iat":1705312200,"capture_id":"123","publisher_id":"456","device_id":"789","method":"sandbox"}"#;
+        let payload = r#"{"iss":"https://dev-api.signedshot.io","aud":"signedshot","sub":"capture-service","iat":1705312200,"capture_id":"123","publisher_id":"456","device_id":"789","attestation":{"method":"sandbox"}}"#;
         let token = make_jwt(header, payload);
 
         let parsed = parse_jwt(&token).unwrap();
         assert_eq!(parsed.header.alg, "ES256");
         assert_eq!(parsed.claims.capture_id, "123");
-        assert_eq!(parsed.claims.method, "sandbox");
+        assert_eq!(parsed.claims.attestation.method, "sandbox");
+        assert_eq!(parsed.claims.attestation.app_id, None);
+    }
+
+    #[test]
+    fn parse_jwt_with_app_id() {
+        let header = r#"{"alg":"ES256","typ":"JWT","kid":"test-key"}"#;
+        let payload = r#"{"iss":"https://dev-api.signedshot.io","aud":"signedshot","sub":"capture-service","iat":1705312200,"capture_id":"123","publisher_id":"456","device_id":"789","attestation":{"method":"app_check","app_id":"io.foo.bar"}}"#;
+        let token = make_jwt(header, payload);
+
+        let parsed = parse_jwt(&token).unwrap();
+        assert_eq!(parsed.claims.attestation.method, "app_check");
+        assert_eq!(
+            parsed.claims.attestation.app_id,
+            Some("io.foo.bar".to_string())
+        );
     }
 
     #[test]
     fn reject_invalid_algorithm() {
         let header = r#"{"alg":"HS256","typ":"JWT"}"#;
-        let payload = r#"{"iss":"https://dev-api.signedshot.io","aud":"signedshot","sub":"capture-service","iat":1705312200,"capture_id":"123","publisher_id":"456","device_id":"789","method":"sandbox"}"#;
+        let payload = r#"{"iss":"https://dev-api.signedshot.io","aud":"signedshot","sub":"capture-service","iat":1705312200,"capture_id":"123","publisher_id":"456","device_id":"789","attestation":{"method":"sandbox"}}"#;
         let token = make_jwt(header, payload);
 
         let result = parse_jwt(&token);
@@ -201,7 +226,7 @@ mod tests {
     #[test]
     fn reject_invalid_audience() {
         let header = r#"{"alg":"ES256","typ":"JWT"}"#;
-        let payload = r#"{"iss":"https://example.com","aud":"wrong","sub":"capture-service","iat":1705312200,"capture_id":"123","publisher_id":"456","device_id":"789","method":"sandbox"}"#;
+        let payload = r#"{"iss":"https://example.com","aud":"wrong","sub":"capture-service","iat":1705312200,"capture_id":"123","publisher_id":"456","device_id":"789","attestation":{"method":"sandbox"}}"#;
         let token = make_jwt(header, payload);
 
         let result = parse_jwt(&token);
@@ -211,7 +236,7 @@ mod tests {
     #[test]
     fn reject_invalid_method() {
         let header = r#"{"alg":"ES256","typ":"JWT"}"#;
-        let payload = r#"{"iss":"https://dev-api.signedshot.io","aud":"signedshot","sub":"capture-service","iat":1705312200,"capture_id":"123","publisher_id":"456","device_id":"789","method":"invalid"}"#;
+        let payload = r#"{"iss":"https://dev-api.signedshot.io","aud":"signedshot","sub":"capture-service","iat":1705312200,"capture_id":"123","publisher_id":"456","device_id":"789","attestation":{"method":"invalid"}}"#;
         let token = make_jwt(header, payload);
 
         let result = parse_jwt(&token);

{signedshot-0.1.2 → signedshot-0.1.4}/src/python.rs

@@ -35,6 +35,7 @@ impl PyValidationResult {
         dict.set_item("device_id", &self.inner.capture_trust.device_id)?;
         dict.set_item("capture_id", &self.inner.capture_trust.capture_id)?;
         dict.set_item("method", &self.inner.capture_trust.method)?;
+        dict.set_item("app_id", &self.inner.capture_trust.app_id)?;
         dict.set_item("issued_at", self.inner.capture_trust.issued_at)?;
         dict.set_item("key_id", &self.inner.capture_trust.key_id)?;
         Ok(dict)

{signedshot-0.1.2 → signedshot-0.1.4}/src/validate.rs

@@ -29,6 +29,8 @@ pub struct CaptureTrustResult {
     pub capture_id: String,
     /// Attestation method (sandbox, app_check, app_attest)
     pub method: String,
+    /// App ID from attestation (e.g., bundle ID), if available
+    pub app_id: Option<String>,
     /// Unix timestamp when the JWT was issued
     pub issued_at: i64,
     /// Key ID used to sign the JWT
@@ -47,7 +49,8 @@ impl CaptureTrustResult {
             publisher_id: claims.publisher_id.clone(),
             device_id: claims.device_id.clone(),
             capture_id: claims.capture_id.clone(),
-            method: claims.method.clone(),
+            method: claims.attestation.method.clone(),
+            app_id: claims.attestation.app_id.clone(),
             issued_at: claims.iat,
             key_id,
         }
@@ -257,6 +260,7 @@ mod tests {
                 device_id: "dev-456".to_string(),
                 capture_id: "cap-789".to_string(),
                 method: "sandbox".to_string(),
+                app_id: None,
                 issued_at: 1705312200,
                 key_id: Some("key-1".to_string()),
             },
@@ -289,6 +293,7 @@ mod tests {
                 device_id: "dev-456".to_string(),
                 capture_id: "cap-789".to_string(),
                 method: "sandbox".to_string(),
+                app_id: None,
                 issued_at: 1705312200,
                 key_id: None,
             },