signedshot 0.1.4__tar.gz → 0.1.5__tar.gz

{signedshot-0.1.4 → signedshot-0.1.5}/Cargo.lock

@@ -1331,7 +1331,7 @@ dependencies = [
 
 [[package]]
 name = "signedshot-validator"
-version = "0.1.4"
+version = "0.1.5"
 dependencies = [
  "anyhow",
  "base64",

{signedshot-0.1.4 → signedshot-0.1.5}/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "signedshot-validator"
-version = "0.1.4"
+version = "0.1.5"
 edition = "2021"
 description = "Validator for SignedShot media authenticity proofs"
 license = "MIT"

signedshot-0.1.5/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 SignedShot
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

signedshot-0.1.5/PKG-INFO

@@ -0,0 +1,133 @@
+Metadata-Version: 2.4
+Name: signedshot
+Version: 0.1.5
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.8
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Rust
+Classifier: Topic :: Security :: Cryptography
+License-File: LICENSE
+Summary: Validator for SignedShot media authenticity proofs
+Keywords: signedshot,media,authenticity,validation,cryptography
+License: MIT
+Requires-Python: >=3.8
+Description-Content-Type: text/markdown; charset=UTF-8; variant=GFM
+Project-URL: Homepage, https://signedshot.io
+Project-URL: Repository, https://github.com/SignedShot/signedshot-validator
+
+# SignedShot
+
+Verify SignedShot media authenticity proofs in Python.
+
+[![PyPI](https://img.shields.io/pypi/v/signedshot)](https://pypi.org/project/signedshot/)
+
+## Installation
+
+```bash
+pip install signedshot
+```
+
+## Quick Start
+
+```python
+import signedshot
+
+# Validate from files
+result = signedshot.validate_files("photo.sidecar.json", "photo.jpg")
+
+print(result.valid)   # True if all checks pass
+print(result.error)   # Error message if validation failed
+```
+
+## Usage
+
+### Validate from Files
+
+```python
+result = signedshot.validate_files("photo.sidecar.json", "photo.jpg")
+```
+
+### Validate from Bytes
+
+```python
+with open("photo.sidecar.json") as f:
+    sidecar_json = f.read()
+with open("photo.jpg", "rb") as f:
+    media_bytes = f.read()
+
+result = signedshot.validate(sidecar_json, media_bytes)
+```
+
+### Validate with Pre-loaded JWKS
+
+Avoid HTTP calls by providing JWKS directly:
+
+```python
+import requests
+
+jwks = requests.get("https://api.signedshot.io/.well-known/jwks.json").text
+result = signedshot.validate_with_jwks(sidecar_json, media_bytes, jwks)
+```
+
+## Validation Result
+
+```python
+result = signedshot.validate_files("photo.sidecar.json", "photo.jpg")
+
+# Overall result
+result.valid      # True/False
+result.version    # Sidecar format version
+result.error      # Error message (if any)
+
+# Capture trust (JWT verification)
+trust = result.capture_trust
+trust["signature_valid"]   # JWT signature verified
+trust["issuer"]            # API that issued the token
+trust["publisher_id"]      # Publisher ID
+trust["device_id"]         # Device ID
+trust["capture_id"]        # Capture session ID
+trust["method"]            # "sandbox", "app_check", or "app_attest"
+trust["app_id"]            # App bundle ID (if attested)
+trust["issued_at"]         # Unix timestamp
+
+# Media integrity (content verification)
+integrity = result.media_integrity
+integrity["content_hash_valid"]   # SHA-256 hash matches
+integrity["signature_valid"]      # ECDSA signature verified
+integrity["capture_id_match"]     # Capture IDs match
+integrity["content_hash"]         # SHA-256 of media
+integrity["captured_at"]          # ISO8601 timestamp
+
+# Export
+result.to_dict()   # Convert to dictionary
+result.to_json()   # Convert to JSON string
+```
+
+## What It Validates
+
+1. **Capture Trust (JWT)**
+   - Fetches JWKS from issuer
+   - Verifies ES256 signature
+   - Extracts attestation claims
+
+2. **Media Integrity**
+   - Computes SHA-256 of media
+   - Verifies ECDSA signature
+   - Confirms capture_id matches
+
+## Links
+
+- [Documentation](https://signedshot.io/docs)
+- [GitHub](https://github.com/SignedShot/signedshot-validator)
+- [Website](https://signedshot.io)
+
+## License
+
+MIT
+

