algovoi-rfc9421-a2a
A2A per-message signing adapter binding the AlgoVoi RFC 9421 signer, verifier, and keyid resolver to the A2A message envelope. Thin glue over three shipped, hardened primitives; no new cryptography.
- Signs and verifies A2A JSON-RPC requests with RFC 9421 (HTTP Message
Signatures) + RFC 9530 (Content-Digest) over
application/a2a+json. - Resolves the signer
keyidwith the SSRF-guardedalgovoi-rfc9421-keyidresolver (did:key/did:web/ HTTPS). - Enforces the Sprint A hardening: replay window, single-use nonce,
taganti cross-protocol reuse, and an algorithm allow-list.
Layers
This is the per-message signature layer (does this specific request come from the key holder). It is orthogonal to A2A AgentCard signing (spec 8.4, JWS over the card document) and composes with it.
Trust boundary
Verifying a signature proves the request was signed by the holder of the key
that keyid resolves to. It does not by itself prove the sender's identity;
that binding is a policy decision the caller owns, normally via the agent's
8.4-signed AgentCard. verify_a2a_request therefore requires expected_keyid,
an authorize_keyid predicate, or an explicit require_keyid_authorization=False
opt-out. It will not silently trust an attacker-chosen keyid.
Install
pip install algovoi-rfc9421-a2a
Apache-2.0.
1 maintainer
Metadata
1 maintainer
Release files for algovoi-rfc9421-a2a 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| algovoi_rfc9421_a2a-0.1.0.tar.gz | 10.1 kB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| algovoi_rfc9421_a2a-0.1.0-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 20.6 kB
Release files / algovoi_rfc9421_a2a-0.1.0.tar.gz
| Download URL | algovoi_rfc9421_a2a-0.1.0.tar.gz |
|---|---|
| Size | 10.1 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
b50942ee6d02bf27cb89c43d0812d6e718a44677555ffaa28c8ec670e6f943c4
|
|
BLAKE2b-256 checksum How to use checksums |
2549c6c512dafd4a565563aaa9f5db288898ec4946f690731571699cd1256594
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.12.10
|
Release files / algovoi_rfc9421_a2a-0.1.0-py3-none-any.whl
| Download URL | algovoi_rfc9421_a2a-0.1.0-py3-none-any.whl |
|---|---|
| Size | 10.5 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
e9b13ce607fabc7f4a0d49e305d686a96a447f2d3b20e869e92c83a87b264a8a
|
|
BLAKE2b-256 checksum How to use checksums |
7ea8a1cbac8a0e9b44f5502cb4ec50b11ddcf2bd2c0c4cdc944e413dbcbfb04b
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.12.10
|
Security for algovoi-rfc9421-a2a 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