signedshot-0.1.5/README.md

@@ -0,0 +1,205 @@
+# SignedShot Validator
+
+Verify SignedShot media authenticity proofs. Available as a Rust CLI and Python library.
+
+[![PyPI](https://img.shields.io/pypi/v/signedshot)](https://pypi.org/project/signedshot/)
+[![CI](https://github.com/SignedShot/signedshot-validator/actions/workflows/ci.yml/badge.svg)](https://github.com/SignedShot/signedshot-validator/actions/workflows/ci.yml)
+
+## Overview
+
+SignedShot is an open protocol for proving photos and videos haven't been altered since capture. This validator verifies the cryptographic proofs (sidecars) generated by the SignedShot iOS SDK.
+
+## Installation
+
+### Python (PyPI)
+
+```bash
+pip install signedshot
+```
+
+### Rust (Cargo)
+
+```bash
+cargo install signedshot-validator
+```
+
+## Python Library
+
+```python
+import signedshot
+
+# Validate from files
+result = signedshot.validate_files("photo.sidecar.json", "photo.jpg")
+
+print(result.valid)           # True/False
+print(result.version)         # Sidecar format version
+print(result.error)           # Error message if validation failed
+
+# Capture trust (JWT verification)
+trust = result.capture_trust
+print(trust["signature_valid"])  # JWT signature verified
+print(trust["issuer"])           # API that issued the token
+print(trust["publisher_id"])     # Publisher ID
+print(trust["device_id"])        # Device ID
+print(trust["capture_id"])       # Capture session ID
+print(trust["method"])           # Attestation: "sandbox", "app_check", or "app_attest"
+print(trust["app_id"])           # App bundle ID (if attested)
+print(trust["issued_at"])        # Unix timestamp
+
+# Media integrity (content verification)
+integrity = result.media_integrity
+print(integrity["content_hash_valid"])  # SHA-256 hash matches
+print(integrity["signature_valid"])     # ECDSA signature verified
+print(integrity["capture_id_match"])    # Capture IDs match
+print(integrity["content_hash"])        # SHA-256 of media
+print(integrity["captured_at"])         # ISO8601 timestamp
+```
+
+### Validate from Bytes
+
+```python
+# Validate from in-memory data
+with open("photo.sidecar.json") as f:
+    sidecar_json = f.read()
+with open("photo.jpg", "rb") as f:
+    media_bytes = f.read()
+
+result = signedshot.validate(sidecar_json, media_bytes)
+```
+
+### Validate with Pre-loaded JWKS
+
+```python
+# Avoid HTTP call by providing JWKS directly
+import requests
+
+jwks = requests.get("https://api.signedshot.io/.well-known/jwks.json").text
+result = signedshot.validate_with_jwks(sidecar_json, media_bytes, jwks)
+```
+
+### Convert to Dict/JSON
+
+```python
+# Get result as dictionary
+data = result.to_dict()
+
+# Get result as JSON string
+json_str = result.to_json()
+```
+
+## CLI Usage
+
+### Validate Media
+
+```bash
+# Basic validation
+signedshot validate photo.sidecar.json photo.jpg
+
+# Output as JSON
+signedshot validate photo.sidecar.json photo.jpg --json
+```
+
+### Parse Sidecar (without validation)
+
+```bash
+signedshot parse photo.sidecar.json
+```
+
+### Example Output
+
+```
+Validating sidecar: photo.sidecar.json
+Media file: photo.jpg
+[OK] Sidecar parsed
+[OK] JWT decoded
+  Issuer: https://api.signedshot.io
+  Publisher: 9a5b1062-a8fe-4871-bdc1-fe54e96cbf1c
+  Device: ea5c9bfe-6bbc-4ee2-b82d-0bcfcc185ef1
+  Capture: ac85dbd2-d8a8-4d0b-9e39-2feef5f7b19f
+  Method: app_check
+  App ID: io.signedshot.capture
+[OK] JWT signature verified
+[OK] Content hash matches
+[OK] Media signature verified
+[OK] Capture IDs match
+
+✓ VALID - Media authenticity verified
+```
+
+## What It Validates
+
+### 1. Capture Trust (JWT)
+
+- Fetches JWKS from issuer (or uses provided keys)
+- Verifies ES256 (P-256 ECDSA) signature
+- Extracts claims: publisher, device, capture ID, attestation method
+
+### 2. Media Integrity
+
+- Computes SHA-256 hash of media file
+- Compares with `content_hash` in sidecar
+- Verifies ECDSA signature over integrity data
+- Confirms `capture_id` matches JWT
+
+### 3. Cross-Validation
+
+- Ensures capture_id in JWT matches capture_id in media_integrity
+- Validates all timestamps and formats
+
+## Building from Source
+
+### Rust CLI
+
+```bash
+git clone https://github.com/SignedShot/signedshot-validator.git
+cd signedshot-validator
+
+cargo build --release
+./target/release/signedshot --help
+```
+
+### Python Wheels
+
+```bash
+# Install maturin
+pip install maturin
+
+# Build wheel
+cd python
+maturin build --release
+
+# Install locally
+pip install ../target/wheels/signedshot-*.whl
+```
+
+## Development
+
+```bash
+# Format
+cargo fmt
+
+# Lint
+cargo clippy -- -D warnings
+
+# Test
+cargo test
+
+# Build
+cargo build --release
+```
+
+## Related Repositories
+
+- [signedshot-api](https://github.com/SignedShot/signedshot-api) - Backend API
+- [signedshot-ios](https://github.com/SignedShot/signedshot-ios) - iOS SDK
+
+## Links
+
+- [PyPI Package](https://pypi.org/project/signedshot/)
+- [Website](https://signedshot.io)
+- [Documentation](https://signedshot.io/docs)
+- [Interactive Demo](https://signedshot.io/demo)
+
+## License
+
+MIT License - see [LICENSE](LICENSE) for details.

{signedshot-0.1.4 → signedshot-0.1.5}/pyproject.toml

@@ -4,9 +4,9 @@ build-backend = "maturin"
 
 [project]
 name = "signedshot"
-version = "0.1.4"
+version = "0.1.5"
 description = "Validator for SignedShot media authenticity proofs"
-readme = "README.md"
+readme = "python/README.md"
 license = { text = "MIT" }
 requires-python = ">=3.8"
 classifiers = [

signedshot-0.1.5/python/README.md

@@ -0,0 +1,109 @@
+# SignedShot
+
+Verify SignedShot media authenticity proofs in Python.
+
+[![PyPI](https://img.shields.io/pypi/v/signedshot)](https://pypi.org/project/signedshot/)
+
+## Installation
+
+```bash
+pip install signedshot
+```
+
+## Quick Start
+
+```python
+import signedshot
+
+# Validate from files
+result = signedshot.validate_files("photo.sidecar.json", "photo.jpg")
+
+print(result.valid)   # True if all checks pass
+print(result.error)   # Error message if validation failed
+```
+
+## Usage
+
+### Validate from Files
+
+```python
+result = signedshot.validate_files("photo.sidecar.json", "photo.jpg")
+```
+
+### Validate from Bytes
+
+```python
+with open("photo.sidecar.json") as f:
+    sidecar_json = f.read()
+with open("photo.jpg", "rb") as f:
+    media_bytes = f.read()
+
+result = signedshot.validate(sidecar_json, media_bytes)
+```
+
+### Validate with Pre-loaded JWKS
+
+Avoid HTTP calls by providing JWKS directly:
+
+```python
+import requests
+
+jwks = requests.get("https://api.signedshot.io/.well-known/jwks.json").text
+result = signedshot.validate_with_jwks(sidecar_json, media_bytes, jwks)
+```
+
+## Validation Result
+
+```python
+result = signedshot.validate_files("photo.sidecar.json", "photo.jpg")
+
+# Overall result
+result.valid      # True/False
+result.version    # Sidecar format version
+result.error      # Error message (if any)
+
+# Capture trust (JWT verification)
+trust = result.capture_trust
+trust["signature_valid"]   # JWT signature verified
+trust["issuer"]            # API that issued the token
+trust["publisher_id"]      # Publisher ID
+trust["device_id"]         # Device ID
+trust["capture_id"]        # Capture session ID
+trust["method"]            # "sandbox", "app_check", or "app_attest"
+trust["app_id"]            # App bundle ID (if attested)
+trust["issued_at"]         # Unix timestamp
+
+# Media integrity (content verification)
+integrity = result.media_integrity
+integrity["content_hash_valid"]   # SHA-256 hash matches
+integrity["signature_valid"]      # ECDSA signature verified
+integrity["capture_id_match"]     # Capture IDs match
+integrity["content_hash"]         # SHA-256 of media
+integrity["captured_at"]          # ISO8601 timestamp
+
+# Export
+result.to_dict()   # Convert to dictionary
+result.to_json()   # Convert to JSON string
+```
+
+## What It Validates
+
+1. **Capture Trust (JWT)**
+   - Fetches JWKS from issuer
+   - Verifies ES256 signature
+   - Extracts attestation claims
+
+2. **Media Integrity**
+   - Computes SHA-256 of media
+   - Verifies ECDSA signature
+   - Confirms capture_id matches
+
+## Links
+
+- [Documentation](https://signedshot.io/docs)
+- [GitHub](https://github.com/SignedShot/signedshot-validator)
+- [Website](https://signedshot.io)
+
+## License
+
+MIT

signedshot-0.1.4/PKG-INFO

@@ -1,63 +0,0 @@
-Metadata-Version: 2.4
-Name: signedshot
-Version: 0.1.4
-Classifier: Development Status :: 4 - Beta
-Classifier: Intended Audience :: Developers
-Classifier: License :: OSI Approved :: MIT License
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.8
-Classifier: Programming Language :: Python :: 3.9
-Classifier: Programming Language :: Python :: 3.10
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
-Classifier: Programming Language :: Rust
-Classifier: Topic :: Security :: Cryptography
-Summary: Validator for SignedShot media authenticity proofs
-Keywords: signedshot,media,authenticity,validation,cryptography
-License: MIT
-Requires-Python: >=3.8
-Description-Content-Type: text/markdown; charset=UTF-8; variant=GFM
-Project-URL: Homepage, https://signedshot.io
-Project-URL: Repository, https://github.com/SignedShot/signedshot-validator
-
-# SignedShot Validator
-
-Validator for SignedShot media authenticity proofs.
-
-## Overview
-
-SignedShot is a media authenticity verification system. This validator checks cryptographic proofs (sidecars) that verify media was captured on a legitimate device.
-
-## Installation
-
-```bash
-cargo install signedshot-validator
-```
-
-## Usage
-
-```bash
-signedshot validate photo.sidecar.json
-```
-
-## Development
-
-Run these checks locally before pushing (same as CI):
-
-```bash
-cargo fmt --check   # Check formatting
-cargo clippy -- -D warnings   # Lint
-cargo test   # Run tests
-cargo build --release   # Build
-```
-
-To fix formatting automatically:
-
-```bash
-cargo fmt
-```
-
-## License
-
-MIT
-

signedshot-0.1.4/README.md

@@ -1,40 +0,0 @@
-# SignedShot Validator
-
-Validator for SignedShot media authenticity proofs.
-
-## Overview
-
-SignedShot is a media authenticity verification system. This validator checks cryptographic proofs (sidecars) that verify media was captured on a legitimate device.
-
-## Installation
-
-```bash
-cargo install signedshot-validator
-```
-
-## Usage
-
-```bash
-signedshot validate photo.sidecar.json
-```
-
-## Development
-
-Run these checks locally before pushing (same as CI):
-
-```bash
-cargo fmt --check   # Check formatting
-cargo clippy -- -D warnings   # Lint
-cargo test   # Run tests
-cargo build --release   # Build
-```
-
-To fix formatting automatically:
-
-```bash
-cargo fmt
-```
-
-## License
-
-MIT